@sema-agent/client-core 0.100.0 → 0.102.0

package/dist/attachmentsWireCaps.js

@@ -1,6 +1,8 @@
 import { hostEnv } from './hostEnv.js';
 import { envFlagOff } from './envFlag.js';
 import { retiredAttachmentsKeyOf } from './taskRequestWords.js';
+import { looksLikeKnownSecret, REDACTION_MARKER_PREFIX } from './displayUntrusted.js';
+import { msg, renderMessage } from './i18n/translate.js';
 export const ATTACHMENTS_ENV = 'SEMA_ATTACHMENTS';
 export const ATTACHMENTS_SPEC_KEYS = Object.freeze([
     'todoReminder',
@@ -57,20 +59,38 @@ function refuse(token, why) {
 function deny(kind, token, why, index, key) {
     return { ok: false, refusal: { kind, token, why, entry: index + 1, key } };
 }
-function judgeAttachmentsEnv(raw) {
+const CREDENTIAL_TOKEN_PLACEHOLDER = `${REDACTION_MARKER_PREFIX}:secret\u00bb`;
+function credentialShapedWord(original) {
+    if (original === undefined || original.length === 0)
+        return false;
+    try {
+        const bare = original.replace(/^[+-]+/, '');
+        const eq = bare.indexOf('=');
+        return looksLikeKnownSecret(original) || looksLikeKnownSecret(bare) || (eq >= 0 && looksLikeKnownSecret(bare.slice(eq + 1)));
+    }
+    catch {
+        return false;
+    }
+}
+function judgeAttachmentsEnv(raw, original = raw) {
     if (envFlagOff(raw))
         return { ok: true, spec: allDefaultOnOff() };
     const tokens = raw.split(',').map(t => t.trim()).filter(t => t.length > 0);
+    const originals = original.split(',').map(t => t.trim()).filter(t => t.length > 0);
+    const denyAt = (kind, token, why, index, key) => deny(kind, credentialShapedWord(originals[index]) ? CREDENTIAL_TOKEN_PLACEHOLDER : token, why, index, key);
     for (const [i, token] of tokens.entries()) {
         const named = retiredAttachmentsKeyOf(token);
         if (named !== undefined)
-            return { ok: false, refusal: { kind: 'retired_key', token, why: named.why, entry: i + 1, key: named.key, retired: named } };
+            return { ok: false, refusal: { kind: 'retired_key', token: credentialShapedWord(originals[i]) ? CREDENTIAL_TOKEN_PLACEHOLDER : token, why: named.why, entry: i + 1, key: named.key, retired: named } };
     }
     if (tokens.length === 0)
         return { ok: true, spec: productDefaultAttachments() };
     if (tokens.length === 1 && (tokens[0] === 'full' || tokens[0] === 'all'))
         return { ok: true, spec: allLiteralTrue() };
     if (tokens.length === 1 && !isKnownToken(tokens[0])) {
+        if (credentialShapedWord(originals[0])) {
+            return deny('credential_shaped_word', CREDENTIAL_TOKEN_PLACEHOLDER, 'the value looks like a credential, not an attachments list', 0, undefined);
+        }
         return { ok: true, spec: productDefaultAttachments() };
     }
     const spec = {};
@@ -86,9 +106,9 @@ function judgeAttachmentsEnv(raw) {
         if (token.startsWith('-')) {
             const key = canonicalKey(token.slice(1));
             if (key === undefined)
-                return deny('unknown_key', token, 'unknown attachments key', i, undefined);
+                return denyAt('unknown_key', token, 'unknown attachments key', i, undefined);
             if (!isDefaultOnKey(key)) {
-                return deny('minus_on_literal_true_key', token, `"${key}" belongs to the literal-true family whose OFF is "delete the key", not "send false" ` +
+                return denyAt('minus_on_literal_true_key', token, `"${key}" belongs to the literal-true family whose OFF is "delete the key", not "send false" ` +
                     '(core wire contract, board [479] ask-2) — simply do not turn it on. ' +
                     `Only the core DEFAULT-ON keys (${ATTACHMENTS_DEFAULT_ON_KEYS.join(' / ')}) accept an explicit false`, i, key);
             }
@@ -98,34 +118,39 @@ function judgeAttachmentsEnv(raw) {
         const [lhs, rhs] = splitAssign(token);
         if (rhs !== undefined) {
             if (canonicalKey(lhs) !== 'todoReminderMode')
-                return deny('value_form_on_other_key', token, 'only `todoReminderMode` takes a `key=value` form', i, canonicalKey(lhs));
+                return denyAt('value_form_on_other_key', token, 'only `todoReminderMode` takes a `key=value` form', i, canonicalKey(lhs));
             const mode = TODO_REMINDER_MODES.find(v => v === rhs);
             if (mode === undefined)
-                return deny('todo_mode_bad_value', token, `todoReminderMode must be one of ${TODO_REMINDER_MODES.join('|')}`, i, 'todoReminderMode');
+                return denyAt('todo_mode_bad_value', token, `todoReminderMode must be one of ${TODO_REMINDER_MODES.join('|')}`, i, 'todoReminderMode');
             spec.todoReminderMode = mode;
             continue;
         }
         const key = canonicalKey(lhs.startsWith('+') ? lhs.slice(1) : lhs);
         if (key === undefined)
-            return deny('unknown_key', token, 'unknown attachments key', i, undefined);
+            return denyAt('unknown_key', token, 'unknown attachments key', i, undefined);
         if (isDefaultOnOnlyKey(key)) {
-            return deny('plus_on_default_on_key', token, `"${key}" is core DEFAULT-ON — turning it "on" is a no-op that would send a redundant true; ` + `use "-${key}" to turn it OFF`, i, key);
+            return denyAt('plus_on_default_on_key', token, `"${key}" is core DEFAULT-ON — turning it "on" is a no-op that would send a redundant true; ` + `use "-${key}" to turn it OFF`, i, key);
         }
         if (key === 'todoReminderMode')
-            return deny('todo_mode_needs_value', token, 'todoReminderMode needs a value: `todoReminderMode=baseline|off`', i, key);
+            return denyAt('todo_mode_needs_value', token, 'todoReminderMode needs a value: `todoReminderMode=baseline|off`', i, key);
         spec[key] = true;
     }
     return { ok: true, spec };
 }
-function envRawOf(env) {
-    return (env[ATTACHMENTS_ENV] ?? '').trim().toLowerCase();
+function envTextOf(env) {
+    const original = (env[ATTACHMENTS_ENV] ?? '').trim();
+    return { lower: original.toLowerCase(), original };
 }
 export function attachmentsForRequest(env = hostEnv()) {
-    const judged = judgeAttachmentsEnv(envRawOf(env));
+    const text = envTextOf(env);
+    const judged = judgeAttachmentsEnv(text.lower, text.original);
     if (!judged.ok)
         return refuse(judged.refusal.token, judged.refusal.why);
     return judged.spec;
 }
+function headWithCatalogLine(head, catalogLine) {
+    return `${head} ${catalogLine} ${attachmentsWayOut()}`;
+}
 function attachmentsWayOut() {
     const on = OPT_IN_KEYS.join(', ');
     const off = ATTACHMENTS_DEFAULT_ON_KEYS.join(', ');
@@ -141,6 +166,8 @@ function attachmentsRefusalSentence(r) {
             return `${head} names "${key}", a key that no longer exists — ${r.retired?.because ?? 'it was retired'}, and a request carrying that key is refused by the server. Remove that entry${r.retired === undefined ? '' : `; ${r.retired.remedy}`}. ${attachmentsWayOut()}`;
         case 'unknown_key':
             return `${head} is not an attachment this version knows. ${attachmentsWayOut()}`;
+        case 'credential_shaped_word':
+            return headWithCatalogLine(head, renderMessage(msg('config.attachments.refusal.credentialShapedWord')));
         case 'minus_on_literal_true_key':
             return key === 'todoReminderMode'
                 ? `${head} puts a minus on todoReminderMode, which is a setting with a value rather than something to turn off — write todoReminderMode=${TODO_REMINDER_MODES.join(' or todoReminderMode=')}, or leave it out of the list. A minus only works on ${ATTACHMENTS_DEFAULT_ON_KEYS.join(', ')}, which are on by default. ${attachmentsWayOut()}`
@@ -160,7 +187,8 @@ function attachmentsUnreadableSentence() {
 }
 export function attachmentsSubmitVerdict(env = hostEnv()) {
     try {
-        const judged = judgeAttachmentsEnv(envRawOf(env));
+        const text = envTextOf(env);
+        const judged = judgeAttachmentsEnv(text.lower, text.original);
         if (judged.ok)
             return { ok: true, attachments: judged.spec };
         return { ok: false, sentence: attachmentsRefusalSentence(judged.refusal), refusedKey: judged.refusal.key };

package/dist/callerCwdCapability.js

@@ -1,4 +1,4 @@
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader } from './engineCapReader.js';
 import { ownDataField, readOwnDataValue } from './ownKey.js';
 export function projectCallerCwdCapability(caps) {
@@ -18,7 +18,7 @@ const reader = createEngineCapReader({
     name: 'callerCwd',
     project: projectCallerCwdCapability,
 });
-export function observedCallerCwd(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedCallerCwd(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function callerCwdAdmitted(reading) {

package/dist/centerWiringCapability.js

@@ -1,5 +1,5 @@
 import { capForDisplay } from './fleetTaskDesc.js';
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { ownDataField } from './ownKey.js';
 const nonEmpty = (v) => typeof v === 'string' && v !== '';
@@ -95,7 +95,7 @@ const reader = createEngineCapReader({
     name: 'centerWiring',
     project: projectCenterWiringForCache,
 });
-export function observedCenterWiring(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedCenterWiring(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 function guarded(reading) {

package/dist/clockReading.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_CLOCK_READING_MS = 8640000000000000;
+export declare function usableClockMs(t: {} | null | undefined): number | null;

package/dist/clockReading.js

@@ -0,0 +1,4 @@
+export const MAX_CLOCK_READING_MS = 8.64e15;
+export function usableClockMs(t) {
+    return typeof t === 'number' && Number.isFinite(t) && Math.abs(t) <= MAX_CLOCK_READING_MS ? t : null;
+}

package/dist/cloudConfigWireCaps.d.ts

@@ -1,15 +1,17 @@
 import type { SkillSpec } from '@sema-agent/sdk';
 import type { McpServerSpec } from './mcpWireCaps.js';
 import type { EnvLike } from './hostEnv.js';
+import type { SkillToolListsReading } from './skillToolListsCapability.js';
 import type { McpEntryKeyIssue } from './generated/settingsSchemaTypes.js';
 export type { McpServerSpec };
 type Rec = Record<string, unknown>;
 export type { EnvLike };
-export type CloudMcpDropReason = 'disabled' | 'missing-field' | 'unknown-transport' | 'principal-and-assertion-header' | 'tool-axes-invalid' | 'elicitation-invalid' | 'name-unusable' | 'transport-invalid';
+export type CloudMcpDropReason = 'disabled' | 'missing-field' | 'unknown-transport' | 'principal-and-assertion-header' | 'tool-axes-invalid' | 'tool-faces-invalid' | 'elicitation-invalid' | 'allow-tools-invalid' | 'entry-unreadable' | 'name-unusable' | 'transport-invalid';
 export interface CloudMcpDroppedServer {
     name?: string;
     reason: CloudMcpDropReason;
     path?: string;
+    problem?: string;
 }
 export interface CloudMcpDegradedServer {
     name: string;
@@ -22,7 +24,16 @@ export interface CloudMcpProjection {
     degradedServers: CloudMcpDegradedServer[];
 }
 export declare function cloudMcpToSpecs(servers: unknown, env: EnvLike): CloudMcpProjection;
-export declare function cloudSkillsToSpecs(manifestSkills: unknown, resolveBody: (contentHash: string) => string | null): SkillSpec[];
+export interface CloudSkillsOptions {
+    readonly skillToolLists?: SkillToolListsReading;
+}
+export type CloudSkillDropReason = 'tool-list-invalid';
+export interface CloudSkillDropped {
+    readonly name: string;
+    readonly reason: CloudSkillDropReason;
+    readonly path: string;
+}
+export declare function cloudSkillsToSpecs(manifestSkills: unknown, resolveBody: (contentHash: string) => string | null, opts?: CloudSkillsOptions): SkillSpec[];
 export interface CloudModelRefIssue {
     readonly key: 'models' | 'roles' | 'atMention' | 'tierGroups' | 'activeTierGroup';
     readonly at?: string;
@@ -117,6 +128,7 @@ export interface CloudProjection {
     missingEnv: string[];
     scope: string;
     skillsMissingBody: string[];
+    droppedSkills: CloudSkillDropped[];
     droppedMcpServers: CloudMcpDroppedServer[];
     degradedMcpServers: CloudMcpDegradedServer[];
     droppedModels: CloudDroppedModel[];
@@ -126,12 +138,14 @@ export interface CloudProjection {
     runtimeCaps: CloudRuntimeCapsReading;
     modelRefIssues: CloudModelRefIssue[];
 }
-export declare function projectEffectiveBody(body: unknown, skillBodies: Record<string, string>, env: EnvLike, rostersValue?: unknown, opts?: CloudModelsDocOptions): CloudProjection;
+export declare function projectEffectiveBody(body: unknown, skillBodies: Record<string, string>, env: EnvLike, rostersValue?: unknown, opts?: CloudModelsDocOptions, skills?: CloudSkillsOptions): CloudProjection;
 export interface CloudEffectiveNotice {
     readonly level: 'warn' | 'info';
     readonly text: string;
 }
-export declare function cloudEffectiveNotices(p: Pick<CloudProjection, 'effectiveWarnings' | 'budget' | 'runtimeCaps' | 'modelRefIssues' | 'droppedMcpServers'> & {
+export interface CloudEffectiveNoticesOptionalInput {
     readonly mcp?: readonly McpServerSpec[];
     readonly degradedMcpServers?: readonly CloudMcpDegradedServer[];
-}): CloudEffectiveNotice[];
+    readonly droppedSkills?: readonly CloudSkillDropped[];
+}
+export declare function cloudEffectiveNotices(p: Pick<CloudProjection, 'effectiveWarnings' | 'budget' | 'runtimeCaps' | 'modelRefIssues' | 'droppedMcpServers'> & CloudEffectiveNoticesOptionalInput): CloudEffectiveNotice[];