@sema-agent/core 6.0.0 → 7.0.1

package/dist/orchestration/workflow.js

@@ -54,11 +54,14 @@ function forReview(text) {
         return text;
     return `${text.slice(0, MAX_REVIEWED_PROMPT_CHARS)}\n[…TRUNCATED FOR REVIEW: ${text.length - MAX_REVIEWED_PROMPT_CHARS} further characters follow that the child WILL receive and this review did NOT see]`;
 }
-function workflowModelLabel(spec) {
+function workflowModelLabel(spec, catalog) {
     const model = spec.model;
     if (model === undefined)
         return undefined;
-    return typeof model === "string" ? resolveModelDisplayLabel(model) : model.id ?? model.name;
+    if (typeof model !== "string")
+        return model.id ?? model.name;
+    const served = catalog?.[model]?.id;
+    return served ?? resolveModelDisplayLabel(model);
 }
 export const WORKFLOW_SUBAGENT_PROMPT = `You are a subagent spawned by a workflow orchestration script. Use the tools available to complete the task.
 
@@ -441,6 +444,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     }
     const concurrency = normalizeConcurrency(opts.concurrency);
     const agentRegistry = workflowAgentRegistry(opts);
+    const modelCatalog = runner.agentCatalog?.models;
     const store = opts.store;
     const maxAgents = normalizeWorkflowHardCap("maxAgents", opts.maxAgents);
     const maxLogChars = normalizeWorkflowHardCap("maxLogChars", opts.maxLogChars);
@@ -633,11 +637,11 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     const bceParentToolCall = opts.parentToolCallId !== undefined ? { parentToolCallId: opts.parentToolCallId } : {};
     const waIdOf = (callKey) => `wa${createHash("sha256").update(`${runId}:${callKey}`).digest("hex").slice(0, 16)}`;
     const bceLive = new Map();
-    const bceSpawn = (callKey, label, agentType, replayed, sessionId) => {
+    const bceSpawn = (callKey, label, agentType, replayed, sessionId, model) => {
         if (!bceSink)
             return;
         const id = waIdOf(callKey);
-        bceLive.set(id, { callKey, label, ...(agentType !== undefined ? { agentType } : {}), ...(sessionId !== undefined ? { sessionId } : {}) });
+        bceLive.set(id, { callKey, label, ...(agentType !== undefined ? { agentType } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(model !== undefined ? { model } : {}) });
         bceEmit({
             kind: "spawn",
             taskId: id,
@@ -648,6 +652,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             ...(scope !== undefined ? { scope } : {}),
             description: replayed ? `${label} (replayed)` : label,
             agentType: agentType ?? "workflow-agent",
+            ...(model !== undefined ? { model } : {}),
             name: label,
             ...(opts.parentTaskId !== undefined ? { parentTaskId: opts.parentTaskId } : {}),
             workflowRunId: runId,
@@ -679,6 +684,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             workflowRunId: runId,
             ...(scope !== undefined ? { scope } : {}),
             ...(row.agentType !== undefined ? { agentType: row.agentType } : { agentType: "workflow-agent" }),
+            ...(row.model !== undefined ? { model: row.model } : {}),
             ...(row.sessionId !== undefined ? { sessionId: row.sessionId, transcriptId: row.sessionId } : {}),
             name: e.name ?? row.label,
             progressTaskId: e.taskId,
@@ -1003,7 +1009,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const specForIdentity = inheritedModelSnap !== undefined ? { ...spec, model: inheritedModelSnap } : spec;
         const callKey = workflowAgentCallKey(run.agents.length, specForIdentity, agentOpts);
         const prompt = boundedRedactedSummary(spec.systemPrompt ? `${spec.systemPrompt}\n\n${spec.objective}` : spec.objective, MAX_TRANSCRIPT_CHARS);
-        const model = workflowModelLabel(specForIdentity);
+        const specForLabel = spec.model === undefined && typeDefModel !== undefined ? { ...spec, model: typeDefModel } : specForIdentity;
+        const model = workflowModelLabel(specForLabel, modelCatalog);
         return { label, phase, phaseInstance, groupId, inheritedModelSnap, callKey, prompt, model };
     };
     const reviewSpawnBeforeLaunch = async (lane, label, callKey, runSpec, effectiveSignal) => {
@@ -1161,13 +1168,14 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     const rs = r.stats;
                     const cachedOutput = boundedRedactedSummary(r.structuredOutput ?? r.result, MAX_TRANSCRIPT_CHARS);
                     const at = now();
+                    const replayModel = r.model;
                     const replayRec = {
                         label,
                         callKey,
                         ...(groupId !== undefined ? { groupId } : {}),
                         phase,
                         prompt,
-                        ...(model !== undefined ? { model } : {}),
+                        ...(replayModel !== undefined ? { model: replayModel } : {}),
                         replayed: true,
                         status: r.status === "completed" ? "completed" : "failed",
                         taskStatus: r.status,
@@ -1185,9 +1193,9 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     run.agents.push(replayRec);
                     if (phaseInstance)
                         agentPhaseOf.set(replayRec, phaseInstance);
-                    emit({ type: "agent_start", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), callKey, prompt, ...(model !== undefined ? { model } : {}), replayed: true, ts: at });
+                    emit({ type: "agent_start", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), callKey, prompt, ...(replayModel !== undefined ? { model: replayModel } : {}), replayed: true, ts: at });
                     emit({ type: "agent_end", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), status: replayRec.status, output: cachedOutput, ...(rs.toolCalls !== undefined ? { toolCalls: rs.toolCalls } : {}), replayed: true, ts: at });
-                    bceSpawn(callKey, label, agentOpts.agentType, true, r.sessionId || undefined);
+                    bceSpawn(callKey, label, agentOpts.agentType, true, r.sessionId || undefined, replayModel);
                     bceTerminal(callKey, replayRec.status === "completed" ? "completed" : "failed", cachedOutput, r.sessionId || undefined, replayRec.stats);
                     accumulateStats(r, false);
                     void persist("update");
@@ -1233,7 +1241,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 }
                 rec.startedAt = now();
                 const bornChildSessionId = resolveChildSessionIdAtSpawn(spec);
-                bceSpawn(callKey, label, agentOpts.agentType, false, bornChildSessionId);
+                bceSpawn(callKey, label, agentOpts.agentType, false, bornChildSessionId, model);
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);
                 const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
@@ -1545,7 +1553,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             }
             rec.startedAt = now();
             const childSessionId = resolveChildSessionIdAtSpawn(spec);
-            bceSpawn(callKey, label, agentOpts.agentType, false, childSessionId);
+            bceSpawn(callKey, label, agentOpts.agentType, false, childSessionId, model);
             let stream;
             try {
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);

package/dist/stores/file/permission-rule-store.d.ts

@@ -111,6 +111,17 @@ declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
     /** Read and validate. Any refusal answers with an empty set AND says so — never a silent empty store. */
     private read;
     private disclose;
+    /**
+     * design/382 §4.3 — the AT-REST half of the durable two-member scope face: rows carrying a session
+     * scope, read out of persisted bytes (a hand edit or a foreign writer — the engine's own write arms
+     * refuse them loudly), are DROPPED from every read face and DISCLOSED. Never quarantined (the
+     * quarantine area is itself durable), never silently ridden: a session authorization must not gain
+     * an afterlife by being planted where the store cannot legally hold it. The write base
+     * (`current()`) is deliberately NOT screened — foreign bytes are left in place for a person to look
+     * at, exactly like every other damaged-row posture here; they simply never reach a live view, the
+     * sync wire (`readRaw`) or adjudication.
+     */
+    private screenDurableRows;
     private write;
     list(): Promise<StoredAllowRules>;
     /** The quarantine area (design/182 §5.2/§8.3): introspection only — never part of `list()`. */

package/dist/stores/file/permission-rule-store.js

@@ -1,7 +1,7 @@
 import { closeSync, constants as FS, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
-import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, foldDelta, } from "../../core/permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
@@ -158,6 +158,17 @@ class FilePermissionRuleStore {
         catch {
         }
     }
+    screenDurableRows(file) {
+        const isSession = (scope) => scope?.kind === "session";
+        const rules = file.rules.filter((r) => !isSession(r?.scope));
+        const tombstones = file.tombstones.filter((t) => !isSession(t?.scope));
+        const quarantined = (file.quarantined ?? []).filter((q) => !isSession(q?.scope));
+        const dropped = file.rules.length - rules.length + (file.tombstones.length - tombstones.length) + ((file.quarantined ?? []).length - quarantined.length);
+        if (dropped > 0) {
+            this.disclose(`${this.file} carries ${dropped} session-scope row(s) — a session authorization cannot live in the durable store (design/382 §4.3); those rows are ignored on every read face and never ride sync`);
+        }
+        return { rules, tombstones, quarantined };
+    }
     write(next) {
         assertSafeDir(this.dir);
         atomicPublish(this.dir, this.file, JSON.stringify({ ...next, checksum: checksumOf(next) }, null, 2));
@@ -166,16 +177,17 @@ class FilePermissionRuleStore {
         const r = this.read();
         if (!("file" in r))
             return { ...EMPTY_READ };
+        const screened = this.screenDurableRows(r.file);
         return {
-            rules: applyTombstones(r.file.rules, r.file.tombstones),
-            tombstones: r.file.tombstones,
+            rules: applyTombstones(screened.rules, screened.tombstones),
+            tombstones: screened.tombstones,
             rev: r.file.rev,
             checksum: r.file.checksum,
         };
     }
     async quarantined() {
         const r = this.read();
-        return "file" in r ? (r.file.quarantined ?? []) : [];
+        return "file" in r ? this.screenDurableRows(r.file).quarantined : [];
     }
     async readOrgState() {
         const r = this.read();
@@ -245,14 +257,15 @@ class FilePermissionRuleStore {
         }),
         readRaw: async () => this.serialize(() => {
             const cur = this.current();
+            const screened = this.screenDurableRows(cur);
             return {
                 actor: cur.actor,
                 counter: cur.counter,
                 rev: cur.rev,
-                rules: structuredClone(cur.rules),
-                tombstones: structuredClone(cur.tombstones),
+                rules: structuredClone(screened.rules),
+                tombstones: structuredClone(screened.tombstones),
                 ...(cur.sync?.observedVector !== undefined ? { observedVector: structuredClone(cur.sync.observedVector) } : {}),
-                quarantined: structuredClone(cur.quarantined ?? []),
+                quarantined: structuredClone(screened.quarantined),
             };
         }),
         apply: async (delta, opts) => this.serialize(() => {
@@ -287,8 +300,8 @@ class FilePermissionRuleStore {
                 return { rev: cur.rev + 1, sync: report };
             }
             const next = delta.kind === "redemption-add"
-                ? (assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
-                : (assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
+                ? (assertWriteDeltaScopeDurable(delta), assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
+                : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
             if (!this.writeAndVerify(next)) {
                 throw new Error("the permission-rule store did not survive its own write; the change was not committed");
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "6.0.0",
+  "version": "7.0.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 1834,
+  "count": 1841,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -439,6 +439,7 @@
     "InMemoryRuleApprovalRecordStore": "class",
     "InMemorySessionPolicyStore": "class",
     "InMemorySessionRepo": "class",
+    "InMemorySessionRuleOverlay": "class",
     "InMemorySessionStorage": "class",
     "InMemoryStrategyStore": "class",
     "InMemoryToolResultStore": "class",
@@ -1002,6 +1003,9 @@
     "SessionPolicyError": "class",
     "SessionPolicyStore": "interface",
     "SessionRepo": "interface",
+    "SessionRuleOverlay": "interface",
+    "SessionRuleOverlayAdd": "interface",
+    "SessionRuleOverlayApplyResult": "type",
     "SessionRulesRecord": "interface",
     "SessionStorage": "interface",
     "SessionStore": "interface",
@@ -1273,6 +1277,7 @@
     "assertWorkflowDeterminism": "function",
     "assertWorkflowPrimitivesWiring": "function",
     "assertWorkflowSandboxConformance": "function",
+    "assertWriteDeltaScopeDurable": "function",
     "atomicWriteFile": "function",
     "attachToolContract": "function",
     "autoModeArmingRecipeOf": "function",
@@ -1537,7 +1542,9 @@
     "isTerminalTaskNotification": "function",
     "isTerminalWorkflowStatus": "function",
     "isThinkingLevel": "function",
+    "isValidConsentScope": "function",
     "isValidCronExpr": "function",
+    "isValidDurableScope": "function",
     "isValidReminderMark": "function",
     "isWslBashLauncher": "function",
     "isolationPermitsAutoAccept": "function",
@@ -2275,6 +2282,7 @@
     "InMemoryRuleApprovalRecordStore": "advanced",
     "InMemorySessionPolicyStore": "advanced",
     "InMemorySessionRepo": "internal",
+    "InMemorySessionRuleOverlay": "advanced",
     "InMemorySessionStorage": "internal",
     "InMemoryStrategyStore": "advanced",
     "InMemoryToolResultStore": "stable",
@@ -2838,6 +2846,9 @@
     "SessionPolicyError": "advanced",
     "SessionPolicyStore": "advanced",
     "SessionRepo": "stable",
+    "SessionRuleOverlay": "advanced",
+    "SessionRuleOverlayAdd": "advanced",
+    "SessionRuleOverlayApplyResult": "advanced",
     "SessionRulesRecord": "advanced",
     "SessionStorage": "internal",
     "SessionStore": "advanced",
@@ -3109,6 +3120,7 @@
     "assertWorkflowDeterminism": "advanced",
     "assertWorkflowPrimitivesWiring": "advanced",
     "assertWorkflowSandboxConformance": "advanced",
+    "assertWriteDeltaScopeDurable": "advanced",
     "atomicWriteFile": "advanced",
     "attachToolContract": "advanced",
     "autoModeArmingRecipeOf": "advanced",
@@ -3373,7 +3385,9 @@
     "isTerminalTaskNotification": "advanced",
     "isTerminalWorkflowStatus": "advanced",
     "isThinkingLevel": "advanced",
+    "isValidConsentScope": "advanced",
     "isValidCronExpr": "advanced",
+    "isValidDurableScope": "advanced",
     "isValidReminderMark": "advanced",
     "isWslBashLauncher": "internal",
     "isolationPermitsAutoAccept": "advanced",