@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/engine-notice.d.ts

@@ -69,6 +69,10 @@ export interface EngineNotice {
      *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
      *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
      *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}).
+     *  - `"mods.registration_refused"` — an extension registration was not mounted: a registration admitted before it
+     *    answered `{ refuse }` on `plugin.register`, or failed while judging it (fail-closed). The run goes on without it.
+     *    Audience `user` (the seat is in `detail`). Once per refused registration per run. `detail: { name, seat, tier,
+     *    refusedBy, reason, sessionId }` (`seat` ∈ `deployment` / `task`).
      *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
      *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
      *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
@@ -213,7 +217,7 @@ export interface EngineNotice {
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
      *    task; the notice is the loud half of that swap.
      *    `detail: { seat, from, to, cause, fixHint, sessionId?, runId? }` — `cause` is the refusal code
-     *    (`route.credential_mismatch` / `route.credential_missing`); `sessionId` (#433, additive)
+     *    (a `RouteRefusalCode` word, the verdict's own); `sessionId` (#433, additive)
      *    rides when the adjudicating seat knows its session, and `runId` (#499, additive) names the
      *    INVOCATION whose seats were being resolved — both correlation keys only, the audience stays
      *    `"operator"` (see the registry's entitlement-not-routability note), and `runId` is what tells one
@@ -261,16 +265,17 @@ export interface EngineNotice {
      *    classifier and the leg's own can carry two); not minted while the call is being aborted (a halt, or the run's end). Audience
      *    `user`: on a lane with no approval face this line is the only place the user hears why the call did not
      *    run. It is not a block — the denial limit does not count it.
-     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
-     *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
-     *    did not change: legal (a provider changing domains), but worth one loud line — if the
-     *    PROVIDER changed, the credential reference needs the same update. Advisory only, never a
-     *    refusal; per-model-hook credentials are invisible to the catalog swap, so the notice is
-     *    deliberately conservative (it may fire when a hook-side credential DID change in lockstep).
-     *    One aggregated notice per swap; `detail: { entries: [{ modelId, from, to }], total,
-     *    occurrenceId }` (rendered list bounded, total always exact); the `occurrenceId` is minted at this
-     *    announcement, independently of the `config.models_swapped` line's own, because the bounded render
-     *    makes two swaps moving the same first entries identical. Dedup key: (code, occurrenceId).
+     *  - `"route.credential_origin_mismatch"` (key↔URL pairing, `src/brain/route-adjudicator.ts`; announced by
+     *    `src/core/runner/credential-origin-seat.ts`) — a request was REFUSED, nothing sent, because the per-model
+     *    credential it would carry is bound to another origin: the law binds a per-model credential to the origin
+     *    (scheme + host + port) of the first request sent carrying it, so an entry whose `baseUrl` moved to another
+     *    host while its credential stayed the same is refused (same-origin path moves are not). The request's own
+     *    failure carries the same code (`[invalid_request] route.credential_origin_mismatch: …`). Minted only for a
+     *    request the gate refused (`routeRefusalError`): a pre-flight or read-face judgment reports nothing, and a derived
+     *    seat refused this way falls back as `route.fallback_to_primary` names. Audience `user` — the person whose request
+     *    failed hears why; the operator hears it through the sink. `detail: { modelId, boundOrigin, requestOrigin,
+     *    sessionId, runId }` — the two origins in display spelling, never a credential or a digest of one. Once per
+     *    run per (modelId, boundOrigin, requestOrigin).
      *  - `"route.response_model_mismatch"` — the provider answered a turn naming a model that is NOT the id
      *    the request was sent with (an alias, a pool or a gateway-side substitution looks exactly like this),
      *    so it is advisory, never a refusal: the engine keeps asking for the catalog's id and reports the
@@ -380,12 +385,20 @@ export interface EngineNotice {
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
      *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's
-     *    declared own credentials (`declareWithheldEnv`), withheld one or more keys from a spawned child's
-     *    environment (a tool's shell, an oracle gate, or a language server).
+     *    own credentials (`declareWithheldEnv`: a declared name, or a value equal to a declared or engine-held
+     *    credential value), withheld one or more keys from a spawned child's environment (a tool's shell, an
+     *    oracle gate, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
      *    `detail: { names, ownCredentials? }` — every withheld key's name, never a value; `ownCredentials`, present
-     *    only when one was withheld, the subset withheld as declared own credentials (under any policy, `"all"`
-     *    included).
+     *    only when one was withheld, the subset withheld as own credentials, by name or by value (under any policy,
+     *    `"all"` included).
+     *  - `"config.credential_not_withheld"` (#1816) — a credential value the engine was handed (a brain's key or credential
+     *    header, a model entry's or a peer's credential header, a consolidation seat's key) is no credential (a placeholder
+     *    such as `EMPTY`, fewer than eight characters, one character repeated): it is used as given, but a variable holding
+     *    the same string is not withheld from a spawned child. Once per PROCESS per value
+     *    ({@link import("./secret-env.js").holdOwnCredentialValues}); `detail: { reason }` — the kind, never the value. Delivered
+     *    to `RunnerDeps.onNotice` from the `new Runner` receipt; the intakes with no structured seat (a brain's construction,
+     *    a request's route reading, a peer's dial, a directly built distiller seat) print its line on `console.warn`.
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
      *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
@@ -511,7 +524,9 @@ export interface EngineNotice {
      *    refused) but the run's ending was not its doing: the run's own ending stands and the result will
      *    NOT carry `haltedByUser` for it (the seat signs consumption, never acceptance). TWO mint points,
      *    one fact, one spelling, disjoint: the VERB arm — the halt arrived while the run's ending was already
-     *    owned by its own abort (nothing cut, nothing stopped; once per such verb call, and only while no halt
+     *    owned by its own abort, or after the loop's end (no turn cut, no boundary stopped — a compaction pass the
+     *    run's tail was in is still cut, and says so on its own `compaction_outcome{mooted, reason:"cancelled"}`;
+     *    once per such verb call, and only while no halt
      *    has been ACCEPTED on the run — after one was, the settle arm alone speaks for the run);
      *    the SETTLE arm — the halt was ACCEPTED (it may even have cut a live seat: `{turnCut:true}` +
      *    `task.turn_interrupted`) but the run ended for its own reason before the machinery consumed it —
@@ -551,9 +566,11 @@ export interface EngineNotice {
      *    taskId?, origin }` with `origin` ∈ `"interrupt"` (the verb) | `"walltime"` | `"turns"` |
      *    `"signal"` (every other run-level abort: the task's own `signal`, a parent's cancel, a
      *    `destroy()`, a refused preempt — the leg names the three it can tell apart and files the rest
-     *    here). Audience `"user"`. A stop that arrives
-     *    AFTER the loop's end is refused typed (`steering.not_running`, every verb alike) and mints
-     *    nothing: the refusal itself is the loud answer.
+     *    here). Audience `"user"`. A stop that arrives AFTER the loop's end but before `done` aborted no
+     *    live loop and mints nothing here: it is answered, the end-of-task compaction pass does not run past
+     *    it (cut in flight — `compaction_outcome{mooted, reason:"cancelled"}` — or never started), and the
+     *    loop's ending stands as it was. A stop that arrives once the result is out is refused typed (`steering.not_running`, every
+     *    verb alike): the refusal itself is the loud answer.
      *
      *  - `"approval.read_root_granted"` / `"approval.read_root_grant_rejected"` — an approver's `readRootGrant`
      *    (`AskOutcome`). GRANTED: it equalled the card's `readRootCandidate.dir` beside `allow: true`; this run's READ

package/dist/core/frontmatter-fence.d.ts

@@ -0,0 +1,10 @@
+/** The fence text a writer emits. The reader below accepts exactly this, plus trailing blanks and a CR. */
+export declare const FRONTMATTER_FENCE = "---";
+/** The refusal sentence for a file that OPENS a frontmatter block and never reaches a closing fence. One wording for
+ *  every reader that refuses such a file: the block exists and cannot be read, so reading the file as one with no
+ *  frontmatter (and dropping what the block declared) is not an answer. */
+export declare const UNCLOSED_FRONTMATTER_REASON = "opens with --- but is not closed by a whole-line ---";
+/** True ⇔ `line` is exactly a frontmatter fence: {@link FRONTMATTER_FENCE}, then spaces / tabs only, then
+ *  at most one CR. The line must not contain `\n` (callers split on it first). The SAME predicate judges
+ *  the opening fence (line 0) and the closing fence (the first later line it accepts). */
+export declare function isFrontmatterFence(line: string): boolean;

package/dist/core/frontmatter-fence.js

@@ -0,0 +1,6 @@
+export const FRONTMATTER_FENCE = "---";
+export const UNCLOSED_FRONTMATTER_REASON = "opens with --- but is not closed by a whole-line ---";
+const FENCE_TAIL = /^[ \t]*\r?$/;
+export function isFrontmatterFence(line) {
+    return line.startsWith(FRONTMATTER_FENCE) && FENCE_TAIL.test(line.slice(FRONTMATTER_FENCE.length));
+}

package/dist/core/gate-fold.js

@@ -8,18 +8,18 @@ import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, wi
 import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
 import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
-import { refuseOutOfContractDecision } from "./tool-policy.js";
+import { foldHookAsk, refuseOutOfContractDecision } from "./tool-policy.js";
 import { applyUnansweredSilence, readStationAnswer, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
-    pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
+    pass.req = Object.freeze({ toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
     let unread;
     try {
         const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
         if (stamped !== undefined)
-            pass.req = await stamped;
+            pass.req = Object.freeze(await stamped);
     }
     catch (error) {
         unread = { error };
@@ -42,26 +42,8 @@ export async function runGateFold(pass) {
     else if (pass.hookAsk?.updatedInput !== undefined) {
         pass.policyRewrite = pass.hookAsk.updatedInput;
     }
-    if (pass.decision.action === "allow" && pass.hookAsk) {
-        pass.decision = {
-            action: "ask",
-            ...(pass.hookAsk.message !== undefined ? { message: pass.hookAsk.message } : {}),
-            decisionReason: "hook",
-            ...(pass.hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-            ...(pass.hookAsk.updatedInput !== undefined ? { updatedInput: pass.hookAsk.updatedInput } : {}),
-        };
-    }
-    else if (pass.decision.action === "ask" && pass.hookAsk) {
-        const hookMessage = pass.hookAsk.message;
-        const foldedMessage = hookMessage !== undefined && hookMessage !== pass.decision.message
-            ? `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(a PreToolUse hook also asks: ${hookMessage})`
-            : pass.decision.message;
-        pass.decision = {
-            ...pass.decision,
-            decisionReason: "hook",
-            ...(foldedMessage !== undefined ? { message: foldedMessage } : {}),
-            ...(pass.hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-        };
+    if (pass.hookAsk !== undefined && pass.decision.action !== "deny") {
+        pass.decision = foldHookAsk(pass.decision, pass.hookAsk);
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
         const station = input.shellReadCheck;