@sema-agent/server 7.130.0 → 7.132.0

package/dist/rule-entry-list.js

@@ -1,23 +1,29 @@
-import { compileAllowList } from "@sema-agent/core";
+import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
-import { NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
+import { limitRefusal } from "./limit-refusal.js";
+import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
+const ALLOW_LAYER_OVER_CAP_TAIL = "Refused rather than truncated: a truncated list silently drops the entries past the cap. Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list";
+function allowLayerOverCap(field, count) {
+    return limitRefusal(field, "entries", count, MAX_ALLOW_LAYER_ENTRIES, { tail: ALLOW_LAYER_OVER_CAP_TAIL });
+}
 export function describeAllowLayerOverCap(field, count) {
-    return (`${field} has ${count} entries — at most ${MAX_ALLOW_LAYER_ENTRIES} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the cap. ` +
-        `Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list`);
+    return allowLayerOverCap(field, count).message;
 }
 export function allowLayerEntryCountIssue(field, list) {
-    if (list.length <= MAX_ALLOW_LAYER_ENTRIES)
-        return undefined;
-    return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
+    return list.length <= MAX_ALLOW_LAYER_ENTRIES ? undefined : allowLayerOverCap(field, list.length);
 }
 export function inertRuleEntriesOf(list, behavior) {
-    return compileAllowList(list, behavior, NO_DECLARED_TOOL_NAMES).inert;
+    return compileAllowList(list, behavior, TOOL_NAME_ROSTER).inert;
+}
+function peerSegmentIsWild(entry) {
+    const at = entry.indexOf("__");
+    return at >= 0 && (entry.slice(at + 2).split("__")[0] ?? "").includes("*");
 }
 export function inertRuleEntryGuidance(i) {
     const reason = i.reason;
-    const write = i.currentName !== undefined ? ` — write ${displayListEntry(i.currentName)}` : "";
+    const write = i.currentName !== undefined && !peerSegmentIsWild(i.entry) ? ` — write ${displayListEntry(i.currentName)}` : "";
     switch (reason) {
         case "tool_name":
             return `the tool name can never match a mounted tool (${i.verdict ?? "stale"})${write}`;
@@ -39,30 +45,87 @@ export function inertRuleEntryGuidance(i) {
         }
     }
 }
+export const MAX_NAMED_INERT_ENTRIES = 5;
 export function describeInertRuleEntries(field, inert) {
-    return inert.map((i) => `${field} entry ${displayListEntry(i.entry)} reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+    const named = inert.slice(0, MAX_NAMED_INERT_ENTRIES).map((i) => `${field} entry ${displayListEntry(i.entry)} reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+    const more = inert.length - MAX_NAMED_INERT_ENTRIES;
+    return more > 0 ? `${named}; and ${more} more` : named;
+}
+const TOOL_LIST_FACES = {
+    "skills": { side: "deny", kind: "rule_table", code: "request.field_invalid" },
+    "agents.skills": { side: "deny", kind: "rule_table", code: "request.field_invalid" },
+    "skills.allowedTools": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+    "agents.skills.allowedTools": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+    "agents.denyTools": { side: "deny", kind: "selector", code: "config.agent.unknown_tool" },
+    "agents.allowTools": { side: "allow", kind: "selector", code: "config.agent.unknown_tool" },
+    "excludeTools": { side: "deny", kind: "selector", code: "config.tool_face_control" },
+    "allowTools": { side: "allow", kind: "selector", code: "config.tool_face_control" },
+    "settings.permissions.allow": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+};
+const LIST_OVER_CAP_CODE = "request.field_invalid";
+export function replayInertEntry(layer, side, code, message, extra) {
+    return { layer, side, code, message, ...(extra !== undefined ? { extra } : {}) };
 }
 const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-function skillDenyInertSentence(skill) {
-    if (!isPlainRecord(skill))
-        return undefined;
-    const deny = skill["disallowedTools"];
-    if (!ruleEntryListShapeOk(deny))
-        return undefined;
-    const inert = inertRuleEntriesOf(deny, "deny");
-    if (inert.length === 0)
-        return undefined;
-    return `${describeInertRuleEntries("skill.disallowedTools", inert)} — a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect`;
+const REFUSAL_TAIL = {
+    deny: "a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect",
+    allow: "an allow entry that reads as nothing admits nothing, so it is refused here rather than taken as in effect",
+};
+function selectorEntryName(entry) {
+    return entry !== entry.trim() ? entry : parsePermissionRule(entry).toolName;
 }
-export function skillDenyInertEntryOf(body) {
-    if (!isPlainRecord(body))
-        return undefined;
+const isProtocolWideName = (name) => PROTOCOL_TABLE.some((e) => name === `${e.prefix}*`);
+function selectorInertEntriesOf(list, side) {
+    return list.flatMap((entry) => {
+        if (entry === "*" && side === "allow")
+            return [];
+        const name = selectorEntryName(entry);
+        if (side === "deny" && isProtocolWideName(name))
+            return [];
+        const inert = compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
+        return side === "allow" ? inert.filter((i) => allowSideReadsAsNothing(i.reason)) : inert;
+    });
+}
+function allowSideReadsAsNothing(reason) {
+    switch (reason) {
+        case "near_miss":
+            return true;
+        case "grammar":
+        case "tool_name":
+        case "content_unsupported":
+        case "wildcard_all":
+        case "namespace_wildcard":
+            return false;
+        case "earlier_grammar":
+            throw new Error(`allow-entry inert reason ${JSON.stringify(reason)} belongs to the session-rule store's bucket reading, never to an allow list`);
+        default: {
+            const unhandled = reason;
+            throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);
+        }
+    }
+}
+function requestAllowRuleInertEntriesOf(list) {
+    return list.flatMap((entry) => compileAllowList([entry], "allow", TOOL_NAME_ROSTER).inert.filter((i) => allowSideReadsAsNothing(i.reason)));
+}
+function inertEntriesOfList(list, layer) {
+    const face = TOOL_LIST_FACES[layer];
+    if (face.kind === "selector")
+        return selectorInertEntriesOf(list, face.side);
+    return face.side === "deny" ? inertRuleEntriesOf(list, "deny") : requestAllowRuleInertEntriesOf(list);
+}
+function* toolListsOf(body) {
     const skills = body["skills"];
     if (Array.isArray(skills)) {
-        for (const skill of skills) {
-            const sentence = skillDenyInertSentence(skill);
-            if (sentence !== undefined)
-                return { layer: "skills", message: sentence };
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
+            if (!isPlainRecord(skill))
+                continue;
+            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", at: `skills[${k}].disallowedTools`, list: skill["disallowedTools"] };
+        }
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
+            if (isPlainRecord(skill))
+                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", at: `skills[${k}].allowedTools`, list: skill["allowedTools"] };
         }
     }
     const agents = body["agents"];
@@ -73,12 +136,81 @@ export function skillDenyInertEntryOf(body) {
             if (!Array.isArray(agentSkills))
                 continue;
             for (let j = 0; j < agentSkills.length; j++) {
-                const sentence = skillDenyInertSentence(agentSkills[j]);
-                if (sentence !== undefined)
-                    return { layer: "agents.skills", message: `agents[${i}]: skills[${j}]: ${sentence}` };
+                const skill = agentSkills[j];
+                if (isPlainRecord(skill))
+                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].disallowedTools`, list: skill["disallowedTools"] };
             }
         }
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            const agentSkills = isPlainRecord(agent) ? agent["skills"] : undefined;
+            if (!Array.isArray(agentSkills))
+                continue;
+            for (let j = 0; j < agentSkills.length; j++) {
+                const skill = agentSkills[j];
+                if (isPlainRecord(skill))
+                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].allowedTools`, list: skill["allowedTools"] };
+            }
+        }
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            if (!isPlainRecord(agent))
+                continue;
+            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", at: `agents[${i}].denyTools`, list: agent["denyTools"] };
+            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", at: `agents[${i}].allowTools`, list: agent["allowTools"] };
+        }
+    }
+    yield { layer: "excludeTools", field: "excludeTools", prefix: "", at: "excludeTools", list: body["excludeTools"] };
+    yield { layer: "allowTools", field: "allowTools", prefix: "", at: "allowTools", list: body["allowTools"] };
+    const settings = body["settings"];
+    const permissions = isPlainRecord(settings) ? settings["permissions"] : undefined;
+    if (isPlainRecord(permissions))
+        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: permissions["allow"] };
+}
+function entryOfList(l) {
+    const face = TOOL_LIST_FACES[l.layer];
+    const over = overCapOfList(l);
+    if (over !== undefined)
+        return over;
+    if (!ruleEntryListShapeOk(l.list))
+        return undefined;
+    const inert = inertEntriesOfList(l.list, l.layer);
+    if (inert.length === 0)
+        return undefined;
+    return { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` };
+}
+function overCapOfList(l) {
+    if (!Array.isArray(l.list))
+        return undefined;
+    const over = allowLayerEntryCountIssue(l.at, l.list);
+    return over === undefined ? undefined : { layer: l.layer, side: TOOL_LIST_FACES[l.layer].side, code: LIST_OVER_CAP_CODE, message: over.message, extra: over.facts };
+}
+export function skillToolListsOverCap(skill, at, scope) {
+    if (!isPlainRecord(skill))
+        return undefined;
+    const allowLayer = scope === "top" ? "skills.allowedTools" : "agents.skills.allowedTools";
+    const denyLayer = scope === "top" ? "skills" : "agents.skills";
+    return (overCapOfList({ layer: allowLayer, field: "skill.allowedTools", prefix: "", at: `${at}.allowedTools`, list: skill["allowedTools"] }) ??
+        overCapOfList({ layer: denyLayer, field: "skill.disallowedTools", prefix: "", at: `${at}.disallowedTools`, list: skill["disallowedTools"] }));
+}
+function firstInertEntry(body, acceptLayer, acceptSide) {
+    if (!isPlainRecord(body))
+        return undefined;
+    for (const l of toolListsOf(body)) {
+        if (!acceptLayer(l.layer))
+            continue;
+        const entry = entryOfList(l);
+        if (entry === undefined)
+            continue;
+        if (entry.extra !== undefined || acceptSide(entry.side))
+            return entry;
     }
     return undefined;
 }
+export function skillDenyInertEntryOf(body) {
+    return firstInertEntry(body, (layer) => layer === "skills" || layer === "agents.skills", () => true);
+}
+export function inertToolListEntryOf(body, sides = ["allow", "deny"]) {
+    return firstInertEntry(body, () => true, (side) => sides.includes(side));
+}
 //# sourceMappingURL=rule-entry-list.js.map

package/dist/run-local.d.ts

@@ -54,15 +54,15 @@ export declare class UsageError extends Error {
  * set: …" list rather than letting the first brain call crash with a cryptic auth error. Returns a list of
  * missing items (empty = OK).
  *
- * 🔴 S-623:这里**不再**判网关 base URL。「配置能派发到的每一条 openai 路由都解析到显式端点」是 `loadConfig()`
- * 那一层的拒启判据(`model-route-endpoint.ts`,本入口在预检之前就调 `loadConfig()` —— 没设网关的配置根本走不到
+ * 🔴 S-623:这里**不再**判网关 base URL。「将要服务的那张表里每一条 openai 路由都解析到显式端点」是配置源应用之后的拒启判据
+ * (`model-route-endpoint.ts` 的 `judgeServedModelRoute`,本入口在预检之前就判过 —— 没设网关的配置根本走不到
  * 这里),原来那条臂(a)是它的一份更弱的手抄:注释要求「本机用户必须指向自己的网关」,判据却只查 `/v1` 后缀,
  * 旧的出厂缺省值恰好以 `/v1` 结尾 ⇒ 缺省值照样过(本仓自己也被骗)。`/v1` 后缀本身也一并删,理由三条:
  *  ① 同一个问题两个判官 —— `serve` 从不要求 `/v1`,同一份 .env 在 `serve` 起得来、在 `run-local` 被拒;
  *  ② 它会误拒真实存在的 OpenAI 兼容端点(DeepSeek 根路径直接服务 `/chat/completions`,本仓
  *     `src/bench/s1/live-deps.ts` 用的正是 `https://api.deepseek.com`;Gemini 的兼容面 `…/v1beta/openai`、Azure 的
  *     `…/openai/deployments/<name>` 也都不以 `/v1` 结尾);
- *  ③ 规则集只许变小:端点判据只有 loadConfig 那一只。
+ *  ③ 规则集只许变小:端点判据只有 `model-route-endpoint.ts` 那一只。
  *
  * NOTE: with an injected mock `brain` the gateway is irrelevant (no real call is made), so the caller skips
  * this check in that case — the check is about a REAL run, not the assembly.

package/dist/run-local.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
+import { servedModelTableLeg } from "./model-select.js";
 import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { BIDI_CONTROL_CHARS, Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { readAskClassPair } from "./approval-card.js";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
@@ -17,14 +18,13 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, buildAppr
 import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { applyCatalogToSource } from "./capabilities/center-prompts.js";
-import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
-import { buildUnreadConfigFileFields } from "./web-admin-client/read-warnings.js";
+import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
@@ -36,20 +36,20 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, gateScenarioRequest, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildPromptSeats, buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
 import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
-import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
-import { createPermissionDeniedMeter } from "./observability/tool-trace.js";
+import { assertDeploymentModsAdmitted, createDeploymentMods } from "./boot/deployment-mods.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { fatalExit } from "./boot/fatal-exit.js";
@@ -253,8 +253,9 @@ function argsDisplayOf(args) {
 function buildLocalAskPrompt(req, argsShown) {
     return `approve "${terminalSafeText(req.toolName)}"? ${terminalSafeText(req.message)}\n  ${argsShown}\n[y/N] `;
 }
+const TERMINAL_UNSAFE_RE = new RegExp(`[\\u0000-\\u001f\\u007f-\\u009f${BIDI_CONTROL_CHARS}\\u200b-\\u200d\\u2028\\u2029\\u2060-\\u2065\\ufeff]`, "g");
 function terminalSafeText(text) {
-    return text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    return text.replace(TERMINAL_UNSAFE_RE, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
 function inputAlreadyEnded(input) {
     const state = input;
@@ -365,6 +366,8 @@ export async function runLocal(argv, deps = {}) {
             else {
                 for (const f of r.unreadFiles ?? [])
                     logger.warn("config_unread_file", buildUnreadConfigFileFields(f, configProvider.kind === "local" ? root : undefined));
+                for (const k of r.unreadKeys ?? [])
+                    logger.warn("config_unread_key", buildUnreadConfigKeyFields(k, configProvider.kind === "local" ? root : undefined));
                 for (const d of r.droppedEntries ?? [])
                     logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
                 applying = true;
@@ -386,12 +389,12 @@ export async function runLocal(argv, deps = {}) {
         else
             logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
-    const noDefaultModel = defaultModelRefusal(config, "env");
+    const noDefaultModel = defaultModelRefusal(config, servedModelTableLeg(config));
     if (noDefaultModel !== undefined)
         throw new Error(noDefaultModel);
-    const endpointRefusal = modelRouteEndpointRefusal(config);
-    if (endpointRefusal !== undefined)
-        throw new Error(endpointRefusal);
+    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false });
+    if (routeVerdict !== undefined)
+        throw new Error(routeVerdict.reason);
     const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
     if (unpricedCeiling)
         logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
@@ -487,25 +490,25 @@ export async function runLocal(argv, deps = {}) {
             return new CenterPromptSource({
                 store: new FilePromptArtifactStore(promptEpochDir),
                 stateStore: new FilePromptSourceStateStore(promptEpochDir),
-                engineVersion: CORE_ENGINE_VERSION,
+                onError: centerSourceOnError(logger),
             });
         }
         catch (e) {
             logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback; built-ins unaffected" });
-            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), onError: centerSourceOnError(logger) });
         }
     })();
     try {
         await promptSource.restore();
         if (candidatePrompts !== undefined) {
-            await applyCatalogToSource(promptSource, candidatePrompts, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, candidatePrompts, undefined, logger, "run-local");
         }
         else {
-            await applyCatalogToSource(promptSource, undefined, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, undefined, undefined, logger, "run-local");
         }
     }
     catch (e) {
-        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "catalog candidate absent — built-ins serve" });
+        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "center candidate absent — built-ins serve" });
     }
     let refusedWithoutPerson = 0;
     const onAsk = createLocalApprover({
@@ -558,6 +561,8 @@ export async function runLocal(argv, deps = {}) {
             { name: "toolResultStore", store: fileBackend.toolResultStore },
         ],
     });
+    const deploymentMods = createDeploymentMods({ metrics, brandIdentity: true });
+    await assertDeploymentModsAdmitted(deploymentMods);
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
@@ -574,10 +579,7 @@ export async function runLocal(argv, deps = {}) {
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         mailboxStore: fileBackend.mailboxStore,
         rosterStore: fileBackend.rosterStore,
-        deploymentHooks: {
-            ...createPermissionDeniedMeter(metrics),
-            ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
-        },
+        deploymentMods,
         toolResultStore: fileBackend.toolResultStore,
         checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
@@ -603,7 +605,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
-    const deploymentSkills = loadDeploymentSkills(config);
+    const deploymentSkills = loadDeploymentSkills(config, logger);
     const skills = effective?.skills ? await applySkillsManifest(deploymentSkills, effective.skills, configProvider, logger) : deploymentSkills;
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
@@ -614,7 +616,6 @@ export async function runLocal(argv, deps = {}) {
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,
-        brandIdentity: true,
     };
     const scenarios = buildScenarios(scenarioDeps);
     if (effective?.scenarios) {
@@ -625,7 +626,7 @@ export async function runLocal(argv, deps = {}) {
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
-        scenarioName = gateScenarioRequest(undefined, args.scenario, config.defaultScenario, Object.keys(scenarios), logger);
+        scenarioName = await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario);
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {
@@ -672,7 +673,7 @@ export async function runLocal(argv, deps = {}) {
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
-        ...(cap.promptProvider ? { promptProvider: cap.promptProvider } : {}),
+        ...buildPromptSeats(scenarioName, cap.prompt, undefined),
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),

package/dist/runs.d.ts

@@ -109,6 +109,12 @@ export declare function resumeAtHttpStatus(result: {
  * `resumeAtHttpStatus` 自己(单元测试直接喂码)。
  */
 export declare function syncRefusalHttpStatus(result: Pick<TaskResult, "terminal" | "stats">): number | undefined;
+/**
+ * 同步腿零工作拒体的机读事实(交 `refusalBody` 的 `facts`)—— 唯一一处。入参是**出口封口 + 脱敏后**的终局(调用方递 `redactTerminalResult(sealResultForExit(result)).terminal`,
+ * 与 run 记录读面 / 流式 `done.result` 上的 `terminal` 同一只来源),本函数只按码取它的 `detail.detail`,不另读、不另脱。码不在登记表里、终局不是 `failed`、
+ * 引擎没给 `coded` 因由 ⇒ `{}`(缺席不造键)。
+ */
+export declare function zeroWorkRefusalFacts(terminal: unknown): Readonly<Record<string, unknown>>;
 /**
  * 一条提交腿把引擎终局落行之后的**唯一**收尾:**零工作的拒不占提交幂等键**。判据就是上面这只 {@link syncRefusalHttpStatus}
  * (零 turn、零 token 且是 prepare 期的拒码)—— 三条提交腿(同步 / 流式 / durable)同调这一只,不另开判据。
@@ -137,6 +143,38 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  * surfaces the degrade (a metric) so a SYSTEMATIC failure — e.g. an un-migrated DB missing `resume_anchor` — is
  * observable instead of a silent feature outage.
  */
+/**
+ * 「这一次用户消息提交是不是一句**提问**」的唯一读法 —— 三处用户回退锚(后台腿与续跑腿的 {@link TurnAnchorCapture}、`/v1/tasks/stream`
+ * 腿的 `userMsgEntryId`)同调这一只。
+ *
+ * 目标声明了附件时,引擎把每只附件铸成**一条自己的用户消息**,紧跟在目标后面提交(core `human_input.attachments` 顶注:
+ * 「each attachment is delivered as its own message after the objective; its `message_committed` is the delivery」)。
+ * 所以一次带 N 只附件的提交会出 1 + N 次 `message_committed{role:"user"}`,而「回到这条提问」的锚要的是**人的那条**
+ * (core 的 `resumeAt` 认它:「a `resumeAt` that keeps the message keeps its group」;以附件帧作 `resumeAt` 引擎拒 `resume_at.not_a_message`),
+ * 不是排在最后的附件帧。目标**之前**还可能有引擎排队的注入消息同批提交(亲读 core `engine/harness/agent-harness.js` 的 `takePrompts`:
+ * 排队消息 ⇒ 目标 ⇒ 附件帧;真案 = 工作区是 git 仓且带图时,git 状态帧单独排在目标前面),所以「窗口里第一次用户提交」不是判据。
+ *
+ * **为什么是「窗口 + 严格吻合」而不是读标记**:`message_committed` 上只有 `entryId / role / toolCallId?`,附件帧与用户真提交在事件上**不可辨认**;
+ * 落盘的行上有标记(`attachment` 键;引擎收尾的中断标记带 `provenance: "engine-note"`),但事件到手的那一刻本仓读不到那一行
+ * (会话店面没有按条目读的口,只有整日志导出),所以只能数。数的前提是「目标之后紧接恰好 N 只帧、其后才是别的」—— 前提成立才落锚,
+ * **不成立就不猜**:猜错的锚会落在附件帧上(引擎拒)或引擎的中断标记上(回到的不是用户那句)。
+ *
+ * 读法:
+ *  · `human_input{delivery:"applied"}` 带 N 只附件 ⇒ 开窗;窗内的用户提交只攒、不落锚(此刻还不知道它们是不是『目标 + N 只帧』)。
+ *  · 窗被**非用户提交**(第一次助手消息 / 工具结果)关上 ⇒ 窗内共 k 次用户提交,k ≥ N+1 时提问 = 倒数第 N+1 次(严格吻合);k < N+1(帧数不符)⇒ 不猜。
+ *  · 窗被 `turn_end` 先切断 ⇒ 第一次模型调用没出任何提交就收了(halt / interrupt / 空失败):窗里可能夹着引擎收尾的中断标记,数 N 会落在帧或标记上 ⇒ 不猜。
+ *  · 窗内又应用了一条别的输入(`human_input{applied}`,如第一次模型调用前排进来的 steer;事件先于它的正文提交到手)⇒ 窗里多了一条别人的消息,数 N 会落在帧上 ⇒ 窗作废、不猜,
+ *    之后的用户提交(含那条 steer 正文)是窗口之外的提交,最后一次赢。排队未应用(`delivery: "queued"`)的输入不动窗。
+ *  · 「不猜」= 返回 `undefined`、这次提交不落锚;拿这次 run 的 taskId 去 `resumeAt` 得 404 `resume_at.unknown_event`(文案点名这一类成因)。
+ *    窗口之外的用户提交(如 interrupt 带话的 steer 正文,在 `turn_end` 之后提交)照修前读法(是提问,最后一次赢)。
+ * 返回这次提交之后的提问 `entryId`(调用方照旧「最后一次赢」地落锚),不是提问相关的提交返回 `undefined`。
+ *
+ * 退役条件:引擎在落盘的帧上(`message_committed`)带上附件标记之日,本读法整体换成「按标记判一次」(零计数、无窗口、无拒臂),
+ * 窗口 / 严格吻合 / 不猜三臂与 `resume_at.unknown_event` 文案里对应的那一句一并删除。
+ */
+export declare function createPromptCommitReader(): (ev: {
+    readonly type: string;
+}) => string | undefined;
 export declare class TurnAnchorCapture {
     private readonly capture;
     private readonly onCaptureFail?;
@@ -151,6 +189,8 @@ export declare class TurnAnchorCapture {
     /** The turn's FIRST text_delta eventId = the message's stable resume handle (also stamped on the durable text event). */
     firstTextEventId: string | undefined;
     private turnHadTool;
+    /** 用户提交是不是提问的唯一读法({@link createPromptCommitReader};附件帧不是提问)。 */
+    private readonly promptCommit;
     constructor(capture: ((eventId: string) => Promise<void>) | undefined, onCaptureFail?: (() => void) | undefined, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
@@ -160,9 +200,15 @@ export declare class TurnAnchorCapture {
      *  Keyed by the run's taskId (the handle the shell already holds from the POST response — no eventId→entryId
      *  side map / no `getLeafId` inference needed). The assistant-turn capture above stays as an additive bonus. */
     captureUser?: ((entryId: string) => Promise<void>) | undefined);
+    /** A `human_input` arrived — the objective's declared attachments open the frame window of {@link createPromptCommitReader}. */
+    onHumanInput(ev: {
+        readonly type: string;
+    }): void;
     /** A `message_committed` arrived — capture a USER-message rewind anchor (CC parity). Best-effort (a failure only
-     *  makes that one prompt non-rewindable). Only `role==="user"`; assistant/toolResult committed entries are handled
-     *  by the turn-text path (assistant) or deliberately not anchored (toolResult — `resumeAt` rejects them). */
+     *  makes that one prompt non-rewindable). Only a user commit that is a PROMPT (not an attachment frame trailing the
+     *  objective — {@link createPromptCommitReader}; an attachment window is decided when a non-user commit closes it, so
+     *  the anchor of an attachment-carrying prompt lands on THAT call); assistant/toolResult committed entries are handled by
+     *  the turn-text path (assistant) or deliberately not anchored (toolResult — `resumeAt` rejects them). */
     onMessageCommitted(role: string | undefined, entryId: string | undefined): Promise<void>;
     /** A text_delta arrived — latch the first DEFINED eventId as the message handle (eventId is optional on the stream). */
     onText(eventId: string | undefined): void;

package/dist/runs.js

@@ -76,8 +76,12 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
     "config.image_invalid": 400,
+    "config.user_attachment_invalid": 400,
     "config.tool_face_control": 400,
+    "config.agent.unknown_tool": 400,
+    "config.legacy_tool_name": 400,
     "config.memory_capture_unsupported": 409,
+    "prompt.assembled_role_refused": 400,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -105,24 +109,75 @@ export function syncRefusalHttpStatus(result) {
         return undefined;
     return resumeAtHttpStatus(result);
 }
+const ZERO_WORK_REFUSAL_DETAIL_CODES = new Set(["config.user_attachment_invalid"]);
+export function zeroWorkRefusalFacts(terminal) {
+    if (terminal === null || typeof terminal !== "object")
+        return {};
+    const t = terminal;
+    if (t.kind !== "failed" || typeof t.code !== "string" || !ZERO_WORK_REFUSAL_DETAIL_CODES.has(t.code))
+        return {};
+    const cause = t.detail;
+    if (cause === null || typeof cause !== "object")
+        return {};
+    const c = cause;
+    return c.kind === "coded" && c.detail !== undefined ? { detail: c.detail } : {};
+}
 export async function releaseKeyIfZeroWorkRefusal(runStore, taskId, result) {
     if (syncRefusalHttpStatus(result) !== undefined)
         await runStore.releaseIdemKey(taskId);
 }
+export function createPromptCommitReader() {
+    let attachmentWindow;
+    return (ev) => {
+        if (ev.type === "human_input") {
+            const h = ev;
+            if (h.delivery !== "applied")
+                return undefined;
+            attachmentWindow = Array.isArray(h.attachments) && h.attachments.length > 0 ? { frames: h.attachments.length, commits: [] } : undefined;
+            return undefined;
+        }
+        if (ev.type === "turn_end") {
+            attachmentWindow = undefined;
+            return undefined;
+        }
+        if (ev.type !== "message_committed")
+            return undefined;
+        const c = ev;
+        const entryId = typeof c.entryId === "string" && c.entryId.length > 0 ? c.entryId : undefined;
+        if (c.role === "user") {
+            if (attachmentWindow !== undefined) {
+                attachmentWindow.commits.push(entryId);
+                return undefined;
+            }
+            return entryId;
+        }
+        const closed = attachmentWindow;
+        attachmentWindow = undefined;
+        if (closed === undefined || closed.commits.length < closed.frames + 1)
+            return undefined;
+        return closed.commits[closed.commits.length - 1 - closed.frames];
+    };
+}
 export class TurnAnchorCapture {
     capture;
     onCaptureFail;
     captureUser;
     firstTextEventId;
     turnHadTool = false;
+    promptCommit = createPromptCommitReader();
     constructor(capture, onCaptureFail, captureUser) {
         this.capture = capture;
         this.onCaptureFail = onCaptureFail;
         this.captureUser = captureUser;
     }
+    onHumanInput(ev) {
+        this.promptCommit(ev);
+    }
     async onMessageCommitted(role, entryId) {
-        if (role === "user" && entryId && this.captureUser) {
-            await this.captureUser(entryId).catch(() => this.onCaptureFail?.());
+        const committed = { type: "message_committed", role, entryId };
+        const prompt = this.promptCommit(committed);
+        if (prompt !== undefined && this.captureUser) {
+            await this.captureUser(prompt).catch(() => this.onCaptureFail?.());
         }
     }
     onText(eventId) {
@@ -135,6 +190,7 @@ export class TurnAnchorCapture {
         this.turnHadTool = true;
     }
     async onTurnEnd() {
+        this.promptCommit({ type: "turn_end" });
         if (this.firstTextEventId && !this.turnHadTool && this.capture) {
             await this.capture(this.firstTextEventId).catch(() => this.onCaptureFail?.());
         }
@@ -373,6 +429,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     case "status":
                         metrics?.inc("brain_retry_total", { phase: String(ev.phase) });
                         break;
+                    case "human_input":
+                        anchor.onHumanInput(ev);
+                        break;
                     case "message_committed":
                         await anchor.onMessageCommitted(ev.role, ev.entryId);
                         break;