@sema-agent/core 7.3.0 → 7.4.0

package/dist/core/runner/denial-limit-arms.js

@@ -0,0 +1,91 @@
+import { createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence } from "../auto-mode.js";
+import { deliverEngineNotice } from "../types.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+export function attachRebuiltDenialTrackers(entries, denialLimit) {
+    const rebuiltTrackers = new Map();
+    const trackerForRebuilt = (decider) => {
+        let t = rebuiltTrackers.get(decider);
+        if (t === undefined) {
+            t = createAutoModeDenialTracker(denialLimit);
+            rebuiltTrackers.set(decider, t);
+        }
+        return t;
+    };
+    return entries?.map((pc) => pc.autoMode !== undefined && pc.autoMode.denialTracking === undefined
+        ? { ...pc, autoMode: { ...pc.autoMode, denialTracking: trackerForRebuilt(pc.autoMode.decider) } }
+        : pc);
+}
+export function createDenialLimitStop(opts) {
+    const gateStopRef = {};
+    const stopForDenialLimit = (info) => {
+        if (gateStopRef.terminal !== undefined)
+            return;
+        const message = `too many classifier denials in headless mode — ${denialLimitSentence(info.fallback)} The run was stopped: ` +
+            `the auto-mode classifier's denial limit falls back to a person, and no approver is wired to fall back to ` +
+            `(latest blocked action: "${info.toolName}").`;
+        const terminal = Object.assign(new Error(message), { code: "classifier.denial_limit" });
+        gateStopRef.terminal = terminal;
+        deliverEngineNotice(opts.onNotice, {
+            code: "classifier.denial_limit",
+            message,
+            detail: { sessionId: opts.sessionId, runId: opts.runId, toolName: info.toolName, toolCallId: info.toolCallId, consecutive: info.fallback.consecutive, total: info.fallback.total, limit: info.fallback.limit },
+        });
+        opts.abort();
+    };
+    return { gateStopRef, stopForDenialLimit };
+}
+export function frozenClassifierExcluded(d) {
+    return d.decisionReason === "hook" || d.matchedAskRule !== undefined || d.denialLimitFallback !== undefined;
+}
+export async function judgeInheritedClassifier(opts) {
+    const { autoMode, ask, req } = opts;
+    if (autoMode === undefined || frozenClassifierExcluded(ask))
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false };
+    const verdict = await autoMode.decider
+        .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
+        .catch(() => ({ kind: "unavailable", cause: "error" }));
+    if (verdict.kind === "allow") {
+        autoMode.denialTracking?.recordAllow();
+        return { kind: "allow" };
+    }
+    if (verdict.kind !== "block")
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false };
+    const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+    const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+    const tracked = autoMode.denialTracking?.recordBlock();
+    if (tracked?.limitReached !== true) {
+        return {
+            kind: "deny",
+            result: {
+                action: "deny",
+                message: `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                decisionReason: "classifier",
+            },
+        };
+    }
+    const fallback = tracked.fallback;
+    return {
+        kind: "resolve",
+        ask: { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback },
+        fallback,
+        mintedHere: true,
+    };
+}
+export function headlessDenyAtFold(r) {
+    return r.resolution === "no_approver" || r.resolution === "blanket_allow_refused";
+}
+export function headlessDenyAtRecheck(r) {
+    return headlessDenyAtFold(r) || r.resolution === "approver_unavailable" || r.approverUnavailable === true;
+}
+export function settleDenialLimitFallback(opts) {
+    const { fallback, resolved } = opts;
+    if (fallback === undefined)
+        return;
+    if (resolved.action === "allow") {
+        if (opts.mintedHere)
+            opts.tracker?.recordAllow();
+    }
+    else if (resolved.action === "deny" && opts.headless(resolved)) {
+        opts.stop({ toolName: opts.toolName, toolCallId: opts.toolCallId, fallback });
+    }
+}

package/dist/core/runner/edited-files-ledger.d.ts

@@ -0,0 +1,33 @@
+import type { FileEditedHook, TaskResult } from "../types.js";
+/** The ceiling on DISTINCT FILES in a run's edited-file ledger (`TaskResult.editedFiles`). A result
+ *  seat must be bounded by something other than how long the model keeps going; a single host-side
+ *  user message that touches a thousand distinct files is already past what that observation is for.
+ *  Far above the delegated-child projection's own cap, which bounds a NOTIFICATION preview rather
+ *  than a per-message ledger — different job, different ceiling. The field's contract states this
+ *  number and the saturation behaviour, so a consumer can tell a full list from a clipped one. */
+export declare const RUN_EDITED_FILES_CAP = 1000;
+/** A run's OWN edited-file ledger — the observation behind `TaskResult.editedFiles`. */
+export interface EditedFilesLedger {
+    /** The hands band's post-write seat feeds this (the other end of the same mutation lane the
+     *  first-touch hook sits at). */
+    note: FileEditedHook;
+    /** The read face: the ledger as `TaskResult.editedFiles`, or `undefined` when this run's hands
+     *  landed nothing (the key is ABSENT then, never an empty array). A LIVE reader, read at result
+     *  assembly — so the throw-path backstop terminal sees the same ledger the ordinary assembly does. */
+    snapshot: () => TaskResult["editedFiles"];
+}
+/**
+ * Build the ledger. Built UNCONDITIONALLY by prepare — unlike the first-touch history hook, which
+ * exists only when a history store is wired, this answers "what did this run change", a fact about
+ * the run and not about the store. Insertion order = order of first edit; the cap keeps a result seat
+ * bounded by something other than the model's persistence (past it, listed paths keep counting and
+ * new ones are dropped — see the field's own contract).
+ *
+ * Identity is the CANONICAL key, display is the model's own spelling. The two differ, and both halves
+ * matter: the band resolves a relative argument against the LIVE cwd, so one spelling can name two
+ * different files across a `cd` (keying on the spelling would merge them and drop a real file from
+ * the ledger), and two spellings can name one file (keying on the spelling would split one file into
+ * two rows). The first spelling that reached a given file is what the row shows — the coordinate the
+ * transcript used, which is the seat's stated path form.
+ */
+export declare function createEditedFilesLedger(cap?: number): EditedFilesLedger;

package/dist/core/runner/edited-files-ledger.js

@@ -0,0 +1,14 @@
+export const RUN_EDITED_FILES_CAP = 1000;
+export function createEditedFilesLedger(cap = RUN_EDITED_FILES_CAP) {
+    const counts = new Map();
+    return {
+        note: (n) => {
+            const seen = counts.get(n.key);
+            if (seen !== undefined)
+                seen.edits += 1;
+            else if (counts.size < cap)
+                counts.set(n.key, { path: n.path, edits: 1 });
+        },
+        snapshot: () => (counts.size > 0 ? [...counts.values()].map(({ path, edits }) => ({ path, edits })) : undefined),
+    };
+}

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -204,6 +204,11 @@ export interface PrepareHandsReadFaceInput {
     /** design/381 — the first-touch history hook prepare built (present iff a fileHistoryStore is
      *  wired and the run mounts a real fs env); threaded to the write band's trackFileEdit seat. */
     trackFileEdit?: import("../types.js").TrackFileEditHook;
+    /** borrowed — the mutation lane's LANDED observation seat (the accumulator behind
+     *  `TaskResult.editedFiles`); threaded to the write band's onFileEdited seat. Unlike
+     *  `trackFileEdit` it does NOT depend on a wired history store: it observes what this run's hands
+     *  did, so it is present on every run that mounts the band. */
+    onFileEdited?: import("../types.js").FileEditedHook;
 }
 /** The phase's outputs (相 API 规则件 four-class form) — ALL settled before the return; the driver
  *  binds them as fresh consts (R-5) except the inverted-closure trio and the two shellGated bits,

package/dist/core/runner/prepare-hands-readface.js

@@ -313,6 +313,7 @@ export async function prepareHandsMount(input) {
             reminderMark: input.reminderMark,
             reminderDisclosureCounts: input.reminderDisclosureCounts,
             ...(input.trackFileEdit !== undefined ? { trackFileEdit: input.trackFileEdit } : {}),
+            ...(input.onFileEdited !== undefined ? { onFileEdited: input.onFileEdited } : {}),
             includeShell: handsIncludeShell,
             readOnly: handsReadOnly,
             ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),

package/dist/core/runner/prepare-task.d.ts

@@ -1,7 +1,7 @@
 import { AgentHarness, type ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import { type CompactionForkContext } from "../auto-compaction.js";
-import { type AutoModeDecider } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type MaterializedMcp } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
@@ -214,6 +214,24 @@ export interface FileHistoryBoundarySeat {
     begin(entryId: string): void;
     settle(): Promise<void>;
 }
+/** The ONE reading of {@link RunInternals.fileHistoryLineage} (see {@link resolveFileHistoryCoordinates}):
+ *  the lineage's scope iff BOTH tree coordinates match; otherwise the run's own session. */
+export declare function resolveFileHistoryScope(lineage: RunInternals["fileHistoryLineage"], historyRoot: string, historyFs: string, sessionId: string): string;
+/**
+ * WHICH filesystem an env is a view of — the second coordinate of tree identity for the file-history
+ * lineage, read from what the env's MINTER states rather than inferred from a path:
+ *  · a remote workspace names itself through its {@link WorkspaceHandle} (provider + sandbox, and the
+ *    device lane's id when stamped) — two runs on one sandbox share a tree, two sandboxes never do;
+ *  · an env that DECLARES its paths host-local (`hostLocalPaths: true`), or is the host adapter itself
+ *    (a {@link NodeExecutionEnv}, which the #211 seam names as the host-local default), is the
+ *    control-plane host's filesystem — every such env is one tree;
+ *  · anything else — an env declaring `hostLocalPaths: false`, or an undeclared custom adapter — is
+ *    attested to nothing, so it is its OWN tree: a per-instance token, which still matches when the
+ *    child literally holds the parent's env object and never matches a fresh per-task mint.
+ * A remote handle that cannot be read (an env not yet connected) falls to the per-instance arm for
+ * the same reason: unattested is not shared.
+ */
+export declare function fileHistoryFilesystemIdentity(env: ExecutionEnv): string;
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -320,6 +338,11 @@ export interface Prepared {
     /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file
      *  env), echoed verbatim onto `TaskResult.rewindNotes`. Present only when there is something to say. */
     rewindNotes?: NonNullable<TaskResult["rewindNotes"]>;
+    /** The run's edited-file ledger read face — what its OWN hands landed, as `TaskResult.editedFiles`
+     *  (undefined when nothing landed: the key is absent, never an empty array). A LIVE reader rather
+     *  than a snapshot, so the throw-path backstop terminal reports the same ledger the ordinary
+     *  assembly would. Always present on Prepared; independent of whether a fileHistoryStore is wired. */
+    editedFilesSnapshot: () => TaskResult["editedFiles"];
     /** design/381 — the run's turn-start boundary seat (present iff a fileHistoryStore is wired and
      *  the run mounts a real fs env). runtask calls begin() at the first committed user entry and
      *  awaits settle() at the lease close + the finish tail. */
@@ -725,6 +748,19 @@ export interface Prepared {
      *  the task the typed terminal — the harness turns a loop throw into an error assistant message, so
      *  without this the cause would reach the caller only as the generic `provider.error`. */
     brainCallGuardrailRef: BrainCallGuardrailRef;
+    /**
+     * #548 — the tool gate's own TYPED STOP: set (once) when the classifier denial limit was reached with
+     * no approver to fall back to (headless), together with the run abort. The run loop adopts it as the
+     * terminal `threw` (`TaskResult.errorCode` = the error's `code`, `errorMessage` = its sentence) the
+     * same way it adopts the brain-call guardrail's — a loop that ended because THIS lane aborted it must
+     * report the cause, not the consequence. The abort-result details seam reads it too, so the aborted
+     * call's own `tool_end` carries the code. `undefined` ⇒ no gate stop happened.
+     */
+    gateStopRef: {
+        terminal?: Error & {
+            code: string;
+        };
+    };
     /** design/80 D-B — set by a tool calling `ctx.requestReview()` (the first-party `present_plan` tool, CC
      *  ExitPlanMode parity): the run loop honors it at the next CLEAN turn boundary by minting a `plan_review`
      *  checkpoint. `{ pending }` is set (with an optional reason) the moment a tool requests review; the boundary
@@ -1269,6 +1305,13 @@ export interface InheritedGate {
          */
         autoMode?: {
             decider: AutoModeDecider;
+            /**
+             * #548 — the ancestor's per-run DENIAL-LIMIT tracker, frozen beside its decider (same owner). The
+             * wrapper arms count the frozen classifier's blocks on it and, at a bound, resolve the fallback
+             * ask at the frozen approver instead of denying (`requiresRealApproval` set, sandbox admission
+             * excluded). Live-only, like the decider: a cross-process redemption starts a fresh count.
+             */
+            denialTracking?: AutoModeDenialTracker;
             /**
              * #503 — the SERIALIZABLE criteria half of this classifier (assembly inputs + knobs + the
              * deployment's settings epoch), present when the arming deployment opted in
@@ -1801,6 +1844,24 @@ export interface RunInternals {
      * parent's cwd instead of an empty per-task sandbox. `isolation: "worktree"` wins over this when both set.
      */
     parentCwd?: string;
+    /**
+     * The spawning run's file-history LINEAGE — the scope it records first-touch edits into and the
+     * TREE those records' keys are minted against (the canonical root spelling + the filesystem
+     * identity of {@link fileHistoryFilesystemIdentity}) — threaded VERBATIM by core delegation
+     * callers from {@link import("../types.js").ToolExecuteContext.fileHistoryLineage} (NEVER a
+     * {@link TaskSpec} field). {@link resolveFileHistoryScope} is the ONE reading: this run records
+     * into the lineage's scope iff its own tree coordinates BOTH equal the lineage's, and then
+     * re-exposes the SAME triple on its own ctx, so every same-tree descendant of a root session — at
+     * any depth — lands in the root session's scope (the fixed point), while a descendant on another
+     * tree (worktree isolation, explicit `cwd`, a fresh per-task sandbox) becomes the root of its own
+     * subtree's history. Absent on a top-level run, on a run with no live history store, and on a
+     * tier-3 revival (the reviver's lineage says nothing about the revived row's tree).
+     */
+    fileHistoryLineage?: {
+        scope: string;
+        root: string;
+        fs: string;
+    };
     /**
      * [c209-D] — the EXPLICIT Agent.cwd request, distinct from the best-effort `parentCwd`
      * inheritance hint above: inheritance may be silently ignored by a factory (or absent without one),