@sema-agent/core 5.59.0 → 5.60.0

package/dist/core/untrusted-text.d.ts

@@ -393,6 +393,17 @@ export declare function defuseControlChars(text: string): string;
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
+/** backlog #239: the per-ENTRY ceiling inside a `ProbeCause` operand family (checkpoint-store's
+ *  structured probe account), sized like the descriptor's own `touchedPaths` entries (the same thing
+ *  on the same card). Per entry, not per cause: that is the whole point of the structured shape —
+ *  one pathological path costs only itself, where a single joined string let it consume every other
+ *  entry's room. HOMED HERE (the leaf neutralizer module) rather than with the `ProbeCause` types:
+ *  its two consumers — the shell probe that sanitizes at the entry boundary (tools/fs) and the
+ *  descriptor builder that re-sanitizes at the persist boundary (core/checkpoint-store) — sit on
+ *  opposite sides of a value-import boundary, and a value import from the shell tool back into
+ *  checkpoint-store closed an ESM evaluation cycle (checkpoint-store → tool-policy → tools/fs →
+ *  checkpoint-store, a latent TDZ). Both already import this module; one cap, no cycle. */
+export declare const PROBE_CAUSE_PATH_MAX = 200;
 /** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
  *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
  *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the

package/dist/core/untrusted-text.js

@@ -568,6 +568,7 @@ export function inlineUntrusted(text, maxLen = LABEL_MAX) {
 function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
+export const PROBE_CAUSE_PATH_MAX = 200;
 export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     return delimitUntrustedWithClip(label, text, maxBody).text;

package/dist/engine/llm/types.d.ts

@@ -413,8 +413,27 @@ export interface AssistantMessage {
      *  ⚠️ Brain OBLIGATION (RB-482 #12, 5.1.0): stamping this field on every cut turn is part of the
      *  Brain contract — the sentinel-prose fallback readers are RETIRED, so a custom Brain that stamps
      *  only `errorMessage` prose is no longer recognized as a cut (terminal-cause.ts reads this field
-     *  and nothing else). Widening note: exhaustive switches on this union gain arms as it grows. */
-    errorKind?: "length_empty" | "degenerate";
+     *  and nothing else). Widening note: exhaustive switches on this union gain arms as it grows.
+     *
+     *  `"input_too_long"` (design/374 slice 2): the provider refused because the request INPUT alone
+     *  exceeds its context limit — classified at the brain boundary from provenance-checked signals
+     *  only (`brain/input-too-long.ts`: the diagnostic field of a JSON error envelope, anchored
+     *  provider openings, the OpenAI `context_length_exceeded` structural code, HTTP 413, and the
+     *  Anthropic in-band `model_context_window_exceeded` stop / streamed `invalid_request_error`
+     *  twin). The loop's prompt-too-long recovery reads THIS seat first; the historic prose regex
+     *  over `errorMessage` remains as the fallback for brains that do not stamp it (additive — the
+     *  stamping obligation above extends to this member for cuts a Brain can classify structurally,
+     *  but unlike the two cut kinds there is no retired fallback: prose detection still works). */
+    errorKind?: "length_empty" | "degenerate" | "input_too_long";
+    /** design/374 slice 2, the AUTHORITATIVE-NEGATIVE twin of `errorKind: "input_too_long"`: the
+     *  brain's provenance-checked classifier RAN and ruled this failure NOT input-too-long (wrong
+     *  status family, or the provider's own diagnostic envelope states a different error). The
+     *  loop's prompt-too-long recovery treats it as a hard negative and SKIPS its prose fallback —
+     *  a "prompt is too long" sentence reflected inside an unrelated error body must never drive a
+     *  context-shrinking recovery (adversarial-review r1). Absent = classification could not
+     *  establish provenance (prose-only gateway, truncated body, non-classifying custom Brain), and
+     *  the historic prose fallback keeps its reach. Mutually exclusive with the positive stamp. */
+    inputTooLongRuledOut?: true;
     /**
      * design/124 tier A: this final message was PARTIALLY FINALIZED after a mid-stream connection
      * loss/stall — the substantive streamed prefix (text and/or completed tool calls) was promoted to

package/dist/engine/loop/agent-loop.js

@@ -39,7 +39,13 @@ function isBlankFailureContent(message) {
     return message.content.every((c) => c.type === "text" ? c.text.trim() === "" : c.type === "thinking" ? c.thinking.trim() === "" : false);
 }
 function defaultDetectPromptTooLong(message) {
-    return message.stopReason === "error" && PROMPT_TOO_LONG_RE.test(message.errorMessage ?? "");
+    if (message.stopReason !== "error")
+        return false;
+    if (message.errorKind === "input_too_long")
+        return true;
+    if (message.inputTooLongRuledOut === true)
+        return false;
+    return PROMPT_TOO_LONG_RE.test(message.errorMessage ?? "");
 }
 function createPtlWithholdBuffer(emit, detect) {
     const held = [];

package/dist/engine/loop/types.d.ts

@@ -161,7 +161,10 @@ export interface LoopPromptTooLongRecovery {
      * Contract: must not throw or reject.
      */
     recover: (messages: AgentMessage[], attempt: number) => Promise<AgentMessage[] | undefined>;
-    /** Override the prompt-too-long classifier. Default: a conservative provider-message pattern. */
+    /** Override the prompt-too-long classifier. Default (design/374 slice 2): the TYPED cause first
+     *  (`errorKind: "input_too_long"`, stamped by the brains from provenance-checked provider
+     *  signals), then the conservative provider-message prose pattern as the fallback for brains
+     *  that do not stamp it. */
     detect?: (message: AssistantMessage) => boolean;
     /** Max recovery retries per turn. Default: 2. */
     maxRetries?: number;

package/dist/tools/fs/fs-bash.js

@@ -10,8 +10,7 @@ import { imageMagicMatches, withinAnyRoot } from "./safety.js";
 import { isRemoteExecutionEnv, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
-import { PROBE_CAUSE_PATH_MAX } from "../../core/checkpoint-store.js";
-import { inlineUntrusted } from "../../core/untrusted-text.js";
+import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
 import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoop, classifyCompoundReadonlyDetailed, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.59.0",
+  "version": "5.60.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",