@sema-agent/server 3.8.0 → 3.10.0

package/dist/budget.js

@@ -178,6 +178,15 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
             //    「下界 + costUnknown」——两层语义与本处的关系见 fleet-client.ts 的旁注(3.7.0 前这里曾写
             //    「wire 表达不了缺席、center 只见低估」,已被该车推翻;doc-rot 修 2026-07-30)。
             // └──────────────────────────────────────────────────────────────────────────────────────────────┘
+            // [2153]③ 侦察钉(core 2.6.0):`brain.call` 帧新增可选 `turn?: number`(trace.d.ts 确认;此前只有
+            // `turn.end`/`repetition.detected`/`task.degraded` 三帧带 turn)。**刻意不接**——`modelUsage.record`
+            // 喂的是 E8 durable `model_usage` echo,累加键=`taskId → model`(见 `ModelUsageTracker.byTask`,
+            // 上方 class 定义),drain 边界=**per-turn**(run lifecycle 在每个 turn 边界 drain 一次、append 一条
+            // durable 事件行)。也就是说 turn 粒度已经由「何时 drain」这个外层动作表达,一次 drain 窗口内本就
+            // 只可能有一个 turn 的 delta——帧上逐行再带一份 `turn` 是重复信息,对已经 per-turn 聚合的行没有
+            // 增量语义(不是「丢了信息」,是「信息已经在结构里」)。将来若变盘:若聚合粒度改粗(比如攒够 N
+            // turn 才 drain 一次,单行 delta 跨多个 turn),或 usage-analytics 想要「同一 drain 窗口内哪个 turn
+            // 花了多少」的细分,才值得把 `e.turn` 塞进 `ModelUsageDelta`(那时 byTask 需要再加一层 turn 键)。
             // E8 (shell-host): per-task × per-model usage for the `TaskStats.modelUsage` echo. `record` is a NO-OP unless
             // e.taskId is a REGISTERED top-level run (the leak fence — sub-task/throwaway taskIds are never registered, so
             // they neither leak nor enter the echo; their spend is in TaskStats.nested). Drained at turn boundaries into the
@@ -201,6 +210,20 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
             metrics.observe("brain_call_latency_ms", e.latencyMs);
         }
         else if (e.kind === "tool.call") {
+            // [2153]③ 侦察钉(core 2.6.0):`tool.call` 帧新增可选 `toolCallId?: string` / `turn?: number`(trace.d.ts
+            // 确认)。**刻意不接进 `tool_calls_total` 的标签**:`toolCallId` 逐调用唯一 → 直接当标签会让这个
+            // 计数器的基数=调用总数(等于没聚合),是本文件 `cardinalityGuard` 存在的理由要防的那类爆炸,
+            // 连 guard 都救不了(不是「用户输入无界」那类可折叠 __other__ 的情形,是键本身设计上就唯一)。
+            // `turn` 本身是低基数(有界于单任务的 turn 数),但作为**跨任务**的 Prometheus 标签会随长任务/
+            // 多任务叠加成事实上无界的序列(同 model/tool_name 已用 guard 的理由,turn 目前没有等价上限)——
+            // 且当前没有「按 turn 分桶看 tool 调用量」的仪表盘/告警消费者在等这个切面,先不加标签。这两个键
+            // 已经在别的通道有名分:`toolCallId` 走 wire 的 `tool_start`/`tool_end` TaskEvent(trace/project.ts
+            // toolStartEventData/toolEndEventData,逐调用可关联、不进 metrics 基数);`turn` 走 `turn.end`/
+            // `task.end.turns`。本臂（createTracer→/metrics）只做计数,不是这两键的合适去处。将来若要接:
+            // (a) 出现「per-turn tool 调用密度」的真实消费者(如异常 turn 侦测),`turn` 分桶价值才成立——
+            //     用有界桶(如 `turn <= 20 ? String(turn) : "20+"`)而非原始整数,避免上面同款无界问题;
+            // (b) `toolCallId` 除非改造成非标签的关联字段(如结构化日志行,不是 Prometheus label),否则永远
+            //     不该进这个计数器。
             metrics.inc("tool_calls_total", { name: toolName(e.name), ok: String(e.ok) });
         }
         else if (e.kind === "task.degraded") {

package/dist/config-types.d.ts

@@ -670,8 +670,13 @@ export interface ServiceConfigFlat {
      *  (default/auto/acceptEdits) gate every fs WRITE hand tool (Write/Edit/NotebookEdit) but never touched Bash —
      *  a model can `echo -n '…' > file` straight past the write-approval card. `MANUAL_MODE_SHELL_GATE` opts a
      *  deployment into ALSO tightening `TaskSpec.shellGate` on those same modes (core `bashReversibilityProbe`
-     *  under `"classify"` only asks on constructively-irreversible commands — shell redirects etc.; plain reads
-     *  auto-allow). Absent/unset = `undefined` = **zero behavior change** (this is a tighten-ONLY opt-in, never a
+     *  under `"classify"` only asks on constructively-irreversible commands — shell redirects etc.).
+     *  🔴 **语义随 core 版本演进(2026-07-31 核)**:`"classify"` 下「纯读自动放行」这句自 core 2.7.0 起
+     *  **不再无条件成立** —— RB-412 给 classifier 加了 root 边界扫描,core 内部自铸 boundary
+     *  (`prepare-task.ts` 的 `shellReadBoundary`:roots=任务 root+additionalRoots,cwd=活 handsCwd),
+     *  **读到 roots 之外的路径同样会 ask**(server 侧零接线即得:我们只传 shellGate,边界是 core 自算的)。
+     *  旧 core(<2.7.0)下仍是名字级判定=越界读放行,两者都能工作、后者更严 ⇒ floor 不因此抬。
+     *  Absent/unset = `undefined` = **zero behavior change** (this is a tighten-ONLY opt-in, never a
      *  default — a deployment must explicitly choose it); `"always"` = CC-strict parity (every Bash asks). Any
      *  other value (incl. `"off"`) is treated as unset — this knob has no "off" value to opt BACK OUT with once a
      *  session's baseline already tightened elsewhere (tightenTaskSpec would reject that as a loosen anyway). */

package/dist/http/routes/tasks.js

@@ -649,6 +649,12 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     // 提示行。cwd 与已展示的工具 args 同信任级 → 共享白名单构造器(redactSecrets + bound)。
                                     res.write(`data: ${JSON.stringify({ type: "workspace_changed", ...workspaceChangedEventData(ev) })}\n\n`);
                                 }
+                                else if (ev.type === "compaction_outcome") {
+                                    // core 2.5.0([2105]② 披露修):压缩非 compacted 结局上流帧——白名单投影:outcome/trigger
+                                    // 闭枚举 verbatim;reason 是引擎说明文本(可能引用配置值)→ redactSecrets;identity 两键同款。
+                                    const e = ev;
+                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", outcome: e.outcome, trigger: e.trigger, ...(e.reason !== undefined ? { reason: redactSecrets(e.reason) } : {}), ...(e.eventId !== undefined ? { eventId: e.eventId } : {}), ...(e.parentToolCallId !== undefined ? { parentToolCallId: e.parentToolCallId } : {}) })}\n\n`);
+                                }
                                 else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     // 裸 catch-all 白名单化收官(probe-wire-1 表征钉的根治半场):最后四个已知臂离开
                                     // `JSON.stringify(ev)`。**零字节变化**白名单——已知键(含 E2 四 identity 键:live 现状

package/dist/plugins/file-snapshot-store-sql.js

@@ -205,6 +205,12 @@ export class SqlFileSnapshotStore {
             // the manifest tx runs → fail-closed: no manifest row ⇒ has() false ⇒ never a half-snapshot a restore would
             // silently truncate. Upsert REFRESHES created_at (incl dedup hits) → blobs touched=now, GC-grace-protected.
             for (const hash of new Set(manifest.values())) {
+                // D2(试剂盒揪出,RB-361 同源):路径逃逸型 hash 在任何 fetch **之前**拒,文案逐字同 core
+                // File/InMemory 后端(消费方按文案分支不劈叉);SQL 侧 hash 虽只是字符串键,但 srcGetBlob
+                // 是跨后端回调(2c 传输面可能远端),可疑值不外递。
+                if (hash === "" || hash === "." || hash === ".." || !/^[A-Za-z0-9_.-]+$/.test(hash)) {
+                    return { ok: false, error: { code: "read_failed", message: `unsafe blob hash ${JSON.stringify(hash)}` } };
+                }
                 let bytes;
                 try {
                     bytes = await srcGetBlob(hash);

package/dist/plugins/mailbox-store-sql.js

@@ -10,6 +10,13 @@ function assertScope(scope) {
 /** 键长守卫(复审 F5):TiDB `INSERT IGNORE` 对超 190 字节键**静默截断**(warning 降级)——截断键
  *  与全长参数的字节比对恒 miss(seq 分配读空行 TypeError / 隔离键错位);PG 侧是干净 22001,同点
  *  提前拒 = 双方言同文案 fail-loud。 */
+/** D4(试剂盒揪出,RB-251 语义):身份键含 NUL/控制符——TiDB VARBINARY 能存但与文件头「两后端一致
+ *  拒绝」的声明不符(该声明此前是谎);写入面双方言同精神拒绝(PG 臂经 PgUnstorableError 已拒)。 */
+function assertIdentityChars(what, v) {
+    if ([...v].some((ch) => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f)) {
+        throw new Error(`MailboxStore: ${what} contains control characters (refusing — identity keys must be byte-exact addressable)`);
+    }
+}
 function assertKeyBytes(what, v) {
     if (Buffer.byteLength(v, "utf8") > 190) {
         throw new Error(`MailboxStore: ${what} exceeds the 190-byte key column (refusing — a truncated key would desync from its byte-exact lookups)`);
@@ -95,6 +102,8 @@ export class TiDBMailboxStore {
     }
     async append(scope, handle, msg) {
         assertScope(scope);
+        assertIdentityChars("scope", scope);
+        assertIdentityChars("handle", handle);
         assertKeyBytes("scope", scope);
         assertKeyBytes("handle", handle);
         // ensure-first 形:先幂等 INSERT IGNORE 建盒(next_seq=1,首条/drop 后重建同臂)再 FOR UPDATE——
@@ -290,6 +299,10 @@ export class PgMailboxStore {
        WHERE scope_key = $1 AND handle = $2 AND lease_owner = $3`, [scope, handle, owner]);
     }
     async peekCount(scope, handle) {
+        // D4(试剂盒揪出):unstorable 身份键在**读面降级**返回 0(该键在写入面就被拒 ⇒ 盒必空),
+        // 而不是把驱动层 22021 裸抛给调用方——与 tool-result 读面「degrades instead」同精神。
+        if (pgHasUnstorable(scope) || pgHasUnstorable(handle))
+            return 0;
         const { rows } = await this.pool.query(`SELECT COUNT(*) AS n FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2`, [scope, handle]);
         return Number(rows[0].n);
     }

package/dist/plugins/tool-result-store-sql.d.ts

@@ -51,6 +51,11 @@ export declare class SqlToolResultStore implements ToolResultStore {
     constructor(db: SqlDriver);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
+    /** D1(试剂盒揪出,RB-266 语义):ref 是主键且 deleteBySession 靠 `tr_<sid>_%` 前缀清理——不合规
+     *  ref 的行既躲过 session 删除也只能等 TTL,永远清不掉。判定逐字镜像 core assertSafeToolResultRef
+     *  (dist/core/tool-result-store.js:5;core 根不导出,本地镜像,试剂盒契约条目为同源锚)。 */
+    private isUnsafeRef;
+    private assertSafeRef;
     put(ref: string, content: string): Promise<void>;
     get(ref: string, opts?: {
         offset?: number;

package/dist/plugins/tool-result-store-sql.js

@@ -28,7 +28,19 @@ export class SqlToolResultStore {
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
+    /** D1(试剂盒揪出,RB-266 语义):ref 是主键且 deleteBySession 靠 `tr_<sid>_%` 前缀清理——不合规
+     *  ref 的行既躲过 session 删除也只能等 TTL,永远清不掉。判定逐字镜像 core assertSafeToolResultRef
+     *  (dist/core/tool-result-store.js:5;core 根不导出,本地镜像,试剂盒契约条目为同源锚)。 */
+    isUnsafeRef(ref) {
+        return ref === "" || ref === "." || ref === ".." || ref.includes("/") || ref.includes("\\") ||
+            [...ref].some((ch) => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f);
+    }
+    assertSafeRef(ref) {
+        if (this.isUnsafeRef(ref))
+            throw new Error(`tool-result store: unsafe ref ${JSON.stringify(ref)}`);
+    }
     async put(ref, content) {
+        this.assertSafeRef(ref);
         // Sanitize invalid UTF-16 (lone/half surrogates — a JS string CAN hold them, e.g. a binary-ish tool
         // output) to U+FFFD so the column accepts the FULL value via a Buffer utf8 round-trip (valid content is
         // unchanged). Shared by both dialects.
@@ -45,6 +57,10 @@ export class SqlToolResultStore {
         await this.db.query(this.q("INSERT IGNORE INTO tool_result (ref, content, created_at) VALUES (?,?,?)", "INSERT INTO tool_result (ref, content, created_at) VALUES ($1,$2,$3) ON CONFLICT (ref) DO NOTHING"), [ref, safe, new Date()]);
     }
     async get(ref, opts = {}) {
+        // D1 读面半条(RB-266「the read face degrades instead」):unsafe ref 在读面**降级**返回 undefined
+        // (该 ref 写入面就被拒 ⇒ 必不在库),不把驱动层错误(PG 22021 对 NUL)漏给调用方。
+        if (this.isUnsafeRef(ref))
+            return undefined;
         const offset = Math.max(0, Math.floor(opts.offset ?? 0));
         const hasLimit = opts.limit !== undefined && Number.isFinite(opts.limit);
         const limit = hasLimit ? Math.max(0, Math.floor(opts.limit)) : 0;

package/dist/plugins/worktree-isolation.js

@@ -109,12 +109,46 @@ export function withWorktreeIsolation(baseFactory, opts) {
             // down (core's hasDestroy() returns false for a plain base env). Behaviour identical to no wrapper.
             return baseFactory(ctx);
         }
+        // S3([2113] core 裁定的 server 半场):keep-if-changed 需要在保留分支跑 inner teardown(LSP evict
+        // 链等)而不跑 `git worktree remove` —— core addWorktree 把两者焊成一个复合 destroy 拆不开,所以在
+        // rootEnvAt 铸造点捕获 inner env 的**原** destroy 引用(per-mint 变量;core 稍后才把复合 destroy
+        // 装回同一对象上)。
+        let innerDestroy;
         const { env, worktreeDir } = await serialize(() => addWorktree(opts.baseEnvForGit, {
             repoRoot,
             sessionId: ctx.sessionId, // core sanitizes this into the worktree dir name (human-readable orphan diag)
-            rootEnvAt: opts.rootEnvAt,
+            rootEnvAt: async (dir) => {
+                const inner = await opts.rootEnvAt(dir);
+                const d = inner.destroy;
+                if (typeof d === "function")
+                    innerDestroy = d.bind(inner);
+                return inner;
+            },
             ...(opts.commit ? { commit: opts.commit } : {}),
         }));
+        // keep-if-changed 判定基点:mint 后立刻解析 worktree 的 HEAD(=detach 基点)。判定轴与 core Agent
+        // 车道逐字同款(subagent.js finish):dirty 文件 >0 ∥ base..HEAD commits >0 ⇒ changed。
+        let baseSha;
+        {
+            const r = await opts.baseEnvForGit.exec("git rev-parse HEAD", { cwd: worktreeDir });
+            if (r.ok && r.value.exitCode === 0)
+                baseSha = r.value.stdout.trim();
+        }
+        const isChanged = async () => {
+            // 判定失败 ⇒ 保守保留(Agent 车道 changed=true 缺省同款:删错=用户产出蒸发,留错=一个目录)。
+            const status = await opts.baseEnvForGit.exec("git status --porcelain", { cwd: worktreeDir });
+            if (!status.ok || status.value.exitCode !== 0)
+                return true;
+            const dirtyFiles = status.value.stdout.split("\n").filter((l) => l.trim() !== "").length;
+            if (dirtyFiles > 0)
+                return true;
+            if (baseSha === undefined)
+                return true;
+            const ahead = await opts.baseEnvForGit.exec(`git rev-list --count ${baseSha}..HEAD`, { cwd: worktreeDir });
+            if (!ahead.ok || ahead.value.exitCode !== 0)
+                return true;
+            return (parseInt(ahead.value.stdout.trim(), 10) || 0) > 0;
+        };
         opts.logger?.info?.("worktree_isolation_minted", {
             sessionId: ctx.sessionId,
             ...(ctx.taskId ? { taskId: ctx.taskId } : {}),
@@ -142,9 +176,30 @@ export function withWorktreeIsolation(baseFactory, opts) {
         // already reached; double/concurrent destroy is a legal Runner shape). The first call always goes through
         // coreDestroy (the inner env's own teardown must run).
         let destroyedOnce = false;
+        let keptOnce = false;
         env.destroy = () => serialize(async () => {
+            if (keptOnce)
+                return; // kept 是终态:二次 destroy 不得把保留的产出删掉
             if (destroyedOnce && !(await residue()))
-                return; // idempotent repeat — done is done
+                return; // idempotent repeat — done is done(原语义:残留时放行重试)
+            // S3 keep-if-changed:有改动(或判不出来)⇒ 保留目录+registration 给 userland verify+merge,
+            // 只跑 inner teardown(LSP evict/host 收尾;rootEnvAt 铸的是 persistent 形,不 rm 目录),
+            // 并披露坐标 —— 不披露的保留=只是换了个姿势的蒸发。残留检查在本分支让位:目录在=目的。
+            if (await isChanged()) {
+                keptOnce = true;
+                try {
+                    await innerDestroy?.();
+                }
+                finally {
+                    opts.logger?.info?.("worktree_kept", {
+                        worktreeDir,
+                        sessionId: ctx.sessionId,
+                        ...(ctx.taskId ? { taskId: ctx.taskId } : {}),
+                        note: "changes present — kept for verify/merge; remove with `git worktree remove` when done",
+                    });
+                }
+                return;
+            }
             await coreDestroy();
             destroyedOnce = true;
             if (!(await residue()))

package/dist/trace/core-keyset-guard.d.ts

@@ -18,7 +18,7 @@
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, TaskEvent } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId";
@@ -28,7 +28,7 @@ type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjec
 type AskProjected = "toolName" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName";
 type AskExcluded = "toolCallId" | "preview" | "principal" | "requiresRealApproval";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 export type CoreKeysetGuards = [_GuardNotification, _GuardBgNotif, _GuardRoster, _GuardAsk, _GuardTaskEvent];
 export {};

package/dist/trace/project.d.ts

@@ -185,6 +185,8 @@ export declare function taskNotificationEventData(ev: {
         }>;
         resumable?: boolean;
         completionId?: string;
+        error?: string;
+        errorCode?: string;
     };
     eventId?: string;
     parentToolCallId?: string;
@@ -250,6 +252,8 @@ export declare function brainStatusEventData(ev: {
     parentToolCallId?: string;
 }): Record<string, unknown>;
 export declare function compactedEventData(ev: {
+    eventId?: string;
+    parentToolCallId?: string;
     trigger?: string;
     tokensBefore?: number;
     preserved_segment?: {

package/dist/trace/project.js

@@ -198,6 +198,10 @@ export function taskNotificationEventData(ev) {
         ...(n.stoppedBy !== undefined ? { stoppedBy: n.stoppedBy } : {}),
         // P1-3(core 1.452):完成幂等锚 verbatim(消费端跨通路去重;[1925] 一轮批)。
         ...(n.completionId !== undefined ? { completionId: n.completionId } : {}),
+        // RB-386(core 2.4.0 wire note,2.5.0 提货收编):bg agent 失败面归因两键——error 是引擎侧
+        // 失败说明(可能含网络地址等)→ redactSecrets;errorCode 是机器码 verbatim。缺席=非失败帧。
+        ...(n.error !== undefined ? { error: redactSecrets(n.error) } : {}),
+        ...(n.errorCode !== undefined ? { errorCode: n.errorCode } : {}),
         // [1543]§二 server①:白名单滞后 core payload 四键补齐——
         //   source:external 通知来源标(caller 供 = UNTRUSTED)→ redactSecrets;
         //   exitCode:数值 verbatim(bash 腿);
@@ -312,6 +316,8 @@ export function compactedEventData(ev) {
         return Object.keys(out).length > 0 ? out : undefined;
     })();
     return {
+        ...(ev.eventId !== undefined ? { eventId: ev.eventId } : {}),
+        ...(ev.parentToolCallId !== undefined ? { parentToolCallId: ev.parentToolCallId } : {}),
         // 🔴 2026-07-25:这三处此前**违反本函数注释自己写的那条不变量**(「畸形字段不得上线,与 1.72 同类」)——
         //   ① `trigger`/`tokensBefore` 是**裸赋值**:`tokensBefore` 为 `NaN` 时 `JSON.stringify` 把它变成 **`null`**,
         //      于是压缩面板渲染成「压缩前 0 tokens」而不是「未知」;裸赋值还会留下 present-with-undefined 的键

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.8.0",
+  "version": "3.10.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^2.3.0",
+    "@sema-agent/core": "^2.5.0",
     "@sema-agent/registry-core": "^0.11.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",