@sema-agent/core 7.5.1 → 7.6.0

package/dist/core/runner/remote-env-retry.js

@@ -0,0 +1,16 @@
+import { isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES } from "../remote-env.js";
+import { withRetry } from "../with-retry.js";
+export function remoteEnvFailureNote(op, error, attempts) {
+    return { op, code: error.code, retryable: isRetryableRemoteErrorCode(error.code), attempts, message: error.message };
+}
+const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
+const REMOTE_RESTORE_BACKOFF_MS = 200;
+export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
+    let attempts = 0;
+    const outcome = await withRetry(async (attempt) => {
+        attempts = attempt;
+        onAttempt?.(attempt);
+        return env.resumeVM(snapshotId, options);
+    }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
+    return { outcome, attempts };
+}

package/dist/core/runner/runtask.d.ts

@@ -5,7 +5,8 @@ import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
-import { type ApprovalSettledBy } from "../tool-policy.js";
+import type { GateOutcome } from "../gate-outcome.js";
+import { type McpDelivered } from "../mcp-failure.js";
 import type { AgentDefinition, ModelRef, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 /**
  * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
@@ -80,45 +81,29 @@ interface ResumeRun {
  *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
  *  close): the resumed frames used to carry only `isError`, so a client rendering tool output from frames
  *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
- *  Also the one place `settledBy` reaches a frame — see the parameter. */
+ *  Also the one place the gate outcome reaches a frame — see the parameter. */
 declare function toolEndBodyFrom(result: unknown, isError: boolean, 
-/** What ended the approval this call was waiting on, supplied by the CALLER of this projection — the
- *  live loop reads it off the gate's per-call sideband, the resumed leg off the decide. Deliberately
- *  a parameter and never derived from `result`: a tool's own `details` (which post-tool hooks may
- *  also replace) is writable by layers that adjudicate nothing, so reading provenance out of it would
- *  let a failing tool claim a person approved it. Omitted ⇒ the caller supplied no source: the call
- *  settled no approval, OR an approval settled whose decider named none (a caller predating the
- *  field) — absence is not a fact about the call (see the `tool_end.settledBy` doc, the one home). */
-settledBy?: ApprovalSettledBy, 
-/** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
- *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
- *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
-approver?: string, 
-/** The ask resolver's deny-arm classification — same caller, same engine-owned channel and the same
- *  never-derived-from-`result` posture as the two above. Omitted ⇒ not an ask-resolution deny. */
-resolution?: import("../tool-policy.js").AskDenyResolution, 
+/** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
+ *  projection — the live loop reads it off the gate's per-call sideband, the resumed leg off the decide's
+ *  minted record. Deliberately a parameter and never derived from `result`: a tool's own `details`
+ *  (which post-tool hooks may also replace) is writable by layers that adjudicate nothing, so reading
+ *  provenance out of it would let a failing tool claim a person approved it. Omitted ⇒ the call never
+ *  went through the gate (see the `tool_end.gate` doc, the one home). */
+gate?: GateOutcome, 
 /** WHICH call this run's committed durable park is holding ({@link gatedCallIdOf}), for the frames the
- *  abort short-circuits. Same never-derived-from-`result` posture as the three above, and for the
+ *  abort short-circuits. Same never-derived-from-`result` posture as the outcome above, and for the
  *  sharpest version of that reason: this one is an assertion about a DIFFERENT call, so a tool able to
  *  author it could point an approval UI at a call nobody is waiting on. Omitted ⇒ no park is holding a
  *  call (nothing parked, or the park that did holds none), and the frame then carries no id at all. */
-gatedCallIdOfRun?: string, 
-/** #557 — the classifier denial-limit fallback's own auto-deny marker, from the same engine-owned
- *  settlement sideband as `resolution` (same never-derived-from-`result` posture). Omitted ⇒ absent.
- *  The pair `settledBy:"timeout"` + `resolution:"window_expired"` WITHOUT this bit is the approval
- *  factory's own `approvalTimeoutMs` window; a durable park's expiry is neither — the decide lane's
- *  emitter passes no `resolution` at all (see the `tool_end.autoDenied` doc on the event type). */
-autoDenied?: true): {
+gatedCallIdOfRun?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    delivered?: McpDelivered;
     gatedCallId?: string;
-    settledBy?: ApprovalSettledBy;
-    approver?: string;
-    resolution?: import("../tool-policy.js").AskDenyResolution;
-    autoDenied?: true;
+    gate?: GateOutcome;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE
@@ -440,12 +425,12 @@ export declare class Runner {
      * factory-minted remote/worktree lane captured an already-destroyed env (plain host/static lanes were
      * false-green).
      *
-     * design/49 v1.5 / design/76 §2.5: a SUSPENDED (`suspendRef.token`) or `needs_review` (`reviewRef.token`) pause
+     * design/49 v1.5 / design/76 §2.5: a committed durable pause (`pausedRef.current`, any gate kind)
      * `suspendVM`-paused the env and persisted its `workspaceHandle` into the checkpoint — destroying it would
      * discard the paused VM and make resume fail to restore. Skip teardown; `resume()` rebuilds + `resumeVM`s it. A
      * cancelled pause is reaped via `TaskStream.destroy()` (design/51); an abandoned one is the service container
      * reaper's backstop. The gate here MIRRORS the tail's reap-stash (same durable fact
-     * `suspendRef.token===undefined && reviewRef.token===undefined`), so exactly one path owns the env's fate.
+     * `pausedRef.current === undefined`), so exactly one path owns the env's fate.
      */
     private teardownOwnedEnv;
 }