@sema-agent/server 7.129.1 → 7.131.0

package/dist/run-local.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
+import { servedModelTableLeg } from "./model-select.js";
 import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { join } from "node:path";
@@ -36,13 +37,13 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, gateScenarioRequest, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
 import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
-import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
@@ -386,12 +387,12 @@ export async function runLocal(argv, deps = {}) {
         else
             logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
-    const noDefaultModel = defaultModelRefusal(config, "env");
+    const noDefaultModel = defaultModelRefusal(config, servedModelTableLeg(config));
     if (noDefaultModel !== undefined)
         throw new Error(noDefaultModel);
-    const endpointRefusal = modelRouteEndpointRefusal(config);
-    if (endpointRefusal !== undefined)
-        throw new Error(endpointRefusal);
+    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false });
+    if (routeVerdict !== undefined)
+        throw new Error(routeVerdict.reason);
     const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
     if (unpricedCeiling)
         logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
@@ -625,7 +626,7 @@ export async function runLocal(argv, deps = {}) {
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
-        scenarioName = gateScenarioRequest(undefined, args.scenario, config.defaultScenario, Object.keys(scenarios), logger);
+        scenarioName = await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario);
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {

package/dist/runs.d.ts

@@ -137,6 +137,38 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  * surfaces the degrade (a metric) so a SYSTEMATIC failure — e.g. an un-migrated DB missing `resume_anchor` — is
  * observable instead of a silent feature outage.
  */
+/**
+ * 「这一次用户消息提交是不是一句**提问**」的唯一读法 —— 三处用户回退锚(后台腿与续跑腿的 {@link TurnAnchorCapture}、`/v1/tasks/stream`
+ * 腿的 `userMsgEntryId`)同调这一只。
+ *
+ * 目标声明了附件时,引擎把每只附件铸成**一条自己的用户消息**,紧跟在目标后面提交(core `human_input.attachments` 顶注:
+ * 「each attachment is delivered as its own message after the objective; its `message_committed` is the delivery」)。
+ * 所以一次带 N 只附件的提交会出 1 + N 次 `message_committed{role:"user"}`,而「回到这条提问」的锚要的是**人的那条**
+ * (core 的 `resumeAt` 认它:「a `resumeAt` that keeps the message keeps its group」;以附件帧作 `resumeAt` 引擎拒 `resume_at.not_a_message`),
+ * 不是排在最后的附件帧。目标**之前**还可能有引擎排队的注入消息同批提交(亲读 core `engine/harness/agent-harness.js` 的 `takePrompts`:
+ * 排队消息 ⇒ 目标 ⇒ 附件帧;真案 = 工作区是 git 仓且带图时,git 状态帧单独排在目标前面),所以「窗口里第一次用户提交」不是判据。
+ *
+ * **为什么是「窗口 + 严格吻合」而不是读标记**:`message_committed` 上只有 `entryId / role / toolCallId?`,附件帧与用户真提交在事件上**不可辨认**;
+ * 落盘的行上有标记(`attachment` 键;引擎收尾的中断标记带 `provenance: "engine-note"`),但事件到手的那一刻本仓读不到那一行
+ * (会话店面没有按条目读的口,只有整日志导出),所以只能数。数的前提是「目标之后紧接恰好 N 只帧、其后才是别的」—— 前提成立才落锚,
+ * **不成立就不猜**:猜错的锚会落在附件帧上(引擎拒)或引擎的中断标记上(回到的不是用户那句)。
+ *
+ * 读法:
+ *  · `human_input{delivery:"applied"}` 带 N 只附件 ⇒ 开窗;窗内的用户提交只攒、不落锚(此刻还不知道它们是不是『目标 + N 只帧』)。
+ *  · 窗被**非用户提交**(第一次助手消息 / 工具结果)关上 ⇒ 窗内共 k 次用户提交,k ≥ N+1 时提问 = 倒数第 N+1 次(严格吻合);k < N+1(帧数不符)⇒ 不猜。
+ *  · 窗被 `turn_end` 先切断 ⇒ 第一次模型调用没出任何提交就收了(halt / interrupt / 空失败):窗里可能夹着引擎收尾的中断标记,数 N 会落在帧或标记上 ⇒ 不猜。
+ *  · 窗内又应用了一条别的输入(`human_input{applied}`,如第一次模型调用前排进来的 steer;事件先于它的正文提交到手)⇒ 窗里多了一条别人的消息,数 N 会落在帧上 ⇒ 窗作废、不猜,
+ *    之后的用户提交(含那条 steer 正文)是窗口之外的提交,最后一次赢。排队未应用(`delivery: "queued"`)的输入不动窗。
+ *  · 「不猜」= 返回 `undefined`、这次提交不落锚;拿这次 run 的 taskId 去 `resumeAt` 得 404 `resume_at.unknown_event`(文案点名这一类成因)。
+ *    窗口之外的用户提交(如 interrupt 带话的 steer 正文,在 `turn_end` 之后提交)照修前读法(是提问,最后一次赢)。
+ * 返回这次提交之后的提问 `entryId`(调用方照旧「最后一次赢」地落锚),不是提问相关的提交返回 `undefined`。
+ *
+ * 退役条件:引擎在落盘的帧上(`message_committed`)带上附件标记之日,本读法整体换成「按标记判一次」(零计数、无窗口、无拒臂),
+ * 窗口 / 严格吻合 / 不猜三臂与 `resume_at.unknown_event` 文案里对应的那一句一并删除。
+ */
+export declare function createPromptCommitReader(): (ev: {
+    readonly type: string;
+}) => string | undefined;
 export declare class TurnAnchorCapture {
     private readonly capture;
     private readonly onCaptureFail?;
@@ -151,6 +183,8 @@ export declare class TurnAnchorCapture {
     /** The turn's FIRST text_delta eventId = the message's stable resume handle (also stamped on the durable text event). */
     firstTextEventId: string | undefined;
     private turnHadTool;
+    /** 用户提交是不是提问的唯一读法({@link createPromptCommitReader};附件帧不是提问)。 */
+    private readonly promptCommit;
     constructor(capture: ((eventId: string) => Promise<void>) | undefined, onCaptureFail?: (() => void) | undefined, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
@@ -160,9 +194,15 @@ export declare class TurnAnchorCapture {
      *  Keyed by the run's taskId (the handle the shell already holds from the POST response — no eventId→entryId
      *  side map / no `getLeafId` inference needed). The assistant-turn capture above stays as an additive bonus. */
     captureUser?: ((entryId: string) => Promise<void>) | undefined);
+    /** A `human_input` arrived — the objective's declared attachments open the frame window of {@link createPromptCommitReader}. */
+    onHumanInput(ev: {
+        readonly type: string;
+    }): void;
     /** A `message_committed` arrived — capture a USER-message rewind anchor (CC parity). Best-effort (a failure only
-     *  makes that one prompt non-rewindable). Only `role==="user"`; assistant/toolResult committed entries are handled
-     *  by the turn-text path (assistant) or deliberately not anchored (toolResult — `resumeAt` rejects them). */
+     *  makes that one prompt non-rewindable). Only a user commit that is a PROMPT (not an attachment frame trailing the
+     *  objective — {@link createPromptCommitReader}; an attachment window is decided when a non-user commit closes it, so
+     *  the anchor of an attachment-carrying prompt lands on THAT call); assistant/toolResult committed entries are handled by
+     *  the turn-text path (assistant) or deliberately not anchored (toolResult — `resumeAt` rejects them). */
     onMessageCommitted(role: string | undefined, entryId: string | undefined): Promise<void>;
     /** A text_delta arrived — latch the first DEFINED eventId as the message handle (eventId is optional on the stream). */
     onText(eventId: string | undefined): void;

package/dist/runs.js

@@ -76,6 +76,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
     "config.image_invalid": 400,
+    "config.user_attachment_invalid": 400,
     "config.tool_face_control": 400,
     "config.memory_capture_unsupported": 409,
 };
@@ -109,20 +110,58 @@ export async function releaseKeyIfZeroWorkRefusal(runStore, taskId, result) {
     if (syncRefusalHttpStatus(result) !== undefined)
         await runStore.releaseIdemKey(taskId);
 }
+export function createPromptCommitReader() {
+    let attachmentWindow;
+    return (ev) => {
+        if (ev.type === "human_input") {
+            const h = ev;
+            if (h.delivery !== "applied")
+                return undefined;
+            attachmentWindow = Array.isArray(h.attachments) && h.attachments.length > 0 ? { frames: h.attachments.length, commits: [] } : undefined;
+            return undefined;
+        }
+        if (ev.type === "turn_end") {
+            attachmentWindow = undefined;
+            return undefined;
+        }
+        if (ev.type !== "message_committed")
+            return undefined;
+        const c = ev;
+        const entryId = typeof c.entryId === "string" && c.entryId.length > 0 ? c.entryId : undefined;
+        if (c.role === "user") {
+            if (attachmentWindow !== undefined) {
+                attachmentWindow.commits.push(entryId);
+                return undefined;
+            }
+            return entryId;
+        }
+        const closed = attachmentWindow;
+        attachmentWindow = undefined;
+        if (closed === undefined || closed.commits.length < closed.frames + 1)
+            return undefined;
+        return closed.commits[closed.commits.length - 1 - closed.frames];
+    };
+}
 export class TurnAnchorCapture {
     capture;
     onCaptureFail;
     captureUser;
     firstTextEventId;
     turnHadTool = false;
+    promptCommit = createPromptCommitReader();
     constructor(capture, onCaptureFail, captureUser) {
         this.capture = capture;
         this.onCaptureFail = onCaptureFail;
         this.captureUser = captureUser;
     }
+    onHumanInput(ev) {
+        this.promptCommit(ev);
+    }
     async onMessageCommitted(role, entryId) {
-        if (role === "user" && entryId && this.captureUser) {
-            await this.captureUser(entryId).catch(() => this.onCaptureFail?.());
+        const committed = { type: "message_committed", role, entryId };
+        const prompt = this.promptCommit(committed);
+        if (prompt !== undefined && this.captureUser) {
+            await this.captureUser(prompt).catch(() => this.onCaptureFail?.());
         }
     }
     onText(eventId) {
@@ -135,6 +174,7 @@ export class TurnAnchorCapture {
         this.turnHadTool = true;
     }
     async onTurnEnd() {
+        this.promptCommit({ type: "turn_end" });
         if (this.firstTextEventId && !this.turnHadTool && this.capture) {
             await this.capture(this.firstTextEventId).catch(() => this.onCaptureFail?.());
         }
@@ -373,6 +413,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     case "status":
                         metrics?.inc("brain_retry_total", { phase: String(ev.phase) });
                         break;
+                    case "human_input":
+                        anchor.onHumanInput(ev);
+                        break;
                     case "message_committed":
                         await anchor.onMessageCommitted(ev.role, ev.entryId);
                         break;

package/dist/runtime-caps-resolver.d.ts

@@ -175,6 +175,13 @@ export interface PrincipalEntitlementsClient {
      *  FAIL-OPEN on error / older center without scenario keys / no principal (undefined = no governance, legacy passthrough).
      *  Scenario switching is not a privilege-amplifying face; a center blip must not pin users to `default`. */
     scenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
+    /**
+     * {@link PrincipalEntitlementsClient.scenarioRuling} 的**只读**孪生(同 {@link PrincipalEntitlementsClient.peekRuntimeCaps} 的界):同一只缓存 / 同一条抓取 /
+     * 同一份 fail-open 判决(`undefined` = 无治理),唯一的差别是 center 硬失败时本腿铸的 fail-closed 降级项**只对读面自己算数**,提交腿不认、照常重抓。
+     * 读面(`GET /v1/capabilities/mcp?scenario=` 的场景门)问中心裁定时必须走这一只 —— 经 `scenarioRuling` 问,center 抖动的那一拍会替这个主体的**真提交**
+     * 留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面成了别人被拒的原因,与 `peekRuntimeCaps` 的病灶同一类)。
+     */
+    peekScenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
     /** (stage7 P5) The resolved per-principal execution-lane ruling for resolveSpec's
      *  gateExecutionLane. FAIL-OPEN + audit on error (this phase is "honest-but-bypassable";
      *  tightening to fail-closed is a future, separate decision) / older center without the execution key / no principal. */

package/dist/runtime-caps-resolver.js

@@ -167,6 +167,7 @@ export function createPrincipalEntitlementsClient(opts) {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
         peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
+        peekScenarioRuling: async (principal) => (principal ? (await load(principal, false)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }

package/dist/session-titler.d.ts

@@ -14,10 +14,12 @@
  * main model; bounded + timed out).
  *
  * FAILURE POSTURE: everything is best-effort — a generation/store failure logs and leaves title null (the
- * list falls back to objectivePreview). An in-process pending set dedupes concurrent submits on the same
+ * list falls back to objectivePreview). The fail-open tag it leaves names the CAUSE FAMILY (one tag, one family):
+ * the llm face's failure CODE picks it (`failOpenTagFor`), never the error's wording. An in-process pending set dedupes concurrent submits on the same
  * session; the store's IS NULL guard closes the cross-replica race (double generation costs one extra cheap
  * call at worst, and exactly one title lands).
  */
+import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
 export interface SessionTitlerDeps {
     /** Secret scrub applied to the RAW llm text before sanitize/persist (workflow audit 2026-07-13: the
      *  objective may carry a pasted secret and the model can echo it into the title — titles are persisted,
@@ -42,6 +44,7 @@ export interface SessionTitlerDeps {
     } | {
         ok: false;
         error: string;
+        code?: HookLlmFailureCode;
     }>;
     logger?: {
         debug?(msg: string, meta?: unknown): void;

package/dist/session-titler.js

@@ -8,6 +8,16 @@ const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
 const SEEN_CAP = 10_000;
+function failOpenTagFor(code) {
+    switch (code) {
+        case "redirect_refused":
+            return "server.session-titler.redirect-refused";
+        case "no_content":
+        case "hard_timeout":
+        case undefined:
+            return "server.session-titler.gateway-unreachable";
+    }
+}
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
@@ -25,10 +35,10 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const logFailure = (sessionId, error) => {
+    const logFailure = (sessionId, error, code) => {
         const safe = redactSecrets(error);
         deps.logger?.debug?.("session_title_failed", { sessionId, error: safe.slice(0, 200) });
-        recordFailOpen("server.session-titler.gateway-unreachable", safe.slice(0, FAIL_CAUSE_KEY_CHARS));
+        recordFailOpen(failOpenTagFor(code), safe.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     const probeOrContinue = async (sessionId, continueWord) => deps
         .probeTitle(sessionId)
@@ -65,7 +75,7 @@ export function createSessionTitler(deps) {
                 const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model });
                 if (!r.ok) {
                     deps.metrics?.inc("session_title_total", { outcome: "llm_failed" });
-                    logFailure(sessionId, r.error);
+                    logFailure(sessionId, r.error, r.code);
                     return;
                 }
                 const title = sanitizeTitle(deps.redact ? deps.redact(r.text) : r.text);

package/dist/spec-fields.d.ts

@@ -51,7 +51,7 @@ export declare const MAX_TASK_AGENTS = 32;
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
  * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
  * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
- * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 ⇒ 400)。
+ * `inertToolListEntryOf`,判据 = 引擎的条目读法;同一只函数也拒请求的工具名选择器清单里的近似名 / 退役名)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 ⇒ 400)。
  * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界;与请求 allow 桶、运维表同一只),
  * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
@@ -67,12 +67,16 @@ export declare function skillToolListRefusal(skill: Record<string, unknown>): st
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
  *  **名字归引擎一只判**(core 7.49.0 #1623 / #1433 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):core 7.51.0 #1736 起
- *  没有任何工具答应的名字(无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`)**不拒 run** —— 条目原样保留、经 onError(config)告知一次(带该写的拼法);
- *  只有任何工具名都不可能有的拼法(`grammar`)与非字符串条目 ⇒ 整 run 拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处
+ *  没有任何工具答应的名字(无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`)**引擎不拒 run** —— 条目原样保留、经 onError(config)告知一次(带该写的拼法);
+ *  其中**写错现名的**(`denyTools:["BASH"]` 想禁的照用 = 静默放行;`allowTools:["BASH"]` 想放的什么也没放 = 静默收窄)由 `resolveSpec` 前置拒:**限制侧**(`denyTools`)四类全拒(近似名 · 退役名 · 文法读不出 · `*`),
+ *  **放行侧**(`allowTools`)只拒近似名 —— 放行侧的退役名 / 内容形 / 文法读不出照 7.130.0 受理、交引擎既有通告(文法读不出的放行条目引擎在子代 prepare 整 run 拒 `config.agent.unknown_tool`,根 `allowTools` 同步腿 400 `config.tool_face_control`;`rule-entry-list.ts` `inertToolListEntryOf`:近似名提交 400 `config.agent.unknown_tool` 点名现名、续跑按方向分流;
+ *  判官仍是引擎的条目读法,不是第二个判官);
+ *  **真未知名**(没有近似也没有退役对应:懒挂载的合法形)照旧只告运维、不拒。
+ *  任何工具名都不可能有的拼法(`grammar`)与非字符串条目引擎照旧整 run 拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处
  *  声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,`capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。
  *  两张表管子代可挂载的**全部**工具:委派池、hands 内建、引擎自己的工具(`Monitor` / `Artifact` / `Skill` / 记忆工具 …)与父的 MCP 挂载 ——
  *  `denyTools:["Monitor"]` ⇒ 子代没有 `Monitor`;`allowTools` 只点了调用方工具 ⇒ 子代只剩那几只与它这条腿的协议工具。`denyTools` 的 `Tool(content)` ⇒ 整只工具。
- *  本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
+ *  本门不做名字对照(拒侧的那一判在 `resolveSpec`,见上;本门只判形与条数)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;

package/dist/stored-request-hooks-m20.d.ts

@@ -0,0 +1,23 @@
+import { type ParseHooksConfigResult, type RunnableHooksConfig } from "./hooks/hook-runner.js";
+/** 一次重读的产物:读者对剥键之后的文档的答案,与被剥掉的每个坐标(出门形,经契约包的脱敏出门)。 */
+export interface StoredHooksRereadM20Result {
+    readonly config: RunnableHooksConfig;
+    readonly stripped: readonly string[];
+}
+/** 重读座:存下的 `settings.hooks` 原值 → 迁移产物(`undefined` = 不迁移,调用方走原臂)。 */
+export type StoredHooksRereadM20 = (raw: unknown) => StoredHooksRereadM20Result | undefined;
+/** 读者(= `parseHooksConfig`);作形参只为让「读者交回什么拒因」可被替身喂(默认值就是生产读者)。 */
+export type HooksReader = (raw: unknown) => ParseHooksConfigResult;
+/**
+ * 重读一份存体 hooks:读者拒因全部属于两形 ⇒ 剥掉被点名的块里按类型确属未知的键、再问读者,**剥到读者受理为止**,过了就交回产物 + 被剥坐标;否则 `undefined`(原臂:整份不采纳)。
+ * 调用方只在读者**已经拒过**这份原值之后才来问;读者一开始就受理的值不进这里(进来也返回 `undefined`:没有可迁移的东西)。
+ *
+ * 终止:循环体以一次读开头(最后一次剥键之后必有一次读);继续下一轮的条件是本轮真从文档里剥掉了至少一个对象键,文档只减不增 ⇒ 必停;同一块只会被点名一次 ⇒ 轮数 ≤ 被点名的块数 + `__proto__` 键数。
+ */
+export declare function rereadStoredHooksM20(raw: unknown, read?: HooksReader): StoredHooksRereadM20Result | undefined;
+/**
+ * 此刻(`today` = UTC 日历日 YYYY-MM-DD)M20 的窗开着 ⇒ 交回重读座;关了 ⇒ `undefined`(今天的读法)。窗只读登记表 M20 那一行
+ * (`migrationWindowOpen`,与 M10 / M19 同一只判据)。登记表里没有 M20 ⇒ 响亮抛:重读臂活过了它的登记行,该随那一行一起删。
+ */
+export declare function storedHooksRereadM20(today: string): StoredHooksRereadM20 | undefined;
+//# sourceMappingURL=stored-request-hooks-m20.d.ts.map

package/dist/stored-request-hooks-m20.js

@@ -0,0 +1,124 @@
+import { HOOK_ENTRY_TYPES } from "@sema-agent/settings-schema/hooks";
+import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+const ENTRY_FIELD_NAMES = {
+    command: { type: true, if: true, timeout: true, statusMessage: true, once: true, command: true, shell: true, async: true, asyncRewake: true },
+    prompt: { type: true, if: true, timeout: true, statusMessage: true, once: true, prompt: true, model: true },
+    agent: { type: true, if: true, timeout: true, statusMessage: true, once: true, prompt: true, model: true },
+    http: { type: true, if: true, timeout: true, statusMessage: true, once: true, url: true, headers: true, allowedEnvVars: true },
+    mcp_tool: { type: true, if: true, timeout: true, statusMessage: true, once: true, server: true, tool: true, input: true },
+};
+const MATCHER_FIELD_NAMES = { matcher: true, hooks: true };
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function isEntryType(v) {
+    return typeof v === "string" && HOOK_ENTRY_TYPES.includes(v);
+}
+function nodeAt(node, path) {
+    let cur = node;
+    for (const seg of path) {
+        if (Array.isArray(cur))
+            cur = typeof seg === "number" ? cur[seg] : undefined;
+        else if (isRecord(cur) && typeof seg === "string")
+            cur = Object.hasOwn(cur, seg) ? cur[seg] : undefined;
+        else
+            return undefined;
+    }
+    return cur;
+}
+function contractFieldsOf(code, block) {
+    if (!isRecord(block))
+        return undefined;
+    if (code === "guard-matcher-invalid")
+        return MATCHER_FIELD_NAMES;
+    const type = Object.hasOwn(block, "type") ? block.type : undefined;
+    return isEntryType(type) ? ENTRY_FIELD_NAMES[type] : undefined;
+}
+function stripTargetsOf(piece, doc) {
+    const [root, ...rel] = piece.path;
+    if (root !== "hooks")
+        return undefined;
+    if ((piece.code === "unknown-event" || piece.code === "guard-under-unknown-event") && rel.length === 1 && rel[0] === "__proto__")
+        return [rel];
+    if ((piece.code === "guard-entry-invalid" || piece.code === "guard-matcher-invalid") && typeof piece.field === "string") {
+        const block = nodeAt(doc, rel);
+        const known = contractFieldsOf(piece.code, block);
+        if (known === undefined || !isRecord(block) || Object.hasOwn(known, piece.field) || !Object.hasOwn(block, piece.field))
+            return undefined;
+        return Object.keys(block)
+            .filter((key) => !Object.hasOwn(known, key))
+            .map((key) => [...rel, key]);
+    }
+    return undefined;
+}
+function cloneDoc(root) {
+    const isContainer = (v) => Array.isArray(v) || isRecord(v);
+    const shell = (v) => (Array.isArray(v) ? [] : isRecord(v) ? {} : v);
+    const copy = shell(root);
+    const pending = isContainer(root) ? [[root, copy]] : [];
+    for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+        const [source, target] = next;
+        if (Array.isArray(source)) {
+            for (const value of source) {
+                const child = shell(value);
+                target.push(child);
+                if (isContainer(value))
+                    pending.push([value, child]);
+            }
+        }
+        else if (isRecord(source)) {
+            for (const [key, value] of Object.entries(source)) {
+                const child = shell(value);
+                Object.defineProperty(target, key, { value: child, writable: true, enumerable: true, configurable: true });
+                if (isContainer(value))
+                    pending.push([value, child]);
+            }
+        }
+    }
+    return copy;
+}
+function removeKeyAt(doc, path) {
+    const key = path[path.length - 1];
+    const parent = nodeAt(doc, path.slice(0, -1));
+    if (!isRecord(parent) || typeof key !== "string" || !Object.hasOwn(parent, key))
+        return false;
+    delete parent[key];
+    return true;
+}
+export function rereadStoredHooksM20(raw, read = parseHooksConfig) {
+    const doc = cloneDoc(raw);
+    const stripped = [];
+    for (;;) {
+        const r = read(doc);
+        if (r.config !== undefined)
+            return stripped.length > 0 ? { config: r.config, stripped } : undefined;
+        const pieces = r.pieces;
+        if (pieces === undefined || pieces.length === 0)
+            return undefined;
+        const targets = [];
+        for (const piece of pieces) {
+            const pieceTargets = stripTargetsOf(piece, doc);
+            if (pieceTargets === undefined)
+                return undefined;
+            for (const target of pieceTargets)
+                targets.push(target);
+        }
+        let removedAny = false;
+        for (const target of targets) {
+            if (!removeKeyAt(doc, target))
+                continue;
+            stripped.push(hooksCoordinate(["hooks", ...target]));
+            removedAny = true;
+        }
+        if (!removedAny)
+            return undefined;
+    }
+}
+export function storedHooksRereadM20(today) {
+    const window = ONE_TIME_MIGRATIONS.find((w) => w.id === "M20");
+    if (window === undefined)
+        throw new Error("stored-request-hooks-m20: the one-time migration registry has no M20 row (the replay-leg stored-hooks re-read window) — the re-read arm outlived its registry row; delete it with that row");
+    return migrationWindowOpen(window, today) ? (raw) => rereadStoredHooksM20(raw) : undefined;
+}
+//# sourceMappingURL=stored-request-hooks-m20.js.map

package/dist/stored-request-tool-axes-m19.d.ts

@@ -0,0 +1,29 @@
+/**
+ * 一次性迁移 M19 —— 续跑重放腿上,升级前存下的请求体里引擎判官判不过的 `mcpServers[].toolAxes`,窗内按升级前的读法重读一次。
+ * 🔴 M19 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 请求腿读 `toolAxes` 的判官是引擎根导出的 `readMcpToolAxes`(整份一坏全拒、不默认)。升级前的请求腿读者是另一种读法:不是对象(含 `null`)⇒ 整键忽略、
+ * server 照挂;是对象 ⇒ 逐成员判形,过不了形的成员剔掉、好的留下。续跑重放腿重放的是**升级前存下的**请求体(`checkpoint_ctx` 里那一份),那时这台 server
+ * 是挂着的 —— 一条停驻在它某只工具审批上的任务,升级后若这台 server 整条不进,批准即撞引擎的 `resume.tool_unavailable`、检查点重开、每次重试重放同一份体
+ * ⇒ 永远批不过去。持久数据面不能「翻红」,所以给它一次性迁移:窗开着时,续跑重放腿把判官判不过的那一格按升级前的读法重读一次,产物**再交同一只判官**
+ * (不过 ⇒ 原臂:整条不进);真挂上的这类 server 由请求腿说一行运维 warn `mcp_tool_axes_read_as_before_upgrade`。窗关之后回到今天的读法,删码零行为变化。
+ *
+ * ## 可达面(结构上只在续跑重放腿)
+ *  · 本模块的值只被 `boot/resolve-spec.ts` 引用一处,挂在 `opts.leg` 不是 `"fresh"` 的那一臂(续跑家族经 `http/resume-legs.ts` 的 `resolveResumeSpec`
+ *    递 `leg: "resume"`);新提交腿递 `"fresh"` 拿不到重读座,且在腿首已经被同一只判官 400 掉(`assertRequestMcpEntries`),读器根本见不到坏形;
+ *  · 请求腿(`task-mcp.ts`)只 import 本模块的**型**:重读座是 `resolveRequestMcp` 的一个形参,没人递就没有;探测口(`validateRequestMcp`)没有这个形参;
+ *  · 部署腿(`web-admin-client/skills-mcp.ts` 的 `resolveMcpServers`)是另一只铸 spec 处,不读本模块。
+ * 机器锚:`test/mcp-tool-axes-m19.test.ts` 的结构格。
+ */
+import type { McpServerSpec } from "@sema-agent/core";
+type ToolAxes = NonNullable<McpServerSpec["toolAxes"]>;
+/** 重读座:一份原始 `toolAxes` 声明 → 升级前的读法读出的那一份(`undefined` = 升级前读成「没声明」)。产物由调用方再交引擎判官。 */
+export type StoredToolAxesRereadM19 = (declared: unknown) => ToolAxes | undefined;
+/**
+ * 此刻(`today` = UTC 日历日 YYYY-MM-DD)M19 的窗开着 ⇒ 交回重读座;关了 ⇒ `undefined`(今天的读法)。窗只读登记表 M19 那一行
+ * (`migrationWindowOpen`,与 M10 的认领窗同一只判据)。登记表里没有 M19 ⇒ 响亮抛:重读臂活过了它的登记行,该随那一行一起删。
+ */
+export declare function storedToolAxesRereadM19(today: string): StoredToolAxesRereadM19 | undefined;
+export {};
+//# sourceMappingURL=stored-request-tool-axes-m19.d.ts.map

package/dist/stored-request-tool-axes-m19.js

@@ -0,0 +1,27 @@
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
+function readToolAxesAsServer7129M19(declared) {
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+        return undefined;
+    const axes = {};
+    for (const [tool, ax] of Object.entries(declared)) {
+        if (!ax || typeof ax !== "object" || Array.isArray(ax))
+            continue;
+        const a = ax;
+        const entry = {
+            ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
+            ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
+            ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
+        };
+        if (Object.keys(entry).length > 0)
+            axes[tool] = entry;
+    }
+    return Object.keys(axes).length > 0 ? axes : undefined;
+}
+export function storedToolAxesRereadM19(today) {
+    const window = ONE_TIME_MIGRATIONS.find((w) => w.id === "M19");
+    if (window === undefined)
+        throw new Error("stored-request-tool-axes-m19: the one-time migration registry has no M19 row (the replay-leg toolAxes re-read window) — the re-read arm outlived its registry row; delete it with that row");
+    return migrationWindowOpen(window, today) ? readToolAxesAsServer7129M19 : undefined;
+}
+//# sourceMappingURL=stored-request-tool-axes-m19.js.map