@sema-agent/core 5.6.0 → 5.8.0

package/dist/orchestration/run-workflow-tool.js

@@ -17,7 +17,6 @@ const DEFAULTS = {
     maxScriptChars: 100_000,
     maxAgents: 50,
     totalTimeoutMs: 600_000,
-    perAgentTimeoutSec: 300,
     maxResultChars: 100_000,
     maxLogChars: 10_000,
 };
@@ -141,7 +140,7 @@ export async function createRunWorkflowTool(d) {
     const lim = d.limits ?? {};
     const maxScriptChars = lim.maxScriptChars ?? DEFAULTS.maxScriptChars;
     const childCaps = {
-        perAgentTimeoutSec: lim.perAgentTimeoutSec ?? DEFAULTS.perAgentTimeoutSec,
+        perAgentMaxWalltimeMs: lim.perAgentMaxWalltimeMs,
         childMaxCostUsd: lim.childMaxCostUsd,
         childMaxTokens: lim.childMaxTokens,
         childMaxTurns: lim.childMaxTurns,

package/dist/orchestration/workflow-governance.d.ts

@@ -13,20 +13,20 @@ export interface WorkflowAgentSpec {
     images?: ImageInput[];
     limits?: {
         maxTurns?: number;
-        timeoutSec?: number;
+        maxWalltimeMs?: number;
+        maxTokens?: number;
+        maxCostUsd?: number;
     };
-    maxCostUsd?: number;
-    maxTokens?: number;
 }
-export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "maxCostUsd", "maxTokens"];
+export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits"];
 export interface WorkflowChildCaps {
-    perAgentTimeoutSec?: number;
+    perAgentMaxWalltimeMs?: number;
     childMaxCostUsd?: number;
     childMaxTokens?: number;
     childMaxTurns?: number;
 }
 export interface ResourceClampNote {
-    field: "maxCostUsd" | "maxTokens" | "timeoutSec" | "maxTurns";
+    field: "maxCostUsd" | "maxTokens" | "maxWalltimeMs" | "maxTurns";
     requested: number | undefined;
     applied: number;
 }

package/dist/orchestration/workflow-governance.js

@@ -17,8 +17,6 @@ export const WHITELIST_KEYS = [
     "systemPrompt",
     "images",
     "limits",
-    "maxCostUsd",
-    "maxTokens",
 ];
 const VALID_THINKING = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 export function resolveModelName(name, allowlist, models) {
@@ -91,36 +89,26 @@ function pickWhitelist(scriptSpec) {
     }
     if (s.limits !== undefined) {
         if (typeof s.limits !== "object" || s.limits === null || Array.isArray(s.limits)) {
-            throw new WorkflowScriptError("agent(spec): `limits` must be an object { maxTurns?, timeoutSec? }");
+            throw new WorkflowScriptError("agent(spec): `limits` must be an object { maxTurns?, maxWalltimeMs?, maxTokens?, maxCostUsd? }");
         }
         const l = s.limits;
         const limits = {};
-        if (l.maxTurns !== undefined) {
-            if (typeof l.maxTurns !== "number" || !Number.isFinite(l.maxTurns))
-                throw new WorkflowScriptError("agent(spec): `limits.maxTurns` must be a number");
-            if (l.maxTurns <= 0)
-                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("maxTurns", "turn cap"));
-            limits.maxTurns = l.maxTurns;
-        }
-        if (l.timeoutSec !== undefined) {
-            if (typeof l.timeoutSec !== "number" || !Number.isFinite(l.timeoutSec))
-                throw new WorkflowScriptError("agent(spec): `limits.timeoutSec` must be a number");
-            if (l.timeoutSec <= 0)
-                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("timeoutSec", "wall-clock window"));
-            limits.timeoutSec = l.timeoutSec;
-        }
+        const readAxis = (field, what) => {
+            const raw = l[field];
+            if (raw === undefined)
+                return;
+            if (typeof raw !== "number" || !Number.isFinite(raw))
+                throw new WorkflowScriptError(`agent(spec): \`limits.${field}\` must be a number`);
+            if (raw <= 0)
+                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG(field, what));
+            limits[field] = raw;
+        };
+        readAxis("maxTurns", "turn cap");
+        readAxis("maxWalltimeMs", "wall-clock window");
+        readAxis("maxTokens", "token budget");
+        readAxis("maxCostUsd", "spend ceiling");
         safe.limits = limits;
     }
-    if (s.maxCostUsd !== undefined) {
-        if (typeof s.maxCostUsd !== "number" || !Number.isFinite(s.maxCostUsd))
-            throw new WorkflowScriptError("agent(spec): `maxCostUsd` must be a number");
-        safe.maxCostUsd = s.maxCostUsd;
-    }
-    if (s.maxTokens !== undefined) {
-        if (typeof s.maxTokens !== "number" || !Number.isFinite(s.maxTokens))
-            throw new WorkflowScriptError("agent(spec): `maxTokens` must be a number");
-        safe.maxTokens = s.maxTokens;
-    }
     let modelName;
     if (s.modelName !== undefined) {
         if (typeof s.modelName !== "string")
@@ -131,37 +119,35 @@ function pickWhitelist(scriptSpec) {
 }
 function clampResourceLimits(safe, base, caps) {
     const notes = [];
-    const requestedCost = safe.maxCostUsd;
-    const cost = minDefined(safe.maxCostUsd, base.maxCostUsd, caps?.childMaxCostUsd);
-    if (cost !== undefined) {
-        if (cost !== requestedCost)
-            notes.push({ field: "maxCostUsd", requested: requestedCost, applied: cost });
-        safe.maxCostUsd = cost;
-    }
-    const requestedTokens = safe.maxTokens;
-    const tokens = minDefined(safe.maxTokens, base.maxTokens, caps?.childMaxTokens);
-    if (tokens !== undefined) {
-        if (tokens !== requestedTokens)
-            notes.push({ field: "maxTokens", requested: requestedTokens, applied: tokens });
-        safe.maxTokens = tokens;
-    }
-    const requestedTimeoutSec = safe.limits?.timeoutSec;
+    const requestedCost = safe.limits?.maxCostUsd;
+    const requestedTokens = safe.limits?.maxTokens;
+    const requestedWalltimeMs = safe.limits?.maxWalltimeMs;
     const requestedMaxTurns = safe.limits?.maxTurns;
-    const timeoutSec = minPositiveDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
+    const cost = minDefined(safe.limits?.maxCostUsd, base.limits?.maxCostUsd, caps?.childMaxCostUsd);
+    const tokens = minDefined(safe.limits?.maxTokens, base.limits?.maxTokens, caps?.childMaxTokens);
+    const maxWalltimeMs = minPositiveDefined(safe.limits?.maxWalltimeMs, base.limits?.maxWalltimeMs, caps?.perAgentMaxWalltimeMs);
     const maxTurns = minPositiveDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
-    if (timeoutSec !== undefined && timeoutSec !== requestedTimeoutSec) {
-        notes.push({ field: "timeoutSec", requested: requestedTimeoutSec, applied: timeoutSec });
+    if (cost !== undefined && cost !== requestedCost)
+        notes.push({ field: "maxCostUsd", requested: requestedCost, applied: cost });
+    if (tokens !== undefined && tokens !== requestedTokens)
+        notes.push({ field: "maxTokens", requested: requestedTokens, applied: tokens });
+    if (maxWalltimeMs !== undefined && maxWalltimeMs !== requestedWalltimeMs) {
+        notes.push({ field: "maxWalltimeMs", requested: requestedWalltimeMs, applied: maxWalltimeMs });
     }
     if (maxTurns !== undefined && maxTurns !== requestedMaxTurns) {
         notes.push({ field: "maxTurns", requested: requestedMaxTurns, applied: maxTurns });
     }
     const baseOtherLimits = { ...base.limits };
     delete baseOtherLimits.maxTurns;
-    delete baseOtherLimits.timeoutSec;
+    delete baseOtherLimits.maxWalltimeMs;
+    delete baseOtherLimits.maxTokens;
+    delete baseOtherLimits.maxCostUsd;
     const rebuilt = {
         ...baseOtherLimits,
         ...(maxTurns !== undefined ? { maxTurns } : {}),
-        ...(timeoutSec !== undefined ? { timeoutSec } : {}),
+        ...(maxWalltimeMs !== undefined ? { maxWalltimeMs } : {}),
+        ...(tokens !== undefined ? { maxTokens: tokens } : {}),
+        ...(cost !== undefined ? { maxCostUsd: cost } : {}),
     };
     if (base.limits !== undefined || Object.keys(rebuilt).length > 0)
         safe.limits = rebuilt;

package/dist/prompt-assembly/event-registry.js

@@ -13,9 +13,8 @@ export const EVENT_PROMPT_REGISTRY = new Map([
     { kind: "skills_listing", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "on", rendererRef: "turn-attachments.ts#renderSkillsListingDelta" },
     { kind: "mcp_instructions", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpInstructionsDelta" },
     { kind: "mcp_dropped_tools", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpDroppedTools" },
-    { kind: "deadline_converge", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#nudgeSchedule" },
-    { kind: "deadline_deliver_now", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#nudgeSchedule" },
-    { kind: "deadline_finalize", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#buildFinalizeText" },
+    { kind: "limit_approach_converge", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#limitApproachFrames" },
+    { kind: "limit_approach_deliver", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#limitApproachFrames" },
     { kind: "final_verification", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#final-verification" },
 ].map((e) => [e.kind, e]));
 export function eventDefaultOn(kind) {

package/dist/stores/cc/lockfile.js

@@ -20,6 +20,9 @@ export async function acquireCcLock(target, opts) {
         }
     };
     for (let attempt = 0;; attempt++) {
+        if (attempt >= RETRIES) {
+            throw new Error(`cc lockfile: could not acquire ${lockPath} after ${RETRIES} retries`);
+        }
         try {
             mkdirSync(lockPath);
             writeFileSync(ownerPath, nonce);
@@ -60,21 +63,16 @@ export async function acquireCcLock(target, opts) {
                 const st = statSync(lockPath);
                 if (Date.now() - st.mtimeMs > staleMs) {
                     const st2 = statSync(lockPath);
-                    if (st2.mtimeMs !== st.mtimeMs)
-                        continue;
-                    try {
-                        rmSync(lockPath, { recursive: true, force: true });
-                    }
-                    catch {
+                    if (st2.mtimeMs === st.mtimeMs) {
+                        try {
+                            rmSync(lockPath, { recursive: true, force: true });
+                        }
+                        catch {
+                        }
                     }
-                    continue;
                 }
             }
             catch {
-                continue;
-            }
-            if (attempt >= RETRIES) {
-                throw new Error(`cc lockfile: could not acquire ${lockPath} after ${RETRIES} retries (held and fresh)`);
             }
             const backoff = Math.min(MAX_TIMEOUT_MS, MIN_TIMEOUT_MS * 2 ** attempt);
             await sleep(backoff / 2 + Math.random() * (backoff / 2));

package/dist/stores/cc/mailbox-store.js

@@ -3,6 +3,7 @@ import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { atomicWriteFile, canonicalStoreKey } from "../file/fs-atomic.js";
 import { withCcLock } from "./lockfile.js";
+const INBOX_FILE_EXT = ".json";
 export function sanitizeCcAgentName(name) {
     return name.replace(/[^a-zA-Z0-9]/g, "-").toLowerCase();
 }
@@ -23,10 +24,8 @@ export function createCcFileMailboxStore(opts) {
             throw new Error(`CcFileMailboxStore: CC inbox files carry no tenant axis — scope:"default" only (D-1); got ${JSON.stringify(scope)}`);
         }
     };
-    const inboxPath = (handle) => {
-        const name = opts.agentNameOf?.(handle) ?? handle;
-        return join(inboxDir, `${sanitizeCcAgentName(name)}.json`);
-    };
+    const leaseKey = (handle) => sanitizeCcAgentName(opts.agentNameOf?.(handle) ?? handle);
+    const inboxPath = (handle) => join(inboxDir, `${leaseKey(handle)}${INBOX_FILE_EXT}`);
     const discloseCorrupt = (path, reason) => {
         try {
             opts.onCorruptRead?.({ path, reason });
@@ -98,6 +97,42 @@ export function createCcFileMailboxStore(opts) {
     const saveBox = (path, box) => {
         atomicWriteFile(inboxDir, path, JSON.stringify(box, null, 2));
     };
+    const isColderThan = (box, now, maxAgeMs) => {
+        if (box.length === 0)
+            return false;
+        const newest = box.reduce((acc, e) => {
+            const t = typeof e.timestamp === "string" ? Date.parse(e.timestamp) : Number.NaN;
+            return Number.isFinite(t) ? Math.max(acc, t) : Number.POSITIVE_INFINITY;
+        }, 0);
+        return newest !== Number.POSITIVE_INFINITY && now - newest > maxAgeMs;
+    };
+    const sweepColdBoxes = async (now, maxAgeMs) => {
+        let dropped = 0;
+        for (const f of readdirSync(inboxDir)) {
+            if (!f.endsWith(INBOX_FILE_EXT))
+                continue;
+            const path = join(inboxDir, f);
+            const boxKey = f.slice(0, -INBOX_FILE_EXT.length);
+            const preNotes = deferredNotes();
+            if (!isColderThan(loadBox(path, preNotes.note), now, maxAgeMs)) {
+                preNotes.flush();
+                continue;
+            }
+            const notes = deferredNotes();
+            const swept = await withCcLock(path, () => {
+                if (!isColderThan(loadBox(path, notes.note), now, maxAgeMs))
+                    return false;
+                leases.delete(boxKey);
+                rmSync(path, { force: true });
+                return true;
+            }).finally(() => {
+                notes.flush();
+            });
+            if (swept)
+                dropped += 1;
+        }
+        return dropped;
+    };
     return {
         append: (scope, handle, msg) => {
             requireDefaultScope(scope);
@@ -124,11 +159,12 @@ export function createCcFileMailboxStore(opts) {
         claimLease: (scope, handle, owner, ttlMs, now) => {
             requireDefaultScope(scope);
             const t = now ?? opts.now?.() ?? Date.now();
-            const key = inboxPath(handle);
+            const key = leaseKey(handle);
+            const path = inboxPath(handle);
             const held = leases.get(key);
             if (held !== undefined && held.expiresAt > t && held.owner !== owner)
                 return Promise.resolve(null);
-            const box = loadBox(key, discloseCorrupt);
+            const box = loadBox(path, discloseCorrupt);
             const maxSeq = box.length;
             const pending = box
                 .map((e, i) => ({ e, seq: i + 1 }))
@@ -147,7 +183,7 @@ export function createCcFileMailboxStore(opts) {
         ack: (scope, handle, owner, upToSeq) => {
             requireDefaultScope(scope);
             const path = inboxPath(handle);
-            const held = leases.get(path);
+            const held = leases.get(leaseKey(handle));
             if (held === undefined || held.owner !== owner)
                 return Promise.resolve();
             if (!existsSync(path))
@@ -165,14 +201,14 @@ export function createCcFileMailboxStore(opts) {
                 if (changed)
                     saveBox(path, box);
                 if (held.maxSeq <= upToSeq)
-                    leases.delete(path);
+                    leases.delete(leaseKey(handle));
             }).finally(() => {
                 notes.flush();
             });
         },
         releaseLease: (scope, handle, owner) => {
             requireDefaultScope(scope);
-            const key = inboxPath(handle);
+            const key = leaseKey(handle);
             const held = leases.get(key);
             if (held !== undefined && held.owner === owner)
                 leases.delete(key);
@@ -185,42 +221,17 @@ export function createCcFileMailboxStore(opts) {
         drop: (scope, handle) => {
             requireDefaultScope(scope);
             const path = inboxPath(handle);
-            leases.delete(path);
-            try {
+            leases.delete(leaseKey(handle));
+            return withCcLock(path, () => {
                 rmSync(path, { force: true });
-                rmSync(`${path}.lock`, { recursive: true, force: true });
-            }
-            catch {
-            }
-            return Promise.resolve();
+            });
         },
         reap: (scope, now, reapOpts) => {
             requireDefaultScope(scope);
             const maxAgeMs = reapOpts?.maxAgeMs;
             if (maxAgeMs === undefined || !existsSync(inboxDir))
                 return Promise.resolve(0);
-            let dropped = 0;
-            for (const f of readdirSync(inboxDir)) {
-                if (!f.endsWith(".json"))
-                    continue;
-                const path = join(inboxDir, f);
-                const box = loadBox(path, discloseCorrupt);
-                const newest = box.reduce((acc, e) => {
-                    const t = typeof e.timestamp === "string" ? Date.parse(e.timestamp) : Number.NaN;
-                    return Number.isFinite(t) ? Math.max(acc, t) : Number.POSITIVE_INFINITY;
-                }, 0);
-                if (box.length > 0 && newest !== Number.POSITIVE_INFINITY && now - newest > maxAgeMs) {
-                    leases.delete(path);
-                    try {
-                        rmSync(path, { force: true });
-                        rmSync(`${path}.lock`, { recursive: true, force: true });
-                        dropped += 1;
-                    }
-                    catch {
-                    }
-                }
-            }
-            return Promise.resolve(dropped);
+            return sweepColdBoxes(now, maxAgeMs);
         },
     };
 }

package/dist/stores/file/index.d.ts

@@ -7,6 +7,7 @@ import { type FileCheckpointStoreOptions } from "./checkpoint-store.js";
 import type { SessionPolicyStore } from "../../core/session-policy-store.js";
 import type { FileSnapshotStore } from "../../core/file-snapshot-store.js";
 import type { WorkflowJournalStore } from "../../core/workflow-journal-store.js";
+import type { UsageWindowStore } from "../../core/usage-window-store.js";
 export { FileCheckpointStore, type FileCheckpointStoreOptions } from "./checkpoint-store.js";
 export { FileMemoryStore } from "./memory-store.js";
 export { FileSessionRepo, type FileSessionRepoOptions } from "./session-store.js";
@@ -14,6 +15,7 @@ export { FileToolResultStore } from "./tool-result-store.js";
 export { FileSessionPolicyStore, type FileSessionPolicyStoreOptions, type SessionPolicyCorruptReadInfo } from "./session-policy-store.js";
 export { FileFileSnapshotStore, type FileFileSnapshotStoreOptions } from "./file-snapshot-store.js";
 export { FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult } from "./workflow-journal-store.js";
+export { FileUsageWindowStore } from "./usage-window-store.js";
 export { resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock } from "./fs-atomic.js";
 export { atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog } from "./fs-atomic.js";
 export interface FileStorageBackendOptions {
@@ -40,6 +42,7 @@ export declare class FileStorageBackend {
     readonly sessionPolicyStore: SessionPolicyStore;
     readonly fileSnapshotStore: FileSnapshotStore;
     readonly workflowJournalStore: WorkflowJournalStore;
+    readonly usageWindowStore: UsageWindowStore;
     readonly consolidationLock: (scope: string) => (() => void) | undefined;
     private readonly lock;
     private readonly fileCheckpoints;

package/dist/stores/file/index.js

@@ -9,6 +9,7 @@ import { FileToolResultStore } from "./tool-result-store.js";
 import { FileSessionPolicyStore } from "./session-policy-store.js";
 import { FileFileSnapshotStore } from "./file-snapshot-store.js";
 import { FileWorkflowJournalStore } from "./workflow-journal-store.js";
+import { FileUsageWindowStore } from "./usage-window-store.js";
 export { FileCheckpointStore } from "./checkpoint-store.js";
 export { FileMemoryStore } from "./memory-store.js";
 export { FileSessionRepo } from "./session-store.js";
@@ -16,6 +17,7 @@ export { FileToolResultStore } from "./tool-result-store.js";
 export { FileSessionPolicyStore } from "./session-policy-store.js";
 export { FileFileSnapshotStore } from "./file-snapshot-store.js";
 export { FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult } from "./workflow-journal-store.js";
+export { FileUsageWindowStore } from "./usage-window-store.js";
 export { resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock } from "./fs-atomic.js";
 export { atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog } from "./fs-atomic.js";
 export class FileStorageBackend {
@@ -27,6 +29,7 @@ export class FileStorageBackend {
     sessionPolicyStore;
     fileSnapshotStore;
     workflowJournalStore;
+    usageWindowStore;
     consolidationLock;
     lock;
     fileCheckpoints;
@@ -53,6 +56,7 @@ export class FileStorageBackend {
             this.fileSnapshotStore = new FileFileSnapshotStore(this.root, opts.snapshotBounds, corruptRead);
             this.fileWorkflowJournal = new FileWorkflowJournalStore(this.root);
             this.workflowJournalStore = this.fileWorkflowJournal;
+            this.usageWindowStore = new FileUsageWindowStore(this.root);
             this.consolidationLock = createFileConsolidationLock(join(this.root, "consolidation-locks"));
         }
         catch (err) {

package/dist/stores/file/usage-window-store.d.ts

@@ -0,0 +1,9 @@
+import { type UsageWindow, type UsageWindowReading, type UsageWindowStore } from "../../core/usage-window-store.js";
+export declare class FileUsageWindowStore implements UsageWindowStore {
+    private readonly dir;
+    constructor(root: string);
+    private pathFor;
+    private loadRecord;
+    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[]): Promise<void>;
+    read(key: string, windows: readonly UsageWindow[], now: number): Promise<readonly UsageWindowReading[]>;
+}

package/dist/stores/file/usage-window-store.js

@@ -0,0 +1,86 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { chargeUsageRecord, readUsageRecord, EMPTY_USAGE_WINDOW_RECORD, } from "../../core/usage-window-store.js";
+import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
+export class FileUsageWindowStore {
+    dir;
+    constructor(root) {
+        this.dir = join(root, "usage-windows");
+        ensureDir(this.dir);
+    }
+    pathFor(key) {
+        return join(this.dir, `${sanitizeScope(key)}.json`);
+    }
+    loadRecord(key) {
+        const path = this.pathFor(key);
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return EMPTY_USAGE_WINDOW_RECORD;
+            throw err;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw corrupt(path, "unparseable JSON (torn/zero-byte write?)");
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            throw corrupt(path, "not a JSON object");
+        const rec = parsed;
+        const slots = validateSlots(rec.slots, path);
+        const buckets = validateBuckets(rec.buckets, path);
+        return { slots, buckets };
+    }
+    async charge(key, tokens, at, windows) {
+        const next = chargeUsageRecord(this.loadRecord(key), tokens, at, windows);
+        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(key), JSON.stringify(next));
+    }
+    async read(key, windows, now) {
+        return readUsageRecord(this.loadRecord(key), windows, now);
+    }
+}
+function corrupt(path, reason) {
+    const e = new Error(`usage-window ledger at ${path} is unreadable (${reason}). Refused rather than treated as empty: an unreadable ceiling would grant the key an unlimited, silent allowance.`);
+    e.code = "usage_window.store_corrupt";
+    return e;
+}
+function validateSlots(value, path) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw corrupt(path, "`slots` is not an array");
+    return value.map((s) => {
+        if (s === null || typeof s !== "object")
+            throw corrupt(path, "`slots` entry is not an object");
+        const { at, tokens } = s;
+        if (typeof at !== "number" || !Number.isFinite(at) || typeof tokens !== "number" || !Number.isFinite(tokens)) {
+            throw corrupt(path, "`slots` entry has a non-numeric `at`/`tokens`");
+        }
+        return { at, tokens };
+    });
+}
+function validateBuckets(value, path) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw corrupt(path, "`buckets` is not an array");
+    return value.map((b) => {
+        if (b === null || typeof b !== "object")
+            throw corrupt(path, "`buckets` entry is not an object");
+        const { windowMs, openedAt, tokens } = b;
+        if (typeof windowMs !== "number" ||
+            !Number.isFinite(windowMs) ||
+            typeof openedAt !== "number" ||
+            !Number.isFinite(openedAt) ||
+            typeof tokens !== "number" ||
+            !Number.isFinite(tokens)) {
+            throw corrupt(path, "`buckets` entry has a non-numeric `windowMs`/`openedAt`/`tokens`");
+        }
+        return { windowMs, openedAt, tokens };
+    });
+}

package/dist/tools/fs/fs-bash.d.ts

@@ -5,14 +5,6 @@ import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 export declare function bashReversibilityProbe(allow?: readonly string[], boundary?: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined)): (args: unknown) => {
     reversible: boolean;
 };
-export interface ExecClampOption {
-    deadlineMs: () => number | undefined;
-    onClamp?: (requestedSec: number, clampedSec: number) => void;
-    registerKillHandle?: (toolCallId: string, handle: {
-        pid: number;
-        kill: () => void;
-    }) => () => void;
-}
 export declare function bashExitOneInterpretation(command: string): string | undefined;
 export declare function canAutoBackground(command: string, depth?: number): boolean;
 export declare function createBashTool(env: ExecutionEnv, rootCanonical: string, coAuthor?: string | false, cwdRef?: CwdRef, taskOpts?: {
@@ -24,14 +16,13 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
         priority?: "now" | "next" | "later";
     }) => void;
     detachHub?: import("../../core/tool-detach.js").ToolDetachHub;
-    execClamp?: ExecClampOption;
     autoBackgroundOnTimeout?: boolean;
     oneShot?: boolean;
     additionalRoots?: readonly string[];
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
 }): AgentTool;
-export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, execClamp?: ExecClampOption, opts?: {
+export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, opts?: {
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
     additionalRoots?: readonly string[];