@sema-agent/core 5.57.0 → 5.59.0

package/dist/stores/cc/sidecar-transcript.d.ts

@@ -6,12 +6,12 @@ import type { Message } from "../../internal/llm.js";
  * handover) can enumerate the teammates' transcript sidecars and project them into sema message
  * shapes for resume context.
  *
- * D-2 ruling (clay, design/152 §3): the sidecar is CC→sema ONE-WAY. sema's transcript truth source
+ * D-2 ruling (design/152 §3): the sidecar is CC→sema ONE-WAY. sema's transcript truth source
  * is the SessionStore — this module never writes, and nothing here mints a second truth source
  * (the dual-truth-source pathology design/151 just eliminated stays eliminated). Dual-write is a
  * separate ruling gated on a real user need.
  *
- * Disk shape ([1545] 定盘, cc-teams-diskform README):
+ * Disk shape (cc-teams-diskform README):
  *  - flat sidecars:    `subagents/agent-<id>.jsonl`
  *  - nested children:  `subagents/<parentSeg>/agent-<id>.jsonl` (parent-segment subdirectories)
  *  - workflow runs:    `subagents/workflows/<runId>/agent-<t>.jsonl`
@@ -53,7 +53,7 @@ export interface CcSidecarHandle {
  * Enumerate every transcript sidecar under a CC `subagents/` directory, walking nested
  * parent-segment subdirectories (symlinks not followed). Missing directory ⇒ `[]` — the CC tree is
  * a PARTIAL tree (headless runs write sidecars but a REPL-only subtree may be absent entirely), so
- * absence is a normal state, never a throw ([1545] 纠偏 #3 posture).
+ * absence is a normal state, never a throw.
  * Order is deterministic: lexicographic by (segments join, agentId).
  */
 export declare function listCcSidecarAgents(subagentsDir: string): CcSidecarHandle[];

package/dist/stores/file/fs-atomic.d.ts

@@ -19,7 +19,7 @@ export declare function resolveDataRoot(explicit?: string): string;
 /** Ensure a directory exists with 0o700 perms (idempotent). */
 /**
  * Atomically CREATE `target` carrying `content` — it appears in ONE step already fully written, no empty/partial
- * window. Fixes the create-then-write race (codex review BUG-1/BUG-3): a reader/pruner can see a half-written
+ * window. Fixes the create-then-write race: a reader/pruner can see a half-written
  * file, and a crash mid-write leaves a zero-byte target a retry would silently keep. Writes a temp in `target`'s
  * OWN dir (same FS → `link` is atomic) + fsync, then `linkSync`-publishes it; throws `EEXIST` if `target` exists.
  */
@@ -134,7 +134,7 @@ export declare class AppendLog {
      *
      * RB-66 (2026-07-25, red probe): `writeSync(fd, string)` issues ONE write(2) and may SHORT-WRITE — the
      * same defect class this file's own `writeThenLink` already documents and fixed ("silently SHORT-WRITES
-     * (codex/Opus review B1)"), never propagated to this shared primitive. A short write here leaves a torn
+     * "), never propagated to this shared primitive. A short write here leaves a torn
      * line with no trailing newline, so the NEXT append concatenates onto it and replay drops BOTH records.
      * Loop until every byte lands (write(2) returns how many it took) — the O_APPEND atomicity per call is
      * unchanged, and a genuine I/O error still throws.

package/dist/stores/file/index.d.ts

@@ -127,7 +127,7 @@ export declare class FileStorageBackend {
      *  `RunnerDeps.fileSnapshotStore`. Content-addressed blobs persist across restarts (local-only; a remote env
      *  defers rewind to its own VM-snapshot backend). */
     readonly fileSnapshotStore: FileSnapshotStore;
-    /** SVC-2 / [381]⑥ (onboarded per [375]) — file-backed durable workflow resume journal. Wire into
+    /** SVC-2 (onboarded per) — file-backed durable workflow resume journal. Wire into
      *  `RunnerDeps.workflowJournalStore` so `resumeFromRunId` survives a process restart on a TOC box. */
     readonly workflowJournalStore: WorkflowJournalStore;
     /** design/164 件五 — file-backed cross-task usage-governance ledger. Wire into

package/dist/stores/file/session-store.d.ts

@@ -71,11 +71,11 @@ export declare class FileSessionRepo implements SessionRepo {
     placementOf(sessionId: string): Promise<SessionPlacementRecord | undefined>;
     delete(metadata: SessionMetadata): Promise<void>;
     fork(sourceMetadata: SessionMetadata, options?: SessionForkOptions): Promise<Session>;
-    /** 2c session-sync ([275], the FILE half of [266]②): the FULL oldest-first log for export. The file backend
+    /** 2c session-sync (the FILE half): the FULL oldest-first log for export. The file backend
      *  has NO F3 floor — `read` returns EVERY persisted entry (`id`/`parentId` verbatim) — so this is the complete
      *  log, BYPASSing any bounded tail (matches `InMemorySessionRepo.exportEntries`). Missing file → not_found. */
     exportEntries(sessionId: string): Promise<SessionTreeEntry[]>;
-    /** 2c session-sync ([275]): import a verbatim log into `sessionId`. The single fail-closed invariant gate runs
+    /** 2c session-sync: import a verbatim log into `sessionId`. The single fail-closed invariant gate runs
      *  FIRST ({@link validateEntriesForImport}); `owner` is a durable multi-tenant concept the local file backend
      *  has no field for (accepted, unused — same as `InMemorySessionRepo`). Writes the WHOLE file (meta + entries)
      *  atomically via tmp→fsync→rename — the rename is the commit point, so a crash leaves either nothing or an

package/dist/stores/file/workflow-journal-store.d.ts

@@ -70,7 +70,7 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
     private get scopes();
     constructor(root: string, fsyncEnabled?: boolean);
     private pathFor;
-    /** [1409]③ CC local form: the run's on-disk journal path for the notification diagnostics line.
+    /** CC local form: the run's on-disk journal path for the notification diagnostics line.
      *  Traversal-shaped ids (LLM-controlled on some paths) degrade to undefined, never throw. */
     locator(runId: string): string | undefined;
     /** Replay a run's ledger: last-writer-wins per ordinal; a torn/unparsable line is skipped (uncommitted). */
@@ -78,7 +78,7 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     load(runId: string, scope: string): Promise<WorkflowJournalEntry[]>;
     /**
-     * RB-242 — the claim file for `(sourceRunId, scope)`. Keyed by BOTH ([1981]): a cross-scope caller already
+     * RB-242 — the claim file for `(sourceRunId, scope)`. Keyed by BOTH: a cross-scope caller already
      * resolves to an empty journal (it cannot fork anything), so letting it share one claim key would only hand
      * any tenant a denial-of-resume lever over another's runs. The scope is folded in as a digest rather than
      * a sanitized literal so two distinct scopes can never collapse onto one filename by sanitization.
@@ -111,7 +111,7 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
      */
     private sweepExpiredClaims;
     /**
-     * RB-242 ([1981]) — admission for a resume off `sourceRunId`. The LOCAL (TOC) twin of server's SQL
+     * RB-242 — admission for a resume off `sourceRunId`. The LOCAL (TOC) twin of the SQL-backed
      * `idem_key UNIQUE` + TTL: publishing the claim file is one atomic namespace operation that fails EEXIST
      * against anyone who got there first, so two processes racing on the same box (the shape the in-process
      * `startWorkflow` guards cannot see — a shell restart resuming a run a still-live process is already
@@ -121,7 +121,7 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
         granted: boolean;
         holder?: string;
     }>;
-    /** RB-242 ([1981]) — release ONLY a claim this `newRunId` still holds. A claim that is already gone (TTL-reaped
+    /** RB-242 — release ONLY a claim this `newRunId` still holds. A claim that is already gone (TTL-reaped
      *  and possibly taken over) is a no-op: unlinking a successor's claim would re-open the very fork this prevents. */
     releaseResumeClaim(input: ResumeClaimArgs): Promise<void>;
     /** GC (service extra, mirrors the SQL twins): drop the run's ledger once the run is terminal + retained. */

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -415,7 +415,7 @@ export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
  *    no-egress envelope — every beat still runs allowlisted readers + literal `sleep`), and the
  *    walltime axis cascades a hard kill regardless. A deployment wanting NO command-substitution at
  *    all can prefer `{<lo>..<hi>}` or a literal list, which bash expands internally with no command
- *    run. (Codex falsification review flagged the substitution as [high] and recommended dropping it;
+ *    run. (falsification review flagged the substitution as [high] and recommended dropping it;
  *    kept per the ruling that names `$(seq <int> <int>)` as the one exemption — recorded for a
  *    tightening decision, since the brace form is a drop-in equivalent.)
  *  · STDIN-BLOCKING BODY (an availability residual, not a safety one). CLOSED for the shape this note

package/dist/tools/fs/encoding.d.ts

@@ -33,7 +33,7 @@ export interface DecodedTextFile {
     encoding: DetectedFileEncoding;
     /** Dominant line ending of the ORIGINAL bytes (majority vote — CC `CKt` @58184 同算法).
      *  Deliberately NOT per-line lossless: a mixed-endings file is unified to the dominant ending on
-     *  the first edit (codex 镜头1/2 LOW, accepted non-goal — CC behaves the same way).
+     *  the first edit (镜头1/2 LOW, accepted non-goal — CC behaves the same way).
      *  RB-285 (encoding LOW): the COUNTING RULE is CC's; the SAMPLE is not. CC votes on the first 4096
      *  characters only (`CKt(s.slice(0, 4096))` @58201) while {@link detectLineEndings} below votes on
      *  the whole file — so a file whose first 4KB is LF and whose bulk is CRLF gets opposite verdicts.
@@ -41,7 +41,7 @@ export interface DecodedTextFile {
      *  the entire file, so sampling a prefix is exactly the case where the cheap answer flips the
      *  remaining 99% of the lines. Registered as a deliberate delta, not parity. */
     endings: DetectedLineEndings;
-    /** codex 双镜头 MED: a utf16le body with an ODD byte count is TRUNCATED/corrupt — decoding would
+    /** 双镜头 MED: a utf16le body with an ODD byte count is TRUNCATED/corrupt — decoding would
      *  silently drop the dangling byte and a later write-back would destroy it permanently. Flagged so
      *  the tool layer fails closed instead of "repairing" the file. */
     malformed?: true;
@@ -65,7 +65,7 @@ export declare function encodeTextForFile(text: string, encoding: DetectedFileEn
  *  Deliberately does NOT strip a leading U+FEFF: an `old_string` starting with one may be quoting
  *  genuine file content — use {@link normalizeFileText} only where the string stands for a whole file. */
 export declare function normalizeEditText(s: string): string;
-/** RB-222 ([1937] W2) — split a leading U+FEFF off MODEL-SUPPLIED whole-file text (CC `CTe` parity,
+/** RB-222 — split a leading U+FEFF off MODEL-SUPPLIED whole-file text (CC `CTe` parity,
  *  220 @365630). The BOM is a file-level byte marker, not text: decodeTextBytes strips it on the way
  *  in, so it can never live in the normalized coordinate. Only for strings that stand for a WHOLE
  *  file (Write `content`, readFileState seeding) — a decoded file text's leading U+FEFF is genuine
@@ -74,7 +74,7 @@ export declare function splitLeadingBom(text: string): {
     hadBom: boolean;
     text: string;
 };
-/** RB-222 ([1937] W2) — CC `X9` parity (220 @365635 = BOM-strip + CRLF-normalize): THE coordinate
+/** RB-222 — CC `X9` parity (220 @365635 = BOM-strip + CRLF-normalize): THE coordinate
  *  every readFileState hash lives in (Read/Edit/Write staleness all hash `decodeTextBytes(...).text`).
  *  A hash taken on raw model content with a leading U+FEFF can never agree with any later re-read. */
 export declare function normalizeFileText(s: string): string;

package/dist/tools/fs/fs-bash.d.ts

@@ -126,11 +126,11 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
      * unconfined; passing this never gates anything.
      */
     additionalRoots?: readonly string[];
-    /** RB-370 ② (cli [2088]): override of the `timeout` parameter's DEFAULT budget, in ms — see
+    /** RB-370 ② (cli): override of the `timeout` parameter's DEFAULT budget, in ms — see
      *  {@link import("./index.js").HandsToolkitOptions.bashDefaultTimeoutMs} for the resolution
      *  contract (options over env over constant; invalid values discarded). */
     bashDefaultTimeoutMs?: number;
-    /** RB-370 ② (cli [2088]): override of the `timeout` parameter's engine CEILING, in ms — only-widen
+    /** RB-370 ② (cli): override of the `timeout` parameter's engine CEILING, in ms — only-widen
      *  vs the resolved default; see {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs}. */
     bashMaxTimeoutMs?: number;
     /** Structured sink for this leg's timeout-cap discard announcements — consumed by
@@ -167,7 +167,7 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
  * the operand cannot be resolved statically (there is nothing to degrade to).
  */
 export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, opts?: {
-    /** RB-370 ② (cli [2088]): same timeout-cap overrides the full `bash` leg takes — see
+    /** RB-370 ② (cli): same timeout-cap overrides the full `bash` leg takes — see
      *  {@link import("./index.js").HandsToolkitOptions.bashDefaultTimeoutMs} /
      *  {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs} (类修完整域: both foreground
      *  legs share runShell's clamp, so both must share the configurable resolution). */

package/dist/tools/fs/fs-pdf.d.ts

@@ -34,7 +34,7 @@ type ReadPdfReturn = string | {
  * it was not — every `document` card, sized or not, was dropped at the gate, making the 48K rule dead
  * code and the pages/fallback-level disclosure invisible to a host. The word is registered now.
  *
- * Degradation chain v2 (clay 拍: the brain-level placeholder is NOT the end state): when the SERVING model
+ * Degradation chain v2 (裁定: the brain-level placeholder is NOT the end state): when the SERVING model
  * cannot take a native document block (`caps.document === false` — e.g. any openai-compatible API), the
  * whole-PDF path degrades IN THE TOOL (the only layer holding env.exec), best first:
  *   1. `pdftotext -layout` text extraction → the content arrives as TEXT (Read byte-cap discipline applies);

package/dist/tools/fs/fs-shared.d.ts

@@ -65,7 +65,7 @@ export declare function truncatedUtf16BodyMessage(tool: string, path: string): s
 /** Why a bash_readonly refusal is terminal rather than escalated. Appended by every arm of that refusal
  *  family; the arms differ in what they found, never in what the model can do about it. */
 export declare const BASH_READONLY_CONFINEMENT_NOTE = "bash_readonly is confined to the workspace roots; it has no approval path, so the call is refused rather than escalated.";
-/** RB-222 ([1937] W2) r3 — the readFileState hash coordinate for a file that was JUST WRITTEN via
+/** RB-222 r3 — the readFileState hash coordinate for a file that was JUST WRITTEN via
  *  `encodeTextForFile`: decode the EXACT payload handed to `env.writeFile`, i.e. what the next
  *  re-read's `decodeTextBytes` will produce. A blanket `normalizeFileText` is WRONG on the
  *  encode-preserving Edit lanes: a leading U+FEFF in the new text is stripped by the next read only
@@ -209,7 +209,7 @@ export declare function bashTimeoutArgRefusal(timeoutMs: number | undefined, cap
     maxMs: number;
 }): string | undefined;
 /**
- * RB-370 ②/③ (cli [2088] 请求③) — the SINGLE authority for the Bash `timeout` parameter's two numbers:
+ * RB-370 ②/③ — the SINGLE authority for the Bash `timeout` parameter's two numbers:
  * the default budget applied when the model omits `timeout`, and the engine ceiling requests are
  * clamped to. The 120s/600s constants themselves are CC 220-same; what CC additionally has — and this
  * resolver adds — is configurability.
@@ -223,7 +223,7 @@ export declare function bashTimeoutArgRefusal(timeoutMs: number | undefined, cap
  * default floors the cap. Invalid values (non-finite / <= 0) are discarded at every leg, options
  * included, exactly like CC's env read.
  *
- * ③ Readable seam (cli [2088]): a shell/host rendering its OWN copy of the Bash tool description MUST
+ * ③ Readable seam: a shell/host rendering its OWN copy of the Bash tool description MUST
  * read the true values from here instead of holding a sibling constant — the engine's description/param
  * text and its runtime clamp both interpolate this function's output (resolved once per tool instance),
  * so a self-held "600s" only matches by coincidence and forks silently the moment a deployment
@@ -271,7 +271,7 @@ export declare function clipShellOutput(s: string): string;
  * ALREADY fully in memory here (the env delivered them whole — only `clipShellOutput` above decides how
  * much of that the model's turn actually sees) — the gap this closes is that the omitted middle was
  * simply discarded, forcing a blind full re-run to recover output that was, in fact, captured. "Whole"
- * means whatever THIS layer received, not a guarantee about what the process originally wrote (codex
+ * means whatever THIS layer received, not a guarantee about what the process originally wrote (
  * review P1): the env's own rolling-tail cap (`MAX_EXEC_OUTPUT_BYTES`, exec-output-tail.ts) can already
  * have dropped the head before delivery on a truly enormous single command — this file is a faithful copy
  * of the received bytes either way, and still carries that cap's own `markTruncated()` marker when it
@@ -379,7 +379,7 @@ export declare function countLines(s: string): number;
  *  home and carries the session mark when one is threaded (the recorded wire-form divergence). */
 export declare function seededFileUnchangedReminder(filePath: string, mark?: string): string;
 /**
- * RB-197②(codex 交叉复审命中,已修) — true when `resultText` is one of the Read tool's TWO dedup
+ * RB-197②(交叉复审命中,已修) — true when `resultText` is one of the Read tool's TWO dedup
  * markers (the ordinary unchanged-since-last-read stub below, or {@link seededFileUnchangedReminder})
  * rather than a genuine content transmission. A consumer deciding "is this file's real content
  * present in THIS message" (e.g. auto-compaction's kept-tail visibility scan) must treat a stub hit
@@ -431,7 +431,7 @@ export declare function seedReadFileStateFromTranscript(state: ReadFileState, ke
  * The read-before-edit gate tightens as a consequence, matching CC: after a compaction the model must
  * re-Read a summarized-away file before editing it, instead of blind-editing from a stale recollection.
  *
- * RB-197②(独立复审 + codex 命中,已修): a THIRD category besides seeded/re-attached — a file whose most
+ * RB-197②(独立复审 + 命中,已修): a THIRD category besides seeded/re-attached — a file whose most
  * recent Read is still visible verbatim in the compaction's KEPT tail is deliberately left OUT of
  * `attachedComplete` (re-attaching it would just duplicate content already in context), but its
  * existing read-state entry must survive unmodified for the SAME reason a seeded entry does: the

package/dist/tools/fs/index.d.ts

@@ -63,7 +63,7 @@ export interface HandsToolkitOptions {
     }) => void;
     /** design/116 detach: the run-local per-tool-call detach hub (mid-flight ctrl+b → adopt as background). */
     detachHub?: import("../../core/tool-detach.js").ToolDetachHub;
-    /** RB-370 ② (cli [2088]): the Bash `timeout` parameter's DEFAULT budget, in ms — applied when the
+    /** RB-370 ② (cli): the Bash `timeout` parameter's DEFAULT budget, in ms — applied when the
      *  model omits `timeout`. Resolution (options over env over constant — the standing sema discipline:
      *  deployments configure the tool, not the process): this field ?? env `BASH_DEFAULT_TIMEOUT_MS` ??
      *  120000; invalid (non-finite / <= 0) values are discarded at every leg. See
@@ -71,7 +71,7 @@ export interface HandsToolkitOptions {
      *  description, so the advertised numbers always match the enforced ones. Additive: absent ⇒
      *  byte-compat 120s. Applies to both shell legs (`bash` and `bash_readonly`). */
     bashDefaultTimeoutMs?: number;
-    /** RB-370 ② (cli [2088]): the Bash `timeout` parameter's engine CEILING, in ms — requests above it
+    /** RB-370 ② (cli): the Bash `timeout` parameter's engine CEILING, in ms — requests above it
      *  are clamped (with the RB-370 requested/capped disclosure naming THIS value). Resolution: (this
      *  field ?? env `BASH_MAX_TIMEOUT_MS` ?? 600000), then floored at the resolved default — CC's own
      *  only-widen semantic: a ceiling below the default is a narrowing intent = invalid, ignored in

package/dist/tools/fs/notebook.d.ts

@@ -1,6 +1,6 @@
 import type { ImageContent } from "../../internal/llm.js";
 /**
- * RB-227 ([1937] N1) — the Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells
+ * RB-227 — the Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells
  * with outputs (CC 2.1.220 parity: `Ctd`/`wtd`/`Zx_`/`Qx_`/`eI_`/`tI_`/`Atd`, pretty220.js
  * :371265-:371426), never as raw JSON text. The raw-JSON rendering let a notebook's base64 outputs
  * overflow the Read token cap, auto-paginate into an `isPartialView` entry, and thereby lock

package/dist/tools/fs/pdf.d.ts

@@ -1,5 +1,5 @@
 /**
- * PDF read pipeline (service [411]② + 审计 [485]⑤ — CC FileReadTool parity).
+ * PDF read pipeline (+ 审计 — CC FileReadTool parity).
  *
  * CC ground truth (original-source-code, 取证 2026-07-07):
  * - Whole-PDF path (`FileReadTool.ts:987-1016` + `utils/pdf.ts:88-103`): the file bytes are base64'd and

package/dist/tools/fs/read-deny.d.ts

@@ -157,7 +157,7 @@ export declare function matchSegmentPatterns(path: string, compiled: readonly Co
     readonly aliasResolved?: boolean;
 }): string | null;
 /**
- * codex r3 — the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
+ * the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
  * face section), for the resume pre-CAS ladder: it must refuse BEFORE the approval CAS everything
  * {@link compileReadDeny} would throw on AFTER it (a post-CAS compile throw consumes the human's
  * approval and strands the row), plus non-canonical spellings (normalizeEntry canonicalizes at every

package/dist/tools/fs/safety.d.ts

@@ -14,13 +14,13 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
  */
 export declare function fileArgPath(args: unknown): string | undefined;
 /**
- * The WRITE TARGET of a path-confinable write call, tool-aware ([886]①a/b — single source for every
+ * The WRITE TARGET of a path-confinable write call, tool-aware (b — single source for every
  * gate that confines a write target, same discipline as {@link fileArgPath} above):
  *
  *  · canonical `NotebookEdit` → `notebook_path` FIRST, `file_path`/`path` only as fallback. The tool
  *    itself writes `notebook_path`; its schema tolerates extra keys, so a stray/decoy `file_path` on a
  *    NotebookEdit call must never become the judged target while the real write lands elsewhere
- *    (a gate that read `file_path` first would confine the decoy — the [886]①b hole).
+ *    (a gate that read `file_path` first would confine the decoy — the hole).
  *  · every other tool → `file_path`/`path` first ({@link fileArgPath}), `notebook_path` as the
  *    historical fallback (unchanged behavior for the pre-existing gate callers).
  *
@@ -63,7 +63,7 @@ export interface ReadEntry {
         start: number;
         end: number;
     };
-    /** Millisecond timestamp of the last read/write-back that recorded this entry (blackboard
+    /** Millisecond timestamp of the last read/write-back that recorded this entry (
      *  2026-07-03, compact re-read parity: the post-compaction attachment picks the most RECENTLY
      *  read files — CC sorts readFileState by timestamp). Optional/additive: undefined (an entry
      *  seeded from an older checkpoint) sorts last, never breaks. */
@@ -125,7 +125,7 @@ export interface FsViolation {
  */
 export declare function isAbsolutePathForm(p: string): boolean;
 /**
- * Windows-FAMILY spelling of a path (codex 1.237 F6, extracted here so {@link canonicalizeTarget} judges
+ * Windows-FAMILY spelling of a path (extracted here so {@link canonicalizeTarget} judges
  * the UNC family by the same rule): drive-rooted (`C:\…`/`C:/…`), UNC-backslash (`\\host\share`), or a
  * RELATIVE path using `\` as its separator. Never keyed on `process.platform` — the exec env may be remote
  * and of the other family than the host. A `/`-rooted path is POSIX-form even when a file NAME inside it
@@ -184,7 +184,7 @@ export declare function hasBinaryExtension(path: string): boolean;
 export declare function imageMimeForRead(path: string): string | undefined;
 /** Verify the raw bytes actually ARE the image format the extension claims (magic-number sniff). Extension alone
  *  is forgeable: a `.png` holding text / an empty file / a truncated blob would otherwise become a malformed
- *  `ImageContent` that makes the NEXT provider request fail (400). Pure — no I/O. (batch-C, codex review.) */
+ *  `ImageContent` that makes the NEXT provider request fail (400). Pure — no I/O. (batch-C.) */
 export declare function imageMagicMatches(bytes: Uint8Array, mimeType: string): boolean;
 /** One contiguous byte pattern that must appear at a fixed offset for its signature to match. */
 export interface BinaryMagicSegment {
@@ -349,8 +349,8 @@ export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to t
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").
  *
- * RB-200 F2(形态一,CC 220 语料证实,@367198/@367671 — Edit/Write 两处读门的判据字面完全相同,
- * `!p || p.isPartialView`,两个工具用的是同一个条件): an AUTO-TRUNCATED read (the model asked for the
+ * RB-200 F2 (CC 220 corpus-confirmed, @367198/@367671 — Edit and Write spell the read gate identically,
+ * `!p || p.isPartialView`): an AUTO-TRUNCATED read (the model asked for the
  * file by default, no explicit offset/limit, and the token cap cut it anyway — {@link ReadEntry.isPartialView})
  * used to satisfy this gate exactly like a full read (`state.has(key)` alone was the whole check) — the
  * model could Write (full overwrite) or Edit a file having genuinely seen only its first page, silently
@@ -372,7 +372,7 @@ export declare function requireRead(state: ReadFileState, key: string): FsViolat
  */
 export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused \u2014 read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
- * RB-264 N1 ([1963] test AI 复验残留, repro `notebookedit-tool-read-gate-deadlock` assertion A.c2) —
+ * RB-264 N1 (repro `notebookedit-tool-read-gate-deadlock` assertion A.c2) —
  * the escape-hatch parenthetical for the OTHER shape of the read-before-edit refusal: the file was read,
  * but the read was AUTO-PAGINATED by the output token cap ({@link ReadEntry.isPartialView}), so only the
  * first page was ever seen. The oversize branch above has named its escape route since the fidelity
@@ -384,7 +384,7 @@ export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read to
  */
 export declare const PARTIAL_VIEW_READ_ESCAPE_HINT = "(Your last Read of this file returned only a PARTIAL view \u2014 the output token cap paginated it, so a default Read will keep returning the same page. Re-read it with explicit offset/limit (start from the page marker's next-page hint) until you have seen the part you are about to change; an explicit slice that fits satisfies the read-first rule. Or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
- * RB-264 ⑥W1 ([1963] test AI 复验残留) — the escape-hatch parenthetical for the ONE shape of the
+ * RB-264 ⑥W1 — the escape-hatch parenthetical for the ONE shape of the
  * read-first deadlock that nothing observable diagnoses: a file the Read tool REFUSES (binary /
  * BOM-less UTF-16 / unknown encoding) can never satisfy read-before-write, and — unlike the oversize
  * and partial-view shapes — leaves no trace the refusal renderer can stat for. It is therefore the

package/dist/tools/fs/search.d.ts

@@ -95,8 +95,8 @@ export declare function gitignoreMatcher(content: string): (rel: string, isDir:
 /** Build the combined ignore predicate (ignore-set ∪ .gitignore) for a JS-fallback walk.
  *  Exported so repo-map (design/72 §1) walks with the SAME ignore semantics as grep/glob.
  *
- * RB-200 F1(形态一,CC 220 语料证实,@368590-368592 Grep `T=["--hidden"]; for(N of Ok_) T.push("--glob",
- * "!"+N)`,@367957/367959-367965 Glob `CLAUDE_CODE_GLOB_HIDDEN` 默认 true 同样带 `--hidden`): CC's own
+ * RB-200 F1 (CC 220 corpus-confirmed, @368590-368592 Grep `T=["--hidden"]; for(N of Ok_) T.push("--glob",
+ * "!"+N)`, @367957/367959-367965 Glob `CLAUDE_CODE_GLOB_HIDDEN` defaults to true and also passes `--hidden`): CC's own
  * "keep it quiet" posture is NOT "every dot-prefixed name is invisible" — it's `--hidden` (show
  * everything dot-prefixed) plus an explicit VCS-directory exclusion list ({@link DEFAULT_IGNORE_DIRS}).
  * The blanket rule this function used to apply here (`base.startsWith(".")`) instead made EVERY hidden

package/dist/tools/monitor.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/135 G2 (审计 [485]① 🔴) — the `Monitor` tool: run a shell command in the background and watch its
+ * design/135 G2 (审计 🔴) — the `Monitor` tool: run a shell command in the background and watch its
  * stdout as a stream of NOTIFICATION EVENTS (the自主循环 core piece: "watch this and tell me when something
  * happens" without burning poll turns).
  *
@@ -17,10 +17,10 @@
  * TaskNotificationPayload lane at "later" priority (delivered at the next turn boundary like every
  * notification — ruled 2026-08-05; consecutive frames drain as one boundary batch, and a backlog past
  * the engine-note cap parks per session, so a chatty watcher cannot monopolize the run's boundaries).
- * 飞轮 [492]② (1.257): events born BETWEEN turns (run torn down / harness idle — the long-watch main case)
+ * (1.257): events born BETWEEN turns (run torn down / harness idle — the long-watch main case)
  * are no longer lost: the Runner parks them per session (bounded, drop-disclosing) and the session's next
  * run redelivers them through the same notification lane at its first turn boundary.
- * 飞轮 [511]③ (CC parity): a monitor's lifetime = min(timeout_ms, process exit, TaskStop); a `persistent`
+ * (CC parity): a monitor's lifetime = min(timeout_ms, process exit, TaskStop); a `persistent`
  * one is SESSION-anchored (reaped at session release). NEITHER is run-anchored: the run teardown leaves an
  * in-window non-persistent watch alive (process on the dispose except-list, watcher ticking, row kept), so
  * cross-turn watching — CC's main Monitor use case — works with the default persistent:false too; its

package/dist/tools/task-list.d.ts

@@ -62,7 +62,7 @@ export interface TaskListStore {
     delete(id: string): boolean | Promise<boolean>;
     list(): TaskListItem[] | Promise<TaskListItem[]>;
     allocateId(): string | Promise<string>;
-    /** codex S4 F2 — the transaction boundary for adapters whose backend outlives one wrapper
+    /** the transaction boundary for adapters whose backend outlives one wrapper
      *  instance (pg, shared files): when present, the tools run EVERY read-modify-write sequence
      *  inside `mutate` and the adapter supplies sequence-level atomicity (a DB transaction, an
      *  advisory lock keyed on the backend — not on this object). Absent ⇒ the tools fall back to the
@@ -70,7 +70,7 @@ export interface TaskListStore {
      *  backend IS this object) and wrong for anything shared wider — implement `mutate` there. */
     mutate?<T>(fn: (tx: TaskListStore) => Promise<T>): Promise<T>;
 }
-/** codex S4 r2-F3 — the clone policy behind the detached-copy contract: metadata must be JSON-shaped
+/** the clone policy behind the detached-copy contract: metadata must be JSON-shaped
  *  (structuredClone would accept — and SHARE — SharedArrayBuffer backing memory, and throws opaquely
  *  on functions/proxies; the tool lane is always JSON, so this guards DIRECT store users). */
 /**

package/dist/tools/web.d.ts

@@ -91,12 +91,12 @@ export declare function webFetchToolSpec(config?: WebFetchConfig): ToolSpec;
 export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool;
 /** {@link createWebFetchSummarizer}'s truncation bound — CC's `MAX_MARKDOWN_LENGTH`
  *  (WebFetchTool/utils.ts:128). Exported so a deployment wiring the reference summarizer doesn't need
- *  its own copy of this number to reason about (黑板 [1900]/[1902] — server asked for this explicitly,
+ *  its own copy of this number to reason about (a downstream deployment asked for this explicitly,
  *  to avoid a value-copy of the truncation threshold drifting from this one). */
 export declare const WEBFETCH_SUMMARY_MAX_CONTENT = 100000;
 /** {@link createWebFetchSummarizer}'s fixed guidelines block — CC's `makeSecondaryModelPrompt`
  *  (WebFetchTool/prompt.ts, non-preapproved-domain arm, guidelines verbatim). Exported alongside
- *  {@link WEBFETCH_SUMMARY_MAX_CONTENT} for the same reason (黑板 [1900]/[1902]): a deployment composing
+ *  {@link WEBFETCH_SUMMARY_MAX_CONTENT} for the same reason: a deployment composing
  *  its OWN summarizer (not this reference one) that still wants CC-parity guidance text doesn't need its
  *  own copy of this string. Not runtime-parameterized — the page content and the caller's `prompt` are
  *  interpolated AROUND this block, never inside it. */
@@ -177,7 +177,7 @@ export interface WebFetchSummarizerOptions {
     } | undefined;
 }
 /**
- * 黑板 [1870] L1 / [1900] — a reference {@link WebFetchConfig.summarize} implementation: reuses a
+ * A reference {@link WebFetchConfig.summarize} implementation: reuses a
  * caller-supplied `brain` (rather than requiring a dedicated second model) to extract a focused answer
  * from fetched content per the caller's `prompt`, instead of the tool dumping the whole (fenced, still
  * untrusted) page. CC ALWAYS routes fetched content through a secondary model this way
@@ -227,7 +227,7 @@ export interface WebSearchConfig {
     }>>;
     /** Max results returned to the model (default 10). */
     maxResults?: number;
-    /** Wall-clock budget for one `search` call, in ms. Default 30 000 (RB-231, 黑板 [1937]). The backend is
+    /** Wall-clock budget for one `search` call, in ms. Default 30 000 (RB-231). The backend is
      *  deployment-injected and may ignore the AbortSignal entirely, so this is enforced with BOTH an abort
      *  and a race — a hung backend must not hang the turn, and without this the deployment had no interface
      *  to bound it. */

package/dist/tools/worktree.d.ts

@@ -1,5 +1,5 @@
 /**
- * 审计[485]③ / 深挖 G4 — the `EnterWorktree` / `ExitWorktree` tool pair: SESSION-level git-worktree
+ * 审计深挖 G4 — the `EnterWorktree` / `ExitWorktree` tool pair: SESSION-level git-worktree
  * isolation (CC 2.1.198 parity). EnterWorktree creates a managed worktree under `.sema-worktrees/`
  * (the same {@link WORKTREE_PARENT} the subagent `isolation:"worktree"` lane uses) and REALLY switches
  * the task's working directory into it; ExitWorktree returns to the original directory and cleans up.
@@ -27,7 +27,7 @@
  * containment is untouched: the worktree lives UNDER the task root, so resolveKey's canonical-within
  * check still holds for every subsequent fs op.
  *
- * ⚠️ Containment ruling (codex 终审 1.255 F4, deliberate): entering a worktree is a **cwd switch, NOT a
+ * ⚠️ Containment ruling (deliberate): entering a worktree is a **cwd switch, NOT a
  * sandbox**. resolveKey's containment anchor stays the ORIGINAL task root — it is deliberately NOT
  * re-anchored/tightened to the worktree dir, so `../../` from inside the worktree can still reach the
  * rest of the repository (which is WITHIN the task root and was reachable before Enter too), while
@@ -40,7 +40,7 @@
  * arbitrary command surface), but they create/delete on-disk state ⇒ effect:"write" (plan mode gates
  * them like every other write tool; read-only hands never mount them — see prepare-task).
  *
- * Durability (codex 终审 1.255 F2): the active session lives in a SHARED, ALL-SERIALIZABLE
+ * Durability: the active session lives in a SHARED, ALL-SERIALIZABLE
  * {@link WorktreeSessionRef} owned by prepare-task (never a closure-only var, and no captured destroy
  * closure — Exit re-derives removal as a plain `git worktree remove`). A durable suspend stamps it into
  * `CheckpointState.activeWorktree` (+ the cwd into `handsCwd`); resume re-seeds both, so
@@ -48,7 +48,7 @@
  */
 import type { ActiveWorktreeSession, AgentTool, ExecutionEnv } from "../internal/harness-types.js";
 import type { CwdRef } from "./fs/index.js";
-/** codex 终审 1.255 F2 — the ACTIVE worktree session, ALL-SERIALIZABLE (plain strings, no closures):
+/** the ACTIVE worktree session, ALL-SERIALIZABLE (plain strings, no closures):
  *  prepare-task owns the ref, stamps `current` into `CheckpointState.activeWorktree` at a durable
  *  suspend, and re-seeds it on resume, so ExitWorktree works across the suspend/resume boundary (the
  *  tree survives on disk; removal is re-derived as a plain `git worktree remove`).
@@ -80,7 +80,7 @@ export interface WorktreeToolsOptions {
      *  assigns it to the worktree path (a REAL cwd switch: Bash/Read/Edit/Write/Monitor all follow),
      *  ExitWorktree restores it. */
     cwdRef: CwdRef;
-    /** codex 终审 1.255 F2: the shared session-state ref (checkpointable — prepare-task serializes it into
+    /** the shared session-state ref (checkpointable — prepare-task serializes it into
      *  the durable checkpoint and re-seeds it on resume). Omitted ⇒ a private per-mount ref (same live
      *  behavior, minus durable-suspend survival — prepare-task always passes one). */
     session?: WorktreeSessionRef;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.57.0",
+  "version": "5.59.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",