@sema-agent/server 7.43.0 → 7.44.0

package/dist/observability/tool-trace.js

@@ -1,19 +1,4 @@
 import { redactSecrets } from "../trace/redact.js";
-/**
- * The gate sources core's `PermissionDeniedPayload.source` names. Treated as an OPEN enum on the WIRE
- * (a core newer than this build may send a word this table has never heard of — that must not explode
- * the Prometheus label set), but as a CLOSED SET against the core we compile with.
- *
- * 🔴 core 5.23.0([3372] 提货批件②):这张表**曾是手抄的**(`new Set([...五个字面量])`,与 core 的类型
- * 零编译期联系),于是 core 先加 `classifier`、又在 5.23.0(design/182 §7)加 `org` 时,两个**真词**都
- * 被静默折进了 `other`。那不是「少一个标签」——`permission_denied_total{source="other"}` 的告警语义是
- * 「引擎发了本 build 不认识的词,去对表」,真词混进来就把这个信号读废了,而 `org`(组织治理层的拒)
- * 恰恰是运维最该单独看见的一类。
- *
- * ⇒ 表改为 `Record<PermissionDeniedSource, true>` 穷举:**core 增删一个词,本表编译期先红**(闭集词表
- * 禁手抄、必须从 core 类型推导的成文纪律)。运行期配对锚在 `test/tool-trace.test.ts`(从装树 core 的
- * `.d.ts` 解析联合词表逐词断言),因为 vitest 走 esbuild 不查类型 —— 两道锚缺一不可。
- */
 const KNOWN_DENY_SOURCE_TABLE = {
     policy: true,
     hook: true,
@@ -23,21 +8,9 @@ const KNOWN_DENY_SOURCE_TABLE = {
     classifier: true,
     org: true,
 };
-/** 表内 ⇒ 收窄成 `PermissionDeniedSource`(类型守卫)。计量点用它判「这个词是不是本 build 认得的真词」。
- *  导出是为了让运行期锚(`test/tool-trace.test.ts`,从装树 core 的 `.d.ts` 解析真词表)**复用同一个谓词**
- *  —— 测试自己另写一份判据 = 又一张手抄表,正是本文件刚消灭的那个病。 */
 export function isKnownDenySource(v) {
     return typeof v === "string" && Object.hasOwn(KNOWN_DENY_SOURCE_TABLE, v);
 }
-/**
- * ALWAYS-ON gate-deny meter (goal B4, 2026-07-08): `permission_denied_total{source}` — how often the
- * adjudicate chain DENIES a tool call, by gate source. Deliberately SEPARATE from {@link createToolTracer}:
- * the tracer is a default-OFF diagnostic (TOOL_TRACE=true), but deny frequency is an operational/security
- * signal that must reach /metrics on every deployment — a spike in `source="policy"` means a task keeps
- * asking for something the operator forbids; `source="safety"`/`"shellGate"` spikes flag risky-command
- * pressure. main.ts composes this UNDER the tracer via composeHooks (both are void observers on the
- * permissionDenied slot, which composeHooks double-runs deployment-first).
- */
 export function createPermissionDeniedMeter(metrics) {
     return {
         permissionDenied(payload) {
@@ -45,34 +18,6 @@ export function createPermissionDeniedMeter(metrics) {
         },
     };
 }
-/**
- * prove-before-scale stopgap (design/50): a no-op observer hook that logs every tool call (pre + post)
- * to the worker log — INCLUDING resumed legs that `GET /v1/runs/:id/events` does NOT surface (the
- * streaming-resume observability gap, service[15] API request #2). Gated by `TOOL_TRACE=true`; OFF by
- * default (no prod noise).
- *
- * Why: a durable-HITL-gated coding task that keeps re-suspending is ambiguous from /events alone —
- * could be a model restart-on-resume loop (the SAME tool re-issued each resume) or slow legit iteration.
- * The pre-hook logs `{tool, id, arg:{path,contentLen,…}}` per call, so grepping `tool_trace` reconstructs
- * the full sequence: a repeated `write_file path=X contentLen=Y` across resumes ⇒ restart-loop;
- * write X → write Y → bash ⇒ iteration.
- *
- * Pure observation: every hook returns `undefined`, so it never rewrites args, never gates, never alters
- * the result (and per core's hooks invariant a hook's `allow` can't bypass the policy gate anyway).
- *
- * 🔴 core 5.20.0 起这条「纯观察」性质必须**声明**出来(`preToolUseObservational`),不能只写在注释里:
- * core 5.19.0 的委派折叠按「PreToolUse 席位在不在」把父的 screening 面折进子代的祖先约束链——它分不出
- * 诊断 tracer 与真裁决者。后果是**这个默认关的诊断旋钮**一开,该部署所有 hook-wired 父的 parked 子代
- * checkpoint 就记 `parentConstraintCount=2`,而跨副本赎回腿(`boot/parked-revive-gate.ts`)恒供 1 ⇒
- * core pre-CAS 响亮拒、行永久 pending(层数 park 时写死,事后关旋钮/重批/回滚都不改)。
- * 声明之后该面不铸链条目,count 回到 1,病路消灭。
- * ⛔ 打这个标的前提是**真的一条裁决都不出**:core 对声明了却返回判词的面是「拒绝采纳 + onError 告警」
- * (classification `observational-hook-verdict-ignored`),即判词被静默丢弃——把标打到会裁决的面上比原
- * 缺陷更坏。本文件三个 pre/post 回调恒返 `undefined`,`permissionDenied` 本就是 void 观察槽。
- * 📎 连带的**可观测**变化(不是回归):core 的「可写工具面无 effect-aware 门」启动告警此前把本 tracer
- * 算作一道门而被抑制;声明之后它不再算,于是「没配任何 policy 层 + 开着 TOOL_TRACE」的部署升级后会
- * 多出那行告警。方向正确——tracer 从来没有门住任何东西,原先的抑制本身就是一次静默 fail-open。
- */
 export function createToolTracer(logger) {
     return {
         preToolUseObservational: true,
@@ -90,10 +35,6 @@ export function createToolTracer(logger) {
             });
             return undefined;
         },
-        // core 1.252 (design/134) BREAKING: postToolUse and postToolUseFailure are MUTUALLY EXCLUSIVE — an
-        // isError result now fires ONLY this callback. Without it, every failed tool call silently vanished
-        // from the trace (the exact silent-fallback class this log exists to catch). Same line shape as the
-        // success path (phase "post", isError true) so existing `tool_trace` grep workflows keep working.
         postToolUseFailure(toolName, _input, failure, ctx) {
             logger.info("tool_trace", {
                 phase: "post",
@@ -106,12 +47,6 @@ export function createToolTracer(logger) {
             });
             return undefined;
         },
-        // core 1.257: the gate's DENY short-circuit never reaches postToolUse* (the call
-        // doesn't execute), so denied calls were INVISIBLE to this trace — the exact observability hole
-        // asked about. `source` = core's adjudicate-chain enum (the closed set is `KNOWN_DENY_SOURCE_TABLE`
-        // above — deliberately NOT re-listed here, a second hand-written copy is how the meter drifted); the
-        // deny `reason` can quote the adjudicated args (an approver's text, a policy message), so redact+clip
-        // like every other line. Same `tool_trace` key so existing grep workflows see denies in sequence.
         permissionDenied(payload) {
             logger.info("tool_trace", {
                 phase: "denied",
@@ -124,15 +59,11 @@ export function createToolTracer(logger) {
         },
     };
 }
-/** Compact, restart-diagnosable summary: key path/command fields + content length (not full content). */
 function summarize(input) {
     if (!input || typeof input !== "object")
         return { v: clip(String(input), 120) };
     const o = input;
     const s = {};
-    // Redact secrets BEFORE clipping: a traced `command`/`old_string` (e.g. `curl -H "Authorization: Bearer …"`,
-    // an edited .env line) can carry credentials into the worker log → its aggregation pipeline. TOOL_TRACE is a
-    // default-off diagnostic, but 120 chars is enough to hold a full token, so mask it.
     for (const k of ["path", "file_path", "command", "cmd", "pattern", "glob", "old_string", "new_string"]) {
         if (typeof o[k] === "string")
             s[k] = clip(redactSecrets(o[k]), 120);
@@ -146,7 +77,7 @@ function textOf(content) {
         .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
         .join("")
         .trim();
-    return clip(redactSecrets(text), 200); // tool output can echo a cat'd secret/credential — mask before logging
+    return clip(redactSecrets(text), 200);
 }
 function clip(s, n) {
     return s.length > n ? `${s.slice(0, n)}…(${s.length})` : s;

package/dist/orchestration/hardened-vm-runner.js

@@ -7,17 +7,7 @@ const DEFAULTS = {
     concurrency: 12,
     maxHeapMb: 128,
 };
-/** Own keys that carry a prototype-tampering gadget across the JSON membrane. */
 const PROTO_TAMPER_KEYS = ["__proto__", "constructor", "prototype"];
-/**
- * Recursively delete own `__proto__` / `constructor` / `prototype` keys from JSON-parsed data. Closes the
- * tampering gadget a script passes across the membrane: `Reflect.defineProperty(o, "__proto__",
- * {enumerable:true, value:{...}})` (Reflect is reachable; `codeGeneration:{strings:false}` does NOT block it)
- * makes `__proto__` an OWN ENUMERABLE key, which in-context `JSON.stringify` emits and host `JSON.parse`
- * re-materializes as a real own data property — feeding a host fn (or the returned result) a crafted
- * prototype a downstream deep-merge / key-assignment sink splats onto the HOST realm's `Object.prototype`
- * (process-wide, cross-tenant). Caught by the s8-sandbox-robustness marshal-bridge lens (core's battery + the
- * result-path probes both miss it). Apply ONLY to JSON.parse output (plain, acyclic, getter-free). */
 function scrubProtoDeep(value) {
     if (value === null || typeof value !== "object")
         return;
@@ -34,19 +24,6 @@ function scrubProtoDeep(value) {
         scrubProtoDeep(value[key]);
     }
 }
-/**
- * [1818]§二邻位 — script-realm rejection guard. The vm context shares the HOST isolate's unhandledRejection
- * machinery, and Node's default posture is CRASH: an untrusted script's un-awaited rejection (a bare
- * `(async () => { throw ... })()`, an un-awaited `agent()`/`phase()` whose body fails) would take the whole
- * server process down — a resource/availability hole, not a data-boundary one (clay's live incident hit the
- * sibling shape that HANGS instead of rejecting, which is the only reason it didn't crash). There is no
- * per-context hook in Node, so the guard is a process listener that tells realms apart by intrinsic:
- * a promise minted INSIDE the context fails `instanceof` against the HOST `Promise`. Context-realm rejections
- * are contained (logged, never fatal); host-realm rejections keep Node's fail-loud default (rethrown as an
- * uncaughtException) UNLESS the deployment installed its own handler — then we defer to it entirely.
- * Installed lazily on the first hardened run: only processes that actually execute untrusted scripts change
- * their global posture, and only then is the hazard live. Idempotent.
- */
 let rejectionGuardInstalled = false;
 export function installScriptRealmRejectionGuard() {
     if (rejectionGuardInstalled)
@@ -54,32 +31,24 @@ export function installScriptRealmRejectionGuard() {
     rejectionGuardInstalled = true;
     process.on("unhandledRejection", (reason, promise) => {
         if (!(promise instanceof Promise)) {
-            // cross-realm ⇒ minted in a vm context ⇒ an un-awaited rejection inside an untrusted script. Contain.
             const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
             try {
                 console.warn(`hardened-vm: un-awaited script rejection contained: ${summary}`);
             }
             catch {
-                /* the guard must never become a crash source itself */
             }
             return;
         }
-        // Host-realm: preserve fail-loud unless another handler exists (a deployment that installed one chose
-        // its own posture — a rethrow here would override that choice).
         if (process.listenerCount("unhandledRejection") > 1)
             return;
         throw reason;
     });
 }
-/** Host-side parse that strips the tampering gadget from data crossing INTO a host fn. */
 function sterilizingParse(json) {
     const parsed = JSON.parse(json);
     scrubProtoDeep(parsed);
     return parsed;
 }
-/** Marshal a (possibly live cross-realm) script value to PLAIN, sterilized host data: JSON round-trips it
- *  (firing in-context getters/toJSON harmlessly in-context → plain data; drops functions; no live context
- *  object with traps reaches the host) then strips the tampering gadget. Throws on a non-serializable result. */
 function marshalOut(value) {
     let json;
     try {
@@ -90,21 +59,14 @@ function marshalOut(value) {
     }
     return sterilizingParse(json === undefined ? "null" : json);
 }
-/**
- * The shared hardened-vm core. Builds the membrane, lets `buildGlobals` construct the context-local globals,
- * runs the untrusted `body` as an async function under the caps, and returns the MARSHALLED (plain, sterilized)
- * result. Both public surfaces delegate here.
- */
 async function runHardened(opts) {
     const cfg = { ...DEFAULTS, ...opts.limits };
     const { signal } = opts;
     if (signal?.aborted)
         throw new WorkflowScriptError("hardened-vm aborted before start");
     installScriptRealmRejectionGuard();
-    // 1. hardened context
     const sandbox = { __proto__: null };
     const ctx = vm.createContext(sandbox, { codeGeneration: { strings: false, wasm: false } });
-    // 2. determinism guard (resume-safety; matches CC): nondeterministic clocks/RNG throw in-context.
     vm.runInContext(`(() => {
        const block = (l) => { throw new Error(l + " is unavailable in workflow scripts (nondeterministic — breaks resume). Pass timestamps via args; vary by index for randomness."); };
        Date.now = () => block("Date.now()");
@@ -121,30 +83,17 @@ async function runHardened(opts) {
          globalThis[n] = () => noTimer(n + "()");
        }
      })()`, ctx);
-    // 3. membrane helpers (factory bodies COMPILED IN-CONTEXT → context-rooted prototypes)
     const ctxJsonParse = vm.runInContext("(s => JSON.parse(s))", ctx);
     const dataIn = (v) => {
-        // sterilize the gadget host-side BEFORE it re-materializes in-context (a __proto__ own key would otherwise
-        // pollute the CONTEXT's Object.prototype — sandboxed, but cheap to close).
         const clean = JSON.parse(JSON.stringify(v === undefined ? null : v));
         scrubProtoDeep(clean);
         return ctxJsonParse(JSON.stringify(clean));
     };
-    // a {ok,v} | {ok:false,err,name} JSON round-trip; the IN-CONTEXT wrapper throws a CONTEXT-LOCAL Error on
-    // failure so a host error never reaches the script (beyond-battery fix).
     const mkBridge = vm.runInContext(`(hostCall => async function (...a) {
        const r = JSON.parse(await hostCall(JSON.stringify(a)));
        if (r.ok) return r.v;
        const e = new Error(r.err); e.name = r.name || "Error"; throw e;
      })`, ctx);
-    // [1818]§二 — quiescence deadlock detector. Inside the membrane the ONLY way a suspended script can ever be
-    // resumed is a bridged host call settling: timers are blocked, there is no I/O, and every other await is a
-    // microtask chain that drains on its own. So "zero bridged calls in flight + the microtask AND macrotask
-    // queues have both drained + scriptPromise still pending" is not a heuristic — it PROVES the script can never
-    // progress again (clay's live shape: an un-awaited `const r = phase(...)` whose body returns `r` → a promise
-    // cycle that neither rejects nor resolves; pre-fix it burned the full totalTimeoutMs blind and then blamed
-    // the timeout). setImmediate (a macrotask) is the drain fence: any continuation the settling host call woke
-    // runs first, and a continuation that starts a new bridged call increments the counter synchronously.
     let inFlightHostCalls = 0;
     let scriptSettled = false;
     let fireDeadlock;
@@ -160,8 +109,6 @@ async function runHardened(opts) {
     const bridge = (hostFn) => mkBridge(async (argsJson) => {
         inFlightHostCalls++;
         try {
-            // sterilizingParse (not bare JSON.parse): strip a slipped-in __proto__/constructor/prototype gadget
-            // BEFORE the args reach the host fn — the dangerous (script→host) direction.
             const out = await hostFn(...sterilizingParse(argsJson));
             return JSON.stringify({ ok: true, v: out ?? null });
         }
@@ -178,7 +125,6 @@ async function runHardened(opts) {
         }
     });
     const membrane = { bridge, dataIn, ctxEval: (src) => vm.runInContext(src, ctx) };
-    // 4. expose the surface's context-local globals + run the body under the sync vm timeout
     for (const [name, value] of Object.entries(opts.buildGlobals(membrane)))
         sandbox[name] = value;
     let invocation;
@@ -188,14 +134,9 @@ async function runHardened(opts) {
     catch (err) {
         throw new WorkflowScriptError(`script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // `timeout` bounds the SYNCHRONOUS run up to the first await (a sync infinite loop is killed here); an async
-    // loop is bounded by the wall-clock race below.
     const scriptPromise = invocation.runInContext(ctx, { timeout: cfg.syncTimeoutMs });
     scriptPromise.then(() => (scriptSettled = true), () => (scriptSettled = true));
-    // Initial probe: a script that suspends without EVER touching the bridge (`await new Promise(() => {})`)
-    // never decrements the counter, so the settle-side probe alone would miss it.
     probeQuiescence();
-    // 5. wall-clock + external-abort + quiescence-deadlock race
     let timer;
     let onAbort;
     try {
@@ -208,24 +149,14 @@ async function runHardened(opts) {
                     onAbort = () => reject(new WorkflowScriptError("hardened-vm aborted"));
                     signal.addEventListener("abort", onAbort, { once: true });
                 }
-                // Diagnosis-first message: it reaches the model via failureSummary (bounded), so the self-correction
-                // hint has to be up front.
                 fireDeadlock = () => reject(new WorkflowScriptError("script deadlocked: no host call (agent/phase) in flight and nothing can resume the script — usually an un-awaited promise cycle, e.g. `const r = phase(...)` without await whose body reads `r`."));
             }),
         ]);
-        // hand the host PLAIN sterilized data, never a live cross-realm object (getter/toJSON/then traps) and
-        // never a slipped-in __proto__ (return-path tampering).
         return marshalOut(result);
     }
     catch (err) {
-        // Live dogfood catch 2026-07-03 ( `setTimeout` blew up as a bare "workflow failed"): a RUNTIME script-realm
-        // rejection (ReferenceError, an uncaught script throw, a bridged agent() error the script didn't catch) used
-        // to propagate UN-typed — `failureSummary` only surfaces the message for `workflow.*`-coded errors, so the model/
-        // operator got zero diagnosis. Wrap it as `workflow.script_error`; core's failureSummary already bounds (200
-        // chars) + `redactHostLeaks`-redacts the message before it reaches the notification, so a bridged host error
-        // message is safe to carry here.
         if (err instanceof WorkflowScriptError)
-            throw err; // compile/timeout/abort/marshal — already typed
+            throw err;
         throw new WorkflowScriptError(`script failed at runtime: ${err instanceof Error ? err.message : String(err)}`);
     }
     finally {
@@ -235,23 +166,6 @@ async function runHardened(opts) {
             signal.removeEventListener("abort", onAbort);
     }
 }
-/**
- * phases=[] ROOT CAUSE + fix — the SCOPED-PHASE GATE. The old in-context `phase` was pure sugar
- * (log a "◆ phase" line, run the body) that NEVER called the host `primitives.phase`, so core recorded ZERO
- * phase state: terminal rows had `phases: []` and agents carried no `phase` key (exactly the storage-row
- * autopsy — agents fine, phase accounting gone). The membrane's JSON bridge cannot carry the script's BODY
- * function across, so the bridge is split into three JSON-safe host calls, and the body stays IN-CONTEXT:
- *   - `mark(title)`  → `primitives.phase(title, undefined)` (core's bare CC-marker path);
- *   - `enter(title)` → opens core's scoped phase with a DEFERRED body (`await gate`), returns a numeric token.
- *     core pushes the phase record + sets `currentPhase` SYNCHRONOUSLY before its first await, so by the time
- *     `enter` returns, `agent()` calls made inside the VM body land with the right phase label;
- *   - `exit(token, ok, err?)` → releases the gate (ok → core closes the phase `completed`; !ok → the deferred
- *     body throws and core closes it `failed`), then awaits core's settle so the close is persisted before the
- *     VM continues.
- * A finalized-run `phase()` (core throws) surfaces on `enter` via the settled-race; an unknown/double `exit`
- * is idempotent. The VM wrapper rethrows the body's own error — the gate's synthetic error never reaches the
- * script.
- */
 export function scopedPhaseGate(phase) {
     let seq = 0;
     const open = new Map();
@@ -264,9 +178,7 @@ export function scopedPhaseGate(phase) {
                 if (!r.ok)
                     throw new Error(r.err ?? "phase body failed");
             }));
-            settled.catch(() => undefined); // the VM path rethrows the body's own error — never an unhandled rejection here
-            // Surface an IMMEDIATE rejection (core's finalized guard rejects before its first await settles) while a
-            // healthy still-pending phase resolves the race via the resolved sentinel.
+            settled.catch(() => undefined);
             await Promise.race([settled, Promise.resolve()]);
             const token = ++seq;
             open.set(token, { release, settled });
@@ -275,19 +187,13 @@ export function scopedPhaseGate(phase) {
         async exit(token, ok, err) {
             const o = open.get(token);
             if (!o)
-                return; // unknown/double exit — idempotent
+                return;
             open.delete(token);
             o.release({ ok, ...(err !== undefined ? { err } : {}) });
-            await o.settled.catch(() => undefined); // core closed + persisted the phase before the VM continues
+            await o.settled.catch(() => undefined);
         },
     };
 }
-/** Build the orchestration context-local globals (agent/parallel/pipeline/phase/log/budget/args) from the
- *  host {@link WorkflowPrimitives}. agent/log/phase are host-bridged (phase via the three-verb
- *  {@link scopedPhaseGate} — the body function itself never crosses the membrane); parallel/pipeline are
- *  in-context sugar; budget is a frozen null-proto object over host accessors.
- *  Exported so the worker-isolated runner (hardened-vm-worker.ts) reuses the EXACT same surface with
- *  IPC-backed primitives — one definition of the orchestration globals, no drift. */
 export function orchestrationGlobals(primitives, scriptArgs, limits = {}) {
     const cfg = { ...DEFAULTS, ...limits };
     return (m) => {
@@ -312,8 +218,6 @@ export function orchestrationGlobals(primitives, scriptArgs, limits = {}) {
            await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
            return out;
          })`)(cfg.concurrency);
-        // Phase-gate fix: REAL phase bridging via the three-verb gate (see scopedPhaseGate) — the old in-context sugar
-        // never told core a phase existed (phases:[] / label-less agents in every hardened-runner deployment).
         const gate = scopedPhaseGate((t, b) => primitives.phase(t, b));
         const phaseMark = m.bridge(async (title) => void (await primitives.phase(String(title), undefined)));
         const phaseEnter = m.bridge(async (title) => gate.enter(String(title)));
@@ -327,9 +231,6 @@ export function orchestrationGlobals(primitives, scriptArgs, limits = {}) {
         return { agent, parallel, pipeline, phase, log, budget, args: m.dataIn(scriptArgs) };
     };
 }
-/** Build the hardened-vm S8 `WorkflowScriptRunner` (TOC+TOB workflow orchestration). `safeForUntrustedScripts`
- *  is `true` — it has passed the conformance battery + robustness suite; the S8 gate mounts `run_workflow` only for
- *  a runner that asserts this. */
 export function createHardenedVmRunner(limits = {}) {
     const cfg = { ...DEFAULTS, ...limits };
     return {
@@ -342,25 +243,10 @@ export function createHardenedVmRunner(limits = {}) {
                 ...(signal ? { signal } : {}),
                 buildGlobals: orchestrationGlobals(primitives, scriptArgs, cfg),
             });
-            // `meta` is core-parsed (AST, not eval) but its values are LLM-controlled — sterilize it too.
             return { result, meta: marshalOut(meta) };
         },
     };
 }
-/**
- * General untrusted-code exec on the SAME hardened membrane — the TOC ephemeral execution sandbox. Runs
- * `code` (an async function body that may `return`) with ONLY the safe built-ins plus whatever host
- * capabilities the caller bridges via `bindings` (each MUST go through `m.bridge` / `m.dataIn` — never a raw
- * host reference). Returns the marshalled (plain, sterilized) result. With no `bindings`, the code is pure
- * computation (no host reach at all).
- *
- * @example
- *   const out = await runInHardenedVm({
- *     code: "return await fetchJson(args.url)",
- *     bindings: (m) => ({ fetchJson: m.bridge((u) => safeFetch(String(u))), args: m.dataIn({ url }) }),
- *     limits: { totalTimeoutMs: 5000 },
- *   });
- */
 export async function runInHardenedVm(opts) {
     return runHardened({
         body: opts.code,

package/dist/orchestration/hardened-vm-worker-runner.js

@@ -2,26 +2,9 @@ import { Worker } from "node:worker_threads";
 import { WorkflowScriptError } from "@sema-agent/core";
 import { scopedPhaseGate } from "./hardened-vm-runner.js";
 const DEFAULTS = { totalTimeoutMs: 600_000, syncTimeoutMs: 5_000, maxAgents: 1000, concurrency: 12, maxHeapMb: 128 };
-// Resolve the worker bootstrap next to this module. In a tsc build it's the sibling `.js`; under vitest/tsx
-// (this module's URL ends in `.ts`) point at the `.ts` and register tsx as the worker's loader so the worker
-// can import TypeScript. Prod (node dist/) never needs tsx.
 const IS_TS = import.meta.url.endsWith(".ts");
 const WORKER_URL = new URL(IS_TS ? "./hardened-vm-worker.ts" : "./hardened-vm-worker.js", import.meta.url);
 const WORKER_EXEC_ARGV = IS_TS ? ["--import", "tsx/esm"] : undefined;
-/**
- * Worker-isolated S8 hard runner (design/98 v2). Runs the hardened-vm membrane inside a `worker_thread`, adding
- * RESOURCE isolation on top of the in-process {@link import("./hardened-vm-runner.js").createHardenedVmRunner}'s
- * BOUNDARY isolation:
- *   - HEAP cap (`resourceLimits.maxOldGenerationSizeMb`): a runaway-allocation script OOMs the WORKER (an `error`
- *     event), never the shared main process — closes the in-process resource-exhaustion gap.
- *   - `terminate()` on wall-clock timeout / abort: kills a MICROTASK-starvation loop (`while(true){await null}`)
- *     the in-process wall-clock race cannot pre-empt (it starves its own event loop).
- *   - credential isolation: the worker gets only the script + args; `agent`/`log` IPC to the main thread (which
- *     holds the real Runner/DB/keys); a (validated-impossible) boundary crossing lands in a credential-free isolate.
- *
- * `safeForUntrustedScripts: true` — the membrane it runs is the conformance-validated + robustness-tested one. Use
- * this (over the in-process runner) for genuinely-untrusted multi-tenant scripts where resource isolation matters.
- */
 export function createWorkerHardenedVmRunner(limits = {}) {
     const cfg = { ...DEFAULTS, ...limits };
     return {
@@ -31,8 +14,6 @@ export function createWorkerHardenedVmRunner(limits = {}) {
                 return Promise.reject(new WorkflowScriptError("worker hardened-vm aborted before start"));
             return new Promise((resolve, reject) => {
                 const worker = new Worker(WORKER_URL, {
-                    // budgetSpent seeds the worker's cache with the CURRENT spend (core 1.238 wiring battery caught the
-                    // cold-start gap: a cache seeded 0 made remaining() read total until the first agent reply refreshed it).
                     workerData: { scriptSource, scriptArgs, limits: cfg, budgetTotal: primitives.budget.total, budgetSpent: primitives.budget.spent() },
                     resourceLimits: { maxOldGenerationSizeMb: cfg.maxHeapMb },
                     ...(WORKER_EXEC_ARGV ? { execArgv: WORKER_EXEC_ARGV } : {}),
@@ -45,7 +26,7 @@ export function createWorkerHardenedVmRunner(limits = {}) {
                         clearTimeout(timer);
                     if (signal)
                         signal.removeEventListener("abort", onAbort);
-                    void worker.terminate(); // hard-stops a starved/runaway worker; no-op if it already exited
+                    void worker.terminate();
                 };
                 const finish = (settle) => {
                     if (settled)
@@ -54,15 +35,10 @@ export function createWorkerHardenedVmRunner(limits = {}) {
                     cleanup();
                     settle();
                 };
-                // Wall-clock backstop (terminate). Grace over the in-worker totalTimeoutMs so the worker's CLEAN error
-                // (stuck host primitive) wins normally; terminate is the backstop for microtask-starvation.
                 timer = setTimeout(() => finish(() => reject(new WorkflowScriptError(`worker hardened-vm exceeded totalTimeoutMs (${cfg.totalTimeoutMs})`))), cfg.totalTimeoutMs + 1500);
                 timer.unref?.();
                 if (signal)
                     signal.addEventListener("abort", onAbort, { once: true });
-                // Phase-gate fix: the worker's phase IPC verbs land on the REAL primitives.phase via the same three-verb gate
-                // the in-process runner uses (the body function stays in the worker; only mark/enter/exit cross). Replies
-                // reuse the worker's id-keyed "agentResult" resolver (same shape — no second pending map in the worker).
                 const phaseGate = scopedPhaseGate((t, b) => primitives.phase(t, b));
                 const reply = (id, p) => void p.then((value) => worker.postMessage({ type: "agentResult", id, ok: true, value: value ?? null, budgetSpent: primitives.budget.spent() }), (e) => worker.postMessage({ type: "agentResult", id, ok: false, error: e instanceof Error ? e.message : String(e), name: e instanceof Error ? e.name : "Error", budgetSpent: primitives.budget.spent() }));
                 worker.on("message", (msg) => {
@@ -91,7 +67,6 @@ export function createWorkerHardenedVmRunner(limits = {}) {
                         finish(() => reject(new WorkflowScriptError(msg.message ?? "worker hardened-vm script failed")));
                     }
                 });
-                // An `error` event = an UNCAUGHT worker exception, most often the heap-cap OOM ("Reached heap limit").
                 worker.on("error", (err) => finish(() => reject(new WorkflowScriptError(`worker hardened-vm crashed (likely heap/OOM): ${err.message}`))));
                 worker.on("exit", (code) => {
                     if (!settled)

package/dist/orchestration/hardened-vm-worker.js

@@ -1,30 +1,13 @@
-/**
- * S8 hardened-vm WORKER bootstrap (design/98 v2 resource isolation). Runs inside a `worker_thread` spawned by
- * {@link import("./hardened-vm-worker-runner.js").createWorkerHardenedVmRunner}. The SAME hardened-vm membrane
- * ({@link runInHardenedVm} + {@link orchestrationGlobals}) executes the untrusted script HERE — so on top of
- * the membrane's BOUNDARY isolation we get the worker's RESOURCE isolation: a separate V8 isolate + heap (capped
- * by `resourceLimits.maxOldGenerationSizeMb` → a memory bomb OOMs the WORKER, not the shared main process) and
- * `terminate()` (the main thread kills a microtask-starvation / runaway loop the in-process wall-clock cannot).
- *
- * The worker holds NO credentials: `agent`/`log` are STUBS that IPC to the main thread (which runs the real
- * primitives with the real Runner/DB/model keys); `budget` reads a worker-local cache the main thread refreshes
- * on each agent reply. So even a (validated-impossible) membrane boundary crossing lands in a credential-free isolate.
- */
 import { parentPort, workerData } from "node:worker_threads";
 import { splitWorkflowMeta } from "@sema-agent/core";
-// Resolve the sibling membrane module with an EXPLICIT extension so it loads under both a tsc build (`.js`) and
-// tsx (`.ts`) — tsx does not map a `.js` specifier to `.ts` for a worker's static import. The template literal
-// keeps tsc from rejecting a literal `.ts` specifier; the cast restores the types.
 const ext = import.meta.url.endsWith(".ts") ? "ts" : "js";
 const { runInHardenedVm, orchestrationGlobals } = (await import(`./hardened-vm-runner.${ext}`));
 const port = parentPort;
 if (!port)
     throw new Error("hardened-vm-worker must run inside a worker_thread");
 const input = workerData;
-// agent: async IPC (request/response keyed by id) to the main thread's real primitive.
 let nextId = 0;
 const pending = new Map();
-// budget: worker-local cache the main thread refreshes (piggybacked on every agentResult).
 const budgetCache = { total: input.budgetTotal, spent: input.budgetSpent ?? 0 };
 port.on("message", (msg) => {
     if (msg.type !== "agentResult" || msg.id === undefined)
@@ -43,8 +26,6 @@ port.on("message", (msg) => {
         p.rej(e);
     }
 });
-// IPC-backed WorkflowPrimitives handed to orchestrationGlobals — agent/log/phase cross to the main thread;
-// budget is the live cache; parallel/pipeline are built in-context by orchestrationGlobals.
 const ipcCall = (type, extra) => new Promise((res, rej) => {
     const id = nextId++;
     pending.set(id, { res, rej });
@@ -58,14 +39,8 @@ const ipcPrimitives = {
         spent: () => budgetCache.spent,
         remaining: () => (budgetCache.total === null ? Infinity : budgetCache.total - budgetCache.spent),
     },
-    // never invoked (orchestrationGlobals builds parallel/pipeline in-context), but required by the type.
     parallel: async () => [],
     pipeline: async () => [],
-    // Phase-gate fix: phase accounting must reach the MAIN thread's real primitives (the old stub ran the body and told
-    // core nothing — phases:[] on every worker-isolated run). The body function cannot cross the IPC boundary, so
-    // the same three-verb protocol as the in-process gate: mark (bare) / enter→token / exit(token, ok, err).
-    // orchestrationGlobals' own gate wraps THIS phase — its deferred body resolves when the in-VM body settles,
-    // which chains 1:1 onto these IPC verbs (enter here ⇒ the main-side gate's enter; exit ⇒ its exit).
     phase: async (t, b) => {
         if (b === undefined) {
             await ipcCall("phaseMark", { title: String(t) });
@@ -82,7 +57,6 @@ const ipcPrimitives = {
                 await ipcCall("phaseExit", { token, ok: false, err: e instanceof Error ? e.message : String(e) });
             }
             catch {
-                /* exit is best-effort — the body's own error wins */
             }
             throw e;
         }
@@ -96,7 +70,6 @@ void (async () => {
             bindings: orchestrationGlobals(ipcPrimitives, input.scriptArgs, input.limits),
             limits: input.limits,
         });
-        // meta is core-parsed; JSON round-trip strips any slipped-in gadget before it crosses back via structuredClone.
         const safeMeta = JSON.parse(JSON.stringify(meta));
         port.postMessage({ type: "done", result, meta: safeMeta });
     }

package/dist/orchestration/subagent-steer.js

@@ -1,53 +1,13 @@
-/**
- * C2 (core 1.219) + design/122 (core 1.225) — the SERVICE-side registry for
- * STEERING and RESUMING a Task SUB-AGENT (a sync delegation spawned by the `Agent` tool), the sibling of
- * {@link import("./workflow-agent-steer.js").WorkflowAgentRegistry} for workflow agents.
- *
- * core emits a {@link SubagentSteerHandle} to the deployment's `RunInternals.onSubagentSpawn` sink the
- * moment a SYNC child spawns (the handle NEVER reaches the model). The service registers it under the
- * PARENT RUN's taskId so `POST /v1/runs/:runId/subagents/:target/{steer,resume}` can route into it.
- * Delivery is replica-local (the handle is an in-memory bridge, like `steerableRuns`); a cross-replica
- * steer/resume is an honest 409, never a silent drop.
- *
- * 🔴 LIFECYCLE (design/122 item ③ — the "不改必踩" change): handles are NO LONGER evicted on child settle.
- * `resume` is only legal AFTER the child settled (core rejects `steering.still_running` before), so a
- * settle-evicted registry would make resume structurally unreachable. Instead:
- *   - one handle PER parentToolCallId, NEWEST WINS (core D2: each resume re-emits a FRESH handle under the
- *     same id whose `settled` tracks the revived run — `Map.set` replace is exactly that contract);
- *   - handles live until the OWNING LEG ends (each run leg collects its `register()` unregister thunks and
- *     runs them in its finally — identity-guarded, so a suspend→fast-resume sibling leg's fresh handles are
- *     never clobbered by the old leg's teardown, mirroring the `steerableRuns` identity guard);
- *   - a per-run cap (oldest-evicted) bounds the map for a delegation-heavy parent (handles now outlive
- *     settle, so an unbounded list would grow for the whole run).
- * After the parent run ends core disposes the retain ledger anyway (abort in-flight resumes + release all),
- * so a post-teardown resume would only ever 409 — the eviction just keeps the map honest.
- *
- * Addressing: `target` matches `parentToolCallId` FIRST (spawn-time identity, unique per delegation), then
- * falls back to `agentName` (display name; two children of the same agent type collide → the route 409s
- * rather than steering/resuming an arbitrary sibling). Steer-in redaction is shared with the workflow route
- * (`redactSteerIn`) — one owner of the trust gate. 🔐 `handle.childSessionId` is a continuation
- * CAPABILITY: control-plane only — no route response may include it.
- *
- * SCOPE (core r1-M3): only SYNC delegations emit a handle — `run_in_background` children have neither steer
- * nor resume (poll/stop via TaskOutput/TaskStop; durable bg revival is a separate core item).
- */
-/** Per-run handle cap — handles now live until the leg ends (not settle), so bound the map. Oldest-evicted;
- *  256 mirrors the ToolDetachHub bound (a run with >256 live-or-resumable delegations is pathological). */
 export const SUBAGENT_HANDLES_PER_RUN_CAP = 256;
 export class SubagentSteerRegistry {
-    /** parent run taskId → (parentToolCallId → NEWEST handle). Map iteration order = insertion = age. */
     byRun = new Map();
-    /** Register a child handle under its parent run. SAME parentToolCallId replaces (core D2: a resume
-     *  re-emits a fresh handle for the revived run — newest wins). Returns an IDENTITY-GUARDED unregister
-     *  thunk: it removes the entry only while it still holds THIS handle (a fresh sibling-leg registration
-     *  under the same id survives the old leg's teardown). Call it at LEG END, not on settle (design/122 ③). */
     register(runId, handle) {
         let handles = this.byRun.get(runId);
         if (!handles) {
             handles = new Map();
             this.byRun.set(runId, handles);
         }
-        handles.delete(handle.parentToolCallId); // re-insert → moves to newest position (age = last registration)
+        handles.delete(handle.parentToolCallId);
         handles.set(handle.parentToolCallId, handle);
         if (handles.size > SUBAGENT_HANDLES_PER_RUN_CAP) {
             const oldest = handles.keys().next().value;
@@ -65,9 +25,6 @@ export class SubagentSteerRegistry {
             }
         };
     }
-    /** Resolve `runId` + `target` to its handle on this replica. Exact `parentToolCallId` match wins (unique —
-     *  newest-per-id by construction → count is 0|1); otherwise match by `agentName` (count may be >1 →
-     *  ambiguous, `handle` undefined → the route 409s). count=0 → no such child here. */
     resolve(runId, target) {
         const handles = this.byRun.get(runId);
         if (!handles || handles.size === 0)
@@ -78,7 +35,6 @@ export class SubagentSteerRegistry {
         const byName = [...handles.values()].filter((h) => h.agentName === target);
         return byName.length === 1 ? { handle: byName[0], count: 1 } : { count: byName.length };
     }
-    /** Total registered handles (test/observability). */
     get size() {
         let n = 0;
         for (const handles of this.byRun.values())