@sema-agent/client-core 0.97.1 → 0.99.0

package/dist/seatContract.js

@@ -1,7 +1,10 @@
 import { PERMISSION_MODE_WORDS, REASONING_EFFORT_WORDS } from "./taskRequestWords.js";
 import { liveDefaultModelCopy, liveModelRowCopy } from "./model/liveCatalogShape.js";
 import { REWIND_MODES } from "./rewindWireCaps.js";
+import { SETTINGS_MODEL_API_WORDS } from "./generated/settingsSchemaTables.js";
+import { PROBE_VERDICTS } from "./modelCapabilityProbe.js";
 import { guardedRead, ownDataField, ownDataRefusalKeyOf, ownSendableField, readOwnDataValue } from "./ownKey.js";
+import { MCP_LIVENESS_STATES } from "./mcpLiveness.js";
 const bad = (reason, field) => field === undefined ? { reason } : { reason, field };
 const nested = (prefix, verdict) => {
     const path = verdict.field === undefined
@@ -12,12 +15,11 @@ const nested = (prefix, verdict) => {
     const reason = verdict.reason.startsWith(`${prefix}:`) ? verdict.reason : `${prefix}: ${verdict.reason}`;
     return bad(reason, path);
 };
-const isObject = (v) => typeof v === "object" && v !== null;
 const isPlainRecord = (v) => {
-    if (!isObject(v) || Array.isArray(v))
+    if (typeof v !== "object" || v === null || Array.isArray(v))
         return false;
     const proto = Object.getPrototypeOf(v);
-    return proto === Object.prototype || proto === null;
+    return proto === null || (typeof proto === "object" && Object.getPrototypeOf(proto) === null);
 };
 const isAbsent = (v) => typeof v === "undefined";
 const optionalString = (v) => isAbsent(v) || typeof v === "string";
@@ -90,6 +92,124 @@ const seatCheckAt = (fn) => (v, field) => {
         return key !== undefined ? bad(NOT_PLAIN_DATA, `${field}.${key}`) : bad("payload could not be read", field);
     }
 };
+const pathAt = (path, key) => (path === "" ? key : `${path}.${key}`);
+const reqF = (rule) => ({ opt: false, rule });
+const optF = (rule) => ({ opt: true, rule });
+const ruleOf = (label, pred) => ({
+    label,
+    test: (v, path) => (pred(v) ? true : bad(`bad value (${label})`, path === "" ? undefined : path)),
+});
+function shapeVerdict(spec, v, path, disc) {
+    if (!isPlainRecord(v))
+        return bad("not object", path === "" ? undefined : path);
+    for (const k of sendableKeysOf(v)) {
+        if (k !== disc && !Object.hasOwn(spec, k))
+            return bad("unknown key", pathAt(path, k));
+    }
+    for (const k of Object.keys(spec)) {
+        const s = spec[k];
+        const val = own(v, k);
+        if (isAbsent(val)) {
+            if (!s.opt)
+                return bad("missing key", pathAt(path, k));
+            continue;
+        }
+        const verdict = s.rule.test(val, pathAt(path, k));
+        if (verdict !== true)
+            return verdict;
+    }
+    return true;
+}
+const shapeRule = (label, spec) => ({ label, test: (v, path) => shapeVerdict(spec, v, path) });
+const armsRule = (label, disc, arms) => ({
+    label,
+    test: (v, path) => {
+        if (!isPlainRecord(v))
+            return bad("not object", path === "" ? undefined : path);
+        const d = own(v, disc);
+        if (typeof d !== "string" || !Object.hasOwn(arms, d))
+            return bad("unknown arm", pathAt(path, disc));
+        return shapeVerdict(arms[d], v, path, disc);
+    },
+});
+const isArraySlotKey = (k, n) => k === "length" || (/^(0|[1-9][0-9]*)$/.test(k) && Number(k) < n);
+const arrayRule = (item, nonEmpty = false) => ({
+    label: `${item.label}[]`,
+    test: (v, path) => {
+        if (!Array.isArray(v))
+            return bad(`bad value (${item.label}[])`, path === "" ? undefined : path);
+        const n = ownDataField(v, "length");
+        for (const k of Reflect.ownKeys(v)) {
+            if (typeof k === "string" && !isArraySlotKey(k, typeof n === "number" ? n : 0))
+                return bad("unknown key", pathAt(path, k));
+        }
+        const rows = ownItems(v);
+        if (nonEmpty && rows.length === 0)
+            return bad(`bad value (${item.label}[])`, path === "" ? undefined : path);
+        for (let i = 0; i < rows.length; i += 1) {
+            const verdict = item.test(rows[i], `${path}[${i}]`);
+            if (verdict !== true)
+                return verdict;
+        }
+        return true;
+    },
+});
+const oneOfRule = (label, words) => ruleOf(label, (v) => typeof v === "string" && words.includes(v));
+const R_STR = ruleOf("string", (v) => typeof v === "string");
+const R_NONEMPTY = ruleOf("non-empty string", (v) => typeof v === "string" && v.length > 0);
+const R_BOOL = ruleOf("boolean", (v) => typeof v === "boolean");
+const R_TRUE = ruleOf("true", (v) => v === true);
+const R_NUM = ruleOf("finite number", (v) => typeof v === "number" && Number.isFinite(v));
+const R_INT0 = ruleOf("non-negative integer", (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0);
+const R_INT1 = ruleOf("positive integer", (v) => typeof v === "number" && Number.isSafeInteger(v) && v > 0);
+const keyWords = (k) => k
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter((w) => w.length > 0);
+const SECRET_KEY_WORDS = new Set(["token", "secret", "password", "passwd", "authorization", "bearer", "sealed"]);
+const SECRET_KEY_PAIRS = new Set(["api key", "device code", "access key", "private key"]);
+const isSecretKeyName = (k) => {
+    const words = keyWords(k);
+    for (let i = 0; i < words.length; i += 1) {
+        if (SECRET_KEY_WORDS.has(words[i]))
+            return true;
+        if (i + 1 < words.length && SECRET_KEY_PAIRS.has(`${words[i]} ${words[i + 1]}`))
+            return true;
+    }
+    return false;
+};
+const firstSecretKeyPath = (root, allow) => {
+    const seen = new Set();
+    const stack = [[root, ""]];
+    while (stack.length > 0) {
+        const [v, path] = stack.pop();
+        if (typeof v !== "object" || v === null || seen.has(v))
+            continue;
+        seen.add(v);
+        const isArr = Array.isArray(v);
+        for (const k of Reflect.ownKeys(v)) {
+            if (typeof k !== "string" || (isArr && k === "length"))
+                continue;
+            const d = Reflect.getOwnPropertyDescriptor(v, k);
+            if (d === undefined || !Object.hasOwn(d, "value"))
+                continue;
+            const at = isArr && /^[0-9]+$/.test(k) ? `${path}[${k}]` : pathAt(path, k);
+            if (isSecretKeyName(k) && !allow.has(at))
+                return at;
+            stack.push([d.value, at]);
+        }
+    }
+    return undefined;
+};
+const NO_SECRET_ALLOW = new Set();
+const seatShapeCheck = (rule, allow = NO_SECRET_ALLOW) => seatCheck((v) => {
+    const verdict = rule.test(v, "");
+    if (verdict !== true)
+        return verdict;
+    const secret = firstSecretKeyPath(v, allow);
+    return secret === undefined ? true : bad("secret key", secret);
+});
 export const TOOL_PERMISSION_REQUEST_ID_DOMAINS = Object.freeze([
     "live:",
     "durable:",
@@ -128,6 +248,7 @@ const SEAT_EVENT_TYPE_TUPLE = [
     "chrome_event",
     "error",
     "tool_permission_resolved",
+    "subagent_content",
 ];
 export const SEAT_EVENT_TYPES = Object.freeze(SEAT_EVENT_TYPE_TUPLE);
 const CHROME_EVENT_KIND_TUPLE = [
@@ -137,6 +258,14 @@ const CHROME_EVENT_KIND_TUPLE = [
     "subagent_lifecycle",
     "text_segment_end",
     "thinking_segment_end",
+    "retry_status",
+    "context_usage",
+    "last_turn_usage",
+    "bgshell_register",
+    "bgshell_settle",
+    "memory_saved",
+    "result_replayed",
+    "tool_parked",
 ];
 export const CHROME_EVENT_KINDS = Object.freeze(CHROME_EVENT_KIND_TUPLE);
 const LANE_PROOF_LANE_TUPLE = ["main", "subagent", "workflow"];
@@ -151,7 +280,54 @@ export const HITL_RESOLUTION_OUTCOMES = [
     "decline",
     "cancel",
 ];
-export const SEAT_CAPABILITY_NAMES = Object.freeze(["pickFolder", "rewind", "recents", "patchSession"]);
+export const SEAT_STREAM_DELTA_TYPE_OF_CHANNEL = Object.freeze({ text: "text_delta", thinking: "thinking_delta" });
+export function seatStreamDeltaMessage(event, ids) {
+    try {
+        const channel = ownDataField(event, "channel");
+        const text = ownDataField(event, "text");
+        const uuid = ownDataField(ids, "uuid");
+        const sessionId = ownDataField(ids, "sessionId");
+        if (typeof channel !== "string" || !Object.hasOwn(SEAT_STREAM_DELTA_TYPE_OF_CHANNEL, channel))
+            return undefined;
+        if (typeof text !== "string")
+            return undefined;
+        if (typeof uuid !== "string" || uuid.length === 0 || typeof sessionId !== "string" || sessionId.length === 0)
+            return undefined;
+        return {
+            type: "stream_event",
+            uuid,
+            session_id: sessionId,
+            event: { type: SEAT_STREAM_DELTA_TYPE_OF_CHANNEL[channel], delta: text },
+            parent_tool_use_id: null,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readSeatStreamDelta(message) {
+    try {
+        if (typeof message !== "object" || message === null)
+            return Object.freeze({ kind: "not_stream_event" });
+        if (ownDataField(message, "type") !== "stream_event")
+            return Object.freeze({ kind: "not_stream_event" });
+        const inner = ownDataField(message, "event");
+        if (typeof inner !== "object" || inner === null)
+            return Object.freeze({ kind: "malformed" });
+        const innerType = ownDataField(inner, "type");
+        if (typeof innerType !== "string")
+            return Object.freeze({ kind: "malformed" });
+        const channel = Object.keys(SEAT_STREAM_DELTA_TYPE_OF_CHANNEL).find((c) => SEAT_STREAM_DELTA_TYPE_OF_CHANNEL[c] === innerType);
+        if (channel === undefined)
+            return Object.freeze({ kind: "unknown_event" });
+        const delta = ownDataField(inner, "delta");
+        return typeof delta === "string" ? Object.freeze({ kind: "delta", channel, delta }) : Object.freeze({ kind: "malformed" });
+    }
+    catch {
+        return Object.freeze({ kind: "malformed" });
+    }
+}
+export const SEAT_CAPABILITY_NAMES = Object.freeze(["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard"]);
 const notReported = () => Object.freeze({ kind: "not_reported" });
 const malformedReading = () => Object.freeze({ kind: "malformed" });
 const reported = (available) => Object.freeze({ kind: "reported", available });
@@ -159,10 +335,7 @@ export function seatCapability(state, name) {
     if (state === undefined)
         return notReported();
     try {
-        if (typeof state !== "object" || state === null || Array.isArray(state))
-            return malformedReading();
-        const proto = Object.getPrototypeOf(state);
-        if (proto !== Object.prototype && proto !== null)
+        if (!isPlainRecord(state))
             return malformedReading();
         const desc = Object.getOwnPropertyDescriptor(state, name);
         if (desc === undefined)
@@ -226,6 +399,9 @@ const SEAT_CAPABILITY_PHRASES = Object.freeze({
     pickFolder: Object.freeze({ action: "Opening a folder", ability: "show a folder picker", support: "folder picker support" }),
     rewind: Object.freeze({ action: "Rewinding to an earlier message", ability: "rewind this session", support: "rewind support" }),
     recents: Object.freeze({ action: "Remembering recent folders", ability: "remember recent folders", support: "recent folders support" }), patchSession: Object.freeze({ action: "Renaming or pinning a conversation", ability: "rename or pin conversations", support: "rename and pin support" }),
+    devices: Object.freeze({ action: "Managing devices", ability: "manage devices", support: "device support" }),
+    engineTarget: Object.freeze({ action: "Switching engines", ability: "switch engines", support: "engine-switching support" }),
+    onboard: Object.freeze({ action: "Model setup", ability: "add models", support: "model-setup support" }),
 });
 export function seatCapabilityUnavailableDetail(name, reading) {
     const phrase = Object.hasOwn(SEAT_CAPABILITY_PHRASES, name)
@@ -354,9 +530,381 @@ export const ATTACHMENT_UPLOAD_REQUEST_KEYS = ["name", "mimeType", "bytes"];
 export const SESSION_ROW_PATCH_REQUEST_KEYS = Object.freeze(["sessionId", "title", "pinned"]);
 export const SESSION_SEARCH_RESULT_KEYS = ["sessionId", "title", "matches"];
 export const GET_TRANSCRIPT_RESULT_KEYS = ["sessionId", "messages"];
+const DEVICE_REFUSED_SPEC = { status: reqF(R_INT0), errorCode: optF(R_STR), message: optF(R_STR) };
+const DEVICE_LANE_ABSENT_SPEC = { runStoreOnly: optF(R_TRUE) };
+const DEVICE_TRANSPORT_SPEC = { detail: optF(R_STR) };
+const DEVICE_UNREADABLE_SPEC = { why: reqF(R_STR) };
+const DEVICE_UNCONFIRMED_SPEC = {
+    why: reqF(oneOfRule("unconfirmed why", ["accepted-unreadable", "transport", "server-error"])),
+    detail: optF(R_STR),
+    mayStillBeRunning: reqF(R_BOOL),
+};
+const DEVICE_RATE_LIMITED_SPEC = { retryAfterSec: optF(R_NUM) };
+const DEVICE_ROSTER_ROW = shapeRule("device row", {
+    deviceId: reqF(R_NONEMPTY),
+    name: optF(R_STR),
+    status: reqF(oneOfRule("device status", ["online", "offline", "unknown"])),
+    lastSeenAt: optF(R_STR),
+});
+const DEVICE_BINDING = shapeRule("device binding", {
+    deviceId: reqF(R_NONEMPTY),
+    rev: reqF(R_INT0),
+    boundAt: optF(R_STR),
+});
+const checkDeviceListOutcome = seatShapeCheck(armsRule("listDevices outcome", "kind", {
+    ok: { devices: reqF(arrayRule(DEVICE_ROSTER_ROW)), dropped: reqF(R_INT0) },
+    unreadable: DEVICE_UNREADABLE_SPEC,
+    "lane-absent": DEVICE_LANE_ABSENT_SPEC,
+    refused: DEVICE_REFUSED_SPEC,
+    transport: DEVICE_TRANSPORT_SPEC,
+    unarmed: {},
+}));
+const checkDeviceSessionBindingOutcome = seatShapeCheck(armsRule("readSessionBinding outcome", "kind", {
+    ok: { rootSessionId: reqF(R_NONEMPTY), boundDevice: reqF(DEVICE_BINDING) },
+    "not-found": {},
+    unreadable: DEVICE_UNREADABLE_SPEC,
+    "lane-absent": DEVICE_LANE_ABSENT_SPEC,
+    refused: DEVICE_REFUSED_SPEC,
+    transport: DEVICE_TRANSPORT_SPEC,
+    unarmed: {},
+}));
+const checkDeviceRebindOutcome = seatShapeCheck(armsRule("rebindSession outcome", "kind", {
+    ok: { deviceId: reqF(R_NONEMPTY), rev: reqF(R_INT0), workspaceCarryover: optF(oneOfRule("carryover", ["none"])) },
+    "active-run": { activeTaskId: optF(R_STR) },
+    "rev-conflict": { currentRev: optF(R_INT0) },
+    "not-found": {},
+    unconfirmed: DEVICE_UNCONFIRMED_SPEC,
+    "lane-absent": DEVICE_LANE_ABSENT_SPEC,
+    refused: DEVICE_REFUSED_SPEC,
+    unarmed: {},
+}));
+const ENROLL_TOKEN_ALLOW = new Set(["token"]);
+const checkDeviceEnrollTokenOutcome = seatShapeCheck(armsRule("issueEnrollToken outcome", "kind", {
+    ok: { token: reqF(R_NONEMPTY), expiresAt: optF(R_STR), ttlSec: optF(R_INT1) },
+    "rate-limited": DEVICE_RATE_LIMITED_SPEC,
+    unreadable: DEVICE_UNREADABLE_SPEC,
+    "lane-absent": DEVICE_LANE_ABSENT_SPEC,
+    refused: DEVICE_REFUSED_SPEC,
+    transport: DEVICE_TRANSPORT_SPEC,
+    unarmed: {},
+}), ENROLL_TOKEN_ALLOW);
+const checkDeviceRevokeOutcome = seatShapeCheck(armsRule("revokeDevice outcome", "kind", {
+    ok: { deviceId: reqF(R_NONEMPTY), revokedAt: optF(R_STR) },
+    "not-found": {},
+    unconfirmed: DEVICE_UNCONFIRMED_SPEC,
+    "lane-absent": DEVICE_LANE_ABSENT_SPEC,
+    refused: DEVICE_REFUSED_SPEC,
+    unarmed: {},
+}));
+export const checkSeatDeviceRebindRequest = seatShapeCheck(shapeRule("rebindSession request", {
+    sessionId: reqF(R_NONEMPTY),
+    toDeviceId: reqF(R_NONEMPTY),
+    expectedRev: reqF(R_INT0),
+    fromDeviceId: reqF(R_NONEMPTY),
+}));
+export const checkSeatDeviceRevokeRequest = seatShapeCheck(shapeRule("revokeDevice request", { deviceId: reqF(R_NONEMPTY), reason: optF(R_STR) }));
+export const ENGINE_TARGET_REFUSALS = Object.freeze([
+    "busy",
+    "switching",
+    "not_configured",
+    "not_signed_in",
+    "probe_failed",
+    "org_policy",
+    "url_refused",
+    "login_failed",
+    "storage_unavailable",
+    "no_local_runtime",
+    "input",
+]);
+export const CLOUD_LOGIN_FAILURES = Object.freeze([
+    "access_denied",
+    "expired_token",
+    "invalid_grant",
+    "cancelled",
+    "transport",
+    "refused",
+    "no_tokens",
+    "other",
+]);
+const R_ISO = R_NONEMPTY;
+const R_LOGIN_FAILURE = oneOfRule("login failure", CLOUD_LOGIN_FAILURES);
+const R_DISPLAY_URL = ruleOf("display url", (v) => {
+    if (typeof v !== "string" || v.length === 0)
+        return false;
+    let u;
+    try {
+        u = new URL(v);
+    }
+    catch {
+        return false;
+    }
+    return (u.protocol === "https:" || u.protocol === "http:") && u.username === "" && u.password === "" && u.search === "" && u.hash === "";
+});
+const R_VERIFICATION_URI_COMPLETE = ruleOf("verification uri", (v) => {
+    if (typeof v !== "string" || v.length === 0)
+        return false;
+    let text = v;
+    for (let i = 0; i < 4; i += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(text);
+        }
+        catch {
+            return false;
+        }
+        if (next === text)
+            break;
+        text = next;
+    }
+    return !/device[_-]?code/i.test(text);
+});
+const ENGINE_PROBE_READING = shapeRule("engine probe", {
+    ok: reqF(R_BOOL),
+    version: optF(R_STR),
+    detail: optF(R_STR),
+    at: reqF(R_ISO),
+});
+const SEAT_LOCAL_MCP_ROW = shapeRule("mcp row", {
+    name: reqF(R_NONEMPTY),
+    status: reqF(R_STR),
+    toolCount: optF(R_INT0),
+    liveness: optF(R_STR),
+    errorCode: optF(R_STR),
+    forcedAsk: optF(arrayRule(R_NONEMPTY, true)),
+});
+const SEAT_LOCAL_MCP_READING = armsRule("mcp reading", "status", {
+    listed: { servers: reqF(arrayRule(SEAT_LOCAL_MCP_ROW)), readAt: reqF(R_ISO), restartRequired: optF(R_TRUE) },
+    unreadable: { cause: reqF(R_NONEMPTY), detail: optF(R_STR), readAt: reqF(R_ISO), restartRequired: optF(R_TRUE) },
+});
+const ENGINE_TARGET_CLOUD = shapeRule("cloud", {
+    configured: reqF(R_BOOL),
+    url: optF(R_DISPLAY_URL),
+    label: optF(R_STR),
+    auth: optF(armsRule("cloud auth", "kind", {
+        registry: { registryUrl: reqF(R_DISPLAY_URL), principal: optF(R_STR), role: optF(R_STR), scope: optF(R_STR) },
+        token: {},
+    })),
+    login: optF(armsRule("cloud login", "state", {
+        pending: {
+            registryUrl: reqF(R_DISPLAY_URL),
+            userCode: reqF(R_NONEMPTY),
+            verificationUri: reqF(R_DISPLAY_URL),
+            verificationUriComplete: optF(R_VERIFICATION_URI_COMPLETE),
+            expiresAt: reqF(R_ISO),
+        },
+        failed: { failure: reqF(R_LOGIN_FAILURE), status: optF(R_INT0), at: reqF(R_ISO) },
+    })),
+    lastProbe: optF(ENGINE_PROBE_READING),
+    authError: optF(shapeRule("auth error", {
+        failure: reqF(R_LOGIN_FAILURE),
+        status: optF(R_INT0),
+        at: reqF(R_ISO),
+    })),
+    orgEngine: optF(shapeRule("org engine", { url: reqF(R_DISPLAY_URL), required: reqF(R_BOOL) })),
+});
+const ENGINE_TARGET_LOCAL = shapeRule("local", {
+    lastBootError: optF(R_STR),
+    mcp: optF(SEAT_LOCAL_MCP_READING),
+});
+const ENGINE_TARGET_STATE = shapeRule("engine target", {
+    mode: reqF(oneOfRule("engine mode", ["local", "cloud"])),
+    generation: reqF(R_INT0),
+    cloud: reqF(ENGINE_TARGET_CLOUD),
+    local: reqF(ENGINE_TARGET_LOCAL),
+});
+const checkEngineTargetState = seatShapeCheck(ENGINE_TARGET_STATE);
+const okArmsRule = (label, okSpec, refusedSpec) => ({
+    label,
+    test: (v, path) => {
+        if (!isPlainRecord(v))
+            return bad("not object", path === "" ? undefined : path);
+        const ok = own(v, "ok");
+        if (ok === true)
+            return shapeVerdict(okSpec, v, path, "ok");
+        if (ok === false)
+            return shapeVerdict(refusedSpec, v, path, "ok");
+        return bad("unknown arm", pathAt(path, "ok"));
+    },
+});
+const ENGINE_TARGET_REFUSED_SPEC = {
+    refusal: reqF(oneOfRule("engineTarget refusal", ENGINE_TARGET_REFUSALS)),
+    failure: optF(R_LOGIN_FAILURE),
+    status: optF(R_INT0),
+    detail: optF(R_STR),
+};
+const checkEngineTargetResult = seatShapeCheck(okArmsRule("engineTarget result", {}, ENGINE_TARGET_REFUSED_SPEC));
+const checkCancelCloudLogin = seatShapeCheck(shapeRule("cancel ack", { ok: reqF(R_BOOL) }));
+const checkCloudLoginStart = seatShapeCheck(okArmsRule("startCloudLogin result", {
+    verificationUri: reqF(R_DISPLAY_URL),
+    verificationUriComplete: optF(R_VERIFICATION_URI_COMPLETE),
+    userCode: reqF(R_NONEMPTY),
+    expiresAt: reqF(R_ISO),
+}, ENGINE_TARGET_REFUSED_SPEC));
+const checkCloudConnectResult = seatShapeCheck(okArmsRule("connect result", {
+    probe: reqF(shapeRule("probe", { version: optF(R_STR) })),
+}, ENGINE_TARGET_REFUSED_SPEC));
+export const checkCloudLoginRequest = seatShapeCheck(shapeRule("startCloudLogin request", { registryUrl: reqF(R_DISPLAY_URL) }));
+export const checkCloudEngineConnectRequest = seatShapeCheck(shapeRule("connectCloudEngine request", { url: reqF(R_DISPLAY_URL) }));
+const CONFIGURE_TOKEN_ALLOW = new Set(["token"]);
+export const checkCloudEngineConfigureRequest = seatShapeCheck(shapeRule("configureCloudEngine request", { url: reqF(R_DISPLAY_URL), token: reqF(R_NONEMPTY) }), CONFIGURE_TOKEN_ALLOW);
+export const ONBOARD_REFUSALS = Object.freeze([
+    "input",
+    "probe_failed",
+    "probe_unverified",
+    "credential_unpaired",
+    "catalog_unreadable",
+    "write_conflict",
+    "write_failed",
+    "engine_is_remote",
+    "env_catalog_present",
+]);
+const R_API_WORD = oneOfRule("api", SETTINGS_MODEL_API_WORDS);
+const ONBOARD_PROBE_RESULT = shapeRule("probe result", {
+    verdict: reqF(oneOfRule("probe verdict", PROBE_VERDICTS)),
+    detail: reqF(R_STR),
+    thinking: optF(R_NONEMPTY),
+});
+const ENGINE_UP_SPEC = { model: reqF(ruleOf("string|null", (x) => x === null || typeof x === "string")) };
+const ENGINE_NOT_UP_SPEC = { reason: reqF(R_STR) };
+const ENGINE_RESTART_OUTCOME = armsRule("engine restart", "state", {
+    started: ENGINE_UP_SPEC,
+    restarted: ENGINE_UP_SPEC,
+    pending: ENGINE_NOT_UP_SPEC,
+    failed: ENGINE_NOT_UP_SPEC,
+    skipped: ENGINE_NOT_UP_SPEC,
+});
+const ONBOARD_SOURCE = armsRule("onboard source", "kind", {
+    preset: { providerId: reqF(R_NONEMPTY) },
+    custom: {},
+    imported: { profileId: reqF(R_NONEMPTY) },
+});
+const ONBOARD_ENTRY_SPEC = {
+    source: reqF(ONBOARD_SOURCE),
+    modelId: reqF(R_NONEMPTY),
+    baseUrl: optF(R_NONEMPTY),
+    api: optF(R_API_WORD),
+    apiKey: optF(R_NONEMPTY),
+    contextWindow: optF(R_INT1),
+    maxTokens: optF(R_INT1),
+};
+const ONBOARD_KEY_ALLOW = new Set(["apiKey"]);
+export const checkOnboardEntryRequest = seatShapeCheck(shapeRule("probeOnboardEntry request", ONBOARD_ENTRY_SPEC), ONBOARD_KEY_ALLOW);
+export const checkOnboardApplyRequest = seatShapeCheck(shapeRule("applyOnboardEntry request", {
+    ...ONBOARD_ENTRY_SPEC,
+    makeDefault: optF(R_BOOL),
+    acceptUnverified: optF(R_BOOL),
+}), ONBOARD_KEY_ALLOW);
+const checkOnboardProbeResult = seatShapeCheck(ONBOARD_PROBE_RESULT);
+const checkOnboardApplyResult = seatShapeCheck(okArmsRule("applyOnboardEntry result", {
+    entryName: reqF(R_NONEMPTY),
+    modelId: reqF(R_NONEMPTY),
+    keyEnv: reqF(R_NONEMPTY),
+    updatedExisting: reqF(R_BOOL),
+    probe: reqF(ONBOARD_PROBE_RESULT),
+    otherIssues: reqF(arrayRule(shapeRule("catalog issue", {
+        name: reqF(R_NONEMPTY),
+        modelId: reqF(R_STR),
+        issue: reqF(R_NONEMPTY),
+    }))),
+    engine: reqF(ENGINE_RESTART_OUTCOME),
+}, {
+    refusal: reqF(oneOfRule("onboard refusal", ONBOARD_REFUSALS)),
+    detail: optF(R_STR),
+    probe: optF(ONBOARD_PROBE_RESULT),
+}));
+const checkOnboardProvidersResult = seatShapeCheck(shapeRule("onboard providers", {
+    providers: reqF(arrayRule(shapeRule("provider row", {
+        id: reqF(R_NONEMPTY),
+        name: reqF(R_NONEMPTY),
+        baseUrl: reqF(R_NONEMPTY),
+        api: reqF(R_API_WORD),
+        keyAuth: reqF(R_BOOL),
+        authEnv: reqF(R_STR),
+        models: reqF(arrayRule(shapeRule("provider model", {
+            id: reqF(R_NONEMPTY),
+            contextWindow: reqF(R_INT1),
+            maxTokens: reqF(R_INT1),
+        }))),
+        consoleUrl: optF(R_STR),
+    }))),
+    importable: optF(arrayRule(shapeRule("importable profile", {
+        id: reqF(R_NONEMPTY),
+        name: reqF(R_STR),
+        baseUrl: reqF(R_NONEMPTY),
+        api: reqF(R_API_WORD),
+        hasKey: reqF(R_BOOL),
+        models: reqF(arrayRule(R_NONEMPTY)),
+    }))),
+}));
+const checkSessionMcpPanelFailure = seatShapeCheck(armsRule("readSessionMcpPanel failure", "kind", {
+    unreadable: DEVICE_UNREADABLE_SPEC,
+    transport: DEVICE_TRANSPORT_SPEC,
+    unarmed: {},
+}));
+function mcpPanelLivenessArms() {
+    const arms = {};
+    for (const state of MCP_LIVENESS_STATES)
+        arms[state] = state === "unreachable" ? { observedAt: reqF(R_NUM), errorCode: optF(R_NONEMPTY) } : { observedAt: reqF(R_NUM) };
+    const keysPin = [true, true];
+    void keysPin;
+    return arms;
+}
+const MCP_PANEL_LIVENESS_VIEW = armsRule("mcp liveness", "state", mcpPanelLivenessArms());
+const MCP_PANEL_LEG_ENTRY = shapeRule("leg entry", {
+    name: reqF(R_NONEMPTY),
+    status: reqF(R_NONEMPTY),
+    source: optF(R_NONEMPTY),
+    errorCode: optF(R_NONEMPTY),
+    toolCount: optF(R_NUM),
+    delivered: optF(R_NONEMPTY),
+    httpStatus: optF(R_NUM),
+    liveness: optF(MCP_PANEL_LIVENESS_VIEW),
+    livenessUnreadable: optF(R_TRUE),
+});
+const MCP_PANEL_LAST_LEG = shapeRule("last leg", {
+    runId: reqF(R_NONEMPTY),
+    at: reqF(R_NONEMPTY),
+    mcp: reqF(arrayRule(MCP_PANEL_LEG_ENTRY)),
+});
+const MCP_PANEL_SERVER_ROW = shapeRule("panel server", {
+    name: reqF(R_NONEMPTY),
+    status: reqF(R_NONEMPTY),
+    serverInfo: optF(shapeRule("server info", {
+        name: reqF(R_STR),
+        version: reqF(R_STR),
+    })),
+    toolNames: optF(arrayRule(R_STR)),
+    error: optF(R_STR),
+});
+const MCP_PANEL_SCENARIO_REFUSAL = shapeRule("scenario refusal", {
+    errorCode: optF(R_NONEMPTY),
+    error: optF(R_STR),
+    scenario: optF(R_NONEMPTY),
+    source: optF(oneOfRule("refusal source", ["ruling", "deployment"])),
+});
+const checkSessionMcpPanelServersView = seatShapeCheck(shapeRule("servers view", {
+    asOf: reqF(R_NONEMPTY),
+    lastLegMcp: optF(MCP_PANEL_LAST_LEG),
+    lastLegMcpUnreadable: optF(R_TRUE),
+    servers: reqF(arrayRule(MCP_PANEL_SERVER_ROW)),
+    degraded: optF(R_TRUE),
+}));
+const checkSessionMcpPanelRefusalView = seatShapeCheck(shapeRule("refusal view", {
+    asOf: reqF(R_NONEMPTY),
+    lastLegMcp: optF(MCP_PANEL_LAST_LEG),
+    lastLegMcpUnreadable: optF(R_TRUE),
+    scenarioRefusal: reqF(MCP_PANEL_SCENARIO_REFUSAL),
+}));
+const checkSessionMcpPanelResult = seatCheck((v) => {
+    if (!isPlainRecord(v))
+        return bad("mcp panel result is not a plain object");
+    if (Object.hasOwn(v, "kind"))
+        return checkSessionMcpPanelFailure(v);
+    return Object.hasOwn(v, "scenarioRefusal") ? checkSessionMcpPanelRefusalView(v) : checkSessionMcpPanelServersView(v);
+});
 const checkLocalSessionRecord = seatCheck((s) => {
-    if (!isObject(s))
-        return bad("session record is not an object");
+    if (!isPlainRecord(s))
+        return bad("session record is not a plain object");
     if (typeof own(s, "sessionId") !== "string")
         return bad("sessionId must be a string", "sessionId");
     if (!optionalString(own(s, "engineSessionId")))
@@ -377,7 +925,7 @@ const checkLocalSessionRecord = seatCheck((s) => {
         return bad("lastActivityAt must be a string when present", "lastActivityAt");
     const q = own(s, "queuedMessages");
     if (!isAbsent(q)) {
-        const okQueue = Array.isArray(q) && ownItems(q).every((row) => isObject(row) && typeof own(row, "uuid") === "string" && typeof own(row, "text") === "string");
+        const okQueue = Array.isArray(q) && ownItems(q).every((row) => isPlainRecord(row) && typeof own(row, "uuid") === "string" && typeof own(row, "text") === "string");
         if (!okQueue)
             return bad("queuedMessages must be an array of {uuid,text}", "queuedMessages");
     }
@@ -395,8 +943,8 @@ export function isLocalSessionRecord(s) {
     return checkLocalSessionRecord(s) === true;
 }
 const checkToctouBinding = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("toctouBinding must be an object", "toctouBinding");
+    if (!isPlainRecord(v))
+        return bad("toctouBinding must be a plain object", "toctouBinding");
     if (typeof own(v, "callId") !== "string")
         return bad("toctouBinding.callId must be a string", "toctouBinding.callId");
     if (typeof own(v, "inputHash") !== "string")
@@ -404,8 +952,8 @@ const checkToctouBinding = seatCheck((v) => {
     return true;
 });
 const checkToolPermissionRequest = seatCheck((r) => {
-    if (!isObject(r))
-        return bad("tool permission request is not an object");
+    if (!isPlainRecord(r))
+        return bad("tool permission request is not a plain object");
     const requestId = own(r, "requestId");
     if (typeof requestId !== "string")
         return bad("requestId must be a string", "requestId");
@@ -440,8 +988,8 @@ export function isToolPermissionRequest(r) {
     return checkToolPermissionRequest(r) === true;
 }
 const checkLaneProof = seatCheckAt((v, field) => {
-    if (!isObject(v))
-        return bad("laneProof must be an object", field);
+    if (!isPlainRecord(v))
+        return bad("laneProof must be a plain object", field);
     const lane = own(v, "lane");
     if (typeof lane !== "string" || !inTuple(LANE_PROOF_LANE_TUPLE, lane)) {
         return bad(`laneProof.lane must be one of ${LANE_PROOF_LANE_TUPLE.join("|")}`, `${field}.lane`);
@@ -454,20 +1002,111 @@ const checkLaneProof = seatCheckAt((v, field) => {
     }
     return true;
 });
+const R_NEVER = ruleOf("absent", () => false);
+const RETRY_ERROR_PAYLOAD = shapeRule("retry error", {
+    formatted: reqF(R_STR),
+    isNetworkDown: optF(R_BOOL),
+    connection: optF(shapeRule("connection", { isSSLError: optF(R_BOOL) })),
+    rateLimits: optF({
+        label: "rate limits",
+        test: (v, path) => v === null
+            ? true
+            : shapeVerdict({ resetsAt: optF(R_NUM), rateLimitType: optF(R_STR) }, v, path),
+    }),
+});
+const RETRY_COMMON_SPEC = {
+    deadline: reqF(R_NUM),
+    attempt: optF(R_NUM),
+    maxRetries: optF(R_NUM),
+    errClass: optF(R_STR),
+    retryAtMs: optF(R_NUM),
+    errorStatus: optF(R_NUM),
+    providerCondition: optF(R_STR),
+    providerConditionSource: optF(R_STR),
+    elapsedMs: optF(R_NUM),
+    timeoutMs: optF(R_NUM),
+};
+const RETRY_STATUS = armsRule("retry status", "kind", {
+    stalled: { ...RETRY_COMMON_SPEC, detail: optF(R_STR) },
+    error: { ...RETRY_COMMON_SPEC, terminal: optF(R_TRUE), error: reqF(RETRY_ERROR_PAYLOAD) },
+    waiting: { ...RETRY_COMMON_SPEC, terminal: optF(R_NEVER), error: reqF(RETRY_ERROR_PAYLOAD) },
+});
+const ENGINE_TURN_USAGE = shapeRule("engine usage", {
+    inputTokens: reqF(R_NUM),
+    totalInputTokens: reqF(R_NUM),
+    outputTokens: reqF(R_NUM),
+    cacheReadTokens: reqF(R_NUM),
+    cacheWriteTokens: reqF(R_NUM),
+    costMicroUsd: reqF(R_NUM),
+});
+const SEMA_MODEL_USAGE = shapeRule("model usage", {
+    inputTokens: reqF(R_NUM),
+    outputTokens: reqF(R_NUM),
+    cacheReadInputTokens: reqF(R_NUM),
+    cacheCreationInputTokens: reqF(R_NUM),
+    webSearchRequests: reqF(R_NUM),
+    costUSD: reqF(R_NUM),
+    contextWindow: reqF(R_NUM),
+    maxOutputTokens: reqF(R_NUM),
+    canonicalModel: optF(R_STR),
+    provider: optF(R_STR),
+    _sema_cost_absent: optF(R_TRUE),
+    _sema_web_search_requests_absent: optF(R_TRUE),
+    _sema_context_window_absent: optF(R_TRUE),
+    _sema_max_output_tokens_absent: optF(R_TRUE),
+});
+const SEAT_CHROME_PAYLOAD_SPECS = {
+    retry_status: { status: reqF({ label: "retry status", test: (v, path) => (v === null ? true : RETRY_STATUS.test(v, path)) }) },
+    context_usage: {
+        usedTokens: optF(R_NUM),
+        windowTokens: optF(R_NUM),
+        compactAtTokens: optF(R_NUM),
+        sections: optF(arrayRule(shapeRule("section", { id: reqF(R_STR), tokens: reqF(R_NUM), kind: optF(R_STR) }))),
+        eventId: optF(R_NONEMPTY),
+    },
+    last_turn_usage: {
+        usage: reqF(SEMA_MODEL_USAGE),
+        engineUsage: optF(ENGINE_TURN_USAGE),
+        engineUsageUnknownKeys: optF(R_INT1),
+        usageMissing: optF(R_TRUE),
+        stopReason: optF(R_STR),
+        responseModel: optF(R_NONEMPTY),
+    },
+    bgshell_register: {
+        taskId: reqF(R_NONEMPTY),
+        registration: reqF(shapeRule("registration", {
+            kind: reqF(oneOfRule("registration kind", ["register"])),
+            taskId: reqF(R_NONEMPTY),
+            command: reqF(R_STR),
+            description: optF(R_STR),
+            receipt: reqF(R_STR),
+            source: reqF(oneOfRule("registration source", ["bash", "monitor"])),
+        })),
+    },
+    bgshell_settle: { taskId: reqF(R_NONEMPTY), status: reqF(R_STR), outputPath: optF(R_STR) },
+    memory_saved: { id: reqF(R_NONEMPTY), notes: reqF(arrayRule(R_NONEMPTY, true)) },
+};
+const ENVELOPE_ROWS = { kind: reqF({ label: "kind", test: () => true }), laneProof: reqF({ label: "laneProof", test: () => true }) };
 const checkSeatChromeEnvelope = seatCheckAt((v, field) => {
-    if (!isObject(v))
-        return bad("chrome must be an object", field);
+    if (!isPlainRecord(v))
+        return bad("chrome must be a plain object", field);
     const kind = own(v, "kind");
     if (typeof kind !== "string")
         return bad("chrome.kind must be a string", `${field}.kind`);
     if (!inTuple(CHROME_EVENT_KIND_TUPLE, kind)) {
         return bad(`chrome.kind is not a renderer-wired arm (${CHROME_EVENT_KIND_TUPLE.join("|")})`, `${field}.kind`);
     }
-    return checkLaneProof(own(v, "laneProof"), `${field}.laneProof`);
+    const lane = checkLaneProof(own(v, "laneProof"), `${field}.laneProof`);
+    if (lane !== true)
+        return lane;
+    if (Object.hasOwn(SEAT_CHROME_PAYLOAD_SPECS, kind)) {
+        return shapeVerdict({ ...ENVELOPE_ROWS, ...SEAT_CHROME_PAYLOAD_SPECS[kind] }, v, field);
+    }
+    return true;
 });
 const checkLocalSessionEvent = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("event is not an object");
+    if (!isPlainRecord(v))
+        return bad("event is not a plain object");
     const type = own(v, "type");
     if (typeof type !== "string")
         return bad("type must be a string", "type");
@@ -476,9 +1115,6 @@ const checkLocalSessionEvent = seatCheck((v) => {
     }
     if (typeof own(v, "sessionId") !== "string")
         return bad("sessionId must be a string", "sessionId");
-    const messages = own(v, "messages");
-    if (!isAbsent(messages) && !Array.isArray(messages))
-        return bad("messages must be an array", "messages");
     if (!optionalString(own(v, "error")))
         return bad("error must be a string when present", "error");
     if (!optionalString(own(v, "errorCategory")))
@@ -486,26 +1122,6 @@ const checkLocalSessionEvent = seatCheck((v) => {
     const code = own(v, "code");
     if (!isAbsent(code) && typeof code !== "number")
         return bad("code must be a number when present", "code");
-    const request = own(v, "request");
-    if (!isAbsent(request)) {
-        const verdict = checkToolPermissionRequest(request);
-        if (verdict !== true)
-            return nested("request", verdict);
-    }
-    if (!optionalString(own(v, "data")))
-        return bad("data must be a string when present", "data");
-    const sources = own(v, "sources");
-    if (!isAbsent(sources)) {
-        const okSources = Array.isArray(sources) && ownItems(sources).every((t) => typeof t === "string");
-        if (!okSources)
-            return bad("sources must be a string[]", "sources");
-    }
-    const mode = own(v, "permissionMode");
-    if (!isAbsent(mode)) {
-        if (typeof mode !== "string" || !inTuple(PERMISSION_MODE_INTENTS, mode)) {
-            return bad(`permissionMode must be one of ${PERMISSION_MODE_INTENTS.join("|")}`, "permissionMode");
-        }
-    }
     const session = own(v, "session");
     if (!isAbsent(session)) {
         const verdict = checkLocalSessionRecord(session);
@@ -514,10 +1130,6 @@ const checkLocalSessionEvent = seatCheck((v) => {
     }
     if (!optionalString(own(v, "userMessageUuid")))
         return bad("userMessageUuid must be a string when present", "userMessageUuid");
-    const hasPreClearSession = own(v, "hasPreClearSession");
-    if (!isAbsent(hasPreClearSession) && typeof hasPreClearSession !== "boolean") {
-        return bad("hasPreClearSession must be a boolean when present", "hasPreClearSession");
-    }
     if (!optionalString(own(v, "requestId")))
         return bad("requestId must be a string when present", "requestId");
     const outcome = own(v, "outcome");
@@ -537,14 +1149,49 @@ const checkLocalSessionEvent = seatCheck((v) => {
         if (verdict !== true)
             return nested("chrome", verdict);
     }
+    const sub = own(v, "subagentContent");
+    if (type === "subagent_content") {
+        if (isAbsent(sub))
+            return bad("missing key", "subagentContent");
+        const verdict = SUBAGENT_CONTENT_SHAPE.test(sub, "subagentContent");
+        if (verdict !== true)
+            return verdict;
+    }
+    else if (!isAbsent(sub)) {
+        return bad("unexpected key", "subagentContent");
+    }
     return true;
 });
+const SUBAGENT_CONTENT_SHAPE = shapeRule("subagent content", {
+    type: reqF(oneOfRule("content type", ["text_delta", "reasoning_delta", "text", "reasoning", "tool_start", "tool_end"])),
+    taskId: reqF(R_NONEMPTY),
+    parentToolCallId: reqF(R_NONEMPTY),
+    delta: optF(R_STR),
+    text: optF(R_STR),
+    eventId: optF(R_STR),
+    toolCallId: optF(R_STR),
+    toolName: optF(R_STR),
+    args: optF({ label: "passthrough", test: () => true }),
+    output: optF(R_STR),
+    isError: optF(R_BOOL),
+});
+export function readSeatSubagentContent(event) {
+    try {
+        if (checkLocalSessionEvent(event) !== true || own(event, "type") !== "subagent_content")
+            return undefined;
+        const sub = own(event, "subagentContent");
+        return { ...sub };
+    }
+    catch {
+        return undefined;
+    }
+}
 export function isLocalSessionEvent(v) {
     return checkLocalSessionEvent(v) === true;
 }
 const checkAttachmentUploadReceipt = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("upload receipt is not an object");
+    if (!isPlainRecord(v))
+        return bad("upload receipt is not a plain object");
     if (typeof own(v, "id") !== "string")
         return bad("id must be a string", "id");
     if (typeof own(v, "name") !== "string")
@@ -560,43 +1207,62 @@ const checkAttachmentUploadReceipt = seatCheck((v) => {
 export function isAttachmentUploadReceipt(v) {
     return checkAttachmentUploadReceipt(v) === true;
 }
+export const APPLY_MODEL_CONFIG_REASONS = Object.freeze([
+    "shadowed_by_models_json",
+    "cheap_provider_unsupported",
+    "invalid_request",
+    "write_failed",
+    "unavailable",
+]);
+const APPLY_MODEL_CONFIG_REASON_DETAILS = Object.freeze({
+    shadowed_by_models_json: "Models are managed in the local engine setup window on this device — open it to change the model (Engine ▸ Set up local engine…). Nothing was saved here.",
+    cheap_provider_unsupported: "The cheap model has to use the default model's provider on this desktop seat (same base URL, API and key). Nothing was saved.",
+    invalid_request: "The model configuration was not valid, so it was not applied.",
+    write_failed: "The model configuration could not be saved.",
+    unavailable: "The model configuration can't be changed from this app right now. Nothing was saved.",
+});
+export function applyModelConfigReasonDetail(reason) {
+    if (typeof reason === "string" && inTuple(APPLY_MODEL_CONFIG_REASONS, reason))
+        return APPLY_MODEL_CONFIG_REASON_DETAILS[reason];
+    return "The seat rejected this configuration.";
+}
 const checkApplyModelConfigResult = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("applyModelConfig result is not an object");
+    if (!isPlainRecord(v))
+        return bad("applyModelConfig result is not a plain object");
     const ok = own(v, "ok");
     if (typeof ok !== "boolean")
         return bad("ok must be a boolean", "ok");
     if (typeof own(v, "requiresRestart") !== "boolean")
         return bad("requiresRestart must be a boolean", "requiresRestart");
     const reason = own(v, "reason");
-    if (ok === false && (typeof reason !== "string" || reason.length === 0)) {
-        return bad("reason must be a non-empty string when ok is false", "reason");
+    if (!isAbsent(reason) && (typeof reason !== "string" || !inTuple(APPLY_MODEL_CONFIG_REASONS, reason))) {
+        return bad(`reason must be one of ${APPLY_MODEL_CONFIG_REASONS.join("|")} when present`, "reason");
     }
-    if (reason !== undefined && typeof reason !== "string")
-        return bad("reason must be a string when present", "reason");
+    if (ok === false && isAbsent(reason)) {
+        return bad(`reason must be present when ok is false (one of ${APPLY_MODEL_CONFIG_REASONS.join("|")})`, "reason");
+    }
+    if (!optionalString(own(v, "detail")))
+        return bad("detail must be a string when present", "detail");
     return true;
 });
 const checkLiveModelCatalog = seatCheck((v) => {
-    if (!isObject(v) || Array.isArray(v))
-        return bad("model catalog is not an object");
+    if (!isPlainRecord(v))
+        return bad("model catalog is not a plain object");
     const models = own(v, "models");
     if (!Array.isArray(models))
         return bad("models must be an array", "models");
     const rows = ownItems(models);
     const names = new Set();
     for (let i = 0; i < rows.length; i += 1) {
-        const row = liveModelRowCopy(rows[i]);
+        const row = isPlainRecord(rows[i]) ? liveModelRowCopy(rows[i]) : undefined;
         if (row === undefined)
-            return bad(`models[${i}] is not a catalog row (an object whose name is a non-empty string, JSON values only)`, `models[${i}]`);
+            return bad(`models[${i}] is not a catalog row (a plain object whose name is a non-empty string, JSON values only)`, `models[${i}]`);
         if (names.has(row.name))
             return bad(`models[${i}] repeats the name of an earlier row`, `models[${i}].name`);
         names.add(row.name);
     }
-    const dflt = own(v, "default");
-    if (typeof dflt !== "string" || dflt.length === 0)
-        return bad("default must be a non-empty string", "default");
     const defaultModel = own(v, "defaultModel");
-    if (!isAbsent(defaultModel) && liveDefaultModelCopy(defaultModel) === undefined) {
+    if (!isAbsent(defaultModel) && (!isPlainRecord(defaultModel) || liveDefaultModelCopy(defaultModel) === undefined)) {
         return bad("defaultModel must be {id: non-empty string, name?: non-empty string} when present", "defaultModel");
     }
     return true;
@@ -737,8 +1403,8 @@ export function isSessionRowPatchRequest(v) {
     return checkSessionRowPatchRequest(v) === true;
 }
 const checkSendMessageAck = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("sendMessage ack is not an object");
+    if (!isPlainRecord(v))
+        return bad("sendMessage ack is not a plain object");
     if (typeof own(v, "sessionId") !== "string")
         return bad("sessionId must be a string", "sessionId");
     if (typeof own(v, "userMessageUuid") !== "string")
@@ -751,13 +1417,13 @@ const checkSendMessageAck = seatCheck((v) => {
 export function isSendMessageAck(v) {
     return checkSendMessageAck(v) === true;
 }
-const checkInterruptAck = seatCheck((v) => isObject(v) && typeof own(v, "interrupted") === "boolean" ? true : bad("interrupt ack needs boolean `interrupted`", "interrupted"));
-const checkStopAck = seatCheck((v) => isObject(v) && typeof own(v, "stopped") === "boolean" ? true : bad("stop ack needs boolean `stopped`", "stopped"));
-const checkOkAck = seatCheck((v) => isObject(v) && typeof own(v, "ok") === "boolean" ? true : bad("ack needs boolean `ok`", "ok"));
+const checkInterruptAck = seatCheck((v) => isPlainRecord(v) && typeof own(v, "interrupted") === "boolean" ? true : bad("interrupt ack needs a plain object with boolean `interrupted`", "interrupted"));
+const checkStopAck = seatCheck((v) => isPlainRecord(v) && typeof own(v, "stopped") === "boolean" ? true : bad("stop ack needs a plain object with boolean `stopped`", "stopped"));
+const checkOkAck = seatCheck((v) => isPlainRecord(v) && typeof own(v, "ok") === "boolean" ? true : bad("ack needs a plain object with boolean `ok`", "ok"));
 const checkBooleanAck = (v) => typeof v === "boolean" ? true : bad("expected a bare boolean result");
 const checkGetTranscriptResult = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("transcript envelope is not an object");
+    if (!isPlainRecord(v))
+        return bad("transcript envelope is not a plain object");
     if (typeof own(v, "sessionId") !== "string")
         return bad("sessionId must be a string", "sessionId");
     if (!Array.isArray(own(v, "messages")))
@@ -765,8 +1431,8 @@ const checkGetTranscriptResult = seatCheck((v) => {
     return true;
 });
 const checkSessionSearchResult = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("search result row is not an object");
+    if (!isPlainRecord(v))
+        return bad("search result row is not a plain object");
     if (typeof own(v, "sessionId") !== "string")
         return bad("sessionId must be a string", "sessionId");
     if (!optionalString(own(v, "title")))
@@ -774,14 +1440,14 @@ const checkSessionSearchResult = seatCheck((v) => {
     const matches = own(v, "matches");
     if (!Array.isArray(matches))
         return bad("matches must be an array", "matches");
-    const okMatches = ownItems(matches).every((m) => isObject(m) && typeof own(m, "snippet") === "string");
+    const okMatches = ownItems(matches).every((m) => isPlainRecord(m) && typeof own(m, "snippet") === "string");
     if (!okMatches)
         return bad("matches must be {snippet:string}[]", "matches");
     return true;
 });
 const checkSessionSearchEnvelope = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("search envelope is not an object");
+    if (!isPlainRecord(v))
+        return bad("search envelope is not a plain object");
     const results = own(v, "results");
     if (!Array.isArray(results))
         return bad("results must be an array", "results");
@@ -794,8 +1460,8 @@ const checkSessionSearchEnvelope = seatCheck((v) => {
     return true;
 });
 const checkSessionsState = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("sessions state is not an object");
+    if (!isPlainRecord(v))
+        return bad("sessions state is not a plain object");
     const sessions = own(v, "sessions");
     if (!Array.isArray(sessions))
         return bad("sessions must be an array", "sessions");
@@ -808,8 +1474,8 @@ const checkSessionsState = seatCheck((v) => {
     return true;
 });
 const checkFocusedSessionState = seatCheck((v) => {
-    if (!isObject(v))
-        return bad("focused session state is not an object");
+    if (!isPlainRecord(v))
+        return bad("focused session state is not a plain object");
     const sessionId = own(v, "sessionId");
     if (sessionId !== null && typeof sessionId !== "string") {
         return bad("sessionId must be a string or null", "sessionId");
@@ -855,10 +1521,7 @@ const checkRecentFoldersResult = seatCheck((v) => {
     return true;
 });
 const checkSeatCapabilitiesState = seatCheck((v) => {
-    if (!isObject(v) || Array.isArray(v))
-        return bad("seat capabilities state is not an object");
-    const proto = Object.getPrototypeOf(v);
-    if (proto !== Object.prototype && proto !== null)
+    if (!isPlainRecord(v))
         return bad("seat capabilities state is not a plain object");
     for (const k of Reflect.ownKeys(v)) {
         const name = typeof k === "string" ? k : String(k);
@@ -893,6 +1556,21 @@ export const LOCAL_SESSIONS_SPEC = {
         pickFolder: { kind: "invoke", check: checkPickFolderResult },
         listRecentFolders: { kind: "invoke", check: checkRecentFoldersResult },
         noteRecentFolder: { kind: "invoke", check: checkOkAck }, patchSession: { kind: "invoke", check: checkLocalSessionRecord },
+        listDevices: { kind: "invoke", check: checkDeviceListOutcome },
+        readSessionBinding: { kind: "invoke", check: checkDeviceSessionBindingOutcome },
+        rebindSession: { kind: "invoke", check: checkDeviceRebindOutcome },
+        issueEnrollToken: { kind: "invoke", check: checkDeviceEnrollTokenOutcome },
+        revokeDevice: { kind: "invoke", check: checkDeviceRevokeOutcome },
+        setEngineMode: { kind: "invoke", check: checkEngineTargetResult },
+        startCloudLogin: { kind: "invoke", check: checkCloudLoginStart },
+        cancelCloudLogin: { kind: "invoke", check: checkCancelCloudLogin },
+        connectCloudEngine: { kind: "invoke", check: checkCloudConnectResult },
+        configureCloudEngine: { kind: "invoke", check: checkCloudConnectResult },
+        clearCloudEngine: { kind: "invoke", check: checkEngineTargetResult },
+        listOnboardProviders: { kind: "invoke", check: checkOnboardProvidersResult },
+        probeOnboardEntry: { kind: "invoke", check: checkOnboardProbeResult },
+        applyOnboardEntry: { kind: "invoke", check: checkOnboardApplyResult },
+        readSessionMcpPanel: { kind: "invoke", check: checkSessionMcpPanelResult },
         onEvent: { kind: "event", check: checkLocalSessionEvent },
         onToolPermissionRequest: { kind: "event", check: checkToolPermissionRequest },
     },
@@ -901,6 +1579,7 @@ export const LOCAL_SESSIONS_SPEC = {
         focusedSessionState: { check: checkFocusedSessionState },
         settingsState: { check: checkSettingsState },
         seatCapabilitiesState: { check: checkSeatCapabilitiesState },
+        engineTargetState: { check: checkEngineTargetState },
     },
 };
 export const SEAT_METHOD_NAMES = [
@@ -922,6 +1601,21 @@ export const SEAT_METHOD_NAMES = [
     "pickFolder",
     "listRecentFolders",
     "noteRecentFolder", "patchSession",
+    "listDevices",
+    "readSessionBinding",
+    "rebindSession",
+    "issueEnrollToken",
+    "revokeDevice",
+    "setEngineMode",
+    "startCloudLogin",
+    "cancelCloudLogin",
+    "connectCloudEngine",
+    "configureCloudEngine",
+    "clearCloudEngine",
+    "listOnboardProviders",
+    "probeOnboardEntry",
+    "applyOnboardEntry",
+    "readSessionMcpPanel",
     "onEvent",
     "onToolPermissionRequest",
 ];
@@ -930,27 +1624,24 @@ export const SEAT_STORE_PROPS = [
     "focusedSessionStateStore",
     "settingsStateStore",
     "seatCapabilitiesStateStore",
+    "engineTargetStateStore",
 ];
 export const SEAT_EVENT_METHOD_NAMES = ["onEvent", "onToolPermissionRequest"];
 export const LOCAL_SESSION_EVENT_KEYS = [
     "type",
     "sessionId",
     "message",
-    "messages",
     "error",
     "errorCategory",
     "code",
-    "request",
-    "data",
-    "sources",
-    "permissionMode",
     "session",
     "userMessageUuid",
-    "hasPreClearSession",
     "requestId",
     "outcome",
     "parked",
     "chrome",
+    "_sema_turnFailure",
+    "subagentContent",
 ];
 export const TOOL_PERMISSION_REQUEST_KEYS = [
     "requestId",
@@ -1083,27 +1774,26 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
         validated: [
             "type",
             "sessionId",
-            "messages",
             "error",
             "errorCategory",
             "code",
-            "request",
-            "data",
-            "sources",
-            "permissionMode",
             "session",
             "userMessageUuid",
-            "hasPreClearSession",
             "requestId",
             "outcome",
             "parked",
             "chrome",
+            "subagentContent",
         ],
         unchecked: [
             {
                 key: "message",
                 why: "transcript 面直通位(CC fQe 逐字姿态:SDKMessage 体不做 schema 校验)—— 校它 = 引擎加一种消息体的那天整条转录被门吃掉。",
             },
+            {
+                key: "_sema_turnFailure",
+                why: "turn 失败的呈现判决(CC-378 TK-9),核形在包读口 readSeatTurnFailure(坏形 / 表外类别词 ⇒ undefined、渲染端只渲 error 文本);出站门为它拒掉整条 error 事件 = 宿主 settle 照走、渲染端把失败轮渲成完成,所以门只登键不拒。",
+            },
         ],
     },
     AttachmentUploadReceipt: {
@@ -1114,7 +1804,7 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
     },
     LiveModelCatalog: {
         check: checkLiveModelCatalog,
-        validated: ["models", "default", "defaultModel"],
+        validated: ["models", "defaultModel"],
         unchecked: [
             {
                 key: "droppedEntries",
@@ -1154,7 +1844,7 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
     },
     ApplyModelConfigResult: {
         check: checkApplyModelConfigResult,
-        validated: ["ok", "requiresRestart", "reason"],
+        validated: ["ok", "requiresRestart", "reason", "detail"],
         unchecked: [],
     },
     SendMessageAck: {
@@ -1205,7 +1895,7 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
     },
     SeatCapabilitiesState: {
         check: checkSeatCapabilitiesState,
-        validated: ["pickFolder", "rewind", "recents", "patchSession"],
+        validated: ["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard"],
         unchecked: [],
     },
     RecentFoldersResult: {
@@ -1238,8 +1928,39 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
         validated: ["kind", "laneProof"],
         unchecked: [],
     },
+    SessionMcpPanelResult: {
+        check: checkSessionMcpPanelResult,
+        validated: ["kind", "why", "detail", "asOf", "servers", "lastLegMcp", "lastLegMcpUnreadable", "degraded", "scenarioRefusal"],
+        unchecked: [],
+    },
 };
 export const SEAT_VALIDATOR_COVERAGE_EXEMPT = [
+    ...[
+        ["DeviceListOutcome", checkDeviceListOutcome],
+        ["DeviceSessionBindingOutcome", checkDeviceSessionBindingOutcome],
+        ["DeviceRebindOutcome", checkDeviceRebindOutcome],
+        ["DeviceEnrollTokenOutcome", checkDeviceEnrollTokenOutcome],
+        ["DeviceRevokeOutcome", checkDeviceRevokeOutcome],
+        ["SeatDeviceRebindRequest", checkSeatDeviceRebindRequest],
+        ["SeatDeviceRevokeRequest", checkSeatDeviceRevokeRequest],
+        ["EngineTargetState", checkEngineTargetState],
+        ["EngineTargetResult", checkEngineTargetResult],
+        ["CloudLoginStart", checkCloudLoginStart],
+        ["CloudLoginCancelAck", checkCancelCloudLogin],
+        ["CloudConnectResult", checkCloudConnectResult],
+        ["CloudLoginRequest", checkCloudLoginRequest],
+        ["CloudEngineConnectRequest", checkCloudEngineConnectRequest],
+        ["CloudEngineConfigureRequest", checkCloudEngineConfigureRequest],
+        ["OnboardProvidersResult", checkOnboardProvidersResult],
+        ["OnboardProbeResult", checkOnboardProbeResult],
+        ["OnboardApplyResult", checkOnboardApplyResult],
+        ["OnboardEntryRequest", checkOnboardEntryRequest],
+        ["OnboardApplyRequest", checkOnboardApplyRequest],
+    ].map(([label, check]) => ({
+        label,
+        check,
+        why: "座位闭形规则铸的判官(规格表型由对象型派生,键集与必选性编译期两向钉);逐臂逐键投毒在三只席位门(见上方注)。",
+    })),
     {
         label: "PickFolderResult",
         check: checkPickFolderResult,
@@ -1282,5 +2003,8 @@ const _seatContractPins = [
     true, true,
     true, true, true, true,
     true, true, true, true, true, true,
+    true, true,
+    true, true, true, true,
+    true, true, true,
 ];
 void _seatContractPins;