@sema-agent/client-core 0.99.0 → 0.101.0

package/dist/seatContract.js

@@ -62,7 +62,7 @@ const firstAccessorPath = (root) => {
             const at = path === "" ? k : `${path}.${k}`;
             if (!Object.hasOwn(d, "value"))
                 return at;
-            stack.push([d.value, at]);
+            Object.defineProperty(stack, stack.length, { value: [d.value, at], writable: true, enumerable: true, configurable: true });
         }
     }
     return undefined;
@@ -197,7 +197,7 @@ const firstSecretKeyPath = (root, allow) => {
             const at = isArr && /^[0-9]+$/.test(k) ? `${path}[${k}]` : pathAt(path, k);
             if (isSecretKeyName(k) && !allow.has(at))
                 return at;
-            stack.push([d.value, at]);
+            Object.defineProperty(stack, stack.length, { value: [d.value, at], writable: true, enumerable: true, configurable: true });
         }
     }
     return undefined;
@@ -251,22 +251,49 @@ const SEAT_EVENT_TYPE_TUPLE = [
     "subagent_content",
 ];
 export const SEAT_EVENT_TYPES = Object.freeze(SEAT_EVENT_TYPE_TUPLE);
-const CHROME_EVENT_KIND_TUPLE = [
-    "panel_task",
-    "notification_terminal",
-    "prompt_suggestions",
-    "subagent_lifecycle",
-    "text_segment_end",
-    "thinking_segment_end",
-    "retry_status",
-    "context_usage",
-    "last_turn_usage",
-    "bgshell_register",
-    "bgshell_settle",
-    "memory_saved",
-    "result_replayed",
-    "tool_parked",
-];
+const CHROME_ARM_SEAT_ROUTE = {
+    panel_task: "seat",
+    notification_terminal: "seat",
+    prompt_suggestions: "seat",
+    subagent_lifecycle: "seat",
+    text_segment_end: "seat",
+    thinking_segment_end: "seat",
+    retry_status: "seat",
+    context_usage: "seat",
+    last_turn_usage: "seat",
+    bgshell_register: "seat",
+    bgshell_settle: "seat",
+    memory_saved: "seat",
+    result_replayed: "seat",
+    tool_parked: "seat",
+    compaction_started: "seat",
+    compaction_outcome: "seat",
+    engine_notice: "seat",
+    workflow_notification_enqueue: "host",
+    plan_review_park: "host",
+    approval_request: "host",
+    approval_revoke: "host",
+    task_ledger_sync: "host",
+    inline_task_stats: "host",
+    stream_delta: "host",
+    thinking_activity: "host",
+    request_start: "host",
+    response_metrics: "host",
+    attachment: "host",
+    subagent_turn_usage: "host",
+    run_cost_reconciled: "host",
+    message_committed: "host",
+    human_input: "host",
+    tool_roster_delta: "host",
+    subagent_started: "host",
+    prompt_assembled: "host",
+    tool_disclosure: "host",
+    tool_progress: "host",
+    wiring_manifest: "host",
+    suspended_reopened: "host",
+    result_text_diverged: "host",
+};
+const CHROME_EVENT_KIND_TUPLE = Object.keys(CHROME_ARM_SEAT_ROUTE).filter((k) => CHROME_ARM_SEAT_ROUTE[k] === "seat");
 export const CHROME_EVENT_KINDS = Object.freeze(CHROME_EVENT_KIND_TUPLE);
 const LANE_PROOF_LANE_TUPLE = ["main", "subagent", "workflow"];
 export const SEAT_CHROME_ENVELOPE_KEYS = ["kind", "laneProof"];
@@ -327,7 +354,7 @@ export function readSeatStreamDelta(message) {
         return Object.freeze({ kind: "malformed" });
     }
 }
-export const SEAT_CAPABILITY_NAMES = Object.freeze(["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard"]);
+export const SEAT_CAPABILITY_NAMES = Object.freeze(["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard", "mcpToolToggles"]);
 const notReported = () => Object.freeze({ kind: "not_reported" });
 const malformedReading = () => Object.freeze({ kind: "malformed" });
 const reported = (available) => Object.freeze({ kind: "reported", available });
@@ -340,7 +367,7 @@ export function seatCapability(state, name) {
         const desc = Object.getOwnPropertyDescriptor(state, name);
         if (desc === undefined)
             return notReported();
-        if (!("value" in desc))
+        if (!Object.hasOwn(desc, "value"))
             return malformedReading();
         const v = desc.value;
         if (v === undefined)
@@ -402,6 +429,7 @@ const SEAT_CAPABILITY_PHRASES = Object.freeze({
     devices: Object.freeze({ action: "Managing devices", ability: "manage devices", support: "device support" }),
     engineTarget: Object.freeze({ action: "Switching engines", ability: "switch engines", support: "engine-switching support" }),
     onboard: Object.freeze({ action: "Model setup", ability: "add models", support: "model-setup support" }),
+    mcpToolToggles: Object.freeze({ action: "Per-tool switching", ability: "toggle tools", support: "per-tool switches" }),
 });
 export function seatCapabilityUnavailableDetail(name, reading) {
     const phrase = Object.hasOwn(SEAT_CAPABILITY_PHRASES, name)
@@ -520,10 +548,10 @@ export const SEAT_REASONING_EFFORTS = [...REASONING_EFFORT_WORDS];
 export const SEAT_TURN_SETTINGS_KEYS = ["ultracode"];
 export const SEAT_TURN_SETTINGS_ORIGINS = Object.freeze({
     ultracode: Object.freeze({ carriedBy: "renderer" }),
-    webSearch: Object.freeze({ hostSupplied: "联网检索的每请求配置来自宿主的设置源(可能带检索服务的凭据与私网地址);渲染端没有设置文件,也不该持有凭据" }),
-    hooks: Object.freeze({ hostSupplied: "hooks 表来自宿主的设置文件(宿主经设置端口与 hooksForWire 投影);渲染端没有设置文件、也不执行本机 hook" }),
-    resolved: Object.freeze({ hostSupplied: "设置解析器的生效快照(hooks / env / model / 已解析权限)由宿主跑解析器得出;渲染端没有设置源可解析" }),
-    outputStyle: Object.freeze({ hostSupplied: "输出风格正文由宿主的兜底层随请求带(风格文件在宿主);渲染端只选名字,不持正文" }),
+    webSearch: Object.freeze({ hostSupplied: "settings.webSearch" }),
+    hooks: Object.freeze({ hostSupplied: "settings.hooks" }),
+    resolved: Object.freeze({ hostSupplied: "settings.resolved" }),
+    outputStyle: Object.freeze({ hostSupplied: "settings.outputStyle" }),
 });
 export const SEAT_REWIND_INTENT_KEYS = ["mode", "targetMessageUuid"];
 export const ATTACHMENT_UPLOAD_REQUEST_KEYS = ["name", "mimeType", "bytes"];
@@ -902,6 +930,12 @@ const checkSessionMcpPanelResult = seatCheck((v) => {
         return checkSessionMcpPanelFailure(v);
     return Object.hasOwn(v, "scenarioRefusal") ? checkSessionMcpPanelRefusalView(v) : checkSessionMcpPanelServersView(v);
 });
+const MCP_TOOL_TOGGLE_KEY = shapeRule("toggle key", {
+    server: reqF(R_NONEMPTY),
+    tool: reqF(R_NONEMPTY),
+});
+export const checkMcpToolToggleKey = seatShapeCheck(MCP_TOOL_TOGGLE_KEY);
+const checkMcpToolTogglesResult = seatShapeCheck(shapeRule("toggles result", { off: reqF(arrayRule(MCP_TOOL_TOGGLE_KEY)) }));
 const checkLocalSessionRecord = seatCheck((s) => {
     if (!isPlainRecord(s))
         return bad("session record is not a plain object");
@@ -1077,9 +1111,11 @@ const SEAT_CHROME_PAYLOAD_SPECS = {
         registration: reqF(shapeRule("registration", {
             kind: reqF(oneOfRule("registration kind", ["register"])),
             taskId: reqF(R_NONEMPTY),
+            toolUseId: optF(R_NONEMPTY),
             command: reqF(R_STR),
             description: optF(R_STR),
             receipt: reqF(R_STR),
+            outputFile: optF(R_NONEMPTY),
             source: reqF(oneOfRule("registration source", ["bash", "monitor"])),
         })),
     },
@@ -1571,6 +1607,8 @@ export const LOCAL_SESSIONS_SPEC = {
         probeOnboardEntry: { kind: "invoke", check: checkOnboardProbeResult },
         applyOnboardEntry: { kind: "invoke", check: checkOnboardApplyResult },
         readSessionMcpPanel: { kind: "invoke", check: checkSessionMcpPanelResult },
+        listMcpToolToggles: { kind: "invoke", check: checkMcpToolTogglesResult },
+        setMcpToolToggle: { kind: "invoke", check: checkOkAck },
         onEvent: { kind: "event", check: checkLocalSessionEvent },
         onToolPermissionRequest: { kind: "event", check: checkToolPermissionRequest },
     },
@@ -1616,6 +1654,8 @@ export const SEAT_METHOD_NAMES = [
     "probeOnboardEntry",
     "applyOnboardEntry",
     "readSessionMcpPanel",
+    "listMcpToolToggles",
+    "setMcpToolToggle",
     "onEvent",
     "onToolPermissionRequest",
 ];
@@ -1895,7 +1935,7 @@ export const SEAT_VALIDATOR_KEY_COVERAGE = {
     },
     SeatCapabilitiesState: {
         check: checkSeatCapabilitiesState,
-        validated: ["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard"],
+        validated: ["pickFolder", "rewind", "recents", "patchSession", "devices", "engineTarget", "onboard", "mcpToolToggles"],
         unchecked: [],
     },
     RecentFoldersResult: {
@@ -1956,6 +1996,8 @@ export const SEAT_VALIDATOR_COVERAGE_EXEMPT = [
         ["OnboardApplyResult", checkOnboardApplyResult],
         ["OnboardEntryRequest", checkOnboardEntryRequest],
         ["OnboardApplyRequest", checkOnboardApplyRequest],
+        ["McpToolTogglesResult", checkMcpToolTogglesResult],
+        ["McpToolToggleKey", checkMcpToolToggleKey],
     ].map(([label, check]) => ({
         label,
         check,
@@ -2006,5 +2048,8 @@ const _seatContractPins = [
     true, true,
     true, true, true, true,
     true, true, true,
+    true,
+    true, true, true,
+    true, true,
 ];
 void _seatContractPins;

package/dist/selfOrchestrationDenial.js

@@ -43,7 +43,7 @@ function ownRead(o, key) {
         const d = Object.getOwnPropertyDescriptor(o, key);
         if (d === undefined)
             return ABSENT;
-        if ('get' in d || 'set' in d)
+        if (Object.hasOwn(d, 'get') || Object.hasOwn(d, 'set'))
             return ACCESSOR;
         return { kind: 'data', value: d.value };
     }

package/dist/sessionPolicyCapability.js

@@ -1,4 +1,4 @@
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { msg, renderMessage } from './i18n/translate.js';
 import { ownDataField } from './ownKey.js';
@@ -22,7 +22,7 @@ const reader = createEngineCapReader({
     name: 'sessionPolicy',
     project: projectSessionPolicyCapability,
 });
-export function observedSessionPolicy(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedSessionPolicy(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function sessionPolicyFaceAvailable(reading) {

package/dist/sessionRulesChildrenReadLive.d.ts

@@ -0,0 +1,6 @@
+export interface SessionRulesManifestSeat {
+    readonly sessionRules?: {
+        readonly childrenReadLive?: boolean;
+    };
+}
+export declare function sessionRulesChildrenReadLiveOf(manifest: SessionRulesManifestSeat | null | undefined): boolean | undefined;

package/dist/sessionRulesChildrenReadLive.js

@@ -0,0 +1,5 @@
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+export function sessionRulesChildrenReadLiveOf(manifest) {
+    const raw = guardedRead(() => readOwnDataValue(readOwnDataValue(manifest, 'sessionRules'), 'childrenReadLive'));
+    return typeof raw === 'boolean' ? raw : undefined;
+}

package/dist/sessionRulesNamespaceFormsCapability.d.ts

@@ -0,0 +1,12 @@
+export type SessionRulesNamespaceFormsReading = {
+    readonly kind: 'confirmed';
+} | {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'declined';
+} | {
+    readonly kind: 'unreadable';
+} | {
+    readonly kind: 'unobserved';
+};
+export declare function observedSessionRulesNamespaceForms(baseUrl?: string | undefined): SessionRulesNamespaceFormsReading;

package/dist/sessionRulesNamespaceFormsCapability.js

@@ -0,0 +1,29 @@
+import { engineCapValue } from './engineCapsCache.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
+const SESSION_RULES_NAMESPACE_FORMS_KEY = 'sessionRulesNamespaceForms';
+const CONFIRMED = Object.freeze({ kind: 'confirmed' });
+const ABSENT = Object.freeze({ kind: 'absent' });
+const DECLINED = Object.freeze({ kind: 'declined' });
+const UNREADABLE = Object.freeze({ kind: 'unreadable' });
+const UNOBSERVED = Object.freeze({ kind: 'unobserved' });
+export function observedSessionRulesNamespaceForms(baseUrl) {
+    try {
+        const base = baseUrl === undefined ? engineWireTargetBaseUrl() : baseUrl;
+        const slot = engineCapValue(typeof base === 'string' ? base : undefined, SESSION_RULES_NAMESPACE_FORMS_KEY);
+        switch (slot.kind) {
+            case 'unobserved':
+                return UNOBSERVED;
+            case 'not_reported':
+                return ABSENT;
+            case 'unreadable':
+                return UNREADABLE;
+            case 'null':
+                return DECLINED;
+            case 'value':
+                return slot.value === true ? CONFIRMED : DECLINED;
+        }
+    }
+    catch {
+        return UNOBSERVED;
+    }
+}

package/dist/sessionSyncFileHistoryCapability.js

@@ -1,4 +1,4 @@
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { ownDataField } from './ownKey.js';
 export function projectSessionSyncFileHistoryCapability(caps) {
@@ -20,7 +20,7 @@ const reader = createEngineCapReader({
     name: 'sessionSyncFileHistory',
     project: projectSessionSyncFileHistoryCapability,
 });
-export function observedSessionSyncFileHistory(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedSessionSyncFileHistory(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function sessionSyncFileHistoryAvailable(reading) {

package/dist/settingsCredentialKeyPaths.d.ts

@@ -0,0 +1,8 @@
+export interface CredentialKeyFinding {
+    readonly path: string;
+    readonly numericByNameOnly?: true;
+}
+export declare function credentialNameWords(name: string): string[];
+export declare function isCredentialEnvName(name: string): boolean;
+export declare function isCredentialConfigKey(name: string): boolean;
+export declare function settingsCredentialKeyPaths(doc: object | null | undefined): CredentialKeyFinding[];

package/dist/settingsCredentialKeyPaths.js

@@ -0,0 +1,274 @@
+import { looksLikeKnownSecret, percentBoundaryReadingOf, queryCarriesCredential } from './displayUntrusted.js';
+const CREDENTIAL_WORDS = new Set([
+    'key', 'keys', 'apikey', 'token', 'tokens', 'secret', 'secrets', 'password', 'passwd', 'pass', 'pwd', 'pin', 'otp',
+    'auth', 'authorization', 'credential', 'credentials', 'cookie', 'cookies', 'session', 'private', 'cert', 'signature', 'salt',
+]);
+const CREDENTIAL_STEMS = ['PASSWORD', 'PASSWD', 'SECRET', 'TOKEN', 'APIKEY', 'CREDENTIAL', 'COOKIE', 'PRIVATE'];
+const CREDENTIAL_SUFFIXES = ['PASS', 'PWD', 'KEY', 'AUTH'];
+const SECRET_CONFIG_NAME = /(?:^|[-_.])(?:token|key|secret|password|authorization|credential|cookie)s?$/i;
+const FLATTENED_CREDENTIAL_TAILS = [
+    'apikey', 'token', 'tokens', 'secret', 'secrets', 'password', 'passwd', 'credential', 'credentials', 'cookie', 'cookies', 'authorization',
+];
+export function credentialNameWords(name) {
+    if (typeof name !== 'string')
+        return [];
+    return name
+        .replace(/([A-Z])(?=[A-Z][a-z])/g, '$1_')
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .split(/[_\-.\s]+/)
+        .filter((w) => w.length > 0)
+        .map((w) => w.toLowerCase());
+}
+export function isCredentialEnvName(name) {
+    if (typeof name !== 'string')
+        return false;
+    if (credentialNameWords(name).some((w) => CREDENTIAL_WORDS.has(w)))
+        return true;
+    const upper = name.toUpperCase();
+    return CREDENTIAL_STEMS.some((stem) => upper.includes(stem)) || CREDENTIAL_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+function legacyNameWords(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .split(/[_\-.\s]+/)
+        .filter((w) => w.length > 0)
+        .map((w) => w.toLowerCase());
+}
+export function isCredentialConfigKey(name) {
+    if (typeof name !== 'string')
+        return false;
+    const words = credentialNameWords(name);
+    const last = words[words.length - 1];
+    if (SECRET_CONFIG_NAME.test(name) || (last !== undefined && CREDENTIAL_WORDS.has(last)))
+        return true;
+    const legacy = legacyNameWords(name);
+    const legacyLast = legacy[legacy.length - 1];
+    if (legacyLast !== undefined && CREDENTIAL_WORDS.has(legacyLast))
+        return true;
+    const flattened = name.replace(/[_\-.\s]+/g, '').toLowerCase();
+    return FLATTENED_CREDENTIAL_TAILS.some((tail) => flattened.endsWith(tail));
+}
+const DECIMAL_INTEGER_RE = /^\s*\d+\s*$/;
+function percentDecodeOnce(s) {
+    return s.indexOf('%') === -1 ? s : s.replace(/%([0-7][0-9A-Fa-f])/g, (_m, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+}
+const SCHEME_THEN_ENCODED_SPACE = /(?:^|[^A-Za-z0-9])(?:bearer|basic)(?:\+|%20)[^\s+%]{1,4096}/i;
+const FORM_READING_MAX_LAYERS = 3;
+function formEncodedCarriesCredential(value) {
+    if (value.indexOf('+') === -1 && value.indexOf('%') === -1)
+        return false;
+    let layer = value;
+    for (let depth = 0;; depth++) {
+        const boundary = percentBoundaryReadingOf(layer);
+        for (const reading of boundary === layer ? [layer] : [layer, boundary]) {
+            if (SCHEME_THEN_ENCODED_SPACE.test(reading))
+                return true;
+            if (reading.indexOf('+') !== -1 && looksLikeKnownSecret(reading.replace(/\+/g, ' ')))
+                return true;
+        }
+        const next = percentDecodeOnce(layer);
+        if (next === layer)
+            return false;
+        if (depth === FORM_READING_MAX_LAYERS)
+            return true;
+        layer = next;
+    }
+}
+function urlCarriesCredential(value) {
+    const text = value.trim();
+    if (!text.includes('://'))
+        return false;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return false;
+    }
+    if (url.username !== '' || url.password !== '')
+        return true;
+    return url.search.length > 1 && queryCarriesCredential(url.search.slice(1));
+}
+function stringCarriesCredential(value) {
+    if (looksLikeKnownSecret(value) || formEncodedCarriesCredential(value))
+        return true;
+    let layer = value;
+    for (let depth = 0;; depth++) {
+        if (urlCarriesCredential(layer))
+            return true;
+        if (depth === FORM_READING_MAX_LAYERS)
+            return false;
+        const next = percentDecodeOnce(layer);
+        if (next === layer)
+            return false;
+        layer = next;
+    }
+}
+const ENV_ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+const LONG_OPTION_RE = /^--?([A-Za-z][A-Za-z0-9_-]*)(?:=(.*))?$/s;
+const HEADER_FORM_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*:\s*\S/;
+function argvFindings(args) {
+    const hits = new Map();
+    const add = (i, numericByNameOnly) => {
+        hits.set(i, (hits.get(i) ?? true) && numericByNameOnly);
+    };
+    const valueCarries = (value) => {
+        const header = HEADER_FORM_RE.exec(value);
+        return stringCarriesCredential(value) || (header !== null && isCredentialConfigKey(header[1] ?? ''));
+    };
+    args.forEach((arg, i) => {
+        if (valueCarries(arg))
+            add(i, false);
+        const assignment = ENV_ASSIGNMENT_RE.exec(arg);
+        if (assignment !== null && assignment[2] !== '') {
+            const assigned = assignment[2] ?? '';
+            if (valueCarries(assigned))
+                add(i, false);
+            if (isCredentialEnvName(assignment[1] ?? ''))
+                add(i, DECIMAL_INTEGER_RE.test(assigned));
+        }
+        const option = LONG_OPTION_RE.exec(arg);
+        if (option === null)
+            return;
+        const inline = option[2];
+        if (inline !== undefined && inline !== '' && valueCarries(inline))
+            add(i, false);
+        const optionName = option[1] ?? '';
+        if (optionName.length <= 1 || !isCredentialEnvName(optionName))
+            return;
+        if (inline !== undefined) {
+            if (inline !== '')
+                add(i, DECIMAL_INTEGER_RE.test(inline));
+        }
+        else {
+            const next = args[i + 1];
+            if (next !== undefined && next !== '')
+                add(i + 1, DECIMAL_INTEGER_RE.test(next));
+        }
+    });
+    return hits;
+}
+function isPresent(value) {
+    return value !== undefined && value !== null && value !== '' && value !== false;
+}
+function arrayKindOf(node) {
+    try {
+        return Array.isArray(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownKeysOf(node) {
+    try {
+        return Object.keys(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readSlot(node, key) {
+    try {
+        return { ok: true, value: node[key] };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+export function settingsCredentialKeyPaths(doc) {
+    const found = [];
+    if (doc === null || doc === undefined || typeof doc !== 'object')
+        return found;
+    const finding = (path, numericByNameOnly) => (numericByNameOnly ? { path, numericByNameOnly: true } : { path });
+    const ancestors = new WeakSet();
+    const stack = [{ node: doc, path: '', inEnv: false }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        if (frame === undefined)
+            continue;
+        const { node, path, inEnv } = frame;
+        if (frame.exit === true) {
+            ancestors.delete(node);
+            continue;
+        }
+        if (ancestors.has(node))
+            continue;
+        ancestors.add(node);
+        stack.push({ node, path, inEnv, exit: true });
+        const isArray = arrayKindOf(node);
+        if (isArray === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        if (isArray) {
+            let items;
+            try {
+                items = Array.from(node);
+            }
+            catch {
+                if (path !== '')
+                    found.push(finding(path, false));
+                continue;
+            }
+            if (items.length > 0 && items.every((item) => typeof item === 'string')) {
+                const hits = argvFindings(items);
+                for (const i of [...hits.keys()].sort((a, b) => a - b))
+                    found.push(finding(`${path}[${i}]`, hits.get(i) === true));
+                continue;
+            }
+            items.forEach((item, i) => {
+                const itemPath = `${path}[${i}]`;
+                if (typeof item === 'string') {
+                    if (stringCarriesCredential(item))
+                        found.push(finding(itemPath, false));
+                }
+                else if (item !== null && typeof item === 'object') {
+                    stack.push({ node: item, path: itemPath, inEnv: false });
+                }
+            });
+            continue;
+        }
+        const keys = ownKeysOf(node);
+        if (keys === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        for (const key of keys) {
+            const keyPath = path === '' ? key : `${path}.${key}`;
+            const nameIsCredential = inEnv ? isCredentialEnvName(key) : isCredentialConfigKey(key);
+            const slot = readSlot(node, key);
+            if (!slot.ok) {
+                if (nameIsCredential)
+                    found.push(finding(keyPath, false));
+                continue;
+            }
+            const value = slot.value;
+            if (typeof value === 'string') {
+                const byValue = stringCarriesCredential(value);
+                if (byValue || (nameIsCredential && isPresent(value)))
+                    found.push(finding(keyPath, !byValue && DECIMAL_INTEGER_RE.test(value)));
+                continue;
+            }
+            if (value !== null && typeof value === 'object') {
+                let nonEmpty;
+                try {
+                    nonEmpty = Array.isArray(value) ? value.length > 0 : Object.keys(value).length > 0;
+                }
+                catch {
+                    nonEmpty = true;
+                }
+                if (nameIsCredential && nonEmpty) {
+                    found.push(finding(keyPath, false));
+                    continue;
+                }
+                stack.push({ node: value, path: keyPath, inEnv: key === 'env' });
+                continue;
+            }
+            if (nameIsCredential && isPresent(value))
+                found.push(finding(keyPath, typeof value === 'number'));
+        }
+    }
+    return found;
+}

package/dist/settingsHooksSalvage.d.ts

@@ -41,4 +41,5 @@ export declare function hooksSalvageMaskOf(dropped: readonly {
 }[]): HooksSalvageMask;
 export declare function salvageSettingsHooksEntries(doc: SettingsDocument | null | undefined): HooksSalvage;
 export declare const HOOK_SETTINGS_SOURCE_TEXT: Readonly<Record<HookSettingsSource, string>>;
+export declare function layerNotAppliedRefusesTurn(source: HookSettingsSource): boolean;
 export declare function settingsHooksSalvageNotice(salvage: HooksSalvage, source: HookSettingsSource, doc?: SettingsDocument | null): string | undefined;

package/dist/settingsHooksSalvage.js

@@ -1,4 +1,5 @@
 import { displayUntrusted } from './displayUntrusted.js';
+import { msg, renderMessage } from './i18n/translate.js';
 import { SETTINGS_CLASSIFY_HOOKS_CONFIG, } from './generated/settingsSchemaFns.js';
 const _tuplePins = [true, true, true, true, true, true];
 void _tuplePins;
@@ -116,6 +117,9 @@ export const HOOK_SETTINGS_SOURCE_TEXT = Object.freeze({
     localSettings: 'Local settings',
     flagSettings: 'Flag settings',
 });
+export function layerNotAppliedRefusesTurn(source) {
+    return source === 'policySettings';
+}
 const SALVAGE_LABEL_MAX = 80;
 const SALVAGE_PIECES_SHOWN = 3;
 const labelOf = (s) => (typeof s === 'number' ? String(s) : displayUntrusted(s, { max: SALVAGE_LABEL_MAX }));
@@ -194,11 +198,13 @@ export function settingsHooksSalvageNotice(salvage, source, doc) {
     try {
         if (salvage.outcome === 'loaded-partial') {
             const what = joinPhrases(salvage.dropped.map((d) => ({ key: d.path.join('\u0000'), text: dropPhrase(d, doc) })));
+            if (layerNotAppliedRefusesTurn(source))
+                return renderMessage(msg('config.hooks.salvage.managedPartial', { layer, what }));
             return `${layer}: ${what}. The rest of this file's hooks are applied.`;
         }
         if (salvage.outcome === 'rejected') {
             const why = joinPhrases(salvage.rejections.map((r) => ({ key: r.path.join('\u0000'), text: rejectionPhrase(r) })));
-            if (source === 'policySettings') {
+            if (layerNotAppliedRefusesTurn(source)) {
                 return `${layer}: hooks could not be loaded — ${why}. Requests are not sent while the managed hooks cannot be applied; ask your administrator to fix the managed settings.`;
             }
             return `${layer}: hooks were not loaded — ${why}; ${GUARD_RISK_TAIL}.`;

package/dist/settingsLayerAdmission.d.ts

@@ -0,0 +1,4 @@
+import type { HostSettingsLayer, WorkspaceTrustState } from './hostSettingsSource.js';
+export declare function layerAdmissionWord(layer: HostSettingsLayer, trust: WorkspaceTrustState | 'unreadable', category: string, member?: string): string;
+export declare function layerAdmitted(layer: HostSettingsLayer, trust: WorkspaceTrustState | 'unreadable', category: string, member?: string): boolean;
+export declare function admittedLayers<L extends HostSettingsLayer>(layers: readonly L[], trust: WorkspaceTrustState | 'unreadable', category: string, member?: string): readonly L[];

package/dist/settingsLayerAdmission.js

@@ -0,0 +1,16 @@
+import { SETTINGS_LAYER_ADMISSION } from './generated/settingsSchemaFns.js';
+const TRUST_UNREADABLE_READING = 'declined';
+const ADMITTED = 'admitted';
+function layerAdmissionOf(layer, trust, category, member) {
+    const reading = trust === 'unreadable' ? TRUST_UNREADABLE_READING : trust;
+    return member === undefined ? SETTINGS_LAYER_ADMISSION(layer, reading, category) : SETTINGS_LAYER_ADMISSION(layer, reading, category, member);
+}
+export function layerAdmissionWord(layer, trust, category, member) {
+    return layerAdmissionOf(layer, trust, category, member);
+}
+export function layerAdmitted(layer, trust, category, member) {
+    return layerAdmissionOf(layer, trust, category, member) === ADMITTED;
+}
+export function admittedLayers(layers, trust, category, member) {
+    return layers.filter((layer) => layerAdmitted(layer, trust, category, member));
+}

package/dist/skillToolListsCapability.js

@@ -1,7 +1,7 @@
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { msg, renderMessage } from './i18n/translate.js';
-import { ownDataField } from './ownKey.js';
+import { guardedRead, ownDataField, readOwnDataValue } from './ownKey.js';
 export function projectSkillToolListsCapability(caps) {
     try {
         if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
@@ -21,13 +21,14 @@ const reader = createEngineCapReader({
     name: 'skillToolLists',
     project: projectSkillToolListsCapability,
 });
-export function observedSkillToolLists(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedSkillToolLists(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function skillToolListsAvailable(reading) {
-    if (reading.kind === 'present')
+    const kind = guardedRead(() => readOwnDataValue(reading, 'kind'));
+    if (kind === 'present')
         return 'yes';
-    if (reading.kind === 'absent' || reading.kind === 'not_reported')
+    if (kind === 'absent' || kind === 'not_reported')
         return 'no';
     return 'unknown';
 }