@sema-agent/sdk 21.1.0 → 22.0.1

package/openapi.yaml

@@ -881,6 +881,7 @@ paths:
             schema:
               type: object
               required: [text]
+              additionalProperties: false
               properties:
                 text: { type: string, description: 'The steering direction (untrusted DATA; the server fences it).' }
                 priority:
@@ -1067,7 +1068,7 @@ paths:
             schema:
               type: object
               # text 形对多余键宽容(冻结契约,steer 同族);bare 形零键纪律由 400 执法(见下)。
-              additionalProperties: true
+              additionalProperties: false
               properties:
                 text:
                   type: string
@@ -1184,6 +1185,7 @@ paths:
             schema:
               type: object
               required: [content]
+              additionalProperties: false
               properties:
                 content: { type: string, description: 'The message for the subagent (untrusted DATA; the server fences it — same framing as the workflow-agent steer).' }
       responses:
@@ -5991,6 +5993,7 @@ paths:
             schema:
               type: object
               required: [content]
+              additionalProperties: false
               properties:
                 content: { type: string, minLength: 1 }
       responses:
@@ -7414,11 +7417,12 @@ components:
             `acceptEdits` (in-workspace writes do not ask) or `bypassPermissions` (422 `request.host_posture_refused` on hosted
             deployments) for the old no-ask posture. `auto` arms iff `permissionMode === "auto"` ∧ a classifier seat is mounted ∧
             `caps.autoMode !== false` (one polarity); when the requested mode does not take effect the stream gets `engine_notice`
-            `config.permission_mode_unavailable`. `bypassPermissions` RELEASES the ten releasable ask classes (server >= 7.115.0: the tenth is `unstated`, a server-tool call nobody stated)
+            `config.permission_mode_unavailable`. `bypassPermissions` RELEASES the releasable ask classes (nine on every face from server >= 7.127.0; ten on
+            server 7.115.0–7.126.x, where the extra one is `rule_unreadable`; `unstated`, a server-tool call nobody stated, is releasable from server >= 7.115.0)
             and DISCLOSES each (`tool_end.gate.disposition.released` + one `engine_notice` `permission.ask_released_by_mode` per (mode, class) per run);
             immune classes (deployment-authored, ask / org rules, hooks, ancestors, questions …) still ask; a write whose protection
             cannot be judged is refused (`deniedBy: mode`) on the file tools — and, from server >= 7.122.0 / core 7.47.0, RELEASED on the SHELL face
-            (an eleventh class, `write_protection_unresolved`, for a caller-supplied tool whose wire name is exactly `Bash` or `Monitor` and which
+            (the class the shell face adds, `target_unresolved` from server >= 7.126.0 — the previous spelling on 7.122.0–7.125.x — for a caller-supplied tool whose wire name is exactly `Bash` or `Monitor` and which
             declares a write-path target; see `ModeRelease.reason`). `plan` (server >= 7.122.0): the engine's plan mode and nothing the service adds —
             the tool table equals `default`'s, the engine mounts the plan-presenting tool, and a write or any non-read-only call is asked AT CALL TIME by the
             engine's plan gate (a card where somebody can answer, a refusal where nobody can; a delegated sub-agent inherits plan as its ceiling); up to
@@ -8008,6 +8012,75 @@ components:
           blocked: '#/components/schemas/TerminalCause_blocked'
           paused: '#/components/schemas/PausedCause'
 
+    ToolOutput:
+      description: >
+        The two shapes of a tool's model-facing body (`Event_tool_end.output`, the turns face `tool-result.output`, the trace stream
+        `tool-result.data.output` — one schema, three faces): a STRING (a string result; over the core text cap it is cut and ends with
+        `…[+N chars truncated]`) or an ARRAY of `ToolOutputBlock` (each block keeps its slot). Handle both. Only the core tool contract
+        is described — a third-party tool that returns content outside it (a body that is neither, a block outside the contract) is
+        the tool's breach, not a third wire shape.
+      oneOf:
+        - type: string
+        - type: array
+          items: { $ref: '#/components/schemas/ToolOutputBlock' }
+
+    ToolOutputBlock:
+      description: >
+        One block of an array-shaped `ToolOutput` (core 7.50.0 `tool_end` output note). Closed, four arms: text; an admitted image /
+        document with its base64 `data`; that same media block's DESCRIPTOR when it did not travel on this face (`{ type, mimeType?,
+        bytes, truncated: true }` — `bytes` = decoded size, a media type over 255 characters is not echoed); and the ONE `omitted`
+        summary core folds the rest of the media into when not even a descriptor fits. Media block vs descriptor share `type` —
+        tell them apart by `data`. Which face sees which (server >= 7.127.0): the LIVE face carries media whole (only a connection
+        backlog over 64 MiB degrades that frame's media to descriptors); the ledger and replay faces (`GET /v1/runs/:id/events`, the
+        turns face, the trace stream) always carry descriptors, with the frame-level `truncated: true`. Render a block with no
+        `data` and `truncated: true` as "not delivered" from its `mimeType` / `bytes`.
+      oneOf:
+        - $ref: '#/components/schemas/ToolOutputTextBlock'
+        - $ref: '#/components/schemas/ToolOutputMediaBlock'
+        - $ref: '#/components/schemas/ToolOutputMediaDescriptor'
+        - $ref: '#/components/schemas/ToolOutputOmittedBlock'
+
+    ToolOutputTextBlock:
+      type: object
+      description: 'The text arm of `ToolOutputBlock` (core `TextContent`).'
+      additionalProperties: false
+      required: [type, text]
+      properties:
+        type: { const: text }
+        text: { type: string }
+
+    ToolOutputMediaBlock:
+      type: object
+      description: 'The media arm of `ToolOutputBlock` (core `ImageContent` / `DocumentContent`) — on the LIVE face only; the ledger / replay faces carry `ToolOutputMediaDescriptor` instead.'
+      additionalProperties: false
+      required: [type, data, mimeType]
+      properties:
+        type: { type: string, enum: [image, document] }
+        data: { type: string, description: 'base64 bytes (not text-redacted: it is an encoding of bytes).' }
+        mimeType: { type: string }
+
+    ToolOutputMediaDescriptor:
+      type: object
+      description: 'The descriptor arm of `ToolOutputBlock`: the same media block did not travel on this face (core budget degrade / the server''s ledger face / a backlogged live connection).'
+      additionalProperties: false
+      required: [type, bytes, truncated]
+      properties:
+        type: { type: string, enum: [image, document] }
+        mimeType: { type: string, description: 'Echoed when it is at most 255 characters.' }
+        bytes: { type: integer, minimum: 0, description: 'Decoded byte size of the media that did not travel.' }
+        truncated: { const: true }
+
+    ToolOutputOmittedBlock:
+      type: object
+      description: 'The summary arm of `ToolOutputBlock` (core 7.50.0): when not even a descriptor fits, this media block and every later one fold into this ONE block.'
+      additionalProperties: false
+      required: [type, blocks, bytes, truncated]
+      properties:
+        type: { const: omitted }
+        blocks: { type: integer, minimum: 1 }
+        bytes: { type: integer, minimum: 0 }
+        truncated: { const: true }
+
     TerminalCause_completed:
       type: object
       additionalProperties: false
@@ -8015,6 +8088,24 @@ components:
       required: [kind]
       properties:
         kind: { const: completed }
+        detail:
+          allOf: [{ $ref: '#/components/schemas/TerminalCompletedDetail' }]
+          description: >
+            server >= 7.126.0 (core 7.49.0 `TerminalCompletedDetail`, forwarded verbatim): a machine-readable account BESIDE a completion, for the one
+            shape that completes yet may be short. PRESENT only when the final assistant message carried the provider's unknown stream-end word and
+            the run completed on that turn; every other completion leaves it absent.
+
+    TerminalCompletedDetail:
+      type: object
+      additionalProperties: false
+      description: >
+        The account a `completed` cause may carry (server >= 7.126.0; core 7.49.0 `dist/core/terminal-cause.d.ts`, key-for-key). `kind` is CLOSED with one
+        member: `finish_reason_unknown` — the final turn's provider ended it with a stream-end word the engine does not read; the turn was kept as
+        the model left it and the run announced it (`route.finish_reason_unknown`). Read it as "completed, but the last answer may be cut", never as a failure.
+      required: [kind, finishReasonUnknown]
+      properties:
+        kind: { const: finish_reason_unknown }
+        finishReasonUnknown: { type: string, description: 'The provider''s stream-end word in the provider echo shape (bytes outside it become `?`); not an engine word.' }
 
     TerminalCause_failed:
       type: object
@@ -9113,6 +9204,9 @@ components:
             properties:
               type: { type: string, description: 'thinking | content | tool-call | tool-result | (open)' }
               text: { type: string }
+              output:
+                allOf: [{ $ref: '#/components/schemas/ToolOutput' }]
+                description: 'tool-result — the model-facing body, the SAME two shapes as `Event_tool_end.output` (one block schema, three faces). This is a ledger face: a media block is always its descriptor here (server >= 7.127.0).'
               id: { type: string, description: tool-call — matches approvals toolCallId. }
               name: { type: string }
               input: { description: tool-call — redacted args. }
@@ -12703,6 +12797,12 @@ components:
                 (where only the `error` frame carried it). Equal to the SSE `event:` line verbatim — its reason
                 to exist is the proxy/relay case that strips the `event:` line and forwards only the data JSON,
                 where this is the only key left to dispatch on. Heartbeats (`data: {}`) carry none.
+            output:
+              allOf: [{ $ref: '#/components/schemas/ToolOutput' }]
+              description: >
+                `tool-result` frames only (no other known event carries this key; the data object stays open for the rest): the model-facing
+                body in the SAME two shapes as `Event_tool_end.output` and the turns face (one block schema, three faces). A ledger face — a
+                media block is always its descriptor here (server >= 7.127.0).
 
     PendingList:
       type: object
@@ -12713,15 +12813,55 @@ components:
       # 结构性不可见)。ADDITIVE / tolerate-absent:键缺席=「协调器未装配(本部署无 live 审批面)」或
       # 旧 server;空数组=「有面、此刻无待批」——两义可判别,消费端测 presence。**分数组不混编**:
       # live 行的决议口=POST /v1/tool-approvals/{approvalId}/respond,durable 行=decide 口;数组名即路由判据。
+      # 22.0.0:第三、四顶层键此前漏声明 —— 封闭 schema 上一个真键 = 合法信封被严格校验器拒收。
       additionalProperties: false
       required: [pending]
       properties:
         pending:
           type: array
           items: { $ref: '#/components/schemas/PendingCheckpoint' }
+        serverNowMs:
+          type: integer
+          description: >
+            server >= 7.57.0 (always present from that version): the server's clock at the moment THIS response was minted. Render a countdown as
+            `deadline − serverNowMs`, never against the local clock (a terminal with clock skew would show a card as alive that already expired).
+            Not repeated per row — one response has one "now".
         livePending:
           type: array
           items: { $ref: '#/components/schemas/LivePendingRow' }
+        crashConverged:
+          type: array
+          items: { $ref: '#/components/schemas/CrashConvergedRow' }
+          description: >
+            server >= 7.55.0: approval asks the previous process left pending, converged at boot to NOT DECIDABLE (audit rows, not queue rows — no
+            decide route, no run revival). Present iff the local-lane ask audit store is wired; `[]` = the face exists and nothing was converged;
+            absent = no such face on this deployment (or an older server).
+
+    CrashConvergedRow:
+      type: object
+      description: >
+        One `GET /v1/approvals` `crashConverged[]` row (server >= 7.55.0; server `src/approval-ask-audit-store.ts` `CrashConvergedRow`, key-for-key):
+        an ask whose carrying leg died, converged at boot so it can no longer be decided. Args / card body are NOT listed (same rule as
+        `livePending` rows). Open like the other response row projections (a strict consumer must not reject a row for a key added later).
+      additionalProperties: true
+      required: [approvalId, toolName, taskId, ts, expiresAtMs, decision, cause, orphanState, convergedAtMs, resumeSafe]
+      properties:
+        approvalId: { type: string }
+        toolName: { type: string }
+        taskId: { type: string }
+        sessionId: { type: string }
+        ts: { type: number, description: 'Mint time (ms epoch; named like `livePending[].ts`).' }
+        expiresAtMs: { type: number }
+        decision: { const: denied, description: 'Discriminating constant: the card can no longer be decided.' }
+        cause:
+          type: string
+          enum: [crashed_before_park, shutdown_before_park]
+          description: '`crashed_before_park` = the process crashed; `shutdown_before_park` (server >= 7.108.0) = an orderly shutdown cut the leg. The SAME word as the decide door''s 410 `gone.ask` body `cause`.'
+        orphanState: { type: string, enum: [pending, decided], description: '`pending` = the tool provably never ran; `decided` = a person had answered, a partial side effect is possible.' }
+        originalDecision: { const: approve, description: 'decided arm only: the person had approved.' }
+        decidedAtMs: { type: number }
+        convergedAtMs: { type: number }
+        resumeSafe: { type: boolean, description: 'pending arm = a re-run (the engine''s resume compensation leg) is safe and a shell may resume by default; decided arm = leave it to a person.' }
 
     LivePendingRow:
       type: object
@@ -14618,6 +14758,7 @@ components:
         - $ref: '#/components/schemas/Event_compacted'
         - $ref: '#/components/schemas/Event_suggestions'
         - $ref: '#/components/schemas/Event_status'
+        - $ref: '#/components/schemas/Event_task_started'
         - $ref: '#/components/schemas/Event_task_progress'
         - $ref: '#/components/schemas/Event_workspace_changed'
         - $ref: '#/components/schemas/Event_engine_notice'
@@ -14693,6 +14834,7 @@ components:
           compacted: '#/components/schemas/Event_compacted'
           suggestions: '#/components/schemas/Event_suggestions'
           status: '#/components/schemas/Event_status'
+          task_started: '#/components/schemas/Event_task_started'
           task_progress: '#/components/schemas/Event_task_progress'
           workspace_changed: '#/components/schemas/Event_workspace_changed'
           engine_notice: '#/components/schemas/Event_engine_notice'
@@ -15143,42 +15285,55 @@ components:
         `UNATTENDED_PERMISSION_MODE=dontAsk`).
     AskClass:
       type: string
-      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, transcript_write, org_rule, governance_unavailable, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, write_protection_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
+      enum: [content_question, hook, ancestor, dangerous_delete, unverifiable_delete, unverifiable_shell_text, transcript_write, org_rule, governance_unavailable, rule_unreadable, ask_rule, denial_limit_fallback, classifier_no_ruling, requires_user_interaction, operator_forced, shell_floor, target_unresolved, probe, write_protection, tool_marks_mcp, tool_marks_a2a, policy_rra, artifact_shared_read, mode, unstated, ordinary]
       description: >
-        core `ASK_CLASSES` (twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0 — 7.34.0 minted twenty; `shell_floor` joined in 7.39.0 #1260 and rides
+        core `ASK_CLASSES` (twenty-two words as of core 7.40.0, twenty-three as of core 7.41.0, twenty-four as of core 7.43.0, twenty-five as of core 7.45.0, twenty-six as of core 7.49.0 — 7.34.0 minted twenty; `unverifiable_shell_text` joined in 7.49.0 #1505 and rides server >= 7.126.0, where the
+        unresolved-write-target class was also RENAMED to `target_unresolved` (#955; zero alias — the previous spelling is in the SDK README's 22.0.0 migration table); `shell_floor` joined in 7.39.0 #1260 and rides
         server >= 7.113.0; `unstated` joined in 7.40.0 and rides server >= 7.115.0; `requires_user_interaction` joined in 7.41.0 and rides
         server >= 7.116.0; `classifier_no_ruling` joined in 7.43.0 #1353 and rides server >= 7.118.0; `dangerous_delete` joined in 7.45.0 and rides
         server >= 7.119.0) — which CLASS an ask falls in (the columns of the mode × class arbitration table).
         `dangerous_delete` = a DELETE OF A PROTECTED PLACE: an `rm` / `rmdir` whose target is the filesystem root, a top-level directory, the home
         directory, the task root / working directory / an added working directory or an ancestor of one (including `rm -rf *` at the task root and
-        `rm -rf ~/*`), or a shell handed a script that is only assembled at run time (`bash -c "$CMD"`, `eval "$(…)"`). ONLY A PERSON'S ANSWER clears
+        `rm -rf ~/*`); on server 7.119.0–7.125.x it also covered a shell handed a script that is only assembled at run time, which is
+        `unverifiable_shell_text` from server >= 7.126.0. ONLY A PERSON'S ANSWER clears
         it: no mode (`bypassPermissions` included), no allow (request `settings.permissions.allow`, operator `APPROVAL_GRANT`, a stored allow row, a
         skill's tool list, a hook's allow) and no `auto` classifier does; the frame carries `requiresRealApproval: true`, nobody answering means the
-        call does not run (the unattended leg refuses), and it is bypass-IMMUNE (not one of the ten releasable classes).
+        call does not run (the unattended leg refuses), and it is bypass-IMMUNE (not a releasable class).
+        `unverifiable_shell_text` (core 7.49.0 #1505, server >= 7.126.0) = the engine CANNOT READ the text this shell will execute — the shell is fed
+        text the command does not spell (a program's output, a substitution, a file's content, an argv a stream fills in: `bash -c "$CMD"`,
+        `eval "$(…)"`, `xargs sh -c …`; shell text that does not parse or is nested too deep lands here too). Its arbitration row is
+        `unverifiable_delete`'s save the classifier column: bypass-IMMUNE, no allow rule clears it, the `auto` classifier is not asked, `dontAsk`
+        refuses; only a person's answer clears it. The card carries no `mandate` word.
+        `target_unresolved` (core 7.49.0 #955, server >= 7.126.0; the previous spelling was used on 7.122.0–7.125.x) = WHERE A WRITE LANDS COULD NOT BE
+        DETERMINED (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path
+        (the write-protection table, the sensitive-path list) is unknown. Refused on the file tools; on the SHELL face `bypassPermissions` releases it and
+        names it in `ModeRelease.reason`. The same word is a `PersistedRuleMandate` member.
         `classifier_no_ruling` = the auto-mode classifier did not rule (it could not run — `error` / `timeout` — or replied with no verdict —
         `parse_error`), so a person decides: the denial-limit fallback's row (bypass-immune, no allow rule clears it, the classifier is not asked
         again); the live frame and the inbox row also carry the cause as `classifierNoRuling`.
         `requires_user_interaction` = the MCP server declared, in the tool's advertisement, `_meta["anthropic/requiresUserInteraction"] === true`
-        (only the boolean `true`): EVERY call of that tool asks the human, in EVERY mode including `bypassPermissions` (it is not one of the ten
-        RELEASABLE classes), and only the human's answer clears it — `settings.permissions.allow`, operator `APPROVAL_GRANT`, a skill's tool list +
+        (only the boolean `true`): EVERY call of that tool asks the human, in EVERY mode including `bypassPermissions` (it is not a
+        RELEASABLE class), and only the human's answer clears it — `settings.permissions.allow`, operator `APPROVAL_GRANT`, a skill's tool list +
         `userInvokedSkills` and a hook's explicit allow all fail to; with no approval seat the call is refused (the server sees nothing). The frame
         also carries `requiresRealApproval: true` / `mandated: true` (`origin: "safety_tighten"`). A client that renders cards by exhaustive `askClass`
         adds this one word.
         `unstated` = NOBODY STATED IT: in an ask-class mode (`default` / `acceptEdits` / `auto` / `plan`) a call to an MCP server tool or A2A skill
         (a seat that states no permission of its own) reached the end of the fold with no layer — rule / hook / approver / classifier / mode
         release — having said "this time is fine"; the engine raises a card with `askClass: "unstated"` (sentence `The agent requested permission to use <tool>,
-        but it has not been granted yet.`), and with no approval surface the call is refused. It is clearable (one of the ten RELEASABLE
-        classes: an allow rule — `settings.permissions.allow` / operator `APPROVAL_GRANT` — an explicit hook `permissionDecision: "allow"`, the auto-mode
+        but it has not been granted yet.`), and with no approval surface the call is refused. It is clearable (a RELEASABLE
+        class: an allow rule — `settings.permissions.allow` / operator `APPROVAL_GRANT` — an explicit hook `permissionDecision: "allow"`, the auto-mode
         classifier or `bypassPermissions` clears it); under `plan` only READ-ONLY server tools raise it.
         `shell_floor` = the operator's `shellGate: "always"` floor on a shell-running seat (the question the `operator_always` mandate
         word discloses), a class of its own so a set that holds another forced question still holds it; like `operator_forced` it is
         bypass-IMMUNE (not releasable).
-        CLOSED on the gate record (screened with core `isAskClass`). `bypassPermissions` releases only the ten RELEASABLE classes
-        (`transcript_write` / `rule_unreadable` / `probe` / `write_protection` / `tool_marks_mcp` / `tool_marks_a2a` /
-        `artifact_shared_read` / `mode` / `unstated` / `ordinary`) — on every face — plus, from server >= 7.122.0 / core 7.47.0, an eleventh on the SHELL
-        face only: `write_protection_unresolved` (core `releasableAskClassesFor(face)`: shell 11, other faces 10; on the file tools that class is
-        refused, `deniedBy: mode`); every other class (deployment-authored `operator_forced`, ask / org rules, hook,
-        ancestor, content question, …) asks under every mode.
+        CLOSED on the gate record (screened with core `isAskClass`). `bypassPermissions` releases only the RELEASABLE classes (core
+        `releasableAskClassesFor(face)`). Server >= 7.127.0 (core 7.50.0): nine on every face (`transcript_write` / `probe` / `write_protection` /
+        `tool_marks_mcp` / `tool_marks_a2a` / `artifact_shared_read` / `mode` / `unstated` / `ordinary`) plus a tenth on the SHELL face only,
+        `target_unresolved` (shell 10, other faces 9; on the file tools that class is refused, `deniedBy: mode`); `rule_unreadable` is no longer released
+        by any mode (bypass asks too, and the run gets one `permission.rule_store_unavailable` notice). Server 7.122.0–7.126.x (core 7.47.0–7.49.x) also
+        released `rule_unreadable` on every face: ten RELEASABLE classes plus an eleventh on the SHELL face (shell 11, other faces 10). Up to 7.121.x the
+        `RELEASABLE_ASK_CLASSES` constant (deleted in core 7.47.0) held ten, face-blind. Every other class (deployment-authored `operator_forced`, ask / org
+        rules, hook, ancestor, content question, `unverifiable_shell_text`, …) asks under every mode.
     ModeRelease:
       type: object
       additionalProperties: false
@@ -15194,24 +15349,26 @@ components:
         classes: { type: array, items: { $ref: '#/components/schemas/AskClass' } }
         origin:
           type: string
-          enum: [content_question, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
+          enum: [content_question, plan_review, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
           description: 'The origin word the card would have shown (core `ASK_ORIGINS`; screened closed on this face, same list as `GateOutcome.origin`).'
         mandate: { $ref: '#/components/schemas/PersistedRuleMandate' }
         reason:
           type: string
-          enum: [rule_unreadable, write_protection_unresolved]
+          enum: [target_unresolved]
           description: >
             WHAT the release went over — one word: the FIRST member (in core `MODE_RELEASE_REASONS` array order) that the ask's class
-            set holds; ABSENT when the set holds none. CLOSED set — the server screens it with core `isModeReleaseReason`, so a word
-            outside it withholds the whole `gate` from the frame (and a consumer that dispatches on the word must learn each new one).
-            `rule_unreadable` = the release went over a rule this call could not be read against (the rule store was unreadable — a
-            security-axis fail-open direction the server discloses on its own).
-            `write_protection_unresolved` (server >= 7.122.0 / core 7.47.0) = the release went over a write whose target the
-            write-protection judge could not RESOLVE (whether it lands on the protected table is unknown). It is released on the SHELL
+            set holds; ABSENT when the set holds none. CLOSED set of ONE word — the server screens it with core `isModeReleaseReason`, so a word
+            outside it withholds the whole `gate` from the frame.
+            `target_unresolved` = the release went over a write whose landing place could not be determined (a link on the way could not be examined,
+            or the environment could not resolve the target), so whether it lands on a guarded path is unknown. It is released on the SHELL
             face only: a caller-supplied tool whose wire name is exactly `Bash` or `Monitor` and which declares a write-path target,
             under `bypassPermissions`; on the file tools the same unresolved write is still refused (`deniedBy: mode`). The engine's
             own `Bash` / `Monitor` cannot mint this class and the server mounts no such tool — it comes from a caller-embedded tool of
-            those names. Before server 7.122.0 / core 7.47.0 the set was `rule_unreadable` alone.
+            those names.
+            History (this SDK's type and this enum hold the one word from 22.0.0; a word an older server sends reads as OUT OF SET and is not rewritten):
+            server 7.122.0–7.125.x (core 7.47.0–7.48.x) spelled this member differently (the SDK README's 22.0.0 migration table); server <= 7.126.x also
+            had `rule_unreadable` (the release went over a rule this call could not be read against) — core 7.50.0 / server >= 7.127.0 releases an
+            unreadable rule under no mode, so that member left (`rule_unreadable` stays an `AskClass`). Before server 7.122.0 the set was `rule_unreadable` alone.
 
     GateClassifierAttribution:
       # sdk 9.5.0:具名 —— 同一份形挂在 `GateDisposition` 的两只臂上,内联会立刻是两份会各自漂的镜像。
@@ -15296,7 +15453,7 @@ components:
             #   服务对缺陷记录是整条不上帧 ⇒ 词表外的值在这条 wire 上到不了消费端。审批帧那一面不判成员,
             #   所以 `AskOrigin` 本体保持真开(见该 schema 的长注)。这张 enum 是本 spec 里该词表的**唯一**
             #   执法点;core 加词时改这一处。
-            - enum: [content_question, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
+            - enum: [content_question, plan_review, ancestor_marked, org_unavailable, org_rule, rule_store_unavailable, hook, ask_rule, denial_limit_fallback, shell_gate_tighten, safety_tighten, policy]
           description: >
             WHO ASKED. Same-present/same-absent as `settlement` (I1). CLOSED here (and only here) — see the
             enum note above.
@@ -15389,10 +15546,13 @@ components:
     Event_tool_end:
       type: object
       description: >
-        design/99 §E1 (SHIPPED) — `output` is the model-facing action-card BODY: NON-UNIFORM (a string, or a
-        (TextContent|ImageContent)[] block array) and degrades to a single TRUNCATED string over the core size cap
-        (`truncated: true`). Absent ⇒ the tool produced no body. 🔴 UNTRUSTED RAW + observability-only: the service
-        has redactDeep'd + size-bounded it; a consumer MAY further bound, MUST never re-feed it to a model.
+        design/99 §E1 (SHIPPED) — `output` is the model-facing action-card BODY in TWO shapes (`ToolOutput`: a string, or a
+        `ToolOutputBlock` array — handle both). A string over the core text cap is cut and ends with the marker; in a block array
+        the text stream is cut in place and image / document blocks ride whole on the LIVE face (core 7.50.0 / server >= 7.127.0;
+        a connection backlog over 64 MiB degrades that frame's media to descriptors), while the ledger and replay faces always
+        carry descriptors. `truncated: true` ⇔ the body is not the tool's content as returned. Absent ⇒ the tool produced no body.
+        🔴 UNTRUSTED RAW + observability-only: the service has redacted the text + size-bounded it (media `data` is bytes and rides
+        verbatim); a consumer MAY further bound, MUST never re-feed it to a model.
       allOf:
         - { $ref: '#/components/schemas/EventIdentity' }
         # 🔴 现役写口与退役四词**互斥**(S-170 codex r2 [medium] 验真后补):退役四词只出现在 <=7.63.0 写下的
@@ -15429,9 +15589,9 @@ components:
             a retired name the roster still answers to). Present ONLY on a refused call (`gate.disposition.kind === "denied"`), and absent when the station that refused it did not know the roster name; per-tool refusal accounting reads this, not `toolName`.
         structured: {}   # core 1.203 CC 卡片明细;与 output 同一 UNTRUSTED RAW 待遇(已 redactDeep),形状开放
         isError: { type: boolean }
-        output: {}   # NON-UNIFORM: string | (TextContent|ImageContent)[] | (truncated) string. Absent ⇒ no body.
-        truncated: { type: boolean }
-        totalChars: { type: integer, description: 'core >=1.442 (RB-210): honest ORIGINAL size when truncated — sum of each block''s true size (text=chars, image/document=base64 bytes), no JSON-wrapping overhead. Absent on older cores / untruncated results.' }  # true ⇒ output was size-bounded to a truncated string.
+        output: { $ref: '#/components/schemas/ToolOutput' }   # 22.0.0: two shapes, one block schema shared with the trace faces
+        truncated: { type: boolean, description: 'true exactly when `output` is not the content the tool returned (text cut, a media block replaced by its descriptor or folded into the `omitted` summary — by core, or by the server on the ledger / replay faces and on a backlogged live connection).' }
+        totalChars: { type: integer, description: 'core >=1.442 (RB-210): honest ORIGINAL size when truncated — sum of each block''s true size (text=chars, image/document=base64 length, whether the block rode or was replaced by its descriptor), no JSON-wrapping overhead. PRESENT ⇒ `truncated`; the converse does not hold (core omits it when the content could not be read). When server >= 7.127.0 replaces media by descriptors (ledger / replay faces, a backlogged live connection) it sets `truncated` AND this key (core''s value kept as is, otherwise the per-block true sizes summed). Absent on older cores / untruncated results / unreadable content — never read it as 0.' }  # true ⇒ output was size-bounded to a truncated string.
         # 🔴 BREAKING (server >=7.64.0, core 7.6.0 S6-A): `settledBy` / `resolution` / `autoDenied` / `approver`
         # are RETIRED and replaced by the ONE `gate` record below. NO 7.64.0+ writer mints them, and the TS type
         # does NOT carry them — nobody should code against a dead vocabulary.
@@ -15650,6 +15810,46 @@ components:
         errClass: { type: string, description: "connect_refused | transport | rate_limit | server | http | output_cap — retry-wait frames ONLY; never inferred from phase" }
         providerCondition: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454, passed through verbatim): what the provider said about the account / capacity — core's closed `PROVIDER_CONDITIONS`; a retry frame carries only the three retryable words `throttled | overloaded | unknown` (`quota_exhausted` / `stop_other` do not retry and ride the terminal `detail.providerCondition`). Presence law as `errorStatus`; read as an OPEN set (keep a default arm). ABSENT = not judged, read the same as `unknown` (back off, do not assert quota). Moves with `providerConditionSource`." }
         providerConditionSource: { type: string, description: "server >= 7.126.0 (core 7.49.0 #1454): the evidence the `providerCondition` verdict rests on — `unified_header | provider_code | status`; present exactly when `providerCondition` is; read as an OPEN set." }
+        retryAtMs: { type: number, description: "server >= 7.52.0 (core 7.0.0): the WALL-CLOCK end of the wait = `Date.now() + retryInMs` at emit, on the emitting process's clock (not monotonic — never compare it with a local monotonic timer). `retryInMs` stays the authoritative RELATIVE amount; this is the producer's absolute note (a reader several hops away recomputing it would reset the countdown on every replay). Moves with `retryInMs`; absent ⇒ not minted." }
+        errorStatus: { type: integer, description: "server >= 7.54.0 (core 7.1.0): the HTTP status of the attempt that just failed, present ONLY when that status names the failure (absent on a transport non-answer, a mid-stream tear, a local circuit-open verdict and the `recovered` / `gave_up` frames). Absent = no status named the failure — not 0; a 2xx never appears." }
+        elapsedMs: { type: number, description: "server >= 7.58.0 (core 7.3.1): ONLY on the `waiting_first_token` phase — how long the current segment has waited so far (at emit, emitting process's clock). Absent = unknown, not 0. A waiting frame never carries `retryInMs` / `retryAtMs` (it OBSERVES a wait, it does not ANNOUNCE one) — do not merge the two families into one countdown." }
+        timeoutMs: { type: number, description: "server >= 7.58.0 (core 7.3.1): present with `elapsedMs` on the same phase — the bound of the segment being waited on (core 7.33.0+: the first-byte window before the response head, the first-token watchdog after it; each segment counts from 0)." }
+        eventId: { type: string }
+        parentToolCallId: { type: string }
+        sourceTaskId: { type: string }
+        bgAgentId: { type: string }
+    Event_task_started:
+      type: object
+      description: >
+        server >= 7.127.0 (core 7.50.0 `task_started`; server projection `taskStartedEventData`, an explicit per-key whitelist) — a
+        delegated child STARTED: one frame per cycle (first spawn / revival; a durable continuation leg mints none), after the child's
+        `wiring_manifest` and before its first `task_progress` and first model request, so a consumer opens the child row at start.
+        Every member is a value `task_progress` already carries with the same meaning. 🔴 LIVE AND LEDGERED, like `task_progress`: it rides
+        the same door (sync stream main leg, forward lane, the child tail stream) AND is persisted, so the async lane's ledger tail and the
+        `GET /v1/runs/:id/events` replay carry it (before the child's first `task_progress`). Core's "never persisted, never replayed on
+        resume" binds the ENGINE (session tree, checkpoints, resume replay); the server ledgers it because `agentType` / `rootSessionId` /
+        `parentSessionId` / `startedAt` ride only this frame. `name` / `workflowAgentLabel` are UNTRUSTED display text, redacted by the server; `spawnName`
+        is a validated identity key, verbatim. Absent optional keys stay absent (`taskType` absent = a foreground child; `seq`
+        absent = no `a*` row, never cycle 1). Servers <= 7.126.x never send it.
+      allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
+      additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注(builder=taskStartedEventData)
+      required: [type, taskId, sessionId, model]
+      properties:
+        type: { const: task_started }
+        taskId: { type: string, description: 'The child RUN id (`spec.taskId ?? sessionId`) — the key its `task_progress` frames carry.' }
+        sessionId: { type: string, description: 'The child run''s session id.' }
+        taskType: { type: string, description: 'As `task_progress.taskType`: absent for a foreground (synchronous) child. Open on read.' }
+        seq: { type: integer, description: 'As `task_progress.seq`: the registry row''s cycle generation; absent when there is no `a*` row.' }
+        workflowRunId: { type: string }
+        workflowAgentLabel: { type: string, description: 'UNTRUSTED display text (redacted).' }
+        parentTaskId: { type: string }
+        parentSessionId: { type: string }
+        rootSessionId: { type: string }
+        name: { type: string, description: 'The child''s display label (the same value as `task_progress.name`) — UNTRUSTED, redacted.' }
+        spawnName: { type: string, description: 'The explicit `Agent({name})` spawn identity, verbatim; present when the spawn carried one.' }
+        agentType: { type: string, description: 'The resolved subagent type (absent on a workflow-lane agent).' }
+        model: { type: string, description: 'The model the child leg was PREPARED with.' }
+        startedAt: { type: number, description: 'Epoch ms at the mint (sent only when finite).' }
         eventId: { type: string }
         parentToolCallId: { type: string }
         sourceTaskId: { type: string }
@@ -15730,7 +15930,9 @@ components:
         `message_committed` + stream order). Live emissions PRECEDE the commit and omit `entryId`.
         SERVICE PROJECTION: core's `principal` is deliberately NOT forwarded (the stream is already owner-scoped —
         the frame does not restate the tenant). `issuer` / `actor.id` / `actor.issuer` are host-derived identity
-        strings and arrive SECRET-REDACTED.
+        strings and arrive SECRET-REDACTED. Server >= 7.127.0 does NOT project core 7.50.0's `attachments` member (always absent here)
+        and does not accept the engine's request-layer `userAttachments` key: a submit / resume body carrying it is 400
+        `request.body_shape` (named in `unknownKeys`).
       allOf: [{ $ref: '#/components/schemas/EventIdentity' }]
       additionalProperties: false   # 封闭 + identity 本地镜像:见 Event_reasoning 处的长注
       required: [type, inputId]
@@ -17458,7 +17660,7 @@ components:
       #   当天,一个**合法**的审批卡就会被严格消费端拒收。`x-open-enum` 只是意图标记,不解除 enum 的执法 ——
       #   这正是本车刚从 `CheckpointGate` 拆掉的那个假开集,不在这里换个地方重犯。
       #   闭集**执法**只属于**筛过的**那一面(`GateOutcome.origin`:引擎的 `screenGateOutcome` 判成员,
-      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十一词见下面的描述。
+      #   出集即整条不上帧),所以那张 enum 落在**那个引用点**,恰一处。已知十二词(core 7.49.0 +plan_review)见下面的描述。
       description: >
         WHO raised an ask (`ToolApprovalFrame.origin`; server >= 7.57.0 / core 7.5.0, S-125③/#564) — core's
         `ASK_ORIGINS`, ENGINE-STAMPED at the gate (core's words: "engine-stamped at the gate, never a policy's
@@ -17485,13 +17687,19 @@ components:
         fails closed to a person. It is the personal-store sibling of `org_unavailable` (a governance source that
         cannot be read means ASK, never a silent allow).
 
+        🔴 core 7.49.0 ADDS A TWELFTH WORD (server >= 7.126.0), second in authority order: `plan_review` = a durable PLAN pause — the
+        model's own request (the first-party plan tool) stopped the run for a human verdict on a plan. Same family as
+        `content_question` (a content-routing ask, never a permission question: no permission decider, classifier or mode answers it
+        and it never reaches an approver as an `AskRequest`); only the plan pause's decide lane stamps it, so the decided row's record
+        names the ask it settled.
+
         The SAME type is the `origin` member of `GateOutcome` on `tool_end` — one vocabulary, two faces.
 
         server >= 7.102.0 (S-755 / cli L-695 / C-R111): the word now also rides the `livePending` row top level
         (read once with the frame's) and the operator queue row (`GET /v1/approvals` `pending[]` + the `/stream`
         `pending` frame — the park-row twin seat, screened by core's `isAskOrigin`), besides the frame and the inbox
         row — five faces, one word. `card_json` / the `approval_request` frame still do not carry it (the card is
-        `.strict()`). The eleven known words are exported at runtime as the SDK's `ASK_ORIGINS` (core 7.32.1
+        `.strict()`). The known words (twelve from core 7.49.0) are exported at runtime as the SDK's `ASK_ORIGINS` (core 7.32.1
         `ASK_ORIGINS`, verbatim and in order) — known words, NOT an enforcement table.
 
     AllowRuleMember:
@@ -17544,11 +17752,12 @@ components:
 
     PersistedRuleMandate:
       type: string
-      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, write_protection_unresolved]
+      enum: [operator_always, tool_marks, probe_mandate, probe_unanswered, write_protection, target_unresolved]
       description: >
         WHICH WORD a mandated ask stands on (server >= 7.102.0 / S-721 / core 7.32.0 #1092) — core's
         `PERSISTED_RULE_MANDATES` six words, transcribed verbatim and in order (core 7.32.1
-        `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core). Rides FOUR faces with one value: the
+        `dist/core/ask-origin.d.ts:349`; the vocabulary's owner is core; the sixth word is `target_unresolved` from core 7.49.0 #955 / server >= 7.126.0 —
+        server 7.122.0–7.125.x sent the previous spelling, which reads as out of set here, see the SDK README's 22.0.0 migration table). Rides FOUR faces with one value: the
         `tool_approval` frame, the `livePending` row top level, the operator queue row (`GET /v1/approvals`
         `pending[]` + the `/v1/approvals/stream` `pending` frame) and the inbox row. NOT on `card_json` / the
         `approval_request` frame (live or reconnect replay — `ApprovalCardSchema` is `.strict()`), same as `mandated`.
@@ -17613,12 +17822,17 @@ components:
         rules (`//abs`, `~/`, root-relative, cwd-relative; `*` within a segment, `**` across segments). `name` /
         `name_prefix` (server >= 7.118.0 / core 7.43.0 #1318) = the `Skill` name grammar: `Skill(<name>)` exact,
         `Skill(<prefix>:*)` a name prefix with NO word boundary; a skill card's "don't ask again" offer carries
-        `match: "name"`. A replica rolled back to 7.117.x reads a `name` / `name_prefix` row as a damaged row.
+        `match: "name"`. A replica rolled back to 7.117.x reads a `name` / `name_prefix` row as a damaged row. `host` /
+        `subdomain` (server >= 7.126.0 / core 7.49.0 #1365) = the `WebFetch` domain grammar: `WebFetch(domain:<host>)` one exact
+        host, `WebFetch(domain:*.<domain>)` every host under that domain — ALLOW rows only; the server's `Bash` card edit face
+        always refuses these two words (no network grant is minted through a card). A replica rolled back to 7.125.x reads such a
+        row as a damaged row.
 
-        🔴 SEVEN MEMBERS, closed: the server validates the member on both faces. A consumer type narrower than the
+        🔴 NINE MEMBERS, closed: the server validates the member on both faces. A consumer type narrower than the
         mint point is a lie — it lets a `switch` claim exhaustiveness the wire does not honour (SDK <= 16 declared
-        four here, so a `path` offer and every 7.118.0 skill-card offer were dropped as malformed).
-      enum: [exact, prefix, wildcard, subpath, path, name, name_prefix]
+        four here, so a `path` offer and every 7.118.0 skill-card offer were dropped as malformed; SDK <= 21 declared
+        seven, so every domain grant row on `GET /v1/rules` was dropped the same way).
+      enum: [exact, prefix, wildcard, subpath, path, name, name_prefix, host, subdomain]
 
     RuleOfferUncoveredReason:
       type: string
@@ -18753,6 +18967,16 @@ components:
             core-stream `eventId`, so this is its own time coordinate. 🔴 It MUST be declared here: this schema
             is `additionalProperties: false`, so omitting a key the server really sends makes a strict validator
             reject a legitimate frame. Absent on servers < 7.3.0.
+        expiresInMs:
+          type: integer
+          description: >
+            server >= 7.39.0, OPEN frame only: the coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5 minutes) — at expiry the ask is
+            released as nobody reachable (`unanswered`) and the engine decides park vs continue. Minted from the SAME ttl the release timer arms
+            (one source, so a countdown rendered from it never disagrees with the release). Relative; with `expiresAtMs` and `serverNowMs` it is a
+            clock-skew-proof trio.
+        expiresAtMs:
+          type: integer
+          description: 'server >= 7.39.0, OPEN frame only: `serverNowMs + expiresInMs` — the absolute deadline on the server''s clock.'
     Event_question_complete:
       type: object
       description: >
@@ -19731,7 +19955,9 @@ components:
         A leg's LSP code-intelligence seam (core 7.18.0 #789). 🔴 THE TWO BITS ARE INDEPENDENT AND MUST NOT BE
         READ AS ONE: `mounted` is the ROSTER fact (a wired manager whose `LSP` tool was excluded reports
         `false`), while `lane` arms on the manager / the hands / the opt-out and NOT on the mount — so
-        `{mounted: false, lane: "diagnostics"}` is a REAL, REACHABLE state, not bad data.
+        `{mounted: false, lane: "diagnostics"}` is a REAL, REACHABLE state, not bad data. LANE REACH (server >= 7.127.0 / core 7.50.0):
+        LSP mounts only on a lane that binds reads to the object it judged — today the host lane; on e2b / k8s (and ssh / adb / device /
+        local-docker / in-process) this section is always absent and the roster has no LSP tool (the server logs `lsp_not_mounted` at boot).
       additionalProperties: false
       required: [mounted]
       properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/sdk",
-  "version": "21.1.0",
+  "version": "22.0.1",
   "description": "Typed, zero-runtime-dependency SDK for the Sema agent fleet usage plane. The shared substrate for all doors (CC/Codex MCP façade + web). Server-side only — tokens never enter the browser.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -52,6 +52,6 @@
     "prepublishOnly": "rm -f tsconfig.tsbuildinfo && npm run build && npm run typecheck --workspaces=false --prefix ../.. && npm test --workspaces=false --prefix ../.. && npm run prepack"
   },
   "devDependencies": {
-    "@sema-agent/settings-schema": "^11.2.0"
+    "@sema-agent/settings-schema": "^12.2.1"
   }
 }