@sema-agent/sdk 15.1.1 → 15.3.0

package/openapi.yaml

@@ -881,6 +881,17 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            errorCode "steering.ledger_unavailable" (server >=7.110.0, S-928) — the live-run path writes this
+            acceptance into the user-input ledger BEFORE answering 200 `applied` (so a process crash before the
+            run consumes it can be announced on the session's next run); the ledger could not be written (local
+            data root not writable / SQL unreachable). NOTHING reached the engine. Client action: retry the SAME
+            text later (same Idempotency-Key is fine — nothing was accepted); unlike every other `steering.*`
+            code this is not a content / key / resume problem. SDK: `SteeringLedgerUnavailableError`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/runs/{taskId}/interrupt:
     parameters:
@@ -1002,6 +1013,16 @@ paths:
           content:
             application/json:
               schema: { $ref: '#/components/schemas/ErrorResponse' }
+        '503':
+          description: >-
+            errorCode "steering.ledger_unavailable" (server >=7.110.0, S-928) — the text form rides the same
+            engine verb as a live steer, so the same ledger write happens BEFORE the 202 `queued-immediate`; when
+            the ledger cannot be written the interrupt is refused and NOTHING reached the engine (the bare halt
+            carries no input and never takes this arm). Client action: retry the same text later. SDK:
+            `SteeringLedgerUnavailableError`.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/runs/{taskId}/subagents/{target}/steer:
     parameters:
@@ -1036,7 +1057,8 @@ paths:
       responses:
         '200':
           description: >
-            Queued/applied. Body `{ taskId, target, status, delivery, marker, note }` — `note` carries the
+            Queued/applied. Body `{ taskId, target, status, delivery, marker, note }` (+ `messageId` from server >= 7.111.0,
+            see `SubagentSteerReceipt`) — `note` carries the
             CC-verbatim "Message queued for delivery to <name> at its next tool round." receipt copy.
         '401': { $ref: '#/components/responses/Unauthorized' }
         '404': { $ref: '#/components/responses/NotFound' }
@@ -1053,6 +1075,18 @@ paths:
           description: 'errorCode "steer.content_too_large" — content over the per-steer cap; shorten and resend (retrying verbatim never succeeds).'
         '429': { $ref: '#/components/responses/RateLimited' } # (declared 2026-07-31) rateLimited||quotaExceeded||leaseDenied all gate this verb (routes/runs.ts)
         '501': { $ref: '#/components/responses/NotImplemented' }
+        '503':
+          description: >-
+            errorCode "steering.ledger_unavailable" (server >=7.111.0, S-966) — a subagent steer enters the same
+            user-input ledger as a run steer (ONE rule: the ledger covers an input whose receipt promised delivery and
+            whose carrying engine stream lives in a run leg of this server), written BEFORE the 200; the ledger could not
+            be written (local data root not writable / SQL unreachable). The subagent received NOTHING. Client action:
+            retry the SAME content later. SDK: `SteeringLedgerUnavailableError`. The sibling `…/resume` verb never
+            takes this arm (a resume starts a new child leg; it does not feed an in-flight queue). Before 7.111.0 this
+            verb wrote no ledger row and never answered 503 for it.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/ErrorResponse' }
 
   /v1/runs/{taskId}/compact:
     parameters:
@@ -7530,7 +7564,8 @@ components:
             `wiring_manifest` frame — test with `'wiringManifest' in result`, never `=== undefined`). The run's
             boot-time wiring receipt: the `wiring_manifest` frame (minted after wiring, before the first turn)
             projected by the SAME projector as the streaming leg (tenant face strips operator-only sections; an
-            explicit operator gets the full face). NOT current state — runtime roster changes ride
+            explicit operator gets the full face; server >=7.111.0 carries the self-minted `instructions` section here
+            too, same present-iff reading as `Event_wiring_manifest.instructions`). NOT current state — runtime roster changes ride
             `tool_roster_delta` frames. Shells judge a zero-tool run by `tools.count === 0`.
         terminal:
           allOf: [{ $ref: '#/components/schemas/TerminalCause' }]
@@ -12195,6 +12230,35 @@ components:
           $ref: '#/components/schemas/SessionWindow'
         promptEpoch:
           $ref: '#/components/schemas/PromptEpoch'
+        userInputUndrained:
+          type: array
+          description: >-
+            server >=7.110.0 (S-928 user-input acceptance ledger): user inputs this session LOST to a crash —
+            the server had answered 200 `applied` (interrupt{text}: 202) but the process carrying that run died
+            before the run settled; whether the run consumed them is NOT known (see `engine_notice`
+            `task.user_steer_undrained{cause:"crashed"}`). Converged rows only, one row per (taskId, messageId),
+            newest 500. From server >=7.111.0 (S-966) the rows include SUBAGENT steers (recorded under the run on the
+            receipt; same row shape, `kind` is still only `steer`; `messageId` = the subagent steer receipt's).
+            ABSENT = this read has nothing to report (zero rows, or the ledger could not be read —
+            the authoritative notice is the frame on the run stream); the `?message=` single-entry form never
+            carries it.
+          items:
+            type: object
+            required: [messageId, kind, taskId, acceptedAt, cause]
+            additionalProperties: false
+            properties:
+              messageId: { type: string }
+              kind: { type: string, enum: [steer] }
+              taskId: { type: string, description: The run the input was accepted for (its 200/202 receipt). }
+              acceptedAt: { type: string, description: ISO timestamp. }
+              cause: { type: string, enum: [crashed] }
+              announced:
+                type: object
+                required: [at, taskId]
+                additionalProperties: false
+                properties:
+                  at: { type: string, description: ISO timestamp. }
+                  taskId: { type: string, description: The later run on whose first beat the notice was emitted. }
         messages:
           type: array
           items: {}
@@ -14300,6 +14364,23 @@ components:
             (`capabilities.rewindFiles`); only a run the REQUEST word turned off cannot restore itself.
             OPEN on read: the server does not enumerate the word (a present non-string is dropped), a third word passes
             through — treat it as unknown. ABSENT = an older engine / external derivation, never "capturing".
+        instructions:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
+          description: >
+            server >= 7.111.0 (S-961; cli L-910; contract appendix G.21b) — SELF-MINTED by the server (core's
+            `WiringManifest` has no such section; the server adds it beside core's own, and a core section of the
+            same name would be a compile error server-side). TENANT and OPERATOR faces alike; rides the live frame, the
+            durable ledger row and the sync receipt's `wiringManifest`. Which PROJECT-INSTRUCTION FILE the project-memory
+            loader selected on THIS leg's own prepare: the chain `CLAUDE.md` > `.claude/CLAUDE.md` > `AGENTS.md` >
+            `.claude/AGENTS.md` (first hit wins; a present-but-EMPTY `CLAUDE.md` is still the selected one and shadows
+            `AGENTS.md`), each member spelled as the chain spells it, relative to the cwd.
+            🔴 TWO MEANINGS, never fold them: the key ABSENT = this leg makes NO statement about instruction files
+            (no loader wired — `PROJECT_MEMORY_ENABLED=false`, or the multi-user `REQUIRE_PRINCIPAL=true` form —, a
+            hand-less leg, a cwd that is not a local absolute directory, a delegated subagent leg, or a server older
+            than 7.111.0) — it does NOT mean "there is no instruction file". PRESENT with `selected: []` = the leg
+            walked the chain and selected nothing. Today at most one member is sent (first hit wins); read it as a list.
+            The segment reports what the model read at this leg's prepare, not the disk now (a resume leg reports the
+            session snapshot). Not on `GET /v1/diagnostics/wiring` (a per-leg fact; the static half never mints it).
         eventId: { type: string }
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
@@ -17422,7 +17503,7 @@ components:
         🔴 ONE RULE FOR EVERY "EFFECTIVE HALF ONLY" KEY (sdk 9.7.0, after a codex adversarial-review [high]):
         this schema's only consumer today is `GET /v1/diagnostics/wiring`'s `static` half, and every key marked
         "effective half only" (`leg`, `ask.effective`, `configFingerprint`, `tools`, `hooks`, `lsp`,
-        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`) is ALWAYS ABSENT on that
+        `modelGate`, `autoMode`, `writeProtection`, `readDeny`, `autoConsolidation`, `fileHistory`, `instructions`) is ALWAYS ABSENT on that
         wire ⇒ THEIR ABSENCE HERE CARRIES NO INFORMATION. The per-key absence readings ("absent = not armed",
         "absent = a third state", …) hold for the LIVE FRAME (`Event_wiring_manifest`) and must not be carried
         over to this response. For the facts behind those keys: a tenant reads
@@ -17603,6 +17684,13 @@ components:
             K-24 (server >= 7.104.0 / S-724) — does this leg capture file history (`on` / `disabled`, OPEN word). EFFECTIVE
             HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT; the deployment-level reading is `capabilities.fileHistoryCapture`.
             Full per-key contract: see Event_wiring_manifest.fileHistory.
+        instructions:
+          allOf: [{ $ref: '#/components/schemas/WiringManifestInstructions' }]
+          description: >
+            server >= 7.111.0 (S-961) — SELF-MINTED by the server, PER-LEG: the instruction file the loader selected on one leg's
+            own prepare. EFFECTIVE HALF ONLY ⇒ ALWAYS ABSENT ON THIS ENDPOINT (a deployment has no per-leg selection to report).
+            🔴 DO NOT read absence here as "no instruction file" — it carries no information on this wire. Full per-key
+            contract: see Event_wiring_manifest.instructions.
     WiringManifestWriteProtection:
       # sdk 9.7.0:与 `WiringManifestMcpEntry` / `WiringManifestLspSeam` 同一条裁定 —— 同一段形被 live 帧与
       # 静态诊断面两处引用,内联就是两份会各自漂的镜像,所以具名单源。
@@ -17650,6 +17738,23 @@ components:
           enum: [true]
           description: "core's ONLY present shape — the construct gate refuses an armed-but-unrunnable state, so this is a SHAPE, not a value."
 
+    WiringManifestInstructions:
+      # S-961(server 7.111.0):与 `WiringManifestReadDeny` / `WiringManifestAutoConsolidation` 同一条裁定 —— 同一段形被 live 帧与静态诊断面两处引用,
+      # 内联就是两份会各自漂的镜像,所以具名单源(`spec-field-drift-gate` 也按「导出的 interface 必有同名 schema」逼出它)。
+      type: object
+      additionalProperties: false
+      description: >
+        The `wiring_manifest.instructions` section (server >= 7.111.0 / S-961) — SELF-MINTED by the server, not a core
+        section: which project-instruction file the project-memory loader selected on this leg's own prepare.
+        `selected` members are a CLOSED four-word set — the server's instruction-file chain (`INSTRUCTION_FILE_CHAIN`,
+        registered in its self-minted wire table `wiringInstructionsSelected`); a fifth chain member would be a new SDK minor,
+        in this enum in the same batch. The present-iff / two-meanings reading is on `Event_wiring_manifest.instructions`.
+      required: [selected]
+      properties:
+        selected:
+          type: array
+          description: 'The selected chain member(s), spelled as the chain spells them (relative to the cwd); `[]` = the chain was walked, nothing was selected.'
+          items: { type: string, enum: ['CLAUDE.md', '.claude/CLAUDE.md', 'AGENTS.md', '.claude/AGENTS.md'] }
     WiringManifestHookEntry:
       # sdk 9.5.0:与 `WiringManifestMcpEntry` 同一条裁定 —— 同一份行形被 live 帧与静态诊断面两处引用,
       # 内联就是两份会各自漂的镜像,所以一开始就具名。
@@ -17963,6 +18068,14 @@ components:
         delivery: { type: string, description: 'Literal "applied" on today''s server.' }
         note: { type: string, description: 'The CC-verbatim queued copy ("Message queued for delivery to <name>…").' }
         marker: { type: string, description: 'Engine-minted delivery marker (present on both steer and resume 200s, server 1.214+).' }
+        messageId:
+          type: string
+          description: >
+            server >= 7.111.0 (S-966) — the STEER 200 only (absent on the `…/resume` 200 and on an older server): the id of
+            this acceptance in the server's user-input ledger (uuidv7) — the SAME value a later
+            `GET /v1/sessions/{id}` `userInputUndrained[].messageId` carries should the carrying server process die
+            before the run settles. The same ledger write that guards a run steer guards a subagent steer: when it
+            cannot be written the verb answers 503 `steering.ledger_unavailable` and the subagent got nothing.
 
     SubagentOutputResult:
       type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/sdk",
-  "version": "15.1.1",
+  "version": "15.3.0",
   "description": "Typed, zero-runtime-dependency SDK for the Sema agent fleet usage plane. The shared substrate for all doors (CC/Codex MCP façade + web). Server-side only — tokens never enter the browser.",
   "type": "module",
   "license": "BUSL-1.1",