@sema-agent/core 7.23.1 → 7.23.3

package/dist/tools/fs/fs-bash.js

@@ -8,7 +8,7 @@ import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESS
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
-import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
+import { imageMagicMatches, normalizeAbsPathLexically, violationDetails, withinAnyRoot } from "./safety.js";
 import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
@@ -16,6 +16,7 @@ import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, } from "./bash-readonly-classifier.js";
 import { NOT_AUTO_ALLOWED, SHELL_SCAN_DECLINES } from "./bash-program-position.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { thrownText } from "../../core/thrown-value.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
 function operandFamily(paths) {
@@ -47,7 +48,8 @@ export function bashReversibilityProbe(allow, boundary) {
         if (loop.reason === undefined)
             return { reversible: true };
         const seatOffer = (verdict) => (offers ? readRootCandidateOf(verdict) : {});
-        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop, CLASSIFY_SEAT_DECLINE_EVIDENCE))
+        const loopScan = refusedCommandScan(command, allowSet, resolved, loop, CLASSIFY_SEAT_DECLINE_EVIDENCE);
+        if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop, loopScan))
             return { reversible: false, mandated: true, ...seatOffer(loop) };
         const refusedCause = recursiveReadCause(detailed);
         return { reversible: false, ...boundaryGate(detailed), ...seatOffer(detailed), ...(refusedCause !== undefined ? { cause: refusedCause } : {}) };
@@ -92,20 +94,29 @@ export const CLASSIFY_SEAT_DECLINE_EVIDENCE = new Set();
 function readBoundaryMandate(command, allowSet, resolved, verdict, declineEvidence) {
     if (resolved === undefined)
         return {};
-    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict, declineEvidence))
+    const scan = refusedCommandScan(command, allowSet, resolved, verdict, declineEvidence);
+    if (denyJudgeSpoke(verdict) || unjudgedRead(command, allowSet, resolved, verdict, scan))
         return { mandated: true };
     const named = classifyOutOfRootReadGate(command, allowSet, resolved);
-    return named.gated || named.denied === true ? { mandated: true } : {};
+    if (named.gated || named.denied === true)
+        return { mandated: true };
+    return declinedRung(scan);
+}
+function declinedRung(scan) {
+    return scan.declined ? { boundaryDeclined: true } : {};
+}
+function refusedCommandScan(command, allowSet, resolved, verdict, declineEvidence) {
+    return verdict.refusedWhole === true ? refusedCommandMayRead(command, allowSet, resolved, declineEvidence) : { mayRead: false, declined: false };
 }
 function boundaryUnjudged(verdict) {
     return verdict.refusedWhole === true || (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0);
 }
-function unjudgedRead(command, allowSet, resolved, verdict, declineEvidence) {
+function unjudgedRead(command, allowSet, resolved, verdict, scan) {
     if (verdict.unresolvedOperands !== undefined && verdict.unresolvedOperands.length > 0)
         return true;
     if (verdict.refusedWhole !== true)
         return false;
-    if (refusedCommandMayRead(command, allowSet, resolved, declineEvidence))
+    if (scan.mayRead)
         return true;
     if (resolved === undefined)
         return false;
@@ -128,7 +139,7 @@ export function bashReadBoundaryProbe(boundary) {
     const allowSet = new Set(bashClassifyDefaultAllow());
     const judge = (command, resolved, offers) => {
         const seatVerdict = (verdict) => {
-            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict, BOUNDARY_SEAT_DECLINE_EVIDENCE)) {
+            if (boundaryDeclared(verdict) || unjudgedRead(command, allowSet, resolved, verdict, refusedCommandScan(command, allowSet, resolved, verdict, BOUNDARY_SEAT_DECLINE_EVIDENCE))) {
                 const cause = recursiveReadCause(verdict);
                 return { reversible: false, mandated: true, ...(cause !== undefined ? { cause } : {}) };
             }
@@ -726,7 +737,7 @@ async function adoptBackgroundShell(req) {
         return { ok: true, taskId, outputFile };
     }
     catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
+        const reason = thrownText(e);
         let kill;
         try {
             kill = await env.killBackground(shellId);
@@ -761,7 +772,10 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     };
     const canonicalEscape = async (command, signal) => {
         const resolvedBoundary = typeof taskOpts.readBoundary === "function" ? taskOpts.readBoundary() : taskOpts.readBoundary;
-        if (resolvedBoundary === undefined || resolvedBoundary.face === "open")
+        if (resolvedBoundary === undefined)
+            return undefined;
+        const ask = { deny: resolvedBoundary.denyMatch, containment: resolvedBoundary.face !== "open" };
+        if (ask.deny === undefined && !ask.containment)
             return undefined;
         const faces = [
             classifyCompoundReadonlyDetailed(command, recheckReaders, resolvedBoundary),
@@ -770,7 +784,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
         const literal = [...new Set(faces.flatMap((v) => [...(v.checkedPaths ?? []), ...(v.checkedSpellings ?? [])]))];
         const asked = new Set(faces.flatMap((v) => v.outOfRootPaths ?? []));
         const patterns = [...new Set(faces.flatMap((v) => [...(v.undecidedPaths ?? []), ...(v.undecidedSpellings ?? [])]))].filter((p) => !asked.has(normalizeAbsPathLexically(p)));
-        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, signal);
+        return await canonicalEscapeRefusal(canonicalBoundaryFor(resolvedBoundary.roots), { literal, patterns }, resolvedBoundary.roots, FULL_SHELL_FACE_ESCAPE_PROSE, ask, signal);
     };
     return defineTool({
         name: "Bash",
@@ -1178,6 +1192,7 @@ function createCanonicalReadBoundary(env, readRoots) {
         let frontier = [p.slice(0, segs[first].start).replace(/[\\/]+$/, "") || "/"];
         let dirsUsed = 0;
         let matches = 0;
+        const canonicalOfMatch = new Map();
         for (let j = first; j < segs.length; j++) {
             const seg = segs[j].text;
             if (!GLOB_METACHAR_RE.test(seg)) {
@@ -1211,40 +1226,48 @@ function createCanonicalReadBoundary(env, readRoots) {
                         if (re.test(dot))
                             next.push(joinCandidate(dir, dot));
                 }
-                let dirInside = false;
-                if (isLast) {
-                    if (canonDir !== undefined && !withinAnyRoot(roots, canonDir.value)) {
-                        next.push(canonDir.value);
-                        continue;
-                    }
-                    dirInside = canonDir !== undefined;
-                }
+                const canonDirHere = isLast ? canonDir?.value : undefined;
                 for (const entry of listed.value) {
                     if (!globSegmentMatches(re, seg, entry.name))
                         continue;
                     if (++matches > MAX_GLOB_MATCHES) {
                         return { unverifiable: `"${p}" expands to more than ${MAX_GLOB_MATCHES} names, too many to enumerate to verify` };
                     }
-                    if (isLast && dirInside && entry.kind !== "symlink")
-                        continue;
-                    next.push(joinCandidate(dir, entry.name));
+                    const candidate = joinCandidate(dir, entry.name);
+                    if (canonDirHere !== undefined && entry.kind !== "symlink")
+                        canonicalOfMatch.set(candidate, joinCandidate(canonDirHere, entry.name));
+                    next.push(candidate);
                 }
             }
             frontier = next;
             if (frontier.length === 0)
-                return { paths: [] };
+                return { paths: [], canonical: canonicalOfMatch };
         }
-        return { paths: frontier };
+        return { paths: frontier, canonical: canonicalOfMatch };
     };
     return {
-        escapesAfterResolution: async (paths, signal) => {
+        escapesAfterResolution: async (paths, ask, signal) => {
+            const deny = ask.deny;
             if (lexicalOnly || (paths.literal.length === 0 && paths.patterns.length === 0))
                 return { escaping: [] };
             const roots = await canonicalRoots(signal);
             const escaping = [];
             let unresolvable;
-            const judge = async (p) => {
-                const real = await resolve(p, signal);
+            let denied;
+            const denyHit = (p) => {
+                if (deny === undefined || denied !== undefined)
+                    return false;
+                const folded = normalizeAbsPathLexically(p);
+                const pattern = deny(folded);
+                if (pattern === null)
+                    return false;
+                denied = { path: folded, pattern };
+                return true;
+            };
+            const judge = async (p, canonicalKnown) => {
+                if (denyHit(p))
+                    return;
+                const real = canonicalKnown !== undefined ? { value: canonicalKnown, exact: true } : await resolve(p, signal);
                 if (real === undefined) {
                     if (resolverIsAuthoritative)
                         unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
@@ -1254,18 +1277,36 @@ function createCanonicalReadBoundary(env, readRoots) {
                     unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;
                 }
-                if (!withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
+                if (denyHit(real.value))
+                    return;
+                if (ask.containment && !withinAnyRoot(roots, real.value) && !escaping.includes(real.value))
                     escaping.push(real.value);
             };
-            for (const p of paths.literal)
+            for (const p of paths.literal) {
+                if (denied !== undefined)
+                    break;
                 await judge(p);
+            }
             for (const p of paths.patterns) {
+                if (denied !== undefined)
+                    break;
                 const expanded = await expandGlobCandidate(p, roots, signal);
-                if (expanded !== undefined && "unverifiable" in expanded)
-                    return { escaping, unverifiable: expanded.unverifiable };
-                for (const t of expanded !== undefined && expanded.paths.length > 0 ? expanded.paths : [p])
-                    await judge(t);
+                if (expanded !== undefined && "unverifiable" in expanded) {
+                    unresolvable ??= expanded.unverifiable;
+                    continue;
+                }
+                if (expanded !== undefined && expanded.paths.length > 0) {
+                    for (const t of expanded.paths) {
+                        if (denied !== undefined)
+                            break;
+                        await judge(t, expanded.canonical.get(t));
+                    }
+                }
+                else
+                    await judge(p);
             }
+            if (denied !== undefined)
+                return { escaping, denied };
             return unresolvable === undefined ? { escaping } : { escaping, unverifiable: unresolvable };
         },
         canonicalOf: async (path, signal) => {
@@ -1289,8 +1330,14 @@ function createCanonicalReadBoundary(env, readRoots) {
         },
     };
 }
-async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, signal) {
-    const resolved = await canonical.escapesAfterResolution(candidates, signal);
+async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, ask, signal) {
+    const resolved = await canonical.escapesAfterResolution(candidates, ask, signal);
+    if (resolved.denied !== undefined) {
+        const content = `Error (Bash): reading "${resolved.denied.path}" is refused: the target matches the sensitive-path ` +
+            `read deny list (pattern "${resolved.denied.pattern}"). This list guards credential-class paths and ` +
+            `applies regardless of the containment roots. ${DENY_REFUSAL_NOTE}`;
+        return errorResult(content, violationDetails({ code: "read_path_denied", message: content, target: resolved.denied.path, pattern: resolved.denied.pattern }));
+    }
     if (resolved.unverifiable !== undefined) {
         return errorResult(`Error (Bash): ${resolved.unverifiable}, so this command cannot be confirmed to read only inside the allowed directories for this session: ${readRoots.join(", ")}. ` +
             face.note, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: [] });
@@ -1302,6 +1349,8 @@ async function canonicalEscapeRefusal(canonical, candidates, readRoots, face, si
     }
     return undefined;
 }
+const DENY_REFUSAL_NOTE = "The read boundary judged this command's written spelling before the call was approved; what the shell " +
+    "would actually read was established only at execution, and a deny-listed read is refused here rather than escalated.";
 const READONLY_FACE_ESCAPE_PROSE = {
     subject: "a path this command reads",
     verdictPhrase: ` ${NOT_AUTO_ALLOWED}`,
@@ -1365,7 +1414,7 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
                     return errorResult(`Error (Bash): ${boundary.reason}. ${BASH_READONLY_CONFINEMENT_NOTE}`, { type: "readonly_out_of_root", code: "readonly_out_of_root", paths: boundary.outOfRootPaths ?? [] });
                 }
             }
-            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? [])], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, ctx.signal);
+            const escape = await canonicalEscapeRefusal(canonicalBoundary, { literal: [...(boundary.checkedPaths ?? []), ...(boundary.checkedSpellings ?? [])], patterns: [...(boundary.undecidedPaths ?? []), ...(boundary.undecidedSpellings ?? [])] }, readRoots, READONLY_FACE_ESCAPE_PROSE, { deny: undefined, containment: true }, ctx.signal);
             if (escape !== undefined)
                 return escape;
             const readOnlyTick = opts?.onToolProgress === undefined ? undefined : (t) => describeSafely(opts.onToolProgress, { toolCallId: ctx.toolCallId, toolName: "Bash", ...t });

package/dist/tools/fs/fs-write.js

@@ -5,6 +5,7 @@ import { sha256, resolveKey, violationText, violationDetails, requireRead, check
 import { decodeTextBytes, encodeTextForFile, normalizeEditText, normalizeFileText } from "./encoding.js";
 import { MAX_EDIT_BYTES, decodeEditBytes, tooLargeToEditMessage, truncatedUtf16BodyMessage, persistedTextOf, notReadRefusalText, enoentMessage, FILE_STATE_TRAILER, FILE_PATH_PARAMS, ipynbRedirect, countLines, applyRecordedEdit, } from "./fs-shared.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { thrownText } from "../../core/thrown-value.js";
 async function envFinalWrite(env, key, content, signal, opts) {
     const fireEdited = () => {
         if (opts?.edited?.hook === undefined)
@@ -66,7 +67,7 @@ async function trackToolEdit(hook, tool, path, key, signal) {
         res = await hook({ tool, path, key, ...(signal !== undefined ? { signal } : {}) });
     }
     catch (err) {
-        return { refusal: `Error (${tool}): the file-history first-touch backup failed (${clipHookText(err instanceof Error ? err.message : String(err))}) — nothing was written.` };
+        return { refusal: `Error (${tool}): the file-history first-touch backup failed (${clipHookText(thrownText(err))}) — nothing was written.` };
     }
     if (res.ok === false)
         return { refusal: clipHookText(res.refusal) };
@@ -80,7 +81,7 @@ async function gateToolWrite(hook, tool, path, key, content) {
         res = await hook({ tool, path, key, content });
     }
     catch (err) {
-        return `Error (${tool}): the write gate failed (${clipHookText(err instanceof Error ? err.message : String(err))}) — nothing was written.`;
+        return `Error (${tool}): the write gate failed (${clipHookText(thrownText(err))}) — nothing was written.`;
     }
     if (res !== undefined && res.ok === false)
         return `Error (${tool}): write rejected by the write gate (${res.code}): ${clipHookText(res.reason)}`;

package/dist/tools/fs/safety.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { pathTargetValue, protectivePathTargetOf } from "../../core/tool-registry.js";
 import { withGateTimeout, DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../../core/gate-bounded-await.js";
+import { thrownText } from "../../core/thrown-value.js";
 export function fileArgPath(args) {
     const a = args;
     const fp = a?.file_path;
@@ -524,7 +525,7 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
     catch (err) {
         if (seenThrow && err === thrownByProbe)
             throw err;
-        return { ok: false, message: `cannot resolve path "${path}": ${err instanceof Error ? err.message : String(err)}` };
+        return { ok: false, message: `cannot resolve path "${path}": ${thrownText(err)}` };
     }
 }
 async function probeRealTarget(env, path, target, family, signal) {

package/dist/tools/fs/search.js

@@ -1,6 +1,7 @@
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
 import { hasBinaryExtension, isAbsoluteForFamily, isWinFormPath, joinForFamily, pathFamilyOf } from "./safety.js";
+import { thrownText } from "../../core/thrown-value.js";
 const WALK_MAX_FILES = 5000;
 const WALK_MAX_DEPTH = 32;
 const GREP_DEFAULT_CAP = 250;
@@ -772,7 +773,7 @@ export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut
         test = compilePattern(p);
     }
     catch (e) {
-        return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
+        return { text: `Error (grep): invalid regex: ${thrownText(e)}` };
     }
     const ignore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
@@ -912,7 +913,7 @@ export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut
             catch (e) {
                 if (e instanceof GrepBudgetExceeded)
                     return { text: budgetError(shownPath, monotonicNow() - fileMatchStart) };
-                return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
+                return { text: `Error (grep): invalid regex: ${thrownText(e)}` };
             }
             fileCount = spans.length;
             if (mode === "content") {

package/dist/tools/monitor.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { hasBackgroundShell } from "../core/background-shell.js";
 import { MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, } from "../core/task-registry.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const MONITOR_DESCRIPTION = "Run a shell command in the background and watch its stdout as a stream of events.\n" +
     "\n" +
     "- Each line the command writes to stdout becomes a notification event delivered to you between turns; " +
@@ -98,7 +99,7 @@ export function createMonitorTool(env, opts) {
                 });
             }
             catch (e) {
-                const why = e instanceof Error ? e.message : String(e);
+                const why = thrownText(e);
                 let killDetail;
                 try {
                     const kill = await env.killBackground(spawn.value.shellId);
@@ -106,7 +107,7 @@ export function createMonitorTool(env, opts) {
                         killDetail = `${kill.error.code}: ${kill.error.message}`;
                 }
                 catch (killErr) {
-                    killDetail = killErr instanceof Error ? killErr.message : String(killErr);
+                    killDetail = thrownText(killErr);
                 }
                 return errorResult(killDetail === undefined
                     ? `Error (Monitor): the watch process was started but could not be registered (${why}); it has been terminated.`

package/dist/tools/sql.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { thrownText } from "../core/thrown-value.js";
 const FORBIDDEN = /\b(insert|update|delete|drop|alter|create|truncate|grant|revoke|merge|replace|attach|detach|pragma|vacuum|exec|execute|call|copy|lock|reindex)\b/i;
 class SqlValidationError extends Error {
 }
@@ -82,7 +83,7 @@ export function createSqlTool(opts) {
                 validateReadOnlySql(sql, opts.allowTables);
             }
             catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
+                const msg = thrownText(e);
                 return { content: `SQL rejected: ${msg}`, details: { error: msg }, terminate: false };
             }
             const rows = await opts.query(stripTrailingSemicolon(sql.trim()));

package/dist/tools/web.js

@@ -8,6 +8,7 @@ import { DEFAULT_CHARS_PER_TOKEN } from "../internal/harness.js";
 import { binaryMagicFormat } from "./fs/safety.js";
 import { pdfMagicMatches } from "./fs/pdf.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const MAX_REDIRECTS = 10;
 const MAX_URL_LENGTH = 2048;
 const WEBFETCH_ACCEPT = "text/markdown, text/html, */*";
@@ -447,7 +448,7 @@ export function webFetchToolSpec(config = {}) {
                     };
                 }
                 return {
-                    content: `Error (WebFetch): request failed: ${e instanceof Error ? e.message : String(e)}`,
+                    content: `Error (WebFetch): request failed: ${thrownText(e)}`,
                     details: errDetails,
                     isError: true,
                 };
@@ -594,7 +595,7 @@ export function webFetchToolSpec(config = {}) {
                 catch (e) {
                     out = text;
                     note =
-                        `[note: summarization failed (${inlineUntrusted(e instanceof Error ? e.message : String(e), 160)}) — ` +
+                        `[note: summarization failed (${inlineUntrusted(thrownText(e), 160)}) — ` +
                             `raw page content follows; the requested analysis ("${inlineUntrusted(prompt, 120)}") was NOT applied]`;
                 }
             }
@@ -910,7 +911,7 @@ export function createWebSearchTool(config) {
                     return abortedFrame();
                 if (ac.signal.aborted)
                     return timedOutFrame();
-                const msg = redactSecrets(e instanceof Error ? e.message : String(e)).trim();
+                const msg = redactSecrets(thrownText(e)).trim();
                 const headline = "Error (WebSearch): the search backend failed.";
                 const verdict = classifySearchFailure(msg);
                 const composed = (msg ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}` : headline) + `\n\n${verdict.hint}`;
@@ -1029,18 +1030,7 @@ export async function probeSearchBackend(search, options) {
         return { ok: true, results: results.length };
     }
     catch (e) {
-        let text;
-        if (e instanceof Error)
-            text = e.message;
-        else {
-            try {
-                text = String(e);
-            }
-            catch {
-                text = Object.prototype.toString.call(e);
-            }
-        }
-        return { ok: false, error: text };
+        return { ok: false, error: thrownText(e) };
     }
     finally {
         clearTimeout(timer);

package/dist/tools/worktree.js

@@ -3,6 +3,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "../core/git-worktree-env.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const ENTER_DESCRIPTION = "Use this tool ONLY when explicitly instructed to work in a worktree — either by the user directly, or by " +
     "project instructions. This tool creates an isolated git worktree and switches the current session into it.\n" +
     "\n" +
@@ -67,14 +68,16 @@ const EXIT_DESCRIPTION = "Exit a worktree session created by EnterWorktree and r
     "- Once exited, EnterWorktree can be called again to create a fresh worktree.";
 const shq = (s) => `'${s.replace(/'/g, "'\\''")}'`;
 function reasonOf(e) {
-    if (e instanceof Error)
-        return e.message;
-    if (typeof e === "object" && e !== null) {
-        const m = e.message;
-        if (typeof m === "string" && m !== "")
-            return m;
+    try {
+        if (typeof e === "object" && e !== null && !(e instanceof Error)) {
+            const m = e.message;
+            if (typeof m === "string" && m !== "")
+                return m;
+        }
+    }
+    catch {
     }
-    return String(e);
+    return thrownText(e);
 }
 async function resolveBaseCommit(env, repoRoot, baseRef) {
     const rev = async (ref) => {
@@ -147,7 +150,7 @@ export function createWorktreeTools(env, opts) {
             try {
                 const probe = await env.exec("git rev-parse --is-inside-work-tree", { cwd: repoRoot });
                 if (!probe.ok || probe.value.exitCode !== 0) {
-                    const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : String(probe.error);
+                    const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : thrownText(probe.error);
                     return errorResult(`Error (EnterWorktree): the working directory ${repoRoot} is not a git repository` +
                         `${detail ? ` (${detail})` : ""}. This deployment has no VCS-agnostic worktree extension point, ` +
                         "so worktree isolation is unavailable here.");
@@ -214,7 +217,7 @@ export function createWorktreeTools(env, opts) {
                     createdDir = worktreeDir;
                 }
                 catch (e) {
-                    return errorResult(`Error (EnterWorktree): ${e instanceof Error ? e.message : String(e)}`);
+                    return errorResult(`Error (EnterWorktree): ${thrownText(e)}`);
                 }
                 session.current = {
                     worktreeDir: createdDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.23.1",
+  "version": "7.23.3",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -70,6 +70,7 @@
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
     "gate:debts": "node scripts/verify-debts.mjs",
     "handoff:diff": "node scripts/dist-handoff-diff.mjs",
+    "post-ship": "node scripts/post-ship.mjs",
     "gate:debts:rc": "node scripts/verify-debts.mjs --rc-gate",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
     "gate:criteria": "node scripts/criteria-lint.mjs",

package/wire-changes/core@7.23.2.json

@@ -0,0 +1,42 @@
+{
+  "repo": "core",
+  "version": "7.23.2",
+  "from": "e9bf8451c623a118a6589a6f860bd7b828c3aa3e",
+  "to": "v7.23.2",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "ReversibilityVerdict",
+      "at": [
+        "src/core/tool-spec.ts:50"
+      ],
+      "added": [
+        "boundaryDeclined"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [
+      "ReversibilityVerdict"
+    ],
+    "server": [
+      "ReversibilityVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@8dd52617 server@7d768b71 sdk@3b02abb — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "cb5240a4a8289d28ed37ef84df8ee1bfb2139905"
+}

package/wire-changes/core@7.23.3.json

@@ -0,0 +1,25 @@
+{
+  "repo": "core",
+  "version": "7.23.3",
+  "from": "b48d37a658cfaa46695e76339021dc1226a9ba57",
+  "to": "v7.23.3",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@bef85633 server@1da4e102 sdk@0a6aeb7 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "912d7792e95edd36fb9b6bb68866661ac36f7f6a"
+}