@sema-agent/client-core 0.77.2 → 0.78.1

package/dist/index.js

@@ -30,6 +30,7 @@ export * from './sessionPolicyCapability.js';
 export * from './memoryComplianceCapability.js';
 export * from './memoryOriginCapability.js';
 export * from './memoryEntriesWire.js';
+export * from './memoryVerbsWire.js';
 export * from './deviceExecutorManagementCapability.js';
 export * from './mcpReconnect.js';
 export * from './leaderConflict.js';

package/dist/mcpLiveness.js

@@ -77,7 +77,7 @@ export function mcpLivenessRollupOf(rows) {
 const epochLabel = (ms) => Math.abs(ms) <= 8.64e15 ? new Date(ms).toISOString() : String(ms);
 export function mcpEngineLegHealthDetail(health) {
     if (health === undefined)
-        return 'mcp liveness not reported (no liveness observation is available to this client)';
+        return 'mcp liveness not reported (this client holds no liveness reading for this leg)';
     const unreadable = health.unreadableCells === true ? ' (one or more liveness records could not be read)' : '';
     const at = health.observedAt !== undefined ? `, last observed at ${epochLabel(health.observedAt)}` : '';
     switch (health.reading) {
@@ -91,6 +91,7 @@ export function mcpEngineLegHealthDetail(health) {
             }
             return `mcp liveness: observed on this leg, but what came back does not answer whether the server can be reached${at}${unreadable}`;
         default:
-            return `mcp liveness not reported (no observation record on this leg's roster)${unreadable}`;
+            return 'mcp liveness not reported (no liveness observation is available to this client, and this client'
+                + ` cannot tell which cause applies)${unreadable}`;
     }
 }

package/dist/mcpPanel.js

@@ -90,7 +90,7 @@ export function mcpPanelLastLegDetail(view, opts) {
     if (view.lastLegMcpUnreadable === true) {
         return 'last leg mcp unreadable (the engine sent a shape this client cannot read)';
     }
-    return 'last leg mcp not reported (no leg in the retention window, no manifest on the last leg, or the engine predates it)';
+    return 'last leg mcp not reported (the panel carried no entry for the last leg; this client cannot tell which cause applies)';
 }
 const _mcpPanelShapePin = (p) => p;
 void _mcpPanelShapePin;

package/dist/memoryVerbsWire.d.ts

@@ -0,0 +1,106 @@
+import type { EntryProvenanceAccount, MemoryErasureRequest, MemoryErasureAttestation, MemoryOriginClearRequest, MemoryOriginClearReceipt, MemoryOriginClearanceRow, MemoryOriginClearancesResult, MemoryOriginExternalEntry, MemoryOriginExternalResult } from '@sema-agent/sdk';
+import type { MemoryComplianceReading } from './memoryComplianceCapability.js';
+import type { MemoryOriginReading } from './memoryOriginCapability.js';
+import type { MemoryEraseReceiptReading, MemoryOriginClearanceReading } from './memoryEntriesWire.js';
+export interface MemoryFacade {
+    provenance(entryId: string, opts?: {
+        signal?: AbortSignal;
+    }): Promise<EntryProvenanceAccount>;
+    erase(body: MemoryErasureRequest, opts?: {
+        signal?: AbortSignal;
+    }): Promise<MemoryErasureAttestation>;
+    originExternal(scopes: string[], opts?: {
+        signal?: AbortSignal;
+    }): Promise<MemoryOriginExternalResult>;
+    originClearances(opts?: {
+        signal?: AbortSignal;
+    }): Promise<MemoryOriginClearancesResult>;
+    originClear(entryId: string, body: MemoryOriginClearRequest, opts?: {
+        signal?: AbortSignal;
+    }): Promise<MemoryOriginClearReceipt>;
+}
+export declare const MEMORY_VERB_REFUSAL_CAUSES: readonly ["face_absent", "client_too_old", "unreadable_request", "store_absent", "operator_only", "unauthorized", "service_token_required", "id_invalid", "request_id_required", "body_shape", "query_invalid", "selector_invalid", "evidence_unavailable", "selector_mismatch", "census_incomplete", "clear_unattributed", "clear_invalid", "clear_not_marked", "clear_challenged", "clear_conflict", "clear_pending"];
+export type MemoryVerbRefusalCause = (typeof MEMORY_VERB_REFUSAL_CAUSES)[number];
+export declare const MEMORY_VERB_UNKNOWN_WHYS: readonly ["no_verdict", "server_fault", "control_plane_corrupt", "clear_unknown", "clear_failed", "result_unreadable", "unsupported_version", "identity_mismatch", "unclassified"];
+export type MemoryVerbUnknownWhy = (typeof MEMORY_VERB_UNKNOWN_WHYS)[number];
+export type MemoryVerbRefused = {
+    status: 'refused';
+    cause: MemoryVerbRefusalCause;
+    message: string;
+};
+export type MemoryVerbUnknown = {
+    status: 'unknown';
+    why: MemoryVerbUnknownWhy;
+    message: string;
+};
+export type MemoryVerbFailure = MemoryVerbRefused | MemoryVerbUnknown;
+export declare function classifyMemoryFailure(e: unknown): MemoryVerbFailure;
+export interface MemoryProvenanceCall {
+    entryId: string;
+    capability: MemoryComplianceReading;
+}
+export type MemoryProvenanceOutcome = {
+    status: 'account';
+    account: EntryProvenanceAccount;
+} | MemoryVerbRefused | MemoryVerbUnknown;
+export declare function readEntryProvenance(facade: MemoryFacade, call: MemoryProvenanceCall, opts?: {
+    signal?: AbortSignal;
+}): Promise<MemoryProvenanceOutcome>;
+export interface MemoryEraseCall {
+    body: MemoryErasureRequest;
+    capability: MemoryComplianceReading;
+}
+export type MemoryEraseOutcome = {
+    status: 'attested';
+    receipt: Extract<MemoryEraseReceiptReading, {
+        kind: 'present';
+    }>;
+} | MemoryVerbRefused | MemoryVerbUnknown;
+export declare function eraseMemoryEntries(facade: MemoryFacade, call: MemoryEraseCall, opts?: {
+    signal?: AbortSignal;
+}): Promise<MemoryEraseOutcome>;
+export interface MemoryOriginExternalCall {
+    scopes: string[];
+    capability: MemoryOriginReading;
+}
+export type MemoryOriginExternalOutcome = {
+    status: 'listed';
+    scopes: string[];
+    entries: MemoryOriginExternalEntry[];
+} | MemoryVerbRefused | MemoryVerbUnknown;
+export declare function listExternalOriginEntries(facade: MemoryFacade, call: MemoryOriginExternalCall, opts?: {
+    signal?: AbortSignal;
+}): Promise<MemoryOriginExternalOutcome>;
+export declare function externalOriginCoverage(outcome: MemoryOriginExternalOutcome, asked: {
+    scopes: string[];
+}): {
+    kind: 'audited';
+    scopes: string[];
+} | {
+    kind: 'unknown';
+    why: 'not_listed' | 'coverage_shortfall';
+};
+export interface MemoryOriginClearancesCall {
+    capability: MemoryOriginReading;
+}
+export type MemoryOriginClearancesOutcome = {
+    status: 'ledger';
+    clearances: MemoryOriginClearanceRow[];
+} | MemoryVerbRefused | MemoryVerbUnknown;
+export declare function listOriginClearances(facade: MemoryFacade, call: MemoryOriginClearancesCall, opts?: {
+    signal?: AbortSignal;
+}): Promise<MemoryOriginClearancesOutcome>;
+export interface MemoryOriginClearCall {
+    entryId: string;
+    body: MemoryOriginClearRequest;
+    capability: MemoryOriginReading;
+}
+export type MemoryOriginClearOutcome = {
+    status: 'cleared';
+    receipt: Extract<MemoryOriginClearanceReading, {
+        kind: 'present';
+    }>;
+} | MemoryVerbRefused | MemoryVerbUnknown;
+export declare function clearEntryOrigin(facade: MemoryFacade, call: MemoryOriginClearCall, opts?: {
+    signal?: AbortSignal;
+}): Promise<MemoryOriginClearOutcome>;

package/dist/memoryVerbsWire.js

@@ -0,0 +1,423 @@
+import { wireFailureShapeOf } from './wireFailureShape.js';
+import { memoryComplianceVerbsAvailable } from './memoryComplianceCapability.js';
+import { memoryOriginVerbsAvailable } from './memoryOriginCapability.js';
+import { readMemoryEraseReceipt, readMemoryOriginClearanceReceipt } from './memoryEntriesWire.js';
+export const MEMORY_VERB_REFUSAL_CAUSES = Object.freeze([
+    'face_absent',
+    'client_too_old',
+    'unreadable_request',
+    'store_absent',
+    'operator_only',
+    'unauthorized',
+    'service_token_required',
+    'id_invalid',
+    'request_id_required',
+    'body_shape',
+    'query_invalid',
+    'selector_invalid',
+    'evidence_unavailable',
+    'selector_mismatch',
+    'census_incomplete',
+    'clear_unattributed',
+    'clear_invalid',
+    'clear_not_marked',
+    'clear_challenged',
+    'clear_conflict',
+    'clear_pending',
+]);
+export const MEMORY_VERB_UNKNOWN_WHYS = Object.freeze([
+    'no_verdict',
+    'server_fault',
+    'control_plane_corrupt',
+    'clear_unknown',
+    'clear_failed',
+    'result_unreadable',
+    'unsupported_version',
+    'identity_mismatch',
+    'unclassified',
+]);
+function refusedBy(cause, message) {
+    return { status: 'refused', cause, message };
+}
+function unknownBy(why, message) {
+    return { status: 'unknown', why, message };
+}
+export function classifyMemoryFailure(e) {
+    const { status, errorCode, message } = wireFailureShapeOf(e);
+    if (errorCode === undefined || errorCode === '')
+        return unknownBy('no_verdict', message);
+    switch (errorCode) {
+        case 'auth.principal_required':
+            return refusedBy('unauthorized', message);
+        case 'auth.operator_only':
+            return refusedBy('operator_only', message);
+        case 'auth.service_token_required':
+            return refusedBy('service_token_required', message);
+        case 'capability.memory_engine_required':
+            return refusedBy('store_absent', message);
+        case 'request.id_invalid':
+            return refusedBy('id_invalid', message);
+        case 'request.request_id_required':
+            return refusedBy('request_id_required', message);
+        case 'request.body_shape':
+            return refusedBy('body_shape', message);
+        case 'request.query_invalid':
+            return refusedBy('query_invalid', message);
+        case 'config.memory_erasure_request':
+            return refusedBy('selector_invalid', message);
+        case 'memory.erasure_evidence_unavailable':
+            return refusedBy('evidence_unavailable', message);
+        case 'memory.erasure_selector_mismatch':
+            return refusedBy('selector_mismatch', message);
+        case 'memory.erasure_census_incomplete':
+            return refusedBy('census_incomplete', message);
+        case 'memory.origin_clear_unattributed':
+            return refusedBy('clear_unattributed', message);
+        case 'memory.origin_clear_invalid':
+            return refusedBy('clear_invalid', message);
+        case 'memory.origin_clear_not_marked':
+            return refusedBy('clear_not_marked', message);
+        case 'memory.origin_clear_challenged':
+            return refusedBy('clear_challenged', message);
+        case 'memory.origin_clear_conflict':
+            return refusedBy('clear_conflict', message);
+        case 'memory.origin_clear_pending':
+            return refusedBy('clear_pending', message);
+        case 'memory.origin_clear_unknown':
+            return unknownBy('clear_unknown', message);
+        case 'memory.origin_clear_failed':
+            return unknownBy('clear_failed', message);
+        case 'internal.memory_control_plane_corrupt':
+            return unknownBy('control_plane_corrupt', message);
+        default:
+            break;
+    }
+    if (errorCode.startsWith('auth.'))
+        return refusedBy('unauthorized', message);
+    if (status === undefined)
+        return unknownBy('no_verdict', message);
+    if (status >= 500)
+        return unknownBy('server_fault', message);
+    return unknownBy('unclassified', message);
+}
+function plainObject(v) {
+    return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+function nonEmptyString(v) {
+    return typeof v === 'string' && v !== '';
+}
+const MAX_SCOPE_NAMES = 1_000;
+function snapshotScopeNames(v) {
+    if (!Array.isArray(v))
+        return null;
+    let n;
+    try {
+        n = v.length;
+    }
+    catch {
+        return null;
+    }
+    if (typeof n !== 'number' || !Number.isSafeInteger(n) || n <= 0 || n > MAX_SCOPE_NAMES)
+        return null;
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        let item;
+        try {
+            item = v[i];
+        }
+        catch {
+            return null;
+        }
+        if (!nonEmptyString(item))
+            return null;
+        out.push(item);
+    }
+    return out;
+}
+function gateRefusal(available, face) {
+    if (available !== 'no')
+        return undefined;
+    return refusedBy('face_absent', `this engine reports the ${face} as off on this deployment, so nothing was sent; the wire does not say which half is missing (a memory backend that does not own the engine control plane, or an empty operator roster), so do not guess which`);
+}
+const COMPLIANCE_FACE = 'memory compliance face (entry provenance and erasure)';
+const ORIGIN_FACE = 'external-origin face (origin listing, clearance ledger and the un-mark valve)';
+function readCapabilityKind(capability, bit) {
+    const kind = plainObject(capability) ? capability.kind : undefined;
+    if (!nonEmptyString(kind)) {
+        throw new TypeError(`memoryVerbsWire: \`capability\` (this call reading of capabilities.${bit}) is required — a default reading anchor would silently answer ` +
+            'for whichever engine happens to be installed, and this step decides whether a request goes on the wire at all');
+    }
+    return kind;
+}
+function complianceGate(capability) {
+    const kind = readCapabilityKind(capability, 'memoryCompliance');
+    return gateRefusal(memoryComplianceVerbsAvailable({ kind }), COMPLIANCE_FACE);
+}
+function originGate(capability) {
+    const kind = readCapabilityKind(capability, 'memoryOrigin');
+    return gateRefusal(memoryOriginVerbsAvailable({ kind }), ORIGIN_FACE);
+}
+const PROVENANCE_ACCOUNT_VERSION = 1;
+function narrowProvenanceAccount(body, entryId) {
+    let v;
+    let id;
+    let binding;
+    let custody;
+    let contributors;
+    let contentState;
+    let hasExclusion;
+    let exclusion;
+    let bindingState;
+    let custodyState;
+    let custodyEvents;
+    let exclusionCode;
+    try {
+        if (!plainObject(body))
+            return { ok: false, why: 'result_unreadable' };
+        v = body.v;
+        id = body.id;
+        binding = body.binding;
+        custody = body.custody;
+        contributors = body.contributors;
+        contentState = body.contentState;
+        hasExclusion = Object.hasOwn(body, 'exclusion');
+        exclusion = hasExclusion ? body.exclusion : undefined;
+        bindingState = plainObject(binding) ? binding.state : undefined;
+        custodyState = plainObject(custody) ? custody.state : undefined;
+        custodyEvents = plainObject(custody) ? custody.events : undefined;
+        exclusionCode = plainObject(exclusion) ? exclusion.code : undefined;
+    }
+    catch {
+        return { ok: false, why: 'result_unreadable' };
+    }
+    if (typeof v !== 'number' || !Number.isFinite(v))
+        return { ok: false, why: 'result_unreadable' };
+    if (v !== PROVENANCE_ACCOUNT_VERSION)
+        return { ok: false, why: 'unsupported_version' };
+    if (!nonEmptyString(id))
+        return { ok: false, why: 'result_unreadable' };
+    if (!plainObject(binding) || !nonEmptyString(bindingState))
+        return { ok: false, why: 'result_unreadable' };
+    if (!plainObject(custody) || !nonEmptyString(custodyState) || !Array.isArray(custodyEvents)) {
+        return { ok: false, why: 'result_unreadable' };
+    }
+    if (!Array.isArray(contributors) || !nonEmptyString(contentState)) {
+        return { ok: false, why: 'result_unreadable' };
+    }
+    if (hasExclusion && !(plainObject(exclusion) && nonEmptyString(exclusionCode))) {
+        return { ok: false, why: 'result_unreadable' };
+    }
+    if (id !== entryId)
+        return { ok: false, why: 'identity_mismatch' };
+    return { ok: true, account: body };
+}
+export async function readEntryProvenance(facade, call, opts) {
+    if (typeof facade?.provenance !== 'function') {
+        return refusedBy('client_too_old', 'this client has no entry-provenance verb — nothing was sent; upgrade the client that builds the memory port');
+    }
+    const gate = complianceGate(call?.capability);
+    if (gate !== undefined)
+        return gate;
+    const entryId = call?.entryId;
+    if (!nonEmptyString(entryId)) {
+        return refusedBy('unreadable_request', 'an entry provenance question needs an entry id — addressing by an absent id matches nothing, so nothing was sent');
+    }
+    let res;
+    try {
+        res = await facade.provenance(entryId, opts);
+    }
+    catch (e) {
+        return classifyMemoryFailure(e);
+    }
+    const narrowed = narrowProvenanceAccount(res, entryId);
+    if (!narrowed.ok) {
+        return unknownBy(narrowed.why, narrowed.why === 'unsupported_version'
+            ? 'the provenance account came back stamped with a newer envelope version than this client knows — refusing to reinterpret it; upgrade the client'
+            : narrowed.why === 'identity_mismatch'
+                ? 'the provenance account came back for a different entry id than the one that was asked about — refusing to present it as this entry account'
+                : 'the provenance call answered 2xx with a body this client cannot branch on (envelope, entry id, binding or custody) — refusing to present it as an account');
+    }
+    return { status: 'account', account: narrowed.account };
+}
+export async function eraseMemoryEntries(facade, call, opts) {
+    if (typeof facade?.erase !== 'function') {
+        return refusedBy('client_too_old', 'this client has no compliance-erasure verb — nothing was sent, so nothing was erased; upgrade the client that builds the memory port');
+    }
+    const gate = complianceGate(call?.capability);
+    if (gate !== undefined)
+        return gate;
+    const body = call?.body;
+    let requestId;
+    let select;
+    try {
+        if (!plainObject(body)) {
+            return refusedBy('unreadable_request', 'an erasure request needs a request body — refusing to mint one out of nothing, so nothing was sent');
+        }
+        requestId = body.requestId;
+        select = body.select;
+    }
+    catch {
+        return refusedBy('unreadable_request', 'the erasure request body could not be inspected — nothing was sent');
+    }
+    if (!nonEmptyString(requestId)) {
+        return refusedBy('unreadable_request', 'an erasure request needs a stable request id of its own minting — it is this request idempotency identity and a retry must carry the same one, so nothing was sent');
+    }
+    if (!plainObject(select)) {
+        return refusedBy('unreadable_request', 'an erasure request needs a selector object — which selector is valid is the engine judgement, but an absent one addresses nothing, so nothing was sent');
+    }
+    let res;
+    try {
+        res = await facade.erase(call.body, opts);
+    }
+    catch (e) {
+        return classifyMemoryFailure(e);
+    }
+    const reading = readMemoryEraseReceipt(res);
+    if (reading.kind !== 'present') {
+        return unknownBy('result_unreadable', `the erasure call answered 2xx with an attestation this client cannot read (${reading.why}) — refusing to report the erasure as attested; re-read the attestation by its request id to reconcile`);
+    }
+    if (reading.requestId !== requestId) {
+        return unknownBy('identity_mismatch', 'the erasure attestation came back under a different request id than the one that was sent — refusing to present it as the outcome of this call');
+    }
+    return { status: 'attested', receipt: reading };
+}
+export async function listExternalOriginEntries(facade, call, opts) {
+    if (typeof facade?.originExternal !== 'function') {
+        return refusedBy('client_too_old', 'this client has no external-origin listing verb — nothing was sent; upgrade the client that builds the memory port');
+    }
+    const gate = originGate(call?.capability);
+    if (gate !== undefined)
+        return gate;
+    let asked;
+    try {
+        asked = snapshotScopeNames(call?.scopes);
+    }
+    catch {
+        asked = null;
+    }
+    if (asked === null) {
+        return refusedBy('unreadable_request', 'an external-origin listing needs a readable, non-empty list of scope keys — this engine generation has no scope-enumeration read face, so the list comes from the caller and an unreadable one is not sent at all');
+    }
+    let res;
+    try {
+        res = await facade.originExternal(asked, opts);
+    }
+    catch (e) {
+        return classifyMemoryFailure(e);
+    }
+    let rawScopes;
+    let rawEntries;
+    try {
+        if (!plainObject(res)) {
+            return unknownBy('result_unreadable', 'the external-origin listing answered 2xx with a body this client cannot read — refusing to present it as a listing');
+        }
+        rawScopes = res.scopes;
+        rawEntries = res.entries;
+    }
+    catch {
+        return unknownBy('result_unreadable', 'the external-origin listing answered 2xx with a body this client cannot read — refusing to present it as a listing');
+    }
+    let audited;
+    try {
+        audited = snapshotScopeNames(rawScopes);
+    }
+    catch {
+        audited = null;
+    }
+    if (audited === null || !Array.isArray(rawEntries)) {
+        return unknownBy('result_unreadable', 'the external-origin listing answered 2xx without a readable audited-scope echo or entry list — refusing to present a listing whose coverage cannot be stated');
+    }
+    return { status: 'listed', scopes: audited, entries: rawEntries };
+}
+export function externalOriginCoverage(outcome, asked) {
+    if (asked === null || typeof asked !== 'object' || !Array.isArray(asked.scopes)) {
+        throw new TypeError('externalOriginCoverage: second argument { scopes: string[] } is required — the answer covers only the scopes that were named, ' +
+            'and an empty listing must never be read as a clean store');
+    }
+    if (outcome?.status !== 'listed')
+        return { kind: 'unknown', why: 'not_listed' };
+    const wanted = snapshotScopeNames(asked.scopes);
+    if (wanted === null)
+        return { kind: 'unknown', why: 'coverage_shortfall' };
+    const seen = new Set(outcome.scopes);
+    for (const s of wanted) {
+        if (!seen.has(s))
+            return { kind: 'unknown', why: 'coverage_shortfall' };
+    }
+    return { kind: 'audited', scopes: outcome.scopes };
+}
+export async function listOriginClearances(facade, call, opts) {
+    if (typeof facade?.originClearances !== 'function') {
+        return refusedBy('client_too_old', 'this client has no clearance-ledger verb — nothing was sent; upgrade the client that builds the memory port');
+    }
+    const gate = originGate(call?.capability);
+    if (gate !== undefined)
+        return gate;
+    let res;
+    try {
+        res = await facade.originClearances(opts);
+    }
+    catch (e) {
+        return classifyMemoryFailure(e);
+    }
+    let rows;
+    try {
+        if (!plainObject(res)) {
+            return unknownBy('result_unreadable', 'the clearance ledger answered 2xx with a body this client cannot read — refusing to present it as a ledger');
+        }
+        rows = res.clearances;
+    }
+    catch {
+        return unknownBy('result_unreadable', 'the clearance ledger answered 2xx with a body this client cannot read — refusing to present it as a ledger');
+    }
+    if (!Array.isArray(rows)) {
+        return unknownBy('result_unreadable', 'the clearance ledger answered 2xx without a readable row list — refusing to present an empty ledger this client never actually read');
+    }
+    return { status: 'ledger', clearances: rows };
+}
+export async function clearEntryOrigin(facade, call, opts) {
+    if (typeof facade?.originClear !== 'function') {
+        return refusedBy('client_too_old', 'this client has no origin-clear verb — nothing was sent, so no marker was cleared; upgrade the client that builds the memory port');
+    }
+    const gate = originGate(call?.capability);
+    if (gate !== undefined)
+        return gate;
+    const entryId = call?.entryId;
+    if (!nonEmptyString(entryId)) {
+        return refusedBy('unreadable_request', 'clearing an origin marker needs an entry id — addressing by an absent id matches nothing, so nothing was sent');
+    }
+    const body = call?.body;
+    let requestId;
+    let reason;
+    try {
+        if (!plainObject(body)) {
+            return refusedBy('unreadable_request', 'clearing an origin marker needs a request body — refusing to mint one out of nothing, so nothing was sent');
+        }
+        requestId = body.requestId;
+        reason = body.reason;
+    }
+    catch {
+        return refusedBy('unreadable_request', 'the origin-clear request body could not be inspected — nothing was sent');
+    }
+    if (!nonEmptyString(requestId)) {
+        return refusedBy('unreadable_request', 'an origin clearance needs a request id: it is the audit attribution for an irreversible act, and a signature needs a name, so nothing was sent');
+    }
+    if (typeof reason !== 'string') {
+        return refusedBy('unreadable_request', 'an origin clearance needs a reason string — whether a given reason is acceptable is the engine judgement, but a non-string one cannot be recorded at all, so nothing was sent');
+    }
+    let res;
+    try {
+        res = await facade.originClear(entryId, call.body, opts);
+    }
+    catch (e) {
+        return classifyMemoryFailure(e);
+    }
+    const reading = readMemoryOriginClearanceReceipt(res);
+    if (reading.kind !== 'present') {
+        return unknownBy('result_unreadable', `the origin-clear call answered 2xx with a receipt this client cannot read (${reading.why}) — refusing to report the marker as cleared; read the clearance ledger back to reconcile`);
+    }
+    if (reading.entryId !== entryId) {
+        return unknownBy('identity_mismatch', 'the origin-clear receipt came back for a different entry than the one that was sent — refusing to present it as the outcome of this call');
+    }
+    return { status: 'cleared', receipt: reading };
+}

package/dist/request/taskRequest.d.ts

@@ -37,6 +37,7 @@ export interface TaskRequestInput {
     limits?: Record<string, unknown>;
     interactiveTools?: false;
     oneShot?: true;
+    excludeAllTools?: true;
     outputSchema?: NonNullable<TaskRequest['outputSchema']>;
     maxCostUsd?: number;
     taskBudget?: number;

package/dist/request/taskRequest.js

@@ -30,6 +30,7 @@ export const REQUEST_FIELD_MATRIX = [
     { field: 'maxCostUsd', lanes: ['print'], live: true, why: '花费上限声明(sdk `TaskRequest.maxCostUsd`,请求体**顶层**位;上游向下夹到部署上限 —— 只许要得更少)。与 `limits` 同一条理由只在无人值守车道:交互面由人随时中断。🔴 坏值(非数 / 非有限 / 非正)在本层**响亮拒**:上游对这一位的坏值是安静忽略并回落部署上限,不是 4xx(见 `refuseBadMaxCostUsd`)' },
     { field: 'attachmentIds', lanes: ['interactive'], live: true, why: '附件**字节通道**(uploadAttachment 回执 id;server ≥1.289 绑定会话并把文件物化进 run 的 attachments/)。有上传入口的端才有 id 可引用:web/desktop 有,壳走 images / 本地文件路径,`-p` 车道连 uploadAttachment 都没有 ⇒ print 缺席是**没有来源**,不是漏。🔴 与上面的 `attachments` 同名不同物(那是 turn 边界的配置键),两条永远不许合并' },
     { field: 'excludeTools', lanes: ['interactive', 'print'], live: true, why: 'design/161 W3(2026-07-30):真 wire 键(SDK types `excludeTools`)且早在 seatContract `START_SESSION_OPTION_KEYS` 里,却是 desktop 手写 taskReq 的第 9 键、矩阵外——而 stamp 门对未登记键**静默丢弃**,真实危险形=「用户显式排除的工具被静默放回」(权限方向回归,类型层不报)。今天只有 desktop 在发;壳的工具面走 roster/interactiveTools 另一条路。0.77.0 补 print 座(三问:① wire 位与车道无关 —— sdk 具名位、提交体真收 `body.excludeTools`;② 来源 —— print 今天没有排除入口,但这是**收紧方向**的声明,传了只进回执 = 端不读回执就把用户排除的工具放回;③ 口径 —— 仍是 live 门后的位,与交互面同一行)' },
+    { field: 'excludeAllTools', lanes: ['interactive', 'print'], live: true, why: '0.78.0(sdk 11.x 具名位 `excludeAllTools`,server ≥7.90.0 请求面):整只工具面卸载 —— 调用方工具 / 脚手架 / 手 / MCP / A2A / skills 一个都不挂,终局必然纯文本(wire 上 `wiring_manifest.tools.count === 0`,整条流零 tool_start / tool_end / tool_disclosure)。与 excludeTools 是两种语义、刻意不折叠(`"*"` 是一个合法的工具名,「卸全部」不能写成 `excludeTools:["*"]`);两键同带各自生效。类型只收字面 `true`(server 只把 literal true 写上任务规格,`false` = 替引擎重申它自己的缺省 ⇒ 不发、与缺席同义、不进回执);坏值响亮拒(收紧方向的声明不许被打字错误安静丢掉)。两条车道都是提交面 ⇒ 都能声明。探测靠键闭集、没有能力位:没接线的 server(≤7.89.x)400 `request.body_shape` 并在 `unknownKeys` 里逐字点名,本层不替它猜;A2A 入站面不承载本键(零工具面走 skill 路由)' },
     { field: 'settings.ultracode', lanes: ['interactive'], live: true, why: 'design/111:sticky `/effort ultracode` 拨盘 + 当轮关键词嗅探,两个来源都只在交互面存在', gap: true },
     { field: 'systemPrompt', lanes: ['interactive', 'print'], live: false, why: '整段替换系统提示(sdk `TaskRequest.systemPrompt`;上游字符数超限 400 响亮拒,本层原样透传)。两条车道都有来源:交互面 = CC QueryParams.systemPrompt,无人值守面 = `--system-prompt[-file]` 一类旗。与追加位 `appendSystemPrompt` 不是一个位(那一位归 live 兜底层,见 `LIVE_DEFAULT_FIELDS`)' },
     { field: 'reasoningEffort', lanes: ['interactive', 'print'], live: false, why: '思考档位(sdk `TaskRequest.reasoningEffort` 七词闭集;上游对表外词 400 响亮拒 ⇒ 本层不预铸第二判官)。档位是请求级的位、与车道无关:交互面 = `/effort` 拨盘,无人值守面 = 档位旗。🔴 端交的必须是**档位词**:「思考 token 数」今天没有上游对位(见 `UPSTREAM_ABSENT_REQUEST_INTENTS` 的 `maxThinkingTokens`),别把一个数字折成档位词发出去' },
@@ -81,6 +82,7 @@ const INPUT_KEY_ROUTES = {
     attachments: row('attachments'),
     attachmentIds: row('attachmentIds'),
     excludeTools: row('excludeTools'),
+    excludeAllTools: row('excludeAllTools'),
     finalVerification: row('finalVerification'),
     limits: row('limits'),
     interactiveTools: row('interactiveTools'),
@@ -171,6 +173,7 @@ const VALUE_LEVEL_IN_PLAY = Object.freeze({
     images: (v) => Array.isArray(v) && v.length > 0,
     attachmentIds: (v) => Array.isArray(v) && v.length > 0,
     excludeTools: (v) => Array.isArray(v) && v.length > 0,
+    excludeAllTools: (v) => v === true,
     memoryCapture: (v) => v === 'off',
     memory: (v) => v === 'off',
     rewind: (v) => typeof v === 'object' && v !== null && rewindSubKeys().some((k) => hasOwn(v, k) && present(v[k])),
@@ -379,6 +382,13 @@ const refuseBadMemoryOff = (v) => {
         '`"on"`,`{ enabled: false }` 对象形也不是 wire 拼法)且对坏拼写**响亮拒**(server 400 `request.field_invalid`)。' +
         '本层若静默删键,这一次运行会照常挂上记忆面而声明人不会知道 —— 与 memoryCapture 同一条纪律。错误文本只报形状,不回显值。');
 };
+const refuseBadExcludeAllTools = (v) => {
+    if (v === undefined || v === null || v === true || v === false)
+        return;
+    throw new TypeError('buildTaskRequest: excludeAllTools 只接受字面量 `true`(`false` / 缺席 = 不卸载)—— ' +
+        `收到 ${coarseShape(v)}。这一位是**整只工具面卸载**的收紧声明:本层若把坏值静默删键,这一次运行会挂上声明人以为已经卸掉的全部工具。` +
+        '错误文本只报形状,不回显值。');
+};
 const refuseBadMemoryCapture = (v) => {
     if (v === undefined || v === null)
         return;
@@ -416,12 +426,14 @@ export function assembleTaskRequest(input, lane) {
     const resolvedOpen = resolvedRoute.via === 'matrix' && omissionCauseOf(standingOf(resolvedRoute), lane, live) === undefined;
     const resolvedWire = resolvedOpen ? resolvedSnapshotForWire(resolvedIn) : {};
     const maxCostUsdIn = input.maxCostUsd;
+    const excludeAllToolsIn = input.excludeAllTools;
     const INPUT_KEYS = Object.keys(INPUT_KEY_ROUTES);
     const i = snapshotByName(input, INPUT_KEYS, {
         live,
         memoryCapture: memoryCaptureIn,
         memory: memoryIn,
         maxCostUsd: maxCostUsdIn,
+        excludeAllTools: excludeAllToolsIn,
         settings: settingsIn,
     });
     const SETTINGS_KEYS = Object.keys(SETTINGS_KEY_ROUTES);
@@ -429,6 +441,7 @@ export function assembleTaskRequest(input, lane) {
     refuseBadMemoryCapture(memoryCaptureIn);
     refuseBadMemoryOff(memoryIn);
     refuseBadMaxCostUsd(maxCostUsdIn);
+    refuseBadExcludeAllTools(excludeAllToolsIn);
     const rewindRoute = INPUT_KEY_ROUTES.rewind;
     const REWIND_KEYS = rewindRoute.via === 'matrix' ? rewindRoute.field.split('/') : [];
     const rewindIn = i.rewind;
@@ -553,6 +566,7 @@ export function assembleTaskRequest(input, lane) {
         ...(on('lenses') ? { lenses: i.lenses } : {}),
         ...(on('attachmentIds') ? { attachmentIds: [...(i.attachmentIds ?? [])] } : {}),
         ...(on('excludeTools') ? { excludeTools: [...(i.excludeTools ?? [])] } : {}),
+        ...(on('excludeAllTools') ? { excludeAllTools: true } : {}),
         ...(on('clientContext') ? { clientContext: i.clientContext } : {}),
         ...(on('scratchpadDir') ? { scratchpadDir: i.scratchpadDir } : {}),
         ...(on('finalVerification') ? { finalVerification: i.finalVerification } : {}),

package/dist/toolResult.d.ts

@@ -29,6 +29,15 @@ export declare function stripUntrustedFence(text: string): {
     label: string;
     body: string;
 } | null;
+export type DisplayBody = {
+    fenced: true;
+    label: string;
+    body: string;
+} | {
+    fenced: false;
+    body: string;
+};
+export declare function displayBody(text: unknown): DisplayBody | undefined;
 export type ModelFacingTaskOutput = {
     kind: 'bash';
     taskId?: string | undefined;