@sema-agent/client-core 0.16.0 → 0.16.2

package/README.md

@@ -23,7 +23,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.16.0
+**Version:** 0.16.2
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -220,6 +220,7 @@ public-surface guard checks that last one).
 | `scripts/run-print-bash-iserror-test.mjs` | The print lane's Bash `is_error` authority (structured over regex) |
 | `scripts/run-sdk-floor-test.mjs` | The SDK version floor — and, more to the point, that the *installed* type declarations still carry the keys this package reads |
 | `scripts/run-engine-vocab-floor-test.mjs` | Engine-mirrored vocabularies (structured card whitelist, self-reported tool face, control verbs, recogniser sets) against the *installed* `@sema-agent/core` |
+| `scripts/run-limits-env-failloud-test.mjs` | `SEMA_HEADLESS_*` env-lane limits reject invalid values as loudly as the flag lane (no silent "no budget" runs) |
 | `scripts/run-streamjson-timing-honesty-test.mjs` | Stream timing & terminal honesty ([2084]): held errored fs-write results release on model progress; a wall-clock stop maps to `error_during_execution` with a truthful salvage note; the synthetic API-error assistant row carries the `<synthetic>` in-message sentinel. Also ([2489], core 5.8.0): the run-limit `errorCode` -> CC subtype map is pinned code by code (`limits.max_{cost,turns,tokens,walltime}_exceeded`), token/wall-clock stops keep the text the engine already produced, and the `failed` event arm shares the one mapping point. The 5.7 dual-vocabulary legs retired with server 6.0.0 (which bundles core 5.8.0); four **retirement negative controls** stand in their place — the retired `status:'timeout'` and the retired codes must fall to the honest fallback subtype and must never drop back to an empty success, so putting any of them back turns the gate red |
 | `scripts/run-background-view-test.mjs` | `createBackgroundView` lifecycle: polling/notify pairing, per-source degrade (`501 → not-configured` vs `unavailable`), the capabilities `scheduler` probe, and dispose really aborting the in-flight fleet snapshot (pure projection lives in the pure suite's W-A segment) |
 | `scripts/run-fleet-view-keys-test.mjs` | The fleet projection views, **both directions**: `FleetTaskView`/`FleetWorkflowView` ⇄ their key lists (compile-pinned) ⇄ what a maximal/minimal row really projects, plus a wire-key coverage ledger (every `FleetTaskRow` key is either projected or carries a written reason why not) and a drift ledger against the shell's render contract. A one-directional assignability check is blind to optional keys — which is how `startedAt` was silently dropped |

package/dist/hitl/frameRouter.js

@@ -14,6 +14,27 @@ function rejectMessageForRender() {
 /** core 对被 gate/连坐 abort 的 call 铸的 tool_end 载体(逐字;desktop session-host 真引擎实测
  *  同款)——HOLD 谓词锚它做**精确等值**,普通工具错的输出是各自错误文案,永不进 HOLD。 */
 export const ENGINE_ABORT_TOOL_RESULT = 'Operation aborted';
+/**
+ * tool_end.output 的文本归一(P0 案B,2026-08-03,server 6.0.0 wire 实测):sync leg 的毒化帧
+ * `output` 不再是裸 string,而是 content-block 数组 `[{"type":"text","text":"Operation aborted"}]`
+ * (8790 裸引擎 POST /v1/tasks/stream 逐帧记录字节形)。abort 标记的**等值锚**必须先归一再比,
+ * 否则 6.0.0 下 hold-poison 臂全盲:毒化帧当场上屏 + generic-close 记 ended ⇒ decide 后重放的
+ * 真收口帧被 isEnded 早退去重 —— 「按 Yes 屏幕永远停在 Error: Operation aborted」整案复发。
+ * 只归一**判定**,帧本身一个字节不改;等值语义不放宽([2084]①-b 收窄仍然成立,负控见 gate ⑩)。
+ */
+function toolEndOutputText(output) {
+    if (typeof output === 'string')
+        return output;
+    if (!Array.isArray(output))
+        return undefined;
+    const parts = [];
+    for (const b of output) {
+        const bb = b;
+        if (bb?.type === 'text' && typeof bb.text === 'string')
+            parts.push(bb.text);
+    }
+    return parts.length > 0 ? parts.join('') : undefined;
+}
 // ── gate 词汇(两把刀共享)──────────────────────────────────────────────────────────────────────
 /** 工具名是不是 AskUserQuestion(空白/下划线/连字符与大小写都不敏感)。
  *  **宽口**:帧上的 `toolName` 位是 UNTRUSTED 的任意值,判据自己吃 `unknown`,本模块内部用。 */
@@ -81,7 +102,7 @@ function isGatedToolName(name) {
 function isGatedToolEnd(ev) {
     if (isGatedToolName(ev.toolName))
         return true;
-    return ev.output === ENGINE_ABORT_TOOL_RESULT;
+    return toolEndOutputText(ev.output) === ENGINE_ABORT_TOOL_RESULT;
 }
 /** done 帧的 AskUserQuestion park 形状(结构性读;别的终态一律 false)。 */
 function isAskGatePark(result) {
@@ -200,7 +221,8 @@ const TOOL_END_ARMS = [
         run(ev, callId, led) {
             if (ev.isError !== true || !isGatedToolEnd(ev))
                 return undefined;
-            if (ev.output !== ENGINE_ABORT_TOOL_RESULT)
+            // 6.0.0 wire:output 可为 content-block 数组形(见 toolEndOutputText 头注)—— 归一后仍做精确等值。
+            if (toolEndOutputText(ev.output) !== ENGINE_ABORT_TOOL_RESULT)
                 return undefined;
             led.hold(callId, ev); // park 毒化帧,先 HOLD(gate 定性前不渲 Error 卡)
             return { kind: 'skip' };

package/dist/limitsWire.d.ts

@@ -117,11 +117,21 @@ export type LimitsParseResult = {
  */
 export declare function parseLimitsArgv(argv: string[]): LimitsParseResult;
 /**
- * The settings-lane defaults. SILENT degrade on a bad value (batch-E triage shape — stricter than
- * scenarioWire's warn-and-ignore: a settings typo must neither brick nor spam every headless run).
- * SEMA_DEBUG surfaces the drop.
+ * The settings-lane defaults. FAIL-LOUD on a bad value (#132 / test [2508],2026-08-04,推翻旧
+ * batch-E「静默降级」形):设置了 SEMA_HEADLESS_* 却是非法值时,旧行为=不开 SEMA_DEBUG 完全无声、
+ * 按「无限期限」跑——用户以为设了预算,实际什么都没设,这正是 [honest-absence] 禁的那类静默谎报。
+ * 现与 flag 路径同拍响亮拒(同文案形,caller exit 1):配置错了要在第一次跑就知道,而不是在一个
+ * 本该 300s 停的任务跑了一夜之后。返回判别联合;唯一消费者是下面的 limitsForPrint(仓际零外部
+ * 消费,干净切不设兼容)。
  */
-export declare function headlessLimitsFromEnv(env?: EnvLike): HeadlessLimits | undefined;
+export type HeadlessEnvLimitsResult = {
+    ok: true;
+    limits: HeadlessLimits | undefined;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function headlessLimitsFromEnv(env?: EnvLike): HeadlessEnvLimitsResult;
 /**
  * Resolve the limits for a headless `-p` submit: explicit flags > settings env defaults > none
  * (= no stamp, today's behaviour). Merge is PER-KNOB: `--deadline 300` + SEMA_HEADLESS_MAX_TURNS=50

package/dist/limitsWire.js

@@ -165,44 +165,36 @@ export function parseLimitsArgv(argv) {
         flaggedFlags,
     };
 }
-/**
- * The settings-lane defaults. SILENT degrade on a bad value (batch-E triage shape — stricter than
- * scenarioWire's warn-and-ignore: a settings typo must neither brick nor spam every headless run).
- * SEMA_DEBUG surfaces the drop.
- */
 export function headlessLimitsFromEnv(env = hostEnv()) {
     const out = {};
     const dl = env[HEADLESS_DEADLINE_ENV]?.trim();
     if (dl) {
         const n = parseIntInDomain(dl, DEADLINE_SEC_MIN, DEADLINE_SEC_MAX);
-        if (n !== null)
-            out.maxWalltimeMs = n * SEC_TO_MS; // env 面同样是秒(变量名带 _SEC),换算同一口
-        else if (env.SEMA_DEBUG) {
-            // eslint-disable-next-line no-console
-            console.error(`[sema] ${HEADLESS_DEADLINE_ENV}="${dl}" is not an integer in ${DEADLINE_SEC_MIN}..${DEADLINE_SEC_MAX} — ignoring the settings default`);
+        if (n === null) {
+            return {
+                ok: false,
+                error: `Error: ${HEADLESS_DEADLINE_ENV}="${dl}" is not an integer in ${DEADLINE_SEC_MIN}..${DEADLINE_SEC_MAX} (seconds). Fix or unset it.`,
+            };
         }
+        out.maxWalltimeMs = n * SEC_TO_MS; // env 面同样是秒(变量名带 _SEC),换算同一口
     }
     const mt = env[HEADLESS_MAX_TURNS_ENV]?.trim();
     if (mt) {
         const n = parseIntInDomain(mt, MAX_TURNS_MIN, MAX_TURNS_MAX);
-        if (n !== null)
-            out.maxTurns = n;
-        else if (env.SEMA_DEBUG) {
-            // eslint-disable-next-line no-console
-            console.error(`[sema] ${HEADLESS_MAX_TURNS_ENV}="${mt}" is not a positive integer — ignoring the settings default`);
+        if (n === null) {
+            return { ok: false, error: `Error: ${HEADLESS_MAX_TURNS_ENV}="${mt}" is not a positive integer. Fix or unset it.` };
         }
+        out.maxTurns = n;
     }
     const mk = env[HEADLESS_MAX_TOKENS_ENV]?.trim();
     if (mk) {
         const n = parseIntInDomain(mk, MAX_TOKENS_MIN, MAX_TOKENS_MAX);
-        if (n !== null)
-            out.maxTokens = n;
-        else if (env.SEMA_DEBUG) {
-            // eslint-disable-next-line no-console
-            console.error(`[sema] ${HEADLESS_MAX_TOKENS_ENV}="${mk}" is not a positive integer — ignoring the settings default`);
+        if (n === null) {
+            return { ok: false, error: `Error: ${HEADLESS_MAX_TOKENS_ENV}="${mk}" is not a positive integer. Fix or unset it.` };
         }
+        out.maxTokens = n;
     }
-    return hasAnyLimit(out) ? out : undefined;
+    return { ok: true, limits: hasAnyLimit(out) ? out : undefined };
 }
 /**
  * Resolve the limits for a headless `-p` submit: explicit flags > settings env defaults > none
@@ -213,8 +205,11 @@ export function limitsForPrint(argv, env = hostEnv()) {
     const parsed = parseLimitsArgv(argv);
     if (!parsed.ok)
         return parsed;
+    // #132:env 面非法值与 flag 同拍响亮拒(见 headlessLimitsFromEnv 头注)。
     const fromEnv = headlessLimitsFromEnv(env);
-    const merged = { ...(fromEnv ?? {}), ...(parsed.limits ?? {}) };
+    if (!fromEnv.ok)
+        return { ok: false, error: fromEnv.error };
+    const merged = { ...(fromEnv.limits ?? {}), ...(parsed.limits ?? {}) };
     return { ok: true, ...(hasAnyLimit(merged) ? { limits: merged } : {}), flaggedFlags: parsed.flaggedFlags };
 }
 /** True when the engine version string satisfies the limits-wire minimum (≥1.196.0). Unparsable ⇒ false. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/client-core",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Client-side session runtime shared by every sema human client (TUI / web / desktop): sema wire frames (AgentEvent) -> CC session vocabulary (SDKMessage) with dual-plane output (transcript/chrome), deterministic transcript ids, lane discipline as a type, and the notification/dedup ledgers. Every CC-skin shape is collected here so the wire itself stays neutral. Blackboard [1832] design axioms; [1651]/[1652]/[1653] signed seam design. Renamed from @sema-agent/wire-cc-adapter (0.1.x).",
   "license": "MIT",
   "type": "module",