@sema-agent/core 7.26.2 → 7.27.0

package/dist/tools/fs/dead-cwd.js

@@ -0,0 +1,56 @@
+function errorMeansDead(code) {
+    return code === "not_found" || code === "not_directory";
+}
+function resolutionFailureMeansDead(code) {
+    return errorMeansDead(code) || code === "unknown";
+}
+function cancelled(signal) {
+    return signal?.aborted === true;
+}
+export async function isDeadCwd(env, dir, signal) {
+    const info = await env.fileInfo(dir, signal);
+    if (!info.ok) {
+        if (info.error.code !== "unknown")
+            return errorMeansDead(info.error.code);
+        const resolved = await env.canonicalPath(dir, signal);
+        return !resolved.ok && resolutionFailureMeansDead(resolved.error.code);
+    }
+    if (info.value.kind === "directory")
+        return false;
+    if (info.value.kind !== "symlink")
+        return true;
+    const target = await env.canonicalPath(dir, signal);
+    if (!target.ok)
+        return resolutionFailureMeansDead(target.error.code);
+    const followed = await env.fileInfo(target.value, signal);
+    if (!followed.ok)
+        return errorMeansDead(followed.error.code);
+    return followed.value.kind !== "directory" && followed.value.kind !== "symlink";
+}
+export async function diagnoseDeadCwd(env, toolName, effectiveCwd, root, cwdRef, signal) {
+    if (!(await isDeadCwd(env, effectiveCwd, signal)))
+        return undefined;
+    if (cancelled(signal))
+        return undefined;
+    if (root === undefined) {
+        return (`Error (${toolName}): command did not run — the working directory no longer exists (or is no longer a directory): ${effectiveCwd} ` +
+            `(it was likely deleted or replaced by a previous command). No reset target is known to this tool; ` +
+            "re-establish the working directory with a Bash `cd` to a live directory and retry.");
+    }
+    if (cwdRef && cwdRef.current !== root) {
+        const rootAlive = !(await isDeadCwd(env, root, signal));
+        if (cancelled(signal))
+            return undefined;
+        if (rootAlive) {
+            cwdRef.current = root;
+            return (`Error (${toolName}): command did not run — the working directory no longer exists (or is no longer a directory): ${effectiveCwd}\n` +
+                `(it was likely deleted or replaced by a previous command). The working directory has been reset to ${root}; ` +
+                `re-run your command (cd first if you need a different directory).`);
+        }
+        return (`Error (${toolName}): command did not run — the working directory ${effectiveCwd} AND the task root ${root} no longer exist. ` +
+            `The shell has no usable directory to run in; this task cannot recover its working tree.`);
+    }
+    return (`Error (${toolName}): command did not run — the task root directory no longer exists (or is no longer a directory): ${effectiveCwd}. ` +
+        `It was likely deleted by a previous command (e.g. rm -rf on the current directory). There is no directory to reset to; ` +
+        `this task cannot recover its working tree.`);
+}

package/dist/tools/fs/fs-bash.js

@@ -9,6 +9,7 @@ import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, withinAnyRoot } from "./safety.js";
+import { isDeadCwd, diagnoseDeadCwd } from "./dead-cwd.js";
 import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, } from "./fs-shared.js";
@@ -98,35 +99,6 @@ function dataUriImageFromStdout(stdout) {
     }
     return undefined;
 }
-async function isDeadCwd(env, dir) {
-    const info = await env.fileInfo(dir);
-    if (!info.ok)
-        return info.error.code === "not_found";
-    if (info.value.kind === "directory")
-        return false;
-    if (info.value.kind === "symlink") {
-        const target = await env.canonicalPath(dir);
-        return !target.ok;
-    }
-    return true;
-}
-async function diagnoseDeadCwd(env, toolName, effectiveCwd, root, cwdRef) {
-    if (!(await isDeadCwd(env, effectiveCwd)))
-        return undefined;
-    if (cwdRef && cwdRef.current !== root) {
-        if (!(await isDeadCwd(env, root))) {
-            cwdRef.current = root;
-            return (`Error (${toolName}): command did not run — the working directory no longer exists (or is no longer a directory): ${effectiveCwd}\n` +
-                `(it was likely deleted or replaced by a previous command). The working directory has been reset to ${root}; ` +
-                `re-run your command (cd first if you need a different directory).`);
-        }
-        return (`Error (${toolName}): command did not run — the working directory ${effectiveCwd} AND the task root ${root} no longer exist. ` +
-            `The shell has no usable directory to run in; this task cannot recover its working tree.`);
-    }
-    return (`Error (${toolName}): command did not run — the task root directory no longer exists (or is no longer a directory): ${effectiveCwd}. ` +
-        `It was likely deleted by a previous command (e.g. rm -rf on the current directory). There is no directory to reset to; ` +
-        `this task cannot recover its working tree.`);
-}
 const AUTO_BACKGROUND_BLOCKED_FIRST_WORDS = new Set(["sleep"]);
 function stripAutoBackgroundWrapperPrefixes(segment) {
     let s = segment.trim();
@@ -371,7 +343,7 @@ async function runShell(env, cwd, toolName, command, timeoutSec, caps, signal, c
     }
     if (!res.ok) {
         if (res.error.code === "spawn_error" || res.error.code === "shell_unavailable") {
-            const diagnosis = await diagnoseDeadCwd(env, toolName, effectiveCwd, cwd, cwdRef);
+            const diagnosis = await diagnoseDeadCwd(env, toolName, effectiveCwd, cwd, cwdRef, signal);
             throw new Error(diagnosis ?? `Error (${toolName}): command did not run (${res.error.code}): ${res.error.message}`);
         }
         if (res.error.code === "transport_lost") {
@@ -656,8 +628,8 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                 if (!hasBackgroundShell(env)) {
                     return errorResult("Error (Bash): this environment does not support background processes (run_in_background).");
                 }
-                if (cwdRef && (await isDeadCwd(env, cwdRef.current))) {
-                    const diagnosis = await diagnoseDeadCwd(env, "Bash", cwdRef.current, rootCanonical, cwdRef);
+                if (cwdRef && (await isDeadCwd(env, cwdRef.current, ctx.signal))) {
+                    const diagnosis = await diagnoseDeadCwd(env, "Bash", cwdRef.current, rootCanonical, cwdRef, ctx.signal);
                     if (diagnosis !== undefined)
                         throw new Error(diagnosis);
                 }

package/dist/tools/monitor.d.ts

@@ -78,5 +78,9 @@ export interface MonitorToolOptions {
      *  could only see the env lane, so a deployment retaining per spec still got the "session ends it"
      *  wording in the persistent-watch receipt. Purely a RECEIPT input — enforcement stays at the sweep. */
     retainBackgroundProcesses?: boolean;
+    /** The task root in the SAME canonical spelling `createBashTool` is built with, so a dead-cwd self-heal
+     *  lands both tools on one directory. Absent ⇒ the diagnosis says it has no reset target, rather than
+     *  naming the cwd "the task root" or promising a recovery it cannot make. */
+    rootCanonical?: string;
 }
 export declare function createMonitorTool(env: ExecutionEnv, opts: MonitorToolOptions): AgentTool;

package/dist/tools/monitor.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { hasBackgroundShell } from "../core/background-shell.js";
 import { MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, } from "../core/task-registry.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { isDeadCwd, diagnoseDeadCwd } from "./fs/dead-cwd.js";
 import { thrownText } from "../core/thrown-value.js";
 const MONITOR_DESCRIPTION = "Run a shell command in the background and watch its stdout as a stream of events.\n" +
     "\n" +
@@ -71,6 +72,11 @@ export function createMonitorTool(env, opts) {
             const refused = await opts.shellReadAdmission?.("Monitor", ctx.toolCallId, command, ctx.signal);
             if (refused !== undefined)
                 return refused;
+            if (opts.cwdRef !== undefined && (await isDeadCwd(env, opts.cwdRef.current, ctx.signal))) {
+                const diagnosis = await diagnoseDeadCwd(env, "Monitor", opts.cwdRef.current, opts.rootCanonical, opts.cwdRef, ctx.signal);
+                if (diagnosis !== undefined)
+                    return errorResult(diagnosis);
+            }
             if (ctx.signal?.aborted === true)
                 return errorResult("Error (Monitor): the call was cancelled before the watch started.");
             const spawn = await env.spawnBackground(command, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.26.2",
+  "version": "7.27.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2449,
+  "count": 2450,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -84,6 +84,7 @@
     "AggregateBudgetOptions": "interface",
     "AnthropicBrainConfig": "interface",
     "AppendLog": "class",
+    "ApprovalSeatOutcome": "type",
     "ApproverPosture": "type",
     "ArtifactAction": "type",
     "ArtifactCallContext": "interface",
@@ -2535,6 +2536,7 @@
     "AggregateBudgetOptions": "advanced",
     "AnthropicBrainConfig": "advanced",
     "AppendLog": "advanced",
+    "ApprovalSeatOutcome": "advanced",
     "ApproverPosture": "advanced",
     "ArtifactAction": "advanced",
     "ArtifactCallContext": "advanced",

package/wire-changes/core@7.26.3.json

@@ -0,0 +1,65 @@
+{
+  "repo": "core",
+  "version": "7.26.3",
+  "from": "f41acbdc6dace7426c1a4dafa1a9c184d010cdb7",
+  "to": "v7.26.3",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1018, P3, Monitor tool — user-visible): the watch tool probes the tracked working directory before it spawns, through the same probe and diagnosis the shell's legs use (`src/tools/fs/dead-cwd.ts`, one mint). A dead cwd (gone / replaced by a file / standing under a file / a symlink that does not resolve to a directory) refuses loudly with the shell's dead-cwd sentence and, when the task root is alive, resets the tracked cwd to the root (self-heal, same as Bash); a mount that was handed no root says it has no reset target. `MonitorToolOptions.rootCanonical?` (additive) carries the root in the same canonical spelling `createBashTool` receives; `prepareTask` wires it. Two probe shapes got truthful on BOTH legs: an ENOTDIR-class probe error and a symlink retargeted at a file now count as dead."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "MonitorToolOptions",
+      "at": [
+        "src/tools/monitor.ts:61"
+      ],
+      "added": [
+        "rootCanonical"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 212,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "MonitorToolOptions.rootCanonical",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunInternals.inheritedGate",
+      "assertions": [
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "MonitorToolOptions"
+    ],
+    "server": [
+      "MonitorToolOptions"
+    ],
+    "sdk": [],
+    "note": "scanned cli@7ea76c7c server@bcf41646 sdk@2bff51e — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "ee393c7d629f3ae8a2f3dbd906441aab40c31cd1"
+}

package/wire-changes/core@7.27.0.json

@@ -0,0 +1,152 @@
+{
+  "repo": "core",
+  "version": "7.27.0",
+  "from": "e90527d7630a7098366f7843b8aae7346ea0a07c",
+  "to": "v7.27.0",
+  "added": [
+    {
+      "name": "ApprovalSeatOutcome",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/tool-policy.ts:1318",
+        "src/index.ts:1345"
+      ],
+      "criteriaCovered": true,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1019, P2, approval face — durable): the auto-mode classifier's denial-limit fallback, when PARKED durably and then settled by nobody (a policy refusal, or no approver), stops the leg with `classifier.denial_limit` exactly as the synchronous station does — the deny stands as the call's result, the stop ends the leg; a person's refusal on the same park does NOT stop (one table, `SETTLEMENT_NOBODY_JUDGED`, both stations)."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1002 ①, C-R80, prompt face): the engine-minted approval-posture directive is EXCLUSIVE, bypass first — a run declaring both `autoModeRequested` and `approverPosture:\"bypass\"` receives the bypass segment alone (CC 2.1.259 `case\"auto_mode\"` arm order); single-seat runs are byte-unchanged. Cross-leg coexistence of two segments (a later leg adding the bypass seat after an auto-only leg already stated auto) is unchanged and recorded as KL-1002c."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1013, P2, file stores): every JSONL read-back judges the record's SHAPE — a line that parses but is not an object (`123`, `\"str\"`, `null`, `[1]`) is disclosed once through the store's corrupt-read seat with a `CORRUPT_BODY_FORMS` word and skipped, never handed to a consumer; the eight roster faces of `storeReadBackShapeContract` are bound; every tolerant file store has one disclosure seat (one shared guard, sync throw and async rejection both contained); an artifact-ledger idempotency-replay record with a bad shape is refused at the ledger door; the permission-rule adoption marker is judged per arm."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "FileBackgroundAgentStoreOptions",
+      "at": [
+        "src/stores/file/background-agent-store.ts:43"
+      ],
+      "added": [
+        "onCorruptRead"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "FileCheckpointStoreOptions",
+      "at": [
+        "src/stores/file/checkpoint-store.ts:86"
+      ],
+      "added": [
+        "onCorruptRead"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "FileWorkflowRunStoreOptions",
+      "at": [
+        "src/stores/file/workflow-run-store.ts:47"
+      ],
+      "added": [
+        "onCorruptRead"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "Prepared",
+      "at": [
+        "src/core/runner/contracts.ts:231"
+      ],
+      "via": "Runner.SuspendReap.env",
+      "added": [
+        "stopForDenialLimit"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 212,
+  "declarationMoves": [
+    {
+      "name": "StopForDenialLimit",
+      "kind": null,
+      "onSurface": false,
+      "from": [
+        "src/core/runner/denial-limit-arms.ts"
+      ],
+      "to": [
+        "src/core/runner/contracts.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ApprovalSeatOutcome.settledBy",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "FileMailboxStoreOptions.onCorruptRead",
+      "assertions": [
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.approverPosture",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "Prepared"
+    ],
+    "server": [
+      "FileBackgroundAgentStoreOptions",
+      "FileCheckpointStoreOptions",
+      "FileWorkflowRunStoreOptions"
+    ],
+    "sdk": [],
+    "note": "scanned cli@17a6b331 server@73a73469 sdk@bfb4fd0 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "bc100bca1f15c0658cc4d0f615bb31aca7027c0b"
+}