@sema-agent/core 5.57.0 → 5.59.0

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -3,7 +3,7 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RemoteEnvFailureNote, RunnerDeps, TaskSpec } from "../types.js";
 import type { PrepareResume, RunInternals } from "./prepare-task.js";
 /**
- * codex 1360 r2-r4 — rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
+ * rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
  * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
  * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
  * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
@@ -71,7 +71,7 @@ export interface PrepareWorkspaceRestoreInput {
     internals: Pick<RunInternals, "onWorkspaceResolved" | "isolation"> | undefined;
     /** borrowed-readonly — the durable-resume seats this phase reads: the checkpointed
      *  `workspaceHandle` (restore target) and `executesApprovedAction` (the divergence fail-closed
-     *  key — codex 1360 r6). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
+     *  key). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
     resume: Pick<PrepareResume, "workspaceHandle" | "executesApprovedAction"> | undefined;
     /** owned (value) — the pre-restore task root (isolation-aware initial derivation, computed in the
      *  driver). Dead after this call by design (R-5): later phases read the returned

package/dist/core/runner/runtask.d.ts

@@ -145,17 +145,17 @@ export declare class Runner {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
-    /** service [403](a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
+    /** (a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
      *  A 20G workspace otherwise pays a full bounded tree-walk (stat tens of thousands of files) EVERY
      *  task just to re-discover the same refusal; once too_large, skip further snapshots for that root
      *  (announced once via onError). E19 semantics unchanged — rewind for that root was already
-     *  impossible. codex 131 审 C: TTL'd (30min), not permanent — a long-lived Runner over a tree the
+     *  impossible. TTL'd (30min), not permanent — a long-lived Runner over a tree the
      *  user later SHRINKS re-probes instead of being locked out until restart.
      *  RB-430-b: `skipAnnounced` makes the SKIP itself observable — one announcement per cooldown window,
      *  so an operator can tell "this turn produced no snapshot" from "snapshots are working", without the
      *  per-turn log spam the latch exists to prevent. Cleared with the entry when the window elapses. */
     private snapshotTooLargeRoots;
-    /** 飞轮 [492]② — task notifications born BETWEEN turns (run torn down / harness already idle), parked
+    /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see
      *  {@link PendingSessionNotifications}. Not checkpointed — the producing handles are process-local. */
@@ -189,7 +189,7 @@ export declare class Runner {
         builtinAgents?: boolean;
         models?: Record<string, Model>;
     };
-    /** design/125 (codex 实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
+    /** design/125 (实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any
      *  assembler that sets `spec.toolPolicy`/`spec.hooks` without folding these in silently shadows the
@@ -228,7 +228,7 @@ export declare class Runner {
         models: Record<string, Model>;
         tiers?: Record<string, ModelRef>;
     }): void;
-    /** [1463]① — one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
+    /** one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
@@ -252,7 +252,7 @@ export declare class Runner {
     /**
      * design/101 §E19 — capture a working-tree snapshot of the just-finished turn, keyed by the leaf
      * `SessionTreeEntry.id`. Best-effort + never throws (errors route to `onError(phase:"rewind")`). Runs against
-     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT, service [263]) — the
+     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT) — the
      * snapshot is portable (env FileSystem ops). A deployment wanting VM-snapshot instead wires a VM-backed store.
      */
     private snapshotTurn;
@@ -276,7 +276,7 @@ export declare class Runner {
      * v1 serves only the `human`/`policy_ask` gate (F4). A `task_done` checkpoint (1C Path A) is not
      * resumable here — the caller orchestrates that one and reads its handle directly.
      *
-     * **🔒 Authorization boundary (design/80 D-2 / [122] invariant #1) — token-as-auth, scope is store-level
+     * **🔒 Authorization boundary (design/80 D-2 invariant #1) — token-as-auth, scope is store-level
      * isolation, NOT caller authorization.** `resume` is TOKEN-AS-AUTH: whoever presents a valid, still-`pending`
      * checkpoint token resolves it. The scope passed to the store CAS is the checkpoint's OWN `cp.scope` (read
      * off the row), so the store's scope-WHERE is store-level multi-tenant DATA isolation (one tenant's reaper /
@@ -318,13 +318,13 @@ export declare class Runner {
      * trigger to execute the pending action — a lost CAS rejects, never returns a re-running stream).
      *
      * **Eager (like {@link runTaskStream}):** once this resolves, the resumed run is already executing — the
-     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` (service [325]) tears down the
+     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` tears down the
      * rebuilt remote env even if you never iterate the stream. So abandoning the returned stream is safe (no leak,
      * no hang); it only means you
      * don't observe the resumed segment's events.
      */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
-    /** service [371]①: the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
+    /** the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
      *  otherwise has no `onForwardEvent`席位, so a subagent's task_progress ticks (child-isolated stream,
      *  only exit = the forward sink) were unreachable on resume. Deployment-owned, never a TaskSpec field.
      *  Parent effective-policy inheritance CONTRACT: a checkpoint whose `state.inheritedGate.
@@ -397,7 +397,7 @@ export declare class Runner {
     private recordCompactionReuse;
     private finish;
     /**
-     * design/48 remote seam + service [325]: tear down a per-task env minted by `executionEnvFactory` (e.g. a
+     * design/48 remote seam +: tear down a per-task env minted by `executionEnvFactory` (e.g. a
      * remote container, or a `withWorktreeIsolation` worktree) — this task owned its lifetime. Best-effort, like
      * `mcp.dispose`: a `destroy()` failure must not break the run. Only `ownedEnv` (factory-produced) is destroyed;
      * a caller-owned static `deps.executionEnv` outlives the task and is left untouched. The service control plane's
@@ -405,7 +405,7 @@ export declare class Runner {
      *
      * Runs from the run-loop tail AFTER every env-reader (finish()'s compaction `attachWorkingFiles` +
      * `snapshotTurn`'s rewind-files capture), so the working tree is still readable when they run. This ORDER is the
-     * fix for service [325]: the old in-`finish()` destroy ran BEFORE `snapshotTurn`, so a factory-minted
+     * fix for a teardown-order defect: the old in-`finish` destroy ran BEFORE `snapshotTurn`, so a factory-minted
      * remote/worktree lane snapshotted an already-destroyed env (plain host/static lanes were false-green).
      *
      * design/49 v1.5 / design/76 §2.5: a SUSPENDED (`suspendRef.token`) or `needs_review` (`reviewRef.token`) pause

package/dist/core/runner/runtask.js

@@ -2095,7 +2095,7 @@ export class Runner {
                     message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
                         `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
                         `delivered — only the interrupting semantics are absent.`,
-                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), sessionId: prepared.sessionId },
                 });
             }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
@@ -2172,7 +2172,7 @@ export class Runner {
                 undrainedUserAtEnd = counts;
                 return;
             }
-            for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(counts, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         };
@@ -3572,7 +3572,7 @@ export class Runner {
                 steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
                 followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
             };
-            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         }
@@ -3933,7 +3933,7 @@ export class Runner {
             if (!sameRouteIdentity(model, prepared.model)) {
                 const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
                 if (verdict !== undefined && !verdict.ok) {
-                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict }));
+                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict, sessionId: prepared.sessionId }));
                     model = prepared.model;
                     thinking = prepared.thinking;
                 }

package/dist/core/runner/session-rule-policy.d.ts

@@ -15,7 +15,7 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
  *  skill face is a separate capability decision with its own review). */
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 /** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
- *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} ([886]①b —
+ *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
  *  notebook_path outranks a decoy `file_path` for that tool).
  *
  *  REF-B3 — the ONE spelling of "tools this codebase can confine by path". Consumers:

package/dist/core/runner/teardown-bounded.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-470 (blackboard [2310], the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
+ * RB-470 (the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
  * cleanup legs on a run's settle path.
  *
  * The defect class: `resume()`/`runTask` settle only when the run body returns, and the body's tail

package/dist/core/runner/tool-disclosure.d.ts

@@ -77,7 +77,7 @@ export declare function classifyDeferred(opts: {
     fullTools: ReadonlyArray<ToolFingerprintInput>;
     deferMode?: "auto";
     model: Model;
-    /** [1044]② TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
+    /** TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
      *  `ToolSpec.defer` only reaches caller specs). Caller pre-filters to mounted names. */
     deferNames?: ReadonlyArray<string>;
     /** RB-400-a — inline-pin names (`TaskSpec.alwaysLoadTools` + the MCP tools whose server declared
@@ -253,7 +253,7 @@ export declare function createToolSearchTool(opts: {
      *  the listing text here and it rides THIS search's own result content — tail of the log, cache
      *  prefix untouched, same channel the activation announcement already uses. */
     listingRide?: (newlyActivated: readonly string[]) => string | undefined;
-    /** [1413]②b (TOOLS-PERFECT): the names callable DIRECTLY right now (mounted non-deferred + activated),
+    /** The names callable DIRECTLY right now (mounted non-deferred + activated),
      *  computed at call time (setTools swaps mutate the surface). Lets the miss note tell the model
      *  "Workflow is already available — call it" instead of a generic not-found that reads as absence
      *  (observed: the model treated the miss as unavailability and only recovered by guessing). */

package/dist/core/runner/turn-attachments.d.ts

@@ -166,7 +166,7 @@ export interface AttachmentState {
     skillsListingStarved?: boolean;
 }
 /**
- * [918] A1-R (codex reopen ①) — the date_change lane's OWN state, deliberately NOT an
+ * A1-R — the date_change lane's OWN state, deliberately NOT an
  * {@link AttachmentState} member: allocating that for a date-only run would activate the cadence
  * content scan + projection reducers on every non-opted run (the reopen's exact finding). Two
  * fields, zero reducers. `announcedDate` starts at the leg's frozen prefix date; the RUN LOOP
@@ -185,7 +185,7 @@ export interface DateChangeState {
  * (`ProjectMemoryLoad.instructionSources` — what the model is already seeing) and the RUN LOOP
  * commits it via {@link commitInstructionsChange} when it actually appends the frame (the producer
  * below is pure). The frame rides ABOVE the 8KB bundle cap as a fixed ≤{@link INSTRUCTIONS_CHANGE_BYTE_CAP}
- * item — no clipping face exists, so commit-at-append is sound (the [918] A1-R argument verbatim).
+ * item — no clipping face exists, so commit-at-append is sound (the A1-R argument verbatim).
  * `null` value = "announced as removed" (a reappearing file re-announces by hash inequality).
  */
 export interface InstructionsChangeState {
@@ -475,10 +475,10 @@ export declare function renderToolSearchUsageReminder(undiscovered: readonly str
  * float accumulator; no rounding anywhere in QFm or the renderer), kept verbatim: sema's inputs come
  * from integer micro-USD ÷ 1e6, so they render with ≤6 decimals by construction.
  */
-/** [915] A1 — CC messages.ts:4162 verbatim shape (de-branded is a no-op here: the text is neutral). */
+/** A1 — CC messages.ts:4162 verbatim shape (de-branded is a no-op here: the text is neutral). */
 export declare function renderDateChange(newDate: string): string;
 /**
- * [918] A1-R — the date_change producer (CC attachments.ts:1400-1443 parity): the system-prefix
+ * A1-R — the date_change producer (CC attachments.ts:1400-1443 parity): the system-prefix
  * date is FROZEN for the leg (upstream: "cached for the duration of the conversation" — re-rendering
  * the prefix at midnight costs ~920K effective tokens per overnight session, upstream's own comment);
  * when the boundary-time LOCAL date walks away from the last announced one, the model is told at the
@@ -625,7 +625,7 @@ export declare const AMBIENT_CONTEXT_NOTE = "This is ambient context \u2014 do n
  *  AND the run loop's resume transcript probe (MED-3②: "was the listing ever delivered?"). */
 export declare function agentListingInitialHeader(toolName: string): string;
 /**
- * [clay session-dedup, codex F1] Rebuild the EXACT announced name-set by replaying every listing
+ * [session-dedup] Rebuild the EXACT announced name-set by replaying every listing
  * frame in a transcript, in order: an initial frame RESETS the set to its names, a delta frame ADDS,
  * a removal frame DELETES. Header-presence alone is NOT a safe seed (it proves "announced once", not
  * WHAT was announced — seeding the current entries would swallow the A→A+B delta and removal-to-zero
@@ -684,12 +684,12 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  */
 export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[]): string | undefined;
 /** [c209-C] R2 C7 — the Q4 catalog line, single-sourced for the initial frame's tail AND the
- *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] codex 收口 C7 补口: an
+ *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] 收口 C7 补口: an
  *  EMPTY catalog renders an honest "(none)" — reachable only from the DRIFT arm (a known announced
  *  catalog shrank to nothing; the initial frame still omits the line when there is nothing to offer). */
 /** Single-sourced carrier prefix of the model-catalog line (renderer + replay parser). */
 export declare const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
-/** [codex S3 round 3] Replay the ANNOUNCED model catalog from stamped transcript texts — the last
+/** [] Replay the ANNOUNCED model catalog from stamped transcript texts — the last
  *  carried "Models available…" line wins (the line is re-carried in full on every drift, [c209-C]
  *  C7). Undefined = the catalog was never carried (unknowable — the drift compare stays silent,
  *  same conservative arm as an old checkpoint). */
@@ -734,7 +734,7 @@ export declare function commitSkillsListing(state: AttachmentState, entries: Rea
  * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
  * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
  * pin an arbitrarily large blob into the cached prompt prefix for the whole task (and, on the delta
- * lane, wedge the frame permanently against the 8KB cap — the codex 1362 F2 failure shape).
+ * lane, wedge the frame permanently against the 8KB cap — the failure shape).
  * Sized at the delta lane's own order of magnitude (the 8KB frame budget), leaving fence + header
  * room under the bundle cap once the "…" truncation marker lands.
  */
@@ -802,18 +802,18 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * loop's intact-survival consumption check (tools_delta discipline).
  */
 export declare function renderMcpDroppedTools(entries: ReadonlyArray<McpDroppedTool>): string;
-/** codex 1362 F2: per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
+/** per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
  *  the batch can never monopolize the boundary against the listing family/changed_files. */
 export declare const MCP_DROPPED_BATCH_MAX_BYTES = 4096;
 /**
- * codex 1362 F2 (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
+ * (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
  * render larger than the 8KB bundle cap gets prefix-CLIPPED by capAttachments; the intact-survival
  * drain predicate then never matches, the full array is retained, and every later boundary re-renders
  * and re-clips the identical prefix forever (tail entries never disclosed, permanent cap churn).
  * Selecting the longest prefix of COMPLETE entries whose render fits {@link MCP_DROPPED_BATCH_MAX_BYTES}
  * (always ≥1) restores monotonic drainage: the run loop splices exactly the delivered batch, the
  * tail rides later boundaries. Pure/deterministic so the drain predicate can re-derive the exact
- * snapshot. codex r2 F3: the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
+ * snapshot. the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
  * producer (tool ≤160 cps, reason ≤240 cps, both single-lined) — one rendered entry is always a
  * few hundred bytes, far under both this bound and the 8KB bundle cap, so the single-entry frame
  * can never be cap-clipped into a permanent re-render wedge.

package/dist/core/scheduler.d.ts

@@ -9,7 +9,7 @@
  *
  * core 薄壳裁定：core 只出接口 + 工具壳 + `hasScheduler` 门控；**持久化存储 / cron 时钟 / idle 触发 / 起新 task 全在
  * backend（daemon）**——core 是 request-driven 不常驻，绝不假装调度器。NodeExecutionEnv 不自带 daemon（不同于
- * background-shell 自带 spawn），而是**委托一个注入的 backend**（飞轮的 shell daemon 实现本接口）。
+ * background-shell 自带 spawn），而是**委托一个注入的 backend**（由一个 shell daemon 实现本接口）。
  */
 import type { ExecutionEnv, Result } from "../internal/harness-types.js";
 /** 一个已排未来意图的句柄。**backend-local、durable（daemon 持久化、重启存活）、对调用方不透明** —— 绝不暴露可枚举的 raw id。 */
@@ -114,11 +114,11 @@ export interface ScheduledTaskSummary {
      *  wakeup（cron/task 意图不受 stop 影响——CC 206 D9 语义）。老 backend 不回 = undefined（工具壳以
      *  label 兜底过滤）。 */
     mode?: "task" | "session-wakeup";
-    /** [c209-D2] codex B4：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无
+    /** [c209-D2]：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无
      *  公开面能辨认自己是会话级还是持久级（CronCreate 的即时 details 是唯一一瞥）。老 backend 不回 =
      *  undefined（层级未知，按既有 durable 直觉读）。 */
     lifetime?: "durable" | "session";
-    /** [c209-D2] codex B4：one-shot cron 回显（{@link ScheduledIntent.recurring}）；undefined = 老 backend
+    /** [c209-D2]：one-shot cron 回显（{@link ScheduledIntent.recurring}）；undefined = 老 backend
      *  或非 cron 意图。 */
     recurring?: boolean;
 }
@@ -143,7 +143,7 @@ export interface SchedulerCapability {
          * reap）。缺省 undefined/false = 不支持：工具壳收到 session 语义调用（CC 形 `durable` 缺省 false）时
          * 诚实拒绝并引导 `durable: true`——**绝不静默落成永生任务**。声明 `true` 的 backend MUST 实现 session
          * intent 的 reap 消费契约（见 {@link ScheduledIntent.lifetime} 注释）。
-         * 🔴 codex B2（TOCTOU 契约条款）：本能力位 MUST 在 backend **实例生命周期内不可变**（`readonly` 快照，
+         * 🔴（TOCTOU 契约条款）：本能力位 MUST 在 backend **实例生命周期内不可变**（`readonly` 快照，
          * 不得热翻）——工具壳的门控读与 `schedule()` 是两次操作，中途翻位会让 session intent 落到不会 reap 的
          * backend 上。防线双置：声明面不可变 + `schedule()` 实现 MUST 自行拒绝它无法履行 reap 契约的
          * `lifetime:"session"` intent（fail-closed 兜底，不依赖工具壳的先行探测）。
@@ -155,7 +155,7 @@ export interface SchedulerCapability {
          */
         readonly supportsSessionLifetime?: boolean;
         /**
-         * TB [991]②b / [997] 裁决 — 宿主是否有会兑现 `mode:"session-wakeup"` intent 的常驻唤醒腿。
+         * TB 裁决 — 宿主是否有会兑现 `mode:"session-wakeup"` intent 的常驻唤醒腿。
          * **opt-out 方向(与 supportsSessionLifetime 的 fail-closed 缺省相反,有意)**:session-wakeup
          * 是既有工作语义(daemon 宿主已在兑现),缺省关断=误伤现网——缺省/undefined=支持;headless 单发
          * 宿主(如 `-p` print 路径:零 daemon,进程终答即退)**显式声明 false** ⇒ 工具壳对 ScheduleWakeup

package/dist/core/secret-env.d.ts

@@ -8,7 +8,7 @@
  *
  * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
  * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
- * adapter (service host adapter, [265]). Keeping the single source of the secret PATTERN here means:
+ * adapter (service host adapter). Keeping the single source of the secret PATTERN here means:
  *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
  *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
  *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.

package/dist/core/sensitive-path-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { ToolPolicy } from "./tool-policy.js";
 /**
- * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} ([871]② — additive export).
+ * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} (additive export).
  * NO upstream verbatim anchor exists (cc-anchors/2.1.209 carries no sensitive/dangerous file-pattern
  * material), so this is an ENGINEERING-CONSENSUS set — each line states its tradeoff. The factory's
  * default behavior is unchanged (no implicit default list; wiring this set is the caller's opt-in:

package/dist/core/session-policy-store.d.ts

@@ -3,7 +3,7 @@
  * task-time {@link import("./tool-policy.js").ToolPolicy} (see {@link import("./runner/session-rule-policy.js").createSessionRulePolicy}).
  *
  * Why core-owned (not a parallel service store): the rules must be ENFORCED by the same policy fold that runs
- * every tool call, so storage and enforcement can't drift (the [210] capability-token invariant). core defines
+ * every tool call, so storage and enforcement can't drift (the capability-token invariant). core defines
  * the seam + an InMemory default; a deployment supplies a DURABLE cross-replica backend (its CAS-rev semantics
  * must match this InMemory one byte-for-byte — a cross-backend equivalence test is the contract).
  *
@@ -68,7 +68,7 @@ export interface SessionPolicyStore {
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
-     * 2c session-sync ([271]): every (principal, rules) record for `sessionId` across ALL principals — `getRules`
+     * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
      * is per-(sessionId, principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy.
      * The importer replays each via `putRules(sessionId, record.principal, record.rules)`. Optional — a backend
      * that supports cross-backend policy export implements it (local backend uses the in-memory/file impl).

package/dist/core/session-reconcile.d.ts

@@ -20,7 +20,7 @@ import type { ToolEffect } from "./types.js";
  *     decision to the model under its verification discipline.
  *   - Use the tool's {@link ToolEffect} to tune the message: `read` carries no risk at all; `idempotent`
  *     is replayable (re-issuing converges the state, but the interrupted attempt may have partially
- *     landed — RB-221 [1937]); `write` (and unknown tools, conservatively) must be verified/confirmed
+ *     landed — RB-221); `write` (and unknown tools, conservatively) must be verified/confirmed
  *     before repeating.
  *
  * This runs on `acquire` of a resumed session, before the next turn starts. New/empty sessions and
@@ -31,7 +31,7 @@ export interface OrphanToolCall {
     toolCallId: string;
     toolName: string;
     /**
-     * RB-398-a part 2 (blackboard [2105]): which half of the pair is missing.
+     * RB-398-a part 2: which half of the pair is missing.
      * - absent (the historical shape) = a **call-orphan**: an assistant `toolCall` with no matching
      *   `toolResult` — the reconcile-actionable kind ({@link reconcileInterruptedSession} closes it
      *   with a synthetic interrupted result).

package/dist/core/session-store.d.ts

@@ -95,14 +95,14 @@ export declare class TtlSessionStore implements SessionStore {
     private owners;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) share one session. */
     private pending;
-    /** Subagent transcript persistence (codex 323-r2) — placed ids whose durable deletion FAILED: the
+    /** Subagent transcript persistence — placed ids whose durable deletion FAILED: the
      *  placed fact for the retry lives HERE, not on a retained cache entry, because the repo may have
      *  torn down the shared session authority before its removal failed (the File repo closes the
      *  append fd pre-rmSync) — a retained entry would serve a session whose log is closed while the
      *  file still exists (append → log_closed, transcript revival broken until restart). The entry is
      *  dropped instead, so a re-acquire replays a FRESH authority from disk; success clears the row. */
     private pendingPlacedDeletes;
-    /** Subagent transcript persistence (codex 323-r3) — placed deletions IN FLIGHT: acquire awaits the
+    /** Subagent transcript persistence — placed deletions IN FLIGHT: acquire awaits the
      *  settlement before resolving the id, because the repo's delete tears down the shared session
      *  authority mid-flight — an acquire racing the await window could capture (or rebuild and then
      *  lose) an authority the delete is about to close, and the caller would hold a session whose
@@ -126,7 +126,7 @@ export declare class TtlSessionStore implements SessionStore {
      * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
      * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
      *
-     * …and the MIRROR direction (codex 323-r1 F1 — the pre-claim SQUAT race): the child session id is
+     * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
      * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
      * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
      * session — host-listable, never really-deleted, the declared full tier falsified in silence. On

package/dist/core/session.d.ts

@@ -58,7 +58,7 @@ export interface AcquiredSession {
  * Named `*StoreSummary` (not the bare `SessionSummary` an earlier version used) because that name collided
  * with an unrelated, differently-shaped `SessionSummary` downstream (the SDK's wire GET /v1/sessions row) —
  * same name, two shapes, the exact "同名异形" pattern a cross-repo cleanup was independently eradicating
- * elsewhere (黑板 [1912]/[1913]/[1914]). This type is this store interface's own projection, never itself
+ * elsewhere. This type is this store interface's own projection, never itself
  * serialized onto the wire — a service backend re-projects/renames its fields (`lastTaskId` → `lastRunId`)
  * when building the actual wire response.
  */

package/dist/core/shutdown-debug.d.ts

@@ -1,7 +1,7 @@
-/** [1093]②/[1105] shutdown forensics — opt-in (`SEMA_DEBUG_SHUTDOWN=1`) stderr trace of every
+/** shutdown forensics — opt-in (`SEMA_DEBUG_SHUTDOWN=1`) stderr trace of every
  *  teardown kill/reap action. stderr lands in the host's engine log, so a "who killed my process"
  *  hunt no longer dead-ends at the drain marker with zero shutdown-phase evidence (test-line pain,
- *  three times: [1076]④, [1093]②, [1103]③ — the reap lane was the blind spot of the first cut).
+ *  three times — the reap lane was the blind spot of the first cut).
  *  Zero default noise. Single source: the exec env's kill paths AND the task registry's reap paths
  *  ride this one function, so the flag can never half-cover the kill surface again. */
 export declare function shutdownDebug(msg: string, extra?: Record<string, unknown>): void;

package/dist/core/side-query.d.ts

@@ -9,7 +9,7 @@ export interface SideQueryToolDef {
     parameters: Tool["parameters"];
 }
 /**
- * The side-query INPUT message union (codex 1361 r2) — REQUEST shapes, not transcript entries. Each
+ * The side-query INPUT message union — REQUEST shapes, not transcript entries. Each
  * role keeps only what the brain wire actually consumes; the assistant arm drops the response
  * metadata (`api`/`provider`/`model`/`usage`/`stopReason`) a transcript entry carries — requiring
  * those would force callers to FABRICATE attribution, the exact shape-forging this verb exists to
@@ -85,7 +85,7 @@ export interface SideQueryResult {
     /** The RESOLVED pool model id the query was ROUTED to (the caller's ref resolved). See
      *  `servedModel` for the model that actually answered. */
     model: string;
-    /** The model that ACTUALLY served the reply (codex 1361: a degrading-brain deployment may fall
+    /** The model that ACTUALLY served the reply (a degrading-brain deployment may fall
      *  back mid-query — billing/quality attribution must follow the real server, not the routing
      *  intent). Equals `model` when no degradation occurred. */
     servedModel: string;

package/dist/core/spec-contract.d.ts

@@ -136,7 +136,7 @@ export declare function snapshotFrozenPaths(resolvedPaths: string[]): Map<string
  * Restore any frozen file whose on-disk bytes differ from the snapshot (belt for `echo > test/x`-style
  * bash writes the Write/Edit deny policy cannot see — fable-MIN2). Returns the number of files restored.
  *
- * Symlink-safe (codex 实现审 B2): a tampered entry that is no longer a regular file (the model swapped
+ * Symlink-safe (实现审 B2): a tampered entry that is no longer a regular file (the model swapped
  * it for a symlink pointing outside the root) is REMOVED first — the snapshot bytes are then written to
  * a fresh regular file, never THROUGH a link. When `rootDir` is given, the parent directory's physical
  * path is containment-checked too (a symlinked PARENT dir would also carry the write outside); an entry

package/dist/core/store-contracts/contract-harness.d.ts

@@ -4,13 +4,13 @@
  * already consumes in production). vitest-free BY CONTRACT: the kits run under any harness — a
  * vitest binding passes `(name, fn) => { it(name, fn); }`, a bare script passes nothing and gets
  * the sequential default — so a third-party store implementor needs NO test framework to verify
- * their backend (cli [2081]: shell/client-core run self-written runners).
+ * their backend (shell/client-core run self-written runners).
  */
 /**
  * Labels + schedules one contract case. May return a promise (collected and awaited by the kit's
  * final `Promise.all`) or register the case with a harness and return void (vitest `it`).
  *
- * ⚠️ Binding note (service [390], inherited from workflowRunStoreContract): cases are REGISTERED
+ * ⚠️ Binding note (inherited from workflowRunStoreContract): cases are REGISTERED
  * eagerly — an async runner that starts work immediately will interleave cases. Every case builds
  * its own fresh store via `make()`, so interleaving is safe UNLESS your binding's stores share
  * state (e.g. SQL twins on one table); such bindings must serialize inside `runAssertion`.

package/dist/core/store-contracts/contract-kit-version.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/159 S1 — the contract kit's version-lockstep constant (server [2058] requirement ①).
+ * design/159 S1 — the contract kit's version-lockstep constant (a downstream consumer requirement).
  *
  * The store-contract kit ships INSIDE `@sema-agent/core` and evolves in lockstep with the engine —
  * an assertion added because an engine release changed a store's semantics is only meaningful
@@ -15,7 +15,7 @@
  * ```
  *
  * A third party running an old kit against a new engine (or the reverse) would otherwise get a
- * silent false-green ([2021] A1 form) — e.g. a pre-2.2.0 kit has no idempotent-reopen entry, so a
+ * silent false-green — e.g. a pre-2.2.0 kit has no idempotent-reopen entry, so a
  * wiping SessionRepo passes it. Compare this constant against the `@sema-agent/core` version you
  * actually resolved (read the installed package.json — the lock file can pin something older than
  * what your manifest says).

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -9,7 +9,7 @@ import { type ContractAssertionRunner } from "./contract-harness.js";
  * 后端,于是没进 harness 的那个后端反复独立漂移 ——
  *   - RB-86:`stores/cc/mailbox-store.ts` 注释自陈 "the contract both bundled backends already
  *     honor, missing only here"(空箱 claimLease 不返回 null,还装上幽灵租约);
- *   - MB1(黑板 [1937]):CC 后端的 `ack` 根本不查 lease 表,注释自陈 "worse than the other two
+ *   - MB1:CC 后端的 `ack` 根本不查 lease 表,注释自陈 "worse than the other two
  *     backends' pre-fix bug"。
  * 两次漏的都是同一个后端。修法不是再补一次点,而是把契约本身变成全后端共跑的资产 —— design/159
  * 再进一步:第三方后端也拿得到同一份资产。

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -167,7 +167,7 @@ export async function mailboxAckOwnershipContract(mk, runAssertion) {
 export async function mailboxBundledOnlyContract(mk, runAssertion) {
     const { run: runRaw, settle } = beginContract(runAssertion);
     const run = (name, fn) => runRaw(name, () => withStores(mk, fn));
-    run("RB-251(黑板 [1937]):handle 含 NUL 被两个后端一致拒绝,且不得跨 (scope,handle) 串箱", async (make) => {
+    run("RB-251:handle 含 NUL 被两个后端一致拒绝,且不得跨 (scope,handle) 串箱", async (make) => {
         const s = make();
         const NUL = String.fromCharCode(0);
         await assert.rejects(s.append("s", `a${NUL}b`, msg("secret")));

package/dist/core/task-notification.d.ts

@@ -55,7 +55,7 @@ export interface TaskNotificationPayload {
      *  to default copy. */
     stoppedBy?: "user" | "parent" | "system" | (string & {});
     summary: string;
-    /** RB-386① ([2090]) — the failure reason DIGEST on a `status:"failed"` terminal notification
+    /** RB-386① — the failure reason DIGEST on a `status:"failed"` terminal notification
      *  (background_agent lanes): the same bounded text the settle stored as the registry row's `error`
      *  (the completed frame carries the full `result`; the failed frame used to carry NOTHING machine-
      *  readable — consumers had to parse the summary prose, which pre-fix didn't even include the
@@ -78,7 +78,7 @@ export interface TaskNotificationPayload {
     partial?: boolean;
     output_file?: string;
     usage?: unknown;
-    /** [1409] CC `<diagnostics>` parity: ENGINE-MINTED teaching text for the "result is empty/unexpected —
+    /** CC `<diagnostics>` parity: ENGINE-MINTED teaching text for the "result is empty/unexpected —
      *  now what" moment (per-agent read route / journal coordinate / resume command). Producers must mint it
      *  from engine values only (ids, store locators) — never from model-influenceable text. */
     diagnostics?: string;
@@ -98,7 +98,7 @@ export interface TaskNotificationPayload {
      *  preconditions, so the claim and the next SendMessage agree. Lets the parent decide
      *  continue-vs-restart without trial-and-error. Background-agent lane only. */
     resumable?: boolean;
-    /** P1-3(黑板 [1920]/[1921]/[1924]/[1925], cli/server 商定项) — a cross-channel correlation key for
+    /** A cross-channel correlation key for
      *  ONE completion event. The same task's completion fans out across several independent read faces
      *  today (this live notification frame, a durable inbox entry, and the `TaskOutput` poll projection)
      *  — a consumer previously had to reconstruct "are these the same completion?" from weaker signals
@@ -107,7 +107,7 @@ export interface TaskNotificationPayload {
      *  {@link "./task-registry.js".UnifiedTaskOutput.completionId} for the shared contract (open-shape
      *  `string`, absent until terminal settle, absent on a pre-P1-3 core build). Deliberately ABSENT on
      *  the `"external"` lane (`TaskStream.notify()`) — that lane has its own caller-supplied `seq`
-     *  correlation key ([1837]/[1925] cross-repo confirmed posture) and no registry-side settle point to
+     *  correlation key (confirmed posture) and no registry-side settle point to
      *  mint this from; core-minting one there would create two competing correlation keys on the same
      *  frame. */
     completionId?: string;
@@ -174,7 +174,7 @@ export interface SystemInjection<TPayload = unknown> {
     priority: SystemInjectionPriority;
     dedupKey: string;
     payload: TPayload;
-    /** S2b codex R2-F2' — resolved with the ACTUAL injection outcome by the runner's subscribe
+    /** S2b' — resolved with the ACTUAL injection outcome by the runner's subscribe
      *  listener: "queued" once the boundary steer accepted, "parked" when the idle tail-race (or the
      *  engine-note backlog cap) rejected and the payload was pended per session. Absent =
      *  fire-and-forget producer (no receipt to honor). */