@sema-agent/core 7.42.0 → 7.42.1

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 7.42.1 — 2026-10-05
+
+**Hard-breaking changes:** none. **Closed sets:** none added. **Package exports:** +1 / −0 — `steerPriorityOf`. **Behavior narrowing:** none (one reading replaces two; a replay that spelled the default is no longer refused).
+
+### A steer's priority has one reading on the 7.42 line too: absent means `next` (#1361; fix; +1 export) (@server @cli @client-core)
+
+- **Before (v7.42.0).** 7.42.0 was cut before the 7.41.2 patch and did not carry it: the live acceptance check (`sameAcceptedSteerInput`) compared the normalized priority (`priority ?? "next"`) while the parked replay check (`samePendingSteerPayload`) compared the row's raw member — a row parked without a priority against a retry that spelled `"next"` read as a different instruction: `409 steering.duplicate_input_id`, after which a client re-issuing under a fresh id queued the same instruction twice (server S-1121). `latest` therefore lacked a fix `patch-7.41` had.
+- **Now.** The same change as 7.41.2: `steerPriorityOf(x)` (src/core/task-notification.ts, the priority word's home; exported) is the one reading — `x.priority ?? "next"` — used by both comparators and by the admission default; `omitted→next`, `next→omitted` and `omitted→omitted` are the idempotent replay (queue unchanged), `next→later` / `next→now` still refuse. Parked rows are written as before (the field stays optional); old rows read through the same default.
+- **Who is hurt.** Nobody: a refusal that was never correct goes away; a real priority change still refuses.
+- **Consumers.** Anyone pinned to `7.42.0`: move to `7.42.1` (a `~7.42.0` range picks it up). server — the 7.42 / 7.43 pickup carries the fix either way; client-core / cli — pin `≥7.42.1` when swapping the embedded engine.
+- Pins: `test/backlog1361-steer-priority-one-reading.test.ts` (A–F from the reproduction; base 7.42.0 red on omitted↔next and on the live check); `test/export-surface.snapshot.json` (+1 name).
+
 ## 7.42.0 — 2026-10-05
 
 **Hard-breaking changes:** one — #1327 (both halves). **#1327 — What breaks:** a caller policy no longer takes an allow rule — `createPermissionRulePolicy` refuses one (`config.invalid_permission_rules`, issue `unsupported.allow`), `PermissionRule.behavior` is `"deny" | "ask"`, the policy's name projection (`nameSets`) has no `allow` group, and the three issue codes that existed only to refuse an allow in one shape or another (`unsupported.bash_prefix`, `unsupported.file_glob`, `invalid.allow_param_rule`) are retired; the allow layer's disclosure `persistedRuleShadowed` (a string, stored rows only) is gone from `PermissionResult`'s ask arm, `AskRequest` and the park closure's sixth seat, and `RiskDescriptor.shadowedRule` from the park row — replaced by `allowRuleShadowed: { member, entries, omitted? }[]` on all four; `SKILL_ENTRY_INERT_REASONS` / `SkillEntryInertReason` are renamed `ALLOW_ENTRY_INERT_REASONS` / `AllowEntryInertReason`; the notice `skills.allowed_tool_not_granted` is renamed `permission.allowed_tool_not_granted` (audience `operator` → `user`, each `detail.entries[]` gains `source`). **#1327 — Why:** "this does not need asking" had several readings — a stored allow row cleared an ordinary question, a skill's row cleared it without disclosing a refusal, a hook's own `allow` only answered the unstated question, and the account of a stored row that could not clear was appended to the message the auto classifier reads; a caller policy's allow rule was a further reading (a statement the fold read at the unstated station only; a content-, path- or param-form allow refused at construction under three different codes); now every allow source is one member of one layer, read under one predicate, with one disclosure that only the card renders, and an allow rule has that one home — a request's entries in `TaskSpec.allowedTools`, the deployment's in `RunnerDeps.allowedTools` — while a policy says deny / ask. **#1327 — What to do:** read `allowRuleShadowed` (one record per member: `hook` / `deployment` / `persisted` / `skill` / `request`) where you read `persistedRuleShadowed` / `riskDescriptor.shadowedRule`; re-import the inert-reason set under its new name; route the notice by its new code (and expect it at the user's session); move the allow entries you handed `createPermissionRulePolicy` to `TaskSpec.allowedTools` (content forms too; write-path and domain forms read as nothing and are announced) or, for the deployment's standing grants, to `RunnerDeps.allowedTools`, and keep deny / ask rules in the policy. **Behavior narrowing (#1311 car A1):** three — `combinePolicies` returns a rule's deny over a deny from an approval seat that was never asked; an inline `TaskSpec.images` entry the model API would not accept is refused before the first model call (`config.image_invalid`); the changed-file notice also honors the caller policy's, the rule store's, the org lane's and an inherited parent policy's deny. **Closed sets:** none on the package root; four engine-internal module vocabularies (`READ_OUTCOMES`, `SYNTHETIC_READ_LAYERS`, `SYNTHETIC_READ_UNANSWERABLE_CAUSES`, `ADMITTED_IMAGE_MIME_TYPES`) and one thrown code (`config.image_invalid`). **Package exports:** none. **#1363:** `PermissionRuleIssue.code` +1 (`invalid.behavior`).
@@ -68,6 +80,18 @@
 - **Compensation.** Spell the verb `deny` or `ask`; an allow entry goes to `TaskSpec.allowedTools` / `RunnerDeps.allowedTools`.
 - Pins: `test/backlog1363-rule-behavior-closed.test.ts` (five bad shapes × throw / skip; the literal `allow` and valid `deny` / `ask` as controls; the sentence names both words).
 
+## 7.41.2 — 2026-10-05
+
+**Hard-breaking changes:** none. **Closed sets:** none added. **Package exports:** +1 / −0 — `steerPriorityOf`. **Behavior narrowing:** none (one reading replaces two; a replay that spelled the default is no longer refused).
+
+### A steer's priority has one reading: absent means `next` (#1361; fix; +1 export) (@server @client-core)
+
+- **Before (v7.41.1).** The live acceptance check (`sameAcceptedSteerInput`) compared the admission's normalized priority (`priority ?? "next"`), while the parked replay check (`samePendingSteerPayload`) compared the row's raw member — a row parked without a priority (every row a ≤7.115.0 server parked, or a client that omits the field) against a retry that spelled `"next"` read as a different instruction: `409 steering.duplicate_input_id`, after which a client re-issuing under a fresh id queued the same instruction twice (server S-1121, reproduced on 7.41.1 with `appendPendingSteer`).
+- **Now.** `steerPriorityOf(x)` (src/core/task-notification.ts, the priority word's home; exported) is the one reading — `x.priority ?? "next"` — used by both comparators and by the admission default; `omitted→next`, `next→omitted` and `omitted→omitted` are the idempotent replay (queue unchanged), `next→later` / `next→now` still refuse. Parked rows are written as before (the field stays optional); old rows read through the same default.
+- **Who is hurt.** Nobody: a refusal that was never correct goes away; a real priority change still refuses.
+- **Consumers.** server — S-1121: pin `7.41.2`, flip the probe cell, delete the MIGRATION / contract sentence about this boundary; client-core — none (one export added).
+- Pins: `test/backlog1361-steer-priority-one-reading.test.ts` (A–F from the reproduction; base 7.41.1 red on omitted↔next and on the live check); `test/export-surface.snapshot.json` (+1 name).
+
 ## 7.41.1 — 2026-10-05
 
 **Hard-breaking changes:** none. **Closed sets:** none added (two existing sets become reachable from the package root). **Package exports:** +5 / −0 — `SKILL_GRANT_ORIGINS`, `SKILL_ENTRY_INERT_REASONS`, types `SkillGrantOrigin`, `SkillEntryInertReason` (all defined in 7.41.0, re-exported now), and `mintNamespacePrefix` (#1355, defined since the namespace minting landed, re-exported now).

package/dist/core/checkpoint-store.d.ts

@@ -1,7 +1,7 @@
 import type { GateOutcome } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
-import type { SystemInjectionPriority } from "./task-notification.js";
+import { type SystemInjectionPriority } from "./task-notification.js";
 import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";

package/dist/core/checkpoint-store.js

@@ -7,6 +7,7 @@ import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
+import { steerPriorityOf } from "./task-notification.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
 import { wireOf } from "./tool-name-readings.js";
@@ -547,7 +548,7 @@ export function readPendingSteerQueue(state) {
 function samePendingSteerPayload(a, b) {
     return (a.text === b.text &&
         a.trusted === b.trusted &&
-        a.priority === b.priority &&
+        steerPriorityOf(a) === steerPriorityOf(b) &&
         a.actor?.id === b.actor?.id &&
         a.actor?.hostAsserted === b.actor?.hostAsserted &&
         a.actor?.issuer === b.actor?.issuer);

package/dist/core/runner/steer-admission.js

@@ -1,3 +1,4 @@
+import { steerPriorityOf } from "../task-notification.js";
 const humanInputOrdinals = new WeakMap();
 export function nextHumanInputSeq(key) {
     let box = humanInputOrdinals.get(key);
@@ -18,7 +19,7 @@ export function announceAcceptance(record) {
 export function sameAcceptedSteerInput(a, b) {
     return (a.payload === b.payload &&
         a.trusted === b.trusted &&
-        a.priority === b.priority &&
+        steerPriorityOf(a) === steerPriorityOf(b) &&
         a.actor?.id === b.actor?.id &&
         a.actor?.hostAsserted === b.actor?.hostAsserted &&
         a.actor?.issuer === b.actor?.issuer);

package/dist/core/runner/stream-steer-verb.js

@@ -3,7 +3,7 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
-import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
@@ -29,7 +29,7 @@ export function streamSteerVerb(input) {
         if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {
             throw steeringError(`priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when supplied`, "steering.invalid_content");
         }
-        const priority = priorityIn ?? "next";
+        const priority = steerPriorityOf({ priority: priorityIn });
         const actorIn = options?.actor;
         const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
         const projected = projectHumanInput({ text, actor, source: "steer" });

package/dist/core/task-notification.d.ts

@@ -30,6 +30,12 @@ export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriori
  *  no-subscriber retain path indexes `queues[priority]` and the park path stores it verbatim, so an
  *  unknown value used to travel until something downstream failed on it (or didn't, and lied). */
 export declare function isSystemInjectionPriority(value: unknown): value is SystemInjectionPriority;
+/** The ONE reading of a steer's priority: a parked row or an accepted input that carries none means `"next"`
+ *  (the default the live admission has always applied) — so a retry that spells the default and a row parked
+ *  without it are the same instruction, whichever side normalized. */
+export declare function steerPriorityOf(x: {
+    readonly priority?: SystemInjectionPriority;
+}): SystemInjectionPriority;
 export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every

package/dist/core/task-notification.js

@@ -10,6 +10,9 @@ export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
 }
+export function steerPriorityOf(x) {
+    return x.priority ?? "next";
+}
 const TASK_NOTIFICATION_TAGS = [
     "task-notification",
     "task-id",

package/dist/index.d.ts

@@ -145,7 +145,7 @@ export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict }
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
-isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";

package/dist/index.js

@@ -117,7 +117,7 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./co
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.42.0",
+  "version": "7.42.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2592,
+  "count": 2593,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -2524,6 +2524,7 @@
     "splitWorkflowMeta": "function",
     "sqliteQuery": "function",
     "startWorkflow": "function",
+    "steerPriorityOf": "function",
     "storeReadBackShapeContract": "function",
     "stripEngineMetadata": "function",
     "stripFormatCharacters": "function",
@@ -5118,6 +5119,7 @@
     "splitWorkflowMeta": "advanced",
     "sqliteQuery": "advanced",
     "startWorkflow": "advanced",
+    "steerPriorityOf": "advanced",
     "storeReadBackShapeContract": "advanced",
     "stripEngineMetadata": "advanced",
     "stripFormatCharacters": "advanced",

package/wire-changes/core@7.42.1.json

@@ -0,0 +1,56 @@
+{
+  "repo": "core",
+  "version": "7.42.1",
+  "from": "708c57d238eecad4d143d7a168159c144a0a5c4c",
+  "to": "ee419e2ab4cffe5151da255f4f91ddfa1f475ada",
+  "added": [
+    {
+      "name": "steerPriorityOf",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/task-notification.ts:49",
+        "src/index.ts:1004"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 225,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "PendingSteerEntry.inputId",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PendingSteerEntry.priority",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [
+      "steerPriorityOf"
+    ],
+    "sdk": [],
+    "note": "scanned cli@bf15b2f9 server@72e966f3 sdk@e3a5370 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}