@sema-agent/core 7.5.0 → 7.5.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 7.5.1 — 2026-09-06
+
+Maintenance release: the design/390 runner decomposition (slices S0–S2), the post-7.5.0 gate repairs, and one summary hardening (#566). **No BREAKING change**: the export surface is byte-identical to 7.5.0 (export snapshot unchanged); the only observable delta is the label text of a wedged dispose on the prepare-throw path (below).
+
+### Changed — design/390 S0–S2: `prepareTask` decomposed into phase modules (14 229 → 7 723 lines), one contract each
+- 24 phase modules under `src/core/runner/prepare-*.ts`, each `prepareX(input: Input): Result` with every Input seat classified (owned / borrowed-readonly / borrowed-mutable + writer table / ownership-ref) and the driver reduced to one destructuring call per phase. Extracted verbatim: offload wrappers, execution-env (`OwnedEnvSeat`), file-history, run-refs, protocol-tools (MCP/A2A), question-face, LSP, project-context, prompt-inputs, defer-classify, listings, inherited-gate, caps-and-workflow, delegation-surface, tool-disclosure-mount, wiring-manifest; helpers `contracts.ts`, `workspace-path.ts`, `derived-route-fallback.ts`, `checkpoint-scope.ts`, `denial-limit-arms.ts`.
+- **RollbackStack** (`rollback-stack.ts`): every resource acquired during prepare registers its disposer the moment it is acquired (env, MCP clients, A2A peers); a prepare throw unwinds them in reverse order, each bounded and reported, replacing the driver's explicit `if (handle) dispose` catch legs. The A2A registration keys on the acquisition decision read ONCE (a caller replacing `spec.a2a` during materialization can no longer unregister an acquired handle).
+- **Disclosed delta**: a dispose that hangs past its budget on the prepare-throw path now reports leg `"<disposer> (rollback leg N of M, prepare-throw)"` (e.g. `mcpDispose (rollback leg 2 of 3, prepare-throw)`) instead of `"mcp.dispose (prepare-throw leg)"` / `"a2a.dispose (prepare-throw leg)"` / `"ownedEnv.destroy (prepare-throw leg)"`. Error class and budget unchanged; no test or consumer referenced the old text.
+- Contract sentence `@contract prepare.deps-read-stable`: the host keeps `deps` / `internals` / `executionEnv` read-stable for the duration of `prepareTask`; an async phase returning a microtask later than the inlined code is within contract.
+- Roster mutation owner table: which phase pushes/splices which tool under which condition is written once on `Prepared.tools` (contracts.ts), not scattered in prose.
+- `isLiveApproverSeat` consumers (3) now read the one predicate in `tool-policy.ts`.
+
+### Fixed
+- #566 `CheckpointSummary.denialLimitFallback` is produced by `readDenialLimitFallback` (the same reader the park row and `AskRequest` use): exactly the four typed members when the row's value is well-formed, no key otherwise — a hand-edited or partial value is dropped, never echoed.
+- Wire-change generator: inherited keys are keys the type HAS — `readTreeModel` folds an interface's `extends` / intersection bases, so moving members onto a base interface no longer reports a false "lost keys" BREAKING item (the two false items in `wire-changes/core@7.5.0.json` are left as published and noted there).
+- `gate:message-branching` (the mcp.ts `transport.kind` fold's five sites are the ONE reader, exemption count corrected) and `gate:domain-lexicon` (UNC anchor test written with `isUncPath`) — two CI-only gates that had been red since the A-089 merge without the local chain running them.
+- Two load-sensitive pins (#583) measure by best-of-three / a generous spawn timeout instead of a single wall-clock reading.
+
+### Tooling / gates
+- `node scripts/gate-all.mjs [--with-dist] [--rc]` runs the whole `gate:*` roster in one command; a `gate:*` script without a roster seat fails `test/gate-all-roster.test.ts` (the release chain's L3 line now points here).
+- New gates: **G1** module line-count ratchet (`test/module-size-ratchet.test.ts`, banked per extraction), **G2** dependency-direction gate (`scripts/verify-layering.mjs` + `docs/LAYERING.json`, four layers: contracts ← prepare-path machinery ← phases ← orchestrator ← runtask; exemptions 13 → 3), **G5** phase-contract gate (`scripts/verify-phase-api.mjs`: every `prepare-*.ts` exports one Input/Result pair, every Input field classified; `KNOWN_INPUT_FIELDS` anti-blindness floor 371), `gate:agent-returns` (every archived car receipt's unresolved line carries a ticket / DEBTS id / DV / slice home).
+- Release criteria: `retiredIn` annotation lets a historic criteria file name a face that a later version removed without rewriting history (`criteria-lint` accepts an absent face carrying the annotation).
+- 16 runtime exports added in 7.5.0 registered in the consumer smoke probe; `test/prepare-lsp-ignore-filter.test.ts` pins the LSP tool's git-ignore wiring (a receiving-side mutation had left every LSP test green).
+
 ## 7.5.0 — 2026-09-05
 
 **BREAKING release** (the 7.4.1 bug batch merged into it — one publish, one pickup). 13 exports removed, 5 public types lose keys, one store contract replaced whole; every item is named below with its replacement. Nothing here is a wire FRAME change: `TaskEvent`, `PendingAction`, `CheckpointSummary`, `WiringManifest` only GAIN keys.

package/dist/core/auto-mode.d.ts

@@ -169,6 +169,15 @@ export interface DenialLimitFallback extends DenialLimitCounts {
  *  which is a break with nothing behind it (the routing invariant constrains where a window is WRITTEN,
  *  never who may read one). */
 export type DenialLimitFallbackFace = UnarmedDenialLimitFallback | DenialLimitFallback;
+/**
+ * A stored or foreign value read back AS a fallback member, or `undefined` when it is not one: exactly
+ * the four members, each of the right kind (finite non-negative counts, the closed `limit` word, a
+ * finite non-negative window), nothing else carried. A deployment-written row (a checkpoint store is a
+ * host's) can hold any shape; the faces that echo it (the inbox summary) read through here, so a bad
+ * shape reads as ABSENT rather than reaching a consumer as a malformed card. Not a parser of intent —
+ * `"3"` is not 3.
+ */
+export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
 /** The window-less route's member, spelled in ONE place: every station that hands a fallback somewhere
  *  nothing can count down (a durable park row, a headless deny, a string `onAsk` seat, a member this
  *  run's tracker did not mint) passes through here rather than writing a `0` of its own. */

package/dist/core/auto-mode.js

@@ -99,6 +99,17 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+export function readDenialLimitFallback(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const o = v;
+    const count = (x) => typeof x === "number" && Number.isFinite(x) && x >= 0;
+    if (!count(o["consecutive"]) || !count(o["total"]) || !count(o["autoDenyAfterMs"]))
+        return undefined;
+    if (o["limit"] !== "consecutive" && o["limit"] !== "total")
+        return undefined;
+    return { consecutive: o["consecutive"], total: o["total"], limit: o["limit"], autoDenyAfterMs: o["autoDenyAfterMs"] };
+}
 export function unarmedWindow(fallback) {
     return { ...countsOf(fallback), autoDenyAfterMs: 0 };
 }

package/dist/core/checkpoint-store.js

@@ -2,6 +2,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
+import { readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin } from "./ask-origin.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
@@ -264,7 +265,10 @@ export function summarizeCheckpoint(cp) {
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
         ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
         ...(tool?.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-        ...(tool?.denialLimitFallback !== undefined ? { denialLimitFallback: { ...tool.denialLimitFallback } } : {}),
+        ...(() => {
+            const fb = readDenialLimitFallback(tool?.denialLimitFallback);
+            return fb !== undefined ? { denialLimitFallback: fb } : {};
+        })(),
         ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };

package/dist/core/runner/checkpoint-scope.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The durable-suspend checkpoint SCOPE vocabulary — the default isolation scope and the ONE derivation of a row's scope —
+ * moved whole out of the orchestrator so the wiring-manifest phase (the synthesized durableApproval) and the driver's
+ * park-lane mint sites reach DOWN for the same two names. Pure: a constant and a string function over two spec fields.
+ */
+/** design/77 §4.4: the multi-tenant scope used when a durable suspend fires for an IRREVERSIBLE tool in an
+ *  unattended deployment that did NOT opt into `durableApproval` (so there is no caller-supplied scope). The
+ *  checkpoint carries this scope; resume reads it back from the checkpoint (`cp.scope`), so it is
+ *  self-consistent without needing the original `TaskSpec`. Kept distinct from any tenant key to make an
+ *  unattended irreversible suspend auditable as such. */
+export declare const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
+/**
+ * design/153 §7.1 — the SINGLE derivation of a durable-suspend checkpoint's scope (both gate mint
+ * sites + the bg-watcher park lane's expire compensation/arbitration consume THIS; a re-derived copy
+ * that drifted was the exact bug the park tests caught — expire against the wrong scope silently
+ * no-ops). `|| DEFAULT` (not `??`): an EMPTY-string principal must not become a shared scope bucket.
+ *
+ * RB-75 (2026-07-25, red probe): that rule is stated twice in this file and was enforced on ONE of the two
+ * inputs — the principal half used `||`, the `durableApproval.scope` half used `??`, so an empty string
+ * arriving through the scope field (a config-centre / env lookup that came back blank is the realistic
+ * source) sailed through as the literal scope `""`. Two different tenants both landed in that one bucket,
+ * where `listByScope("")` reads BOTH their pending approvals — including each summary's `toolInput`
+ * preview of the raw arguments — and `reap("")` / `resolve(token, "")` act across both. `durableApproval.
+ * scope` is documented as "Multi-tenant isolation key … Required"; a blank string is the absence of an
+ * isolation key wearing its clothes, so both halves now fall through to the default isolation scope.
+ */
+export declare function checkpointScopeOf(spec: {
+    durableApproval?: {
+        scope?: string;
+    };
+    principal?: string;
+}): string;

package/dist/core/runner/checkpoint-scope.js

@@ -0,0 +1,4 @@
+export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
+export function checkpointScopeOf(spec) {
+    return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
+}