@sema-agent/core 7.47.0 → 7.49.0

package/dist/agents/tool-filter.js

@@ -1,5 +1,11 @@
+import { createHash } from "node:crypto";
+import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
 import { parsePermissionRule } from "../core/permission-rule-syntax.js";
-import { HAND_TOOLS } from "../core/tool-catalog-entries.js";
+import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
+import { protocolOf } from "../core/protocol-table.js";
+import { splitNamespacedName } from "../core/tool-name-aliases.js";
+import { readToolNameList, snapshotToolNameList, valueTypeLabel } from "../core/tool-name-list.js";
 export function readDeniedEntry(entry) {
     if (typeof entry !== "string")
         return { kind: "not_a_string", type: valueTypeLabel(entry) };
@@ -8,61 +14,6 @@ export function readDeniedEntry(entry) {
     const parsed = parsePermissionRule(entry);
     return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
 }
-export function valueTypeLabel(value) {
-    if (value === null)
-        return "null";
-    switch (typeof value) {
-        case "string":
-            return "a string";
-        case "undefined":
-            return "undefined";
-        case "number":
-            return "a number";
-        case "boolean":
-            return "a boolean";
-        case "bigint":
-            return "a bigint";
-        case "symbol":
-            return "a symbol";
-        case "function":
-            return "a function";
-        default:
-            try {
-                return Array.isArray(value) ? "an array" : "an object";
-            }
-            catch {
-                return "an object";
-            }
-    }
-}
-const isList = (value) => Array.isArray(value);
-const UNREADABLE_LIST = Object.freeze({});
-export function readToolNameList(value) {
-    if (value === UNREADABLE_LIST)
-        return { kind: "unreadable" };
-    let list;
-    try {
-        list = isList(value) ? value : undefined;
-    }
-    catch {
-        return { kind: "not_a_list", type: "an object" };
-    }
-    if (list === undefined)
-        return { kind: "not_a_list", type: valueTypeLabel(value) };
-    try {
-        const entries = [];
-        for (let i = 0; i < list.length; i++)
-            entries.push(list[i]);
-        return { kind: "entries", entries };
-    }
-    catch {
-        return { kind: "unreadable" };
-    }
-}
-export function snapshotToolNameList(value) {
-    const read = readToolNameList(value);
-    return read.kind === "entries" ? read.entries : read.kind === "unreadable" ? UNREADABLE_LIST : value;
-}
 const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
 const LIST_NAME = { allowed: "an allowed-tools list", denied: "a denied-tools list" };
 export function notAStringSentence(where, side, index, type) {
@@ -73,6 +24,13 @@ export function notAListSentence(where, side, list) {
         ? `${where} declares in its ${LIST_NOUN[side]} a value that is ${list.type}, not a list of tool names. Fix the list.`
         : `${where} declares in its ${LIST_NOUN[side]} a list whose entries cannot be read (an accessor or a proxy trap threw). Fix the list.`;
 }
+export function delegationListWhere(toolName, definitionName) {
+    return `delegation tool "${toolName}": ${definitionName !== undefined ? `agent definition "${definitionName}"` : "the tool-level list"}`;
+}
+export function toolListsDigest(allow, deny) {
+    const canonical = canonicalize({ allow: allow ?? null, deny: deny ?? [] });
+    return canonical === UNCANONICALIZABLE ? undefined : createHash("sha256").update(canonical, "utf8").digest("hex");
+}
 export function toolNameListFlaw(where, side, value) {
     if (value === undefined || value === null)
         return undefined;
@@ -94,53 +52,125 @@ export function snapshotDefinitionLists(def) {
         copy.denyTools = snapshotToolNameList(copy.denyTools);
     return copy;
 }
-export function allowedToolNames(allowTools) {
+function reachOf(entries, side) {
+    const names = new Set();
+    const covering = [];
+    const wholeProtocols = new Set();
+    for (const entry of entries) {
+        let name;
+        if (side === "denied") {
+            const read = readDeniedEntry(entry);
+            name = read.kind === "name" ? read.name : undefined;
+        }
+        else
+            name = typeof entry === "string" ? entry : undefined;
+        if (name === undefined)
+            continue;
+        const split = splitNamespacedName(name);
+        if (split !== undefined && split.tool === undefined && split.peer === "*") {
+            if (side === "denied")
+                wholeProtocols.add(split.ns.id);
+            continue;
+        }
+        if (isNamespacedCoveringRuleName(name))
+            covering.push(name);
+        else
+            names.add(name);
+    }
+    return { names, covering, wholeProtocols };
+}
+export function readAllowedToolList(allowTools) {
     if (allowTools === undefined || allowTools === null)
         return undefined;
     const list = readToolNameList(allowTools);
     if (list.kind !== "entries")
-        return new Set();
+        return reachOf([], "allowed");
     if (list.entries.includes("*"))
         return undefined;
-    const names = new Set();
-    for (const entry of list.entries)
-        if (typeof entry === "string")
-            names.add(entry);
-    return names;
+    return reachOf(list.entries, "allowed");
 }
-function deniedNames(denyTools) {
-    const names = new Set();
+export function readDeniedToolList(denyTools) {
     const list = readToolNameList(denyTools);
-    if (list.kind !== "entries")
-        return names;
-    for (const entry of list.entries) {
-        const read = readDeniedEntry(entry);
-        if (read.kind === "name")
-            names.add(read.name);
+    return reachOf(list.kind === "entries" ? list.entries : [], "denied");
+}
+export function listReaches(reach, tool) {
+    for (const spelling of [tool.name, ...(tool.aliases ?? [])]) {
+        if (reach.names.has(spelling))
+            return true;
+        for (const pattern of reach.covering)
+            if (namespacedRuleNameCovers(pattern, spelling))
+                return true;
+        if (reach.wholeProtocols.size > 0) {
+            const ns = protocolOf(spelling);
+            if (ns !== undefined && reach.wholeProtocols.has(ns.id))
+                return true;
+        }
     }
-    return names;
+    return false;
 }
-export function toolNameAllowed(name, allowTools, denyTools) {
-    const allow = allowedToolNames(allowTools);
-    const denied = deniedNames(denyTools);
-    const deny = denied.size > 0 ? denied : undefined;
-    const n = name;
-    return (!allow || allow.has(n)) && (!deny || !deny.has(n));
+const PROTOCOL_ROWS = Object.freeze(TOOL_CATALOG_ENTRIES.flatMap((e) => (e.protocol !== undefined ? [Object.freeze({ name: e.name, legs: e.protocol, underCeiling: e.protocolUnderCeiling === true })] : [])));
+export function protocolToolNames(legs) {
+    return [...new Set(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => r.name))];
 }
-export function resolveToolSubset(pool, allowTools, denyTools) {
-    const allow = allowedToolNames(allowTools);
-    const denied = deniedNames(denyTools);
-    const deny = denied.size > 0 ? denied : undefined;
-    if (!allow && !deny)
-        return [...pool];
-    return pool.filter((t) => {
-        const matches = (set) => set.has(t.name) || (t.aliases ?? []).some((a) => set.has(a));
-        return (!allow || matches(allow)) && (!deny || !matches(deny));
+function reachTouchesPeer(reach, peer) {
+    if (reach.wholeProtocols.has(peer.ns))
+        return true;
+    const inPeer = (spelling) => {
+        const split = splitNamespacedName(spelling);
+        return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer;
+    };
+    return [...reach.names].some(inPeer) || reach.covering.some(inPeer);
+}
+function reachCoversPeer(reach, peer) {
+    if (reach.wholeProtocols.has(peer.ns))
+        return true;
+    return reach.covering.some((pattern) => {
+        const split = splitNamespacedName(pattern);
+        return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer && (split.tool === undefined || split.tool === "*");
     });
 }
-export function resolveAgentToolSubset(pool, allowTools, denyTools) {
-    const kept = new Set(resolveToolSubset([...pool, ...HAND_TOOLS], allowTools, denyTools));
-    const handed = pool.filter((t) => kept.has(t));
-    const mountedUnder = new Set(handed.map((t) => t.name));
-    return { handed, withheldHands: HAND_TOOLS.filter((t) => !kept.has(t) && !mountedUnder.has(t.name)).map((t) => t.name) };
+export function compileToolSelector(layers, legs = []) {
+    const kept = Object.freeze([...layers]);
+    const compiled = kept.map((l) => ({ allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) }));
+    const admittedBy = (ls, tool) => ls.every((l) => (l.allow === undefined || listReaches(l.allow, tool)) && !listReaches(l.deny, tool));
+    const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, r.underCeiling]));
+    return Object.freeze({
+        layers: kept,
+        admits: (tool) => {
+            const underCeiling = protocol.get(tool.name);
+            if (underCeiling === false)
+                return true;
+            if (underCeiling === true)
+                return admittedBy(compiled.slice(0, -1), tool);
+            return admittedBy(compiled, tool);
+        },
+        admitsPeer: (prefix) => {
+            const split = splitNamespacedName(prefix);
+            if (split === undefined)
+                return false;
+            const peer = { ns: split.ns.id, peer: split.peer };
+            return compiled.every((l) => (l.allow === undefined || reachTouchesPeer(l.allow, peer)) && !reachCoversPeer(l.deny, peer));
+        },
+    });
+}
+export function deniedProtocolTools(layers, legs) {
+    const denies = layers.map((l) => readDeniedToolList(l.deny));
+    const own = denies.slice(-1);
+    const inherited = denies.slice(0, -1);
+    const hits = new Map();
+    for (const r of PROTOCOL_ROWS.filter((row) => row.legs.some((l) => legs.includes(l)))) {
+        const reached = (ds) => ds.some((d) => listReaches(d, { name: r.name }));
+        if (reached(own))
+            hits.set(`own:${r.name}`, { name: r.name, own: true });
+        if (!r.underCeiling && reached(inherited))
+            hits.set(`inherited:${r.name}`, { name: r.name, own: false });
+    }
+    return [...hits.values()];
+}
+export function toolNameAllowed(name, allowTools, denyTools) {
+    return compileToolSelector([{ ...(allowTools !== undefined ? { allow: allowTools } : {}), deny: denyTools ?? [] }]).admits({ name });
+}
+export function resolveToolSubset(pool, allowTools, denyTools) {
+    const selector = compileToolSelector([{ ...(allowTools !== undefined ? { allow: allowTools } : {}), deny: denyTools ?? [] }]);
+    return pool.filter((t) => selector.admits(t));
 }

package/dist/agents/verify.d.ts

@@ -26,12 +26,9 @@ import type { ModelRef, TaskResult, TaskSpec, TaskStatus, ToolSpec } from "../co
  * DEPLOYMENT POSTURE (ruled 2026-07-14): opt-in library primitive ONLY — never a scenario default,
  * never deployed implicitly. It is a **thin composition** over existing core seams — a verifier subtask
  * (own model role), a read-only tool set (via tool `effect`), {@link TaskSpec.outputSchema} for the
- * verdict, and the teacher-style fix loop — so it adds no Runner-core surface. Off by default; opt in
- * per task via {@link runWithVerification} (or {@link runDeveloperTask}).
- *
- * Boundary vs teacher mode: teacher's Tier-1 is a *lenient* rubric verifier that triggers escalation to
- * an advisor (stuck/wrong recovery); this is a *strict falsification-style* completion gate with a fix loop.
- * Orthogonal, composable, not merged.
+ * verdict, and a fix loop — so it adds no Runner-core surface. Off by default; opt in
+ * per task via {@link runWithVerification} (or {@link runDeveloperTask}). It is a *strict falsification-style*
+ * completion gate.
  */
 export declare const VERIFICATION_PROMPT = "You are a verification specialist. Your job is NOT to confirm the implementation works \u2014 it is to try to BREAK it.\n\nYou have two documented failure patterns. First, verification avoidance: faced with a check, you find reasons not to run it \u2014 you read code, narrate what you would test, declare \"PASS,\" and move on. Second, being seduced by the first 80%: a polished result or a passing test suite makes you inclined to pass it, not noticing the edge that crashes, the state that vanishes, the bad input that is unhandled. The first 80% is the easy part. Your entire value is in finding the last 20%.\n\n## Hard boundary \u2014 do not modify the project\nYou are STRICTLY a verifier. Do NOT create, modify, or delete project files; do NOT install packages; do NOT run version-control write operations. Use only the read/probe/execute tools available to you. (If you need a scratch file, use a temp directory, and clean up.)\n\n## Evidence is mandatory\nReading code is NOT verification. Every check must actually run something \u2014 execute the code, hit the endpoint, run the build/tests \u2014 and record the command and its real output. A \"PASS\" with no command output is a skip, not a pass.\n\n## Strategy (adapt to what changed)\n- Build/lib changes: build it, run the full test suite, exercise the public API as a consumer would.\n- Backend/API: start it, call endpoints, check response *shapes* (not just status codes), test error paths.\n- CLI/script: run with representative AND edge inputs (empty, malformed, boundary); check stdout/stderr/exit codes.\n- Bug fix: reproduce the original bug first, verify the fix, then check for regressions and side effects.\n- Refactor (no behavior change): the existing suite must pass unchanged; diff the public surface; same inputs \u2192 same outputs.\nRun the project's own build/tests/linters as a baseline, then apply the type-specific checks. Test results are context, not proof \u2014 the implementer is an LLM too; its tests may be happy-path or circular.\n\n## Adversarial probes (pick the ones that fit)\nBoundary values (0, -1, empty, very long, unicode, max), idempotency (same mutating call twice), orphan operations (ids that don't exist), concurrency (parallel create-if-not-exists). Your verdict must include at least one adversarial probe you actually ran and its result \u2014 even if it was handled correctly.\n\n## Before you FAIL\nCheck you haven't missed why it's actually fine: defensive code elsewhere, intentional behavior documented in comments/specs, or an unfixable external-contract limitation (note that as an observation, not a FAIL). Don't wave away real issues, but don't FAIL on intentional behavior.\n\n## Verdict\nSubmit exactly one verdict via the provided output tool:\n- PASS \u2014 you ran real checks (including \u22651 adversarial probe) and it holds up. Put the commands + observed output in `evidence`.\n- FAIL \u2014 something is broken. Put each concrete problem (with how to reproduce) in `findings`.\n- PARTIAL \u2014 environmental limitation only (no test framework, a tool/server unavailable). Not for \"I'm unsure\": if you can run the check, decide PASS or FAIL. Note what you couldn't verify and why in `findings`.";
 /**
@@ -169,7 +166,7 @@ export interface VerificationOutcome {
     /**
      * Total cost (micro-USD) of the VERIFIER run(s) across all rounds — the verification OVERHEAD, separate from
      * the implementation's own cost (which is the returned `TaskResult.stats`, as the verifier runs in its own
-     * session). Mirrors `runWithTeacher`'s `teacherStats` work-vs-overhead split. Σ of each verifier run's
+     * session) — a work-vs-overhead split. Σ of each verifier run's
      * cost+nested.
      *
      * THE OPERATION TOTAL, exactly (note the middle term — it is easy to miss and this doc used to omit it):

package/dist/agents/verify.js

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { CODE_AGENT_PROMPT } from "../prompts/default.js";
 import { releaseSession } from "./session-util.js";
-import { childClampSeats, engineHeadlessLegSeats } from "../core/child-clamp-seats.js";
+import { childClampSeats, clampSourceOf, engineHeadlessLegSeats } from "../core/child-clamp-seats.js";
 import { mapNestedSuspend, isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
@@ -153,9 +153,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             handsReadOnly: config.verifierHandsReadOnly ?? true,
             ...engineHeadlessLegSeats(),
             ...childClampSeats({
-                handsReadOnly: specBase.handsReadOnly,
-                interactiveTools: specBase.interactiveTools,
-                approvalReach: specBase.approvalReach,
+                ...clampSourceOf(specBase),
                 readFace: foldedRootsFace ? "roots" : undefined,
                 writeFace: foldedRootsWriteFace ? "roots" : undefined,
                 readDenyPatterns: foldedReadDeny,
@@ -165,6 +163,9 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             limits: { ...(specBase.limits?.maxWalltimeMs !== undefined ? { maxWalltimeMs: specBase.limits.maxWalltimeMs } : {}) },
             getApiKeyAndHeaders: specBase.getApiKeyAndHeaders,
             ...(specBase.principal !== undefined ? { principal: specBase.principal } : {}),
+            ...(specBase.allowTools !== undefined
+                ? { allowTools: Array.isArray(specBase.allowTools) ? [...specBase.allowTools] : specBase.allowTools }
+                : {}),
             ...(specBase.excludeTools !== undefined
                 ? { excludeTools: Array.isArray(specBase.excludeTools) ? [...specBase.excludeTools] : specBase.excludeTools }
                 : {}),
@@ -260,9 +261,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             sessionId: current.sessionId,
             objective: fixObjective(outcome.findings),
             ...childClampSeats({
-                handsReadOnly: specBase.handsReadOnly,
-                interactiveTools: specBase.interactiveTools,
-                approvalReach: specBase.approvalReach,
+                ...clampSourceOf(specBase),
                 readFace: foldedRootsFace ? "roots" : specBase.readFace,
                 writeFace: foldedRootsWriteFace ? "roots" : specBase.writeFace,
                 readDenyPatterns: foldedReadDeny,

package/dist/bench/metrics.d.ts

@@ -33,9 +33,8 @@
  *                an external deterministic verifier is the critic; the human is the escalation tier only). Hypothesis:
  *                on coding tasks where the verifier goes green, SUP-vf collapses C2→~0 and stops being dominated by
  *                solo, WHILE keeping the trap-safety CORRECTLY-WITHHELD (the danger list still escalates `rm -rf data`).
- *   - "team"   — service-deferred (runLeaderTask).
  */
-export type Arm = "solo" | "sup" | "sup-vf" | "team";
+export type Arm = "solo" | "sup" | "sup-vf";
 /**
  * The OBJECTIVE oracle verdicts for one run (design/89 §2.2). These are the four AND criteria.
  * Every field is produced by an external, deterministic oracle run AFTER the agent finishes — never