@sema-agent/server 7.129.1 → 7.131.0

package/dist/task-settings.js

@@ -193,18 +193,26 @@ export function taskSettingsKeyIssue(raw) {
 export function taskHooksHonored(config) {
     return config.requirePrincipal !== true;
 }
-export function parseTaskSettings(raw) {
+export function parseTaskSettings(raw, seats = {}) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
     const s = raw;
     const deferred = [];
     let hooksConfig;
+    let hooksReread;
     if (s.hooks !== undefined && s.hooks !== null) {
         const parsedHooks = parseHooksConfig(s.hooks);
         if (parsedHooks.config)
             hooksConfig = parsedHooks.config;
-        else
-            deferred.push("hooks");
+        else {
+            const reread = seats.storedHooksReread?.(s.hooks);
+            if (reread !== undefined) {
+                hooksConfig = reread.config;
+                hooksReread = { stripped: reread.stripped };
+            }
+            else
+                deferred.push("hooks");
+        }
     }
     const shellEnv = cleanEnvMap(s.env);
     if (s.env !== undefined && s.env !== null && shellEnv === undefined)
@@ -252,7 +260,7 @@ export function parseTaskSettings(raw) {
     const maxDesc = s.skillListingMaxDescChars;
     if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
-    return { settings: Object.keys(out).length > 0 ? out : undefined, deferred };
+    return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
 export function hasConstitutionAnchors(text) {
     return typeof text === "string" && text.includes(CYBER_RISK) && text.includes(URL_SAFETY) && text.includes(HARNESS_SECTION_ANCHOR);
@@ -321,33 +329,39 @@ function createWorkflowAskPolicy(isExempt) {
     };
 }
 function rejectUnmatchableSettingsNames(perms, pathBases) {
-    if (pathBases?.home === undefined) {
-        for (const [field, names, behavior] of [
-            ["permissions.ask", perms.ask, "ask"],
-            ["permissions.deny", perms.deny, "deny"],
-        ]) {
-            for (const name of names ?? []) {
-                const parsed = parseRuleText(name, behavior);
+    const refused = rulePolicyBucketsRefusal(perms, { ...(pathBases !== undefined ? { declared: pathBases } : {}), ...(pathBases?.home !== undefined ? { home: pathBases.home } : {}) });
+    if (refused !== undefined)
+        throw new Error(refused.message);
+}
+export const RULE_POLICY_BUCKETS = ["ask", "deny"];
+export function rulePolicyBucketsRefusal(permissions, bases) {
+    for (const bucket of RULE_POLICY_BUCKETS) {
+        const names = permissions[bucket];
+        if (!names)
+            continue;
+        const unmatchable = unmatchableToolNamesRefusal(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
+        if (unmatchable !== undefined)
+            return { bucket, message: unmatchable.message };
+    }
+    if (bases.home === undefined) {
+        for (const bucket of RULE_POLICY_BUCKETS) {
+            const field = `permissions.${bucket}`;
+            for (const name of permissions[bucket] ?? []) {
+                const parsed = parseRuleText(name, bucket);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
-                    throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
-                        `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
-                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`);
+                    return {
+                        bucket,
+                        message: `${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
+                            `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
+                            `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`,
+                    };
                 }
             }
         }
     }
-    const judgments = [
-        ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
-        ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
-    ];
-    for (const [field, names, judgment] of judgments) {
-        if (!names)
-            continue;
-        const unmatchable = unmatchableToolNamesRefusal(field, names, judgment);
-        if (unmatchable !== undefined)
-            throw new Error(unmatchable.message);
-    }
+    return undefined;
 }
+export const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)

package/dist/tool-axis-words.d.ts

@@ -1,30 +1,27 @@
 /**
- * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词,**两面共用一份**。
+ * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词(读者:**A2A 请求腿**;以及一次性迁移 M19 的升级前读法 `stored-request-tool-axes-m19.ts`,随 M19 的登记行退役)。
  *
- * ## 病(修前)
- * `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构
- * (`effect` / `egress` / `irreversibility`),而两个**闭集词表**是**手抄的字面串**:四份字面量
- * (两文件 × 两个词轴),没有一份钉在 core 的型上。后果不是「今天判错了」,而是**判据比声明窄**这件事
- * 没有任何门看得见 —— core 哪天给 `ToolEffect` 加一个词(或把 `irreversibility` 的两词改成三词,它在
- * `AskOrigin` 那一面**已经**是 `never|maybe|always` 三词了),两条请求腿会把那个**合法**的新词
- * **静默剔除**(MCP 腿)或**整条 server 判假**(A2A 腿),而 tsc 一声不吭。
+ * ## 历史与现状
+ * 修前 `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构(`effect` / `egress` / `irreversibility`),两个**闭集词表**是手抄的字面串,
+ * 没有一份钉在 core 的型上;S-249 把词表收到本文件并**两向钉死在 core 的型上**(core 加词 ⇒ 正向门红;本表留了 core 已没有的词 ⇒ 反向门红),两条腿读同一只谓词。
  *
- * ## 修法
- * 词表留在本仓(运行期要它),但**两向钉死在 core 的型上**:core 加词 ⇒ 正向门红;本表留了一个 core
- * 已经没有的词 ⇒ 反向门红。两个面共用**同一只**谓词,于是「什么算一个合法的轴值」在本仓只有一个答案。
+ * 之后 MCP 面的 `toolAxes` 判官整个换给了**引擎**:core 7.51.2 起根导出 `readMcpToolAxes`(整份声明一坏全拒、不默认),部署腿(`web-admin-client/skills-mcp.ts`)
+ * 与请求腿(`task-mcp.ts`)都问它,本仓不再有 MCP 面的自铸读者、也不再 import 本文件的谓词。**A2A 面引擎没有对应的判官**(core 暂无 `readA2aToolAxes`),
+ * 所以 A2A 请求腿(`task-a2a.ts`)仍用本文件的谓词;引擎一旦给 A2A 也立一只判官,本文件随之退役。另一个读者是 M19 的迁移读者:续跑重放腿把升级前存下的
+ * `mcpServers[].toolAxes` 按升级前那只读者的读法重读一次(产物再交引擎的判官),那段读法当年就读本文件的谓词,逐字搬回;它不是 MCP 面的第二只判官。
  *
- * 🔴 **只管值域,不管处置**:两条腿对坏值的处置**刻意不同**(MCP = 丢这一键、留 server;A2A = 整条拒),
- * 判据与理由各写在各自的调用点。合并处置会抹掉那条真实的分歧(MCP 的 `toolAxes` 有 server-hint 腿可折,
- * A2A 收下的就是最终值),而分歧本身是裁定过的。
+ * 下面的同型钉(A2A 的轴型与 MCP 的轴型逐字同声明)仍有意义:A2A 的词表跟着引擎 MCP 面的轴型走,哪一边加词、改词,另一边在这里当场红。
+ *
+ * 🔴 **只管值域,不管处置**:A2A 腿对坏值的处置是整条拒(MCP 面是引擎判官的「整份全拒」;两面方向一致),M19 的迁移读者剔坏成员(升级前的读法),判据与理由写在各自的调用点。
  */
 import type { McpServerSpec, ToolEffect } from "@sema-agent/core";
-/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明两面逐字同声明。 */
+/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明 A2A 面与它逐字同声明。 */
 export type ToolAxisEntry = NonNullable<McpServerSpec["toolAxes"]>[string];
 /** 轴覆写上那个**两词**的不可逆档(⚠️ 与 `AskOrigin` 面的**三词** `never|maybe|always` 不是同一个词表:
  *  覆写面只收两极,`maybe` 是引擎按工具自己的声明定的,调用方说不出口)。 */
 export type ToolAxisIrreversibility = NonNullable<ToolAxisEntry["irreversibility"]>;
-/** 值是不是一个合法的 `effect` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的 `effect` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolEffect(v: unknown): v is ToolEffect;
-/** 值是不是一个合法的**覆写面** `irreversibility` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的**覆写面** `irreversibility` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolAxisIrreversibility(v: unknown): v is ToolAxisIrreversibility;
 //# sourceMappingURL=tool-axis-words.d.ts.map

package/dist/trace/core-keyset-guard.d.ts

@@ -148,9 +148,9 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "userAttachments";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";

package/dist/trace/ledger-sink.d.ts

@@ -104,6 +104,35 @@ export declare function createSerialLedgerAppend(appendEvent: (seq: number, type
  * 返回 `.catch` 用的处理器(产物是函数 ⇒ `create*`)。
  */
 export declare function createForwardAppendFailedNote(type: string): (err: unknown) => void;
+/**
+ * 人在环帧(`question` / `question_complete`、`elicitation` / `elicitation_complete`)的**账本孪生投递口**。
+ *
+ * 一条律:**凡进 run 流的 HITL 帧都有账本孪生;腿只决定「还要不要同时直写 socket」**。后台腿没有 live 面,
+ * 它的投递口就是账本追加本身(`runs.ts`);同步流腿有 live SSE,走本函数 —— 同一只帧对象先落账、再按需直写,
+ * 于是两条腿对同一只帧的落法只差「直写要不要」,不差「账本有没有」。
+ *
+ * 顺序与失败语义(与后台腿同一条):
+ *  · **先账本后直写**。账本落不下 ⇒ 本次投递**失败**(抛),帧不上 socket —— 一只没有孪生的帧不许单独露面
+ *    (否则壳看见一张重载就丢的卡)。调用方(协调器)按「开帧投递失败」处理:这一问结算 `unavailable`、记一次既有的
+ *    P-DEBT 留痕;消卡帧则落「面包屑丢失」的 F 类留痕。
+ *  · **seq 不自造**:孪生走 `sink.append` —— 本腿账本唯一的那条串行链(与 text / tool / done 行同一个计数器)。
+ *  · **直写口已不可达**(客户端离开,而 run 因 detach 继续)⇒ 账本孪生即送达,不再触碰那条已死的连接
+ *    (不抛、也不记「丢帧」—— 帧没丢,在账本里)。
+ *  · **本腿没有账本**(无 durable run 行的部署:`sink` 缺席)⇒ 直写就是全部投递,死流姿态由 `writeLive` 自己带
+ *    (question 抛、elicitation 静默记账),字节逐字同孪生落地之前。
+ *
+ * 命名(CLAUDE.md 工厂命名律):`create*` —— 返回的是捕获了两个口的闭包,不是纯数据。
+ */
+export declare function createLedgerTwinEmit<F extends {
+    type: LedgerEventType;
+}>(opts: {
+    /** 本腿的账本(sync 腿 = 有 durable run 行才有;缺席 ⇒ 无孪生可落)。只用 `append`:seq 由它那条链铸。 */
+    sink: Pick<LedgerSink, "append"> | undefined;
+    /** 本腿的直写口(sync 腿 = 一个具名 SSE 事件)。 */
+    writeLive: (frame: F) => void;
+    /** 直写面此刻可达吗 —— 与协调器问「这条腿还够得着人吗」的是**同一只**谓词(`QuestionRunContext.deliverable`)。 */
+    liveReachable: () => boolean;
+}): (frame: F) => Promise<void>;
 export declare function createLedgerSink(opts: {
     /** The seq-stamped durable append — typically `(seq, type, data) => runStore.appendEvent(taskId, seq, type, data)`. */
     appendEvent: (seq: number, type: LedgerEventType, data: unknown) => Promise<void>;

package/dist/trace/ledger-sink.js

@@ -17,6 +17,17 @@ export function createSerialLedgerAppend(appendEvent, startSeq) {
 export function createForwardAppendFailedNote(type) {
     return (err) => recordFailOpen("server.ledger.forward-append-failed", `type=${type} err=${err instanceof Error ? err.message : String(err)}`);
 }
+export function createLedgerTwinEmit(opts) {
+    return async (frame) => {
+        if (opts.sink !== undefined) {
+            const { type, ...data } = frame;
+            await opts.sink.append(type, data);
+            if (!opts.liveReachable())
+                return;
+        }
+        opts.writeLive(frame);
+    };
+}
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
     let seq = 0;

package/dist/trace/project.d.ts

@@ -851,6 +851,11 @@ export declare function wiringManifestFaceEventData(ev: {
  *    `[from …]` 渲染就是靠它决定加不加 `(unverified)`),剥掉它比剥掉 id 更坏:剩下一个看不出真假的名字。
  *  · `principal` —— **刻意不投影**(与 ToolApprovalFrame 的 `principal` 同裁):帧本就经 owner-scoped 流
  *    投递,租户身份不必再由帧自述。要它请先提消费需求,别顺手加。
+ *  · `attachments[]`(core 7.50.0,只在声明了附件的目标那一帧 `applied` 上)—— 逐成员挑四键:`ordinal`(引擎铸的序号)/
+ *    `kind`(引擎认出的种类,闭集词;读不出种类时缺席)/ `outcome`(引擎的结局词,闭集)⇒ verbatim;`label` = 调用方**自己声明的**
+ *    路径或名字(引擎原样回声,不是解析后的落点 —— 多租户沙箱车道上它是这次 run 自己工作区里的相对 / 绝对路径串,帧上不出现任何别的租户
+ *    或宿主盘的信息),与已展示的工具实参 / `workspace_changed.cwd` 同一信任级(UNTRUSTED 的路径串)⇒ 过 `redactSecrets`。长度界由引擎定
+ *    (`USER_ATTACHMENT_LABEL_MAX`),本仓不另截。非对象的成员丢、集外的成员键不投(同 `actor` 的白名单理由)。
  *
  * `actor` 逐键挑(禁 spread):core 已声明 `ActorAssertion` 是冻结三键形,但白名单的意义正是「core 加第
  * 四键时由人处置」——身份对象上多出来的键裸上线是本文件反复登记的病族。
@@ -866,6 +871,7 @@ export declare function humanInputEventData(ev: {
     actor?: unknown;
     principal?: unknown;
     entryId?: unknown;
+    attachments?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -665,6 +665,16 @@ export function wiringManifestFaceEventData(ev, operatorFace, instructions) {
 export function humanInputEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const a = typeof ev.actor === "object" && ev.actor !== null && !Array.isArray(ev.actor) ? { ...ev.actor } : {};
+    const attachments = Array.isArray(ev.attachments)
+        ? ev.attachments
+            .filter((m) => typeof m === "object" && m !== null && !Array.isArray(m))
+            .map((m) => ({
+            ...(typeof m.ordinal === "number" && Number.isFinite(m.ordinal) ? { ordinal: m.ordinal } : {}),
+            ...(str(m.kind) !== undefined ? { kind: m.kind } : {}),
+            ...(str(m.outcome) !== undefined ? { outcome: m.outcome } : {}),
+            ...(str(m.label) !== undefined ? { label: redactSecrets(String(m.label)) } : {}),
+        }))
+        : undefined;
     const actor = {
         ...(str(a.id) !== undefined ? { id: redactSecrets(String(a.id)) } : {}),
         ...(typeof a.hostAsserted === "boolean" ? { hostAsserted: a.hostAsserted } : {}),
@@ -679,6 +689,7 @@ export function humanInputEventData(ev) {
         ...(str(ev.issuer) !== undefined ? { issuer: redactSecrets(String(ev.issuer)) } : {}),
         ...(Object.keys(actor).length > 0 ? { actor } : {}),
         ...(str(ev.entryId) !== undefined ? { entryId: ev.entryId } : {}),
+        ...(attachments !== undefined ? { attachments } : {}),
         ...identityFields(ev),
     };
 }

package/dist/trace/wire-projection-faces.d.ts

@@ -161,7 +161,7 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly human_input: {
         readonly projector: "humanInputEventData";
         readonly coreType: string;
-        readonly excluded: readonly ["principal", "attachments"];
+        readonly excluded: readonly ["principal"];
         readonly minted: readonly [];
     };
     readonly task_notification: {

package/dist/trace/wire-projection-faces.js

@@ -30,7 +30,7 @@ export const WIRE_PROJECTION_FACES = {
     context_usage: { projector: "contextUsageEventData", coreType: arm("context_usage"), excluded: [], minted: [] },
     turn_end: { projector: "turnEndEventData", coreType: arm("turn_end"), excluded: [], minted: [] },
     compaction_outcome: { projector: "compactionOutcomeEventData", coreType: arm("compaction_outcome"), excluded: [], minted: [] },
-    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal", "attachments"], minted: [] },
+    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal"], minted: [] },
     task_notification: {
         projector: "taskNotificationEventData",
         coreType: `TaskNotificationPayload & ${arm("task_notification")}`,

package/dist/user-authored-text.d.ts

@@ -28,4 +28,11 @@ export declare function buildObjectivePreview(text: string, chars: number): stri
 export declare const RUN_OBJECTIVE_PREVIEW_CHARS = 120;
 /** run 行的预览:用户写的那段 → 脱敏 → 截 {@link RUN_OBJECTIVE_PREVIEW_CHARS};没有用户正文 ⇒ `""`(列写空串 = 有记录、剥空)。 */
 export declare function buildRunObjectivePreview(objective: string): string;
+/**
+ * 这条消息是不是**附件帧**(core 7.50.0 请求层附件:目标声明的每只文件由引擎铸成一条自己的 user 消息,紧跟目标提交)。
+ * 判据 = 引擎写在消息上的送达记录 `attachment` **在场**(core:那只记录是「这条消息是附件帧」的唯一来源,文本从不判)。坏形记录同样算在场 ——
+ * 两个读者都往「不是人写的话」那一侧落(预览走下一条;会话视图按文件字节脱敏),那是安全的一侧。
+ * 一个事实一个读法:会话视图的处置表(`audit.ts`)与本地会话列表的预览(`plugins/local-session-store.ts`)同调这一只。
+ */
+export declare function isAttachmentFrame(message: unknown): boolean;
 //# sourceMappingURL=user-authored-text.d.ts.map

package/dist/user-authored-text.js

@@ -15,4 +15,7 @@ export const RUN_OBJECTIVE_PREVIEW_CHARS = 120;
 export function buildRunObjectivePreview(objective) {
     return buildObjectivePreview(objective, RUN_OBJECTIVE_PREVIEW_CHARS);
 }
+export function isAttachmentFrame(message) {
+    return typeof message === "object" && message !== null && Object.hasOwn(message, "attachment");
+}
 //# sourceMappingURL=user-authored-text.js.map

package/dist/web-admin-client/apply-effective.js

@@ -1,7 +1,7 @@
 import { expandTiers, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
 import { WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
-import { readAtMention } from "../model-select.js";
+import { buildEnvModelIdNotServedNotice, mintCapabilityKeys, readAtMention, servedModelTableLeg } from "../model-select.js";
 import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
@@ -40,8 +40,7 @@ function toModel(m, envDefaults = {}, logger) {
         provider: m.provider,
         api: m.api,
         baseUrl: m.baseUrl ?? "",
-        reasoning: m.reasoning !== undefined ? Boolean(m.reasoning) : (envDefaults.reasoning ?? true),
-        input: m.vision ? ["text", "image"] : ["text"],
+        ...mintCapabilityKeys({ reasoning: m.reasoning, vision: m.vision }),
         contextWindow: m.contextWindow ?? envDefaults.contextWindow ?? 262144,
         maxTokens: m.maxTokens ?? envDefaults.maxTokens ?? 4096,
         ...(charsPerTokenOf(m.charsPerToken) !== undefined || envDefaults.charsPerToken !== undefined
@@ -115,6 +114,7 @@ export function applyEffective(config, eff, logger, opts) {
             }
         }
     }
+    const servedBefore = servedModelTableLeg(config);
     commitStaged(config, staged);
     if (ordered)
         appliedGeneration.set(config, gen);
@@ -138,6 +138,11 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.info("web_admin_limits", { version: staged.version, keys: staged.limits.changed });
     if (mp)
         logger?.info("web_admin_models", mp.infoLine);
+    if (servedBefore === "env") {
+        const notServed = buildEnvModelIdNotServedNotice(config);
+        if (notServed !== undefined)
+            logger?.warn(notServed.event, notServed.fields);
+    }
     if (staged.approvalGate.next !== undefined)
         logger?.info("web_admin_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
@@ -248,7 +253,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         const modelApiKeyEnv = {};
         const modelApiKeys = {};
         const envModel = envDerivedModel(config);
-        const envDefaults = { maxTokens: envModel.maxTokens, contextWindow: envModel.contextWindow, reasoning: envModel.reasoning, charsPerToken: envModel.charsPerToken, defaultThinking: envModel.defaultThinking, compat: envModel.compat };
+        const envDefaults = { maxTokens: envModel.maxTokens, contextWindow: envModel.contextWindow, charsPerToken: envModel.charsPerToken, defaultThinking: envModel.defaultThinking, compat: envModel.compat };
         for (const m of usable) {
             if (m.baseUrl)
                 logger?.warn("web_admin_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(m.baseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
@@ -343,7 +348,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
         if (noDefault !== undefined)
             return refuse(DEFAULT_MODEL_MISSING_CODE, noDefault);
-        const endpoint = judgeModelRouteEndpoint(nextView);
+        const endpoint = judgeModelRouteEndpoint(nextView, "catalog");
         if (endpoint !== undefined)
             return refuse(endpoint.code, endpoint.reason);
         const minted = crossInvariant("refused-names-not-minted").check({ live: config, next: nextView });

package/dist/web-admin-client/skills-mcp.d.ts

@@ -27,7 +27,7 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
  * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
- * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / `mcp-tool-axes.ts`). Restart-to-apply
+ * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / the engine's `readMcpToolAxes`). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {

package/dist/web-admin-client/types.d.ts

@@ -125,7 +125,7 @@ export interface CenterMcpServer {
      * 与传输类型和地址无关(stdio 子进程可以是不可信包,loopback URL 可以是你自己的服务)——core 刻意
      * 不按拓扑推断,本层同样不推断。它是**部署面**的键(core 顶注:与 `RunnerDeps` 接线同一权威平面),
      * 所以它的家在 center 下发这条腿;请求腿那半场的门与结构性兑现见 `task-mcp.ts`
-     * 的 `assertRequestMcpContentOrigin` 顶注。
+     * 的 `assertRequestMcpEntries` 顶注。
      *
      * ✅ **两条腿已通**([ref],settings-schema 1.4.0 补键 + config-provider 映射行,2026-09-02;双绊线翻正销账)。
      * 病史([ref]③ / [ref]③ / [ref],2026-08-31 双绊线实测更正 —— 本注更旧版那句

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.129.1",
+  "version": "7.131.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.51.2",
-    "@sema-agent/settings-schema": "12.2.1",
+    "@sema-agent/settings-schema": "13.0.1",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",

package/scripts/drain-check-local.mjs

@@ -19,8 +19,9 @@
  *  · `skill-deny-inert`(换钉 7.117.0 前,引擎 7.42 逐字读规则条目):pending 行所在会话的续跑上下文里,提交体顶层 `skills[]` 或某只子代的 `agents[].skills[]`
  *    某只技能的 `disallowedTools` 有引擎读成空的条目(例:带首尾空白的 `"Bash "` —— 7.41 去白后是一条有效的拒,7.42 什么也不拒)—— 这样的行在 7.117.0 上续跑会被拒
  *    (行字节不动;出路 = 取消、改好条目重提,见随包 `MIGRATION.md` 7.117.0 节)。命中行点名是哪一层(`member=skills` / `member=agents.skills`)。
- *    判据**就是**服务提交与续跑两腿同经的那一只函数(`src/rule-entry-list.ts` 的 `skillDenyInertEntryOf`,它调引擎包根的 `compileAllowList`),经编译产物
- *    `dist/rule-entry-list.js` 取 —— 本脚本不写第二份;
+ *    判据**就是**服务提交与续跑两腿同经的那一只判官(`src/rule-entry-list.ts`:两腿经 `inertToolListEntryOf` 判全部工具名清单,它先调技能两层的取清单函数 `skillDenyInertEntryOf`,
+ *    后者调引擎包根的 `compileAllowList`),本脚本取的是技能两层那一只,经编译产物 `dist/rule-entry-list.js` 取 —— 不写第二份。7.131.0 起读成空即拒的清单扩到根 run 的 `allowTools` / `excludeTools` 与子代定义的 `allowTools` / `denyTools`,
+ *    本判据(窗在 7.117.0)与随包 SQL 孪生**仍只数技能两层**,不覆盖那几张清单(续跑时的 409 是它们的响亮道);
  *  · `workflow-park-holder`(换钉 7.118.0 前,引擎 7.44.0 起 workflow 子代卡交给哪条 run 只看记录 `parks[]` 条目上的持有者位 `parkedBy` / `generation`):
  *    pending 行的子会话被 workflow park 索引点名(`<数据根>/workflows/workflow-agent-sessions/index.jsonl`:一行 = 一条 workflow run 的整份指针集
  *    `{ runId, rows: [{ sessionId, runId, agentKey, scope }] }`,同一条 run 后写的一行整份覆盖先写的,空集 = 它不再点名任何子会话)= 一张待批的 workflow 子代卡。