@sema-agent/client-core 0.98.0 → 0.100.0

package/dist/generated/settingsSchemaHooksClassifier.js

@@ -0,0 +1,254 @@
+export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
+    const HOOK_GUARD_EVENTS = ["PreToolUse", "PermissionRequest"];
+    const HOOK_SHELLS = ["bash", "powershell"];
+    const HOOK_ENTRY_COMMON_FIELDS = { if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?" };
+    const HOOK_ENTRY_FIELDS = {
+        command: { command: "text", shell: "shell?", async: "boolean?", asyncRewake: "boolean?", ...HOOK_ENTRY_COMMON_FIELDS },
+        prompt: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
+        agent: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
+        http: { url: "text", headers: "stringRecord?", allowedEnvVars: "stringList?", ...HOOK_ENTRY_COMMON_FIELDS },
+        mcp_tool: { server: "string", tool: "string", input: "record?", ...HOOK_ENTRY_COMMON_FIELDS },
+    };
+    function hookIsRecord(value) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const proto = Object.getPrototypeOf(value);
+        return proto === Object.prototype || proto === null;
+    }
+    function hookGuardKeyOf(node) {
+        for (const key of Object.keys(node)) {
+            if (!HOOK_GUARD_EVENTS.includes(key))
+                continue;
+            const value = node[key];
+            if (value !== null && value !== undefined && !(Array.isArray(value) && value.length === 0))
+                return key;
+        }
+        return undefined;
+    }
+    function hookLooksLikeMatcher(value) {
+        if (!hookIsRecord(value))
+            return false;
+        const inner = Object.hasOwn(value, "hooks") ? value.hooks : undefined;
+        if (Array.isArray(inner))
+            return inner.length > 0;
+        return hookIsRecord(inner) && (Object.hasOwn(value, "matcher") || typeof inner.type === "string");
+    }
+    function hookGuardSignIn(root, rootPath, place) {
+        const frames = [];
+        const pending = [[root, -1, place]];
+        const seen = { matcherList: new Set(), matcher: new Set(), other: new Set() };
+        const pathTo = (frame, tail) => {
+            const segments = [...tail];
+            for (let f = frame; f >= 0; f = frames[f].parent)
+                segments.unshift(frames[f].key);
+            return [...rootPath, ...segments];
+        };
+        while (pending.length > 0) {
+            const [node, frame, at] = pending.pop();
+            if (node === null || typeof node !== "object" || seen[at].has(node))
+                continue;
+            seen[at].add(node);
+            if (Array.isArray(node)) {
+                for (let i = node.length - 1; i >= 0; i--) {
+                    frames.push({ key: i, parent: frame });
+                    pending.push([node[i], frames.length - 1, at === "matcherList" ? "matcher" : "other"]);
+                }
+                continue;
+            }
+            const guardKey = hookGuardKeyOf(node);
+            if (guardKey !== undefined)
+                return pathTo(frame, [guardKey]);
+            if (at !== "matcher" && hookLooksLikeMatcher(node))
+                return pathTo(frame, []);
+            const keys = Object.keys(node);
+            for (let i = keys.length - 1; i >= 0; i--) {
+                frames.push({ key: keys[i], parent: frame });
+                pending.push([node[keys[i]], frames.length - 1, "other"]);
+            }
+        }
+        return undefined;
+    }
+    function hookSignKeyOf(at, sign) {
+        const key = sign[at.length];
+        return key === undefined ? "hooks" : String(key);
+    }
+    function hookFieldFits(base, value) {
+        switch (base) {
+            case "text":
+                return typeof value === "string" && value.length > 0 && !value.includes("\0");
+            case "string":
+                return typeof value === "string";
+            case "shell":
+                return typeof value === "string" && HOOK_SHELLS.includes(value);
+            case "boolean":
+                return typeof value === "boolean";
+            case "seconds":
+                return typeof value === "number" && Number.isFinite(value) && value > 0;
+            case "stringRecord":
+                return hookIsRecord(value) && Object.values(value).every((v) => typeof v === "string");
+            case "stringList":
+                if (!Array.isArray(value))
+                    return false;
+                for (let i = 0; i < value.length; i++)
+                    if (typeof value[i] !== "string")
+                        return false;
+                return true;
+            case "record":
+                return hookIsRecord(value);
+            default: {
+                const unknownKind = base;
+                throw new Error(`hook entry field table: unknown field kind '${String(unknownKind)}'`);
+            }
+        }
+    }
+    function hookEntryRead(entry) {
+        if (!hookIsRecord(entry))
+            return {};
+        const type = Object.hasOwn(entry, "type") ? entry.type : undefined;
+        if (typeof type !== "string" || !Object.hasOwn(HOOK_ENTRY_FIELDS, type))
+            return { field: "type" };
+        const fields = HOOK_ENTRY_FIELDS[type];
+        const out = { type };
+        for (const field of Object.keys(fields)) {
+            const kind = fields[field];
+            const optional = kind.endsWith("?");
+            const value = Object.hasOwn(entry, field) ? entry[field] : undefined;
+            if (value === undefined) {
+                if (optional)
+                    continue;
+                return { field };
+            }
+            const base = (optional ? kind.slice(0, -1) : kind);
+            if (!hookFieldFits(base, value))
+                return { field };
+            out[field] = Array.isArray(value) ? value.slice() : hookIsRecord(value) ? Object.fromEntries(Object.entries(value)) : value;
+        }
+        return { entry: out };
+    }
+    function hookMatcherRead(matcher, at, guardEvent, reject, drop) {
+        if (!hookIsRecord(matcher)) {
+            if (guardEvent || hookGuardSignIn(matcher, at, "matcher") !== undefined)
+                reject("guard-matcher-invalid", at);
+            else
+                drop("matcher-invalid", at);
+            return undefined;
+        }
+        const entries = Object.hasOwn(matcher, "hooks") ? matcher.hooks : undefined;
+        const signField = hookGuardKeyOf(matcher) ??
+            Object.keys(matcher).find((key) => !(key === "hooks" && Array.isArray(entries)) && hookGuardSignIn(matcher[key], [...at, key], "other") !== undefined);
+        if (signField !== undefined) {
+            reject("guard-matcher-invalid", at, signField);
+            return undefined;
+        }
+        const entrySigns = [];
+        if (Array.isArray(entries))
+            for (let j = 0; j < entries.length; j++)
+                entrySigns.push(hookGuardSignIn(entries[j], [...at, "hooks", j], "other"));
+        const name = Object.hasOwn(matcher, "matcher") ? matcher.matcher : undefined;
+        const badField = name !== undefined && typeof name !== "string" ? "matcher" : !Array.isArray(entries) ? "hooks" : undefined;
+        if (badField !== undefined || !Array.isArray(entries)) {
+            if (guardEvent || entrySigns.some((sign) => sign !== undefined))
+                reject("guard-matcher-invalid", at, badField);
+            else
+                drop("matcher-invalid", at, badField);
+            return undefined;
+        }
+        const kept = [];
+        for (let j = 0; j < entries.length; j++) {
+            const where = [...at, "hooks", j];
+            const sign = entrySigns[j];
+            if (sign !== undefined) {
+                reject("guard-entry-invalid", where, hookIsRecord(entries[j]) ? hookSignKeyOf(where, sign) : undefined);
+                continue;
+            }
+            const read = hookEntryRead(entries[j]);
+            if (read.entry !== undefined)
+                kept.push(read.entry);
+            else if (guardEvent)
+                reject("guard-entry-invalid", where, read.field);
+            else
+                drop("entry-invalid", where, read.field);
+        }
+        return typeof name === "string" ? { matcher: name, hooks: kept } : { hooks: kept };
+    }
+    function hookBlockRead(hooks, reject, drop) {
+        if (!hookIsRecord(hooks)) {
+            if (Array.isArray(hooks) && hooks.some((x) => x !== null && typeof x === "object"))
+                reject("hooks-is-matcher", ["hooks"]);
+            else
+                drop("hooks-not-object", ["hooks"]);
+            return undefined;
+        }
+        if (hookLooksLikeMatcher(hooks) || typeof hooks.type === "string") {
+            reject("hooks-is-matcher", ["hooks"]);
+            return undefined;
+        }
+        const loaded = {};
+        for (const event of Object.keys(hooks)) {
+            const value = hooks[event];
+            const at = ["hooks", event];
+            if (!HOOK_EVENTS.includes(event)) {
+                if (hookGuardSignIn(value, at, Array.isArray(value) ? "matcherList" : "other") !== undefined)
+                    reject("guard-under-unknown-event", at);
+                else
+                    drop("unknown-event", at);
+                continue;
+            }
+            const guardEvent = HOOK_GUARD_EVENTS.includes(event);
+            if (!Array.isArray(value)) {
+                if ((guardEvent && value !== null) || hookGuardSignIn(value, at, "other") !== undefined)
+                    reject("guard-event-not-array", at);
+                else
+                    drop("event-not-array", at);
+                continue;
+            }
+            const matchers = [];
+            for (let i = 0; i < value.length; i++) {
+                const read = hookMatcherRead(value[i], [...at, i], guardEvent, reject, drop);
+                if (read !== undefined)
+                    matchers.push(read);
+            }
+            loaded[event] = matchers;
+        }
+        return loaded;
+    }
+    function classifyHooksConfig(settingsDoc) {
+        const rejections = [];
+        const dropped = [];
+        const reject = (code, path, field) => {
+            rejections.push(field === undefined ? { code, path } : { code, path, field });
+        };
+        const drop = (code, path, field) => {
+            dropped.push(field === undefined ? { code, path } : { code, path, field });
+        };
+        let hooks;
+        if (settingsDoc !== null && typeof settingsDoc === "object" && !Array.isArray(settingsDoc)) {
+            const doc = settingsDoc;
+            for (const key of Object.keys(doc)) {
+                const value = doc[key];
+                if (key === "hooks") {
+                    hooks = hookBlockRead(value, reject, drop);
+                    continue;
+                }
+                const sign = key === "matcher" && hookLooksLikeMatcher(doc)
+                    ? [key]
+                    : HOOK_GUARD_EVENTS.includes(key) && value !== null && value !== undefined && !(Array.isArray(value) && value.length === 0)
+                        ? [key]
+                        : hookGuardSignIn(value, [key], "other");
+                if (sign !== undefined)
+                    reject("guard-outside-hooks", sign);
+            }
+        }
+        else {
+            const sign = hookGuardSignIn(settingsDoc, [], "other");
+            if (sign !== undefined)
+                reject("guard-outside-hooks", sign);
+        }
+        if (rejections.length > 0)
+            return { outcome: "rejected", hooks: undefined, dropped: [], rejections };
+        if (dropped.length > 0)
+            return { outcome: "loaded-partial", hooks, dropped, rejections: [] };
+        return { outcome: "loaded", hooks, dropped: [], rejections: [] };
+    }
+    return classifyHooksConfig;
+};

package/dist/generated/settingsSchemaMcpRequestEntry.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE: (MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"], startsWithHttpScheme: (raw: string) => boolean) => any;

package/dist/generated/settingsSchemaMcpRequestEntry.js

@@ -0,0 +1,162 @@
+export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme) => {
+    function describeValueShape(v) {
+        if (v === undefined)
+            return "nothing (the key is absent)";
+        if (v === null)
+            return "null";
+        if (Array.isArray(v))
+            return "an array";
+        if (typeof v === "string")
+            return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
+        if (typeof v === "object")
+            return "an object";
+        return `a ${typeof v}`;
+    }
+    function describeNotStringArray(v) {
+        return Array.isArray(v) ? "an array with a non-string element" : describeValueShape(v);
+    }
+    function isStringArray(v) {
+        return Array.isArray(v) && v.every((a) => typeof a === "string");
+    }
+    const CONTROL_AND_BIDI_STRIP_RE = /[\u0000-\u001f\u007f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+    const CALLER_TEXT_ECHO_MAX_CHARS = 64;
+    function echoCallerText(text) {
+        const clean = text.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        return clean.length > CALLER_TEXT_ECHO_MAX_CHARS ? `${clean.slice(0, CALLER_TEXT_ECHO_MAX_CHARS)}…` : clean;
+    }
+    function quotedCallerText(text) {
+        return `"${echoCallerText(text)}"`;
+    }
+    const TOOL_WIRE_NAME_MAX_CHARS = 128;
+    const hasEdgeWhitespace = (v) => v.trim() !== v;
+    function isUsableWireName(v) {
+        return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS && !hasEdgeWhitespace(v);
+    }
+    function describeBadWireName(v) {
+        if (typeof v !== "string")
+            return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+        if (v.length === 0)
+            return "empty";
+        const head = quotedCallerText(v);
+        const tooLong = `${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS}`;
+        if (!hasEdgeWhitespace(v))
+            return `${head} (${tooLong})`;
+        return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
+    }
+    const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
+    function isContentOriginWord(v) {
+        return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
+    }
+    function describeBadContentOrigin(v) {
+        return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    }
+    function readMcpIdentityHeaders(transport) {
+        return {
+            ...(typeof transport.principalHeader === "string" ? { principalHeader: transport.principalHeader } : {}),
+            ...(transport.principalHeader === undefined && typeof transport.assertionHeader === "string" ? { assertionHeader: transport.assertionHeader } : {}),
+        };
+    }
+    const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
+    function readRequestMcpTransport(t) {
+        if (!t || typeof t !== "object")
+            return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
+        const tr = t;
+        const lost = [];
+        if (tr.kind === "stdio") {
+            if (typeof tr.command !== "string" || tr.command.length === 0)
+                return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
+            if (tr.args !== undefined && !isStringArray(tr.args))
+                lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
+            const env = readTransportRecord("transport.env", tr.env, lost);
+            return {
+                ok: true,
+                transport: {
+                    kind: "stdio",
+                    command: tr.command,
+                    ...(isStringArray(tr.args) ? { args: tr.args } : {}),
+                    ...(env !== undefined ? { env } : {}),
+                },
+                lost,
+            };
+        }
+        if (tr.kind === "http") {
+            if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
+                return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
+            const ids = readMcpIdentityHeaders(tr);
+            const headers = readTransportRecord("transport.headers", tr.headers, lost);
+            if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
+                lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
+            }
+            return {
+                ok: true,
+                transport: {
+                    kind: "http",
+                    url: tr.url,
+                    ...(headers !== undefined ? { headers } : {}),
+                    ...ids,
+                },
+                lost,
+            };
+        }
+        return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
+    }
+    const RESERVED_MEMBER_NAME = "__proto__";
+    const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
+    function readPlainStringRecord(v) {
+        if (v === null || typeof v !== "object" || Array.isArray(v))
+            return { ok: false, fault: "not_plain_record", detail: v === null ? "got null" : Array.isArray(v) ? "got an array" : `got a ${typeof v}` };
+        let proto;
+        let names;
+        try {
+            proto = Object.getPrototypeOf(v);
+            names = Object.getOwnPropertyNames(v);
+        }
+        catch {
+            return { ok: false, fault: "not_plain_record", detail: "got an object that could not be inspected (a proxy trap threw)" };
+        }
+        if (proto !== Object.prototype && proto !== null) {
+            return { ok: false, fault: "not_plain_record", detail: "got an object that is not plain data (a class instance, a Map, process.env, or a record built on a prototype; copy it into a plain object)" };
+        }
+        const record = {};
+        let reservedMember = false;
+        for (const name of names) {
+            let value;
+            let unreadable = false;
+            try {
+                const d = Object.getOwnPropertyDescriptor(v, name);
+                value = d === undefined ? undefined : Object.hasOwn(d, "value") ? d.value : d.get === undefined ? undefined : Reflect.apply(d.get, v, []);
+            }
+            catch {
+                unreadable = true;
+            }
+            if (unreadable || typeof value !== "string") {
+                const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
+                const reserved = name === RESERVED_MEMBER_NAME;
+                return {
+                    ok: false,
+                    fault: reserved ? "member_name_reserved" : "member_not_string",
+                    member: echoCallerText(name),
+                    detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
+                };
+            }
+            if (name === RESERVED_MEMBER_NAME)
+                reservedMember = true;
+            else
+                record[name] = value;
+        }
+        return { ok: true, record, reservedMember };
+    }
+    function readTransportRecord(path, raw, lost) {
+        if (raw === undefined)
+            return undefined;
+        const read = readPlainStringRecord(raw);
+        if (!read.ok) {
+            lost.push({ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault });
+            return undefined;
+        }
+        if (read.reservedMember)
+            lost.push({ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" });
+        return read.record;
+    }
+    return { readRequestMcpTransport, readMcpIdentityHeaders, isUsableWireName, describeBadWireName, isContentOriginWord, describeBadContentOrigin, TOOL_WIRE_NAME_MAX_CHARS };
+};

package/dist/generated/settingsSchemaTables.d.ts

@@ -9,3 +9,5 @@ export declare const SETTINGS_BUDGET_STRING_KEYS: readonly ["mode", "budgetDurat
 export declare const SETTINGS_BUDGET_PER_MODEL_NUMBER_KEYS: readonly ["maxBudgetUsd", "tpmLimit", "rpmLimit"];
 export declare const SETTINGS_MODEL_API_WORDS: readonly ["openai-completions", "anthropic-messages"];
 export declare const SETTINGS_TOOL_NAME_MATCHER_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
+export declare const SETTINGS_UI_LANGUAGE_VALUES: readonly ["en", "zh"];
+export declare const SETTINGS_MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];

package/dist/generated/settingsSchemaTables.js

@@ -41,3 +41,12 @@ export const SETTINGS_TOOL_NAME_MATCHER_EVENTS = Object.freeze([
     "PostToolUse",
     "PostToolUseFailure",
 ]);
+export const SETTINGS_UI_LANGUAGE_VALUES = Object.freeze([
+    "en",
+    "zh",
+]);
+export const SETTINGS_MCP_CONTENT_ORIGINS = Object.freeze([
+    "local",
+    "execution",
+    "external",
+]);

package/dist/generated/settingsSchemaTypes.d.ts

@@ -0,0 +1,133 @@
+export type ConfigPath = readonly (string | number)[];
+declare const HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart", "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop", "PreCompact", "PostCompact", "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle", "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult", "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded", "CwdChanged", "FileChanged", "MessageDisplay", "DirectoryAdded", "PreModelSwitch", "PostModelSwitch"];
+type HookEventWord = (typeof HOOK_EVENTS)[number];
+declare const HOOK_ENTRY_TYPES: readonly ["command", "prompt", "agent", "http", "mcp_tool"];
+export type HookEntryType = (typeof HOOK_ENTRY_TYPES)[number];
+declare const HOOK_SHELLS: readonly ["bash", "powershell"];
+declare const HOOK_ENTRY_FIELDS: {
+    readonly command: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly command: "text";
+        readonly shell: "shell?";
+        readonly async: "boolean?";
+        readonly asyncRewake: "boolean?";
+    };
+    readonly prompt: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly prompt: "text";
+        readonly model: "string?";
+    };
+    readonly agent: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly prompt: "text";
+        readonly model: "string?";
+    };
+    readonly http: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly url: "text";
+        readonly headers: "stringRecord?";
+        readonly allowedEnvVars: "stringList?";
+    };
+    readonly mcp_tool: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly server: "string";
+        readonly tool: "string";
+        readonly input: "record?";
+    };
+};
+type HookFieldBaseValue<B> = B extends "text" | "string" ? string : B extends "shell" ? (typeof HOOK_SHELLS)[number] : B extends "boolean" ? boolean : B extends "seconds" ? number : B extends "stringRecord" ? Record<string, string> : B extends "stringList" ? string[] : B extends "record" ? Record<string, unknown> : never;
+type HookFieldValue<K> = K extends `${infer B}?` ? HookFieldBaseValue<B> : HookFieldBaseValue<K>;
+type Flat<O> = {
+    [K in keyof O]: O[K];
+};
+type HookEntryOf<T extends HookEntryType, F = (typeof HOOK_ENTRY_FIELDS)[T]> = Flat<{
+    type: T;
+} & {
+    -readonly [K in keyof F as F[K] extends `${string}?` ? never : K]: HookFieldValue<F[K]>;
+} & {
+    -readonly [K in keyof F as F[K] extends `${string}?` ? K : never]?: HookFieldValue<F[K]>;
+}>;
+export type HookEntry = {
+    [T in HookEntryType]: HookEntryOf<T>;
+}[HookEntryType];
+export type HookMatcherEntry = {
+    matcher?: string;
+    hooks: HookEntry[];
+};
+export type HooksConfig = Partial<Record<HookEventWord, HookMatcherEntry[]>>;
+declare const HOOKS_CLASSIFICATION_OUTCOMES: readonly ["loaded", "loaded-partial", "rejected"];
+export type HooksClassificationOutcome = (typeof HOOKS_CLASSIFICATION_OUTCOMES)[number];
+declare const HOOKS_DROPPED_PIECE_CODES: readonly ["hooks-not-object", "unknown-event", "event-not-array", "matcher-invalid", "entry-invalid"];
+export type HooksDroppedPieceCode = (typeof HOOKS_DROPPED_PIECE_CODES)[number];
+declare const HOOKS_REJECTION_CODES: readonly ["guard-outside-hooks", "hooks-is-matcher", "guard-under-unknown-event", "guard-event-not-array", "guard-matcher-invalid", "guard-entry-invalid"];
+export type HooksRejectionCode = (typeof HOOKS_REJECTION_CODES)[number];
+export interface HooksDroppedPiece {
+    readonly code: HooksDroppedPieceCode;
+    readonly path: ConfigPath;
+    readonly field?: string;
+}
+export interface HooksRejection {
+    readonly code: HooksRejectionCode;
+    readonly path: ConfigPath;
+    readonly field?: string;
+}
+export type HooksClassification = {
+    readonly outcome: "loaded";
+    readonly hooks: HooksConfig | undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: "loaded-partial";
+    readonly hooks: HooksConfig | undefined;
+    readonly dropped: readonly HooksDroppedPiece[];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: "rejected";
+    readonly hooks: undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly HooksRejection[];
+};
+export type RequestMcpTransport = {
+    kind: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+} | {
+    kind: "http";
+    url: string;
+    headers?: Record<string, string>;
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+export interface McpEntryKeyIssue {
+    readonly path: string;
+    readonly reason: string;
+    readonly member?: string;
+    readonly fault?: "not_plain_record" | "member_not_string" | "member_name_reserved";
+}
+export type RequestMcpTransportRead = {
+    ok: true;
+    transport: RequestMcpTransport;
+    lost: readonly McpEntryKeyIssue[];
+} | {
+    ok: false;
+    issue: McpEntryKeyIssue;
+};
+declare const MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
+export type McpContentOrigin = (typeof MCP_CONTENT_ORIGINS)[number];
+export {};

package/dist/generated/settingsSchemaTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/hitl/allowRuleShadow.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from '../env/uiLanguage.js';
 export interface ApprovalAllowRuleShadowMember {
     readonly member?: string;
     readonly known: boolean;
@@ -23,4 +24,4 @@ export declare function retiredAllowRuleShadowKeyPresent(carrier: object | null
 export declare function readAllowRuleShadowFromWire(carrier: object | null | undefined, leg: 'frame' | 'row'): ApprovalAllowRuleShadow | undefined;
 export declare function readApprovalAllowRuleShadow(card: object | null | undefined): ApprovalAllowRuleShadow | undefined;
 export declare function approvalAllowRuleShadowed(card: object | null | undefined): boolean;
-export declare function allowRuleShadowSentence(card: object | null | undefined): string | undefined;
+export declare function allowRuleShadowSentence(card: object | null | undefined, lang?: UiLanguage): string | undefined;

package/dist/hitl/allowRuleShadow.js

@@ -1,5 +1,6 @@
 import { CORE_ALLOW_RULE_MEMBERS } from '../generated/engineFactTables.js';
-import { quoteUntrustedForSentence } from '../displayUntrusted.js';
+import { displayUntrusted, quoteUntrustedForSentence } from '../displayUntrusted.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 const KNOWN_MEMBERS = new Set(CORE_ALLOW_RULE_MEMBERS);
 function freezeMember(m) {
     return Object.freeze({ ...m });
@@ -162,7 +163,6 @@ export function approvalAllowRuleShadowed(card) {
 const ENTRY_MAX = 4096;
 const MEMBER_MAX = 64;
 const ENTRIES_SHOWN = 5;
-const UNREADABLE_LINE = 'An allow rule matched this call but cannot clear it; which rule could not be read, so this one is confirmed individually.';
 function singlePersistedEntry(shadow) {
     if (shadow.unreadable === true || shadow.members.length !== 1)
         return undefined;
@@ -173,12 +173,12 @@ function singlePersistedEntry(shadow) {
         return undefined;
     return quoteUntrustedForSentence(m.entries[0], ENTRY_MAX);
 }
-function memberPhrase(m) {
+function memberPhrase(m, lang) {
     const memberWord = m.member === undefined ? undefined : KNOWN_MEMBERS.has(m.member) ? m.member : quoteUntrustedForSentence(m.member, MEMBER_MAX);
-    const word = memberWord ?? 'an unrecognised source';
+    const word = memberWord ?? msg('approval.card.shadow.unrecognisedSource');
     const entries = m.entries ?? [];
     if (m.malformed === true && entries.length === 0)
-        return `${word} (could not be read)`;
+        return renderMessage(msg('approval.card.shadow.memberUnreadable', { word }), lang);
     const listed = entries
         .map((e) => quoteUntrustedForSentence(e, ENTRY_MAX))
         .filter((e) => e !== undefined)
@@ -188,25 +188,28 @@ function memberPhrase(m) {
     if (listed.length > 0)
         parts.push(listed.join(', '));
     if (notListed > 0)
-        parts.push(listed.length > 0 ? `and ${String(notListed)} more not listed` : `${String(notListed)} not listed`);
+        parts.push(renderMessage(listed.length > 0 ? msg('approval.card.shadow.moreNotListed', { count: notListed }) : msg('approval.card.shadow.notListed', { count: notListed }), lang));
     if (m.malformed === true)
-        parts.push('part of it could not be read');
-    return parts.length > 0 ? `${word}: ${parts.join('; ')}` : word;
+        parts.push(renderMessage(msg('approval.card.shadow.partUnreadable'), lang));
+    return parts.length > 0
+        ? renderMessage(msg('approval.card.shadow.memberWithParts', { word, parts: parts.join(renderMessage(msg('approval.card.shadow.partJoin'), lang)) }), lang)
+        : typeof word === 'string'
+            ? word
+            : renderMessage(word, lang);
 }
-export function allowRuleShadowSentence(card) {
+export function allowRuleShadowSentence(card, lang) {
     const shadow = readApprovalAllowRuleShadow(card);
     if (shadow === undefined)
         return undefined;
     try {
         if (shadow.unreadable === true || shadow.members.length === 0)
-            return UNREADABLE_LINE;
+            return renderMessage(msg('approval.card.shadow.unreadable'), lang);
         const single = singlePersistedEntry(shadow);
-        if (single !== undefined) {
-            return `Your saved permission rule ${single} still exists — it just cannot clear this particular call, so this one is confirmed individually.`;
-        }
-        return `Allow rules matched this call but cannot clear it, so this one is confirmed individually — ${shadow.members.map(memberPhrase).join(' · ')}.`;
+        if (single !== undefined)
+            return renderMessage(msg('approval.card.shadow.single', { entry: single }), lang);
+        return renderMessage(msg('approval.card.shadow.several', { members: displayUntrusted(shadow.members.map((m) => memberPhrase(m, lang)).join(' · ')) }), lang);
     }
     catch {
-        return UNREADABLE_LINE;
+        return renderMessage(msg('approval.card.shadow.unreadable'), lang);
     }
 }