@sema-agent/core 5.49.0 → 5.50.0

package/dist/core/runner/prepare-task.js

@@ -277,6 +277,19 @@ function raceAbort(p, signal, onAbort) {
         p.then(finish, () => finish(onAbort()));
     });
 }
+function mcpRevocationWiring(deps) {
+    if (deps.mcpRevocations === undefined)
+        return undefined;
+    const ledger = deps.mcpRevocations;
+    return {
+        isRevoked: (name) => ledger.isRevoked(name),
+        onProbeFailure: (e) => deliverEngineNotice(deps.onNotice, {
+            code: "mcp.revocation_probe_failed",
+            message: `the mcpRevocations.isRevoked probe threw — MCP dispatch fails OPEN (no server treated as revoked) until the probe recovers: ${e instanceof Error ? e.message : String(e)}`,
+            detail: { message: e instanceof Error ? e.message : String(e) },
+        }),
+    };
+}
 async function forgetQuietly(sessions, sessionId) {
     try {
         if (sessions.forget)
@@ -1030,6 +1043,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
                 parentReadFace: () => carrierReadFace(),
                 parentReadDenyPatterns: () => (readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined),
+                ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
                 onNotice: deps.onNotice,
                 parentCheckpointStoreDisabled: spec.checkpointStore === null,
                 parentCenterArtifactDigest: () => centerAdoption?.artifact.artifactDigest,
@@ -1101,7 +1115,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
         mcp = lockedPreflight.mcp?.length
-            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts })
+            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps))
             : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
         for (const w of mcp.warnings)
             deps.onError?.(w, { phase: "mcp", sessionId });

package/dist/core/task-registry-agent.js

@@ -233,6 +233,12 @@ export async function reapDurableAgentsLane(core, scope, deps, policy) {
                 continue;
             }
             rowsReaped++;
+            {
+                const staleInProc = core.handles.get(r.handle);
+                if (staleInProc !== undefined && staleInProc.status !== "running" && staleInProc.status !== "pending" && staleInProc.status !== "parked") {
+                    core.handles.delete(r.handle);
+                }
+            }
             core.reapedHandles.add(r.handle);
             if (deps.mailbox !== undefined) {
                 try {

package/dist/core/types.d.ts

@@ -4730,6 +4730,10 @@ export interface EngineNotice {
      *    `detail: { total, stripped: [{ key, reason }], omitted? }`, the rendered key list bounded in count
      *    and length because the names come from the untrusted script. One aggregated notice per governed
      *    child build, not de-duplicated across builds: each spec is a distinct fact.
+     *  - `"mcp.revocation_probe_failed"` (design/338) — the deployment's `mcpRevocations.isRevoked`
+     *    probe threw; MCP dispatch FAILS OPEN (revocation is a tightening face) and this announces
+     *    once per run. `detail: { message }`. The refusal itself (`mcp.server_revoked`) is a tool
+     *    RESULT code, not a notice.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers }` — key COUNTS only, never the
      *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
@@ -4898,6 +4902,19 @@ export interface RunnerDeps {
     brain: Brain;
     /** Catalog used to resolve string ModelRefs to Model objects. */
     models?: Record<string, Model>;
+    /**
+     * design/338 (mid-turn MCP revocation) — the HOST's revocation ledger, probed synchronously at
+     * every MCP dispatch (tool call + the three resource tools) BEFORE the transport. The engine
+     * never caches the answer: the ledger's one authority lives on the host (a cached copy would be
+     * a split-state second authority). A revoked server's calls settle as the coded refusal
+     * `mcp.server_revoked` with known-not-executed wording; in-flight calls a revocation raced are
+     * deliberately not chased (the threat shape is "new calls after removal"). Absent seat = the
+     * pre-338 semantics. A THROWING probe fails open (revocation is a tightening face — a broken
+     * probe must not brick every MCP call) with a once-per-run `mcp.revocation_probe_failed` notice.
+     */
+    mcpRevocations?: {
+        isRevoked(serverName: string): boolean;
+    };
     /**
      * design/147 S1c (clay ruling 2026-07-18) — the DURABLE name→agent roster behind explicit-name
      * addressing, a storage-tier seam like the checkpoint store: core bundles `MemoryRosterStore`

package/dist/orchestration/run-workflow-tool.d.ts

@@ -234,6 +234,18 @@ export interface RunWorkflowToolDeps {
     parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
     /** Twin of the above for the deny-set additions (union, not replace). */
     parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
+    /** #345 ③ — the HOST task's write-hands clamp, the read-face clamp's sibling on this lane (the
+     *  subagent delegation lane has carried it as `ToolExecuteContext.handsReadOnly` since its own
+     *  tighten-only ruling; the workflow lane was the remaining gap — a read-only host's workflow
+     *  children spawned with full write hands). Filled ONLY when the clamp is ON (`true`), exactly
+     *  like the ctx seat, so an unclamped deployment's mount gains no key. Known at prepare-time
+     *  (frozen TaskSpec snapshot — no lazy getter needed, the `parentCheckpointStoreDisabled` shape). */
+    parentHandsReadOnly?: true;
+    /** #345 ③ — the HOST task's hard-headless clamp (`interactiveTools: false`), same carriage rules
+     *  as `parentHandsReadOnly` above: only the DISABLING value travels, mirroring the subagent lane's
+     *  `ToolExecuteContext.interactiveTools` seat — without it a headless-clamped host's workflow
+     *  children could re-mount the interactive tool the host run disabled. */
+    parentInteractiveTools?: false;
     /** [1238](A) — call-time getter for the HOST task's RESOLVED Model object: a spawned agent whose
      *  fold chain produced no model inherits the parent's full object (baseUrl/key routing included),
      *  mirroring the subagent lane's ctx.model semantics. */

package/dist/orchestration/run-workflow-tool.js

@@ -468,7 +468,7 @@ export async function createRunWorkflowTool(d) {
                 }
                 : governance;
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {

package/dist/orchestration/workflow-governance.d.ts

@@ -125,6 +125,33 @@ export interface ResourceClampNote {
     /** The effective value the child actually runs under (min of script/baseline/caps, or a forced ceiling). */
     applied: number;
 }
+/**
+ * The worktree-overlay merge — `{ ...base, ...worktreeBase }` with ONE amendment: an overlay key
+ * whose value is OWN NULLISH (`undefined` OR `null` — both plain-JS deployment shapes) never
+ * overrides `base`; it reads as the absent key its value spells ("an absent overlay field inherits
+ * from base", the documented semantics). The GENERIC successor of the per-key protections that grew
+ * one field at a time (three face arrays, then `onAsk` — the mount-side deletes, which remain for
+ * their base-slot readings) while every OTHER same-shaped key stayed destructive: a surviving own
+ * nullish overlay key erased the base value — `toolPolicy` / `shellGate` / `limits` / `hooks` /
+ * `restoreGatedTools` / `readFace` / … — for exactly the children an untrusted script can route to
+ * the overlay (`isolation: "worktree"`), own-`undefined` keys included (a spread copies them; the
+ * old `=== null` face drop missed that half). One rule at the one merge point: a new baseline key
+ * is safe with no list to extend. The single exception is {@link NULL_VALUED_BASELINE_KEYS}
+ * (`checkpointStore: null` — the deployment disarming durable suspend for isolated children is a
+ * capability removal it must be able to spell). Explicit non-nullish overlay values keep winning
+ * wholesale — the documented deployment override.
+ *
+ * ACCEPTED COST, stated (adversarial-review round 2): the rule is direction-blind — a CAPABILITY
+ * key's out-of-type overlay `null` used to WITHHOLD the base value by the same spread accident
+ * (e.g. `worktreeBase: { getApiKeyAndHeaders: null }` overwrote the base resolver AND defeated the
+ * parent-credential `=== undefined` fill in workflow.ts — silently blocking the documented
+ * inheritance, the same seam-defeat disease the onAsk r3 ruling deleted null for), and such a key
+ * now inherits per the documented contract. Deployments withhold capabilities from isolated
+ * children with IN-TYPE spellings (`tools: []`, a deny `toolPolicy`, `handsReadOnly: true`);
+ * `getApiKeyAndHeaders` currently has no in-type disable value — that expressiveness gap is a
+ * baseline-contract question, deliberately not solved by resurrecting undocumented null semantics.
+ */
+export declare function overlayWorktreeBaseline(base: WorkflowGovernanceBaseline["base"], worktreeBase: WorkflowGovernanceBaseline["base"]): WorkflowGovernanceBaseline["base"];
 /** Resolve an LLM-supplied model NAME to a deploy-configured `Model`, FAIL-CLOSED against the allowlist.
  *  Throws (never falls open to the whole catalog) when no allowlist is configured or the name is not on it. */
 export declare function resolveModelName(name: string, allowlist: string[] | undefined, models: Record<string, Model> | undefined): Model;

package/dist/orchestration/workflow-governance.js

@@ -57,6 +57,19 @@ function emitStrippedKeysNotice(survey, onNotice) {
     }
 }
 const VALID_THINKING = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+const NULL_VALUED_BASELINE_KEYS = new Set(["checkpointStore"]);
+export function overlayWorktreeBaseline(base, worktreeBase) {
+    let overlay = worktreeBase;
+    for (const key of Object.keys(worktreeBase)) {
+        const v = worktreeBase[key];
+        if (v !== undefined && (v !== null || NULL_VALUED_BASELINE_KEYS.has(key)))
+            continue;
+        if (overlay === worktreeBase)
+            overlay = { ...worktreeBase };
+        delete overlay[key];
+    }
+    return { ...base, ...overlay };
+}
 export function resolveModelName(name, allowlist, models) {
     if (!allowlist || allowlist.length === 0) {
         throw new WorkflowModelNotAllowedError(name, "no workflowModelAllowlist is configured (fail-closed: an LLM-authored script cannot pick a model)");

package/dist/orchestration/workflow-primitives.d.ts

@@ -44,4 +44,11 @@ parentCheckpointStoreDisabled?: boolean,
 parentReadFace?: () => TaskSpec["readFace"], 
 /** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
  *  entries the host's own deployment/task layers stacked on). */
-parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"]): WorkflowPrimitives;
+parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 
+/** #345 ③ — the HOST task's write-hands clamp is ON (`spec.handsReadOnly === true`). Injected
+ *  tighten-only into every spawned child, like the read-face clamp above; see the injection
+ *  below for why it outranks even a `worktreeBase: { handsReadOnly: false }` overlay. */
+parentHandsReadOnly?: boolean, 
+/** #345 ③ — the HOST task's hard-headless clamp is ON (`spec.interactiveTools === false`).
+ *  Same tighten-only injection; only the disabling value ever arrives here as `true`. */
+parentInteractiveToolsOff?: boolean): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -1,5 +1,5 @@
 import { assertSupportedAgentIsolation } from "./workflow.js";
-import { buildGovernedChildSpec } from "./workflow-governance.js";
+import { buildGovernedChildSpec, overlayWorktreeBaseline } from "./workflow-governance.js";
 function safeAgentOptions(opts) {
     if (typeof opts !== "object" || opts === null)
         return {};
@@ -22,12 +22,12 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
         const agentOpts = safeAgentOptions(opts);
-        const effectiveBaseline = (b) => agentOpts.isolation === "worktree" && b.worktreeBase !== undefined ? { ...b, base: { ...b.base, ...b.worktreeBase } } : b;
+        const effectiveBaseline = (b) => agentOpts.isolation === "worktree" && b.worktreeBase != null ? { ...b, base: overlayWorktreeBaseline(b.base, b.worktreeBase) } : b;
         const childSpec = governance
             ? buildGovernedChildSpec(spec, effectiveBaseline(governance.baseline), governance.models, governance.caps, (notes) => ctx.log(formatResourceClampNote(notes)), governance.onNotice)
             : { ...spec };
@@ -53,6 +53,14 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
                 childSpec.readDenyPatterns = childSpec.readDenyPatterns !== undefined ? [...childSpec.readDenyPatterns, ...pd] : [...pd];
             }
         }
+        if (parentHandsReadOnly === true) {
+            childSpec.handsReadOnly = true;
+        }
+        if (parentInteractiveToolsOff === true) {
+            childSpec.interactiveTools = false;
+            if (childSpec.interactionPosture === "interactive")
+                delete childSpec.interactionPosture;
+        }
         if (onAgentSpawn) {
             return ctx.agentStream(childSpec, agentOpts).then((handle) => {
                 onAgentSpawn(handle);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.49.0",
+  "version": "5.50.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",