@sema-agent/server 7.115.0 → 7.116.1

package/dist/config-center/apply-effective.js

@@ -481,7 +481,7 @@ function stageApprovalRequire(raw) {
         return {
             ok: false,
             detail: unmatchable.message,
-            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
+            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete protocol name / server segment the engine never mints / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
             names: unmatchable.names,
             kept: KEPT_WOULD_MATCH_NOTHING,
         };

package/dist/config.d.ts

@@ -293,11 +293,14 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *     名单比的是**整串工具名**,带括号那串不是任何活工具的名字 ⇒ 永不匹配。指引=按命令名走
  *     `runtime.commandPolicy`,整条 shell 进门走 `MANUAL_MODE_SHELL_GATE=always`。判别式见
  *     {@link findCcRuleFormNames}(它同时是 `allow` 腿的**唯一**判据,见下方例外说明)。
- *   - 退役名(`bash`/`Task`/`KillShell`…):core `RETIRED_TOOL_NAMES` 静态表,指引=现役名。
- *   - pre-prefix 短名(`figma__x`):v4 自动加前缀的折叠面已删,实挂名恒带 `mcp__`,指引=补全前缀。
- *   - 不完整 MCP 名(`mcp__`、`mcp__figma`):前缀对但缺段——MCP 实挂名恒是 `mcp__<server>__<tool>` 三段形,
- *     少一段同样永不匹配。旧判据「含 `__` 且 protocolOf 认不出」放过了这一族(前缀恰好认得出),从另一侧
- *     漏出去,失守方向与 `figma__x` 完全相同。
+ *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):S-1047(core 7.41.0 #1156)起判据是 core 导出的
+ *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
+ *     补全协议前缀。
+ *   - 够不着挂载工具的协议名:缺段(`mcp__`、`mcp__srv__`、`mcp____x`)与**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、
+ *     超长 / 归一后带连串下划线的服务器段;服务器段带通配的 `mcp__*` 单列判词 `wildcard_peer`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。
+ *     判官与句子是 `namespaced-rule-name.ts` 的那**一只**(判据 = core `mintNamespacePrefix` 的自铸对照;会话规则写口两腿与 SQL 店写口同调),
+ *     本文件零手写臂。修前(7.116.0 之前)这里只有缺段一臂外加一条只排 `*` 的特例(`coversAServer`),对端段带点号 / 超长的覆盖形在每个面都照收。
+ *     ⚠️ 两段覆盖形 `mcp__<server>`(服务器段是自铸形)够得着(S-1047 收掉的分叉,见下)。
  *   - **core 的文法编不出来的串**(名字里带反斜杠、单条 >512 字符、空串):判词取自 core 自己的
  *     `validatePermissionRules`,见 {@link uncompilableRuleGuidance}。[ref]①([ref])补齐 ——
  *     此前只有 `ask` 腿(经 `createPermissionRulePolicy` 的 throw)拒得出这一族,`deny` 静默 no-op。
@@ -313,12 +316,12 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  * `<ns>__<server>__*` / `<ns>__<server>__<glob>` 在**每一条**腿上都是**真判**,不再是
  * 「放行进 no-op」—— 而那正是 [ref] 病形(`APPROVAL_DENY=mcp__figma__*` 判 allow)的根。
  *
- * ⚠️ 仍然拒的那一格,理由**换了**(别再照旧引「approval.ts 还不认」):`<ns>__<peer>` **两段形**
- * (`mcp__figma`)core 全家解成 covering,本函数判它「缺段」拒。挡它的不再是消费腿的能力,而是
- * **一名两义**:同一个 `mcp__figma` 既可能是运维想写的「整台服务器」,也可能是他把三段名写漏了一段
- * (`mcp__figma__get_file` 少打一截),两者在 boot 期无 roster 可判——所以三条腿一律响亮拒,并在
- * 指引里直接给出**无歧义**的等价写法 `mcp__figma__*`(见下方 guidance)。放宽两段形是一次
- * behavior-facing 的放宽(三条腿同时变宽,且方向是「更少拒绝」),要走独立批的三问,不是本函数的补丁。
+ * 🔴 **S-1047(core 7.41.0 #1156)收掉的分叉:两段覆盖形 `<ns>__<server>`(`mcp__figma`)自 7.116.0 起受理**。core 全家把它解成
+ * covering(这台服务器的每一只工具,与 `mcp__figma__*` 同义),core 的判词 `judgeRuleToolName` 判它 `current`,本仓会话规则写口也一直
+ * 收它;而本函数此前以「一名两义」(运维也可能是把三段名写漏了一段)拒它,句子却说它「永远不生效」—— 对它不成立,且同一个名字在本仓两张表上
+ * 两种答案。收成一个答案:受理。代价(三问在 CHANGELOG 7.116.0):少了「三段名漏打一截」的那一次拦截 —— 想要一只工具就写全名;
+ * 拒放集合的变化逐条在 MIGRATION 7.116.0 节。服务器段带通配(`mcp__*`)仍拒(core 的匹配器对服务器段逐字比,一只都够不着;7.116.0 起它是
+ * 「对端段铸不出」的一例,不再单列)。
  */
 export interface UnmatchableToolName {
     name: string;
@@ -354,7 +357,7 @@ export interface UnmatchableToolNameJudgment {
  * (`formatUnmatchableToolNames`)是两只导出,句子里那半句(「这些表都是整串逐字比对」)只对名表成立 —— 规则编译器的
  * 三只桶(与 `APPROVAL_GRANT`)是按规则文法编、按 covering 匹配的,不是整串比对。
  *
- * 句子对两种消费者、三种态度都成立:每一条要么永远匹配不到活工具(退役名 / 无协议前缀的短名 / 缺段的 MCP 名 / 名表里的内容形),要么编不成
+ * 句子对两种消费者、三种态度都成立:每一条要么永远匹配不到活工具(退役名 / 无协议前缀的短名 / 缺段或对端段铸不出的协议名 / 名表里的内容形),要么编不成
  * 一条规则(core 文法的判词原样带出);名字按写的样子读,不做别名折叠、不补协议前缀。逐条的「为什么 / 怎么改」在 `→` 之后。
  */
 export declare function unmatchableToolNamesRefusal(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
@@ -364,7 +367,7 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
 /**
  * 7.115.0 —— 运维 allow 规则 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:
  * 返回句子 = 拒,`undefined` = 通过)。判据与请求腿的 `settings.permissions.allow` 是**同一只**:
- *  ① 名字形与 core 文法 —— {@link unmatchableToolNamesRefusal},消费者 `rule-policy`、behavior `allow`(退役名 / 无前缀短名 / 缺段 MCP 名 /
+ *  ① 名字形与 core 文法 —— {@link unmatchableToolNamesRefusal},消费者 `rule-policy`、behavior `allow`(退役名 / 无前缀短名 / 缺段或对端段铸不出的协议名 /
  *     反斜杠 / 超长 / 内容形与参数级的 allow;句子点名哪一条、为什么、怎么改);
  *  ② 整表试编一次 —— 编的就是治理折叠里那一只(`runtime-governance.ts` {@link compileApprovalGrantLayers}),于是 core 的整表帽这类
  *     只在编译时才抛的判据也在启动时响亮,而不是每个任务一次 500。

package/dist/config.js

@@ -3,7 +3,7 @@ import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -18,6 +18,7 @@ import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-post
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
@@ -1245,29 +1246,28 @@ function findUnmatchableToolNames(names, opts) {
                 continue;
             }
         }
-        const retired = RETIRED_TOOL_NAMES.get(name);
-        if (retired !== undefined) {
-            out.push({ name, guidance: retired });
+        const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
+        const verdict = judgeRuleToolName(subject, NO_DECLARED_TOOL_NAMES);
+        if (verdict.kind === "retired") {
+            out.push({ name, guidance: verdict.guidance });
             continue;
         }
         const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
-        const subject = opts.consumer === "tool-name-table" ? name : (() => { const parsed = parseRuleText(name, opts.behavior); return "rule" in parsed ? parsed.rule.tool : name; })();
         if (uncompilable !== undefined) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        const ns = protocolOf(subject);
-        if (ns === undefined) {
-            if (subject.includes("__"))
-                out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
+        if (verdict.kind === "unprefixed_namespace") {
+            out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
             continue;
         }
-        if (ns.parse(subject) === undefined) {
-            out.push({ name, guidance: `incomplete ${ns.id} name — the live form is ${ns.prefix}<server>__<tool>, or ${ns.prefix}<server>__* to cover every tool on that server` });
-        }
+        const unreachable = unreachableNamespacedRuleNameOf(subject);
+        if (unreachable !== undefined)
+            out.push({ name, guidance: describeUnreachableNamespacedRuleName(unreachable) });
     }
     return out;
 }
+const NO_DECLARED_TOOL_NAMES = new Set();
 export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)

package/dist/http/admission.d.ts

@@ -52,6 +52,12 @@ export declare const MAX_OUTPUT_SCHEMA_CHARS = 32768;
  * 🔴 **server 侧禁裁列表 / 禁截描述**:渲染归引擎(单一属主)。本函数只判「这一条技能的形能不能用」。
  */
 export declare function validateUserSkills(skills: unknown): string | null;
+/**
+ * core 7.41.0 #1303 —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
+ * (`allowedTools` / `disallowedTools`)、圈工具 = deny 规则(请求 `settings.permissions.deny` / 运维 `APPROVAL_DENY`)或子代定义的
+ * `agents[].allowTools`、圈写路径 = 会话规则 `allowDirs`(`PUT /v1/sessions/:id/policy`)。
+ */
+export declare const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 \u2014 a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 export declare function createAdmission(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];

package/dist/http/admission.js

@@ -5,13 +5,13 @@ import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
-import { selfOrchestrationDenial } from "../task-workflow.js";
-import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
+import * as facts from "../capability-facts.js";
 import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
-import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { describeUnreachableSkillToolListEntry, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, unreachableSkillToolListEntryOf, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
+import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
@@ -33,9 +33,19 @@ export function validateUserSkills(skills) {
             return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
         if (s["baseDir"] !== undefined && !isValidCwd(s["baseDir"]))
             return `skill.baseDir must be an absolute path string of at most ${MAX_CWD_CHARS} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`;
+        if (skillCarriesRetiredManifest(s))
+            return SKILL_MANIFEST_RETIRED;
+        for (const key of ["allowedTools", "disallowedTools"]) {
+            if (s[key] !== undefined && !skillToolListOk(s[key]))
+                return `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))`;
+        }
+        const unreachable = unreachableSkillToolListEntryOf(s);
+        if (unreachable !== undefined)
+            return describeUnreachableSkillToolListEntry(unreachable);
     }
     return null;
 }
+export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 function mentionableNames(config, catalog) {
@@ -361,10 +371,10 @@ export function createAdmission(ctx) {
             return null;
         }
         {
-            const denial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
+            const admission = facts.selfOrchestrationAdmission(deps);
             const wantsSelfOrchestration = body.selfOrchestration === true
                 || parseTaskSettings(body.settings).settings?.ultracode === true;
-            if (denial !== null && wantsSelfOrchestration) {
+            if (!admission.available && wantsSelfOrchestration) {
                 sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
                 return null;
             }
@@ -478,6 +488,13 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other");
             return null;
         }
+        {
+            const v = body.userInvokedSkills;
+            if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
+                sendError(res, 400, "request.field_invalid", "userInvokedSkills must be an array of non-empty skill-name strings (each one a skill this run carries)");
+                return null;
+            }
+        }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {

package/dist/http/principal-gate.d.ts

@@ -92,6 +92,9 @@ export declare function runOwnerReadable(principal: string | undefined, owner: s
  *  and two more hand-inlined copies sat in approvals-assistant — a future hardening of this judgment would have
  *  missed them. All call sites now consume THIS function; do not re-introduce a sibling. */
 export declare function explicitOperatorOk(principal: string | undefined, operatorPrincipals: readonly string[]): boolean;
+/** operator 面族在「名单为空」这一形上的**唯一**拒发口:事实 `operatorLane`(`capability-facts.ts`)为假 ⇒ 这一面对任何
+ *  身份都打不通 = 这台部署上不可用 ⇒ 501,不是鉴权拒(403 只留给「名单非空而你不在名单上」)。能力位读的是同一只事实。 */
+export declare function sendOperatorPrincipalsRequired(res: ServerResponse): void;
 /** May `principal` act as an OPERATOR on the F4 approval queue? Empty `operatorPrincipals` = legacy
  *  behavior (the shared service token IS the operator boundary → everyone authenticated is an operator).
  *  Otherwise only listed principals are operators. */

package/dist/http/principal-gate.js

@@ -95,6 +95,9 @@ export function runOwnerReadable(principal, owner, config) {
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
 }
+export function sendOperatorPrincipalsRequired(res) {
+    sendError(res, 501, "capability.operator_principals_required", "this endpoint is operator-only and OPERATOR_PRINCIPALS is empty, so no caller can be an operator on this deployment; configure OPERATOR_PRINCIPALS to enable it");
+}
 export function isOperator(principal, operatorPrincipals) {
     if (operatorPrincipals.length === 0)
         return true;

package/dist/http/resume-legs.js

@@ -66,6 +66,7 @@ const WORKER_SWAP_REDEEMABLE = {
     read_face_damaged: false,
     read_face_forged: false,
     write_face_damaged: false,
+    skill_grants_damaged: false,
     constraint_chain_missing: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {
@@ -121,13 +122,21 @@ export function checkpointErrorDisposition(e) {
 const CHECKPOINT_ERROR_FIELD_ROLE = {
     boundCallId: "binding",
     boundInputHash: "binding",
+    boundGrantDigest: "regrant",
     answer: "answer",
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     taskConfig: "config",
     inheritedGate: "config",
 };
-const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => CHECKPOINT_ERROR_FIELD_ROLE[f] === "outcome_cell"));
+const ROLE_MINTS_RESUME_OUTCOME_INVALID = {
+    binding: false,
+    answer: false,
+    outcome_cell: true,
+    regrant: true,
+    config: false,
+};
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => ROLE_MINTS_RESUME_OUTCOME_INVALID[CHECKPOINT_ERROR_FIELD_ROLE[f]]));
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }

package/dist/http/retired-skill-manifest.d.ts

@@ -0,0 +1,23 @@
+/**
+ * 技能上已退役的 `manifest` 键 —— 「一条技能还带它」的**唯一判据**(core 7.41.0 起 `SkillSpec.manifest` 退役,零别名)。
+ *
+ * 两个读者,同一句话:
+ *  · 提交口的顶层技能门(`admission.ts` 的 `validateUserSkills`):带它(任何值)⇒ 点名拒;
+ *  · 随包排空脚本(`scripts/drain-check-local.mjs` 的 `retired-skill-manifest` 判据,经脚本隔壁的编译产物 `dist/http/retired-skill-manifest.js` 取):
+ *    升级前停驻、持久化的提交体里仍带它的行,升级后续跑会被引擎按名拒(顶层 `skills[]`)或丢掉那只子代定义(`agents[].skills[]`),运维升级前要能数出来。
+ *
+ * 「带」= 键在场、值是什么都算(`null` / 空对象同样是「我带了 manifest」)—— 与引擎的退役键表读法同形(`RETIRED_TASK_SPEC_KEYS["skills[].manifest"]`:`at !== undefined`)。
+ * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
+ *
+ * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它,与 `checkpoint-ctx.js` 同一姿势)—— 往里加 import 要先想想脚本那一头。
+ */
+/** 一条技能(提交体 `skills[]` / `agents[].skills[]` 的元素)是否还带退役的 `manifest` 键。 */
+export declare function skillCarriesRetiredManifest(skill: unknown): boolean;
+/** 持久化体里哪一层带着它:顶层 `skills[]`,或某只子代定义的 `agents[].skills[]`。 */
+export type RetiredSkillManifestLayer = "skills" | "agents.skills";
+/**
+ * 一份提交体(持久化的 JSON)里有没有技能还带 `manifest`,有则说是哪一层(两层都有 ⇒ 取顶层,先说引擎会响亮拒的那一层);都没有 ⇒ `undefined`。
+ * 顶层不是数组 / 子代不是对象 / 子代的 `skills` 不是数组 ⇒ 该处不算(受理门从不放进这种形;盘上若有也不是「带 manifest」)。
+ */
+export declare function retiredSkillManifestLayerOf(body: unknown): RetiredSkillManifestLayer | undefined;
+//# sourceMappingURL=retired-skill-manifest.d.ts.map

package/dist/http/retired-skill-manifest.js

@@ -0,0 +1,22 @@
+export function skillCarriesRetiredManifest(skill) {
+    return skill !== null && typeof skill === "object" && !Array.isArray(skill) && Object.hasOwn(skill, "manifest");
+}
+const isArray = (v) => Array.isArray(v);
+export function retiredSkillManifestLayerOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    const { skills, agents } = body;
+    if (isArray(skills) && skills.some(skillCarriesRetiredManifest))
+        return "skills";
+    if (isArray(agents)) {
+        for (const agent of agents) {
+            if (agent === null || typeof agent !== "object" || Array.isArray(agent))
+                continue;
+            const own = agent.skills;
+            if (isArray(own) && own.some(skillCarriesRetiredManifest))
+                return "agents.skills";
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=retired-skill-manifest.js.map

package/dist/http/route-table.d.ts

@@ -84,8 +84,9 @@ export interface RouteRow {
      *  `test/route-shape-roster.test.ts` 层E 的能力位词干也取自这里 —— 域的身份是声明出来的,
      *  不是从函数名反推的。函数真名与它的一致性由 `route-order-freeze` 自检格钉住。 */
     readonly label: string;
-    /** **挂载条件**(只有真有条件的行才写):缺席 = 恒挂载。域头的合取式就是挂载条件 —— 阀门没开 ⇒
-     *  请求落到分派器尾的全局 404(**诚实缺席,不是 501**;判据全文在各域模块头注)。 */
+    /** **挂载条件**(只有真有条件的行才写):缺席 = 恒挂载。今天只剩 diagnostics 一行(它没有能力位,缺席形只出现在测试夹具)。
+     *  「这台部署上不可用」的面**不**用它:那些面恒挂载、域头按能力事实(`src/capability-facts.ts`)答 501,与能力位同一只函数
+     *  —— 未挂载落全局 404 会让「这台没有这一面」与「URL 写错了」同码,也违背契约「false ⇒ 501」。 */
     readonly enabled?: (deps: FlatServiceDeps) => boolean;
 }
 export declare const ROUTES: readonly RouteRow[];

package/dist/http/route-table.js

@@ -52,9 +52,9 @@ export const ROUTES = [
     row({ handler: handleRunMemoryCapture, decls: RUN_MEMORY_CAPTURE_ROUTES, position: "post-credential", label: "run-memory-capture" }),
     row({ handler: handleMcpReconnect, decls: MCP_RECONNECT_ROUTES, position: "post-credential", label: "mcp-reconnect" }),
     row({ handler: handleBackground, decls: BACKGROUND_ROUTES, position: "post-credential", label: "background" }),
-    row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader", enabled: (deps) => Boolean(deps.leaderEndpoint) }),
+    row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader" }),
     row({ handler: handleImages, decls: IMAGES_ROUTES, position: "post-credential", label: "images" }),
-    row({ handler: handleApprovalsAssistant, decls: APPROVALS_ASSISTANT_ROUTES, position: "post-credential", label: "approvals-assistant", enabled: (deps) => Boolean(deps.checkpointStore) }),
+    row({ handler: handleApprovalsAssistant, decls: APPROVALS_ASSISTANT_ROUTES, position: "post-credential", label: "approvals-assistant" }),
     row({ handler: handleObservability, decls: OBSERVABILITY_ROUTES, position: "post-credential", label: "observability" }),
     row({ handler: handleDiagnostics, decls: DIAGNOSTICS_ROUTES, position: "post-credential", label: "diagnostics", enabled: (deps) => Boolean(deps.staticWiring) }),
     row({ handler: handleAdoption, decls: ADOPTION_ROUTES, position: "post-credential", label: "adoption" }),
@@ -62,15 +62,15 @@ export const ROUTES = [
     row({ handler: handleAdminDrain, decls: ADMIN_DRAIN_ROUTES, position: "post-credential", label: "admin-drain" }),
     row({ handler: handleDevices, decls: DEVICES_ROUTES, position: "post-credential", label: "devices" }),
     row({ handler: handleAdminConfigRefresh, decls: ADMIN_CONFIG_REFRESH_ROUTES, position: "post-credential", label: "admin-config-refresh" }),
-    row({ handler: handleConfigCatalog, decls: CONFIG_CATALOG_ROUTES, position: "post-credential", label: "config-catalog", enabled: (deps) => deps.config.configCatalogEnabled === true }),
+    row({ handler: handleConfigCatalog, decls: CONFIG_CATALOG_ROUTES, position: "post-credential", label: "config-catalog" }),
     row({ handler: handleMemoryOptOut, decls: MEMORY_OPTOUT_ROUTES, position: "post-credential", label: "memory-opt-out" }),
     row({ handler: handleMemoryPolicy, decls: MEMORY_POLICY_ROUTES, position: "post-credential", label: "memory-policy" }),
     row({ handler: handleMemoryBundle, decls: MEMORY_BUNDLE_ROUTES, position: "post-credential", label: "memory-bundle" }),
     row({ handler: handleMemoryCompliance, decls: MEMORY_COMPLIANCE_ROUTES, position: "post-credential", label: "memory-compliance" }),
     row({ handler: handleMemoryOrigin, decls: MEMORY_ORIGIN_ROUTES, position: "post-credential", label: "memory-origin" }),
-    row({ handler: handleMemoryConsolidation, decls: MEMORY_CONSOLIDATION_ROUTES, position: "post-credential", label: "memory-consolidation", enabled: (deps) => Boolean(deps.memoryConsolidation) }),
+    row({ handler: handleMemoryConsolidation, decls: MEMORY_CONSOLIDATION_ROUTES, position: "post-credential", label: "memory-consolidation" }),
     row({ handler: handleRules, decls: RULES_ROUTES, position: "post-credential", label: "rules" }),
-    row({ handler: handleSharedMemory, decls: SHARED_MEMORY_ROUTES, position: "post-credential", label: "shared-memory", enabled: (deps) => Boolean(deps.sharedMemoryStore) && Boolean(deps.orgMemoryDirectory) }),
+    row({ handler: handleSharedMemory, decls: SHARED_MEMORY_ROUTES, position: "post-credential", label: "shared-memory" }),
     row({ handler: handleSessionsList, decls: SESSIONS_LIST_ROUTES, position: "post-credential", label: "sessions-list" }),
     row({ handler: handleAgentRoster, decls: AGENT_ROSTER_ROUTES, position: "post-credential", label: "agent-roster" }),
     row({ handler: handleSessions, decls: SESSIONS_ROUTES, position: "post-credential", label: "sessions" }),

package/dist/http/routes/a2a-serve.js

@@ -8,6 +8,7 @@ import { sendJson, sendError } from "../send.js";
 import { readinessOf, billableRefusalOf, sendBillableRefusal } from "../readiness.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { createDurableRun } from "./runs.js";
 export const A2A_PROTOCOL_VERSION = "1.0";
 export const A2A_VERSION_HEADER = "a2a-version";
@@ -25,13 +26,13 @@ export async function handleA2aServe(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "a2a-agent-card": {
-            const serve = deps.config.a2aServe;
-            if (!serve) {
+            const peer = facts.a2aServe(deps);
+            if (!peer.available) {
                 sendError(res, 404, "not_found.route", "not found");
                 return;
             }
             res.setHeader(A2A_VERSION_HEADER, A2A_PROTOCOL_VERSION);
-            sendJson(res, 200, buildAgentCard(serve));
+            sendJson(res, 200, buildAgentCard(peer.serve));
             return;
         }
         default:
@@ -44,10 +45,8 @@ const JSONRPC_METHOD_NOT_FOUND = -32601;
 const JSONRPC_INVALID_PARAMS = -32602;
 const JSONRPC_INTERNAL_ERROR = -32603;
 const A2A_TASK_NOT_FOUND = -32001;
-const A2A_UNSUPPORTED_OPERATION = -32004;
 const A2A_CONTENT_TYPE_NOT_SUPPORTED = -32005;
 export const A2A_TASK_NOT_FOUND_MESSAGE = "task not found";
-const A2A_NO_RUN_STORE_MESSAGE = "this deployment has no durable run store, so A2A tasks cannot be created or polled (set DB_BACKEND=mysql|pg|local)";
 const A2A_STATE_BY_RUN_STATUS = {
     running: "working",
     completed: "completed",
@@ -188,11 +187,8 @@ function readBlocking(params) {
 function isStaleRun(run, runStaleSec) {
     return run.status === "running" && Date.now() - new Date(run.updatedAt).getTime() > runStaleSec * 1000;
 }
-async function waitForRun(ctx, res, taskId, budgetMs) {
+async function waitForRun(ctx, store, res, taskId, budgetMs) {
     const { deps } = ctx;
-    const store = deps.runStore;
-    if (!store)
-        return null;
     const deadline = Date.now() + budgetMs;
     let last = null;
     for (;;) {
@@ -219,7 +215,7 @@ async function waitForRun(ctx, res, taskId, budgetMs) {
         });
     }
 }
-async function handleMessageSend({ req, res, ctx, params, serve }) {
+async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     const { deps } = ctx;
     const { rateLimited, quotaExceeded } = ctx.helpers;
     const message = asRecord(params.message, "params.message");
@@ -232,8 +228,6 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
     const skillId = skill?.id;
     const scenario = skill?.scenario;
     const blocking = readBlocking(params);
-    if (!deps.runStore)
-        throw new RpcError(A2A_UNSUPPORTED_OPERATION, A2A_NO_RUN_STORE_MESSAGE);
     const idemScope = `${ctx.req.source ?? ""}\x1f${gatedPrincipal(req, deps.config) ?? ""}`;
     const fingerprint = createHash("sha256")
         .update(messageId).update("\x1f")
@@ -248,7 +242,7 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const replay = await deps.runStore.getRun(body.taskId).catch(() => undefined);
+    const replay = await runStore.getRun(body.taskId).catch(() => undefined);
     if (replay && (replay.owner === null || replay.owner === gatedPrincipal(req, deps.config))) {
         return taskFromRun(replay, isStaleRun(replay, deps.config.runStaleSec));
     }
@@ -280,7 +274,7 @@ async function handleMessageSend({ req, res, ctx, params, serve }) {
     }
     const taskId = receiptBody.taskId;
     const sessionId = receiptBody.sessionId;
-    const run = await waitForRun(ctx, res, taskId, blocking ? serve.blockingWaitMs : 0);
+    const run = await waitForRun(ctx, runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
     if (run)
         return taskFromRun(run, isStaleRun(run, deps.config.runStaleSec));
     return {
@@ -298,12 +292,10 @@ function durableIdempotencyTaskId(scope, messageId) {
     const hex = b.toString("hex");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-async function handleTasksGet({ req, ctx, params }) {
+async function handleTasksGet({ req, ctx, params, runStore }) {
     const { deps } = ctx;
     const id = asNonEmptyString(params.id, "params.id", MAX_TASK_ID_CHARS);
-    if (!deps.runStore)
-        throw new RpcError(A2A_UNSUPPORTED_OPERATION, A2A_NO_RUN_STORE_MESSAGE);
-    const run = await deps.runStore.getRun(id);
+    const run = await runStore.getRun(id);
     if (!run)
         throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
     if (run.owner !== null && gatedPrincipal(req, deps.config) !== run.owner)
@@ -322,11 +314,12 @@ export async function handleA2a(req, res, match, ctx) {
         default:
             return assertNever(match.decl.id);
     }
-    const serve = deps.config.a2aServe;
-    if (!serve) {
+    const peer = facts.a2aServe(deps);
+    if (!peer.available) {
         sendError(res, 404, "not_found.route", "not found");
         return;
     }
+    const { serve, runStore } = peer;
     const requestedVersion = req.headers[A2A_VERSION_HEADER];
     res.setHeader(A2A_VERSION_HEADER, A2A_PROTOCOL_VERSION);
     if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
@@ -372,7 +365,7 @@ export async function handleA2a(req, res, match, ctx) {
     }
     deps.logger?.debug?.("a2a_serve_rpc", { method, ...(typeof requestedVersion === "string" ? { requestedVersion: requestedVersion.slice(0, 32) } : {}) });
     try {
-        const result = await handler({ req, res, ctx, params: params, serve });
+        const result = await handler({ req, res, ctx, params: params, serve, runStore });
         if (result === undefined) {
             deps.metrics?.inc("a2a_serve_rpc_total", { method, outcome: "refused" });
             return;

package/dist/http/routes/admin-config-refresh.js

@@ -1,8 +1,9 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 export const ADMIN_CONFIG_REFRESH_PATH = "/v1/admin/config/refresh";
-const OPERATOR_ONLY_MESSAGE = "config refresh is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
+const OPERATOR_ONLY_MESSAGE = "config refresh is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminConfigRefresh(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -12,6 +13,10 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;

package/dist/http/routes/admin-drain.js

@@ -1,9 +1,10 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
 export const MAX_DRAIN_REASON_CHARS = 256;
-const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
+const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminDrain(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -13,6 +14,10 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
+            if (!facts.operatorLane(deps).available) {
+                sendOperatorPrincipalsRequired(res);
+                return;
+            }
             if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;

package/dist/http/routes/admin-memory-optout.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { memoryOptOutPrincipalShapeProblem } from "../../plugins/memory-optout-grant-store-sql.js";
 export const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
 const PutBodySchema = z.object({ allow: z.boolean(), note: z.string().min(1).max(500).optional() }).strict();
@@ -15,16 +16,29 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
+    const fact = facts.memoryOptOutGrant(deps);
+    if (!fact.available && fact.why === "operator_principals_empty") {
+        sendOperatorPrincipalsRequired(res);
+        return;
+    }
     if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-        sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable these endpoints)");
+        sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }
     const operator = principal;
-    const store = deps.memoryOptOutGrant;
-    if (store === undefined) {
-        sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no companion store for forgetting — wire a SQL backend to administer opt-out grants");
-        return;
+    if (!fact.available) {
+        switch (fact.why) {
+            case "memory_optout_grant_absent":
+                sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no companion store for forgetting — wire a SQL backend to administer opt-out grants");
+                return;
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            default:
+                return assertNever(fact.why);
+        }
     }
+    const store = fact.store;
     if (target !== undefined && (target === null || memoryOptOutPrincipalShapeProblem(target) !== undefined)) {
         sendError(res, 400, "request.path_malformed", "invalid memory opt-out grant principal — the path segment must percent-decode to a non-empty principal of at most 190 chars with no leading/trailing whitespace or control characters (the deployment default row is addressed by PUT on the collection root, not by a path segment)");
         return;