@sema-agent/core 5.49.0 → 5.51.0

package/dist/orchestration/run-workflow-tool.d.ts

@@ -234,6 +234,18 @@ export interface RunWorkflowToolDeps {
     parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
     /** Twin of the above for the deny-set additions (union, not replace). */
     parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
+    /** #345 ③ — the HOST task's write-hands clamp, the read-face clamp's sibling on this lane (the
+     *  subagent delegation lane has carried it as `ToolExecuteContext.handsReadOnly` since its own
+     *  tighten-only ruling; the workflow lane was the remaining gap — a read-only host's workflow
+     *  children spawned with full write hands). Filled ONLY when the clamp is ON (`true`), exactly
+     *  like the ctx seat, so an unclamped deployment's mount gains no key. Known at prepare-time
+     *  (frozen TaskSpec snapshot — no lazy getter needed, the `parentCheckpointStoreDisabled` shape). */
+    parentHandsReadOnly?: true;
+    /** #345 ③ — the HOST task's hard-headless clamp (`interactiveTools: false`), same carriage rules
+     *  as `parentHandsReadOnly` above: only the DISABLING value travels, mirroring the subagent lane's
+     *  `ToolExecuteContext.interactiveTools` seat — without it a headless-clamped host's workflow
+     *  children could re-mount the interactive tool the host run disabled. */
+    parentInteractiveTools?: false;
     /** [1238](A) — call-time getter for the HOST task's RESOLVED Model object: a spawned agent whose
      *  fold chain produced no model inherits the parent's full object (baseUrl/key routing included),
      *  mirroring the subagent lane's ctx.model semantics. */

package/dist/orchestration/run-workflow-tool.js

@@ -468,7 +468,7 @@ export async function createRunWorkflowTool(d) {
                 }
                 : governance;
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {

package/dist/orchestration/workflow-governance.d.ts

@@ -125,6 +125,33 @@ export interface ResourceClampNote {
     /** The effective value the child actually runs under (min of script/baseline/caps, or a forced ceiling). */
     applied: number;
 }
+/**
+ * The worktree-overlay merge — `{ ...base, ...worktreeBase }` with ONE amendment: an overlay key
+ * whose value is OWN NULLISH (`undefined` OR `null` — both plain-JS deployment shapes) never
+ * overrides `base`; it reads as the absent key its value spells ("an absent overlay field inherits
+ * from base", the documented semantics). The GENERIC successor of the per-key protections that grew
+ * one field at a time (three face arrays, then `onAsk` — the mount-side deletes, which remain for
+ * their base-slot readings) while every OTHER same-shaped key stayed destructive: a surviving own
+ * nullish overlay key erased the base value — `toolPolicy` / `shellGate` / `limits` / `hooks` /
+ * `restoreGatedTools` / `readFace` / … — for exactly the children an untrusted script can route to
+ * the overlay (`isolation: "worktree"`), own-`undefined` keys included (a spread copies them; the
+ * old `=== null` face drop missed that half). One rule at the one merge point: a new baseline key
+ * is safe with no list to extend. The single exception is {@link NULL_VALUED_BASELINE_KEYS}
+ * (`checkpointStore: null` — the deployment disarming durable suspend for isolated children is a
+ * capability removal it must be able to spell). Explicit non-nullish overlay values keep winning
+ * wholesale — the documented deployment override.
+ *
+ * ACCEPTED COST, stated (adversarial-review round 2): the rule is direction-blind — a CAPABILITY
+ * key's out-of-type overlay `null` used to WITHHOLD the base value by the same spread accident
+ * (e.g. `worktreeBase: { getApiKeyAndHeaders: null }` overwrote the base resolver AND defeated the
+ * parent-credential `=== undefined` fill in workflow.ts — silently blocking the documented
+ * inheritance, the same seam-defeat disease the onAsk r3 ruling deleted null for), and such a key
+ * now inherits per the documented contract. Deployments withhold capabilities from isolated
+ * children with IN-TYPE spellings (`tools: []`, a deny `toolPolicy`, `handsReadOnly: true`);
+ * `getApiKeyAndHeaders` currently has no in-type disable value — that expressiveness gap is a
+ * baseline-contract question, deliberately not solved by resurrecting undocumented null semantics.
+ */
+export declare function overlayWorktreeBaseline(base: WorkflowGovernanceBaseline["base"], worktreeBase: WorkflowGovernanceBaseline["base"]): WorkflowGovernanceBaseline["base"];
 /** Resolve an LLM-supplied model NAME to a deploy-configured `Model`, FAIL-CLOSED against the allowlist.
  *  Throws (never falls open to the whole catalog) when no allowlist is configured or the name is not on it. */
 export declare function resolveModelName(name: string, allowlist: string[] | undefined, models: Record<string, Model> | undefined): Model;

package/dist/orchestration/workflow-governance.js

@@ -57,6 +57,19 @@ function emitStrippedKeysNotice(survey, onNotice) {
     }
 }
 const VALID_THINKING = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+const NULL_VALUED_BASELINE_KEYS = new Set(["checkpointStore"]);
+export function overlayWorktreeBaseline(base, worktreeBase) {
+    let overlay = worktreeBase;
+    for (const key of Object.keys(worktreeBase)) {
+        const v = worktreeBase[key];
+        if (v !== undefined && (v !== null || NULL_VALUED_BASELINE_KEYS.has(key)))
+            continue;
+        if (overlay === worktreeBase)
+            overlay = { ...worktreeBase };
+        delete overlay[key];
+    }
+    return { ...base, ...overlay };
+}
 export function resolveModelName(name, allowlist, models) {
     if (!allowlist || allowlist.length === 0) {
         throw new WorkflowModelNotAllowedError(name, "no workflowModelAllowlist is configured (fail-closed: an LLM-authored script cannot pick a model)");

package/dist/orchestration/workflow-primitives.d.ts

@@ -44,4 +44,11 @@ parentCheckpointStoreDisabled?: boolean,
 parentReadFace?: () => TaskSpec["readFace"], 
 /** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
  *  entries the host's own deployment/task layers stacked on). */
-parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"]): WorkflowPrimitives;
+parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 
+/** #345 ③ — the HOST task's write-hands clamp is ON (`spec.handsReadOnly === true`). Injected
+ *  tighten-only into every spawned child, like the read-face clamp above; see the injection
+ *  below for why it outranks even a `worktreeBase: { handsReadOnly: false }` overlay. */
+parentHandsReadOnly?: boolean, 
+/** #345 ③ — the HOST task's hard-headless clamp is ON (`spec.interactiveTools === false`).
+ *  Same tighten-only injection; only the disabling value ever arrives here as `true`. */
+parentInteractiveToolsOff?: boolean): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -1,5 +1,5 @@
 import { assertSupportedAgentIsolation } from "./workflow.js";
-import { buildGovernedChildSpec } from "./workflow-governance.js";
+import { buildGovernedChildSpec, overlayWorktreeBaseline } from "./workflow-governance.js";
 function safeAgentOptions(opts) {
     if (typeof opts !== "object" || opts === null)
         return {};
@@ -22,12 +22,12 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
         const agentOpts = safeAgentOptions(opts);
-        const effectiveBaseline = (b) => agentOpts.isolation === "worktree" && b.worktreeBase !== undefined ? { ...b, base: { ...b.base, ...b.worktreeBase } } : b;
+        const effectiveBaseline = (b) => agentOpts.isolation === "worktree" && b.worktreeBase != null ? { ...b, base: overlayWorktreeBaseline(b.base, b.worktreeBase) } : b;
         const childSpec = governance
             ? buildGovernedChildSpec(spec, effectiveBaseline(governance.baseline), governance.models, governance.caps, (notes) => ctx.log(formatResourceClampNote(notes)), governance.onNotice)
             : { ...spec };
@@ -53,6 +53,14 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
                 childSpec.readDenyPatterns = childSpec.readDenyPatterns !== undefined ? [...childSpec.readDenyPatterns, ...pd] : [...pd];
             }
         }
+        if (parentHandsReadOnly === true) {
+            childSpec.handsReadOnly = true;
+        }
+        if (parentInteractiveToolsOff === true) {
+            childSpec.interactiveTools = false;
+            if (childSpec.interactionPosture === "interactive")
+                delete childSpec.interactionPosture;
+        }
         if (onAgentSpawn) {
             return ctx.agentStream(childSpec, agentOpts).then((handle) => {
                 onAgentSpawn(handle);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.49.0",
+  "version": "5.51.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",