@sema-agent/server 7.129.1 → 7.131.0

package/dist/hooks/hook-runner.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
-import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
+import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
+import { formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
 import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -57,6 +58,23 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
+const HOOK_ENTRY_TYPE_RUNS = {
+    command: true,
+    http: true,
+    prompt: true,
+    agent: true,
+    mcp_tool: false,
+};
+function isSupportedHookEntryType(t) {
+    return HOOK_ENTRY_TYPE_RUNS[t];
+}
+export const SUPPORTED_HOOK_ENTRY_TYPES = HOOK_ENTRY_TYPES.filter(isSupportedHookEntryType);
+function isHookEventName(key) {
+    return HOOK_EVENTS.includes(key);
+}
+function isRunnableHookEntry(entry) {
+    return isSupportedHookEntryType(entry.type);
+}
 export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
 export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 1_000;
 export const MATCHER_ECHO_CHARS = 200;
@@ -201,23 +219,61 @@ export function toolMatcherIssue(config, depth, budget = {}) {
     }
     return undefined;
 }
+const HOOKS_PIECE_MEANING = {
+    "hooks-not-object": "`hooks` must be an object keyed by hook event name",
+    "unknown-event": "not a hook event name",
+    "event-not-array": "an event's value must be an array of matcher groups",
+    "matcher-invalid": "a matcher group must be an object with an optional string `matcher` and an array `hooks`",
+    "entry-invalid": "a hook entry must be an object whose `type` and fields are valid for that type",
+    "guard-outside-hooks": "a PreToolUse / PermissionRequest hook sits outside `hooks`",
+    "hooks-is-matcher": "`hooks` holds a matcher group or an entry directly; it must be an object keyed by hook event name",
+    "guard-under-unknown-event": "an unknown event name holds a PreToolUse / PermissionRequest hook",
+    "guard-event-not-array": "a PreToolUse / PermissionRequest event's value must be an array of matcher groups",
+    "guard-matcher-invalid": "a PreToolUse / PermissionRequest matcher group is not valid",
+    "guard-entry-invalid": "a PreToolUse / PermissionRequest hook entry is not valid",
+};
+export function hooksCoordinate(path) {
+    return `settings.${formatConfigPath(outgoingPath(path))}`;
+}
+function hooksPieceRefusal(piece) {
+    const field = piece.field !== undefined ? ` (field: ${piece.field})` : "";
+    return `${hooksCoordinate(piece.path)}: ${piece.code} — ${HOOKS_PIECE_MEANING[piece.code]}${field}`;
+}
+function unsupportedHookEntryTypeRefusal(path, type) {
+    return `${hooksCoordinate(path)}: this server does not run hook entries of type ${type}; supported: ${SUPPORTED_HOOK_ENTRY_TYPES.join(" / ")}`;
+}
 export function parseHooksConfig(raw) {
-    const parsed = HooksConfig.safeParse(raw);
-    if (!parsed.success) {
-        const first = parsed.error.issues[0];
-        return { error: `settings.hooks: ${first ? `${first.path.join(".")}: ${first.message}` : "invalid shape"}` };
+    const classified = classifyHooksConfig({ hooks: raw });
+    if (classified.outcome !== "loaded") {
+        const first = classified.outcome === "rejected" ? classified.rejections[0] : classified.dropped[0];
+        const pieces = classified.outcome === "rejected" ? classified.rejections : classified.dropped;
+        return { error: first !== undefined ? hooksPieceRefusal(first) : `${hooksCoordinate(["hooks"])}: the hooks reader refused this configuration without naming a piece`, pieces };
     }
-    const config = parsed.data;
-    for (const [event, groups] of Object.entries(config)) {
+    const loaded = classified.hooks;
+    if (loaded === undefined) {
+        return { error: hooksPieceRefusal({ code: "hooks-not-object", path: ["hooks"] }) };
+    }
+    const config = {};
+    for (const key of Object.keys(loaded)) {
+        if (!isHookEventName(key)) {
+            return { error: hooksPieceRefusal({ code: "unknown-event", path: ["hooks", key] }) };
+        }
+        const event = key;
+        const groups = loaded[event];
         if (!groups)
             continue;
         if (groups.length > MAX_HOOK_MATCHER_GROUPS) {
             return { error: `settings.hooks.${event}: ${groups.length} matcher groups exceeds cap ${MAX_HOOK_MATCHER_GROUPS}` };
         }
         let entries = 0;
-        for (const group of groups) {
-            for (const entry of group.hooks) {
+        const kept = [];
+        for (const [groupIndex, group] of groups.entries()) {
+            const hooks = [];
+            for (const [entryIndex, entry] of group.hooks.entries()) {
                 entries++;
+                if (!isRunnableHookEntry(entry)) {
+                    return { error: unsupportedHookEntryTypeRefusal(["hooks", event, groupIndex, "hooks", entryIndex, "type"], entry.type) };
+                }
                 if (entry.type === "command" && entry.command.length > MAX_HOOK_COMMAND_CHARS) {
                     return { error: `settings.hooks.${event}: command exceeds ${MAX_HOOK_COMMAND_CHARS} chars` };
                 }
@@ -237,11 +293,14 @@ export function parseHooksConfig(raw) {
                         return { error: `settings.hooks.${event}: allowedEnvVars exceeds cap ${MAX_HOOK_HTTP_HEADERS}` };
                     }
                 }
+                hooks.push(entry);
             }
+            kept.push(group.matcher !== undefined ? { matcher: group.matcher, hooks } : { hooks });
         }
         if (entries > MAX_HOOK_ENTRIES_PER_EVENT) {
             return { error: `settings.hooks.${event}: ${entries} entries exceeds cap ${MAX_HOOK_ENTRIES_PER_EVENT}` };
         }
+        config[event] = kept;
     }
     return { config };
 }
@@ -712,6 +771,23 @@ function parseHookStdout(stdout) {
         return undefined;
     }
 }
+function runRunnableEntry(entry, payload, ctx, event, llmExtra) {
+    switch (entry.type) {
+        case "http":
+            return runHttpHook(entry, payload, ctx, event);
+        case "prompt":
+            return runLlmHook(entry, payload, ctx, llmExtra);
+        case "agent":
+            return runLlmHook(entry, payload, ctx, { system: ccAgentHookSystemFor(event), event });
+        case "command":
+            return runCommandHook(entry, payload, ctx);
+        default: {
+            const unreachable = entry;
+            void unreachable;
+            throw new Error(`hook entry of an unsupported type reached the runner although parseHooksConfig admits only ${SUPPORTED_HOOK_ENTRY_TYPES.join(" / ")}`);
+        }
+    }
+}
 async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceFired, deadlineAt, keyBase, llmExtra) {
     const results = [];
     let llmEntries = 0;
@@ -731,10 +807,6 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
             const onceKey = `${keyBase ?? event}:${gi}:${ei}`;
             if (entry.once && onceFired.has(onceKey))
                 continue;
-            if (entry.type !== "command" && entry.type !== "http" && entry.type !== "prompt" && entry.type !== "agent") {
-                ctx.logger.warn("hook_entries_skipped", { event, type: entry.type, reason: "type_not_supported" });
-                continue;
-            }
             if (entry.type === "prompt" || entry.type === "agent") {
                 const carrier = entry.type === "prompt" ? ctx.hookLlm : ctx.hookAgent;
                 if (!carrier) {
@@ -771,9 +843,7 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 onceFired.add(onceKey);
             if (entry.type === "prompt" || entry.type === "agent")
                 llmEntries++;
-            const run = entry.type === "http" ? await runHttpHook(entry, payload, ctx, event)
-                : entry.type === "prompt" || entry.type === "agent" ? await runLlmHook(entry, payload, ctx, entry.type === "prompt" ? llmExtra : { system: ccAgentHookSystemFor(event), event })
-                    : await runCommandHook(entry, payload, ctx);
+            const run = await runRunnableEntry(entry, payload, ctx, event, llmExtra);
             if (run.spawnError) {
                 ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: clip(run.spawnError, 300) });
                 if (!run.noticed)

package/dist/http/admission.js

@@ -16,7 +16,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { createRunAcceptance } from "../run-acceptance.js";
-import { sendError, httpErrorCode } from "./send.js";
+import { sendError, sendHttpError } from "./send.js";
 import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
@@ -655,7 +655,7 @@ export function createAdmission(ctx) {
                     onTypedFailure(err);
                     return null;
                 }
-                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
+                sendHttpError(res, err);
                 return null;
             }
             throw err;

package/dist/http/approval-sweeps.js

@@ -73,7 +73,7 @@ export function createApprovalSweeps(ctx) {
                 return undefined;
             if (read.kind === "absent")
                 return undefined;
-            return storedBodyReplayRefusal(read.ctx, deps.config.autonomy);
+            return storedBodyReplayRefusal(read.ctx, deps.config);
         };
         let parkedSkipped = 0;
         const replaySkipped = [];
@@ -96,7 +96,7 @@ export function createApprovalSweeps(ctx) {
             deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
                 count: replaySkipped.length,
                 skipped: replaySkipped,
-                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind skill_deny_inert: a skill disallowedTools entry the engine now reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind inert_tool_list: a tool-list entry (a skill disallowedTools, an agent definition's denyTools / allowTools or the request's excludeTools / allowTools) the engine reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/checkpoint-ctx.d.ts

@@ -16,9 +16,10 @@
  *  · 拒句按「这行是在哪种读法下写的」分两句({@link ALLOW_LIST_READING_ERAS} 穷举):无记号(或记号认不得)= 名单时代;`"statement"` = 表态时代。
  *  · 体里没有 `allow`(或空数组 —— 三代都把空数组读成「没有」)的行不写记号、不受本规则影响。
  *
- * ## 第二问(7.117.0,引擎 7.42 逐字读规则条目):技能拒侧读成空的存量体
- * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
- * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
+ * ## 第二问(7.117.0 起,引擎 7.42 逐字读规则条目;7.131.0 起覆盖全部工具名清单):工具名清单读成空的存量体
+ * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里工具名清单 —— 技能(顶层 / 子代)的 `disallowedTools`(7.117.0:`"Bash "` 这类 7.41 去白后有效、
+ * 7.42 什么也不拒的条目)、子代定义的 `denyTools` / `allowTools`、顶层 `excludeTools` / `allowTools`(7.131.0:限制侧近似名 / 大小写孪生、退役名、文法读不出,放行侧只近似名)—— 有引擎读成空的条目 ⇒ 提交 400(`resolveSpec`,拒点);
+ * 存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`(`blockedBy` = 该层的拒码)。判据函数 = `rule-entry-list.ts` `inertToolListEntryOf`。
  *
  * ## 第三问(7.122.0):体里模式词的读法记号
  * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
@@ -36,7 +37,7 @@
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
- * allow 记号,技能拒侧那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
+ * allow 记号,工具名清单那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
  *
  * ## 何时删(一次性迁移,不是长期双读)
  * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件与窗登记在 `plugins/one-time-migrations.ts` 的
@@ -46,7 +47,7 @@
 import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-import type { SkillDenyInertEntry } from "../rule-entry-list.js";
+import type { InertToolListEntry } from "../rule-entry-list.js";
 /** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
  *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
 export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
@@ -140,8 +141,8 @@ export type StoredBodyReplayRefusal = {
     readonly era: AllowListReadingEra;
     readonly writerVersion?: string;
 } | {
-    readonly kind: "skill_deny_inert";
-    readonly entry: SkillDenyInertEntry;
+    readonly kind: "inert_tool_list";
+    readonly entry: InertToolListEntry;
 } | {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
@@ -168,7 +169,7 @@ export interface ResumeRefusalAnswer {
 }
 /**
  * 「续跑被一条准入策略挡住」的**唯一**铸点:`resolveSpec` 在重放存量体时抛出的 `HttpError`(400 族)折成 409 `resume_blocked_by_policy`,
- * `blockedBy` = 那条 400 的码(属主 `http/send.ts` `httpErrorCode`),`extra` 原样随体。{@link storedBodyReplayAnswer} 的技能拒侧那一臂与
+ * `blockedBy` = 那条 400 的码(属主 `http/send.ts` `httpErrorCode`),`extra` 原样随体。{@link storedBodyReplayAnswer} 的工具名清单那一臂与
  * `resume-legs.ts` 的折叠口都调它 —— 句子与码只在这里写一次(冻结门 `api-error-text-freeze` 的模板骨架表锚这一处)。
  */
 export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
@@ -179,15 +180,15 @@ export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy:
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
     era?: AllowListReadingEra;
-    layer?: SkillDenyInertEntry["layer"];
+    layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
     note: string;
 };
 /**
  * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
- * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
+ * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal, readerVersion: string): ResumeRefusalAnswer;
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -87,8 +87,8 @@ export function storedBodyReplayLogFields(refusal) {
     switch (refusal.kind) {
         case "allow_list_reading":
             return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
-        case "skill_deny_inert":
-            return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "inert_tool_list":
+            return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         default: {
@@ -103,8 +103,8 @@ export function storedBodyReplayAnswer(refusal, readerVersion) {
             const answer = allowListReadingRefusal(refusal.era);
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
-        case "skill_deny_inert":
-            return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        case "inert_tool_list":
+            return resumeBlockedByPolicyAnswer(refusal.entry.message, refusal.entry.code, refusal.entry.extra !== undefined ? { ...refusal.entry.extra } : undefined);
         case "permission_mode_reading": {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };

package/dist/http/dispatch.js

@@ -149,7 +149,7 @@ export function createDispatch(ctx) {
                 configHash,
                 pid: process.pid,
                 startedAt: PROCESS_STARTED_AT_MS,
-                port: deps.config.port,
+                port: req.socket.localPort,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...buildHealthSelfReport(deps, hasServiceAuth(deps.config)),
                 ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),

package/dist/http/resume-legs.js

@@ -422,11 +422,11 @@ export function createResumeLegs(ctx) {
         noteLateSettleIfAccepted(driven);
         return driven;
     }
-    const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
-    const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
+    const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments"];
+    const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
     const resolveResumeSpec = async (ctx, req, auth) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, {
+        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
@@ -438,7 +438,7 @@ export function createResumeLegs(ctx) {
         return storedBodyReplayAnswer(refusal, serviceVersion());
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
@@ -932,6 +932,7 @@ export function createResumeLegs(ctx) {
                                 break;
                             }
                             case "human_input":
+                                anchor.onHumanInput(ev);
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
                                 break;
@@ -1400,7 +1401,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };

package/dist/http/routes/approvals-assistant.js

@@ -22,7 +22,7 @@ import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answe
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
+import { readResumeCtx } from "../resume-ctx-read.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
-import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
@@ -12,6 +12,7 @@ import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protoco
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
+import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
 import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
@@ -51,7 +52,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const name = match.params.name;
             const detail = deps.scenarioDetails?.[name];
             if (!detail) {
-                sendError(res, 404, "scenario_not_found", "scenario not found");
+                sendScenarioNotFound(res);
                 return;
             }
             sendJson(res, 200, detail);
@@ -146,6 +147,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
+                userAttachments: USER_ATTACHMENT_SEAT,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyKeepsOpenWriteFace(deps.config.autonomy),
@@ -217,7 +219,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario) ?? [], "deployment");
+            const scenarioParams = new URLSearchParams(match.search).getAll("scenario");
+            if (scenarioParams.length > 1) {
+                sendError(res, 400, "request.field_invalid", "scenario must be given at most once (omit it to read this deployment's default scenario)");
+                return;
+            }
+            const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
+            await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, scenarioName) ?? [], "deployment");
             return;
         }
         case "capability-mcp-probe": {
@@ -247,7 +255,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 name,
                 id: m.id,
                 provider: m.provider,
-                reasoning: m.reasoning,
+                ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),

package/dist/http/routes/runs.js

@@ -599,6 +599,14 @@ export async function handleRuns(req, res, match, ctx) {
             };
             const job = prior.then(async () => {
                 const cs = deps.checkpointStore;
+                const withdrawWakeCard = async (token, scope, arm) => {
+                    try {
+                        await cs.expire(token, scope);
+                    }
+                    catch (e) {
+                        deps.logger?.warn?.("steer_wake_card_withdraw_failed", { taskId, sessionId: run.sessionId, arm, error: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+                    }
+                };
                 const reprobe = await tryPark();
                 if (reprobe === "parked") {
                     mintResult.parked = true;
@@ -624,7 +632,7 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.noResumeCtx = true;
                     return;
                 }
-                const unservable = storedBodyReplayRefusal(resumeRead.ctx, deps.config.autonomy);
+                const unservable = storedBodyReplayRefusal(resumeRead.ctx, deps.config);
                 if (unservable !== undefined) {
                     mintResult.unservable = unservable;
                     return;
@@ -645,18 +653,18 @@ export async function handleRuns(req, res, match, ctx) {
                 });
                 const stillRead = await readResumeCtx(cs.getCtx(run.sessionId));
                 if (stillRead.kind === "corrupt") {
-                    await cs.expire(wakeToken, cpScope).catch(() => undefined);
+                    await withdrawWakeCard(wakeToken, cpScope, "resume_context_corrupt");
                     mintResult.corruptCtxWhere = stillRead.where;
                     return;
                 }
                 if (stillRead.kind !== "ok") {
-                    await cs.expire(wakeToken, cpScope).catch(() => undefined);
+                    await withdrawWakeCard(wakeToken, cpScope, "resume_context_absent");
                     mintResult.noResumeCtx = true;
                     return;
                 }
                 const winner = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" }).catch(() => null);
                 if (winner !== null && winner !== wakeToken) {
-                    await cs.expire(wakeToken, cpScope).catch(() => undefined);
+                    await withdrawWakeCard(wakeToken, cpScope, "converged_on_winner");
                     await parkOnce(winner, cpScope);
                     return;
                 }
@@ -680,7 +688,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (mintResult.corruptCtxWhere !== undefined) {
-                sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — no wake card was minted and nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
+                sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
                 return;
             }
             if (mintResult.unservable !== undefined) {
@@ -735,10 +743,6 @@ export async function handleRuns(req, res, match, ctx) {
         }
         const interruptBody = interruptNormalized;
         const interruptBare = !("text" in interruptBody);
-        if (interruptBare && Object.keys(interruptBody).length > 0) {
-            sendError(res, 400, "request.body_shape", "body must be {} (bare halt: cut the in-flight turn and stop the run at this boundary) or { text: string (non-empty) } (cut + steer: the text reaches the model after the cut)");
-            return;
-        }
         let text = "";
         if (!interruptBare) {
             if (typeof interruptBody.text !== "string" || interruptBody.text.length === 0) {
@@ -746,11 +750,11 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             text = interruptBody.text;
-            const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
-            if (keyIssue) {
-                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
-                return;
-            }
+        }
+        const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
+        if (keyIssue) {
+            sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+            return;
         }
         const interruptIdemRaw = headerStr(req.headers["idempotency-key"]);
         const interruptInputId = interruptIdemRaw ? `idem-${idemKeyOf(interruptIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();

package/dist/http/routes/sessions.js

@@ -1,6 +1,6 @@
 import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js";
-import { isUuidShape, legacyUnownedSessionOk } from "../../security.js";
+import { HttpError, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
@@ -8,7 +8,7 @@ import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
-import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
+import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -144,10 +144,21 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const lastLegMcp = await lastLegMcpFor(deps, safeDecode(match.params.sessionId), principal);
-            const specs = mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario);
-            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
+            const ledgerHalf = lastLegMcp === undefined ? {} : { lastLegMcp };
+            let scenarioName;
+            try {
+                scenarioName = await deps.scenarioGate(principal, undefined);
+            }
+            catch (e) {
+                if (!(e instanceof HttpError))
+                    throw e;
+                sendJson(res, 200, { asOf: new Date().toISOString(), ...ledgerHalf, scenarioRefusal: httpErrorBody(e) });
+                return;
+            }
+            const specs = mcpForScenario(deps.config.mcpServers, scenarioName);
+            const cacheKey = `${scenarioName}::${principal ?? ""}`;
             if (!specs || specs.length === 0) {
-                sendJson(res, 200, { servers: [], asOf: new Date().toISOString(), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
+                sendJson(res, 200, { servers: [], asOf: new Date().toISOString(), ...ledgerHalf });
                 return;
             }
             const cached = mcpStatusCache.get(cacheKey);
@@ -179,23 +190,24 @@ export async function handleSessions(req, res, match, ctx) {
                 })();
                 mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
             }
-            sendJson(res, 200, { ...(await mcpStatusCache.get(cacheKey).panel), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
+            sendJson(res, 200, { ...(await mcpStatusCache.get(cacheKey).panel), ...ledgerHalf });
             return;
         }
     }
     {
         if (match.decl.id === "session-a2a") {
-            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const specs = a2aForScenario(deps.config.a2aPeers, deps.config.defaultScenario);
+            const scenarioName = await deps.scenarioGate(principal, undefined);
+            const specs = a2aForScenario(deps.config.a2aPeers, scenarioName);
             if (!specs || specs.length === 0) {
                 sendJson(res, 200, { peers: [], asOf: new Date().toISOString() });
                 return;
             }
-            const principal = gatedPrincipal(req, deps.config);
-            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
+            const cacheKey = `${scenarioName}::${principal ?? ""}`;
             const cached = a2aStatusCache.get(cacheKey);
             if (!cached || Date.now() - cached.at > A2A_STATUS_TTL_MS) {
                 if (a2aStatusCache.size > 1024)