@sema-agent/client-core 0.98.0 → 0.100.0

package/dist/selfOrchestrationDenial.js

@@ -1,30 +1,18 @@
 import { CAPABILITY_SELF_ORCHESTRATION_REQUIRED } from './engineErrorCodes.js';
+import { readThrownSlot, THROWN_SLOT_UNREADABLE } from './wireFailureShape.js';
 const ENTITLEMENT_RESOLVER_ABSENT = 'entitlement_resolver_absent';
 export const SELF_ORCHESTRATION_RETRY_WITHOUT = Object.freeze(['selfOrchestration', 'settings.ultracode']);
 export function classifySelfOrchestrationRefusal(e) {
-    let status;
-    let code;
-    try {
-        const o = e;
-        const rawStatus = o?.status;
-        const rawCode = o?.errorCode;
-        status = typeof rawStatus === 'number' ? rawStatus : undefined;
-        code = typeof rawCode === 'string' ? rawCode : undefined;
-    }
-    catch {
-        return null;
-    }
+    const rawStatus = readThrownSlot(e, 'status', 'data');
+    const rawCode = readThrownSlot(e, 'errorCode', 'data');
+    const status = typeof rawStatus === 'number' ? rawStatus : undefined;
+    const code = typeof rawCode === 'string' ? rawCode : undefined;
     if (status !== 501)
         return null;
     if (code !== CAPABILITY_SELF_ORCHESTRATION_REQUIRED)
         return null;
-    let denial;
-    try {
-        denial = e?.denial;
-    }
-    catch {
-        denial = undefined;
-    }
+    const rawDenial = readThrownSlot(e, 'denial', 'data');
+    const denial = rawDenial === THROWN_SLOT_UNREADABLE ? undefined : rawDenial;
     return {
         kind: 'self-orchestration-denied',
         retryWithout: SELF_ORCHESTRATION_RETRY_WITHOUT,

package/dist/sessionIdSegment.d.ts

@@ -1 +1,7 @@
 export declare function isSessionIdPathSegment(id: unknown): id is string;
+export type SessionIdRefusalWhy = 'not_string' | 'bad_shape' | 'bad_version' | 'bad_variant';
+export interface SessionIdRefusal {
+    readonly why: SessionIdRefusalWhy;
+}
+export declare function canonicalSessionIdOf(raw: {} | null | undefined): string | null;
+export declare function sessionIdRefusalOf(raw: {} | null | undefined): SessionIdRefusal | null;

package/dist/sessionIdSegment.js

@@ -9,3 +9,27 @@ export function isSessionIdPathSegment(id) {
         return false;
     }
 }
+const UUID_ANY_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function sessionIdReadingOf(raw) {
+    if (typeof raw !== 'string')
+        return { id: null, why: 'not_string' };
+    const folded = raw.replace(/[A-F]/g, (c) => c.toLowerCase());
+    if (UUID_ANY_RE.test(folded))
+        return { id: folded, why: null };
+    const version = folded.charAt(14);
+    const variant = folded.charAt(19);
+    const hex = '0123456789abcdef';
+    if (folded.length !== 36 || !hex.includes(version) || !hex.includes(variant))
+        return { id: null, why: 'bad_shape' };
+    const probe = `${folded.slice(0, 14)}4${folded.slice(15, 19)}8${folded.slice(20)}`;
+    if (!UUID_ANY_RE.test(probe))
+        return { id: null, why: 'bad_shape' };
+    return { id: null, why: '12345678'.includes(version) ? 'bad_variant' : 'bad_version' };
+}
+export function canonicalSessionIdOf(raw) {
+    return sessionIdReadingOf(raw).id;
+}
+export function sessionIdRefusalOf(raw) {
+    const r = sessionIdReadingOf(raw);
+    return r.why === null ? null : Object.freeze({ why: r.why });
+}

package/dist/sessionMemoryStatus.js

@@ -1,17 +1,12 @@
 import { isSessionIdPathSegment } from './sessionIdSegment.js';
+import { readThrownSlot, THROWN_SLOT_UNREADABLE } from './wireFailureShape.js';
 export function classifyMemoryStatusFailure(e) {
-    let code;
-    let status;
-    try {
-        const o = e;
-        const rawCode = o?.errorCode;
-        const rawStatus = o?.status;
-        code = typeof rawCode === 'string' ? rawCode : undefined;
-        status = typeof rawStatus === 'number' ? rawStatus : undefined;
-    }
-    catch {
+    const rawCode = readThrownSlot(e, 'errorCode', 'data');
+    const rawStatus = readThrownSlot(e, 'status', 'data');
+    if (rawCode === THROWN_SLOT_UNREADABLE || rawStatus === THROWN_SLOT_UNREADABLE)
         return { kind: 'failed', error: e };
-    }
+    const code = typeof rawCode === 'string' ? rawCode : undefined;
+    const status = typeof rawStatus === 'number' ? rawStatus : undefined;
     if (code !== undefined) {
         if (code.startsWith('capability.'))
             return { kind: 'unsupported', reason: 'capability' };

package/dist/sessionPolicyCapability.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from './env/uiLanguage.js';
 export type SessionPolicyReading = {
     kind: 'unobserved';
 } | {
@@ -12,4 +13,4 @@ export type SessionPolicyReading = {
 export declare function projectSessionPolicyCapability(caps: unknown): SessionPolicyReading | undefined;
 export declare function observedSessionPolicy(baseUrl?: string | undefined): SessionPolicyReading;
 export declare function sessionPolicyFaceAvailable(reading: SessionPolicyReading): 'yes' | 'no' | 'unknown';
-export declare function sessionPolicyDoctorDetail(reading: SessionPolicyReading): string;
+export declare function sessionPolicyDoctorDetail(reading: SessionPolicyReading, lang?: UiLanguage): string;

package/dist/sessionPolicyCapability.js

@@ -1,5 +1,6 @@
 import { engineWireTarget } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
+import { msg, renderMessage } from './i18n/translate.js';
 import { ownDataField } from './ownKey.js';
 export function projectSessionPolicyCapability(caps) {
     try {
@@ -31,17 +32,18 @@ export function sessionPolicyFaceAvailable(reading) {
         return 'no';
     return 'unknown';
 }
-export function sessionPolicyDoctorDetail(reading) {
+export function sessionPolicyDoctorDetail(reading, lang) {
+    const subject = msg('notice.capability.subject.sessionPolicy');
     switch (reading.kind) {
         case 'unreadable':
-            return unreadableReadingDetail('per-session rule face');
+            return unreadableReadingDetail(renderMessage(subject, lang), lang);
         case 'unobserved':
-            return 'per-session rule face not observed — the engine reports it on /v1/capabilities (sessionPolicy); this process has no usable capabilities reading cached for it (none received, the last one was unreadable, or the last one was discarded when the engine connection was reset; this process cannot tell which)';
+            return renderMessage(msg('notice.capability.unobserved', { subject, key: 'sessionPolicy' }), lang);
         case 'not_reported':
-            return 'per-session rule face not reported by this engine — this binary predates the position itself; it says nothing about whether the face exists, so read the rules rather than writing them blind';
+            return renderMessage(msg('notice.capability.sessionPolicy.notReported'), lang);
         case 'absent':
-            return 'no per-session rule store on this deployment — reading and writing this session’s tool rules is unavailable here';
+            return renderMessage(msg('notice.capability.sessionPolicy.absent'), lang);
         case 'present':
-            return 'per-session rule face on — this session’s tool rules can be read, and a tightening write is accepted or refused by the engine call by call';
+            return renderMessage(msg('notice.capability.sessionPolicy.present'), lang);
     }
 }

package/dist/settingsCredentialKeyPaths.d.ts

@@ -0,0 +1,8 @@
+export interface CredentialKeyFinding {
+    readonly path: string;
+    readonly numericByNameOnly?: true;
+}
+export declare function credentialNameWords(name: string): string[];
+export declare function isCredentialEnvName(name: string): boolean;
+export declare function isCredentialConfigKey(name: string): boolean;
+export declare function settingsCredentialKeyPaths(doc: object | null | undefined): CredentialKeyFinding[];

package/dist/settingsCredentialKeyPaths.js

@@ -0,0 +1,219 @@
+import { looksLikeKnownSecret, queryCarriesCredential } from './displayUntrusted.js';
+const CREDENTIAL_WORDS = new Set([
+    'key', 'keys', 'apikey', 'token', 'tokens', 'secret', 'secrets', 'password', 'passwd', 'pass', 'pwd', 'pin', 'otp',
+    'auth', 'authorization', 'credential', 'credentials', 'cookie', 'cookies', 'session', 'private', 'cert', 'signature', 'salt',
+]);
+const CREDENTIAL_STEMS = ['PASSWORD', 'PASSWD', 'SECRET', 'TOKEN', 'APIKEY', 'CREDENTIAL', 'COOKIE', 'PRIVATE'];
+const CREDENTIAL_SUFFIXES = ['PASS', 'PWD', 'KEY', 'AUTH'];
+const SECRET_CONFIG_NAME = /(?:^|[-_.])(?:token|key|secret|password|authorization|credential|cookie)s?$/i;
+export function credentialNameWords(name) {
+    if (typeof name !== 'string')
+        return [];
+    return name
+        .replace(/([A-Z])(?=[A-Z][a-z])/g, '$1_')
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .split(/[_\-.\s]+/)
+        .filter((w) => w.length > 0)
+        .map((w) => w.toLowerCase());
+}
+export function isCredentialEnvName(name) {
+    if (typeof name !== 'string')
+        return false;
+    if (credentialNameWords(name).some((w) => CREDENTIAL_WORDS.has(w)))
+        return true;
+    const upper = name.toUpperCase();
+    return CREDENTIAL_STEMS.some((stem) => upper.includes(stem)) || CREDENTIAL_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+export function isCredentialConfigKey(name) {
+    if (typeof name !== 'string')
+        return false;
+    const words = credentialNameWords(name);
+    const last = words[words.length - 1];
+    return SECRET_CONFIG_NAME.test(name) || (last !== undefined && CREDENTIAL_WORDS.has(last));
+}
+const DECIMAL_INTEGER_RE = /^\s*\d+\s*$/;
+function stringCarriesCredential(value) {
+    if (looksLikeKnownSecret(value))
+        return true;
+    const text = value.trim();
+    if (!text.includes('://'))
+        return false;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return false;
+    }
+    if (url.username !== '' || url.password !== '')
+        return true;
+    return url.search.length > 1 && queryCarriesCredential(url.search.slice(1));
+}
+const ENV_ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+const LONG_OPTION_RE = /^--?([A-Za-z][A-Za-z0-9_-]*)(?:=(.*))?$/s;
+const HEADER_FORM_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*:\s*\S/;
+function argvFindings(args) {
+    const hits = new Map();
+    const add = (i, numericByNameOnly) => {
+        hits.set(i, (hits.get(i) ?? true) && numericByNameOnly);
+    };
+    const valueCarries = (value) => {
+        const header = HEADER_FORM_RE.exec(value);
+        return stringCarriesCredential(value) || (header !== null && isCredentialConfigKey(header[1] ?? ''));
+    };
+    args.forEach((arg, i) => {
+        if (valueCarries(arg))
+            add(i, false);
+        const assignment = ENV_ASSIGNMENT_RE.exec(arg);
+        if (assignment !== null && assignment[2] !== '') {
+            const assigned = assignment[2] ?? '';
+            if (valueCarries(assigned))
+                add(i, false);
+            if (isCredentialEnvName(assignment[1] ?? ''))
+                add(i, DECIMAL_INTEGER_RE.test(assigned));
+        }
+        const option = LONG_OPTION_RE.exec(arg);
+        if (option === null)
+            return;
+        const inline = option[2];
+        if (inline !== undefined && inline !== '' && valueCarries(inline))
+            add(i, false);
+        const optionName = option[1] ?? '';
+        if (optionName.length <= 1 || !isCredentialEnvName(optionName))
+            return;
+        if (inline !== undefined) {
+            if (inline !== '')
+                add(i, DECIMAL_INTEGER_RE.test(inline));
+        }
+        else {
+            const next = args[i + 1];
+            if (next !== undefined && next !== '')
+                add(i + 1, DECIMAL_INTEGER_RE.test(next));
+        }
+    });
+    return hits;
+}
+function isPresent(value) {
+    return value !== undefined && value !== null && value !== '' && value !== false;
+}
+function arrayKindOf(node) {
+    try {
+        return Array.isArray(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownKeysOf(node) {
+    try {
+        return Object.keys(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readSlot(node, key) {
+    try {
+        return { ok: true, value: node[key] };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+export function settingsCredentialKeyPaths(doc) {
+    const found = [];
+    if (doc === null || doc === undefined || typeof doc !== 'object')
+        return found;
+    const finding = (path, numericByNameOnly) => (numericByNameOnly ? { path, numericByNameOnly: true } : { path });
+    const ancestors = new WeakSet();
+    const stack = [{ node: doc, path: '', inEnv: false }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        if (frame === undefined)
+            continue;
+        const { node, path, inEnv } = frame;
+        if (frame.exit === true) {
+            ancestors.delete(node);
+            continue;
+        }
+        if (ancestors.has(node))
+            continue;
+        ancestors.add(node);
+        stack.push({ node, path, inEnv, exit: true });
+        const isArray = arrayKindOf(node);
+        if (isArray === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        if (isArray) {
+            let items;
+            try {
+                items = Array.from(node);
+            }
+            catch {
+                if (path !== '')
+                    found.push(finding(path, false));
+                continue;
+            }
+            if (items.length > 0 && items.every((item) => typeof item === 'string')) {
+                const hits = argvFindings(items);
+                for (const i of [...hits.keys()].sort((a, b) => a - b))
+                    found.push(finding(`${path}[${i}]`, hits.get(i) === true));
+                continue;
+            }
+            items.forEach((item, i) => {
+                const itemPath = `${path}[${i}]`;
+                if (typeof item === 'string') {
+                    if (stringCarriesCredential(item))
+                        found.push(finding(itemPath, false));
+                }
+                else if (item !== null && typeof item === 'object') {
+                    stack.push({ node: item, path: itemPath, inEnv: false });
+                }
+            });
+            continue;
+        }
+        const keys = ownKeysOf(node);
+        if (keys === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        for (const key of keys) {
+            const keyPath = path === '' ? key : `${path}.${key}`;
+            const nameIsCredential = inEnv ? isCredentialEnvName(key) : isCredentialConfigKey(key);
+            const slot = readSlot(node, key);
+            if (!slot.ok) {
+                if (nameIsCredential)
+                    found.push(finding(keyPath, false));
+                continue;
+            }
+            const value = slot.value;
+            if (typeof value === 'string') {
+                const byValue = stringCarriesCredential(value);
+                if (byValue || (nameIsCredential && isPresent(value)))
+                    found.push(finding(keyPath, !byValue && DECIMAL_INTEGER_RE.test(value)));
+                continue;
+            }
+            if (value !== null && typeof value === 'object') {
+                let nonEmpty;
+                try {
+                    nonEmpty = Array.isArray(value) ? value.length > 0 : Object.keys(value).length > 0;
+                }
+                catch {
+                    nonEmpty = true;
+                }
+                if (nameIsCredential && nonEmpty) {
+                    found.push(finding(keyPath, false));
+                    continue;
+                }
+                stack.push({ node: value, path: keyPath, inEnv: key === 'env' });
+                continue;
+            }
+            if (nameIsCredential && isPresent(value))
+                found.push(finding(keyPath, typeof value === 'number'));
+        }
+    }
+    return found;
+}

package/dist/settingsHooksSalvage.d.ts

@@ -0,0 +1,44 @@
+import type { WireHooksConfig } from './finalVerifyWire.js';
+import type { SettingsDocument } from './host.js';
+import type { HookSettingsSource } from './pluginHooksWire.js';
+export type HooksSalvageOutcome = 'loaded' | 'loaded-partial' | 'rejected';
+export type HooksSalvageDropCode = 'hooks-not-object' | 'unknown-event' | 'event-not-array' | 'matcher-invalid' | 'entry-invalid';
+export type HooksSalvageRejectionCode = 'guard-outside-hooks' | 'hooks-is-matcher' | 'guard-under-unknown-event' | 'guard-event-not-array' | 'guard-matcher-invalid' | 'guard-entry-invalid';
+export interface HooksSalvageDrop {
+    readonly code: HooksSalvageDropCode;
+    readonly path: readonly (string | number)[];
+    readonly field?: string;
+}
+export interface HooksSalvageRejection {
+    readonly code: HooksSalvageRejectionCode;
+    readonly path: readonly (string | number)[];
+    readonly field?: string;
+}
+export type HooksSalvage = {
+    readonly outcome: 'loaded';
+    readonly hooks: WireHooksConfig | undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: 'loaded-partial';
+    readonly hooks: WireHooksConfig | undefined;
+    readonly dropped: readonly HooksSalvageDrop[];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: 'rejected';
+    readonly hooks: undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly HooksSalvageRejection[];
+};
+export interface HooksSalvageMask {
+    readonly hooksDropped: boolean;
+    eventDropped(event: string): boolean;
+    groupDropped(event: string, groupIndex: number): boolean;
+    entryDropped(event: string, groupIndex: number, hookIndex: number): boolean;
+}
+export declare function hooksSalvageMaskOf(dropped: readonly {
+    readonly path: readonly (string | number)[];
+}[]): HooksSalvageMask;
+export declare function salvageSettingsHooksEntries(doc: SettingsDocument | null | undefined): HooksSalvage;
+export declare const HOOK_SETTINGS_SOURCE_TEXT: Readonly<Record<HookSettingsSource, string>>;
+export declare function settingsHooksSalvageNotice(salvage: HooksSalvage, source: HookSettingsSource, doc?: SettingsDocument | null): string | undefined;

package/dist/settingsHooksSalvage.js

@@ -0,0 +1,211 @@
+import { displayUntrusted } from './displayUntrusted.js';
+import { SETTINGS_CLASSIFY_HOOKS_CONFIG, } from './generated/settingsSchemaFns.js';
+const _tuplePins = [true, true, true, true, true, true];
+void _tuplePins;
+const _classifierPins = [true, true, true, true, true, true];
+void _classifierPins;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const own = (o, k) => (Object.hasOwn(o, k) ? o[k] : undefined);
+const freezeRow = (row) => Object.freeze(row);
+function pieceOf(p) {
+    return freezeRow({ code: p.code, path: Object.freeze([...p.path]), ...(typeof p.field === 'string' ? { field: p.field } : {}) });
+}
+const EMPTY_MASK = Object.freeze({
+    hooksDropped: false,
+    eventDropped: () => false,
+    groupDropped: () => false,
+    entryDropped: () => false,
+});
+export function hooksSalvageMaskOf(dropped) {
+    if (dropped.length === 0)
+        return EMPTY_MASK;
+    let all = false;
+    const events = new Set();
+    const groups = new Set();
+    const entries = new Set();
+    for (const d of dropped) {
+        const p = d.path;
+        if (p[0] !== 'hooks') {
+            all = true;
+            continue;
+        }
+        if (p.length === 1)
+            all = true;
+        else if (p.length === 2 && typeof p[1] === 'string')
+            events.add(p[1]);
+        else if (p.length === 3 && typeof p[1] === 'string' && typeof p[2] === 'number')
+            groups.add(`${p[1]}\u0000${p[2]}`);
+        else if (p.length === 5 && typeof p[1] === 'string' && typeof p[2] === 'number' && p[3] === 'hooks' && typeof p[4] === 'number')
+            entries.add(`${p[1]}\u0000${p[2]}\u0000${p[4]}`);
+        else
+            all = true;
+    }
+    return Object.freeze({
+        hooksDropped: all,
+        eventDropped: (event) => all || events.has(event),
+        groupDropped: (event, gi) => all || events.has(event) || groups.has(`${event}\u0000${gi}`),
+        entryDropped: (event, gi, hi) => all || events.has(event) || groups.has(`${event}\u0000${gi}`) || entries.has(`${event}\u0000${gi}\u0000${hi}`),
+    });
+}
+function pruneHooks(hooks, mask) {
+    if (mask.hooksDropped || !isRecord(hooks))
+        return undefined;
+    const out = [];
+    for (const event of Object.keys(hooks)) {
+        if (mask.eventDropped(event))
+            continue;
+        const groups = own(hooks, event);
+        if (!Array.isArray(groups)) {
+            out.push([event, groups]);
+            continue;
+        }
+        const keptGroups = [];
+        let changed = false;
+        groups.forEach((group, gi) => {
+            if (mask.groupDropped(event, gi)) {
+                changed = true;
+                return;
+            }
+            const entries = isRecord(group) ? own(group, 'hooks') : undefined;
+            if (!isRecord(group) || !Array.isArray(entries)) {
+                keptGroups.push(group);
+                return;
+            }
+            const keptEntries = entries.filter((_e, hi) => !mask.entryDropped(event, gi, hi));
+            if (keptEntries.length === entries.length) {
+                keptGroups.push(group);
+                return;
+            }
+            changed = true;
+            if (keptEntries.length > 0)
+                keptGroups.push({ ...group, hooks: keptEntries });
+        });
+        if (!changed)
+            out.push([event, groups]);
+        else if (keptGroups.length > 0)
+            out.push([event, keptGroups]);
+    }
+    return out.length > 0 ? Object.fromEntries(out) : undefined;
+}
+export function salvageSettingsHooksEntries(doc) {
+    const r = SETTINGS_CLASSIFY_HOOKS_CONFIG(doc);
+    if (r.outcome === 'rejected') {
+        return Object.freeze({ outcome: 'rejected', hooks: undefined, dropped: Object.freeze([]), rejections: Object.freeze(r.rejections.map(pieceOf)) });
+    }
+    const original = isRecord(doc) ? own(doc, 'hooks') : undefined;
+    if (r.outcome === 'loaded') {
+        return Object.freeze({
+            outcome: 'loaded',
+            hooks: isRecord(original) ? original : undefined,
+            dropped: Object.freeze([]),
+            rejections: Object.freeze([]),
+        });
+    }
+    const dropped = Object.freeze(r.dropped.map(pieceOf));
+    return Object.freeze({
+        outcome: 'loaded-partial',
+        hooks: pruneHooks(original, hooksSalvageMaskOf(dropped)),
+        dropped,
+        rejections: Object.freeze([]),
+    });
+}
+export const HOOK_SETTINGS_SOURCE_TEXT = Object.freeze({
+    policySettings: 'Managed settings',
+    userSettings: 'User settings',
+    projectSettings: 'Project settings',
+    localSettings: 'Local settings',
+    flagSettings: 'Flag settings',
+});
+const SALVAGE_LABEL_MAX = 80;
+const SALVAGE_PIECES_SHOWN = 3;
+const labelOf = (s) => (typeof s === 'number' ? String(s) : displayUntrusted(s, { max: SALVAGE_LABEL_MAX }));
+function receivedOf(v) {
+    if (v === null)
+        return 'null';
+    if (Array.isArray(v))
+        return 'array';
+    return typeof v === 'object' ? 'object' : typeof v;
+}
+function valueAt(doc, path) {
+    let cur = doc;
+    for (const seg of path) {
+        if (typeof seg === 'number')
+            cur = Array.isArray(cur) ? cur[seg] : undefined;
+        else
+            cur = isRecord(cur) ? own(cur, seg) : undefined;
+    }
+    return cur;
+}
+function whereOf(path) {
+    const ev = path[1];
+    const gi = path[2];
+    const hi = path[4];
+    const evText = ev === undefined ? '' : `"${labelOf(ev)}"`;
+    if (typeof gi !== 'number')
+        return evText;
+    return typeof hi === 'number' ? `${evText} (matcher ${gi + 1}, hook ${hi + 1})` : `${evText} (matcher ${gi + 1})`;
+}
+const fieldTail = (field) => (field !== undefined ? ` (field "${labelOf(field)}")` : '');
+function dropPhrase(d, doc) {
+    switch (d.code) {
+        case 'hooks-not-object':
+            return `"hooks" must be an object mapping event names to matcher arrays; received ${receivedOf(valueAt(doc, d.path))}. This field was ignored`;
+        case 'unknown-event':
+            return `Unknown hook event ${whereOf(d.path)} was ignored`;
+        case 'event-not-array':
+            return `Hook event ${whereOf(d.path)} must be an array of matchers; received ${receivedOf(valueAt(doc, d.path))}. This entry was ignored`;
+        case 'matcher-invalid':
+            return `an invalid matcher under hook event ${whereOf(d.path)}${fieldTail(d.field)} was ignored`;
+        case 'entry-invalid':
+            return `an invalid hook under hook event ${whereOf(d.path)}${fieldTail(d.field)} was ignored`;
+    }
+}
+function rejectionPhrase(r) {
+    switch (r.code) {
+        case 'guard-outside-hooks':
+            return `a PreToolUse or PermissionRequest hook is written outside "hooks" (at ${r.path.map(labelOf).join('.') || 'the top level'})`;
+        case 'hooks-is-matcher':
+            return '"hooks" is written as a matcher or a single hook instead of an object of hook events';
+        case 'guard-under-unknown-event':
+            return `${whereOf(r.path)} is not a hook event, but it holds PreToolUse or PermissionRequest hooks`;
+        case 'guard-event-not-array':
+            return `hook event ${whereOf(r.path)} is not an array of matchers`;
+        case 'guard-matcher-invalid':
+            return `a matcher under hook event ${whereOf(r.path)}${fieldTail(r.field)} is invalid or holds a misplaced hook`;
+        case 'guard-entry-invalid':
+            return `a hook under hook event ${whereOf(r.path)}${fieldTail(r.field)} is invalid or holds a misplaced hook`;
+    }
+}
+function joinPhrases(phrases) {
+    const seen = new Set();
+    const uniq = [];
+    for (const p of phrases) {
+        if (seen.has(p.key))
+            continue;
+        seen.add(p.key);
+        uniq.push(p.text);
+    }
+    const shown = uniq.slice(0, SALVAGE_PIECES_SHOWN).join('; ');
+    return uniq.length > SALVAGE_PIECES_SHOWN ? `${shown}; and ${uniq.length - SALVAGE_PIECES_SHOWN} more` : shown;
+}
+const GUARD_RISK_TAIL = 'a PreToolUse or PermissionRequest hook that cannot be loaded may be what guards the permissions declared beside it, so none of the hooks in this file are applied until it is fixed';
+export function settingsHooksSalvageNotice(salvage, source, doc) {
+    const layer = HOOK_SETTINGS_SOURCE_TEXT[source] ?? 'Settings';
+    try {
+        if (salvage.outcome === 'loaded-partial') {
+            const what = joinPhrases(salvage.dropped.map((d) => ({ key: d.path.join('\u0000'), text: dropPhrase(d, doc) })));
+            return `${layer}: ${what}. The rest of this file's hooks are applied.`;
+        }
+        if (salvage.outcome === 'rejected') {
+            const why = joinPhrases(salvage.rejections.map((r) => ({ key: r.path.join('\u0000'), text: rejectionPhrase(r) })));
+            if (source === 'policySettings') {
+                return `${layer}: hooks could not be loaded — ${why}. Requests are not sent while the managed hooks cannot be applied; ask your administrator to fix the managed settings.`;
+            }
+            return `${layer}: hooks were not loaded — ${why}; ${GUARD_RISK_TAIL}.`;
+        }
+        return undefined;
+    }
+    catch {
+        return salvage.outcome === 'loaded' ? undefined : `${layer}: some hooks in this file could not be loaded.`;
+    }
+}

package/dist/skillToolListsCapability.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from './env/uiLanguage.js';
 export type SkillToolListsReading = {
     kind: 'unobserved';
 } | {
@@ -12,4 +13,4 @@ export type SkillToolListsReading = {
 export declare function projectSkillToolListsCapability(caps: unknown): SkillToolListsReading | undefined;
 export declare function observedSkillToolLists(baseUrl?: string | undefined): SkillToolListsReading;
 export declare function skillToolListsAvailable(reading: SkillToolListsReading): 'yes' | 'no' | 'unknown';
-export declare function skillToolListsDoctorDetail(reading: SkillToolListsReading): string;
+export declare function skillToolListsDoctorDetail(reading: SkillToolListsReading, lang?: UiLanguage): string;