@sema-agent/server 7.108.0 → 7.110.0

package/dist/hooks/hook-runner.js

@@ -648,12 +648,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
     }
     return results;
 }
-function basePayload(ctx) {
+function basePayload(ctx, permissionMode) {
     return {
         session_id: ctx.sessionId,
         transcript_path: "",
         cwd: ctx.cwd,
-        ...(ctx.permissionMode ? { permission_mode: ctx.permissionMode } : {}),
+        ...(permissionMode !== undefined ? { permission_mode: permissionMode } : {}),
     };
 }
 function ignoreMatchers(groups) {
@@ -732,7 +732,7 @@ export function createTaskHooks(config, ctx) {
                 if (!m)
                     continue;
                 const payload = {
-                    ...basePayload(ctx),
+                    ...basePayload(ctx, tctx.permissionMode),
                     hook_event_name: "PreToolUse",
                     tool_name: toolName,
                     tool_input: currentInput,
@@ -827,7 +827,7 @@ export function createTaskHooks(config, ctx) {
                 .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
                 .join("");
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, tctx.permissionMode),
                 hook_event_name: "PostToolUse",
                 tool_name: toolName,
                 tool_input: input,
@@ -876,7 +876,7 @@ export function createTaskHooks(config, ctx) {
         const postToolUseFailureHook = async (toolName, input, f, tctx) => {
             const contexts = [];
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, tctx.permissionMode),
                 hook_event_name: "PostToolUseFailure",
                 tool_name: toolName,
                 tool_input: input,
@@ -919,10 +919,10 @@ export function createTaskHooks(config, ctx) {
         hooks.postToolUseFailure = postToolUseFailureHook;
     }
     if (postBatch) {
-        const postToolBatchHook = async (calls) => {
+        const postToolBatchHook = async (calls, _meta, bctx) => {
             const contexts = [];
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, bctx?.permissionMode),
                 hook_event_name: "PostToolBatch",
                 tool_calls: calls.map((c) => ({
                     tool_name: c.toolName,
@@ -962,9 +962,9 @@ export function createTaskHooks(config, ctx) {
         hooks.postToolBatch = postToolBatchHook;
     }
     if (promptSubmit) {
-        const userPromptSubmitHook = async (prompt) => {
+        const userPromptSubmitHook = async (prompt, uctx) => {
             const contexts = [];
-            const payload = { ...basePayload(ctx), hook_event_name: "UserPromptSubmit", prompt: clip(prompt, MAX_TOOL_INPUT_CHARS) };
+            const payload = { ...basePayload(ctx, uctx?.permissionMode), hook_event_name: "UserPromptSubmit", prompt: clip(prompt, MAX_TOOL_INPUT_CHARS) };
             const singles = await runMatchingEntries("UserPromptSubmit", ignoreMatchers(promptSubmit), "", payload, ctx, onceFired, Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000);
             for (const { entry, run } of singles) {
                 if (run.code === 2) {
@@ -1003,7 +1003,7 @@ export function createTaskHooks(config, ctx) {
     }
     if (stopEntries) {
         const stopHook = async (sctx) => {
-            const payload = { ...basePayload(ctx), hook_event_name: "Stop", stop_hook_active: sctx.stopHookActive };
+            const payload = { ...basePayload(ctx, sctx.permissionMode), hook_event_name: "Stop", stop_hook_active: sctx.stopHookActive };
             let llmExtra;
             const wantsPrompt = stopEntries.some((g) => g.hooks.some((h) => h.type === "prompt"));
             if (wantsPrompt) {
@@ -1097,7 +1097,7 @@ export function createTaskHooks(config, ctx) {
         const stopFailureHook = async (fctx) => {
             const turnError = toAssistantTurnError(fctx.errorKind);
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "StopFailure",
                 error: turnError,
                 ...(fctx.error ? { error_details: clip(redactSecrets(fctx.error), MAX_HOOK_FEEDBACK_CHARS) } : {}),
@@ -1109,7 +1109,7 @@ export function createTaskHooks(config, ctx) {
     if (preCompactEntries) {
         const preCompactHook = async (pctx) => {
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "PreCompact",
                 trigger: pctx.trigger,
                 custom_instructions: pctx.customInstructions ?? null,
@@ -1143,7 +1143,7 @@ export function createTaskHooks(config, ctx) {
     if (postCompactEntries) {
         const postCompactHook = async (cctx) => {
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "PostCompact",
                 trigger: cctx.trigger,
                 compact_summary: clip(cctx.summary, MAX_TOOL_RESPONSE_CHARS),
@@ -1191,16 +1191,30 @@ export function composeHooks(deployment, task) {
                 if (!slot)
                     continue;
                 const r = await slot(toolName, current, ctx);
-                if (!r)
+                if (r === undefined || Object.is(r, null) || Object.is(r, false))
                     continue;
+                if (typeof r !== "object")
+                    return r;
                 if (r.additionalContext)
                     contexts.push(r.additionalContext);
-                if (r.action === "deny")
-                    return { ...r, ...buildHookContextField(contexts) };
-                if (r.action === "ask")
-                    asked = r;
-                if (r.action === "allow" && r.updatedInput !== undefined) {
-                    current = r.updatedInput;
+                const action = r.action;
+                const updatedInput = r.updatedInput;
+                switch (action) {
+                    case "deny":
+                        return { ...r, ...buildHookContextField(contexts) };
+                    case "ask":
+                        asked = r;
+                        break;
+                    case "allow":
+                    case undefined:
+                        if (updatedInput !== undefined)
+                            current = updatedInput;
+                        break;
+                    default: {
+                        const unread = action;
+                        void unread;
+                        return r;
+                    }
                 }
             }
             if (asked) {
@@ -1245,20 +1259,20 @@ export function composeHooks(deployment, task) {
         };
     }
     if (d.postToolBatch || t.postToolBatch) {
-        out.postToolBatch = async (calls) => {
-            const rd = d.postToolBatch ? await d.postToolBatch(calls) : undefined;
-            const rt = t.postToolBatch ? await t.postToolBatch(calls) : undefined;
+        out.postToolBatch = async (calls, meta, bctx) => {
+            const rd = d.postToolBatch ? await d.postToolBatch(calls, meta, bctx) : undefined;
+            const rt = t.postToolBatch ? await t.postToolBatch(calls, meta, bctx) : undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
             const additionalContext = buildHookContext(contexts);
             return additionalContext === undefined ? undefined : { additionalContext };
         };
     }
     if (d.userPromptSubmit || t.userPromptSubmit) {
-        out.userPromptSubmit = async (prompt) => {
-            const rd = d.userPromptSubmit ? await d.userPromptSubmit(prompt) : undefined;
+        out.userPromptSubmit = async (prompt, uctx) => {
+            const rd = d.userPromptSubmit ? await d.userPromptSubmit(prompt, uctx) : undefined;
             if (rd?.block)
                 return { ...rd, ...buildHookContextField(rd.additionalContext ? [rd.additionalContext] : []) };
-            const rt = t.userPromptSubmit ? await t.userPromptSubmit(prompt) : undefined;
+            const rt = t.userPromptSubmit ? await t.userPromptSubmit(prompt, uctx) : undefined;
             if (!rd && !rt)
                 return undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);

package/dist/http/admission.js

@@ -458,8 +458,14 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
-        if (body.excludeAllTools !== undefined && typeof body.excludeAllTools !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "excludeAllTools must be a boolean");
+        for (const key of ["excludeAllTools", "disableSkills"]) {
+            if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                sendError(res, 400, "request.field_invalid", `${key} must be a boolean`);
+                return null;
+            }
+        }
+        if (body.disableSkills === true && ((body.skills?.length ?? 0) > 0 || (body.agents ?? []).some((a) => (a.skills?.length ?? 0) > 0))) {
+            sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other");
             return null;
         }
         for (const key of ["excludeTools", "deferTools"]) {

package/dist/http/durable-run-leg.js

@@ -63,7 +63,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger);
     return { status: 202, body: { taskId, sessionId, status: "running" } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/resume-legs.js

@@ -622,11 +622,14 @@ export function createResumeLegs(ctx) {
                 unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId,
                     ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
-                    durable: (row) => void append("engine_notice", row).catch((err) => {
+                    durable: (row) => append("engine_notice", row).then(() => true, (err) => {
                         recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
                         deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
+                        return false;
                     }),
                 });
+                if (deps.userInputLedger && taskId)
+                    await deps.userInputLedger.announceUndrained({ sessionId, taskId });
                 const anchorOwner = principal ?? null;
                 const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
                 const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
@@ -964,6 +967,8 @@ export function createResumeLegs(ctx) {
         finally {
             unregisterEngineNotice?.();
             if (taskId) {
+                if (resumeStreamRef !== undefined)
+                    await deps.userInputLedger?.settleLeg(resumeStreamRef);
                 if (inflightRuns.get(taskId) === cancelCtrl)
                     inflightRuns.delete(taskId);
                 if (preemptableRuns.get(taskId) === preemptCtrl)

package/dist/http/route-ctx.d.ts

@@ -150,9 +150,9 @@ export interface CheckpointCtx {
     /**
      * 🔴 S-877 候裁 18(codex r3 F1)—— 这条会话的 run 是**无人值守腿**铸的(今天唯一的写者 = leader worker 的 durable 块,
      * `leader/wire.ts`),**服务端写、不来自请求体**(`body` 是提交体;本位是它的兄弟键,客户端够不着)。
-     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它按续跑 Runner 的同名座经 `createUnattendedLeg` / `withUnattendedLeg`
-     * 重挂整条腿(模式 = 旋钮、写面 roots、模式释放写保护时的写保护拒层)—— 拒层是活闭包、进不了 checkpoint,而 core 在 spec 不说
-     * 模式时取 checkpoint 记下的那一个(`seat ?? recorded`),不重挂 = 续跑落 bypass 而拒层缺席。写回口(`DriveResumeArgs.resumeCtx`)
+     * 续跑家族据此请 `resolveSpec` 带 `unattendedLeg: true`,由它经首跑同一只合并口 `withUnattendedLeg` 重挂整条腿(S-934 ①:`default` +
+     * 按类作答的 onAsk)—— onAsk 是活闭包、进不了 checkpoint,而 core 在 spec 不说模式时取 checkpoint 记下的那一个(`seat ?? recorded`),
+     * 不重挂 = 续跑落 checkpoint 记下的旧模式(7.106.0–7.108.0 的行记 `bypassPermissions`)而按类作答缺席。写回口(`DriveResumeArgs.resumeCtx`)
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;

package/dist/http/routes/capabilities.js

@@ -138,6 +138,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 taskAgents: deps.config.requirePrincipal !== true,
                 retainBackgroundProcesses: deps.config.requirePrincipal !== true,
                 interactiveTools: true,
+                disableSkills: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots",

package/dist/http/routes/runs.d.ts

@@ -6,7 +6,6 @@ import type { RouteCtx, PreparedTaskSubmission, RouteMatch, RouteIdsOf } from ".
  *  —— 导出的是**行为**而不是 schema 对象:schema 的推断类型会牵出 registry-core 内嵌的 zod 路径
  *  (TS2742,不可移植),而这道门要钉的本来就是行为。非 wire 面。 */
 export declare function projectDecisionActor(raw: unknown): ActorAssertionWire | undefined;
-/** 子代理 / 任务句柄 / HITL 应答段——`handle()` 里它在 SVC-5 workflow steer **之后**,故是独立的域入口。 */
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
  *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleRuns(req: IncomingMessage, res: ServerResponse, match: RouteMatch<RunsRouteId>, ctx: RouteCtx): Promise<void>;

package/dist/http/routes/runs.js

@@ -134,6 +134,18 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
+async function acceptLiveUserInput(deps, res, at) {
+    if (!deps.userInputLedger)
+        return undefined;
+    try {
+        return await deps.userInputLedger.accept({ input: "steer", messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+    }
+    catch (e) {
+        deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
+        sendError(res, 503, "steering.ledger_unavailable", "this steer was NOT delivered: the server could not record it in its user-input ledger (an acceptance receipt is only given once the acceptance is durable, so a crash before the run consumes it can be announced) — nothing reached the engine; retry later");
+        return "refused";
+    }
+}
 export async function handleRuns(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints } = ctx.registry;
@@ -468,12 +480,17 @@ export async function handleRuns(req, res, match, ctx) {
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const live = steerableRuns.get(taskId);
         if (live) {
+            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live });
+            if (acceptance === "refused")
+                return;
             try {
                 await live.steer(text, { trusted, ...(steerInputId !== undefined ? { inputId: steerInputId } : {}) });
                 sendJson(res, 200, { taskId, status: "running", delivery: "applied", messageId, ...(priority ? { priority } : {}) });
                 return;
             }
             catch (e) {
+                if (acceptance !== undefined)
+                    await deps.userInputLedger.withdraw(acceptance);
                 const code = e.code;
                 if (code === "steering.invalid_content") {
                     sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
@@ -776,10 +793,15 @@ export async function handleRuns(req, res, match, ctx) {
             });
             return;
         }
+        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream });
+        if (acceptance === "refused")
+            return;
         try {
             await liveStream.steer(text, { trusted, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) });
         }
         catch (e) {
+            if (acceptance !== undefined)
+                await deps.userInputLedger.withdraw(acceptance);
             const code = e.code;
             if (code === "steering.invalid_content") {
                 sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");

package/dist/http/routes/sessions.js

@@ -618,8 +618,18 @@ export async function handleSessions(req, res, match, ctx) {
             const tail = qi("tail");
             const before = qi("before");
             const blobCap = qi("blobCap");
+            let undrained;
+            if (deps.userInputLedger) {
+                try {
+                    undrained = await deps.userInputLedger.readSession(match.params.sessionId);
+                }
+                catch (e) {
+                    recordFailOpen("server.user-input-ledger.read-failed", `op=session-view ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+            const undrainedKey = undrained !== undefined ? { userInputUndrained: undrained } : {};
             if (tail === undefined && before === undefined && blobCap === undefined) {
-                sendJson(res, 200, audit);
+                sendJson(res, 200, { ...audit, ...undrainedKey });
                 return;
             }
             let messages = audit.messages;
@@ -631,7 +641,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             if (blobCap !== undefined && blobCap > 0)
                 messages = truncateMessageBlobs(messages, blobCap);
-            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}) });
+            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}), ...undrainedKey });
             return;
         }
     }

package/dist/http/routes/tasks.js

@@ -333,10 +333,12 @@ export async function handleTasks(req, res, match, ctx) {
                     },
                     ...(noticeLedger
                         ? {
-                            durable: (row) => void noticeLedger.append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`)),
+                            durable: (row) => noticeLedger.append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`), false)),
                         }
                         : {}),
                 });
+                if (deps.userInputLedger && durableTaskId && prepared.spec.sessionId)
+                    await deps.userInputLedger.announceUndrained({ sessionId: prepared.spec.sessionId, taskId: durableTaskId });
                 try {
                     const streamBody = async () => {
                         await withPrincipal(principal, async () => {
@@ -700,6 +702,8 @@ export async function handleTasks(req, res, match, ctx) {
                         clearInterval(durableHeartbeat);
                     if (durableTaskId && steerableRuns.get(durableTaskId) === liveStreamRef)
                         steerableRuns.delete(durableTaskId);
+                    if (liveStreamRef !== undefined)
+                        await deps.userInputLedger?.settleLeg(liveStreamRef);
                     if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
                         inflightRuns.delete(durableTaskId);
                         cancelledViaVerb.delete(durableTaskId);

package/dist/http/server.d.ts

@@ -105,8 +105,8 @@ export interface ServiceCoreDeps {
      *  ⚠️ 7.69.0(R-1)起 **resume 家族也递这一位** —— 四条 resume 腿收敛到 `resolveResumeSpec` 一只 resolver,
      *  通告口接一次、四腿同得(见 http/server.ts 的 `resolveResumeSpec` 顶注);此处旧注写作「resume 家族缺席」
      *  已过期,按新行为改。
-     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
-     *  装配器在**全部折叠之后**经 `createUnattendedLeg` / `withUnattendedLeg` 重挂那条腿(表 / 根取续跑 Runner 的同名座)。只由续跑腿
+     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1;S-934 ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
+     *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
      *  按服务端写的 ctx 位递,绝不从请求体读。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
@@ -217,6 +217,11 @@ export interface ServiceStoreDeps {
     /** SendUserFile 账本(多租户治理面):scope↔object 映射的读面 GET /v1/sendfile-links。present ⇔ 签发面
      *  已配 AND 有 store backend(main.ts 建;写点在两条 send lane 的 withLedgerRecording)。 */
     sendFileLedger?: import("../plugins/send-file-ledger.js").SendFileLedger;
+    /** S-928 用户输入受理账本(「200 applied」受理的影子;单写者 = `src/user-input-ledger.ts` 的活对象,boot 装配在 stage-07 并跑一次收敛)。
+     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿受理前写 `accepted`(写不进 ⇒ 503
+     *  `steering.ledger_unavailable`)、三条 run 腿开通告口那一拍铸 `crashed` 通告并在收场时 settle、`GET /v1/sessions/:id` 的
+     *  `userInputUndrained` 读面。缺席只出现在不接 backend 的 stub-harness 上(那时没有这一面,行为与修前逐字相同)。 */
+    userInputLedger?: import("../user-input-ledger.js").UserInputLedger;
     /** 2c session-sync (P1d) — the WHOLE durable backend, so the `/v1/sessions/:id/sync/*` routes can fan out across
      *  ALL four session subsystems (session entries + fileSnapshot blobs/manifests + sessionPolicy + resumeAnchor)
      *  in the §8 fail-closed atomic order.

package/dist/http/wire-types.d.ts

@@ -293,6 +293,14 @@ export interface TaskRequestBody {
      *  探测:本键在不在受理面由**键闭集**自己回答 —— 没接线的 server 版本对它 400 `request.body_shape`
      *  并逐字列名,所以**不加能力位**(一个键一条探测路,不长第二条)。 */
     excludeAllTools?: boolean;
+    /** S-946(cli L-920 请托;CC 2.1.280 `--disable-slash-commands`「Disable all skills」,cli280.js:240760 整张命令表置空):
+     *  **这一发一只技能都不装** —— 场景出厂技能(启动期烤入 + 中心下发)、调用方 `skills`、子代定义的 `agents[].skills`
+     *  一个都不进 `TaskSpec`。`true` ⇒ `TaskSpec.skills = []`(core 对空表:零 `<skills>` 块、`Skill` 工具不挂);
+     *  `false` / 缺席 = 技能照旧。值形门与 {@link excludeAllTools} **同一只**(非 boolean ⇒ 400 `request.field_invalid`);
+     *  与非空 `skills` 或任一非空 `agents[].skills` 同带 ⇒ 400 `request.field_conflict`(体内自相矛盾,拒在受理门)。
+     *  续跑重放逐字重放存量体 ⇒ 同一只写点同判(坏形 defensive:只认 literal `true`)。无租户门(收窄,不跨租户)。
+     *  探测位 `GET /v1/capabilities` 的 `disableSkills`(与本键同一个词)。 */
+    disableSkills?: boolean;
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/index.d.ts

@@ -28,4 +28,6 @@ export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type Sid
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
+export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
+export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -25,4 +25,5 @@ export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-l
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { RETIRED_ENVS } from "./config.js";
+export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 //# sourceMappingURL=index.js.map

package/dist/instruction-source-notice.d.ts

@@ -28,9 +28,9 @@
  * sessionId / phase)—— 与 `mcp.injection_dropped`「装配期铸、无 runId」同形,run 归属由投递腿承载(这条 run 的 SSE /
  * 这条 run 的账本)。向 core 要 ctx 加 runId 已登记为未闭环项。
  */
-import type { EngineNotice } from "@sema-agent/core";
-import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const INSTRUCTION_SOURCE_CHANGED: ServerNoticeCode;
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+/** 码常量型 = core 码册(#1240 入册:受众 user、铸者 `NOTICE_MINTER` = `"server"`)。 */
+export declare const INSTRUCTION_SOURCE_CHANGED: EngineNoticeCode;
 /** 基线读数。`recorded: false` = 这个会话还没有任何 run 记过基线(首 run ⇒ 只写不发);`source: null` = 记过,且那一次
  *  没有项目指令文件被选中。两态必须可判别:把「没记过」读成「记过没有」会让新会话首 run 发一帧 `null → CLAUDE.md`。 */
 export type InstructionSourceBaseline = {

package/dist/leader/diffup.d.ts

@@ -27,6 +27,59 @@ export declare function buildUploadScript(p: {
 }): string;
 /** The objective suffix that makes the upload the worker's last task step (no URL through the model). */
 export declare function uploadStepSuffix(workDir: string): string;
+/**
+ * S-949 —— the INCREMENTAL upload loop's lifetime protocol (single writer; the wire only runs its two verbs).
+ *
+ * While a worker env lives, a background loop re-runs the staged upload script every {@link UPLOAD_LOOP_PERIOD_SEC}
+ * seconds, so the worker's fixed diff key tracks its latest COMMITTED progress and salvage survives an env hard-crash
+ * (#16 tail: run 019eca71's "4 commits vaporized"). The loop must NOT outlive the env: the pre-S-949 form
+ * (`nohup sh -c 'while true; …' &`) relied on "the pod dies, the loop dies", which holds only where the env IS a
+ * pod — on an env whose shell is the host's (`RemoteHostExecutionEnv`, core `NodeExecutionEnv`) teardown does not
+ * reap detached processes (by contract), and the loop became a ppid-1 orphan (254 of them on one box, 2026-10-01).
+ *
+ * ONE mechanism for every lane, carried entirely by the env's ordinary `exec` (no lane branch, no process-group or
+ * `/proc` assumption, never a signal to a pid that might have been reused):
+ *  - **run token** `.leader-upload-loop.gen` — the generation allowed to run. `start` draws the next number from
+ *    the monotonic counter `.leader-upload-loop.seq` (never reset by `stop` — a counter that restarted at 1 after a
+ *    `stop` past its bound would hand a fresh loop the generation of a revoked loop still finishing its upload, and
+ *    that one would carry on), writes it here BEFORE forking and hands it to the loop; the loop runs only while this
+ *    file still names its generation. So a later `start` (a resumed leg re-staging the same workspace) supersedes an
+ *    earlier loop, `stop` (which removes the file) ends every loop, and a workspace deleted out from under it ends it
+ *    too — the token check IS the loop's only exit, there is no second mechanism;
+ *  - **one pid file per generation** `.leader-upload-loop.pid.<gen>` — written by `start` right after the fork (the
+ *    wire awaits `start`, so it is on disk before any `stop` can run) and removed by that loop as it exits. `stop`
+ *    waits until no generation is left, so a superseded loop whose upload was still in flight at the re-stage is
+ *    waited for too (codex r1 F2). It only PROBES a pid (`kill -0`): a loop that died abnormally does not hold it up;
+ *  - **bounded uploads** — the loop runs each upload with a PUT time bound ({@link UPLOAD_LOOP_UPLOAD_MAX_SEC},
+ *    `curl --max-time`), so a hung object store cannot pin a revoked loop alive (codex r1 F1: on a host env that was
+ *    an orphan stuck in curl). `stopWaitSec` must exceed that bound plus one tick (the builder refuses otherwise);
+ *  - **ordering** — the loop checks the token right before every upload and runs it in the foreground, so once
+ *    `stop` returns 0 no loop upload of any generation is running or can start: the teardown belt upload that follows
+ *    is the last write to the diff key. A `stop` past its bound (a hung `git format-patch`, or a pid file whose pid
+ *    now belongs to someone else) exits non-zero — the wire warns and still runs the belt (dropping the belt would
+ *    lose the uncommitted-work capture it exists for).
+ */
+/** Seconds between two loop runs of the upload script. Single writer: the wire passes THIS constant; tests inject a
+ *  short period through {@link buildUploadLoopScript}'s parameter. Deliberately not a deployment knob. */
+export declare const UPLOAD_LOOP_PERIOD_SEC = 90;
+/** Where the loop script is staged — next to the upload script, same `workDir` rule. */
+export declare function uploadLoopScriptPath(workDir: string): string;
+/** The two lifecycle verbs the wire runs through the env's ordinary exec (closed set — `run` is the loop's own,
+ *  internal entry point and is never issued from outside). */
+export type UploadLoopVerb = "start" | "stop";
+/** The shell line for one lifecycle verb. `stop` revokes the run token FIRST and independently of the script (a loop
+ *  whose script file went missing still sees its token gone and exits), then lets the script's `stop` wait for it. */
+export declare function uploadLoopCommand(workDir: string, verb: UploadLoopVerb): string;
+/** The staged loop script (see the protocol note above). The three bounds are interpolated into the shell ⇒
+ *  validated here, fail-closed: positive integers, and `stopWaitSec > uploadMaxSec + 1` (stop outlasts one bounded
+ *  upload plus the loop's one-second tick — otherwise "stop returned ⇒ no upload in flight" would be false by
+ *  construction). */
+export declare function buildUploadLoopScript(p: {
+    workDir: string;
+    periodSec: number;
+    uploadMaxSec?: number;
+    stopWaitSec?: number;
+}): string;
 /**
  * Fetch the worker-uploaded patch over a presigned GET (control plane; creds stay adapter-held). Returns the
  * same result shape as pullDiff so merge consumes either path. 🔴 The presigned URL is a short-lived bearer

package/dist/leader/diffup.js

@@ -8,9 +8,10 @@ export function buildUploadScript(p) {
         "#!/bin/sh",
         "# leader diff-out (design/68 F2(a)) — exports this worker's branch as a patch series. Do not edit.",
         "set -e",
+        'case "$1" in ""|*[!0-9]*) M="" ;; *) M="--max-time $1" ;; esac',
         `cd ${p.repoDir}`,
         `git format-patch --stdout ${p.baseSha}..HEAD > ${p.workDir}/.leader-out.patch`,
-        `curl -fsS -X PUT -T ${p.workDir}/.leader-out.patch '${putUrl}'`,
+        `curl -fsS $M -X PUT -T ${p.workDir}/.leader-out.patch '${putUrl}'`,
         `echo leader-diff-uploaded`,
         "",
     ].join("\n");
@@ -18,6 +19,99 @@ export function buildUploadScript(p) {
 export function uploadStepSuffix(workDir) {
     return `\n\nMANDATORY FINAL STEP: after your final commit, run exactly: sh ${workDir}/.leader-upload.sh — it exports your branch diff for integration. Do not modify, inspect, or skip it; if it fails, fix your git state (commit your work) and run it again.`;
 }
+export const UPLOAD_LOOP_PERIOD_SEC = 90;
+const UPLOAD_LOOP_UPLOAD_MAX_SEC = 25;
+const UPLOAD_LOOP_STOP_WAIT_SEC = 30;
+export function uploadLoopScriptPath(workDir) {
+    return `${workDir}/.leader-upload-loop.sh`;
+}
+const uploadLoopTokenPath = (workDir) => `${workDir}/.leader-upload-loop.gen`;
+export function uploadLoopCommand(workDir, verb) {
+    const script = uploadLoopScriptPath(workDir);
+    switch (verb) {
+        case "start":
+            return `sh ${script} start`;
+        case "stop":
+            return `rm -f ${uploadLoopTokenPath(workDir)}; sh ${script} stop`;
+    }
+}
+export function buildUploadLoopScript(p) {
+    const uploadMaxSec = p.uploadMaxSec ?? UPLOAD_LOOP_UPLOAD_MAX_SEC;
+    const stopWaitSec = p.stopWaitSec ?? UPLOAD_LOOP_STOP_WAIT_SEC;
+    for (const [name, n] of [["periodSec", p.periodSec], ["uploadMaxSec", uploadMaxSec], ["stopWaitSec", stopWaitSec]]) {
+        if (!Number.isInteger(n) || n < 1)
+            throw new Error(`buildUploadLoopScript: ${name} must be a positive integer, got ${JSON.stringify(n)}`);
+    }
+    if (stopWaitSec <= uploadMaxSec + 1) {
+        throw new Error(`buildUploadLoopScript: stopWaitSec (${stopWaitSec}) must exceed uploadMaxSec (${uploadMaxSec}) + 1 — stop has to outlast one bounded upload plus the loop's tick`);
+    }
+    const script = uploadLoopScriptPath(p.workDir);
+    return [
+        "#!/bin/sh",
+        "# leader incremental upload loop (S-949) — re-runs .leader-upload.sh while this env lives. Do not edit.",
+        "# start: launch ONE detached loop (an earlier loop here sees its generation superseded and exits); record its pid.",
+        "# stop:  revoke the run token, then wait until no loop of any generation is left (uploads in flight finish first).",
+        "# run:   the loop itself (internal) — runs only while the token file still names its generation.",
+        `G=${uploadLoopTokenPath(p.workDir)}`,
+        `Q=${p.workDir}/.leader-upload-loop.seq`,
+        `P=${p.workDir}/.leader-upload-loop.pid`,
+        "stop_all() {",
+        '  rm -f "$G"',
+        "  i=0",
+        "  while :; do",
+        "    live=",
+        '    for f in "$P".*; do',
+        '      [ -f "$f" ] || continue',
+        "      p=",
+        '      read -r p 2>/dev/null < "$f"',
+        '      if [ -n "$p" ] && kill -0 "$p" 2>/dev/null; then live="$live $p"; else rm -f "$f"; fi',
+        "    done",
+        '    [ -z "$live" ] && return 0',
+        `    if [ "$i" -ge ${stopWaitSec} ]; then`,
+        `      echo "leader upload loop(s) still running ${stopWaitSec}s after the run token was revoked (pid$live)" >&2`,
+        "      return 1",
+        "    fi",
+        "    sleep 1",
+        "    i=$((i + 1))",
+        "  done",
+        "}",
+        'case "$1" in',
+        "start)",
+        '  command -v nohup >/dev/null 2>&1 || { echo "nohup not found — upload loop not started" >&2; exit 1; }',
+        "  g=0",
+        '  [ -f "$Q" ] && read -r g < "$Q"',
+        "  case $g in ''|*[!0-9]*) g=0 ;; esac",
+        "  g=$((g + 1))",
+        '  echo "$g" > "$Q"',
+        '  echo "$g" > "$G"',
+        `  nohup sh ${script} run "$g" </dev/null >/dev/null 2>&1 &`,
+        '  echo "$!" > "$P.$g"',
+        "  ;;",
+        "run)",
+        "  n=0",
+        '  while read -r g 2>/dev/null < "$G" && [ "$g" = "$2" ]; do',
+        `    if [ "$n" -ge ${p.periodSec} ]; then`,
+        "      n=0",
+        `      sh ${p.workDir}/.leader-upload.sh ${uploadMaxSec} >/dev/null 2>&1 || true`,
+        "    else",
+        "      sleep 1",
+        "      n=$((n + 1))",
+        "    fi",
+        "  done",
+        '  rm -f "$P.$2"',
+        "  exit 0",
+        "  ;;",
+        "stop)",
+        "  stop_all",
+        "  ;;",
+        "*)",
+        '  echo "usage: sh $0 start|stop" >&2',
+        "  exit 2",
+        "  ;;",
+        "esac",
+        "",
+    ].join("\n");
+}
 export async function fetchUploadedDiff(getUrl, opts = {}) {
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_DIFF_BYTES;
     const f = opts.fetchImpl ?? fetch;

package/dist/leader/leader.d.ts

@@ -16,7 +16,6 @@ import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
 import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
-import { type UnattendedLeg } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -68,11 +67,6 @@ export interface ProvisionedWorker {
 export interface LeaderDeps {
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
-    /** S-877 候裁 15 / 18 —— 本车道有手的 run 并进的无人值守腿(模式 = 运维旋钮 `UNATTENDED_PERMISSION_MODE`、写面 roots、模式释放写保护时的
-     *  写保护拒层),由 `wire.ts` 经 `createUnattendedLeg` 铸一次递进来。本文件自己起的有手 run(模块门修复)与 `repair-wire.ts` 的单代理修复环按
-     *  `sub.spec` 起 run、不经 provisionWorker —— 两处都经 `withUnattendedLeg` 并进这一份。**必填**(缺席 = core「Absent = default」⇒ 无人可答的腿上
-     *  写与非只读命令被当场拒,codex F1 的病)。 */
-    unattendedLeg: UnattendedLeg;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */
     provisionWorker: (sub: SubtaskSpec) => Promise<ProvisionedWorker>;
     /** Ephemeral no-creds integration sandbox + the credentialed Coordinator push (merge(b) deps). */