@sema-agent/server 7.131.0 → 7.132.0

package/dist/prompts-domain-validate.js

@@ -1,122 +1,12 @@
-import { createHash } from "node:crypto";
-import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { verifyPromptArtifact } from "@sema-agent/core";
-import { PROMPT_SLOTS } from "@sema-agent/settings-schema";
-import { SHA256_DIGEST_RE } from "./digest-form.js";
-const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
-const SLOTS = PROMPT_SLOTS;
-function declarationIssue(d, where) {
-    if (d === null || typeof d !== "object")
-        return `${where}: declaration is not an object`;
-    const o = d;
-    if (typeof o.id !== "string" || o.id.length === 0 || o.id.length > 128 || !ID_RE.test(o.id))
-        return `${where}: bad id`;
-    if (o.id.startsWith("core/"))
-        return `${where}: id in the reserved core/ namespace`;
-    if (typeof o.slot !== "string" || !SLOTS.includes(o.slot))
-        return `${where}: bad slot`;
-    if (typeof o.text !== "string" || o.text.length === 0)
-        return `${where}: text must be a non-empty string`;
-    if (typeof o.contentHash !== "string" || !SHA256_DIGEST_RE.test(o.contentHash))
-        return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
-    const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
-    if (o.contentHash !== expected)
-        return `${where}: contentHash does not match sha256(text) — stale or altered declaration`;
-    return undefined;
-}
-export function validateCenterPrompts(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const p = raw;
-    if (typeof p.packId !== "string" || !/^center:[0-9a-f]{12}$/.test(p.packId))
-        return { ok: false, error: "bad packId form (center:<digest12>)" };
-    if (typeof p.contentDigest !== "string" || !SHA256_DIGEST_RE.test(p.contentDigest))
-        return { ok: false, error: "bad contentDigest form" };
-    const arrayIssue = (decls, where) => {
-        if (!Array.isArray(decls))
-            return `${where} is not an array`;
-        if (decls.length === 0)
-            return `${where} is empty (an empty replacement set is not a v1 semantic — omit the key instead)`;
-        const seen = new Set();
-        for (let i = 0; i < decls.length; i++) {
-            const issue = declarationIssue(decls[i], `${where}[${i}]`);
-            if (issue)
-                return issue;
-            const id = decls[i].id;
-            if (seen.has(id))
-                return `${where}[${i}]: duplicate id "${id}" (core composer throws on duplicates)`;
-            seen.add(id);
-        }
-        return undefined;
-    };
-    const sectionsIssue = arrayIssue(p.sections, "sections");
-    if (sectionsIssue)
-        return { ok: false, error: sectionsIssue };
-    if (p.scenarioOverrides !== undefined) {
-        if (p.scenarioOverrides === null || typeof p.scenarioOverrides !== "object" || Array.isArray(p.scenarioOverrides)) {
-            return { ok: false, error: "scenarioOverrides is not an object" };
-        }
-        for (const [name, decls] of Object.entries(p.scenarioOverrides)) {
-            const issue = arrayIssue(decls, `scenarioOverrides[${name}]`);
-            if (issue)
-                return { ok: false, error: issue };
-        }
-    }
-    return { ok: true, value: raw };
-}
-export const CORE_ENGINE_VERSION = (() => {
-    try {
-        const entry = createRequire(import.meta.url).resolve("@sema-agent/core");
-        return JSON.parse(readFileSync(join(dirname(entry), "..", "package.json"), "utf8")).version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-})();
-export function validatePromptsDomain(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const w = raw;
-    if (w.schemaVersion === undefined) {
-        return { ok: false, error: "prompts payload has no schemaVersion — the legacy flat shape was retired in 5.0.0; wrap as {schemaVersion:1, declarations:{...}} (registry-core EffectivePromptsWire)" };
-    }
-    if (w.schemaVersion !== 1)
-        return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };
-    if (w.declarations === undefined && w.catalog === undefined)
-        return { ok: false, error: "dual-axis prompts carries neither axis (at least one of declarations|catalog required)" };
-    const value = { identity: "", axes: [] };
-    if (w.declarations !== undefined) {
-        const d = validateCenterPrompts(w.declarations);
-        if (!d.ok)
-            return { ok: false, error: `declarations axis: ${d.error}` };
-        value.declarations = d.value;
-        value.axes.push("declarations");
-    }
-    if (w.catalog !== undefined) {
-        const c = verifyPromptArtifact(w.catalog, { engineVersion: CORE_ENGINE_VERSION });
-        if (!c.ok)
-            return { ok: false, error: `catalog axis: ${c.code}: ${c.reason}` };
-        value.catalog = w.catalog;
-        value.axes.push("catalog");
-    }
-    value.identity = `${value.declarations?.contentDigest ?? "-"}+${value.catalog?.artifact.artifactDigest ?? "-"}`;
-    return { ok: true, value };
-}
-export function centerPromptsFromEffective(eff) {
-    const prompts = eff?.prompts;
-    if (prompts === undefined || prompts === null)
-        return undefined;
-    if (typeof prompts !== "object" || Array.isArray(prompts))
-        return prompts;
-    const o = prompts;
-    if ("schemaVersion" in o)
-        return prompts;
-    if ("packId" in o && "contentDigest" in o && "sections" in o)
-        return prompts;
-    if (o.catalog !== undefined)
-        return { schemaVersion: 1, catalog: o.catalog };
-    return undefined;
+import { EffectivePromptsWire, formatConfigPath, sanitizeZodError } from "@sema-agent/settings-schema";
+export function judgePromptsWire(raw) {
+    const wire = EffectivePromptsWire.safeParse(raw);
+    if (!wire.success) {
+        const issues = sanitizeZodError(wire.error).issues.map((i) => `${i.path.length === 0 ? "prompts" : `prompts.${formatConfigPath(i.path.map((s) => (typeof s === "number" ? s : String(s))))}`}: ${i.message}`);
+        return { ok: false, error: issues.join("; ") };
+    }
+    const verified = verifyPromptArtifact(wire.data.artifact);
+    return verified.ok ? { ok: true, artifact: verified.artifact } : { ok: false, error: `prompts.artifact refused by the engine (${verified.code}): ${verified.reason}` };
 }
 //# sourceMappingURL=prompts-domain-validate.js.map

package/dist/request-key-closure.d.ts

@@ -1,8 +1,8 @@
 /** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
  *  放大成流量面。超出部分只报数。 */
 export declare const MAX_KEY_ECHO = 20;
-/** 键名回显的清洗:剥控制/双向字符(键名进的是 JSON 错误体与运维日志,一个 RLO 能把两行字读反),
- *  再按 {@link MAX_KEY_ECHO_CHARS} 截断。清洗之外**逐字**,不做大小写/近似猜测。 */
+/** 键名回显 = 前缀 + 调用方串的唯一回显口径(`caller-text-echo.ts`:剥控制 / 双向字符、截到 64 字 + …;键名进的是 JSON 错误体与运维日志,
+ *  一个 RLO 能把两行字读反)。清洗之外**逐字**,不做大小写/近似猜测。 */
 export declare function echoKeyName(prefix: string, key: string): string;
 /** 一次键闭集裁决的产物:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
 export interface KeyClosureIssue {

package/dist/request-key-closure.js

@@ -1,9 +1,7 @@
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { echoCallerText } from "./caller-text-echo.js";
 export const MAX_KEY_ECHO = 20;
-const MAX_KEY_ECHO_CHARS = 64;
 export function echoKeyName(prefix, key) {
-    const clean = key.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return `${prefix}${clean.length > MAX_KEY_ECHO_CHARS ? `${clean.slice(0, MAX_KEY_ECHO_CHARS)}…` : clean}`;
+    return `${prefix}${echoCallerText(key)}`;
 }
 export function scanKeyClosure(bag, prefix, accepted, tolerated, into) {
     for (const k of Object.keys(bag)) {

package/dist/rule-entry-list.d.ts

@@ -17,7 +17,7 @@
  *     运维 / 中心的审批名单读同一份,没有「这一处空名册、那一处带名册」的两种读法。
  *     **读成空的哪些原因词是拒面,按方向定**:**限制侧**(读成空 = 静默放行:技能 `disallowedTools`、`excludeTools` / 子代 `denyTools`、`settings.permissions.deny` / `ask`、运维 / 中心的审批名单)四类全拒 ——
  *     近似名 · 退役名 · 文法读不出 · 不带内容形的工具带内容;**放行侧**(读成空 = 想放的什么也没放:`settings.permissions.allow`、根 / 子代 `allowTools`、技能 `allowedTools`)**只拒近似名**
- *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(引擎侧的终形是把退役名归一到现名并在用户面点名,到货前放行侧不拒 ——
+ *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(其中选择器清单 `allowTools` 里**有后继**的退役名〔`Task` ⇒ `Agent`、`bash` ⇒ `Bash`〕core 7.52.0 起由引擎开跑前拒,不在本仓拒面;规则表上的退役名引擎照旧告运维 ——
  *     壳转投的 CC 用户 settings 里这些极常见,尤其内容形里的 `$VAR`(`Bash(echo $HOME)`)读成 `grammar`,拒了 = 每次提交 400)。运维的 `APPROVAL_GRANT` 是运维自己的配置:任何读成空都拒启(写错了当场改)。
  *     技能拒侧那一拒与引擎 #1372(core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
  *     `checkpoint.config_refused`(`config.skill_deny_unreadable`)答得不一(资源停车续跑腿 500、`/decide` 先结了卡、`/wake` 先铸了 run 行),先统一那一层再退
@@ -29,6 +29,7 @@
  *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧 `mcp__*` / `a2a__*`(整个协议的拒)合法。
  */
 import { compileAllowList } from "@sema-agent/core";
+import { type LimitRefusal } from "./limit-refusal.js";
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
 export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
 /**
@@ -42,14 +43,10 @@ export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[
  * 没有真实用法需要上千条」。抬不抬这个数是产品判断,不随提货改。
  */
 export declare const MAX_ALLOW_LAYER_ENTRIES = 1000;
-/** 超帽的拒句(不截:截掉的尾项读起来像「在生效」)—— 句子的唯一铸点(请求 allow 桶的 wire 拒体按字段重铸也调它)。 */
+/** 超帽的拒句({@link allowLayerOverCap} 的句子;请求 allow 桶的拒句按字段重铸时读它)。 */
 export declare function describeAllowLayerOverCap(field: string, count: number): string;
-/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒句 + 机读两数;没超 ⇒ `undefined`。四张表同调这一只。 */
-export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): {
-    readonly message: string;
-    readonly count: number;
-    readonly cap: number;
-} | undefined;
+/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒(句子 + 机读位 `field` / `reason: "over_cap"` / `count` / `cap`);没超 ⇒ `undefined`。四张表同调这一只。 */
+export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): LimitRefusal | undefined;
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /**
@@ -150,6 +147,12 @@ export declare function replayInertEntry(layer: ToolListLayer | RulePolicyLayer,
 export interface SkillDenyInertEntry extends InertToolListEntry {
     readonly layer: SkillListLayer;
 }
+/**
+ * 一条技能(顶层 `skills[k]` / 子代 `agents[i].skills[j]`,`at` = 它的体内坐标)两只清单的**条数帽**:先 `allowedTools` 后 `disallowedTools`(与 7.131.0 的判序同)。
+ * 判与句子就是 {@link overCapOfList} 那一只(拒点 `resolveSpec` 两腿同经的 {@link inertToolListEntryOf} 先过的也是它):受理口在技能的两道形门处调它
+ * (`http/admission.ts` 的 `validateUserSkills` 与 `spec-fields.ts` 的 `validateTaskAgents`:两道门都逐条先形、后帽 —— 与 7.131.0 的拒点与判序同,码与先后不变),句子与机读位点体内坐标。
+ */
+export declare function skillToolListsOverCap(skill: unknown, at: string, scope: "top" | "agent"): InertToolListEntry | undefined;
 /**
  * ③ 的拒侧在**提交体**上的判,技能那两层(顶层 `skills[]` 与子代 `agents[].skills[]`;第一处命中即答)。全部工具名清单的判是 {@link inertToolListEntryOf}(调用点两处都调它);
  * 本函数单独导出是给随包排空脚本:那条判据(`skill-deny-inert`)只数技能这两层,SQL 车道的孪生也只看技能的清单。
@@ -167,7 +170,7 @@ export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntr
  * 本函数只是「在体的哪几处取清单」;句子只有一个有界的组句器({@link describeInertRuleEntries}),清单先过条数帽({@link allowLayerEntryCountIssue})。
  *
  * 为什么限制侧四类全拒、放行侧只拒近似名:引擎 7.51.x 把「没有任何工具答应的名字」改成条目原样保留 + 运维行告知一次。限制侧读成空 = **静默放行**(`denyTools:["BASH"]` 以为禁了 `Bash`,子代照用);
- * 放行侧读成空 = 想放的什么也没放 —— 其中**近似名**(现名唯一)是确定的笔误,拒并点名现名;**退役名**、**内容形**与**文法读不出**在放行侧照 7.130.0 受理、交引擎既有通告(见头注 ③)。
+ * 放行侧读成空 = 想放的什么也没放 —— 其中**近似名**(现名唯一)是确定的笔误,拒并点名现名;**退役名**(选择器清单里有后继的由引擎开跑前拒)、**内容形**与**文法读不出**在放行侧照 7.130.0 受理、交引擎既有通告(见头注 ③)。
  * **真未知名**(没有近似也没有退役对应)不在读成空之列,原样保留、告运维一次(之后挂上同名工具即生效)。请求的 `settings.permissions.deny` / `ask`
  * 与运维 / 中心的审批名单读同一张名册,走另一只入口({@link unmatchableToolNamesRefusal},`config.ts`),不在本函数(存体预判调同一只判据、home 同源于部署配置,见 `http/stored-body-replay.ts`)。
  *

package/dist/rule-entry-list.js

@@ -1,16 +1,18 @@
 import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
+import { limitRefusal } from "./limit-refusal.js";
 import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
+const ALLOW_LAYER_OVER_CAP_TAIL = "Refused rather than truncated: a truncated list silently drops the entries past the cap. Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list";
+function allowLayerOverCap(field, count) {
+    return limitRefusal(field, "entries", count, MAX_ALLOW_LAYER_ENTRIES, { tail: ALLOW_LAYER_OVER_CAP_TAIL });
+}
 export function describeAllowLayerOverCap(field, count) {
-    return (`${field} has ${count} entries — at most ${MAX_ALLOW_LAYER_ENTRIES} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the cap. ` +
-        `Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list`);
+    return allowLayerOverCap(field, count).message;
 }
 export function allowLayerEntryCountIssue(field, list) {
-    if (list.length <= MAX_ALLOW_LAYER_ENTRIES)
-        return undefined;
-    return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
+    return list.length <= MAX_ALLOW_LAYER_ENTRIES ? undefined : allowLayerOverCap(field, list.length);
 }
 export function inertRuleEntriesOf(list, behavior) {
     return compileAllowList(list, behavior, TOOL_NAME_ROSTER).inert;
@@ -114,14 +116,16 @@ function inertEntriesOfList(list, layer) {
 function* toolListsOf(body) {
     const skills = body["skills"];
     if (Array.isArray(skills)) {
-        for (const skill of skills) {
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
             if (!isPlainRecord(skill))
                 continue;
-            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", list: skill["disallowedTools"] };
+            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", at: `skills[${k}].disallowedTools`, list: skill["disallowedTools"] };
         }
-        for (const skill of skills) {
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
             if (isPlainRecord(skill))
-                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", list: skill["allowedTools"] };
+                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", at: `skills[${k}].allowedTools`, list: skill["allowedTools"] };
         }
     }
     const agents = body["agents"];
@@ -134,7 +138,7 @@ function* toolListsOf(body) {
             for (let j = 0; j < agentSkills.length; j++) {
                 const skill = agentSkills[j];
                 if (isPlainRecord(skill))
-                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["disallowedTools"] };
+                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].disallowedTools`, list: skill["disallowedTools"] };
             }
         }
         for (let i = 0; i < agents.length; i++) {
@@ -145,31 +149,29 @@ function* toolListsOf(body) {
             for (let j = 0; j < agentSkills.length; j++) {
                 const skill = agentSkills[j];
                 if (isPlainRecord(skill))
-                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["allowedTools"] };
+                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].allowedTools`, list: skill["allowedTools"] };
             }
         }
         for (let i = 0; i < agents.length; i++) {
             const agent = agents[i];
             if (!isPlainRecord(agent))
                 continue;
-            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", list: agent["denyTools"] };
-            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", list: agent["allowTools"] };
+            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", at: `agents[${i}].denyTools`, list: agent["denyTools"] };
+            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", at: `agents[${i}].allowTools`, list: agent["allowTools"] };
         }
     }
-    yield { layer: "excludeTools", field: "excludeTools", prefix: "", list: body["excludeTools"] };
-    yield { layer: "allowTools", field: "allowTools", prefix: "", list: body["allowTools"] };
+    yield { layer: "excludeTools", field: "excludeTools", prefix: "", at: "excludeTools", list: body["excludeTools"] };
+    yield { layer: "allowTools", field: "allowTools", prefix: "", at: "allowTools", list: body["allowTools"] };
     const settings = body["settings"];
     const permissions = isPlainRecord(settings) ? settings["permissions"] : undefined;
     if (isPlainRecord(permissions))
-        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", list: permissions["allow"] };
+        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: permissions["allow"] };
 }
 function entryOfList(l) {
     const face = TOOL_LIST_FACES[l.layer];
-    if (Array.isArray(l.list)) {
-        const over = allowLayerEntryCountIssue(l.field, l.list);
-        if (over !== undefined)
-            return { layer: l.layer, side: face.side, code: LIST_OVER_CAP_CODE, message: `${l.prefix}${over.message}`, extra: { field: l.field, reason: "over_cap", count: over.count, cap: over.cap } };
-    }
+    const over = overCapOfList(l);
+    if (over !== undefined)
+        return over;
     if (!ruleEntryListShapeOk(l.list))
         return undefined;
     const inert = inertEntriesOfList(l.list, l.layer);
@@ -177,6 +179,20 @@ function entryOfList(l) {
         return undefined;
     return { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` };
 }
+function overCapOfList(l) {
+    if (!Array.isArray(l.list))
+        return undefined;
+    const over = allowLayerEntryCountIssue(l.at, l.list);
+    return over === undefined ? undefined : { layer: l.layer, side: TOOL_LIST_FACES[l.layer].side, code: LIST_OVER_CAP_CODE, message: over.message, extra: over.facts };
+}
+export function skillToolListsOverCap(skill, at, scope) {
+    if (!isPlainRecord(skill))
+        return undefined;
+    const allowLayer = scope === "top" ? "skills.allowedTools" : "agents.skills.allowedTools";
+    const denyLayer = scope === "top" ? "skills" : "agents.skills";
+    return (overCapOfList({ layer: allowLayer, field: "skill.allowedTools", prefix: "", at: `${at}.allowedTools`, list: skill["allowedTools"] }) ??
+        overCapOfList({ layer: denyLayer, field: "skill.disallowedTools", prefix: "", at: `${at}.disallowedTools`, list: skill["disallowedTools"] }));
+}
 function firstInertEntry(body, acceptLayer, acceptSide) {
     if (!isPlainRecord(body))
         return undefined;

package/dist/run-local.js

@@ -8,7 +8,7 @@ import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { BIDI_CONTROL_CHARS, Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { readAskClassPair } from "./approval-card.js";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
@@ -18,14 +18,13 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, buildAppr
 import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { applyCatalogToSource } from "./capabilities/center-prompts.js";
-import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
-import { buildUnreadConfigFileFields } from "./web-admin-client/read-warnings.js";
+import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
@@ -37,7 +36,7 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildPromptSeats, buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
@@ -50,7 +49,7 @@ import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
-import { createPermissionDeniedMeter } from "./observability/tool-trace.js";
+import { assertDeploymentModsAdmitted, createDeploymentMods } from "./boot/deployment-mods.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { fatalExit } from "./boot/fatal-exit.js";
@@ -254,8 +253,9 @@ function argsDisplayOf(args) {
 function buildLocalAskPrompt(req, argsShown) {
     return `approve "${terminalSafeText(req.toolName)}"? ${terminalSafeText(req.message)}\n  ${argsShown}\n[y/N] `;
 }
+const TERMINAL_UNSAFE_RE = new RegExp(`[\\u0000-\\u001f\\u007f-\\u009f${BIDI_CONTROL_CHARS}\\u200b-\\u200d\\u2028\\u2029\\u2060-\\u2065\\ufeff]`, "g");
 function terminalSafeText(text) {
-    return text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    return text.replace(TERMINAL_UNSAFE_RE, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
 function inputAlreadyEnded(input) {
     const state = input;
@@ -366,6 +366,8 @@ export async function runLocal(argv, deps = {}) {
             else {
                 for (const f of r.unreadFiles ?? [])
                     logger.warn("config_unread_file", buildUnreadConfigFileFields(f, configProvider.kind === "local" ? root : undefined));
+                for (const k of r.unreadKeys ?? [])
+                    logger.warn("config_unread_key", buildUnreadConfigKeyFields(k, configProvider.kind === "local" ? root : undefined));
                 for (const d of r.droppedEntries ?? [])
                     logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
                 applying = true;
@@ -488,25 +490,25 @@ export async function runLocal(argv, deps = {}) {
             return new CenterPromptSource({
                 store: new FilePromptArtifactStore(promptEpochDir),
                 stateStore: new FilePromptSourceStateStore(promptEpochDir),
-                engineVersion: CORE_ENGINE_VERSION,
+                onError: centerSourceOnError(logger),
             });
         }
         catch (e) {
             logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback; built-ins unaffected" });
-            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), onError: centerSourceOnError(logger) });
         }
     })();
     try {
         await promptSource.restore();
         if (candidatePrompts !== undefined) {
-            await applyCatalogToSource(promptSource, candidatePrompts, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, candidatePrompts, undefined, logger, "run-local");
         }
         else {
-            await applyCatalogToSource(promptSource, undefined, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, undefined, undefined, logger, "run-local");
         }
     }
     catch (e) {
-        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "catalog candidate absent — built-ins serve" });
+        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "center candidate absent — built-ins serve" });
     }
     let refusedWithoutPerson = 0;
     const onAsk = createLocalApprover({
@@ -559,6 +561,8 @@ export async function runLocal(argv, deps = {}) {
             { name: "toolResultStore", store: fileBackend.toolResultStore },
         ],
     });
+    const deploymentMods = createDeploymentMods({ metrics, brandIdentity: true });
+    await assertDeploymentModsAdmitted(deploymentMods);
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
@@ -575,10 +579,7 @@ export async function runLocal(argv, deps = {}) {
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         mailboxStore: fileBackend.mailboxStore,
         rosterStore: fileBackend.rosterStore,
-        deploymentHooks: {
-            ...createPermissionDeniedMeter(metrics),
-            ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
-        },
+        deploymentMods,
         toolResultStore: fileBackend.toolResultStore,
         checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
@@ -604,7 +605,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
-    const deploymentSkills = loadDeploymentSkills(config);
+    const deploymentSkills = loadDeploymentSkills(config, logger);
     const skills = effective?.skills ? await applySkillsManifest(deploymentSkills, effective.skills, configProvider, logger) : deploymentSkills;
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
@@ -615,7 +616,6 @@ export async function runLocal(argv, deps = {}) {
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,
-        brandIdentity: true,
     };
     const scenarios = buildScenarios(scenarioDeps);
     if (effective?.scenarios) {
@@ -673,7 +673,7 @@ export async function runLocal(argv, deps = {}) {
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
-        ...(cap.promptProvider ? { promptProvider: cap.promptProvider } : {}),
+        ...buildPromptSeats(scenarioName, cap.prompt, undefined),
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),

package/dist/runs.d.ts

@@ -109,6 +109,12 @@ export declare function resumeAtHttpStatus(result: {
  * `resumeAtHttpStatus` 自己(单元测试直接喂码)。
  */
 export declare function syncRefusalHttpStatus(result: Pick<TaskResult, "terminal" | "stats">): number | undefined;
+/**
+ * 同步腿零工作拒体的机读事实(交 `refusalBody` 的 `facts`)—— 唯一一处。入参是**出口封口 + 脱敏后**的终局(调用方递 `redactTerminalResult(sealResultForExit(result)).terminal`,
+ * 与 run 记录读面 / 流式 `done.result` 上的 `terminal` 同一只来源),本函数只按码取它的 `detail.detail`,不另读、不另脱。码不在登记表里、终局不是 `failed`、
+ * 引擎没给 `coded` 因由 ⇒ `{}`(缺席不造键)。
+ */
+export declare function zeroWorkRefusalFacts(terminal: unknown): Readonly<Record<string, unknown>>;
 /**
  * 一条提交腿把引擎终局落行之后的**唯一**收尾:**零工作的拒不占提交幂等键**。判据就是上面这只 {@link syncRefusalHttpStatus}
  * (零 turn、零 token 且是 prepare 期的拒码)—— 三条提交腿(同步 / 流式 / durable)同调这一只,不另开判据。

package/dist/runs.js

@@ -78,7 +78,10 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.image_invalid": 400,
     "config.user_attachment_invalid": 400,
     "config.tool_face_control": 400,
+    "config.agent.unknown_tool": 400,
+    "config.legacy_tool_name": 400,
     "config.memory_capture_unsupported": 409,
+    "prompt.assembled_role_refused": 400,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -106,6 +109,19 @@ export function syncRefusalHttpStatus(result) {
         return undefined;
     return resumeAtHttpStatus(result);
 }
+const ZERO_WORK_REFUSAL_DETAIL_CODES = new Set(["config.user_attachment_invalid"]);
+export function zeroWorkRefusalFacts(terminal) {
+    if (terminal === null || typeof terminal !== "object")
+        return {};
+    const t = terminal;
+    if (t.kind !== "failed" || typeof t.code !== "string" || !ZERO_WORK_REFUSAL_DETAIL_CODES.has(t.code))
+        return {};
+    const cause = t.detail;
+    if (cause === null || typeof cause !== "object")
+        return {};
+    const c = cause;
+    return c.kind === "coded" && c.detail !== undefined ? { detail: c.detail } : {};
+}
 export async function releaseKeyIfZeroWorkRefusal(runStore, taskId, result) {
     if (syncRefusalHttpStatus(result) !== undefined)
         await runStore.releaseIdemKey(taskId);