@sema-agent/client-core 0.85.2 → 0.86.0

package/dist/gateVocabulary.js

@@ -1,3 +1,4 @@
+import { CORE_DENIED_BY_VALUES } from './generated/engineFactTables.js';
 export const CC_TOOL_DENIAL_KINDS = Object.freeze([
     'user-rejected',
     'permission-rule',
@@ -20,18 +21,10 @@ export function ccToolDenialKindForSettledBy(settledBy) {
         return 'permission-rule';
     return undefined;
 }
-export const GATE_DENIED_BY_WORDS = Object.freeze([
-    'policy',
-    'hook',
-    'org',
-    'persisted_rule',
-    'classifier',
-    'plan_mode',
-    'compliance',
-    'write_protection',
-    'ask_resolution',
-    'read_boundary',
-]);
+const RETIRED_DENIED_BY_WORDS = Object.freeze(['plan_mode']);
+export const GATE_DENIED_BY_WORDS = Object.freeze([...CORE_DENIED_BY_VALUES, ...RETIRED_DENIED_BY_WORDS]);
+const _deniedByWordsPin = true;
+void _deniedByWordsPin;
 const DENIED_BY_SENTENCES = Object.freeze({
     policy: "denied by this deployment's permission policy",
     hook: 'denied by a PreToolUse hook',
@@ -43,6 +36,7 @@ const DENIED_BY_SENTENCES = Object.freeze({
     write_protection: 'denied because the write landed on a write-protected path',
     ask_resolution: 'denied when the approval was resolved',
     read_boundary: 'denied by the read boundary',
+    mode: "denied by this session's permission mode",
 });
 export function isGateDeniedByWord(v) {
     return typeof v === 'string' && GATE_DENIED_BY_WORDS.includes(v);
@@ -63,7 +57,7 @@ const ASK_ORIGIN_SENTENCES = Object.freeze({
     hook: 'a PreToolUse hook asked about this call',
     ask_rule: 'a persisted ask rule matches this call',
     denial_limit_fallback: 'the auto-mode classifier hit its denial limit and handed this call back to you',
-    shell_gate_tighten: 'this deployment asks about shell commands the coarse shell gate rates above this tier',
+    shell_gate_tighten: 'the coarse shell check rates this command above the tier it lets through, so it asks',
     safety_tighten: 'the gate tightened on this call’s own facts (network egress, irreversibility, or a protected write)',
     policy: 'this deployment’s permission policy asks about this call',
 });
@@ -82,8 +76,6 @@ export function askOriginDetail(origin, message) {
     const word = typeof origin === 'string' && origin.length > 0 ? origin : '(none)';
     return `this call asks; its origin ${word} is a word newer than this client, so answer it as usual`;
 }
-const _deniedByWordsPin = GATE_DENIED_BY_WORDS;
-void _deniedByWordsPin;
 export const RULE_STORE_UNREADABLE_KINDS = Object.freeze(['store', 'call']);
 const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
 export function isRuleStoreUnreadableKind(v) {

package/dist/generated/engineFactTables.d.ts

@@ -0,0 +1,10 @@
+export declare const CORE_ASK_UNRESOLVABLE_CAUSES: readonly string[];
+export declare const CORE_DURABLE_MANDATE_SOURCES: readonly string[];
+export declare const CORE_TERMINAL_CAUSE_KINDS: readonly ["completed", "failed", "blocked", "paused"];
+export declare const CORE_RESERVED_AGENT_NAMES: readonly string[];
+export declare const CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS: Readonly<Record<"small" | "medium" | "large", number>>;
+export declare const CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS: readonly string[];
+export declare const CORE_DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"];
+export declare const CORE_PERMISSION_MODE_FOLD_REASONS: readonly string[];
+export declare const CORE_ENGINE_CARD_TYPES: readonly string[];
+export declare const CORE_TOOL_DECLARATION_CODES: readonly string[];

package/dist/generated/engineFactTables.js

@@ -0,0 +1,113 @@
+export const CORE_ASK_UNRESOLVABLE_CAUSES = Object.freeze([
+    "approver_unavailable",
+    "no_approver_wired",
+    "mandate_unreconstructible",
+]);
+export const CORE_DURABLE_MANDATE_SOURCES = Object.freeze([
+    "force_durable_gate",
+    "durable_approval",
+]);
+export const CORE_TERMINAL_CAUSE_KINDS = Object.freeze([
+    "completed",
+    "failed",
+    "blocked",
+    "paused",
+]);
+export const CORE_RESERVED_AGENT_NAMES = Object.freeze([
+    "StructuredOutput",
+    "ToolSearch",
+    "ReadToolResult",
+    "ReportBlocked",
+    "Agent",
+]);
+export const CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS = Object.freeze({
+    "small": 5,
+    "medium": 15,
+    "large": 50,
+});
+export const CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS = Object.freeze([
+    "system-reminder",
+    "task-notification",
+    "new-diagnostics",
+    "user_memory",
+    "scope",
+    "skills",
+    "total_tokens",
+    "instruction-files",
+]);
+export const CORE_DENIED_BY_VALUES = Object.freeze([
+    "policy",
+    "hook",
+    "org",
+    "persisted_rule",
+    "classifier",
+    "compliance",
+    "write_protection",
+    "ask_resolution",
+    "read_boundary",
+    "mode",
+]);
+export const CORE_PERMISSION_MODE_FOLD_REASONS = Object.freeze([
+    "operator_deny",
+    "face_absent",
+    "inherited_ceiling",
+]);
+export const CORE_ENGINE_CARD_TYPES = Object.freeze([
+    "mcp",
+    "a2a",
+    "path_not_in_root",
+    "read_path_denied",
+    "readonly_out_of_root",
+    "read_unestablished",
+    "text",
+    "notebook",
+    "file_unchanged",
+    "image",
+    "document",
+    "edit",
+    "create",
+    "update",
+    "notebook-edit",
+    "bash",
+    "bash_invalid_timeout",
+    "grep",
+    "glob",
+    "repo-map",
+    "artifact",
+    "worktree",
+    "task-output",
+    "task-stop",
+    "monitor-start",
+    "send-message",
+    "agent-transcript",
+    "list-agents",
+    "read-inbox",
+    "workflow-run",
+    "report-findings",
+    "tool-search",
+    "ask-question",
+    "exit-plan-mode",
+    "enter-plan-mode",
+    "cron-create",
+    "cron-delete",
+    "cron-list",
+    "schedule-wakeup",
+    "web-fetch",
+    "web-search",
+    "todo",
+    "task",
+    "task-list",
+    "agent",
+    "fork",
+]);
+export const CORE_TOOL_DECLARATION_CODES = Object.freeze([
+    "config.tool_mount_denied",
+    "config.tool_roster_bound",
+    "config.tool_name_too_long",
+    "config.tool_contract_too_long",
+    "config.tool_schema_bound",
+    "config.tool_face_invalid",
+    "config.tool_name_invalid",
+    "config.egress_requires_write_effect",
+    "config.reserved_tool_name",
+]);

package/dist/generated/engineNoticeTables.js

@@ -24,6 +24,11 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.peer_admission_out_of_range",
     "config.peer_lane_unmounted",
     "config.secret_env_scrubbed",
+    "config.permission_mode_unavailable",
+    "permission.ask_released_by_mode",
+    "permission.read_deny_unapplied",
+    "permission.rule_store_unavailable",
+    "resume.legacy_mode_seed_migrated",
     "peer.inbound_disposition",
     "peer.held_settled",
     "peer.idle_subscription",
@@ -31,6 +36,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "classifier.fallback",
     "classifier.role_defaulted",
     "classifier.contract_broken",
+    "classifier.unavailable",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
     "delegation.ask_unresolvable",
@@ -58,6 +64,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
+    "route.tool_call_id_folded",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -99,6 +106,11 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.peer_admission_out_of_range": "operator",
     "config.peer_lane_unmounted": "operator",
     "config.secret_env_scrubbed": "operator",
+    "config.permission_mode_unavailable": "user",
+    "permission.ask_released_by_mode": "user",
+    "permission.read_deny_unapplied": "user",
+    "permission.rule_store_unavailable": "user",
+    "resume.legacy_mode_seed_migrated": "operator",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
     "peer.idle_subscription": "user",
@@ -106,6 +118,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "classifier.fallback": "operator",
     "classifier.role_defaulted": "operator",
     "classifier.contract_broken": "operator",
+    "classifier.unavailable": "user",
     "checkpoint.execution_outcome_unrecorded": "operator",
     "delegation.transcript_integrity": "operator",
     "delegation.ask_unresolvable": "user",
@@ -133,6 +146,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
+    "route.tool_call_id_folded": "operator",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
     "steering.parked_input_blocked": "user",

package/dist/hitl/refusedToolNameProse.d.ts

@@ -0,0 +1,4 @@
+export declare const PREFIXES_IN_PROSE: string;
+export declare const REFUSED_NAME_CLASSES: string;
+export declare const REFUSED_NAME_FIX: string;
+export declare const RULES_LEGACY_TOOL_NAME_WRITE_NOTE: string;

package/dist/hitl/refusedToolNameProse.js

@@ -0,0 +1,7 @@
+import { CORE_PROTOCOL_PREFIXES } from '../generated/toolNameTables.js';
+export const PREFIXES_IN_PROSE = CORE_PROTOCOL_PREFIXES.map((prefix) => `"${prefix}"`).join(' or ');
+export const REFUSED_NAME_CLASSES = `a retired tool name, or a name that contains "__" but does not start with ${PREFIXES_IN_PROSE}`;
+export const REFUSED_NAME_FIX = `If the tool still exists, use its current name; a server or agent-peer tool name starts with ${PREFIXES_IN_PROSE}.`;
+export const RULES_LEGACY_TOOL_NAME_WRITE_NOTE = `The engine refused to write these session rules, and the stored record was not changed at all: they name a tool the engine refuses — ${REFUSED_NAME_CLASSES} (the engine's own error text names the entry). ` +
+    `${REFUSED_NAME_FIX} Then write the rules again. ` +
+    'If that entry was already in this session’s rule record, it has to be removed from the record before the record can be written again.';

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,16 +1,16 @@
-import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
+import { CONFIG_LEGACY_TOOL_NAME, RULES_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
+import { PREFIXES_IN_PROSE, REFUSED_NAME_CLASSES, REFUSED_NAME_FIX, RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
 import { CORE_PROTOCOL_PREFIXES, CORE_RETIRED_TOOL_CURRENT_NAMES } from '../generated/toolNameTables.js';
 const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
 const ENGINE_RETIRED_TOOL_NAMES = CORE_RETIRED_TOOL_CURRENT_NAMES;
-const PREFIXES_IN_PROSE = COVERING_NAMESPACE_PREFIXES.map((prefix) => `"${prefix}"`).join(' or ');
 const WITHHELD_NOTICE = {
     ask_no_bucket: 'Not written to this session’s rule record: that record only holds rules that block outright, and this rule asks before running instead — recording it as a block would change what it means.',
     qualified_deny: 'Not written to this session’s rule record: that record holds whole tool names and command names only, and this rule has a part in parentheses it cannot carry — recording just the name could block more than this rule does.',
     peer_wide: 'Not written to this session’s rule record: this rule names a server or agent peer without naming one of its tools, and an engine that matches that record by exact tool name would block none of that peer’s tools.',
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, or has spaces around the name.',
-    legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. If the tool still exists, use its current name; a server or agent-peer tool name starts with ${PREFIXES_IN_PROSE}.`,
+    legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
     not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
@@ -114,8 +114,12 @@ export function sessionPolicyWithheldNotice(why) {
         ? WITHHELD_NOTICE[why]
         : 'Not written to this session’s rule record.';
 }
-const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule applied to it names a tool the engine refuses — a retired tool name, or a name that contains "__" but does not start with ${PREFIXES_IN_PROSE} (the engine's own error text names the entry). ` +
+const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule applied to it names a tool the engine refuses — ${REFUSED_NAME_CLASSES} (the engine's own error text names the entry). ` +
     'Every later run fails the same way until that entry is removed from wherever it is set: this session’s rule record, the settings sent with the run, a parent session’s rule record, or the deployment’s own tool rules.';
 export function legacyToolNameFailureNoteOf(code) {
-    return code === CONFIG_LEGACY_TOOL_NAME ? LEGACY_TOOL_NAME_FAILURE_NOTE : undefined;
+    if (code === CONFIG_LEGACY_TOOL_NAME)
+        return LEGACY_TOOL_NAME_FAILURE_NOTE;
+    if (code === RULES_LEGACY_TOOL_NAME)
+        return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
+    return undefined;
 }

package/dist/hitl/sessionPolicyWire.d.ts

@@ -38,6 +38,11 @@ export type SessionPolicyFailure = {
 } | {
     kind: 'request-rejected';
     message: string;
+} | {
+    kind: 'legacy-tool-name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
 } | {
     kind: 'unauthorized';
     message: string;
@@ -85,6 +90,12 @@ export type SessionPolicyTightenOutcome = {
 } | {
     kind: 'capability_absent';
     why: 'not_reported' | 'absent';
+} | {
+    kind: 'legacy_tool_name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
+    alreadyInRecord?: boolean;
 } | {
     kind: 'unknown';
     why: SessionPolicyTightenUnknownWhy;
@@ -127,6 +138,11 @@ export type SessionPolicyRemovalOutcome = {
     kind: 'write_unconfirmed';
     why: Extract<SessionPolicyTightenUnknownWhy, 'write_indeterminate' | 'write_receipt_unreadable' | 'write_receipt_mismatch'>;
     message?: string;
+} | {
+    kind: 'legacy_tool_name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
 };
 export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
 export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {

package/dist/hitl/sessionPolicyWire.js

@@ -1,6 +1,8 @@
 import { wireFailureShapeOf } from '../wireFailureShape.js';
 import { hostLog } from '../host.js';
 import { isEngineRefusedToolName } from './sessionPolicyDeliverable.js';
+import { RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
+import { RULES_LEGACY_TOOL_NAME, isRulesRefusalCode } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
 const RULE_FIELD_PRESENCE = {
     toolAllow: true,
@@ -12,9 +14,19 @@ const RULE_FIELD_PRESENCE = {
 export const SESSION_POLICY_RULE_FIELDS = Object.freeze(Object.keys(RULE_FIELD_PRESENCE));
 const MAX_RULE_ENTRIES = 10_000;
 export function classifySessionPolicyFailure(e) {
-    const { status, errorCode, message } = wireFailureShapeOf(e);
+    const { status, errorCode, message, bodyField, bodyName } = wireFailureShapeOf(e);
     if (errorCode === undefined || errorCode === '')
         return { kind: 'no-verdict', message };
+    if (errorCode === RULES_LEGACY_TOOL_NAME) {
+        return {
+            kind: 'legacy-tool-name',
+            message,
+            ...(bodyField === 'toolDeny' || bodyField === 'toolAllow' ? { field: bodyField } : {}),
+            ...(bodyName !== undefined && bodyName !== '' ? { name: bodyName } : {}),
+        };
+    }
+    if (isRulesRefusalCode(errorCode) && status !== undefined && status >= 400 && status < 500)
+        return { kind: 'error', message };
     if (status === 501 || errorCode === 'capability.session_store_required') {
         return { kind: 'face-unavailable', message };
     }
@@ -209,10 +221,30 @@ function unknownFrom(failure, leg) {
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_indeterminate', message };
         case 'loosen-forbidden':
         case 'cas-conflict':
+        case 'legacy-tool-name':
         case 'error':
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_refused', message };
     }
 }
+function legacyToolNameOutcome(failure, prior, add) {
+    const { field, name } = failure;
+    let alreadyInRecord;
+    if (field !== undefined && name !== undefined) {
+        const inPrior = Object.hasOwn(prior, field) ? prior[field] : undefined;
+        const inAdd = Object.hasOwn(add, field) ? add[field] : undefined;
+        if (inPrior !== undefined && inPrior.includes(name))
+            alreadyInRecord = true;
+        else if (inAdd !== undefined && inAdd.includes(name))
+            alreadyInRecord = false;
+    }
+    return {
+        kind: 'legacy_tool_name',
+        message: failure.message,
+        ...(field !== undefined ? { field } : {}),
+        ...(name !== undefined ? { name } : {}),
+        ...(alreadyInRecord !== undefined ? { alreadyInRecord } : {}),
+    };
+}
 async function attemptTighten(facade, req, opts) {
     const read = await readSessionPolicy(facade, req.sessionId, opts);
     if (read.kind === 'failed')
@@ -231,6 +263,8 @@ async function attemptTighten(facade, req, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
+        if (failure.kind === 'legacy-tool-name')
+            return { done: legacyToolNameOutcome(failure, read.rules, req.add) };
         return { done: unknownFrom(failure, 'write') };
     }
     let narrowed;
@@ -279,6 +313,8 @@ export function sessionPolicyTightenNotice(outcome) {
             return outcome.why === 'absent'
                 ? 'This deployment does not keep per-session tool rules, so there is nothing to tighten here.'
                 : 'This engine does not say whether it keeps per-session tool rules — it predates that answer — so the tightening entry stays hidden rather than being written blind.';
+        case 'legacy_tool_name':
+            return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
         case 'unknown':
             switch (outcome.why) {
                 case 'face_unavailable':
@@ -382,6 +418,16 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message, refused: removed } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
+        if (failure.kind === 'legacy-tool-name') {
+            return {
+                done: {
+                    kind: 'legacy_tool_name',
+                    message: failure.message,
+                    ...(failure.field !== undefined ? { field: failure.field } : {}),
+                    ...(failure.name !== undefined ? { name: failure.name } : {}),
+                },
+            };
+        }
         return { done: removalFailed(failure, 'write') };
     }
     let narrowed;
@@ -475,6 +521,8 @@ export function sessionPolicyRemovalNotice(outcome) {
             }
         case 'write_unconfirmed':
             return 'The removal was sent but no clear answer came back from the engine — it may already be in effect. Run the removal again: it re-reads the record, and reports nothing left to remove if it did take effect.';
+        case 'legacy_tool_name':
+            return 'Nothing was changed: the engine refused to write this session’s rule record back, because an entry this removal keeps is a name the engine no longer accepts in that record (the engine\'s own error text names the entry). The removal keeps it on purpose — the supplied roster mounts a tool by exactly that name, or this version does not yet recognise the name as one the engine refuses. While the record holds that entry it cannot be written, so the entries this removal meant to take out stay in it as well.';
         default:
             return generic;
     }

package/dist/index.d.ts

@@ -72,7 +72,7 @@ export * from './engineWireSdk.js';
 export * from './classifierVerdictWire.js';
 export { stripSystemReminderBlocks, unwrapSystemReminder } from './systemReminderTag.js';
 export { findSystemReminderOpenTag, type SystemReminderOpenTagSpan } from './systemReminderTag.js';
-export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
+export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, FLEET_LEASE_UNAVAILABLE, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isRulesRefusalCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, RULES_LEGACY_TOOL_NAME, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
 export type { DelegationCapDisposition, ModelFallbackReason, } from './engineErrorCodes.js';
 export * from './agentsWireCaps.js';
 export * from './attachmentsWireCaps.js';
@@ -90,6 +90,8 @@ export * from './rewindWireCaps.js';
 export * from './rewindArchiveCapability.js';
 export * from './fileHistoryCaptureCapability.js';
 export * from './sealedKeyCapability.js';
+export * from './storePostureCapability.js';
+export * from './centerWiringCapability.js';
 export * from './registryQuotaUsage.js';
 export * from './selfOrchestrationWireCaps.js';
 export * from './skillsWireCaps.js';
@@ -145,6 +147,7 @@ export * from './corruptSession.js';
 export * from './corruptSessionCopy.js';
 export * from './resumeRefusalCopy.js';
 export * from './wireRefusalCopy.js';
+export * from './inheritEnvWire.js';
 export * from './decideReceipt.js';
 export * from './sessionMap.js';
 export * from './detachWire.js';
@@ -189,6 +192,7 @@ export * from './request/printNotification.js';
 export * from './seatContract.js';
 export * from './agentSession/contract.js';
 export * from './agentSession/backgroundView.js';
+export { READ_CREDENTIAL_NOT_ACCEPTED_NOTICE } from './readCredentialRefusal.js';
 export { readEngineAgentRegistry, isEngineAgentRegistryListingSuperseded } from './agentSession/engineAgentRegistryRead.js';
 export type { EngineAgentRegistryClient } from './agentSession/engineAgentRegistryRead.js';
 export { stopEngineSessionBackground, engineSessionBackgroundReceiptReadingOf, ENGINE_SESSION_BACKGROUND_RECEIPT_STATES, } from './agentSession/engineSessionBackgroundStop.js';

package/dist/index.js

@@ -65,7 +65,7 @@ export * from './engineWireSdk.js';
 export * from './classifierVerdictWire.js';
 export { stripSystemReminderBlocks, unwrapSystemReminder } from './systemReminderTag.js';
 export { findSystemReminderOpenTag } from './systemReminderTag.js';
-export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
+export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, FLEET_LEASE_UNAVAILABLE, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isRulesRefusalCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, RULES_LEGACY_TOOL_NAME, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
 export * from './agentsWireCaps.js';
 export * from './attachmentsWireCaps.js';
 export * from './clientContextWireCaps.js';
@@ -82,6 +82,8 @@ export * from './rewindWireCaps.js';
 export * from './rewindArchiveCapability.js';
 export * from './fileHistoryCaptureCapability.js';
 export * from './sealedKeyCapability.js';
+export * from './storePostureCapability.js';
+export * from './centerWiringCapability.js';
 export * from './registryQuotaUsage.js';
 export * from './selfOrchestrationWireCaps.js';
 export * from './skillsWireCaps.js';
@@ -133,6 +135,7 @@ export * from './corruptSession.js';
 export * from './corruptSessionCopy.js';
 export * from './resumeRefusalCopy.js';
 export * from './wireRefusalCopy.js';
+export * from './inheritEnvWire.js';
 export * from './decideReceipt.js';
 export * from './sessionMap.js';
 export * from './detachWire.js';
@@ -175,6 +178,7 @@ export * from './request/printNotification.js';
 export * from './seatContract.js';
 export * from './agentSession/contract.js';
 export * from './agentSession/backgroundView.js';
+export { READ_CREDENTIAL_NOT_ACCEPTED_NOTICE } from './readCredentialRefusal.js';
 export { readEngineAgentRegistry, isEngineAgentRegistryListingSuperseded } from './agentSession/engineAgentRegistryRead.js';
 export { stopEngineSessionBackground, engineSessionBackgroundReceiptReadingOf, ENGINE_SESSION_BACKGROUND_RECEIPT_STATES, } from './agentSession/engineSessionBackgroundStop.js';
 export * from './model/catalog.js';

package/dist/inheritEnvWire.d.ts

@@ -0,0 +1,22 @@
+import { type InheritEnvWord, type TaskRequestLike } from './request/taskRequest.js';
+export declare const INHERIT_ENV_MIN_SERVER: readonly [number, number, number];
+export type InheritEnvServerSupport = 'supported' | 'unsupported' | 'unknown';
+export declare function inheritEnvServerSupport(version: string | undefined): InheritEnvServerSupport;
+export type InheritEnvWithheldCause = 'server_version_unknown' | 'server_too_old';
+export interface InheritEnvWithheld {
+    readonly cause: InheritEnvWithheldCause;
+    readonly word: InheritEnvWord;
+}
+export interface InheritEnvDeclaration {
+    readonly field: {
+        readonly inheritEnv?: InheritEnvWord;
+    };
+    readonly withheld?: InheritEnvWithheld;
+}
+export declare function inheritEnvDeclaration(word: unknown, serverVersion: string | undefined): InheritEnvDeclaration;
+export declare function inheritEnvWithheldNotice(withheld: InheritEnvWithheld): string;
+export interface InheritEnvRefusalDetail {
+    readonly code: string;
+}
+export declare function inheritEnvRefusalFromError(err: unknown, sentRequest: TaskRequestLike | undefined): InheritEnvRefusalDetail | null;
+export declare function inheritEnvRefusalContent(_detail: InheritEnvRefusalDetail): string;

package/dist/inheritEnvWire.js

@@ -0,0 +1,84 @@
+import { INHERIT_ENV_WORDS, isInheritEnvWord } from './request/taskRequest.js';
+import { settingsPermissionBucketRefusalFromError } from './wireRefusalCopy.js';
+export const INHERIT_ENV_MIN_SERVER = Object.freeze([7, 106, 0]);
+export function inheritEnvServerSupport(version) {
+    const mm = typeof version === 'string' ? /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version) : null;
+    if (!mm)
+        return 'unknown';
+    const got = [Number(mm[1]), Number(mm[2]), Number(mm[3])];
+    for (let i = 0; i < 3; i++) {
+        const g = got[i];
+        const need = INHERIT_ENV_MIN_SERVER[i];
+        if (g !== need)
+            return g > need ? 'supported' : 'unsupported';
+    }
+    return 'supported';
+}
+const EMPTY_DECLARATION = Object.freeze({ field: Object.freeze({}) });
+export function inheritEnvDeclaration(word, serverVersion) {
+    if (word === undefined || word === null)
+        return EMPTY_DECLARATION;
+    if (!isInheritEnvWord(word)) {
+        throw new TypeError(`inheritEnvDeclaration: inheritEnv 只接受 ${INHERIT_ENV_WORDS.map((w) => `'${w}'`).join(' / ')} 或缺席 —— 收到 ${Array.isArray(word) ? 'typeof=object / array' : `typeof=${typeof word}`}。坏词在版本判定之前就拒:「这一次不发」不许顺手吞掉一个打错字的声明。错误文本只报形状,不回显值。`);
+    }
+    const support = inheritEnvServerSupport(serverVersion);
+    if (support === 'supported')
+        return Object.freeze({ field: Object.freeze({ inheritEnv: word }) });
+    const cause = support === 'unsupported' ? 'server_too_old' : 'server_version_unknown';
+    return Object.freeze({ field: Object.freeze({}), withheld: Object.freeze({ cause, word }) });
+}
+const WITHHELD_NOTICES = Object.freeze({
+    server_too_old: Object.freeze({
+        all: "Not sent with this request: this engine is too old to accept the setting that lets the shell inherit this machine's whole environment, so this run's shell gets the default environment, with credential-like variables removed.",
+        scrub: 'Not sent with this request: this engine is too old to accept the default-environment setting, so it was left out; that has the same effect, because the default environment (credential-like variables removed) is what this run gets anyway.',
+    }),
+    server_version_unknown: Object.freeze({
+        all: "Not sent with this request: the engine's version is not known yet, and an engine that does not know the setting that lets the shell inherit this machine's whole environment refuses the whole request, so it was held back; this run's shell gets the default environment, with credential-like variables removed, and on an engine that does know the setting, leaving it out also clears an earlier whole-environment choice for this session.",
+        scrub: "Not sent with this request: the engine's version is not known yet, so the default-environment setting was left out; that has the same effect, because leaving it out also gives this run the default environment (credential-like variables removed).",
+    }),
+});
+const WITHHELD_UNKNOWN_NOTICE = 'Not sent with this request: the shell-environment setting was held back for a reason this version does not recognize.';
+export function inheritEnvWithheldNotice(withheld) {
+    try {
+        if (typeof withheld !== 'object' || withheld === null)
+            return WITHHELD_UNKNOWN_NOTICE;
+        const cause = withheld.cause;
+        const word = withheld.word;
+        if (typeof cause !== 'string' || !Object.hasOwn(WITHHELD_NOTICES, cause) || !isInheritEnvWord(word))
+            return WITHHELD_UNKNOWN_NOTICE;
+        return WITHHELD_NOTICES[cause][word];
+    }
+    catch {
+        return WITHHELD_UNKNOWN_NOTICE;
+    }
+}
+const FIELD_INVALID = 'request.field_invalid';
+function readGuarded(o, key) {
+    if (typeof o !== 'object' || o === null)
+        return undefined;
+    try {
+        return o[key];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function inheritEnvRefusalFromError(err, sentRequest) {
+    try {
+        if (readGuarded(sentRequest, 'inheritEnv') !== 'all')
+            return null;
+        if (readGuarded(err, 'errorCode') !== FIELD_INVALID)
+            return null;
+        if (settingsPermissionBucketRefusalFromError(err) !== null)
+            return null;
+        return Object.freeze({ code: FIELD_INVALID });
+    }
+    catch {
+        return null;
+    }
+}
+const REFUSAL_NOT_ACCEPTED = 'The engine refused this request as invalid without naming the field · ' +
+    "This request asked for the shell to inherit this machine's whole environment, which the engine accepts only when tools run directly on its own machine and the request belongs to a session; if that is what it refused, send it again without that setting (or with the default)";
+export function inheritEnvRefusalContent(_detail) {
+    return REFUSAL_NOT_ACCEPTED;
+}

package/dist/peerFrames.js

@@ -1,4 +1,5 @@
 import { applyDisplayFace, LEGACY_NAME_FACE } from './displayUntrusted.js';
+import { CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS } from './generated/engineFactTables.js';
 const WIRE_KEY_FROM = 'from';
 const WIRE_KEY_BODY = 'body';
 const WIRE_KEY_KIND = 'kind';
@@ -107,16 +108,7 @@ export function classifyPeerNotification(n) {
     }
     return null;
 }
-const AUTHORITY_ENVELOPE_TAGS = Object.freeze([
-    'system-reminder',
-    'task-notification',
-    'new-diagnostics',
-    'user_memory',
-    'scope',
-    'skills',
-    'total_tokens',
-    'instruction-files',
-]);
+const AUTHORITY_ENVELOPE_TAGS = CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS;
 const ZWSP = String.fromCharCode(0x200b);
 const AUTHORITY_BREAKOUT_RE = new RegExp(`<\\s*\\/?\\s*(?:${AUTHORITY_ENVELOPE_TAGS.map(t => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})(?:\\s[^>]*)?>`, 'gi');
 function neutralizeAuthorityTags(text) {