@sema-agent/client-core 0.3.0 → 0.4.0

package/dist/permissionWireCaps.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/permissionWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/permissionWireCaps.ts — PURE CC permission-mode INTENT projection (R4, revised per the two-axis
+ * seamless principle). seamQuery imports it.
+ *
+ * 🔴 Design (memory seamless-two-axis-wire-principle): the frontend carries the RAW permission-mode INTENT; the
+ * SERVICE interprets it (axis-aware, tighten-only). We do NOT pre-interpret `plan → enablePlanMode+handsReadOnly`
+ * on the client — that bakes policy into one frontend and would drift between the TUI shell and the web portal.
+ * Instead we stamp `permissionMode` and let the service own the interpretation (plan ⇒ present_plan + read-only;
+ * acceptEdits/bypassPermissions ⇒ loosening, coerced to default engine-side, enforced client-side). This keeps the
+ * shell a thin per-turn intent projector that's identical across TOC-local / TOB-cloud / centralized-session axes.
+ *
+ * `auto`(分类器批3,黑板 [907] server 五模式表):server ≥1.209 coercePermissionMode 认 "auto"
+ * (解释 = default 同款 fs 写 ask 门;存活 ask 由引擎侧 auto-mode 分类器先行裁决——武装 AND 门
+ * RuntimeCaps.autoMode ∧ RunnerDeps.autoMode,缺一静默回 ask,fail-closed)。壳只透传意图,分类器
+ * 规则/权益都在装配面,非 TaskSpec 字段。版本安全:老 server coerce 未知非空词 → "default"
+ * (manual ask 门)= 只紧不松。
+ */
+export type PermissionMode = 'default' | 'plan' | 'acceptEdits' | 'bypassPermissions' | 'auto';
+export interface PermissionModeField {
+    permissionMode?: PermissionMode;
+}
+/**
+ * Project the client's permission mode → the wire intent. Carries any KNOWN non-`default` mode verbatim (the
+ * service interprets); `default`/unknown/undefined ⇒ no stamp (the deployment baseline governs). No policy baked
+ * here — relevance + tighten-only governance is the service's job.
+ *
+ * `stampDefault`([830]① server 1.191 五模式解释层):server 侧 absent-mode 不挂门(存量 headless
+ * 零回归),manual(=CC default)要挂 fs 写 ask 门必须显式 stamp `permissionMode:"default"`。只有
+ * 三选卡真能弹出来的调用方(交互 REPL,leader ToolUseConfirm 队列已注册)才传 true —— print/headless
+ * 不 stamp;老 server 对 "default" 走 basePolicy(与 absent 等价),version-safe。
+ */
+export declare function permissionModeField(mode: string | undefined, opts?: {
+    stampDefault?: boolean;
+}): PermissionModeField;

package/dist/permissionWireCaps.js

@@ -0,0 +1,46 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/permissionWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/permissionWireCaps.ts — PURE CC permission-mode INTENT projection (R4, revised per the two-axis
+ * seamless principle). seamQuery imports it.
+ *
+ * 🔴 Design (memory seamless-two-axis-wire-principle): the frontend carries the RAW permission-mode INTENT; the
+ * SERVICE interprets it (axis-aware, tighten-only). We do NOT pre-interpret `plan → enablePlanMode+handsReadOnly`
+ * on the client — that bakes policy into one frontend and would drift between the TUI shell and the web portal.
+ * Instead we stamp `permissionMode` and let the service own the interpretation (plan ⇒ present_plan + read-only;
+ * acceptEdits/bypassPermissions ⇒ loosening, coerced to default engine-side, enforced client-side). This keeps the
+ * shell a thin per-turn intent projector that's identical across TOC-local / TOB-cloud / centralized-session axes.
+ *
+ * `auto`(分类器批3,黑板 [907] server 五模式表):server ≥1.209 coercePermissionMode 认 "auto"
+ * (解释 = default 同款 fs 写 ask 门;存活 ask 由引擎侧 auto-mode 分类器先行裁决——武装 AND 门
+ * RuntimeCaps.autoMode ∧ RunnerDeps.autoMode,缺一静默回 ask,fail-closed)。壳只透传意图,分类器
+ * 规则/权益都在装配面,非 TaskSpec 字段。版本安全:老 server coerce 未知非空词 → "default"
+ * (manual ask 门)= 只紧不松。
+ */
+const KNOWN = new Set([
+    'default',
+    'plan',
+    'acceptEdits',
+    'bypassPermissions',
+    'auto',
+]);
+/**
+ * Project the client's permission mode → the wire intent. Carries any KNOWN non-`default` mode verbatim (the
+ * service interprets); `default`/unknown/undefined ⇒ no stamp (the deployment baseline governs). No policy baked
+ * here — relevance + tighten-only governance is the service's job.
+ *
+ * `stampDefault`([830]① server 1.191 五模式解释层):server 侧 absent-mode 不挂门(存量 headless
+ * 零回归),manual(=CC default)要挂 fs 写 ask 门必须显式 stamp `permissionMode:"default"`。只有
+ * 三选卡真能弹出来的调用方(交互 REPL,leader ToolUseConfirm 队列已注册)才传 true —— print/headless
+ * 不 stamp;老 server 对 "default" 走 basePolicy(与 absent 等价),version-safe。
+ */
+export function permissionModeField(mode, opts) {
+    if (typeof mode === 'string' && mode !== 'default' && KNOWN.has(mode)) {
+        return { permissionMode: mode };
+    }
+    if (opts?.stampDefault === true && (mode === undefined || mode === 'default')) {
+        return { permissionMode: 'default' };
+    }
+    return {};
+}

package/dist/promptProfileWireCaps.d.ts

@@ -0,0 +1,17 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/promptProfileWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/promptProfileWireCaps.ts — PURE projection: the shell's prompt-profile pick → the
+ * `TaskRequest.promptProfile` axis (core 1.328 [1144]: CC LT(model_id)-同构的呈现轴,
+ * "simple"=CC 对 BYOM id 发的短形面(引擎缺省)/"classic"=长形面,按任务/模型可切)。
+ *
+ * Config source: env `SEMA_PROMPT_PROFILE`(A/B 与手选口;center 下发面走引擎侧 TaskSpec 直通,
+ * 不经此位)。STRICT allowlist:仅 "simple"/"classic"(大小写不敏感,trim)stamp;其它/缺省 ⇒
+ * `undefined`(不 stamp=引擎缺省 simple,请求形状不变——additive 纪律与 retainBackgroundWireCaps
+ * 同款)。CALLER 前置 live 门(mock 形不变)。
+ */
+import { type EnvLike } from './hostEnv.js';
+export declare const PROMPT_PROFILE_ENV: "SEMA_PROMPT_PROFILE";
+export type PromptProfile = 'simple' | 'classic';
+export declare function promptProfileFromEnv(env?: EnvLike): PromptProfile | undefined;

package/dist/promptProfileWireCaps.js

@@ -0,0 +1,20 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/promptProfileWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/promptProfileWireCaps.ts — PURE projection: the shell's prompt-profile pick → the
+ * `TaskRequest.promptProfile` axis (core 1.328 [1144]: CC LT(model_id)-同构的呈现轴,
+ * "simple"=CC 对 BYOM id 发的短形面(引擎缺省)/"classic"=长形面,按任务/模型可切)。
+ *
+ * Config source: env `SEMA_PROMPT_PROFILE`(A/B 与手选口;center 下发面走引擎侧 TaskSpec 直通,
+ * 不经此位)。STRICT allowlist:仅 "simple"/"classic"(大小写不敏感,trim)stamp;其它/缺省 ⇒
+ * `undefined`(不 stamp=引擎缺省 simple,请求形状不变——additive 纪律与 retainBackgroundWireCaps
+ * 同款)。CALLER 前置 live 门(mock 形不变)。
+ */
+import { hostEnv } from './hostEnv.js';
+export const PROMPT_PROFILE_ENV = 'SEMA_PROMPT_PROFILE';
+export function promptProfileFromEnv(env = hostEnv()) {
+    const raw = env[PROMPT_PROFILE_ENV];
+    const s = typeof raw === 'string' ? raw.trim().toLowerCase() : '';
+    return s === 'simple' || s === 'classic' ? s : undefined;
+}

package/dist/retainBackgroundWireCaps.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/retainBackgroundWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/retainBackgroundWireCaps.ts — PURE projection: the shell's "retain background processes past
+ * task teardown" opt-in → the TOP-LEVEL `TaskRequest.retainBackgroundProcesses` boolean the SERVICE consumes
+ * (spec-fields.js `retainBackgroundProcessesFromBody`: `raw !== true` ⇒ dropped;requirePrincipal 多租户形
+ * 服务端另有门)。Mirrors selfOrchestrationWireCaps(the verified top-of-body wire pattern)。
+ *
+ * 背景([1046] 核谳,TB [991]② reap 族):core 直跑腿(sema-tb)出厂显式
+ * `retainBackgroundProcesses:true`(design/128 T1-1——「交付存活服务」任务的 verifier 在进程退出后
+ * 才连接),而组合腿产品曾默认关 ⇒ 两腿在 reap 族不是同一场考试。
+ *
+ * ⚠️ 缺省已翻转为 ON(clay 亲报「后台 shell 命令跑到一半被杀」案,2026-07-26;[1046]④ 的裁量件本次
+ * 由真实场景需求兑现)。缺省不发时,引擎 turn finally 的**两道门**都关着:
+ *   ① `settleKilledForOwner({retainProcesses})` 的 retain 豁免;
+ *   ② `retainBgBySpec = spec.retainBackgroundProcesses === true && !ownedEnvDying` —— 为真才整块跳过
+ *      `bgEnv.disposeBackgroundShells(...)`(该 blanket sweep 不经 task-registry,故被它收掉的任务
+ *      `stopSource` 为空,终态归因落到 `stoppedBy = "system"` 缺省 = clay 观察到的 `stopped-by: system`)。
+ *
+ * 三问(宪法 NO-SHIP 检查):
+ *   谁需要:真人用户 —— `run_in_background` 起的构建/测试/服务在当轮结束后必须还活着,否则
+ *           BashOutput/TaskOutput 续读到的是尸体(clay 案:输出文件 0 字节 + status killed)。
+ *   谁受害:隔离执行环境(e2b/k8s/ssh 等 `isIsolated(env)`)—— 那里 `ownedEnvDying` 为真,retain 被
+ *           **无条件覆盖**(core 侧 `!opts.envDying` / `&& !ownedEnvDying`),进程随宿主一起走。这是
+ *           正确的:进程宿主没了,留 handle 无意义。故本翻转对隔离腿零语义变化。
+ *           次级受害面 = 本机资源泄漏(后台进程活过当轮)—— 但这正是 CC 的既定契约,不是回归。
+ *   补偿机制:`SEMA_RETAIN_BACKGROUND=0|false|no|off` 逃生口 ⇒ 不 stamp ⇒ 回引擎缺省 reap;
+ *           进程始终可由 KillShell/TaskStop 显式收,`/bashes` 面板可见可停;引擎 hard-wall
+ *           (defaultBgTimeoutSec 30min / maxBgTimeoutSec 2h)仍是兜底上限。
+ *
+ * CC 逐字锚(对标纲领 = 100% 达 CC 效果):CC 的 Bash `run_in_background` 契约 = 进程活过当轮,
+ * 由 BashOutput 续读、KillShell 显式收 —— **不在 turn 边界回收**。缺省 reap 是对 CC 的偏离,本次钉回。
+ *
+ * 语义:缺省 ON —— unset / 未识别值 ⇒ `true`(stamp);显式 truthy(1/true/yes/on)⇒ `true`;
+ * 只有显式 falsy(0/false/no/off)⇒ `undefined`(不 stamp ⇒ 引擎缺省 reap)。
+ * 服务端 `retainBackgroundProcessesFromBody` 是 `raw !== true ⇒ 丢弃` 的严格刻度,所以 opt-out 一律
+ * 表达为**不 stamp**,绝不发 `false`(形状诚实)。
+ * PURE — callers pass `env`;caller gates to LIVE mode(mock request shape 不变)。
+ */
+import { type EnvLike } from './hostEnv.js';
+/** The env key the shell reads(SEMA_ 命名空间,与引擎自己的 spec∨env 通道正交——这里是壳→
+ *  TaskRequest 的 per-request 意图面,非引擎部署面)。 */
+export declare const RETAIN_BACKGROUND_ENV: "SEMA_RETAIN_BACKGROUND";
+/**
+ * ENV source → `true`(缺省 ON = CC `run_in_background` 契约:后台进程活过当轮),
+ * 只有显式 falsy 逃生口(`SEMA_RETAIN_BACKGROUND=0|false|no|off`)⇒ `undefined`(不 stamp ⇒ 引擎缺省 reap)。
+ * 返回型刻意是 `true | undefined` —— 服务端 `raw !== true ⇒ 丢弃`,opt-out 只能表达为「不 stamp」。
+ */
+export declare function retainBackgroundFromEnv(env?: EnvLike): true | undefined;

package/dist/retainBackgroundWireCaps.js

@@ -0,0 +1,58 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/retainBackgroundWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/retainBackgroundWireCaps.ts — PURE projection: the shell's "retain background processes past
+ * task teardown" opt-in → the TOP-LEVEL `TaskRequest.retainBackgroundProcesses` boolean the SERVICE consumes
+ * (spec-fields.js `retainBackgroundProcessesFromBody`: `raw !== true` ⇒ dropped;requirePrincipal 多租户形
+ * 服务端另有门)。Mirrors selfOrchestrationWireCaps(the verified top-of-body wire pattern)。
+ *
+ * 背景([1046] 核谳,TB [991]② reap 族):core 直跑腿(sema-tb)出厂显式
+ * `retainBackgroundProcesses:true`(design/128 T1-1——「交付存活服务」任务的 verifier 在进程退出后
+ * 才连接),而组合腿产品曾默认关 ⇒ 两腿在 reap 族不是同一场考试。
+ *
+ * ⚠️ 缺省已翻转为 ON(clay 亲报「后台 shell 命令跑到一半被杀」案,2026-07-26;[1046]④ 的裁量件本次
+ * 由真实场景需求兑现)。缺省不发时,引擎 turn finally 的**两道门**都关着:
+ *   ① `settleKilledForOwner({retainProcesses})` 的 retain 豁免;
+ *   ② `retainBgBySpec = spec.retainBackgroundProcesses === true && !ownedEnvDying` —— 为真才整块跳过
+ *      `bgEnv.disposeBackgroundShells(...)`(该 blanket sweep 不经 task-registry,故被它收掉的任务
+ *      `stopSource` 为空,终态归因落到 `stoppedBy = "system"` 缺省 = clay 观察到的 `stopped-by: system`)。
+ *
+ * 三问(宪法 NO-SHIP 检查):
+ *   谁需要:真人用户 —— `run_in_background` 起的构建/测试/服务在当轮结束后必须还活着,否则
+ *           BashOutput/TaskOutput 续读到的是尸体(clay 案:输出文件 0 字节 + status killed)。
+ *   谁受害:隔离执行环境(e2b/k8s/ssh 等 `isIsolated(env)`)—— 那里 `ownedEnvDying` 为真,retain 被
+ *           **无条件覆盖**(core 侧 `!opts.envDying` / `&& !ownedEnvDying`),进程随宿主一起走。这是
+ *           正确的:进程宿主没了,留 handle 无意义。故本翻转对隔离腿零语义变化。
+ *           次级受害面 = 本机资源泄漏(后台进程活过当轮)—— 但这正是 CC 的既定契约,不是回归。
+ *   补偿机制:`SEMA_RETAIN_BACKGROUND=0|false|no|off` 逃生口 ⇒ 不 stamp ⇒ 回引擎缺省 reap;
+ *           进程始终可由 KillShell/TaskStop 显式收,`/bashes` 面板可见可停;引擎 hard-wall
+ *           (defaultBgTimeoutSec 30min / maxBgTimeoutSec 2h)仍是兜底上限。
+ *
+ * CC 逐字锚(对标纲领 = 100% 达 CC 效果):CC 的 Bash `run_in_background` 契约 = 进程活过当轮,
+ * 由 BashOutput 续读、KillShell 显式收 —— **不在 turn 边界回收**。缺省 reap 是对 CC 的偏离,本次钉回。
+ *
+ * 语义:缺省 ON —— unset / 未识别值 ⇒ `true`(stamp);显式 truthy(1/true/yes/on)⇒ `true`;
+ * 只有显式 falsy(0/false/no/off)⇒ `undefined`(不 stamp ⇒ 引擎缺省 reap)。
+ * 服务端 `retainBackgroundProcessesFromBody` 是 `raw !== true ⇒ 丢弃` 的严格刻度,所以 opt-out 一律
+ * 表达为**不 stamp**,绝不发 `false`(形状诚实)。
+ * PURE — callers pass `env`;caller gates to LIVE mode(mock request shape 不变)。
+ */
+import { hostEnv } from './hostEnv.js';
+/** The env key the shell reads(SEMA_ 命名空间,与引擎自己的 spec∨env 通道正交——这里是壳→
+ *  TaskRequest 的 per-request 意图面,非引擎部署面)。 */
+export const RETAIN_BACKGROUND_ENV = 'SEMA_RETAIN_BACKGROUND';
+/** FALSY spellings that opt OUT (case-insensitive, trimmed). Conservative allowlist —— 只有这些
+ *  拼写能关掉 retain;其它一切(含未识别值/空串)落缺省 ON,绝不静默 opt-out。 */
+function isFalsy(v) {
+    const s = typeof v === 'string' ? v.trim().toLowerCase() : '';
+    return s === '0' || s === 'false' || s === 'no' || s === 'off';
+}
+/**
+ * ENV source → `true`(缺省 ON = CC `run_in_background` 契约:后台进程活过当轮),
+ * 只有显式 falsy 逃生口(`SEMA_RETAIN_BACKGROUND=0|false|no|off`)⇒ `undefined`(不 stamp ⇒ 引擎缺省 reap)。
+ * 返回型刻意是 `true | undefined` —— 服务端 `raw !== true ⇒ 丢弃`,opt-out 只能表达为「不 stamp」。
+ */
+export function retainBackgroundFromEnv(env = hostEnv()) {
+    return isFalsy(env[RETAIN_BACKGROUND_ENV]) ? undefined : true;
+}

package/dist/rewindWireCaps.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/rewindWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/rewindWireCaps.ts — PURE CC Rewind (E18) field projection (no deps, testable). seamQuery imports it.
+ *
+ * Maps the CC /rewind MessageSelector modes → the engine's rewind fields (SDK TaskRequest, core 1.166.0;
+ * resumeAtMode: core 1.292 [833]):
+ *   both         = { resumeAt, resumeAtMode:"before", rewindFiles:true }   fork BEFORE the user message + tree
+ *   conversation = { resumeAt, resumeAtMode:"before" }                     fork BEFORE the user message only
+ *   code         = { rewindFilesTo }                restore the tree only, NO conversation fork (no setLeafId)
+ * The target is a USER-MESSAGE SessionTreeEntry.id (server anchors user-message boundaries). Plus the per-turn
+ * CAPTURE stamp (rewindFiles:true on a normal turn) so the engine snapshots the tree (else nothing to restore).
+ *
+ * resumeAtMode "before"(排他截,core 1.292):CC /rewind 的语义是「回到发这条消息之前」——被选中的
+ * user message 回填输入框、从对话里移除;engine 侧对应 setLeafId(entry.parentId)。旧的含目标(inclusive
+ * "at")形状会把该 user message 留在引擎历史里 → 模型仍记得(暗号复现 bug)。老 server 未透传该字段时
+ * 行为退回含目标(version-safe,无回归——等 server 透传)。
+ */
+/** A one-shot rewind RESTORE instruction (or the per-turn capture stamp) projected onto a request. */
+export interface SeamRewindSpec {
+    resumeAt?: string;
+    /** core 1.292([833]):"before" = 排他截(setLeafId(entry.parentId));缺省 "at" = 含目标。 */
+    resumeAtMode?: 'at' | 'before';
+    rewindFiles?: boolean;
+    rewindFilesTo?: string;
+}
+/** The CC /rewind restore modes that hit the engine (summarize = compact, handled elsewhere). */
+export type RewindMode = 'both' | 'conversation' | 'code';
+/** Build the engine rewind fields for a chosen mode + target user-message entryId. */
+export declare function rewindSpecForMode(mode: RewindMode, targetEntryId: string): SeamRewindSpec;
+/**
+ * PURE projection (no state): an armed one-shot RESTORE wins; else the per-turn CAPTURE stamp (when enabled);
+ * else nothing. The caller consumes (clears) the arm after a restore.
+ */
+export declare function projectRewind(pending: SeamRewindSpec | undefined, captureEnabled: boolean): SeamRewindSpec;

package/dist/rewindWireCaps.js

@@ -0,0 +1,41 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/rewindWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/rewindWireCaps.ts — PURE CC Rewind (E18) field projection (no deps, testable). seamQuery imports it.
+ *
+ * Maps the CC /rewind MessageSelector modes → the engine's rewind fields (SDK TaskRequest, core 1.166.0;
+ * resumeAtMode: core 1.292 [833]):
+ *   both         = { resumeAt, resumeAtMode:"before", rewindFiles:true }   fork BEFORE the user message + tree
+ *   conversation = { resumeAt, resumeAtMode:"before" }                     fork BEFORE the user message only
+ *   code         = { rewindFilesTo }                restore the tree only, NO conversation fork (no setLeafId)
+ * The target is a USER-MESSAGE SessionTreeEntry.id (server anchors user-message boundaries). Plus the per-turn
+ * CAPTURE stamp (rewindFiles:true on a normal turn) so the engine snapshots the tree (else nothing to restore).
+ *
+ * resumeAtMode "before"(排他截,core 1.292):CC /rewind 的语义是「回到发这条消息之前」——被选中的
+ * user message 回填输入框、从对话里移除;engine 侧对应 setLeafId(entry.parentId)。旧的含目标(inclusive
+ * "at")形状会把该 user message 留在引擎历史里 → 模型仍记得(暗号复现 bug)。老 server 未透传该字段时
+ * 行为退回含目标(version-safe,无回归——等 server 透传)。
+ */
+/** Build the engine rewind fields for a chosen mode + target user-message entryId. */
+export function rewindSpecForMode(mode, targetEntryId) {
+    switch (mode) {
+        case 'both':
+            return { resumeAt: targetEntryId, resumeAtMode: 'before', rewindFiles: true };
+        case 'conversation':
+            return { resumeAt: targetEntryId, resumeAtMode: 'before' };
+        case 'code':
+            return { rewindFilesTo: targetEntryId };
+    }
+}
+/**
+ * PURE projection (no state): an armed one-shot RESTORE wins; else the per-turn CAPTURE stamp (when enabled);
+ * else nothing. The caller consumes (clears) the arm after a restore.
+ */
+export function projectRewind(pending, captureEnabled) {
+    if (pending)
+        return { ...pending };
+    if (captureEnabled)
+        return { rewindFiles: true };
+    return {};
+}

package/dist/selfOrchestrationWireCaps.d.ts

@@ -0,0 +1,40 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/selfOrchestrationWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/selfOrchestrationWireCaps.ts — PURE projection: the shell's "enable the LLM-authored workflow engine"
+ * opt-in → the TOP-LEVEL `TaskRequest.selfOrchestration` boolean the SERVICE consumes. Mirrors webSearchWireCaps.ts
+ * (the verified wire pattern), but the field rides at the TOP of the body (not under `settings`).
+ *
+ * The SERVICE reads `body.selfOrchestration` STRICTLY (ai-agent-service task-workflow.ts `selfOrchestrationFromBody`:
+ * `body.selfOrchestration !== true` ⇒ dropped) → core `TaskSpec.selfOrchestration`, the gate that MOUNTS core's
+ * LLM-authored `run_workflow` engine (the workflow.ts agent/parallel/pipeline/phase/nested orchestrator). The
+ * service then gates it on the DEPLOYMENT's `SELF_ORCHESTRATION_ENABLED` (else a harmless no-op, dropped) + the
+ * MULTI-TENANT per-principal entitlement RESOLVER (fail-closed: no resolver ⇒ dropped); a single-user worker honors
+ * it directly. So the shell's job is ONLY to STAMP the intent when the user opted in — the service owns every gate.
+ * We mirror the service's strict `=== true` semantics here: only an explicit truthy env opt-in returns `true`;
+ * everything else returns `undefined` (⇒ NO stamp ⇒ the engine never mounts run_workflow ⇒ default behaviour
+ * unchanged, exactly like an absent webSearch config).
+ *
+ * Config source (clay 决定 2026-07-01 §4 — DEFAULT-ON,opt-out):
+ *   - DEFAULT ON: unset / 其它 ⇒ stamp `selfOrchestration:true`(RunWorkflow 默认可用,体验像 CC 超集)。
+ *   - ENV opt-OUT: `SEMA_SELF_ORCHESTRATION=0/false/no/off` ⇒ undefined(no stamp)。
+ *
+ * 前身是 opt-in(parity-safe 保守默认 OFF);clay 拍 §4 后翻转为默认 ON(TOC 单用户本机无 entitlement 顾虑,
+ * 引擎侧 SELF_ORCHESTRATION_ENABLED 也在 assembleChildEnv 默认开)。可后续接 settings.json 驱动,这里仍是单一投影点。
+ *
+ * PURE — no env/file IO of its OWN (callers pass `env`), so it bundles + unit-tests without the heavy settings
+ * graph, exactly like webSearchWireCaps. The CALLER (seamQuery / seamQueryEngine) gates the env read to LIVE mode
+ * so the mock request shape never changes; the selfOrchestration stamp IS the opt-in (no extra flag needed).
+ */
+import { type EnvLike } from './hostEnv.js';
+/** The env key the shell reads. SEMA_-namespaced so it never collides with the worker's OWN deploy
+ *  `SELF_ORCHESTRATION_ENABLED` env (the service's DEPLOYMENT gate — a different axis the service owns). */
+export declare const SELF_ORCHESTRATION_ENV: "SEMA_SELF_ORCHESTRATION";
+/** ENV source → `true` by DEFAULT (clay 决定 2026-07-01 §4:RunWorkflow 默认可用),unless the user explicitly
+ *  opts OUT (`SEMA_SELF_ORCHESTRATION=0/false/no/off`) ⇒ `undefined` (no stamp; engine never mounts run_workflow).
+ *  Still `true | undefined` (never `false`) to mirror the service's strict `=== true` read. A stamped `true` only
+ *  makes run_workflow AVAILABLE — the engine still owns the final gate (its own `SELF_ORCHESTRATION_ENABLED`, set
+ *  default-on in TOC assembleChildEnv, + per-principal entitlement; TOC single-user honors it directly). The caller
+ *  gates this to LIVE mode, so the MOCK request shape is unchanged; only the live default path now stamps true. */
+export declare function selfOrchestrationFromEnv(env?: EnvLike): true | undefined;

package/dist/selfOrchestrationWireCaps.js

@@ -0,0 +1,48 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/selfOrchestrationWireCaps.ts 逐字搬入(零依赖)。
+ */
+/**
+ * src/sema/selfOrchestrationWireCaps.ts — PURE projection: the shell's "enable the LLM-authored workflow engine"
+ * opt-in → the TOP-LEVEL `TaskRequest.selfOrchestration` boolean the SERVICE consumes. Mirrors webSearchWireCaps.ts
+ * (the verified wire pattern), but the field rides at the TOP of the body (not under `settings`).
+ *
+ * The SERVICE reads `body.selfOrchestration` STRICTLY (ai-agent-service task-workflow.ts `selfOrchestrationFromBody`:
+ * `body.selfOrchestration !== true` ⇒ dropped) → core `TaskSpec.selfOrchestration`, the gate that MOUNTS core's
+ * LLM-authored `run_workflow` engine (the workflow.ts agent/parallel/pipeline/phase/nested orchestrator). The
+ * service then gates it on the DEPLOYMENT's `SELF_ORCHESTRATION_ENABLED` (else a harmless no-op, dropped) + the
+ * MULTI-TENANT per-principal entitlement RESOLVER (fail-closed: no resolver ⇒ dropped); a single-user worker honors
+ * it directly. So the shell's job is ONLY to STAMP the intent when the user opted in — the service owns every gate.
+ * We mirror the service's strict `=== true` semantics here: only an explicit truthy env opt-in returns `true`;
+ * everything else returns `undefined` (⇒ NO stamp ⇒ the engine never mounts run_workflow ⇒ default behaviour
+ * unchanged, exactly like an absent webSearch config).
+ *
+ * Config source (clay 决定 2026-07-01 §4 — DEFAULT-ON,opt-out):
+ *   - DEFAULT ON: unset / 其它 ⇒ stamp `selfOrchestration:true`(RunWorkflow 默认可用,体验像 CC 超集)。
+ *   - ENV opt-OUT: `SEMA_SELF_ORCHESTRATION=0/false/no/off` ⇒ undefined(no stamp)。
+ *
+ * 前身是 opt-in(parity-safe 保守默认 OFF);clay 拍 §4 后翻转为默认 ON(TOC 单用户本机无 entitlement 顾虑,
+ * 引擎侧 SELF_ORCHESTRATION_ENABLED 也在 assembleChildEnv 默认开)。可后续接 settings.json 驱动,这里仍是单一投影点。
+ *
+ * PURE — no env/file IO of its OWN (callers pass `env`), so it bundles + unit-tests without the heavy settings
+ * graph, exactly like webSearchWireCaps. The CALLER (seamQuery / seamQueryEngine) gates the env read to LIVE mode
+ * so the mock request shape never changes; the selfOrchestration stamp IS the opt-in (no extra flag needed).
+ */
+import { hostEnv } from './hostEnv.js';
+/** The env key the shell reads. SEMA_-namespaced so it never collides with the worker's OWN deploy
+ *  `SELF_ORCHESTRATION_ENABLED` env (the service's DEPLOYMENT gate — a different axis the service owns). */
+export const SELF_ORCHESTRATION_ENV = 'SEMA_SELF_ORCHESTRATION';
+/** The FALSY spellings that opt OUT (case-insensitive, trimmed). Conservative allowlist — only an explicit
+ *  `0`/`false`/`no`/`off` disables; everything else (incl. unset/empty) is the DEFAULT-ON path. */
+function isFalsy(v) {
+    const s = typeof v === 'string' ? v.trim().toLowerCase() : '';
+    return s === '0' || s === 'false' || s === 'no' || s === 'off';
+}
+/** ENV source → `true` by DEFAULT (clay 决定 2026-07-01 §4:RunWorkflow 默认可用),unless the user explicitly
+ *  opts OUT (`SEMA_SELF_ORCHESTRATION=0/false/no/off`) ⇒ `undefined` (no stamp; engine never mounts run_workflow).
+ *  Still `true | undefined` (never `false`) to mirror the service's strict `=== true` read. A stamped `true` only
+ *  makes run_workflow AVAILABLE — the engine still owns the final gate (its own `SELF_ORCHESTRATION_ENABLED`, set
+ *  default-on in TOC assembleChildEnv, + per-principal entitlement; TOC single-user honors it directly). The caller
+ *  gates this to LIVE mode, so the MOCK request shape is unchanged; only the live default path now stamps true. */
+export function selfOrchestrationFromEnv(env = hostEnv()) {
+    return isFalsy(env[SELF_ORCHESTRATION_ENV]) ? undefined : true;
+}

package/dist/sessionModelLatch.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/sessionModelLatch.ts 逐字搬入(零依赖;🔴 三个模块级 latch 是单实例态)。
+ */
+/**
+ * sessionModelLatch — 件13 (rev2 2026-07-14, CC 2.1.207 对锚): support module for the /model `s`
+ * (use this session only) split, anchored on the 207 mechanism (verified against the 2.1.198 pretty
+ * source, semantics identical in 207):
+ *
+ *   wsr(model, get, set, setDefault):                        // pretty.js:493226 (198 coords)
+ *     set(a => ({ ...a, mainLoopModel: model, mainLoopModelForSession: null }))   // ALWAYS in-memory
+ *     if (setDefault) RQt(model)                              // RQt = eo("userSettings",{model}) —
+ *                                                             // the ONLY settings write (493244)
+ *     message = `Set model to X${setDefault ? " and saved as your default for new sessions"
+ *                                            : " for this session only"}`
+ *
+ * i.e. in 207 BOTH Enter and `s` write the in-memory mainLoopModel and CLEAR the plan-mode session
+ * field; persistence is EXPLICIT (RQt) and only runs on set-as-default. 207 has no auto-persisting
+ * model choke point. sema's bundled base DOES auto-persist every mainLoopModel change in
+ * state/onChangeAppState.ts, so to reproduce the 207 state shape exactly the session-only commit
+ * marks its write with a ONE-SHOT skip-persist flag which the choke consumes: the write then behaves
+ * exactly like 207's no-RQt branch (mainLoopModel set in-memory, mainLoopModelForSession null,
+ * userSettings untouched → restart reverts to the persisted default).
+ *
+ * The latch half mirrors "the active model is UNPERSISTED" for NON-React consumers (seamQuery's
+ * modelEndpointSwitch runs outside the component tree): a session-only pick must not be promoted to
+ * next-boot roster/env state when the engine can route the model by itself. Kept in sync from the
+ * onChangeAppState choke (single funnel for every setAppState write): set on a session-only
+ * mainLoopModel write OR a plan-mode mainLoopModelForSession write, cleared on a persisted write.
+ */
+export declare function setSessionModelLatch(model: string | null): void;
+export declare function getSessionModelLatch(): string | null;
+export declare function markSessionOnlyModelWrite(): void;
+export declare function consumeSessionOnlyModelWrite(): boolean;
+export declare function markUserModelPickThisSession(): void;
+export declare function hasUserModelPickThisSession(): boolean;

package/dist/sessionModelLatch.js

@@ -0,0 +1,63 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/sessionModelLatch.ts 逐字搬入(零依赖;🔴 三个模块级 latch 是单实例态)。
+ */
+/**
+ * sessionModelLatch — 件13 (rev2 2026-07-14, CC 2.1.207 对锚): support module for the /model `s`
+ * (use this session only) split, anchored on the 207 mechanism (verified against the 2.1.198 pretty
+ * source, semantics identical in 207):
+ *
+ *   wsr(model, get, set, setDefault):                        // pretty.js:493226 (198 coords)
+ *     set(a => ({ ...a, mainLoopModel: model, mainLoopModelForSession: null }))   // ALWAYS in-memory
+ *     if (setDefault) RQt(model)                              // RQt = eo("userSettings",{model}) —
+ *                                                             // the ONLY settings write (493244)
+ *     message = `Set model to X${setDefault ? " and saved as your default for new sessions"
+ *                                            : " for this session only"}`
+ *
+ * i.e. in 207 BOTH Enter and `s` write the in-memory mainLoopModel and CLEAR the plan-mode session
+ * field; persistence is EXPLICIT (RQt) and only runs on set-as-default. 207 has no auto-persisting
+ * model choke point. sema's bundled base DOES auto-persist every mainLoopModel change in
+ * state/onChangeAppState.ts, so to reproduce the 207 state shape exactly the session-only commit
+ * marks its write with a ONE-SHOT skip-persist flag which the choke consumes: the write then behaves
+ * exactly like 207's no-RQt branch (mainLoopModel set in-memory, mainLoopModelForSession null,
+ * userSettings untouched → restart reverts to the persisted default).
+ *
+ * The latch half mirrors "the active model is UNPERSISTED" for NON-React consumers (seamQuery's
+ * modelEndpointSwitch runs outside the component tree): a session-only pick must not be promoted to
+ * next-boot roster/env state when the engine can route the model by itself. Kept in sync from the
+ * onChangeAppState choke (single funnel for every setAppState write): set on a session-only
+ * mainLoopModel write OR a plan-mode mainLoopModelForSession write, cleared on a persisted write.
+ */
+/** The model that is currently ACTIVE but UNPERSISTED (session-only pick or plan-mode override). */
+let sessionModelOverride = null;
+export function setSessionModelLatch(model) {
+    sessionModelOverride = model;
+}
+export function getSessionModelLatch() {
+    return sessionModelOverride;
+}
+/** One-shot mark: the NEXT mainLoopModel change is session-only (207 no-RQt branch) — do not persist. */
+let sessionOnlyWritePending = false;
+export function markSessionOnlyModelWrite() {
+    sessionOnlyWritePending = true;
+}
+export function consumeSessionOnlyModelWrite() {
+    const v = sessionOnlyWritePending;
+    sessionOnlyWritePending = false;
+    return v;
+}
+// ── 件3(F1 模型面批,S3 铁律半场):本会话「用户显式选过模型」标记 ─────────────────────
+// boot 目录回读(replEntry 把 /v1/models default 写进 initialState.mainLoopModel)不经过
+// setAppState ⇒ 不置位;任何经 setAppState 的 mainLoopModel 变更(cmd-model Enter、`s` 键、
+// /model <name>、config 面板)都算显式 pick —— 由 onChangeAppState choke(每个 setAppState
+// 写的单一漏斗)置位,散在 UI 调用点零改动。ensureEngineServesModel 据此区分「运行时回声」
+// (boot 回读的目录 default)vs「用户意图」:回声绝不允许持久化写(不 switchRoster 改 env /
+// 不重排 models.json / 不改档位绑定)。注意与上面 latch 的分工:latch=「当前活跃值未持久化」
+// (s 键/plan override),本标记=「本会话内发生过显式选择」——s 键 pick 也置位(它是显式意图,
+// 是否持久化由件13 latch 在 instant 路径拦截,语义不变)。
+let userModelPickThisSession = false;
+export function markUserModelPickThisSession() {
+    userModelPickThisSession = true;
+}
+export function hasUserModelPickThisSession() {
+    return userModelPickThisSession;
+}

package/dist/skillsWireCaps.d.ts

@@ -0,0 +1,47 @@
+/**
+ * ⇄ B2 批搬迁(2026-07-27,多端改造设计稿 §3 B2):cli src/sema/skillsWireCaps.ts 逐字搬入(只 import SDK)。
+ */
+/**
+ * src/sema/skillsWireCaps.ts — the PURE projection + server caps for the skills engine wire.
+ *
+ * Split out from skillsWire.ts so this logic (the part worth pinning) is testable WITHOUT the heavy on-disk
+ * loader graph (loadSkillsDir / loadPluginCommands pull analytics/signals/fs). It imports ONLY the `SkillSpec`
+ * type (erased at build), so a test can esbuild-bundle THIS file alone — no runtime side effects.
+ *
+ * The caps mirror the SDK `TaskRequest.skills` server caps (types.ts:82): ≤10 items, name ≤64, description
+ * ≤1024, content ≤32768 — a violation is a 400, so we truncate/limit HERE to make the live request well-formed
+ * by construction.
+ */
+import type { SkillSpec } from '@sema-agent/sdk';
+/** Server caps for `TaskRequest.skills` (SDK types.ts:82 — violations are a 400). */
+export declare const SKILL_CAPS: {
+    readonly items: 10;
+    readonly name: 64;
+    readonly description: 1024;
+    readonly content: 32768;
+};
+/** The minimal shape of a loaded skill `Command` this projection reads (a structural subset of CC's Command,
+ *  cast at the call site so we stay decoupled from the wide Command union). */
+export interface SkillCmdLike {
+    type?: string;
+    name?: string;
+    description?: string;
+    whenToUse?: string;
+    /** loader origin ('builtin' | 'plugin' | SettingSource…) — read by the skillOverrides four-state
+     *  resolution when the wire prunes hidden skills (skillsWire.ts). */
+    source?: string;
+    disableModelInvocation?: boolean;
+    /** the skill's own directory (`createSkillCommand` baseDir → command.skillRoot); SKILL.md lives at root/SKILL.md. */
+    skillRoot?: string;
+}
+/** Build one capped `SkillSpec`, or null when there is no usable name/body. description folds in `whenToUse`
+ *  (CC's progressive-disclosure metadata is name+description+whenToUse) so the engine's Skill tool can select
+ *  it. All three fields are truncated to the server caps. */
+export declare function toCappedSpec(name: string, description: string, whenToUse: string, body: string): SkillSpec | null;
+/**
+ * PURE projection: loaded skill commands → `SkillSpec[]` (capped, deduped by name, ≤10 items). `resolveBody`
+ * supplies each command's raw SKILL.md body (null ⇒ skip); injecting it keeps this function IO-free and
+ * unit-testable. Only MODEL-INVOCABLE prompt skills are sent — UI-only / `disableModelInvocation` commands
+ * are excluded (engine injection feeds the model's Skill tool, not the slash menu).
+ */
+export declare function skillCommandsToSpecs(cmds: SkillCmdLike[], resolveBody: (cmd: SkillCmdLike) => string | null): SkillSpec[];

package/dist/skillsWireCaps.js

@@ -0,0 +1,41 @@
+/** Server caps for `TaskRequest.skills` (SDK types.ts:82 — violations are a 400). */
+export const SKILL_CAPS = { items: 10, name: 64, description: 1024, content: 32768 };
+/** Build one capped `SkillSpec`, or null when there is no usable name/body. description folds in `whenToUse`
+ *  (CC's progressive-disclosure metadata is name+description+whenToUse) so the engine's Skill tool can select
+ *  it. All three fields are truncated to the server caps. */
+export function toCappedSpec(name, description, whenToUse, body) {
+    const n = name.trim().slice(0, SKILL_CAPS.name);
+    const c = body.trim().slice(0, SKILL_CAPS.content);
+    if (!n || !c)
+        return null;
+    const desc = [description.trim(), whenToUse.trim()]
+        .filter((s) => s.length > 0)
+        .join(' — ')
+        .slice(0, SKILL_CAPS.description);
+    return { name: n, description: desc, content: c };
+}
+/**
+ * PURE projection: loaded skill commands → `SkillSpec[]` (capped, deduped by name, ≤10 items). `resolveBody`
+ * supplies each command's raw SKILL.md body (null ⇒ skip); injecting it keeps this function IO-free and
+ * unit-testable. Only MODEL-INVOCABLE prompt skills are sent — UI-only / `disableModelInvocation` commands
+ * are excluded (engine injection feeds the model's Skill tool, not the slash menu).
+ */
+export function skillCommandsToSpecs(cmds, resolveBody) {
+    const specs = [];
+    const seen = new Set();
+    for (const cmd of cmds) {
+        if (specs.length >= SKILL_CAPS.items)
+            break;
+        if (cmd.type !== 'prompt' || cmd.disableModelInvocation)
+            continue;
+        const body = resolveBody(cmd);
+        if (!body)
+            continue;
+        const spec = toCappedSpec(cmd.name ?? '', cmd.description ?? '', cmd.whenToUse ?? '', body);
+        if (!spec || seen.has(spec.name))
+            continue;
+        seen.add(spec.name);
+        specs.push(spec);
+    }
+    return specs;
+}