@sema-agent/core 7.12.0 → 7.13.0

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -114,9 +114,18 @@ export function streamLifecycleVerbs(input) {
         detachHub.request(toolCallId);
     };
     const interrupt = async () => {
+        const interruptRefused = (msg) => {
+            const e = new Error(`cannot interrupt: ${msg}`);
+            e.code = "steering.not_running";
+            return e;
+        };
+        if (live.resultValue)
+            throw interruptRefused("the task has already finished");
         const h = live.handle ?? (await orTimeout(ready));
         if (!h)
-            return;
+            throw interruptRefused("the task is not running");
+        if (live.resultValue !== undefined || h.loop.ended)
+            throw interruptRefused("the task is no longer running");
         if (!h.abortController.signal.aborted)
             h.loop.userInterrupted = true;
         h.abortController.abort();

package/dist/core/task-stream.d.ts

@@ -277,7 +277,16 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }>;
     /**
      * Hard-**interrupt** the running task — a real abort (not a best-effort hint), equivalent to firing the
-     * task's `signal` (design/47). No-op if the task already finished. For a SOFT redirect that lets the
+     * task's `signal` (design/47). Refused typed (`steering.not_running`, the steer-family liveness code —
+     * `cannot interrupt: …`) once the task has finished (the loop's end included: the teardown window
+     * refuses like `halt`/`steer` do), never silently dropped. **A run that has already given its answer
+     * is not cancellable**: once its last turn ended `stopReason:"stop"` with no queued steer / follow-up
+     * left to serve (a continuation the person had already asked for makes that "stop" work in progress,
+     * not an answer), a stop landing on the run's
+     * tail (this verb, the task's `signal`, the walltime or turns limit — one law) still aborts what is
+     * left of that tail (a final-boundary compaction is mooted) but the run ends `completed` with the
+     * answer as `result`, writes no interruption marker, mints no `limits.*` code, and says so once with
+     * the `task.interrupt_unconsumed` notice. For a SOFT redirect that lets the
      * task keep running and adjust, use {@link steer} instead. For the CC-Esc "stop and wait for my
      * input" form — cut the turn, keep the ending clean and resumable — use {@link halt}.
      */

package/dist/core/tool-face.d.ts

@@ -150,7 +150,15 @@ export interface ToolRuleFace {
  *  budgets a MINTED name to — a minted name is always inside this wire bound by construction; a CALLER
  *  declaration is judged against it at prepare. */
 export declare const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/** The roster's wire bound on a SHORT identity member: a contract's `contractId` / `implementationRevision`, and the
+ *  `modelGate` class a definition carries. Bounded at the mint (`rosterMemberBoundProblem`), never truncated. */
 export declare const TOOL_CONTRACT_MAX_CHARS = 64;
+/** The roster's wire bound on a row's `cardId` — a COMPOSITE minted from bounded members, so its bound is DERIVED
+ *  from theirs rather than declared beside them: the widest form is `<mcp|a2a>:<peer>/<tool>` with the peer and the
+ *  protocol tool segment each inside the wire NAME bound (`builtin:<name>` and `<caller|external>:<contractId>` are
+ *  narrower). A row minted from in-bound members therefore fits by construction; the mint's own check on it is a
+ *  tripwire for a new source form, never a working rule. */
+export declare const TOOL_CARD_ID_MAX_CHARS: number;
 /** The roster's wire bound on a KEY — a schema property name, a path-target `param`/alias, a rule-face param. A key is a
  *  SEMANTIC name every fence reads an argument by, so it is never truncated: a declaration over the bound is refused at
  *  the door (caller) or dropped with a disclosed reason (MCP intake), and a row carries every key exactly. */

package/dist/core/tool-face.js

@@ -14,6 +14,7 @@ export function pathTargetSlotOnly(pt) {
 }
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 export const TOOL_CONTRACT_MAX_CHARS = 64;
+export const TOOL_CARD_ID_MAX_CHARS = "mcp:".length + TOOL_WIRE_NAME_MAX_CHARS + "/".length + TOOL_WIRE_NAME_MAX_CHARS;
 export const TOOL_KEY_MAX_CHARS = 256;
 export const TOOL_KEYS_MAX = 1024;
 export const RENDER_HINT_MAX_CHARS = 64;

package/dist/core/tool-policy.d.ts

@@ -19,9 +19,11 @@ export interface ToolCallRequest {
      * (how the target may be confirmed by path), the display family, and the engine-minted identity
      * (`capabilityId` / `contractId` / `shapeDigest`) an exemption store keys on. Stamped at the gate entry
      * from the live roster, so identity follows the OBJECT the call dispatches to — a caller tool that merely
-     * took a built-in's name carries its own face, never the built-in's. ABSENT when a policy is invoked
-     * outside a Runner (a bare producer): a path-confining face then reads the catalog's declaration for the
-     * NAME (the pre-388 posture, never wider), and a skill-scope face treats the write as unconfirmable.
+     * took a built-in's name carries its own face, never the built-in's. ABSENT only on a BARE request (a
+     * policy invoked outside a Runner by a producer that stamped nothing): a PROTECTIVE fence (a deny-list)
+     * then reads the catalog's declaration for the NAME, tighten-only; a CONTAINMENT fence (a grant admitting a
+     * write by its path) REFUSES the request, typed (`policy.bare_request`, #626 ②) — stamp the face yourself
+     * (`toolCallFaceOf(roster, name)`) when driving a policy outside a Runner.
      */
     face?: ToolCallFace;
     /**

package/dist/core/tool-registry.d.ts

@@ -62,13 +62,21 @@ type CallPathTarget = ToolCallPathTarget;
  * a different file, and the deny this floor exists to preserve simply misses.
  */
 export declare function protectivePathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
+/** The typed refusal a CONTAINMENT reader mints for a request that carries no face at all (#626 ② — design/388 B6's
+ *  bare-producer migration seam, closed). */
+export declare const BARE_REQUEST_CODE = "policy.bare_request";
 /**
  * The path target a CONTAINMENT fence reads (a grant admitting a write BY its path: session `allowDirs`, the fs-write
  * gate's accept/exempt dirs; the active-skill allowPaths face reads its own eligibility bit the same way): the object
  * face's OWN declaration only — a same-name tool that declares no path target is an UNCONFIRMABLE write (the catalog's
- * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed. A BARE
- * request (no face at all — a policy invoked outside a Runner) reads the catalog for the name: the pre-388 reading, the
- * documented migration seam for bare producers.
+ * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed.
+ *
+ * #626 ②: a BARE request (no face at all) is REFUSED, typed (`policy.bare_request`), never answered from the catalog
+ * for the name. A grant is a claim about the tool's OWN slot, and only a prepared leg's roster can say which object
+ * the call dispatches to — the catalog's declaration for a NAME is exactly the reading a same-name caller tool would
+ * exploit. Inside a Runner every gated request carries the leg's face (the gate entry, the resume belts and the
+ * pre-CAS edit recheck stamp it); a policy invoked outside a Runner stamps its own (`toolCallFaceOf(roster, name)`).
+ * The PROTECTIVE floor above keeps reading the catalog for a bare request: tighten-only, a deny can only gain a slot.
  */
 export declare function declaredPathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
 /** Is this call a write a PROTECTIVE fence judges (a protected target whose access ≠ read)? The name sets are its static view. */

package/dist/core/tool-registry.js

@@ -54,8 +54,14 @@ export function protectivePathTargetOf(call) {
     const floor = pathTargetOf(call.toolName);
     return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
+export const BARE_REQUEST_CODE = "policy.bare_request";
 export function declaredPathTargetOf(call) {
-    return call.face !== undefined ? call.face.pathTarget : pathTargetOf(call.toolName);
+    if (call.face === undefined) {
+        const e = new Error(`tool call ${JSON.stringify(call.toolName)} carries no face: a containment fence admits a write only by the tool's OWN declared path target, which a prepared leg's roster stamps on every gated request — a policy invoked outside a Runner must stamp \`face\` itself (toolCallFaceOf) rather than expect the catalog's declaration for the name`);
+        e.code = BARE_REQUEST_CODE;
+        throw e;
+    }
+    return call.face.pathTarget;
 }
 export function isProtectedWrite(call) {
     const pt = protectivePathTargetOf(call);

package/dist/core/tool-roster.d.ts

@@ -309,6 +309,32 @@ export declare function inputKeysOf(schema: TSchema | undefined): {
 /** The roster's KEY bounds over a schema (design/388 B20): a problem sentence, or undefined when every top-level key fits.
  *  Shared by the caller declaration door (typed refusal) and the MCP intake (disclosed drop) — a key is never truncated. */
 export declare function schemaKeyBoundProblem(schema: TSchema | undefined): string | undefined;
+/** The identity members of one roster row the wire bounds hold, as a DECLARATION (the door) or a MINTED row hands them. */
+export interface RosterBoundMembers {
+    name: string;
+    aliases?: readonly string[];
+    /** An MCP/A2A mount's peer (the row's `origin.peer`) — a NAME on the roster, held to the wire name bound. */
+    peer?: string;
+    contractId?: string;
+    implementationRevision?: string;
+    modelGate?: string;
+    cardId?: string;
+}
+/** The typed refusal a member over its bound mints — the door's two codes, and the mint's own for the members no
+ *  declaration door names (`modelGate`, the derived `cardId`). */
+export type RosterBoundCode = "config.tool_name_too_long" | "config.tool_contract_too_long" | "config.tool_roster_bound";
+/**
+ * design/388 B20 / #626 ① — the ONE bound judge over a row's identity members: a problem `{ code, message }`, or
+ * undefined when every member fits. Read by the declaration door (a `TaskSpec.tools` entry, refused before session
+ * acquire) and by the row mint (every source — an MCP/A2A peer, a definition that reached the mint by a route the
+ * door does not cover — refused before the row exists). A member over its bound is NEVER truncated onto the row: a
+ * truncated identity is a different identity (`judgeParkedToolIdentity` compares it across a park; the card
+ * namespace door reads it), and the schema's own bounds would then describe a row the mint never made.
+ */
+export declare function rosterMemberBoundProblem(m: RosterBoundMembers): {
+    code: RosterBoundCode;
+    message: string;
+} | undefined;
 /**
  * The rule vocabulary of ONE mounted instance (design/388 §2.2 ③ / D-3): DERIVED = the scalar top-level
  * keys ∪ the path target's `param` + aliases; a declared `params` list can only NARROW it (a declared

package/dist/core/tool-roster.js

@@ -2,12 +2,12 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { getToolContract } from "../prompt-assembly/tool-catalog.js";
 import { protocolOf } from "./protocol-table.js";
-import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
+import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_CARD_ID_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_WIRE_NAME_MAX_CHARS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
 function lit(values) {
     return Type.Union(values.map((v) => Type.Literal(v)));
 }
-const Name = Type.String({ minLength: 1, maxLength: 128 });
-const Short = Type.String({ maxLength: 64 });
+const Name = Type.String({ minLength: 1, maxLength: TOOL_WIRE_NAME_MAX_CHARS });
+const Short = Type.String({ maxLength: TOOL_CONTRACT_MAX_CHARS });
 const Key = Type.String({ maxLength: TOOL_KEY_MAX_CHARS });
 const Digest16 = Type.String({ minLength: 16, maxLength: 16 });
 export const ROSTER_SOURCES = ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
@@ -26,7 +26,7 @@ export const ToolRosterEntry = Type.Object({
     contract: Type.Object({ contractId: Short, implementationRevision: Short }, { additionalProperties: false }),
     shapeDigest: Digest16,
     wireSchemaDigest: Digest16,
-    cardId: Type.String({ maxLength: 160 }),
+    cardId: Type.String({ maxLength: TOOL_CARD_ID_MAX_CHARS }),
     capabilityId: Digest16,
     inputKeys: Type.Array(Type.Object({ name: Key, type: lit(["string", "number", "integer", "boolean", "object", "array", "null", "mixed"]) }, { additionalProperties: false }), { maxItems: TOOL_KEYS_MAX }),
     effect: lit(["read", "write", "idempotent"]),
@@ -207,6 +207,26 @@ export function schemaKeyBoundProblem(schema) {
         return `the schema property ${JSON.stringify(long.slice(0, 40) + "…")} is ${long.length} characters; a roster key is at most ${TOOL_KEY_MAX_CHARS}`;
     return undefined;
 }
+export function rosterMemberBoundProblem(m) {
+    const over = (label, value, bound) => `${label} ${JSON.stringify(value.slice(0, 40) + "…")} is ${value.length} characters; the roster's bound is ${bound}`;
+    const of = (text) => `tool ${JSON.stringify(m.name.slice(0, 40))}: ${text}`;
+    if (m.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: over("tool name", m.name, TOOL_WIRE_NAME_MAX_CHARS) };
+    const alias = m.aliases?.find((a) => a.length > TOOL_WIRE_NAME_MAX_CHARS);
+    if (alias !== undefined)
+        return { code: "config.tool_name_too_long", message: of(over("alias", alias, TOOL_WIRE_NAME_MAX_CHARS)) };
+    if (m.peer !== undefined && m.peer.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: of(over("peer", m.peer, TOOL_WIRE_NAME_MAX_CHARS)) };
+    for (const [label, v] of [["contractId", m.contractId], ["implementationRevision", m.implementationRevision]]) {
+        if (v !== undefined && v.length > TOOL_CONTRACT_MAX_CHARS)
+            return { code: "config.tool_contract_too_long", message: of(over(`contract ${label}`, v, TOOL_CONTRACT_MAX_CHARS)) };
+    }
+    if (m.modelGate !== undefined && m.modelGate.length > TOOL_CONTRACT_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("modelGate", m.modelGate, TOOL_CONTRACT_MAX_CHARS)) };
+    if (m.cardId !== undefined && m.cardId.length > TOOL_CARD_ID_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("cardId", m.cardId, TOOL_CARD_ID_MAX_CHARS)) };
+    return undefined;
+}
 export function ruleFaceOfInstance(schema, declared, pathTarget) {
     const { scalar } = inputKeysOf(schema);
     const derived = new Set(scalar);
@@ -375,15 +395,26 @@ export function mintRosterEntry(tool, meta, facts) {
     const pathTarget = face.pathTarget;
     const rf = ruleFaceOfInstance(tool.parameters, face.ruleFace, pathTarget);
     const hints = face.renderHints !== undefined ? capRenderHints(face.renderHints) : undefined;
+    const bound = rosterMemberBoundProblem({
+        name: tool.name,
+        aliases: tool.aliases,
+        ...(peer !== null ? { peer } : {}),
+        contractId: d.contractId,
+        implementationRevision: d.implementationRevision,
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
+        cardId,
+    });
+    if (bound !== undefined)
+        throw configError(bound.code, bound.message);
     return {
         name: tool.name,
         aliases: [...new Set(tool.aliases ?? [])],
         source: meta.source,
         ...(meta.origin !== undefined ? { origin: { peer: meta.origin.peer, ...(meta.origin.declaredBy !== undefined ? { declaredBy: meta.origin.declaredBy } : {}) } } : {}),
-        contract: { contractId: d.contractId.slice(0, 64), implementationRevision: d.implementationRevision.slice(0, 64) },
+        contract: { contractId: d.contractId, implementationRevision: d.implementationRevision },
         shapeDigest: d.shapeDigest,
         wireSchemaDigest: d.wireSchemaDigest,
-        cardId: cardId.slice(0, 160),
+        cardId,
         capabilityId: mintCapabilityId({ source: meta.source, peer, name: tool.name, contractId: d.contractId }),
         inputKeys,
         effect,
@@ -417,7 +448,7 @@ export function mintRosterEntry(tool, meta, facts) {
         validateInput: typeof tool.validateInput === "function",
         deferred: facts.deferred.has(tool.name),
         alwaysLoad: face.alwaysLoad === true || face.mcpAlwaysLoad === true,
-        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate.slice(0, 64) } : {}),
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
         ...(hints !== undefined ? { renderHints: hints } : {}),
         mountedBy: meta.mountedBy,
     };

package/dist/index.d.ts

@@ -126,9 +126,9 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
-export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors, type ToolConformanceVector } from "./core/tool-conformance.js";

package/dist/index.js

@@ -102,9 +102,9 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
-export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors } from "./core/tool-conformance.js";

package/dist/server/http.js

@@ -97,7 +97,8 @@ export function createTaskServer(opts) {
         res.on("close", () => {
             if (!res.writableEnded) {
                 clientGone = true;
-                void stream.interrupt();
+                stream.interrupt().catch(() => {
+                });
                 void stream.destroy();
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2274,
+  "count": 2279,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -109,6 +109,7 @@
     "AutonomousLoopPromptOptions": "interface",
     "BACKGROUND_AGENT_CONTRACT_SCOPE": "variable",
     "BARE_INTERPRETER_NAMES": "variable",
+    "BARE_REQUEST_CODE": "variable",
     "BASH_READONLY_DEFAULT_ALLOW": "variable",
     "BUILTIN_COMPLIANCE_DENIES": "variable",
     "BUILTIN_READONLY_DENY_TOOLS": "variable",
@@ -1078,6 +1079,8 @@
     "RollingTailBuffer": "class",
     "RootAdoptionFile": "type",
     "RosterAccess": "interface",
+    "RosterBoundCode": "type",
+    "RosterBoundMembers": "interface",
     "RosterEntry": "interface",
     "RosterGcOptions": "interface",
     "RosterSource": "type",
@@ -1308,6 +1311,7 @@
     "TEAM_DISCUSSION_WORKFLOW_NAME": "variable",
     "TOKEN_CHECKPOINT_VERSION": "variable",
     "TOOL_APPROVAL_CARDS": "variable",
+    "TOOL_CARD_ID_MAX_CHARS": "variable",
     "TOOL_CONFORMANCE_VECTORS": "variable",
     "TOOL_CONTRACT_MAX_CHARS": "variable",
     "TOOL_FAMILIES": "variable",
@@ -2137,6 +2141,7 @@
     "retiredWorkflowNameAliases": "function",
     "retryBackoffMs": "function",
     "riskSeverity": "function",
+    "rosterMemberBoundProblem": "function",
     "routePairingStatus": "function",
     "routePeerDeliveryReceipt": "function",
     "routePeerDroppedReceipt": "function",
@@ -2385,6 +2390,7 @@
     "AutonomousLoopPromptOptions": "advanced",
     "BACKGROUND_AGENT_CONTRACT_SCOPE": "advanced",
     "BARE_INTERPRETER_NAMES": "advanced",
+    "BARE_REQUEST_CODE": "advanced",
     "BASH_READONLY_DEFAULT_ALLOW": "advanced",
     "BUILTIN_COMPLIANCE_DENIES": "advanced",
     "BUILTIN_READONLY_DENY_TOOLS": "advanced",
@@ -3354,6 +3360,8 @@
     "RollingTailBuffer": "advanced",
     "RootAdoptionFile": "advanced",
     "RosterAccess": "advanced",
+    "RosterBoundCode": "advanced",
+    "RosterBoundMembers": "advanced",
     "RosterEntry": "advanced",
     "RosterGcOptions": "advanced",
     "RosterSource": "advanced",
@@ -3584,6 +3592,7 @@
     "TEAM_DISCUSSION_WORKFLOW_NAME": "advanced",
     "TOKEN_CHECKPOINT_VERSION": "advanced",
     "TOOL_APPROVAL_CARDS": "advanced",
+    "TOOL_CARD_ID_MAX_CHARS": "advanced",
     "TOOL_CONFORMANCE_VECTORS": "advanced",
     "TOOL_CONTRACT_MAX_CHARS": "advanced",
     "TOOL_FAMILIES": "advanced",
@@ -4413,6 +4422,7 @@
     "retiredWorkflowNameAliases": "advanced",
     "retryBackoffMs": "advanced",
     "riskSeverity": "advanced",
+    "rosterMemberBoundProblem": "advanced",
     "routePairingStatus": "advanced",
     "routePeerDeliveryReceipt": "advanced",
     "routePeerDroppedReceipt": "advanced",