@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/untrusted-egress.d.ts

@@ -5,7 +5,7 @@ export declare function redactSecrets(s: string, report?: RedactionReport): stri
 export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
 /** Secret-redact + size-bound (NO injection fence) — the SAME-PRINCIPAL tier: workflow outputs/results/errors
  *  riding back to the launching model/script, run rows behind scope-gated observe. Paths/URLs survive
- *  ([1295]② — the assertion pattern depends on them); secrets never do. */
+ *  (the assertion pattern depends on them); secrets never do. */
 export declare function boundedRedactedSummary(value: unknown, max: number): string;
 /**
  * The FULL untrusted-egress transform (design/97 CORE-2): full host-leak redaction + size-bound + FENCE. Use

package/dist/core/untrusted-text.d.ts

@@ -236,7 +236,7 @@ export declare function defuseExactMarkInSegments(segments: readonly string[], m
  */
 export declare function sanitizeUntrustedText(text: string, extraTags?: string[]): string;
 /**
- * [c209-C] codex 收口 C1/C2 (metadata-driven, replaces the shape-anchored
+ * [c209-C] 收口 C1/C2 (metadata-driven, replaces the shape-anchored
  * `stripLeadingSystemReminders`) — cut the engine-prepended prefix off a user-lane message using the
  * EXACT length recorded on the message at mint time (`UserMessage.enginePrefixChars`, stamped where
  * the engine concatenated first-frame listing reminders / a UserPromptSubmit additionalContext
@@ -246,7 +246,7 @@ export declare function sanitizeUntrustedText(text: string, extraTags?: string[]
  * summarizer input) must not let them (a) impersonate user authority or (b) evict the real
  * objective from a head-truncated excerpt.
  *
- * The old helper GUESSED by reminder shape, which mis-fired in both directions (codex 收口轮): a
+ * The old helper GUESSED by reminder shape, which mis-fired in both directions (收口轮): a
  * same-line engine mint (`<system-reminder>[deadline] …</system-reminder>`) was NOT recognized and
  * entered the window under `[user]` authority, while a user who legitimately opened their own
  * prompt with a byte-exact reminder block WAS stripped. Metadata removes the guess entirely:
@@ -270,7 +270,7 @@ export interface EngineSegment {
     end: number;
 }
 /**
- * [c209-C] R5 codex R4 复核 — the three-state result of {@link normalizeEngineSegments}. `absent`
+ * [c209-C] R5 — the three-state result of {@link normalizeEngineSegments}. `absent`
  * and `malformed` are DIFFERENT states on purpose (R4 #1): a message whose `engineSegments` field
  * is present-but-malformed must render WHOLLY verbatim — the metadata family is suspect, so a
  * co-present `enginePrefixChars` must NOT get a second chance to cut (absent metadata is the only
@@ -285,7 +285,7 @@ export type NormalizedEngineSegments = {
     readonly segments: ReadonlyArray<EngineSegment>;
 };
 /**
- * [c209-C] R4 codex 终判 (R5: three-state + exception-safe over `unknown`) — validate
+ * [c209-C] R4 终判 (R5: three-state + exception-safe over `unknown`) — validate
  * `UserMessage.engineSegments` against the text it indexes into.
  * - `absent`: the field is `undefined` (or an empty array — it claims no engine bytes), so the
  *   `enginePrefixChars` sugar MAY still apply.
@@ -303,7 +303,7 @@ export type NormalizedEngineSegments = {
  */
 export declare function normalizeEngineSegments(text: string, segments: unknown): NormalizedEngineSegments;
 /**
- * [c209-C] R4 codex 终判 — the SEGMENT sibling of {@link cutEnginePrefix}: remove every
+ * [c209-C] R4 终判 — the SEGMENT sibling of {@link cutEnginePrefix}: remove every
  * engine-trusted `[start, end)` segment from a user-lane message, keeping the bytes OUTSIDE the
  * segments verbatim (the caller/operator-authored content that derived views may present under
  * `[user]`/`[User]:` authority). Unlike the prefix cut, segments can sit mid-message: the resume
@@ -311,7 +311,7 @@ export declare function normalizeEngineSegments(text: string, segments: unknown)
  * ResumeOutcome/ResumeRun contract), so a trusted engine frame may legally follow an untrusted
  * fenced one.
  *
- * [c209-C] R5 (codex R4 #1) — the result distinguishes WHY nothing was cut: `malformed:true`
+ * [c209-C] R5 — the result distinguishes WHY nothing was cut: `malformed:true`
  * means the field was PRESENT but bad (per {@link normalizeEngineSegments}) — the caller must
  * render the whole message verbatim and MUST NOT fall through to `enginePrefixChars` (segments
  * exist ⇒ they own the message; malformed ⇒ the metadata family is suspect wholesale). Only
@@ -323,7 +323,7 @@ export declare function cutEngineSegments(text: string, segments: unknown): {
     malformed: boolean;
 };
 /**
- * [c209-C] R5 (codex R4 #3) — the ONE flatten under which `engineSegments`/`enginePrefixChars`
+ * [c209-C] R5 — the ONE flatten under which `engineSegments`/`enginePrefixChars`
  * offsets are DEFINED: a user-lane message qualifies only when its content is a plain string or a
  * SINGLE text block (whose text is that same string). Multi-block / image-bearing content returns
  * `undefined` and consumers render the message VERBATIM with their own local flatten — the two

package/dist/core/wiring-manifest.d.ts

@@ -36,7 +36,7 @@ export type WiringLegKind = "root" | "child" | "resume";
 /** The shape of the resolved permission-ask seat (`spec.onAsk ?? deps.onAsk`): a live approver
  *  callback, a blanket `"allow"`/`"deny"` policy setting, or nothing at all. `"deny"` (a deliberate
  *  policy) and `"absent"` (a degrade to the headless auto-deny default) are DISTINCT on purpose —
- *  design/173 codex 5. */
+ *  design/173 */
 export type AskSeamForm = "callback" | "allow" | "deny" | "absent";
 /** What a policy `ask` actually reaches under this assembly. `"unresolved"` = not computable from
  *  the facts at hand (the static half's park-dependent arm). */
@@ -106,7 +106,7 @@ export interface WiringManifest {
         serversOptedIn: number;
     };
     parkLane: {
-        /** A checkpoint store is wired (capability — design/173 codex 13: capability and current policy
+        /** A checkpoint store is wired (capability — design/173: capability and current policy
          *  are reported separately). */
         capable: boolean;
         /** capable ∧ (durableApproval opt-in ∨ forceDurableGate entitlement ∨ armed safety-tool
@@ -114,7 +114,7 @@ export interface WiringManifest {
          *  vocabulary are prepare-time facts). */
         effective: boolean | "unresolved";
         /** Why `effective` is `false`/`"unresolved"` — empty when `true`. The derivation chain an
-         *  operator follows from `static unresolved` to `effective park unavailable` (codex 7). */
+         *  operator follows from `static unresolved` to `effective park unavailable`. */
         reasons: readonly ParkLaneReason[];
         /** design/173 §8.4 (opus R7): the DECLARED durability of the resolved checkpoint store — an
          *  armed park lane over a process-local store is the "armed but memory-backed" degrade shape
@@ -159,7 +159,7 @@ export interface WiringManifest {
     };
     /**
      * Governance surfaces (presence facts only). `audience: "operator"` is the MACHINE-READABLE
-     * projection classification (design/173 codex 9): a serving layer forwarding this event to a
+     * projection classification (design/173): a serving layer forwarding this event to a
      * multi-tenant/shared stream MUST project this section for operators only — and when it does no
      * projection, the default is to NOT disclose the section, never to leak it.
      */
@@ -263,7 +263,7 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
     };
 } | undefined): SubagentTranscriptTier;
 /**
- * The ONE `ask.effective` derivation (design/173 codex 5) — shared by the effective manifest AND
+ * The ONE `ask.effective` derivation (design/173) — shared by the effective manifest AND
  * the posture door (`config.interaction_posture`), so "what does the door require" and "what does
  * the manifest report" can never disagree:
  *  - a live approver callback ⇒ `human_reachable` (regardless of the park lane);

package/dist/core/workflow-journal-store.d.ts

@@ -29,13 +29,13 @@ export interface ResumeClaimArgs {
  * run's journal whose recorded scope equals the requested `scope` (a cross-scope `resumeFromRunId` resolves to an
  * EMPTY journal → the resume safely diverges to a live re-run, never disclosing another tenant's results).
  *
- * SESSION-axis RULING (clay 裁定 2026-07-22, B-2 会话轴扫描案; FINAL form settled in the γ batch):
+ * SESSION-axis RULING (ruled 2026-07-22):
  * `load` is deliberately SCOPE-only, PERMANENTLY — same-scope callers from a different session may
  * replay a run's journal. Rationale: (a) same-scope = same trust domain (the task-list store
  * records the same posture) and a runId is engine-minted, not enumerable; (b) cross-session resume
  * is `resumeFromRunId`'s CORE legitimate use — a fresh session picking up yesterday's run has a new
  * taskId AND a new sessionId by construction, so ANY engine-side session/owner clamp on this face
- * refuses exactly the contract the tool teaches (the [1455] prefix-replay pins are the regression
+ * refuses exactly the contract the tool teaches (the prefix-replay pins are the regression
  * proof; a γ-batch recheck attempt was reverted on them). Layering: the ENGINE owns the scope
  * hard-wall (this WHERE); the SESSION acceptance arm belongs to the SERVING layer, which has a
  * session-bound connection to adjudicate against (server 1.247's wire-face soft acceptance). This
@@ -48,13 +48,13 @@ export interface WorkflowJournalStore {
     /** Record one agent's result under `(runId, scope)`. MUST be idempotent per `(runId, ordinal)` — a resumed run
      *  re-appends the cached results of its replayed prefix, so a second append for the same ordinal overwrites. */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
-    /** [1409]③ (CC diagnostics parity, additive): a HUMAN/MODEL-readable coordinate for this run's journal —
+    /** (CC diagnostics parity, additive): a HUMAN/MODEL-readable coordinate for this run's journal —
      *  the file store returns the on-disk jsonl path (CC "Read journal.jsonl" local form); a service store
      *  returns its API route (cloud form). `undefined`/absent ⇒ the completion notification's diagnostics
      *  line teaches only the TaskOutput route (which is always live). Engine-facing string, never parsed. */
     locator?(runId: string, scope: string): string | undefined;
     /**
-     * RB-242 ([1980] server → [1981] core ruling, 2026-07-30) — ADMISSION for a resume, so two concurrent
+     * RB-242 (ruled 2026-07-30) — ADMISSION for a resume, so two concurrent
      * `resumeFromRunId` legs off ONE source run cannot fork its execution.
      *
      * Why a store seam at all: the engine's own mutex is in-process only (`startWorkflow` refuses a duplicate
@@ -65,7 +65,7 @@ export interface WorkflowJournalStore {
      * shared durable layer, i.e. here.
      *
      * OPTIONAL, and absence is a first-class state: a store that does NOT implement this has NO STORE-LEVEL lease
-     * semantics. RB-367 ([2054] test AI dual-process probe): a store without the hook is no longer completely
+     * semantics. RB-367 (dual-process probe): a store without the hook is no longer completely
      * unguarded, though — `runWorkflow`'s engine falls back to a process-local admission table for exactly this
      * shape, so a same-process double `resumeFromRunId` off one source is still refused even against a store
      * that never implements this member. That fallback cannot see a SECOND process, which is the one thing a
@@ -83,13 +83,13 @@ export interface WorkflowJournalStore {
      *    and is charset-clamped before it lands in a message.
      *  - IDEMPOTENT for the same holder: a re-claim by the SAME `newRunId` on a claim it already holds MUST be
      *    granted (a retry must not deadlock a run against itself).
-     *  - `scope` is the journal scope passed through VERBATIM ([1981]). A claim is keyed by `(sourceRunId, scope)`,
+     *  - `scope` is the journal scope passed through VERBATIM. A claim is keyed by `(sourceRunId, scope)`,
      *    NOT by `sourceRunId` alone: a cross-scope caller already resolves to an EMPTY journal (the CORE-9 wall
      *    above) so it cannot fork anything, and letting it take a global claim would hand any tenant a
      *    denial-of-resume lever over another's runs.
      *  - THROWING is a store failure, not a refusal — it propagates and fails the resume. Return `{granted:false}`
      *    to refuse.
-     *  - A GRANT MEANS POSSESSION (RB-356①, codex 异源复审 2026-07-29). `granted: true` may only be returned once
+     *  - A GRANT MEANS POSSESSION (RB-356①). `granted: true` may only be returned once
      *    the claim is RECORDED where every other contender will see it; a store that cannot tell whether it holds
      *    the claim must refuse, with `holder` omitted if it cannot attribute the winner. The asymmetry is the
      *    reason: an unearned refusal fails one resume loudly and is recoverable, an unearned grant forks a run
@@ -101,7 +101,7 @@ export interface WorkflowJournalStore {
      *    "an incomplete record is dead, take it over" is only safe if an in-flight acquisition can never look
      *    incomplete.
      *
-     * TWO INVALIDATION DOMAINS, each covering what the other cannot ([1981], settled with server):
+     * TWO INVALIDATION DOMAINS, each covering what the other cannot:
      *  1. ENGINE release — the normal path, prompt, covers every terminal outcome of a live engine.
      *  2. STORE TTL — the backstop for an engine that DIED holding a claim (crash/kill/replica loss): it never
      *     reaches its `finally`, so only a store-side expiry can ever free that row. Server's SQL twins land this
@@ -113,7 +113,7 @@ export interface WorkflowJournalStore {
         holder?: string;
     }>;
     /**
-     * RB-242 ([1981]) — release the claim {@link resumeClaim} granted to `newRunId` on `(sourceRunId, scope)`.
+     * RB-242 — release the claim {@link resumeClaim} granted to `newRunId` on `(sourceRunId, scope)`.
      * Called by the engine at the resuming run's TERMINAL boundary (in a `finally`, so abort/error/abandon are
      * covered), and ONLY when the matching claim was actually granted.
      *
@@ -124,7 +124,7 @@ export interface WorkflowJournalStore {
      * A throw here is swallowed by the engine — a release failure must never replace the run's real outcome, and
      * the store's TTL is the standing backstop for the row it left behind.
      *
-     * RB-355 (codex 异源复审 2026-07-29): the engine's terminal boundary now BOUNDS this call (and its wait on
+     * RB-355: the engine's terminal boundary now BOUNDS this call (and its wait on
      * the {@link resumeClaim} verdict) by a timeout — a store that hangs would otherwise keep the run's `done`
      * promise pending forever, after the outcome is already decided. A release that outlives that bound is
      * treated exactly like one that throws: swallowed, with the TTL as the backstop. Implementations should not
@@ -139,18 +139,18 @@ export declare const MAX_JOURNAL_RESULT_BYTES: number;
 /** True when a serialized journal result is too large to store (UTF-8 byte length over {@link MAX_JOURNAL_RESULT_BYTES}). */
 export declare function oversizeJournalResult(serialized: string): boolean;
 export declare function callKeyOrdinal(callKey: string): number;
-/** RB-243 ([1937]): the errorCode a journal OVERSIZE TOMBSTONE carries — the resume path recognizes it to
+/** RB-243: the errorCode a journal OVERSIZE TOMBSTONE carries — the resume path recognizes it to
  *  say WHY an ordinal never replays. `failed` + this code lands on the T2A-4 no-replay arm, so replay
  *  behavior is identical to the entry simply being absent (the pre-tombstone shape). */
 export declare const JOURNAL_OVERSIZE_ERROR_CODE = "workflow.journal_oversize";
-/** RB-243 ([1937]): mint the tiny FAILED entry the ENGINE journals in place of an oversize result. The
+/** RB-243: mint the tiny FAILED entry the ENGINE journals in place of an oversize result. The
  *  tombstone is minted in the engine, NOT in a store — the stores' skip semantics are unchanged (the
  *  §4.1 backend-parity pin depends on that layering; a store-side tombstone would re-create the RB-168
  *  dialect divergence). Never copies `result.result`/`structuredOutput` (the oversize payload); keeps
  *  taskId/sessionId/stats so the journal read-face still shows the session handle and the paid spend. */
 export declare function journalOversizeTombstone(result: TaskResult, bytes: number): TaskResult;
 /**
- * RB-367 ([2054] test AI dual-process probe, core-side judgment) — the TTL a resume claim {@link
+ * RB-367 (dual-process probe, core-side judgment) — the TTL a resume claim {@link
  * InMemoryWorkflowJournalStore} grants survives WITHOUT an engine release: the backstop for an engine that
  * abandoned a granted claim without ever reaching the terminal `finally` that releases it (a bug, not the
  * normal path — the normal path releases promptly). Same VALUE as the file store's `RESUME_CLAIM_TTL_MS`
@@ -169,7 +169,7 @@ export declare const IN_MEMORY_RESUME_CLAIM_TTL_MS: number;
  *  store WITHOUT the seam — its own header said so). Left unimplemented, the DEFAULT deployment (no
  *  `journalStore` supplied, or this store supplied explicitly) had NO protection against two same-process
  *  `resumeFromRunId` calls off one source forking its execution — the class of bug RB-242 exists to close, and
- *  a test AI's dual-process probe found it wide open on the default path while the file store's half already
+ *  a dual-process probe found it wide open on the default path while the file store's half already
  *  worked. A single-process store's promise is necessarily single-process: this implementation gives no
  *  cross-process guarantee (there is no shared medium to publish a claim on), so a multi-process deployment
  *  still needs a store that IS durable/shared (the file or SQL stores) for the seam to mean anything beyond

package/dist/core/workflow-run-store-contract.d.ts

@@ -21,7 +21,7 @@ export declare function createWorkflowRun(over?: Partial<WorkflowRun>): Workflow
  * runner). The DEFAULT runs the cases inline and sequentially (so `service` can call
  * `await workflowRunStoreContract(make)` with no harness at all).
  *
- * ⚠️ Binding note (service [390]): the cases are REGISTERED eagerly and awaited via `Promise.all` — an async
+ * ⚠️ Binding note: the cases are REGISTERED eagerly and awaited via `Promise.all` — an async
  * `runAssertion` that schedules work concurrently will interleave cases. Bindings whose stores share state
  * (e.g. SQL twins on one table) must CHAIN the assertions themselves (serialize inside `runAssertion`).
  */

package/dist/core/workflow-run-store-contract.js

@@ -56,7 +56,7 @@ export async function workflowRunStoreContract(make, runAssertion = defaultSeque
         assert.equal((await store.get(r.id)).status, "completed");
         assert.equal(await store.update("ghost", r.scope, createWorkflowRun({ id: "ghost" })), false);
     });
-    run("the key id is authoritative — a payload with a mismatched id never poisons the projection (codex BUG4)", async () => {
+    run("the key id is authoritative — a payload with a mismatched id never poisons the projection", async () => {
         const store = make();
         const r = createWorkflowRun({ id: "real", status: "running" });
         await store.put("real", { ...r, id: "spoofed" });

package/dist/core/workflow-run-store.d.ts

@@ -7,7 +7,7 @@ import type { WorkflowRun, WorkflowRunStatus } from "../orchestration/workflow.j
  *
  * **Distinct from the four load-bearing durable seams** (session / checkpoint / memory / tool-result): those
  * are the engine's suspend/resume命脉, so core ships PG adapters for them. A WorkflowRunStore is an
- * **observation layer — opt-in, non-engine-critical** — so per design/97 §D.8 (clay 2026-06-22 拍) core
+ * **observation layer — opt-in, non-engine-critical** — so per design/97 §D.8 (2026-06-22 拍) core
  * ships ONLY: this interface + {@link InMemoryWorkflowRunStore} (process-local / default / tests) +
  * `FileWorkflowRunStore` (zero-dependency, TOC-local persistence — `src/stores/file/workflow-run-store.ts`).
  * **The PG backend lives in service (TOB), implementing THIS interface** when it needs cross-replica
@@ -34,7 +34,7 @@ export interface WorkflowRunSummary {
     id: string;
     /** The tenant / grouping key this run lives in ({@link WorkflowRun.scope}). */
     scope: string;
-    /** γ 批 ([1510] server request): the ORIGINATING session id ({@link WorkflowRun.originatingSessionId}),
+    /** The ORIGINATING session id ({@link WorkflowRun.originatingSessionId}),
      *  projected so a serving layer's LIST face can apply its session acceptance/filter arm without an
      *  N+1 `get` of the full run. Absent for a direct `runWorkflow` call / sessionless deployment. */
     originatingSessionId?: string;
@@ -117,10 +117,10 @@ export interface WorkflowRunStore {
      * core query. Newest first (`createdAt` DESC). `opts.status` filters to one lifecycle state; `opts.limit`
      * caps the result count (applied AFTER the sort, so it keeps the newest N). An empty scope returns `[]`.
      */
-    /** `opts.session` ([1513] server ask, δ 尾件): STORE-side push-down filter on
+    /** `opts.session`: STORE-side push-down filter on
      *  `originatingSessionId` — strict equality, rows WITHOUT the field excluded (filter semantics,
      *  deliberately unlike the per-id acceptance arm's absent-pass). Applied BEFORE limit, so the
-     *  serving layer's "this session's workflows" is FULL-history, not page-window ([1513] cli note). */
+     *  serving layer's "this session's workflows" is FULL-history, not page-window (cli note). */
     listByScope(scope: string, opts?: WorkflowRunListByScopeOptions): Promise<WorkflowRunSummary[]>;
     /**
      * Retention sweep: delete OLD **terminal** runs in `scope` (a `running` run is NEVER deleted — design/97

package/dist/engine/compaction/compaction.d.ts

@@ -26,7 +26,7 @@ export interface CompactionDetails {
      */
     invokedSkills?: InvokedSkillRetention[];
     /**
-     * RB-398-b① ([2105]): CUMULATIVE count of transcript messages this compaction's summary stands in
+     * RB-398-b①: CUMULATIVE count of transcript messages this compaction's summary stands in
      * for (this range's folded messages + the previous compaction's carried count). WRITE-side
      * accounting on purpose: deriving the count at render time from the branch walk broke the F3
      * "bounded wake equals full wake" invariant (a floored storage cannot see below the floor, so the
@@ -52,7 +52,7 @@ export interface CompactionDetails {
      */
     unsummarizedMessages?: number;
     /**
-     * RB-398-c (blackboard [2105]): `<persisted-output ref="…">` handles found in the COMPACTED range
+     * RB-398-c: `<persisted-output ref="…">` handles found in the COMPACTED range
      * (merged over the previous compaction's retained set, oldest-first, capped at
      * {@link PERSISTED_OUTPUT_REFS_MAX_ENTRIES} newest). The offloaded blobs outlive the preview that
      * carried their only address — without this channel the handle survived only if the summarizer
@@ -62,7 +62,7 @@ export interface CompactionDetails {
      */
     persistedOutputRefs?: string[];
     /**
-     * RB-402 (blackboard [2132]③c/[2133]): the activated deferred-tool names LIVE at the
+     * RB-402: the activated deferred-tool names LIVE at the
      * moment this compaction landed — the design/36 activation state whose transcript carriers
      * (the ToolSearch toolCall parts, and since RB-431 the successful direct calls, that
      * `extractDiscoveredToolNames` replays at every task boundary)

package/dist/engine/compaction/utils.d.ts

@@ -98,8 +98,8 @@ export declare function readElidedMessages(details: unknown): number | undefined
  *  {@link readElidedMessages} — a non-negative safe integer, else absent (pre-field sessions /
  *  foreign shapes ⇒ no uncovered-scale clause, byte-identical wrapper). */
 export declare function readUnsummarizedMessages(details: unknown): number | undefined;
-/** Defensive reader for persisted `CompactionDetails.activeTools` (RB-402, blackboard [2132]③c/
- *  [2133]): the ToolSearch activation snapshot each landed compaction restates. details is
+/** Defensive reader for persisted `CompactionDetails.activeTools` (RB-402):
+ *  the ToolSearch activation snapshot each landed compaction restates. details is
  *  `unknown` on the wire — pre-field sessions and foreign shapes yield an empty list; non-string/
  *  empty members are dropped (the consumer additionally intersects with the current leg's deferred
  *  registry, so an unknown name is inert either way). */

package/dist/engine/execution-env/kill-tree.d.ts

@@ -14,7 +14,7 @@ export type KillProcessTreeOptions = {
      * handle with `exitCode === null && signalCode === null`); the pid probe remains only an
      * auxiliary check. Absent ⇒ the pre-existing pid-only behavior (callers without a process handle).
      *
-     * codex R2 (1.296.1) — `false` cancels the DIRECT-pid escalation (that is where pid-reuse risk
+     * (1.296.1) — `false` cancels the DIRECT-pid escalation (that is where pid-reuse risk
      * lives), but on the group-kill lane it no longer cancels the GROUP leg: the anchor only knows
      * the LEADER — a detached shell that honors SIGTERM and exits while its TERM-ignoring descendants
      * (run89's build workers) keep the group alive. While ANY original member lives, POSIX reserves

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -6,12 +6,12 @@ import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledT
 import { SchedulerError } from "../../core/scheduler.js";
 /** Convert user-facing timeout seconds into a positive, timer-safe millisecond delay. */
 export declare function resolveExecTimeoutMs(timeoutSeconds: unknown): number | undefined;
-/** service [377] review finding (win32): `where bash.exe` can resolve to `System32\bash.exe` — the
+/** review finding (win32): `where bash.exe` can resolve to `System32\bash.exe` — the
  *  WSL LAUNCHER, not a native shell. Running it drops into a Linux subsystem where Windows cwd/paths
  *  do not exist; silently adopting it is exactly the "wrong shell, false green" failure D1 forbids.
  *  Filter it (and the WindowsApps alias) out of PATH discovery; Git-Bash candidates are tried first. */
 export declare function isWslBashLauncher(p: string): boolean;
-/** Shell discovery for the platform (service [377] ask ①: exported as the single SDK source so a host
+/** Shell discovery for the platform (ask ①: exported as the single SDK source so a host
  *  adapter does not mirror the platform logic). Explicit `customShellPath` wins (missing → err);
  *  win32 = Git-Bash discovery (ProgramFiles → PATH, WSL launcher filtered) with fail-loud
  *  `shell_unavailable` (never a silent cmd.exe fallback); POSIX = /bin/bash → PATH bash → sh. */
@@ -21,7 +21,7 @@ export declare function getShellConfig(customShellPath?: string): Promise<Result
 }, ExecutionError>>;
 /** test seam (mirrors the notice-seat announce reset): the once-per-process fallback latches. */
 export declare function __resetSecretScrubAnnouncement(): void;
-/** RB-235 ([1937] BB2): the spool-reclaim decision, extracted PURE so every rule is unit-pinnable.
+/** RB-235: the spool-reclaim decision, extracted PURE so every rule is unit-pinnable.
  *  Both reclaim sites (foreground `reclaimSpool`, background `syncSpool`) route through this one
  *  function so they cannot drift apart.
  *
@@ -65,7 +65,7 @@ export declare function decideSpoolReclaim(args: {
     reclaim: true;
     skippedBytes: number;
 };
-/** design/128 T1-1 / codex 1.236 复审 R2: open the spool file pair ALL-OR-NOTHING — a failure opening the
+/** design/128 T1-1: open the spool file pair ALL-OR-NOTHING — a failure opening the
  *  second file must close the first fd before rethrowing (the caller's catch only clears its references, so
  *  a half-open pair would leak fdOut for the env's lifetime). `wx` + 0600 (never follow / never reuse an
  *  existing path). Exported for direct fault-injection tests (pre-create a path → EEXIST). `a` (not
@@ -132,14 +132,14 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
     readBinaryFile(path: string, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
-    /** RB-221 ([1937]): whole-file replace via same-directory staging + fsync + rename (CC 2.1.220 `Q5`,
+    /** RB-221: whole-file replace via same-directory staging + fsync + rename (CC 2.1.220 `Q5`,
      *  pretty220.js:60808). The former single-step `writeFile` was an in-place O_TRUNC: an abort mid-write
      *  (Esc during a large Write — ctx.signal reaches here directly), ENOSPC, or a crash left the target as
      *  a torn prefix of the NEW content with the original unrecoverable. Post-fix contract: the target is
      *  either fully old or fully new; `aborted` means it was never touched. Known semantic change (same as
      *  CC): rename breaks a hard link — the other link keeps the old content. */
     writeFile(path: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
-    /** RB-221 ([1937]): the historical single-step in-place overwrite — kept for targets where
+    /** RB-221: the historical single-step in-place overwrite — kept for targets where
      *  staging+rename would change node identity (symlink chains, non-regular files) and as the
      *  CC-parity fallback for filesystems where the rename cannot work. NOT atomic by design. */
     private writeFileInPlace;
@@ -180,11 +180,11 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
     /** design/128 T1-1: incrementally read a retained shell's spool files into the in-memory tails, so
      *  pollBackground serves the same cursor semantics whether stdio came over pipes or spool files.
      *  Bounded single read per stream per poll (the tail keeps only its rolling window anyway).
-     *  codex R3 F-C: reads are positioned by spool.fileCursor (the FILE offset — rotation truncates
+     *  reads are positioned by spool.fileCursor (the FILE offset — rotation truncates
      *  the file), while poll slicing keeps using the logical stream totalBytes; the two advance in
      *  lockstep here but are NOT interchangeable after a rotation. */
     private syncSpool;
-    /** codex R3 F-D + [1105]: reclaim an EPHEMERAL spool (detach-adopted, or any non-retain bg
+    /** +: reclaim an EPHEMERAL spool (detach-adopted, or any non-retain bg
      *  spawn — the whole unix bg lane is spool-backed now) — fold the final residue into the tails,
      *  unlink both files, and drop the spool reference (later syncs become no-ops). Idempotent;
      *  never touches design/128 retain-lane spools (no `ephemeral` flag). A still-writing detached

package/dist/engine/harness/agent-harness.d.ts

@@ -2,7 +2,7 @@ import type { ActorAssertion, AssistantMessage, ImageContent, Model } from "../l
 import type { AgentMessage, AgentTool, LoopMalformedToolUseRecovery, LoopThinkingOnlyRecovery, LoopTruncatedOutputRecovery, QueueMode, ThinkingLevel } from "../loop/types.js";
 import { type EngineSegment } from "../../core/untrusted-text.js";
 import type { AbortResult, AgentHarnessEvent, AgentHarnessEventResultMap, AgentHarnessOptions, AgentHarnessOwnEvent, AgentHarnessResources, AgentHarnessStreamOptions, ExecutionEnv, PromptTemplate, Skill } from "./types.js";
-/** [c209-C] codex 收口 C1/C2 — engine-provenance metadata a caller can stamp on the user message it
+/** [c209-C] 收口 C1/C2 — engine-provenance metadata a caller can stamp on the user message it
  *  mints (see the field docs on {@link UserMessage}). Threaded from `prompt`/`steer`/`followUp`/
  *  `nextTurn` options into the persisted message so derived views (auto-mode window, compaction
  *  serializer) work from METADATA, never from reminder-shape guessing. */
@@ -93,7 +93,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  hand a queued frame to the model once the run is unwinding, and — crucially — none may SPLICE one
      *  out of the queue either (that would delete the terminal undrained account the abort path owes it). */
     private aborting;
-    /** backlog #389 (codex adversarial r1, HIGH-1) — frames a boundary has REMOVED from a queue but that
+    /** backlog #389 (HIGH-1) — frames a boundary has REMOVED from a queue but that
      *  have not yet entered the model's context.
      *
      *  The abort latch alone leaves a real window: `drainQueuedMessages` splices first and then awaits
@@ -147,7 +147,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  gated: its splice opens a NEW run (idle-park redelivery), and a halt belongs to the run that
      *  minted it. */
     engineInjectionsHeld?: () => boolean;
-    /** RB-30 codex F1/F2: shared recovery sweep — collects engine-note payloads from the given queues
+    /** RB-30: shared recovery sweep — collects engine-note payloads from the given queues
      *  in DELIVERY order (steer before followUp, each queue forward — the live loop serves steering
      *  first, so the recovered redelivery must not present "later" frames ahead of "now/next"),
      *  removes those entries, and hands the payloads to the runner sink. Called from BOTH terminal
@@ -243,16 +243,16 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     prompt(text: string, options?: {
         images?: ImageContent[];
     } & UserMessageProvenance): Promise<AssistantMessage>;
-    /** [920] R2-③: an empty/whitespace-only injection with no images carries ZERO information — it
+    /** R2-③: an empty/whitespace-only injection with no images carries ZERO information — it
      *  must not mint a user frame (strict endpoints reject empty user content, and an empty follow-up would
      *  pointlessly extend the run by one turn). No-op, not a throw: injection callers are fire-and-
      *  forget lanes (wakeups, reminders) and a shell bug upstream must not crash the run. */
     private static emptyInjection;
-    /** REF-B6 — the ONE injection enqueue behind steer()/followUp()/nextTurn(): the [920] R2-③ empty-injection
+    /** REF-B6 — the ONE injection enqueue behind steer/followUp/nextTurn: the R2-③ empty-injection
      *  short circuit, the user frame, the RB-30 engine-payload SIDECAR (a WeakMap entry, never a message field —
      *  pre-prompt exits recover these too), the queue push, and the broadcast. All three lanes ship in ONE
      *  `queue_update` event (see emitQueueUpdate), so they are one protocol contract and must stay one
-     *  implementation: [920] R2-③ and RB-30 each had to be patched in three places.
+     *  implementation: R2-③ and RB-30 each had to be patched in three places.
      *
      *  The idle check is deliberately NOT here: its message differs per lane, and nextTurn() legitimately has
      *  none (queueing the NEXT prompt while idle is exactly what it is for). */

package/dist/engine/harness/agent-harness.js

@@ -2,6 +2,7 @@ import { snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
 import { runAgentLoop } from "../loop/agent-loop.js";
 import { resolveAgentCoreStreamFn } from "../loop/runtime-deps.js";
 import { normalizeEngineSegments } from "../../core/untrusted-text.js";
+import { AUTH_CARRIER_NAMES } from "../../brain/request-params.js";
 import { convertToLlm } from "./messages.js";
 import { AgentHarnessError, CompactionError, SessionError, toError, } from "./types.js";
 function createUserMessage(text, images, provenance) {
@@ -84,6 +85,28 @@ function mergeHeaders(...headers) {
     }
     return hasHeaders ? merged : undefined;
 }
+function dropAuthCarriers(bag) {
+    if (!bag)
+        return bag;
+    const out = {};
+    for (const [k, v] of Object.entries(bag)) {
+        if (!AUTH_CARRIER_NAMES.has(k.toLowerCase()))
+            out[k] = v;
+    }
+    return out;
+}
+function refuseAuthCarriersInStreamOptions(bag) {
+    if (!bag)
+        return;
+    for (const k of Object.keys(bag)) {
+        if (AUTH_CARRIER_NAMES.has(k.toLowerCase())) {
+            throw new Error(`streamOptions.headers must not carry an auth header ("${k}") — the run-static bag is not an auth channel ` +
+                `(the route pairing law reads options-borne carriers as per-model credentials, which a run-wide bag is not). ` +
+                `Put a deployment credential on the brain config (apiKey / headers, where its URL half is judged), or serve ` +
+                `per-model credentials through getApiKeyAndHeaders.`);
+        }
+    }
+}
 function applyStreamOptionsPatch(base, patch) {
     const result = cloneStreamOptions(base);
     if (!patch) {
@@ -239,6 +262,7 @@ export class AgentHarness {
         this.env = options.env;
         this.session = options.session;
         this.resources = options.resources ?? {};
+        refuseAuthCarriersInStreamOptions(options.streamOptions?.headers);
         this.streamOptions = cloneStreamOptions(options.streamOptions);
         this.systemPrompt = options.systemPrompt;
         this.systemBlocks = options.systemBlocks;
@@ -426,7 +450,7 @@ export class AgentHarness {
             const auth = await this.getApiKeyAndHeaders?.(model);
             const snapshotOptions = {
                 ...turnState.streamOptions,
-                headers: mergeHeaders(turnState.streamOptions.headers, auth?.headers),
+                headers: mergeHeaders(dropAuthCarriers(turnState.streamOptions.headers), auth?.headers),
             };
             const requestOptions = await this.emitBeforeProviderRequest(model, turnState.sessionId, snapshotOptions);
             return resolveAgentCoreStreamFn(this.runtime)(model, context, {
@@ -951,6 +975,7 @@ export class AgentHarness {
         return cloneStreamOptions(this.streamOptions);
     }
     async setStreamOptions(streamOptions) {
+        refuseAuthCarriersInStreamOptions(streamOptions?.headers);
         this.streamOptions = cloneStreamOptions(streamOptions);
     }
     setSystemPrompt(prompt, blocks) {

package/dist/engine/harness/messages.d.ts

@@ -20,7 +20,7 @@ export declare function createCustomMessage(customType: string, content: string
  *  product, not authored content. */
 export declare const NORMALIZED_CONTENT_PREFIX = "[invalid content block normalized to text]";
 /**
- * Fail-soft salvage for a possibly-contaminated LLM message ([868] 件b): any structurally-invalid
+ * Fail-soft salvage for a possibly-contaminated LLM message (件b): any structurally-invalid
  * `content` shape (bare object as the whole field, or a typeless/unknown-type block in the array) is
  * normalized to a prefixed text block. Legal messages are returned BY REFERENCE, untouched. Shared by
  * `convertToLlm` (provider leg) and `serializeConversation` (compaction leg) — one helper, two mouths.

package/dist/engine/harness/types.d.ts

@@ -62,7 +62,11 @@ export interface AgentHarnessStreamOptions {
     maxRetries?: number;
     /** Optional cap for provider-requested retry delays. */
     maxRetryDelayMs?: number;
-    /** Additional request headers merged with auth and lifecycle headers. */
+    /** Additional request headers merged with auth and lifecycle headers. NOT an auth channel: a bag
+     *  carrying an auth header (`authorization` / `x-api-key`, any case) is refused loudly at the
+     *  construction and `setStreamOptions` seats — the route pairing law reads options-borne
+     *  carriers as per-model credentials, which a run-wide bag is not. Deployment credentials go on
+     *  the brain config; per-model credentials ride `getApiKeyAndHeaders`. */
     headers?: Record<string, string>;
     /** Provider metadata forwarded with requests. */
     metadata?: SimpleStreamOptions["metadata"];
@@ -222,7 +226,7 @@ export interface ExecutionEnvExecOptions {
     /** Called with stderr chunks as they are produced. */
     onStderr?: (chunk: string) => void;
     /**
-     * VENDORED EDIT (design/116 detach, 飞轮 [C]): when fired mid-run, an env that supports detach ADOPTS the
+     * VENDORED EDIT (design/116 detach, [C]): when fired mid-run, an env that supports detach ADOPTS the
      * running child as a background process (its handle never leaves the env) and settles the exec with a
      * `detached` marker instead of killing it. Envs without detach support ignore this (the exec runs on).
      */
@@ -265,7 +269,7 @@ export interface FileSystem {
     /** Read a binary file. */
     readBinaryFile(path: string, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
     /** Create or overwrite a file, creating parent directories when supported. Implementation note
-     *  (RB-221 [1937]): the Node env replaces the file as a WHOLE (same-directory staging + fsync +
+     *  (RB-221): the Node env replaces the file as a WHOLE (same-directory staging + fsync +
      *  rename; `aborted` ⇒ target untouched), falling back to an in-place rewrite where rename cannot
      *  apply (cross-device, symlink chains, non-regular targets, read-only parent dir). Atomicity is an
      *  implementation quality, NOT an interface-level contract — a remote/transport env may only have a
@@ -451,7 +455,7 @@ export interface LeafEntry extends SessionTreeEntryBase {
     targetId: string | null;
 }
 /**
- * Prompt-epoch pin (campaign S3, prompt-assembly protocol §9.2) — a FIRST-CLASS typed entry (not a
+ * Prompt-epoch pin (stage S3, prompt-assembly protocol §9.2) — a FIRST-CLASS typed entry (not a
  * forgeable generic `custom` entry): which prompt-pack artifact this session is pinned to. Written
  * at session start (before the first conversation entry) and on legacy migration; every compaction
  * RESTATES the then-current descriptor inside its own `details.promptEpoch` (same-CAS atomicity,
@@ -478,7 +482,7 @@ export interface AnnouncedListingEntry extends SessionTreeEntryBase {
     models?: string[];
 }
 /**
- * REF-D3/D4 merge target: the active EnterWorktree session (M22 live-CC anchor, codex 终审 1.255 F2 —
+ * REF-D3/D4 merge target: the active EnterWorktree session (M22 live-CC anchor —
  * plain strings only, no closures, so it survives a durable suspend into `CheckpointState.activeWorktree`
  * verbatim). Canonical definition — `tools/worktree.ts` (the tool pair that owns this durably) re-exports
  * this type rather than declaring its own copy: the harness layer must never import FROM `tools/`
@@ -508,7 +512,7 @@ export interface WorkspaceState {
     activeWorktree?: ActiveWorktreeSession;
 }
 /**
- * design/155 (cli [1580]): the session's WORKSPACE STATE at a task settle — the tracked logical cwd
+ * design/155: the session's WORKSPACE STATE at a task settle — the tracked logical cwd
  * and the active EnterWorktree session. Ordinary continuation turns (a new task on the same
  * `spec.sessionId`) have NO checkpoint seed, so without this entry both refs silently reset to the
  * task root every turn (cd doesn't stick, ExitWorktree no-ops, the worktree leaks). Restore ladder
@@ -707,7 +711,7 @@ export interface SessionStorage<TMetadata extends SessionMetadata = SessionMetad
     getPathToRoot(leafId: string | null): Promise<SessionTreeEntry[]>;
     getEntries(): Promise<SessionTreeEntry[]>;
     /**
-     * Campaign S3 / RB-14 seam (blackboard [975] joint verdict): OPTIONAL epoch anchor for
+     * S3 / RB-14 seam (joint verdict): OPTIONAL epoch anchor for
      * bounded-tail backends. A durable backend that loads only `firstKeptEntryId..leaf` cannot show
      * the branch walk an epoch carrier when a rewind cuts BEFORE the latest compaction's restatement
      * (window: firstKept ≤ cut < compactionEntry) — `Session.getPromptEpoch()` falls back to this
@@ -844,7 +848,7 @@ export interface SessionRepo<TMetadata extends SessionMetadata = SessionMetadata
     delete(metadata: TMetadata): Promise<void>;
     fork(source: TMetadata, options: SessionForkOptions & TCreateOptions): Promise<Session<TMetadata>>;
     /**
-     * 2c session-sync (service [266]②): the FULL durable entry log for `sessionId`, oldest-first, with
+     * 2c session-sync: the FULL durable entry log for `sessionId`, oldest-first, with
      * `id`/`parentId` VERBATIM and BYPASSING any compaction floor — NOT `getEntries()`, which on a durable
      * backend that woke with a bounded F3 window returns only the tail (silently truncating pre-floor history).
      * Optional — a backend that supports cross-backend session export/migration implements it.
@@ -1110,7 +1114,7 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
         resources: AgentHarnessResources<TSkill, TPromptTemplate>;
     }) => string | Promise<string>);
     /**
-     * Campaign S4 (ADDITIVE): physical system blocks for block-aware Brains. Static per leg (same
+     * S4 (ADDITIVE): physical system blocks for block-aware Brains. Static per leg (same
      * freeze semantics as a string `systemPrompt`). When present it MUST correspond to the same
      * bytes as `systemPrompt` (the M13 projection duty is on the producer — prepare-task). Brains
      * that ignore it read `systemPrompt` and lose nothing.
@@ -1154,13 +1158,13 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
      */
     abortResultDetails?: () => Record<string, unknown> | undefined;
     /**
-     * service [398] C2: the loop's recovery/terminal trace sink, forwarded to `runAgentLoop`'s trace
+     * C2: the loop's recovery/terminal trace sink, forwarded to `runAgentLoop`'s trace
      * parameter (previously test-only — never passed in production, so the loop's six self-heal
      * recoveries were invisible outside display:false nudge messages). Must not throw; hot path.
      */
     loopTrace?: (step: import("../loop/agent-loop.js").LoopStep) => void;
     /**
-     * design/131 (service [404] 拍): per-task resilience intent flags, forwarded to every provider
+     * design/131 (拍): per-task resilience intent flags, forwarded to every provider
      * call (`StreamOptions.resilience`) so the deployment's decorator stack (degrading / failover /
      * breaker) can stand aside for this task. Absent ⇒ today's behavior.
      */