@sema-agent/core 7.35.0 → 7.35.1

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 7.35.1 — 2026-09-29
+
+### A run that named no session holds the session its store minted — a second run on that id waits for it (#1206; behavior (tighten: a second run of a new session queues); +0 exports, +0 wire keys; +1 engine-invariant code `internal.session_lock_second_id` that no engine path reaches) (@server @test)
+
+- **Before (v7.35.0).** A run that named its session (`TaskSpec.sessionId`) took the Runner's session lock before its prepare; a run that named none took no lock. Its session store minted the id inside prepare, and the id reached other callers through the run's tool contexts and events, so a second run started on it ran beside the first. Run A (`bypassPermissions`, a new session) spawned a child and was still running, or was cancelled with its tool pending; run B (`plan`) started on A's session id reached its first tool at once, and the child's ceiling kept answering A's `bypassPermissions` while B ran (KL-1192-c). Not a regression: v7.34.0's child held A's controller for life.
+- **Now (one lock rule).** Every run holds ONE session lock from the moment it knows the session id to the run's end, decided by one read of the spec. A session the spec names is locked before prepare (unchanged). For a spec that names none, prepare takes the lock the moment the store mints the id. It is the same lock, released at the same place. Asking a run's hold again for the same id returns the same hold; asking it for another id is refused by name (`internal.session_lock_second_id`, an engine invariant no engine path reaches) rather than taking a second lock over the first. A second run on a minted id queues behind the first exactly as it does behind a named session; once the first run stops, the second enters, and a child of the first then follows it (`plan` refuses the child's write). Runs on different sessions are not serialized. The child ceiling rule (#1192) is unchanged.
+- **Timing.** Measured on a prepare refusal: a run that named no session settles four microtasks later (46 → 50: the lock's await on the prepare path); a run naming its session reaches prepare two microtasks later (56 → 58: the hold's own step before the lock).
+- **Who is hurt.** A caller that starts a second run on a new session's id while the first still runs sees that run start after the first ends: the order changes, not the outcome. The exception is a caller tool that starts a run on its OWN run's session id and awaits it: that now waits forever, as it already did for a run that named its session (no engine path does this). A probe that pinned the old overlap (two runs of one session side by side because the first named no session) goes red; rewrite it to expect the second run to queue, as the re-pinned cells below do. The lock is per Runner instance, so two Runners over one session store are not serialized, as for a named session. A caller that reads the freshly minted id off the store (`TtlSessionStore.list()`) and starts a run on it before the first run's prepare took the lock runs first; the first then queues behind it — the order is reversed and nothing waits forever (KL-1206).
+- Pins: `test/backlog1206-new-session-lock.test.ts` ①–⑧, on a real Runner:
+  - ① / ② the second run queues behind a new-session run that was cancelled with its tool pending, or is still running. The reading is the named-session one, and the child then follows the second run's `plan`.
+  - ③ / ④ controls.
+  - ⑤ the lock is released on a prepare throw after the mint and on an abort.
+  - ⑥ tripwire for the retired shape: the second run's prepare does not begin while the first run runs, however the first got its session.
+  - ⑦ / ⑧ one decision per run: a `sessionId` inherited through the prototype chain, which the plan-mode rebind drops, with the run refused after prepare acquired, releases the named session's lock (the next run on it enters); a caller clearing its `sessionId` while the store's acquire is pending does not wait on its own lock and runs on the session it acquired. v7.35.0 green; the first cut of this fix red (it held twice and overwrote the first release, or waited on its own lock).
+
+  `test/backlog1206-session-lock-one-hold.test.ts` ⑨ / ⑩ (the lane's hold verb reached where prepare receives it): the same id again is the same hold, another id is refused by `internal.session_lock_second_id` and the first lock is still released at the run's end; a spec naming its session hands prepare no hold verb.
+
+  Re-pinned where the old overlap was the setup:
+  - `backlog1192-session-mode-seat` C1 / C3: the second run queues, and the child keeps the running leg's `plan`; `wrote` is 0 as before.
+  - `backlog744-notification-session-routing`, the two overlapping-run cells: the second run waits, the frame the idle first run cannot take parks, and a same-key retry folds on the producer's lane. The waiting run's turn-open carries it once.
+  - `design393-s6-run-leg-lanes`: rejection depth 46 → 50, because the lock's await is on the prepare path.
+
+  Mutations:
+  - D950, a new session is not locked: ①, ②, ⑥, C1, C3 and the rejection depth go red.
+  - D951, the minted lock is never released: ①, ②, ③, ⑤, ⑥, ⑨ go red.
+  - D952, the lock is released only when the run body resolves: ⑤ and ⑦ go red.
+  - D953, every minted session locks one shared key: control ④ goes red.
+  - D955, the hold keeps no owner: ⑨ goes red.
+  - D956, prepare is handed the hold for a named session too: ⑦ and ⑩ go red.
+  - The first cut of this fix (a second decision in prepare): ⑦, ⑧, ⑨ and ⑩ go red.
+
+  Known limits: KL-1192-c closed; KL-1206 (the mint-to-lock window).
+
 ## 7.35.0 — 2026-09-29
 
 **Hard-breaking changes — the whole release in three sentences.**

package/dist/core/runner/contracts.d.ts

@@ -2771,7 +2771,7 @@ export interface RunnerSelfSeat {
  */
 export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
     runId?: string;
-}) => Promise<Prepared>;
+}, holdSessionLock?: (sessionId: string) => Promise<void>) => Promise<Prepared>;
 /**
  * The Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
  * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed

package/dist/core/runner/prepare-task.d.ts

@@ -113,7 +113,9 @@ runnerSelf?: RunnerSelfSeat,
  *  shape the Runner uses for the generated taskId/sessionId. */
 runIdSink?: {
     runId?: string;
-}): Promise<Prepared>;
+}, 
+/** The Runner's lock on this leg's session, handed only when the spec named none: taken the moment the store mints the id. */
+holdSessionLock?: (sessionId: string) => Promise<void>): Promise<Prepared>;
 /** The entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
  *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability:
  *  the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —

package/dist/core/runner/prepare-task.js

@@ -282,7 +282,7 @@ function refusePermissionModeDoors(spec) {
     }
     return mode;
 }
-export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink) {
+export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink, holdSessionLock) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
         runIdSink.runId = runId;
@@ -308,6 +308,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const fileHistoryRequest = resolveFileHistoryRequest(spec, deps);
     const { acquired, session, conflictRef, wakeRecovered } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
+    await holdSessionLock?.(sessionId);
     const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);

package/dist/core/runner/run-notification-lane.d.ts

@@ -17,6 +17,8 @@ export interface RunNotificationLaneInput<R> {
     internals: RunInternals | undefined;
     /** borrowed-mutable — the stream layer's backstop carrier, handed to prepare so a prepare THROW still names its run. */
     taskIdRef: TaskIdRef | undefined;
+    /** borrowed-readonly — the stream layer's session-lock verb, handed to prepare; absent when the spec named its session. */
+    holdSessionLock: ((sessionId: string) => Promise<void>) | undefined;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError` in the park closure — after the run, on a swapped
      *  catalog it is still the CURRENT sink; `models` and prepare's `deps` at the natural-snapshot pin); the one home of why it
      *  is a seat and not a captured object is {@link RunnerDepsSeat}. */

package/dist/core/runner/run-notification-lane.js

@@ -8,7 +8,7 @@ export function runNotificationLane(input) {
     return obligations.run(() => runNotificationLaneAs(input, obligations));
 }
 async function runNotificationLaneAs(input, obligations) {
-    const { spec, queue, resume, internals, taskIdRef, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
+    const { spec, queue, resume, internals, taskIdRef, holdSessionLock, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
     const prepareResume = resume
         ? {
             leafId: resume.cp.leafId,
@@ -127,7 +127,7 @@ async function runNotificationLaneAs(input, obligations) {
             }
             return injectTaskNotification(notification, opts);
         },
-    }, self, taskIdRef);
+    }, self, taskIdRef, holdSessionLock);
     pendingSessionNotifications.bindSessionBox(prepared.sessionId, prepared.sessionBox);
     const notificationLane = {
         get harness() { return notificationHarness; }, set harness(h) { notificationHarness = h; },

package/dist/core/runner/runtask.d.ts

@@ -94,7 +94,8 @@ export declare class Runner implements RunnerSelfSeat {
         toolPolicy?: RunnerDeps["toolPolicy"];
         hooks?: RunnerDeps["hooks"];
     };
-    /** Acquire the lock for a sessionId; returns a release fn. New (undefined) sessions need no lock. */
+    /** Acquire the lock for a sessionId; returns a release fn. The one lock every leg holds on its session, from the moment it
+     *  knows the id to the leg's end (through `holdSessionLock` in `runTaskStream`, one per leg). */
     private acquireSessionLock;
     /**
      * Hot-swap the deployment seats a running Runner may change without a restart — the ONE door for every

package/dist/core/runner/runtask.js

@@ -330,14 +330,24 @@ export class Runner {
         };
         const runStartedAt = Date.now();
         const taskIdRef = { current: spec.taskId, sessionId: spec.sessionId };
+        let held;
+        let releaseLock;
+        const holdSessionLock = (sessionId) => {
+            if (held === undefined)
+                held = { sessionId, taken: this.acquireSessionLock(sessionId).then((release) => void (releaseLock = release)) };
+            else if (held.sessionId !== sessionId)
+                return Promise.reject(Object.assign(new Error(`internal invariant: a leg holds one session lock — it holds "${held.sessionId}" and was asked for "${sessionId}"`), { code: "internal.session_lock_second_id" }));
+            return held.taken;
+        };
+        const namedSessionId = spec.sessionId;
         const run = (async () => {
-            const releaseLock = spec.sessionId
-                ? await this.acquireSessionLock(spec.sessionId)
-                : undefined;
+            if (namedSessionId)
+                await holdSessionLock(namedSessionId);
             try {
                 await this.runLocked({
                     spec,
                     queue,
+                    holdSessionLock: namedSessionId ? undefined : holdSessionLock,
                     setResult: (r) => {
                         resultValue = r;
                         const pcs = internals?.inheritedGate?.parentConstraints;
@@ -436,9 +446,9 @@ export class Runner {
         };
     }
     runLocked(input) {
-        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
+        const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, holdSessionLock, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
         return runNotificationLane({
-            spec, queue, resume, internals, taskIdRef,
+            spec, queue, resume, internals, taskIdRef, holdSessionLock,
             runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, sessionModeSeats: this.sessionModeSeats, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.35.0",
+  "version": "7.35.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.35.1.json

@@ -0,0 +1,59 @@
+{
+  "repo": "core",
+  "version": "7.35.1",
+  "from": "b0a5a6ddd0b430433d12452260aa51cf96f05972",
+  "to": "v7.35.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 219,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SessionStore.acquire",
+      "assertions": [
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.sessionId",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.permissionMode",
+      "assertions": [
+        "G1.a",
+        "G1.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.sessionId",
+      "assertions": [
+        "G1.a",
+        "G1.c",
+        "G1.d"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@6b6025f7 server@25d6b7a6 sdk@e8f6f0d — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "27a9b09aced4d24b63a68ca78f4186c6fd5fa944"
+}