@sema-agent/server 7.130.0 → 7.131.0

package/dist/hooks/hook-llm.js

@@ -1,5 +1,5 @@
 import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
-import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
+import { matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
 import { dispatchBrainLane } from "../model-provider.js";
@@ -24,7 +24,7 @@ export function createHookLlm(deps) {
             case "anthropic":
                 return { ok: true, catalogRef, providerModelId, baseUrl: m?.baseUrl || anthropicRouteBaseUrl(), api: "anthropic-messages" };
             case "gateway": {
-                const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m?.baseUrl, config.gatewayBaseUrl);
+                const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m, config.gatewayBaseUrl, servedModelTableLeg(config));
                 return endpoint.ok ? { ok: true, catalogRef, providerModelId, baseUrl: endpoint.baseUrl, api: "openai-completions" } : { ok: false, error: endpoint.refusal };
             }
         }

package/dist/hooks/hook-runner.d.ts

@@ -1,4 +1,5 @@
-import { HooksConfig, type HookEventName } from "@sema-agent/settings-schema/hooks";
+import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksRejection } from "@sema-agent/settings-schema/hooks";
+import { type ConfigPath } from "@sema-agent/settings-schema";
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";
@@ -31,10 +32,45 @@ export declare const MAX_HOOK_OUTPUT_BYTES: number;
  * 且 4096 的单条帽保证**前两条**钩子的话仍整段进得去(截断是配置广度的代价,不是常态)。
  */
 export declare const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10000;
+/**
+ * 本仓对契约每一种 hook 条目类型的表态 —— **一张表**:受理面({@link parseHooksConfig})与执行侧({@link RunnableHookEntry},以及每个按条目类型分派的臂)读的都是它。
+ *
+ * `Record<HookEntryType, boolean>` 穷举:契约新增一种条目类型而这里没登记 ⇒ 编译红。`true` ⇒ 执行侧有这一型的臂 —— 把某一型改成 `true` 而执行侧没补臂,
+ * 分派处(`hookDisplayName` / `runMatchingEntries` 的类型分派)编译红;`false` ⇒ 本仓不跑它,受理面把含它的配置**整份拒**(提交 400),
+ * 不是记一条运维日志然后跳过:守卫事件里一条被跳过的条目,是「写的人以为在拦、其实没拦」。
+ */
+declare const HOOK_ENTRY_TYPE_RUNS: {
+    readonly command: true;
+    readonly http: true;
+    readonly prompt: true;
+    readonly agent: true;
+    readonly mcp_tool: false;
+};
+/** {@link HOOK_ENTRY_TYPE_RUNS} 里表态为 `true` 的类型(由表派生,不另写一份)。 */
+export type SupportedHookEntryType = {
+    [T in HookEntryType]: (typeof HOOK_ENTRY_TYPE_RUNS)[T] extends true ? T : never;
+}[HookEntryType];
+/** 本仓会真跑的条目类型闭集(契约 {@link HOOK_ENTRY_TYPES} 的次序)—— 拒句 `supported: …` 的词表与 {@link RunnableHookEntry} 的类型都出自这一张表。 */
+export declare const SUPPORTED_HOOK_ENTRY_TYPES: readonly SupportedHookEntryType[];
+/** 本 runner 会真跑的条目(契约 `HookEntry` 取表态为 `true` 的那几型)。 */
+export type RunnableHookEntry = Extract<HookEntry, {
+    type: SupportedHookEntryType;
+}>;
+/** 一个匹配器组,条目只含 {@link RunnableHookEntry}。 */
+export interface RunnableMatcherGroup {
+    matcher?: string;
+    hooks: RunnableHookEntry[];
+}
+/** 受理面通过后的 hooks 配置:每个事件下的条目都是本仓会跑的型 —— 执行侧({@link createTaskHooks})只收这一型,「不认识的类型」到不了它手里。 */
+export type RunnableHooksConfig = Partial<Record<HookEventName, RunnableMatcherGroup[]>>;
+/** 分类器点名的一块(被剔的块或整份被拒的理由):码 + 坐标 + 坏字段。 */
+export type HooksRefusalPiece = HooksDroppedPiece | HooksRejection;
 export interface ParseHooksConfigResult {
-    config?: HooksConfig;
-    /** 人可读的第一条校验错误(HTTP 层用它 400 fail-loud;resume 防御路径用它 warn)。 */
+    config?: RunnableHooksConfig;
+    /** 人可读的第一条拒因(HTTP 层用它 400 fail-loud;resume 防御路径用它 warn)。 */
     error?: string;
+    /** 拒因来自**分类器**时,它点名的每一块(数据,文档序);本仓自己的拒(条目类型 / 服务侧上限)不带这一位。一次性迁移读它按名剥键(`stored-request-hooks-m20.ts`)—— 迁移不另起读者。 */
+    pieces?: readonly HooksRefusalPiece[];
 }
 /**
  * 🔴 **S-924 → S-995(clay [ref] ③;八病审计 SG H6-d;test 7.112.0 验收 OBS ①)—— 工具事件的 matcher 选中了工具**别名**、却选不中它的正名 ⇒ fresh 提交面响亮拒。**
@@ -184,10 +220,19 @@ export declare function buildToolMatcherRefusal(issue: ToolMatcherIssue): ToolMa
  * `budget` **仅供测试注入**({@link MatcherEvalBudget});生产调用点只传前两个实参。
  * **只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。未判的 matcher 过 `recordFailOpen`(tag `MATCHER_UNJUDGED_TAG`);超预算的不是未判,是拒。
  */
-export declare function toolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): ToolMatcherIssue | undefined;
+export declare function toolMatcherIssue(config: RunnableHooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): ToolMatcherIssue | undefined;
+/** 坐标出门形:`settings.` + 契约包唯一的 stringify 点({@link formatConfigPath}),事件名等键段是用户文本 ⇒ 先过 {@link outgoingPath}(凭据形不原样回显)。 */
+export declare function hooksCoordinate(path: ConfigPath): string;
 /**
- * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
- * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。
+ * 把 wire 上的 untrusted `settings.hooks` 判成 {@link RunnableHooksConfig} + 服务侧上限 —— **hooks 配置在本仓的唯一入口**。
+ *
+ *  · **一只读者**:合不合法只问契约包的 {@link classifyHooksConfig}(入参是 `{ hooks: raw }`,与契约 zod 面 `HooksConfig` 是同一读法的投影)。本仓只收 `loaded`:
+ *    一块被剔(`loaded-partial`)或整份被拒(`rejected`)都是拒 —— wire 面「剔掉坏块、其余照装」会让写的人以为生效的钩子无声消失(分类器的宽松粒度是读设置文件的宿主用的)。
+ *    拒句 = 分类器给的**码 + 坐标 + 坏字段**经 {@link hooksPieceRefusal} 铸(分类器不写句子)。
+ *  · **本仓不执行的条目类型整份拒**:分类器受理契约的全部五型,而本仓只跑 {@link SUPPORTED_HOOK_ENTRY_TYPES}。含其余类型的配置整份拒,不留跳过臂。
+ *  · **服务侧上限**(广度闸;契约本身不设量纲)。
+ *
+ * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop(hooks 整只不采纳),由调用方选;**读者与句子两腿同一只**,后果按腿分。
  */
 export declare function parseHooksConfig(raw: unknown): ParseHooksConfigResult;
 /**
@@ -320,10 +365,10 @@ export interface LlmHookExtra {
     transcript?: string;
 }
 /**
- * 把校验过的 {@link HooksConfig} 翻成 core `Hooks` 回调(阶段二:engine-owned 9 事件全点亮)。
+ * 把校验过的 {@link RunnableHooksConfig} 翻成 core `Hooks` 回调(阶段二:engine-owned 9 事件全点亮)。
  * 没有可点亮的条目 → undefined(spec 不挂 hooks,deps 路径原样)。
  */
-export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerContext): Hooks | undefined;
+export declare function createTaskHooks(config: RunnableHooksConfig, ctx: HookRunnerContext): Hooks | undefined;
 /**
  * 把部署级 hooks 基线(deps.hooks,如 TOOL_TRACE 观测)折进 task 级 hooks——core 是整槽覆盖
  * (`spec.hooks ?? deps.hooks`),不折叠就静默 shadow 部署观测(runtask gateBaseline 注释点名的坑)。
@@ -338,4 +383,5 @@ export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerCont
  * 单在则透传。
  */
 export declare function composeHooks(deployment: Hooks | undefined, task: Hooks): Hooks;
+export {};
 //# sourceMappingURL=hook-runner.d.ts.map

package/dist/hooks/hook-runner.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
-import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
+import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
+import { formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
 import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -57,6 +58,23 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
+const HOOK_ENTRY_TYPE_RUNS = {
+    command: true,
+    http: true,
+    prompt: true,
+    agent: true,
+    mcp_tool: false,
+};
+function isSupportedHookEntryType(t) {
+    return HOOK_ENTRY_TYPE_RUNS[t];
+}
+export const SUPPORTED_HOOK_ENTRY_TYPES = HOOK_ENTRY_TYPES.filter(isSupportedHookEntryType);
+function isHookEventName(key) {
+    return HOOK_EVENTS.includes(key);
+}
+function isRunnableHookEntry(entry) {
+    return isSupportedHookEntryType(entry.type);
+}
 export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
 export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 1_000;
 export const MATCHER_ECHO_CHARS = 200;
@@ -201,23 +219,61 @@ export function toolMatcherIssue(config, depth, budget = {}) {
     }
     return undefined;
 }
+const HOOKS_PIECE_MEANING = {
+    "hooks-not-object": "`hooks` must be an object keyed by hook event name",
+    "unknown-event": "not a hook event name",
+    "event-not-array": "an event's value must be an array of matcher groups",
+    "matcher-invalid": "a matcher group must be an object with an optional string `matcher` and an array `hooks`",
+    "entry-invalid": "a hook entry must be an object whose `type` and fields are valid for that type",
+    "guard-outside-hooks": "a PreToolUse / PermissionRequest hook sits outside `hooks`",
+    "hooks-is-matcher": "`hooks` holds a matcher group or an entry directly; it must be an object keyed by hook event name",
+    "guard-under-unknown-event": "an unknown event name holds a PreToolUse / PermissionRequest hook",
+    "guard-event-not-array": "a PreToolUse / PermissionRequest event's value must be an array of matcher groups",
+    "guard-matcher-invalid": "a PreToolUse / PermissionRequest matcher group is not valid",
+    "guard-entry-invalid": "a PreToolUse / PermissionRequest hook entry is not valid",
+};
+export function hooksCoordinate(path) {
+    return `settings.${formatConfigPath(outgoingPath(path))}`;
+}
+function hooksPieceRefusal(piece) {
+    const field = piece.field !== undefined ? ` (field: ${piece.field})` : "";
+    return `${hooksCoordinate(piece.path)}: ${piece.code} — ${HOOKS_PIECE_MEANING[piece.code]}${field}`;
+}
+function unsupportedHookEntryTypeRefusal(path, type) {
+    return `${hooksCoordinate(path)}: this server does not run hook entries of type ${type}; supported: ${SUPPORTED_HOOK_ENTRY_TYPES.join(" / ")}`;
+}
 export function parseHooksConfig(raw) {
-    const parsed = HooksConfig.safeParse(raw);
-    if (!parsed.success) {
-        const first = parsed.error.issues[0];
-        return { error: `settings.hooks: ${first ? `${first.path.join(".")}: ${first.message}` : "invalid shape"}` };
+    const classified = classifyHooksConfig({ hooks: raw });
+    if (classified.outcome !== "loaded") {
+        const first = classified.outcome === "rejected" ? classified.rejections[0] : classified.dropped[0];
+        const pieces = classified.outcome === "rejected" ? classified.rejections : classified.dropped;
+        return { error: first !== undefined ? hooksPieceRefusal(first) : `${hooksCoordinate(["hooks"])}: the hooks reader refused this configuration without naming a piece`, pieces };
     }
-    const config = parsed.data;
-    for (const [event, groups] of Object.entries(config)) {
+    const loaded = classified.hooks;
+    if (loaded === undefined) {
+        return { error: hooksPieceRefusal({ code: "hooks-not-object", path: ["hooks"] }) };
+    }
+    const config = {};
+    for (const key of Object.keys(loaded)) {
+        if (!isHookEventName(key)) {
+            return { error: hooksPieceRefusal({ code: "unknown-event", path: ["hooks", key] }) };
+        }
+        const event = key;
+        const groups = loaded[event];
         if (!groups)
             continue;
         if (groups.length > MAX_HOOK_MATCHER_GROUPS) {
             return { error: `settings.hooks.${event}: ${groups.length} matcher groups exceeds cap ${MAX_HOOK_MATCHER_GROUPS}` };
         }
         let entries = 0;
-        for (const group of groups) {
-            for (const entry of group.hooks) {
+        const kept = [];
+        for (const [groupIndex, group] of groups.entries()) {
+            const hooks = [];
+            for (const [entryIndex, entry] of group.hooks.entries()) {
                 entries++;
+                if (!isRunnableHookEntry(entry)) {
+                    return { error: unsupportedHookEntryTypeRefusal(["hooks", event, groupIndex, "hooks", entryIndex, "type"], entry.type) };
+                }
                 if (entry.type === "command" && entry.command.length > MAX_HOOK_COMMAND_CHARS) {
                     return { error: `settings.hooks.${event}: command exceeds ${MAX_HOOK_COMMAND_CHARS} chars` };
                 }
@@ -237,11 +293,14 @@ export function parseHooksConfig(raw) {
                         return { error: `settings.hooks.${event}: allowedEnvVars exceeds cap ${MAX_HOOK_HTTP_HEADERS}` };
                     }
                 }
+                hooks.push(entry);
             }
+            kept.push(group.matcher !== undefined ? { matcher: group.matcher, hooks } : { hooks });
         }
         if (entries > MAX_HOOK_ENTRIES_PER_EVENT) {
             return { error: `settings.hooks.${event}: ${entries} entries exceeds cap ${MAX_HOOK_ENTRIES_PER_EVENT}` };
         }
+        config[event] = kept;
     }
     return { config };
 }
@@ -712,6 +771,23 @@ function parseHookStdout(stdout) {
         return undefined;
     }
 }
+function runRunnableEntry(entry, payload, ctx, event, llmExtra) {
+    switch (entry.type) {
+        case "http":
+            return runHttpHook(entry, payload, ctx, event);
+        case "prompt":
+            return runLlmHook(entry, payload, ctx, llmExtra);
+        case "agent":
+            return runLlmHook(entry, payload, ctx, { system: ccAgentHookSystemFor(event), event });
+        case "command":
+            return runCommandHook(entry, payload, ctx);
+        default: {
+            const unreachable = entry;
+            void unreachable;
+            throw new Error(`hook entry of an unsupported type reached the runner although parseHooksConfig admits only ${SUPPORTED_HOOK_ENTRY_TYPES.join(" / ")}`);
+        }
+    }
+}
 async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceFired, deadlineAt, keyBase, llmExtra) {
     const results = [];
     let llmEntries = 0;
@@ -731,10 +807,6 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
             const onceKey = `${keyBase ?? event}:${gi}:${ei}`;
             if (entry.once && onceFired.has(onceKey))
                 continue;
-            if (entry.type !== "command" && entry.type !== "http" && entry.type !== "prompt" && entry.type !== "agent") {
-                ctx.logger.warn("hook_entries_skipped", { event, type: entry.type, reason: "type_not_supported" });
-                continue;
-            }
             if (entry.type === "prompt" || entry.type === "agent") {
                 const carrier = entry.type === "prompt" ? ctx.hookLlm : ctx.hookAgent;
                 if (!carrier) {
@@ -771,9 +843,7 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 onceFired.add(onceKey);
             if (entry.type === "prompt" || entry.type === "agent")
                 llmEntries++;
-            const run = entry.type === "http" ? await runHttpHook(entry, payload, ctx, event)
-                : entry.type === "prompt" || entry.type === "agent" ? await runLlmHook(entry, payload, ctx, entry.type === "prompt" ? llmExtra : { system: ccAgentHookSystemFor(event), event })
-                    : await runCommandHook(entry, payload, ctx);
+            const run = await runRunnableEntry(entry, payload, ctx, event, llmExtra);
             if (run.spawnError) {
                 ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: clip(run.spawnError, 300) });
                 if (!run.noticed)

package/dist/http/admission.js

@@ -16,7 +16,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { createRunAcceptance } from "../run-acceptance.js";
-import { sendError, httpErrorCode } from "./send.js";
+import { sendError, sendHttpError } from "./send.js";
 import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
@@ -655,7 +655,7 @@ export function createAdmission(ctx) {
                     onTypedFailure(err);
                     return null;
                 }
-                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
+                sendHttpError(res, err);
                 return null;
             }
             throw err;

package/dist/http/approval-sweeps.js

@@ -73,7 +73,7 @@ export function createApprovalSweeps(ctx) {
                 return undefined;
             if (read.kind === "absent")
                 return undefined;
-            return storedBodyReplayRefusal(read.ctx, deps.config.autonomy);
+            return storedBodyReplayRefusal(read.ctx, deps.config);
         };
         let parkedSkipped = 0;
         const replaySkipped = [];
@@ -96,7 +96,7 @@ export function createApprovalSweeps(ctx) {
             deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
                 count: replaySkipped.length,
                 skipped: replaySkipped,
-                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind skill_deny_inert: a skill disallowedTools entry the engine now reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind inert_tool_list: a tool-list entry (a skill disallowedTools, an agent definition's denyTools / allowTools or the request's excludeTools / allowTools) the engine reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/checkpoint-ctx.d.ts

@@ -16,9 +16,10 @@
  *  · 拒句按「这行是在哪种读法下写的」分两句({@link ALLOW_LIST_READING_ERAS} 穷举):无记号(或记号认不得)= 名单时代;`"statement"` = 表态时代。
  *  · 体里没有 `allow`(或空数组 —— 三代都把空数组读成「没有」)的行不写记号、不受本规则影响。
  *
- * ## 第二问(7.117.0,引擎 7.42 逐字读规则条目):技能拒侧读成空的存量体
- * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
- * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
+ * ## 第二问(7.117.0 起,引擎 7.42 逐字读规则条目;7.131.0 起覆盖全部工具名清单):工具名清单读成空的存量体
+ * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里工具名清单 —— 技能(顶层 / 子代)的 `disallowedTools`(7.117.0:`"Bash "` 这类 7.41 去白后有效、
+ * 7.42 什么也不拒的条目)、子代定义的 `denyTools` / `allowTools`、顶层 `excludeTools` / `allowTools`(7.131.0:限制侧近似名 / 大小写孪生、退役名、文法读不出,放行侧只近似名)—— 有引擎读成空的条目 ⇒ 提交 400(`resolveSpec`,拒点);
+ * 存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`(`blockedBy` = 该层的拒码)。判据函数 = `rule-entry-list.ts` `inertToolListEntryOf`。
  *
  * ## 第三问(7.122.0):体里模式词的读法记号
  * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
@@ -36,7 +37,7 @@
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
- * allow 记号,技能拒侧那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
+ * allow 记号,工具名清单那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
  *
  * ## 何时删(一次性迁移,不是长期双读)
  * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件与窗登记在 `plugins/one-time-migrations.ts` 的
@@ -46,7 +47,7 @@
 import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-import type { SkillDenyInertEntry } from "../rule-entry-list.js";
+import type { InertToolListEntry } from "../rule-entry-list.js";
 /** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
  *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
 export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
@@ -140,8 +141,8 @@ export type StoredBodyReplayRefusal = {
     readonly era: AllowListReadingEra;
     readonly writerVersion?: string;
 } | {
-    readonly kind: "skill_deny_inert";
-    readonly entry: SkillDenyInertEntry;
+    readonly kind: "inert_tool_list";
+    readonly entry: InertToolListEntry;
 } | {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
@@ -168,7 +169,7 @@ export interface ResumeRefusalAnswer {
 }
 /**
  * 「续跑被一条准入策略挡住」的**唯一**铸点:`resolveSpec` 在重放存量体时抛出的 `HttpError`(400 族)折成 409 `resume_blocked_by_policy`,
- * `blockedBy` = 那条 400 的码(属主 `http/send.ts` `httpErrorCode`),`extra` 原样随体。{@link storedBodyReplayAnswer} 的技能拒侧那一臂与
+ * `blockedBy` = 那条 400 的码(属主 `http/send.ts` `httpErrorCode`),`extra` 原样随体。{@link storedBodyReplayAnswer} 的工具名清单那一臂与
  * `resume-legs.ts` 的折叠口都调它 —— 句子与码只在这里写一次(冻结门 `api-error-text-freeze` 的模板骨架表锚这一处)。
  */
 export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
@@ -179,15 +180,15 @@ export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy:
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
     era?: AllowListReadingEra;
-    layer?: SkillDenyInertEntry["layer"];
+    layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
     note: string;
 };
 /**
  * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
- * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
+ * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal, readerVersion: string): ResumeRefusalAnswer;
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -87,8 +87,8 @@ export function storedBodyReplayLogFields(refusal) {
     switch (refusal.kind) {
         case "allow_list_reading":
             return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
-        case "skill_deny_inert":
-            return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "inert_tool_list":
+            return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         default: {
@@ -103,8 +103,8 @@ export function storedBodyReplayAnswer(refusal, readerVersion) {
             const answer = allowListReadingRefusal(refusal.era);
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
-        case "skill_deny_inert":
-            return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        case "inert_tool_list":
+            return resumeBlockedByPolicyAnswer(refusal.entry.message, refusal.entry.code, refusal.entry.extra !== undefined ? { ...refusal.entry.extra } : undefined);
         case "permission_mode_reading": {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };

package/dist/http/dispatch.js

@@ -149,7 +149,7 @@ export function createDispatch(ctx) {
                 configHash,
                 pid: process.pid,
                 startedAt: PROCESS_STARTED_AT_MS,
-                port: deps.config.port,
+                port: req.socket.localPort,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...buildHealthSelfReport(deps, hasServiceAuth(deps.config)),
                 ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),

package/dist/http/resume-legs.js

@@ -422,11 +422,11 @@ export function createResumeLegs(ctx) {
         noteLateSettleIfAccepted(driven);
         return driven;
     }
-    const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
-    const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
+    const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments"];
+    const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
     const resolveResumeSpec = async (ctx, req, auth) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, {
+        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
@@ -438,7 +438,7 @@ export function createResumeLegs(ctx) {
         return storedBodyReplayAnswer(refusal, serviceVersion());
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
@@ -932,6 +932,7 @@ export function createResumeLegs(ctx) {
                                 break;
                             }
                             case "human_input":
+                                anchor.onHumanInput(ev);
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
                                 break;
@@ -1400,7 +1401,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };

package/dist/http/routes/approvals-assistant.js

@@ -22,7 +22,7 @@ import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answe
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
+import { readResumeCtx } from "../resume-ctx-read.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
-import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
@@ -12,6 +12,7 @@ import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protoco
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
+import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
 import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
@@ -44,9 +45,6 @@ function retentionAdvertisement(config) {
 export function createCapabilitiesLocal() {
     return { mcpProbe: createMcpProbeLocal() };
 }
-function sendScenarioNotFound(res) {
-    sendError(res, 404, "scenario_not_found", "scenario not found");
-}
 export async function handleCapabilities(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -149,6 +147,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
+                userAttachments: USER_ATTACHMENT_SEAT,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyKeepsOpenWriteFace(deps.config.autonomy),
@@ -225,16 +224,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "scenario must be given at most once (omit it to read this deployment's default scenario)");
                 return;
             }
-            const requestedScenario = scenarioParams[0];
-            let scenarioName;
-            if (requestedScenario === undefined)
-                scenarioName = deps.config.defaultScenario;
-            else if (deps.scenarioGate === undefined) {
-                sendScenarioNotFound(res);
-                return;
-            }
-            else
-                scenarioName = await deps.scenarioGate(principal, requestedScenario);
+            const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
             await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, scenarioName) ?? [], "deployment");
             return;
         }
@@ -265,7 +255,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 name,
                 id: m.id,
                 provider: m.provider,
-                reasoning: m.reasoning,
+                ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),

package/dist/http/routes/runs.js

@@ -632,7 +632,7 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.noResumeCtx = true;
                     return;
                 }
-                const unservable = storedBodyReplayRefusal(resumeRead.ctx, deps.config.autonomy);
+                const unservable = storedBodyReplayRefusal(resumeRead.ctx, deps.config);
                 if (unservable !== undefined) {
                     mintResult.unservable = unservable;
                     return;
@@ -743,10 +743,6 @@ export async function handleRuns(req, res, match, ctx) {
         }
         const interruptBody = interruptNormalized;
         const interruptBare = !("text" in interruptBody);
-        if (interruptBare && Object.keys(interruptBody).length > 0) {
-            sendError(res, 400, "request.body_shape", "body must be {} (bare halt: cut the in-flight turn and stop the run at this boundary) or { text: string (non-empty) } (cut + steer: the text reaches the model after the cut)");
-            return;
-        }
         let text = "";
         if (!interruptBare) {
             if (typeof interruptBody.text !== "string" || interruptBody.text.length === 0) {
@@ -754,11 +750,11 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             text = interruptBody.text;
-            const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
-            if (keyIssue) {
-                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
-                return;
-            }
+        }
+        const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
+        if (keyIssue) {
+            sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+            return;
         }
         const interruptIdemRaw = headerStr(req.headers["idempotency-key"]);
         const interruptInputId = interruptIdemRaw ? `idem-${idemKeyOf(interruptIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();