@sema-agent/core 5.48.0 → 5.50.0

package/dist/core/mcp.js

@@ -650,7 +650,30 @@ export function mcpToolSchemaProblem(schema) {
     }
     return undefined;
 }
-export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure) {
+export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations) {
+    let revocationProbeFailed = false;
+    const isServerRevoked = (serverName) => {
+        if (mcpRevocations === undefined)
+            return false;
+        try {
+            const r = mcpRevocations.isRevoked(serverName);
+            if (typeof r !== "boolean") {
+                throw new Error(`isRevoked returned ${r instanceof Promise ? "a Promise — the ledger seat is SYNCHRONOUS by contract" : `a non-boolean (${typeof r})`}`);
+            }
+            return r;
+        }
+        catch (e) {
+            if (!revocationProbeFailed) {
+                revocationProbeFailed = true;
+                try {
+                    mcpRevocations.onProbeFailure?.(e);
+                }
+                catch {
+                }
+            }
+            return false;
+        }
+    };
     const mcpDisclosure = reminderDisclosure?.reminderMark !== undefined
         ? { mark: reminderDisclosure.reminderMark, windows: new Map(), ...(reminderDisclosure.counts !== undefined ? { counts: reminderDisclosure.counts } : {}) }
         : undefined;
@@ -665,7 +688,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const droppedTools = [];
     let disposing = false;
     const serverHandles = [];
-    const settled = await Promise.allSettled(specs.map((spec) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure)));
+    const settled = await Promise.allSettled(specs.map((spec) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked)));
     try {
         for (let i = 0; i < specs.length; i++) {
             const r = settled[i];
@@ -701,7 +724,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                 statuses.push({ name: spec.name, status: "failed", error: namedMcpFailureText(r.reason) });
             }
         }
-        const resourceTools = buildResourceTools(resourceServers);
+        const resourceTools = buildResourceTools(resourceServers, isServerRevoked);
         tools.push(...resourceTools.tools);
         toolAxes.push(...resourceTools.axes);
     }
@@ -729,10 +752,14 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     results.push({ server: h.name, prefix: prefixOf(h.name), status: "not_connected", toolCount: 0, added: [], removed: [] });
                     continue;
                 }
+                if (isServerRevoked(h.name)) {
+                    results.push({ server: h.name, prefix: prefixOf(h.name), status: "revoked", toolCount: 0, added: [], removed: [], error: "server revoked by the operator — the refresh did not contact it" });
+                    continue;
+                }
                 try {
                     const listed = await listToolsLenient(h.client);
                     cacheMcpToolMetadata(h.client, listed.tools);
-                    const { serverTools, serverAxes, dropped } = intakeListedTools(listed, h.spec, h.client, h.health, imageResizer, mcpDisclosure);
+                    const { serverTools, serverAxes, dropped } = intakeListedTools(listed, h.spec, h.client, h.health, imageResizer, mcpDisclosure, isServerRevoked);
                     const newNames = serverTools.map((t) => t.name);
                     const added = newNames.filter((n) => !h.toolNames.includes(n));
                     const removed = h.toolNames.filter((n) => !newNames.includes(n));
@@ -882,7 +909,7 @@ function renderDirChildren(server, uri, children, flags) {
         terminate: false,
     };
 }
-function buildResourceTools(resourceServers) {
+function buildResourceTools(resourceServers, isServerRevoked = () => false) {
     const listable = resourceServers.filter((rs) => rs.listAllowed);
     const readable = resourceServers.filter((rs) => rs.readAllowed);
     if (listable.length === 0 && readable.length === 0)
@@ -910,6 +937,11 @@ function buildResourceTools(resourceServers) {
                 const all = [];
                 const errors = [];
                 for (const rs of targets) {
+                    if (isServerRevoked(rs.server)) {
+                        errors.push({ server: rs.server, error: "server revoked by the operator mid-session (request not sent)" });
+                        sections.push(`[${rs.server}] Error: server revoked by the operator — its resources are unavailable this turn.`);
+                        continue;
+                    }
                     if (rs.health.dead) {
                         errors.push({ server: rs.server, error: "server disconnected (transport closed earlier in this task)" });
                         sections.push(`[${rs.server}] Error: server disconnected — its resources are unavailable.`);
@@ -970,6 +1002,14 @@ function buildResourceTools(resourceServers) {
                 if (!rs)
                     return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with readable resources. Available: ${serverNames(readable)}.` }], details: undefined, terminate: false };
                 const what = `The read of resource ${inlineUntrusted(uri)}`;
+                if (isServerRevoked(server)) {
+                    return {
+                        content: [{ type: "text", text: `${what} was refused: MCP server "${server}" was revoked by the operator mid-session. The request was NOT sent. The tool list updates at the next turn.` }],
+                        details: { error: "mcp.server_revoked", code: "mcp.server_revoked", server },
+                        terminate: false,
+                        isError: true,
+                    };
+                }
                 if (rs.health.dead)
                     throwDeadServer(server, what);
                 const timeoutMs = mcpToolTimeoutMs();
@@ -1021,6 +1061,14 @@ function buildResourceTools(resourceServers) {
                 if (!rs)
                     return { content: [{ type: "text", text: `Error: no MCP server ${inlineUntrusted(server)} with listable resources. Available: ${serverNames(listable)}.` }], details: undefined, terminate: false };
                 const what = `The directory listing of ${inlineUntrusted(uri)}`;
+                if (isServerRevoked(server)) {
+                    return {
+                        content: [{ type: "text", text: `${what} was refused: MCP server "${server}" was revoked by the operator mid-session. The request was NOT sent. The tool list updates at the next turn.` }],
+                        details: { error: "mcp.server_revoked", code: "mcp.server_revoked", server },
+                        terminate: false,
+                        isError: true,
+                    };
+                }
                 if (rs.health.dead)
                     throwDeadServer(server, what);
                 const timeoutMs = mcpToolTimeoutMs();
@@ -1123,7 +1171,7 @@ const LENIENT_CALL_TOOL_RESULT_SCHEMA = { safeParse: parseCallToolResultLenient
 async function listToolsLenient(client, options) {
     return client.request({ method: "tools/list", params: {} }, LenientListToolsResultSchema, options);
 }
-async function connectServer(spec, principal, onElicit, imageResizer, reminderDisclosure) {
+async function connectServer(spec, principal, onElicit, imageResizer, reminderDisclosure, isServerRevoked) {
     const elicitOn = spec.elicitation === true && onElicit !== undefined;
     const health = { dead: false, pendingElicitations: 0, lastElicitationClosedAt: 0 };
     const client = new Client({ name: `sema-core/${spec.name}`, version: "0.1.0" }, { capabilities: elicitOn ? { elicitation: { form: {} } } : {} });
@@ -1159,7 +1207,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         };
         const listed = await listToolsLenient(client, startupOpts);
         cacheMcpToolMetadata(client, listed.tools);
-        const { serverTools, serverAxes, dropped } = intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure);
+        const { serverTools, serverAxes, dropped } = intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked);
         const caps = client.getServerCapabilities();
         const resourceInfo = caps?.resources
             ? {
@@ -1192,7 +1240,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         throw err;
     }
 }
-function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure) {
+function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked) {
     const serverTools = [];
     const serverAxes = [];
     const dropped = [];
@@ -1235,6 +1283,14 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
             ...(mcpAlwaysLoad ? { mcpAlwaysLoad: true } : {}),
             execute: async (_toolCallId, params, signal) => {
                 const what = `The call to tool ${inlineUntrusted(remoteName)}`;
+                if (isServerRevoked?.(spec.name) === true) {
+                    return {
+                        content: [{ type: "text", text: `The call to MCP server "${spec.name}" was refused: the server was revoked by the operator mid-session. The call was NOT sent, so the server did not execute it. The tool list updates at the next turn.` }],
+                        details: { error: "mcp.server_revoked", code: "mcp.server_revoked", server: spec.name },
+                        terminate: false,
+                        isError: true,
+                    };
+                }
                 if (health.dead)
                     throwDeadServer(spec.name, what);
                 const timeoutMs = mcpToolTimeoutMs();

package/dist/core/memory-engine/delegation-settlement.d.ts

@@ -221,6 +221,11 @@ export interface HoldRow {
     };
     /** Host valve verdict awaiting the next harvest ("release" commits with cause "static"). */
     resolved?: "release" | "discard";
+    /** The verdict's GENERATION (strictly increases on every re-resolution): the settle leg's
+     *  consumed-verdict exit clears only the exact generation it read, so a host re-resolution
+     *  racing a failing release attempt is never erased by the stale attempt's cleanup. Absent on
+     *  rows resolved before the member existed (a generation-less clear matches those). */
+    resolvedAt?: number;
 }
 export declare function readHolds(controlDir: string): HoldRow[];
 /** ATOMIC no-replace restore of a staged file onto a plane path (adversarial round 2: an
@@ -308,6 +313,28 @@ export declare function resolveHoldRecord(controlDir: string, input: {
     requestId: string;
     now: () => number;
 }): void;
+/**
+ * Consume a standing valve verdict WITHOUT any other transition — the settle leg's exit for a
+ * valve release that FAILED on an already-disposed row (an expired hold whose release hit a
+ * judgment refusal: lost custody, re-scan refusal, CAS conflict). `disposeHold` is a no-op there
+ * (the row is already terminal), so leaving `resolved` standing would re-run the identical failing
+ * release — and re-announce a disposal that never happened — on every subsequent harvest, forever.
+ * Clearing it returns the row to its plain disposed/expired state: the failure is disclosed by the
+ * caller, custody/quarantine bytes stay addressable, and `resolveHold(holdId, "release")` remains
+ * admissible after the host reconciles. GENERATION-KEYED: only the exact verdict generation the
+ * caller read is cleared — a host re-resolution that landed while the failing attempt was in
+ * flight is a NEWER generation and stands (the stale attempt's cleanup must not erase a live host
+ * action). A generation-less verdict (a row written before the member existed) is consumable
+ * against a generation-less read — every CURRENT writer mints a generation, so the only verdict
+ * such a clear can erase is one written by a PRE-generation writer racing on the same control
+ * plane: the standing mixed-version-writer class the upgrade-order duty prices, kept consumable
+ * on purpose (refusing it would revive the forever-re-firing valve loop for every verdict minted
+ * before the upgrade). Idempotent; unknown/verdict-less/other-generation rows are a no-op.
+ */
+export declare function clearHoldResolution(controlDir: string, input: {
+    holdId: string;
+    ifResolvedAt: number | undefined;
+}): void;
 /** Read one hold's custody bytes (release leg + expired-release valve). Returns undefined when
  *  the custody file is gone or fails its digest — the caller records capture_lost, never commits
  *  unverified bytes. For an expired-released row the bytes may already sit in quarantine

package/dist/core/memory-engine/delegation-settlement.js

@@ -346,6 +346,7 @@ function coerceHolds(raw) {
             !HOLD_STATUSES.has(row.status) ||
             (row.disposition !== undefined && (typeof row.disposition !== "object" || row.disposition === null || !HOLD_TERMINALS.has(row.disposition.terminal) || (row.disposition.quarantineName !== undefined && !safeBasename(row.disposition.quarantineName)))) ||
             (row.resolved !== undefined && row.resolved !== "release" && row.resolved !== "discard") ||
+            (row.resolvedAt !== undefined && (typeof row.resolvedAt !== "number" || !Number.isSafeInteger(row.resolvedAt) || row.resolvedAt < 0 || row.resolvedAt >= 2 ** 50 || row.resolved === undefined)) ||
             (row.entryId !== undefined && typeof row.entryId !== "string") ||
             (row.baseRev !== undefined && typeof row.baseRev !== "string") ||
             (row.op === "update" && (!reqStr(row.entryId) || !reqStr(row.baseRev))) ||
@@ -401,6 +402,14 @@ export function openInstructionHold(controlDir, input) {
     const digest = sha256(buf);
     const captureName = `${holdId}.md`;
     const holdDir = join(controlDir, HOLD_DIR);
+    const refuse = (reason, terminal) => {
+        try {
+            disposeHold(controlDir, { holdId, terminal, now: input.now });
+        }
+        catch {
+        }
+        return { ok: false, holdId, reason };
+    };
     try {
         lockedStrictUpdate(controlDir, HOLDS_FILE, "memory instruction-hold ledger", coerceHolds, (rec) => {
             if (rec.rows.some((r) => r.holdId === holdId))
@@ -431,10 +440,10 @@ export function openInstructionHold(controlDir, input) {
         writeFileSync(join(holdDir, captureName), buf, { flag: "wx" });
         const back = readFileSync(join(holdDir, captureName));
         if (sha256(back) !== digest)
-            return { ok: false, holdId, reason: "hold capture verification failed (written bytes do not hash to the captured digest)" };
+            return refuse("hold capture verification failed (written bytes do not hash to the captured digest)", "capture_lost");
     }
     catch (err) {
-        return { ok: false, holdId, reason: `hold capture failed: ${err instanceof Error ? err.message : String(err)}` };
+        return refuse(`hold capture failed: ${err instanceof Error ? err.message : String(err)}`, "capture_lost");
     }
     const stagingName = uniqueStagingName(holdId, input.now);
     const stagingPath = join(holdDir, stagingName);
@@ -447,7 +456,7 @@ export function openInstructionHold(controlDir, input) {
         if (code === "ENOENT") {
         }
         else {
-            return { ok: false, holdId, reason: `hold removal failed (${code ?? "rename error"}): the plane file was not moved` };
+            return refuse(`hold removal failed (${code ?? "rename error"}): the plane file was not moved`, "discarded");
         }
     }
     if (existsSync(stagingPath)) {
@@ -475,7 +484,7 @@ export function openInstructionHold(controlDir, input) {
         });
     }
     catch (err) {
-        return { ok: false, holdId, reason: `hold ledger flip refused: ${err instanceof Error ? err.message : String(err)}` };
+        return refuse(`hold ledger flip refused: ${err instanceof Error ? err.message : String(err)}`, "discarded");
     }
     return { ok: true, holdId, ...(thirdWriterStranded !== undefined ? { thirdWriterStranded } : {}) };
 }
@@ -604,6 +613,7 @@ export function markHoldReleased(controlDir, input) {
             return { result: undefined };
         r.status = "released";
         delete r.resolved;
+        delete r.resolvedAt;
         return { next: rec, result: r.captureName };
     });
     if (captureName === undefined)
@@ -638,6 +648,23 @@ export function resolveHoldRecord(controlDir, input) {
             throw e;
         }
         r.resolved = input.action;
+        const nextGeneration = Math.max(input.now(), 0, (r.resolvedAt ?? 0) + 1);
+        if (!Number.isSafeInteger(nextGeneration) || nextGeneration < 0 || nextGeneration >= 2 ** 50) {
+            const e = new Error(`resolveHold: hold ${JSON.stringify(input.holdId)} cannot mint a fresh verdict generation (${String(nextGeneration)} — an exhausted window, a deranged clock, or a corrupt ledger row) — refused, never written.`);
+            e.code = "memory.hold_resolve_invalid_state";
+            throw e;
+        }
+        r.resolvedAt = nextGeneration;
+        return { next: rec, result: undefined };
+    });
+}
+export function clearHoldResolution(controlDir, input) {
+    lockedStrictUpdate(controlDir, HOLDS_FILE, "memory instruction-hold ledger", coerceHolds, (rec) => {
+        const r = rec.rows.find((x) => x.holdId === input.holdId);
+        if (r === undefined || r.resolved === undefined || r.resolvedAt !== input.ifResolvedAt)
+            return { result: undefined };
+        delete r.resolved;
+        delete r.resolvedAt;
         return { next: rec, result: undefined };
     });
 }

package/dist/core/memory-engine/dual-root.js

@@ -75,5 +75,16 @@ export function mergeHarvestReports(a, b) {
     const qf = [...(a.quarantineFailures ?? []), ...(b.quarantineFailures ?? [])];
     if (qf.length > 0)
         merged.quarantineFailures = qf;
+    const ac = a.containment;
+    const bc = b.containment;
+    if (ac !== undefined || bc !== undefined) {
+        merged.containment = {
+            indexRolledBack: ac?.indexRolledBack === true || bc?.indexRolledBack === true,
+            quarantinedInstruction: [...(ac?.quarantinedInstruction ?? []), ...(bc?.quarantinedInstruction ?? [])],
+            heldInstruction: [...(ac?.heldInstruction ?? []), ...(bc?.heldInstruction ?? [])],
+            releasedHolds: [...(ac?.releasedHolds ?? []), ...(bc?.releasedHolds ?? [])],
+            disposedHolds: [...(ac?.disposedHolds ?? []), ...(bc?.disposedHolds ?? [])],
+        };
+    }
     return merged;
 }

package/dist/core/memory-engine/engine.d.ts

@@ -803,7 +803,12 @@ export declare class MemoryEngine {
      * and a re-call RESUMES it idempotently. Refusals (#123 coded, caller-shape):
      * unattributed/invalid input, unknown/unmarked entry, and a CHALLENGED entry — the clear valve
      * is not a challenge exit (adjudicate the challenge first; clearing a challenged entry would
-     * launder the exclusion through the weaker credential).
+     * launder the exclusion through the weaker credential); the challenged refusal re-judges on the
+     * RESUME path too while the marked entry stands. Two effect-half refusals (terminal, both
+     * states untouched): an on-disk projection diverging from the committed state (the clear never
+     * overwrites unadopted plane bytes — adopt/reconcile first), and a resumed row whose entry is
+     * ABSENT without a recorded committed tombstone (that absence is an independent deletion the
+     * clear never resurrects; the custody bytes stay disclosed on the terminal row).
      */
     clearEntryOrigin(entryId: string, input: {
         requestId: string;
@@ -844,6 +849,11 @@ export declare class MemoryEngine {
      *  the deleted disk file WAS the backend's storage). Zero-copy skips getByIds: its read-side scan
      *  cannot see a deleted file, and calling it mid-harvest would sync-adopt in-session edits. */
     private committedContentFor;
+    /** {@link committedContentFor} with the FAULT axis preserved: `fault: true` means the backend
+     *  read THREW and no shadow answered — "could not read" — which consumers that make destructive
+     *  decisions on absence (the projection-debt settlement clears a row on "entry gone") must
+     *  distinguish from a clean miss. The 8 non-destructive read sites keep the folded face. */
+    private committedContentOrFault;
     /**
      * design/336 §2.2 (r4-9) — the COMMITTED frontmatter an origin carry-forward is computed against.
      * Deliberately NOT {@link committedContentFor}'s non-zero-copy leg: that one calls the backend's
@@ -905,8 +915,32 @@ export declare class MemoryEngine {
     /** Persist the canonical projection back to the session file (id minting / frontmatter completion).
      *  C-F6 (S2-0): called ONLY after the backend transaction committed — never ahead of the journal
      *  commit point. Skips the write when the disk already holds the canonical bytes (zero-copy: the
-     *  journal's own execute step wrote them, making this an idempotent no-op). */
+     *  journal's own execute step wrote them, making this an idempotent no-op). Returns whether the
+     *  disk now holds the canonical bytes — the ordinary completion family stays best-effort on a
+     *  `false` (the next materialize re-projects), but the id-COMPLETION family's caller reads it to
+     *  keep the #366 projection-debt row standing (an id-less plane file must re-bind to its
+     *  committed id at the next harvest, never re-admit as a duplicate). */
     private writeBackProjection;
+    /**
+     * #366 — repair an id-less-but-committed seat IN PLACE (the failed write-back's retry): write the
+     * committed canonical bytes over the seat and settle the debt row on success. Callers have
+     * already proven the seat carries no unadmitted edit (rev equality against its baseline), so the
+     * overwrite is content-preserving — it restores the id line, the completed frontmatter and any
+     * carried marker, nothing else. A refused read/write leaves the row standing (retried next pass;
+     * the next materialize's projection loop repairs and settles it too).
+     */
+    private repairProjectionSeat;
+    /**
+     * #366 — validate a projection-debt row against the COMMITTED state (side-effect-free read: the
+     * retrievalView face in copy-out, never the File backend's adopting `getByIds`). Three-valued on
+     * purpose: `valid` binds, `stale` clears the row (the seat claim dissolved — entry gone, moved or
+     * renamed), and `unknown` (committed state unreadable) makes the caller DEFER the file fail-closed
+     * — treating a transient read fault as "stale" would clear the row and mint the very duplicate
+     * the account exists to close. Zero-copy answers `stale` by construction: there the backend's own
+     * commit writes the id into the plane file, so any standing row is a leftover, and the plain
+     * `getByIds` there would sync-adopt mid-harvest.
+     */
+    private debtCommittedProjection;
     /** Sibling scope subdir names under `dir` (excluded from a scope-tree walk when `dir` is the root —
      *  a root-owning layer's chmod/restore must never touch another scope's home). */
     private siblingScopeDirNames;