@sema-agent/core 5.56.0 → 5.58.0

package/dist/tools/fs/read-deny.d.ts

@@ -157,7 +157,7 @@ export declare function matchSegmentPatterns(path: string, compiled: readonly Co
     readonly aliasResolved?: boolean;
 }): string | null;
 /**
- * codex r3 — the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
+ * the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
  * face section), for the resume pre-CAS ladder: it must refuse BEFORE the approval CAS everything
  * {@link compileReadDeny} would throw on AFTER it (a post-CAS compile throw consumes the human's
  * approval and strands the row), plus non-canonical spellings (normalizeEntry canonicalizes at every

package/dist/tools/fs/safety.d.ts

@@ -14,13 +14,13 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
  */
 export declare function fileArgPath(args: unknown): string | undefined;
 /**
- * The WRITE TARGET of a path-confinable write call, tool-aware ([886]①a/b — single source for every
+ * The WRITE TARGET of a path-confinable write call, tool-aware (b — single source for every
  * gate that confines a write target, same discipline as {@link fileArgPath} above):
  *
  *  · canonical `NotebookEdit` → `notebook_path` FIRST, `file_path`/`path` only as fallback. The tool
  *    itself writes `notebook_path`; its schema tolerates extra keys, so a stray/decoy `file_path` on a
  *    NotebookEdit call must never become the judged target while the real write lands elsewhere
- *    (a gate that read `file_path` first would confine the decoy — the [886]①b hole).
+ *    (a gate that read `file_path` first would confine the decoy — the hole).
  *  · every other tool → `file_path`/`path` first ({@link fileArgPath}), `notebook_path` as the
  *    historical fallback (unchanged behavior for the pre-existing gate callers).
  *
@@ -63,7 +63,7 @@ export interface ReadEntry {
         start: number;
         end: number;
     };
-    /** Millisecond timestamp of the last read/write-back that recorded this entry (blackboard
+    /** Millisecond timestamp of the last read/write-back that recorded this entry (
      *  2026-07-03, compact re-read parity: the post-compaction attachment picks the most RECENTLY
      *  read files — CC sorts readFileState by timestamp). Optional/additive: undefined (an entry
      *  seeded from an older checkpoint) sorts last, never breaks. */
@@ -125,7 +125,7 @@ export interface FsViolation {
  */
 export declare function isAbsolutePathForm(p: string): boolean;
 /**
- * Windows-FAMILY spelling of a path (codex 1.237 F6, extracted here so {@link canonicalizeTarget} judges
+ * Windows-FAMILY spelling of a path (extracted here so {@link canonicalizeTarget} judges
  * the UNC family by the same rule): drive-rooted (`C:\…`/`C:/…`), UNC-backslash (`\\host\share`), or a
  * RELATIVE path using `\` as its separator. Never keyed on `process.platform` — the exec env may be remote
  * and of the other family than the host. A `/`-rooted path is POSIX-form even when a file NAME inside it
@@ -184,7 +184,7 @@ export declare function hasBinaryExtension(path: string): boolean;
 export declare function imageMimeForRead(path: string): string | undefined;
 /** Verify the raw bytes actually ARE the image format the extension claims (magic-number sniff). Extension alone
  *  is forgeable: a `.png` holding text / an empty file / a truncated blob would otherwise become a malformed
- *  `ImageContent` that makes the NEXT provider request fail (400). Pure — no I/O. (batch-C, codex review.) */
+ *  `ImageContent` that makes the NEXT provider request fail (400). Pure — no I/O. (batch-C.) */
 export declare function imageMagicMatches(bytes: Uint8Array, mimeType: string): boolean;
 /** One contiguous byte pattern that must appear at a fixed offset for its signature to match. */
 export interface BinaryMagicSegment {
@@ -349,8 +349,8 @@ export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to t
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").
  *
- * RB-200 F2(形态一,CC 220 语料证实,@367198/@367671 — Edit/Write 两处读门的判据字面完全相同,
- * `!p || p.isPartialView`,两个工具用的是同一个条件): an AUTO-TRUNCATED read (the model asked for the
+ * RB-200 F2 (CC 220 corpus-confirmed, @367198/@367671 — Edit and Write spell the read gate identically,
+ * `!p || p.isPartialView`): an AUTO-TRUNCATED read (the model asked for the
  * file by default, no explicit offset/limit, and the token cap cut it anyway — {@link ReadEntry.isPartialView})
  * used to satisfy this gate exactly like a full read (`state.has(key)` alone was the whole check) — the
  * model could Write (full overwrite) or Edit a file having genuinely seen only its first page, silently
@@ -372,7 +372,7 @@ export declare function requireRead(state: ReadFileState, key: string): FsViolat
  */
 export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused \u2014 read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
- * RB-264 N1 ([1963] test AI 复验残留, repro `notebookedit-tool-read-gate-deadlock` assertion A.c2) —
+ * RB-264 N1 (repro `notebookedit-tool-read-gate-deadlock` assertion A.c2) —
  * the escape-hatch parenthetical for the OTHER shape of the read-before-edit refusal: the file was read,
  * but the read was AUTO-PAGINATED by the output token cap ({@link ReadEntry.isPartialView}), so only the
  * first page was ever seen. The oversize branch above has named its escape route since the fidelity
@@ -384,7 +384,7 @@ export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read to
  */
 export declare const PARTIAL_VIEW_READ_ESCAPE_HINT = "(Your last Read of this file returned only a PARTIAL view \u2014 the output token cap paginated it, so a default Read will keep returning the same page. Re-read it with explicit offset/limit (start from the page marker's next-page hint) until you have seen the part you are about to change; an explicit slice that fits satisfies the read-first rule. Or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
- * RB-264 ⑥W1 ([1963] test AI 复验残留) — the escape-hatch parenthetical for the ONE shape of the
+ * RB-264 ⑥W1 — the escape-hatch parenthetical for the ONE shape of the
  * read-first deadlock that nothing observable diagnoses: a file the Read tool REFUSES (binary /
  * BOM-less UTF-16 / unknown encoding) can never satisfy read-before-write, and — unlike the oversize
  * and partial-view shapes — leaves no trace the refusal renderer can stat for. It is therefore the

package/dist/tools/fs/search.d.ts

@@ -95,8 +95,8 @@ export declare function gitignoreMatcher(content: string): (rel: string, isDir:
 /** Build the combined ignore predicate (ignore-set ∪ .gitignore) for a JS-fallback walk.
  *  Exported so repo-map (design/72 §1) walks with the SAME ignore semantics as grep/glob.
  *
- * RB-200 F1(形态一,CC 220 语料证实,@368590-368592 Grep `T=["--hidden"]; for(N of Ok_) T.push("--glob",
- * "!"+N)`,@367957/367959-367965 Glob `CLAUDE_CODE_GLOB_HIDDEN` 默认 true 同样带 `--hidden`): CC's own
+ * RB-200 F1 (CC 220 corpus-confirmed, @368590-368592 Grep `T=["--hidden"]; for(N of Ok_) T.push("--glob",
+ * "!"+N)`, @367957/367959-367965 Glob `CLAUDE_CODE_GLOB_HIDDEN` defaults to true and also passes `--hidden`): CC's own
  * "keep it quiet" posture is NOT "every dot-prefixed name is invisible" — it's `--hidden` (show
  * everything dot-prefixed) plus an explicit VCS-directory exclusion list ({@link DEFAULT_IGNORE_DIRS}).
  * The blanket rule this function used to apply here (`base.startsWith(".")`) instead made EVERY hidden

package/dist/tools/monitor.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/135 G2 (审计 [485]① 🔴) — the `Monitor` tool: run a shell command in the background and watch its
+ * design/135 G2 (审计 🔴) — the `Monitor` tool: run a shell command in the background and watch its
  * stdout as a stream of NOTIFICATION EVENTS (the自主循环 core piece: "watch this and tell me when something
  * happens" without burning poll turns).
  *
@@ -17,10 +17,10 @@
  * TaskNotificationPayload lane at "later" priority (delivered at the next turn boundary like every
  * notification — ruled 2026-08-05; consecutive frames drain as one boundary batch, and a backlog past
  * the engine-note cap parks per session, so a chatty watcher cannot monopolize the run's boundaries).
- * 飞轮 [492]② (1.257): events born BETWEEN turns (run torn down / harness idle — the long-watch main case)
+ * (1.257): events born BETWEEN turns (run torn down / harness idle — the long-watch main case)
  * are no longer lost: the Runner parks them per session (bounded, drop-disclosing) and the session's next
  * run redelivers them through the same notification lane at its first turn boundary.
- * 飞轮 [511]③ (CC parity): a monitor's lifetime = min(timeout_ms, process exit, TaskStop); a `persistent`
+ * (CC parity): a monitor's lifetime = min(timeout_ms, process exit, TaskStop); a `persistent`
  * one is SESSION-anchored (reaped at session release). NEITHER is run-anchored: the run teardown leaves an
  * in-window non-persistent watch alive (process on the dispose except-list, watcher ticking, row kept), so
  * cross-turn watching — CC's main Monitor use case — works with the default persistent:false too; its

package/dist/tools/scheduler-tools.js

@@ -396,10 +396,19 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         wakeupChain = next.then(() => undefined, () => undefined);
         return next;
     };
+    const wakeupMountNote = sched.schedulerCapabilities.supportsSessionWakeup === false
+        ? `
+
+MOUNT NOTE: this host has no resident wakeup leg, so ${SCHEDULE_WAKEUP_TOOL_NAME} refuses every scheduling call here — do not plan a self-paced loop around it (\`stop: true\` still works).`
+        : sched.schedulerCapabilities.supportsSessionLifetime === true
+            ? ""
+            : `
+
+MOUNT NOTE: this host does not vouch for session-scoped scheduling, so a wakeup scheduled here is PERSISTENT — contrary to the paragraph above, it can outlive this session instead of ending with it. End the loop explicitly with \`stop: true\` when the work is done; do not rely on the session ending to cancel it.`;
     const scheduleWakeup = defineTool({
         name: SCHEDULE_WAKEUP_TOOL_NAME,
         contract: { contractId: "core.schedule_wakeup@1", implementationRevision: "1" },
-        description: SCHEDULE_WAKEUP_PROMPT,
+        description: `${SCHEDULE_WAKEUP_PROMPT}${wakeupMountNote}`,
         parameters: Type.Object({
             delaySeconds: Type.Optional(Type.Number({
                 description: "Seconds from now to wake up. Clamped to [60, 3600] by the runtime. Required unless `stop` is true.",
@@ -433,20 +442,33 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
             if (sched.schedulerCapabilities.supportsSessionWakeup === false) {
                 return errorResult(`Error (${SCHEDULE_WAKEUP_TOOL_NAME}): this environment has no resident scheduler that can honor a session wakeup — the wakeup would never fire. Wait in the foreground instead, or start the work in a self-detaching form.`);
             }
+            const sessionReapVouched = sched.schedulerCapabilities.supportsSessionLifetime === true;
             const clampedDelaySeconds = Math.min(3600, Math.max(60, Math.round(a.delaySeconds)));
             const wasClamped = clampedDelaySeconds !== a.delaySeconds;
             const pending = await listPendingWakeups();
-            if (!("err" in pending))
-                await cancelWakeups(pending.ids);
-            const r = await sched.schedule({ prompt: a.prompt, when: { kind: "delay", delaySec: clampedDelaySeconds }, label: WAKEUP_LABEL, mode: "session-wakeup" }, sessionCtx);
+            const cancelledCount = "err" in pending ? 0 : await cancelWakeups(pending.ids);
+            const cleanupIncomplete = "err" in pending || cancelledCount < pending.ids.length;
+            const r = await sched.schedule({
+                prompt: a.prompt,
+                when: { kind: "delay", delaySec: clampedDelaySeconds },
+                label: WAKEUP_LABEL,
+                mode: "session-wakeup",
+                ...(sessionReapVouched ? { lifetime: "session" } : {}),
+            }, sessionCtx);
             if (!r.ok)
                 return errorResult(`Error (${SCHEDULE_WAKEUP_TOOL_NAME}): ${r.error.message}`);
             const scheduledFor = Date.now() + clampedDelaySeconds * 1000;
             const hhmmss = new Date(scheduledFor).toTimeString().slice(0, 8);
             const clampNote = wasClamped ? ` (clamped to ${clampedDelaySeconds}s from your requested value)` : "";
+            const cleanupNote = cleanupIncomplete
+                ? " Warning: the previously pending wakeup(s) for this session could not all be listed or cancelled, so MORE THAN ONE wakeup may now be armed (you would be re-invoked twice). Call this tool with `stop: true` and then re-schedule to get back to a single one."
+                : "";
+            const reapNote = sessionReapVouched
+                ? ""
+                : " Note: this scheduler does not vouch for session-lifetime reap, so this wakeup is scheduled as a persistent one and may outlive the session — end the loop explicitly with `stop: true` rather than relying on the session ending.";
             return {
-                content: `Next wakeup scheduled for ${hhmmss} (in ${clampedDelaySeconds}s)${clampNote}. Nothing more to do this turn — the harness re-invokes you when the wakeup fires or a task-notification arrives.`,
-                details: { type: "schedule-wakeup", stopped: false, scheduledFor, clampedDelaySeconds, wasClamped },
+                content: `Next wakeup scheduled for ${hhmmss} (in ${clampedDelaySeconds}s)${clampNote}. Nothing more to do this turn — the harness re-invokes you when the wakeup fires or a task-notification arrives.${reapNote}${cleanupNote}`,
+                details: { type: "schedule-wakeup", stopped: false, scheduledFor, clampedDelaySeconds, wasClamped, reason: a.reason },
             };
         }),
     });

package/dist/tools/task-list.d.ts

@@ -62,7 +62,7 @@ export interface TaskListStore {
     delete(id: string): boolean | Promise<boolean>;
     list(): TaskListItem[] | Promise<TaskListItem[]>;
     allocateId(): string | Promise<string>;
-    /** codex S4 F2 — the transaction boundary for adapters whose backend outlives one wrapper
+    /** the transaction boundary for adapters whose backend outlives one wrapper
      *  instance (pg, shared files): when present, the tools run EVERY read-modify-write sequence
      *  inside `mutate` and the adapter supplies sequence-level atomicity (a DB transaction, an
      *  advisory lock keyed on the backend — not on this object). Absent ⇒ the tools fall back to the
@@ -70,7 +70,7 @@ export interface TaskListStore {
      *  backend IS this object) and wrong for anything shared wider — implement `mutate` there. */
     mutate?<T>(fn: (tx: TaskListStore) => Promise<T>): Promise<T>;
 }
-/** codex S4 r2-F3 — the clone policy behind the detached-copy contract: metadata must be JSON-shaped
+/** the clone policy behind the detached-copy contract: metadata must be JSON-shaped
  *  (structuredClone would accept — and SHARE — SharedArrayBuffer backing memory, and throws opaquely
  *  on functions/proxies; the tool lane is always JSON, so this guards DIRECT store users). */
 /**

package/dist/tools/web.d.ts

@@ -91,12 +91,12 @@ export declare function webFetchToolSpec(config?: WebFetchConfig): ToolSpec;
 export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool;
 /** {@link createWebFetchSummarizer}'s truncation bound — CC's `MAX_MARKDOWN_LENGTH`
  *  (WebFetchTool/utils.ts:128). Exported so a deployment wiring the reference summarizer doesn't need
- *  its own copy of this number to reason about (黑板 [1900]/[1902] — server asked for this explicitly,
+ *  its own copy of this number to reason about (a downstream deployment asked for this explicitly,
  *  to avoid a value-copy of the truncation threshold drifting from this one). */
 export declare const WEBFETCH_SUMMARY_MAX_CONTENT = 100000;
 /** {@link createWebFetchSummarizer}'s fixed guidelines block — CC's `makeSecondaryModelPrompt`
  *  (WebFetchTool/prompt.ts, non-preapproved-domain arm, guidelines verbatim). Exported alongside
- *  {@link WEBFETCH_SUMMARY_MAX_CONTENT} for the same reason (黑板 [1900]/[1902]): a deployment composing
+ *  {@link WEBFETCH_SUMMARY_MAX_CONTENT} for the same reason: a deployment composing
  *  its OWN summarizer (not this reference one) that still wants CC-parity guidance text doesn't need its
  *  own copy of this string. Not runtime-parameterized — the page content and the caller's `prompt` are
  *  interpolated AROUND this block, never inside it. */
@@ -160,9 +160,24 @@ export declare function resolveSummaryInputChars(model: Model, override?: number
 export interface WebFetchSummarizerOptions {
     /** Override the derived page-content budget (see {@link resolveSummaryInputChars}). */
     maxContentChars?: number;
+    /**
+     * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
+     * call against the summarizer's model, the side-query seat's form). Without this seat the
+     * summarizer called the brain with `{ signal }` only, so a summarizer model on a
+     * per-model-credential route fell to the brain's construction-time credential — which the
+     * key↔URL pairing gate refuses off the deployment root. Absent ⇒ the options object is
+     * byte-identical to the pre-seat shape (no keys added).
+     */
+    getApiKeyAndHeaders?: (model: Model) => Promise<{
+        apiKey?: string;
+        headers?: Record<string, string>;
+    } | undefined> | {
+        apiKey?: string;
+        headers?: Record<string, string>;
+    } | undefined;
 }
 /**
- * 黑板 [1870] L1 / [1900] — a reference {@link WebFetchConfig.summarize} implementation: reuses a
+ * A reference {@link WebFetchConfig.summarize} implementation: reuses a
  * caller-supplied `brain` (rather than requiring a dedicated second model) to extract a focused answer
  * from fetched content per the caller's `prompt`, instead of the tool dumping the whole (fenced, still
  * untrusted) page. CC ALWAYS routes fetched content through a secondary model this way
@@ -212,7 +227,7 @@ export interface WebSearchConfig {
     }>>;
     /** Max results returned to the model (default 10). */
     maxResults?: number;
-    /** Wall-clock budget for one `search` call, in ms. Default 30 000 (RB-231, 黑板 [1937]). The backend is
+    /** Wall-clock budget for one `search` call, in ms. Default 30 000 (RB-231). The backend is
      *  deployment-injected and may ignore the AbortSignal entirely, so this is enforced with BOTH an abort
      *  and a race — a hung backend must not hang the turn, and without this the deployment had no interface
      *  to bound it. */

package/dist/tools/web.js

@@ -725,9 +725,15 @@ export function createWebFetchSummarizer(brain, model, options = {}) {
         const truncated = inputTruncated ? content.slice(0, budget) + "\n\n[Content truncated due to length...]" : content;
         const userPrompt = `\nWeb page content:\n---\n${truncated}\n---\n\n${prompt}\n\n` + WEBFETCH_SUMMARY_GROUNDING_CLAUSE + "\n" + WEBFETCH_SUMMARY_GUIDELINES;
         const context = { messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] };
+        const auth = await options.getApiKeyAndHeaders?.(model);
+        const callOptions = {
+            signal,
+            ...(auth?.apiKey !== undefined ? { apiKey: auth.apiKey } : {}),
+            ...(auth?.headers !== undefined ? { headers: auth.headers } : {}),
+        };
         const msg = brain.complete
-            ? await brain.complete(model, context, { signal })
-            : await (await Promise.resolve(brain.stream(model, context, { signal }))).result();
+            ? await brain.complete(model, context, callOptions)
+            : await (await Promise.resolve(brain.stream(model, context, callOptions))).result();
         if (msg.stopReason === "error" || msg.stopReason === "aborted") {
             throw new Error(msg.errorMessage ?? `summarizer stopped with ${msg.stopReason}`);
         }

package/dist/tools/worktree.d.ts

@@ -1,5 +1,5 @@
 /**
- * 审计[485]③ / 深挖 G4 — the `EnterWorktree` / `ExitWorktree` tool pair: SESSION-level git-worktree
+ * 审计深挖 G4 — the `EnterWorktree` / `ExitWorktree` tool pair: SESSION-level git-worktree
  * isolation (CC 2.1.198 parity). EnterWorktree creates a managed worktree under `.sema-worktrees/`
  * (the same {@link WORKTREE_PARENT} the subagent `isolation:"worktree"` lane uses) and REALLY switches
  * the task's working directory into it; ExitWorktree returns to the original directory and cleans up.
@@ -27,7 +27,7 @@
  * containment is untouched: the worktree lives UNDER the task root, so resolveKey's canonical-within
  * check still holds for every subsequent fs op.
  *
- * ⚠️ Containment ruling (codex 终审 1.255 F4, deliberate): entering a worktree is a **cwd switch, NOT a
+ * ⚠️ Containment ruling (deliberate): entering a worktree is a **cwd switch, NOT a
  * sandbox**. resolveKey's containment anchor stays the ORIGINAL task root — it is deliberately NOT
  * re-anchored/tightened to the worktree dir, so `../../` from inside the worktree can still reach the
  * rest of the repository (which is WITHIN the task root and was reachable before Enter too), while
@@ -40,7 +40,7 @@
  * arbitrary command surface), but they create/delete on-disk state ⇒ effect:"write" (plan mode gates
  * them like every other write tool; read-only hands never mount them — see prepare-task).
  *
- * Durability (codex 终审 1.255 F2): the active session lives in a SHARED, ALL-SERIALIZABLE
+ * Durability: the active session lives in a SHARED, ALL-SERIALIZABLE
  * {@link WorktreeSessionRef} owned by prepare-task (never a closure-only var, and no captured destroy
  * closure — Exit re-derives removal as a plain `git worktree remove`). A durable suspend stamps it into
  * `CheckpointState.activeWorktree` (+ the cwd into `handsCwd`); resume re-seeds both, so
@@ -48,7 +48,7 @@
  */
 import type { ActiveWorktreeSession, AgentTool, ExecutionEnv } from "../internal/harness-types.js";
 import type { CwdRef } from "./fs/index.js";
-/** codex 终审 1.255 F2 — the ACTIVE worktree session, ALL-SERIALIZABLE (plain strings, no closures):
+/** the ACTIVE worktree session, ALL-SERIALIZABLE (plain strings, no closures):
  *  prepare-task owns the ref, stamps `current` into `CheckpointState.activeWorktree` at a durable
  *  suspend, and re-seeds it on resume, so ExitWorktree works across the suspend/resume boundary (the
  *  tree survives on disk; removal is re-derived as a plain `git worktree remove`).
@@ -80,7 +80,7 @@ export interface WorktreeToolsOptions {
      *  assigns it to the worktree path (a REAL cwd switch: Bash/Read/Edit/Write/Monitor all follow),
      *  ExitWorktree restores it. */
     cwdRef: CwdRef;
-    /** codex 终审 1.255 F2: the shared session-state ref (checkpointable — prepare-task serializes it into
+    /** the shared session-state ref (checkpointable — prepare-task serializes it into
      *  the durable checkpoint and re-seeds it on resume). Omitted ⇒ a private per-mount ref (same live
      *  behavior, minus durable-suspend survival — prepare-task always passes one). */
     session?: WorktreeSessionRef;

package/dist/tools/worktree.js

@@ -248,10 +248,10 @@ export function createWorktreeTools(env, opts) {
                 description: "true = remove the worktree even when it has uncommitted files or new commits, permanently discarding them. Default false: a changed worktree is kept and its changes listed. Cannot be combined with `keep: true`.",
             })),
             action: Type.Optional(Type.Union([Type.Literal("keep"), Type.Literal("remove")], {
-                description: '"keep" leaves the worktree and branch on disk; "remove" deletes both.',
+                description: '"keep" leaves the worktree on disk. "remove" takes the default removal path: an unchanged worktree is removed, a changed one is still KEPT unless `discard_changes: true`. The worktree is detached — no branch is created or deleted either way.',
             })),
             discard_changes: Type.Optional(Type.Boolean({
-                description: 'Required true when action is "remove" and the worktree has uncommitted files or unmerged commits. The tool will refuse and list them otherwise.',
+                description: 'Set true to remove the worktree even when it has uncommitted files or unmerged commits — they are permanently discarded. Without it a changed worktree is KEPT (the exit still completes and the reply lists the changes plus this escape), never refused.',
             })),
         }),
         effect: "write",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.56.0",
+  "version": "5.58.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",