@sema-agent/server 7.131.0 → 7.132.0

package/dist/task-mcp.js

@@ -1,22 +1,19 @@
 import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
-import { describeBadWireName, isUsableWireName } from "./wire-name-bound.js";
+import { MCP_CONTENT_ORIGINS, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readMcpIdentityHeaders, } from "@sema-agent/settings-schema";
+import { describeBadContentOrigin, describeBadWireName } from "./caller-text-echo.js";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
-import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
-import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, readMcpIdentityHeaders, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
-import { echoKeyName } from "./request-key-closure.js";
+import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
+import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
+import { readPlainStringRecord } from "./plain-string-record.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
-export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
+export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
 export const STDIO_MCP_TRANSPORT_KEYS = ["args", "command", "env", "kind"];
 export const HTTP_MCP_TRANSPORT_KEYS = ["assertionHeader", "headers", "kind", "principalHeader", "url"];
-export const MCP_ENTRY_EMPTY_RECORD_KEYS = ["toolAxes", "toolFaces"];
-export const MCP_ENTRY_EMPTY_ARRAY_KEYS = ["allowTools"];
-export const MCP_TRANSPORT_EMPTY_RECORD_KEYS = ["env", "headers"];
-export const MCP_TRANSPORT_EMPTY_ARRAY_KEYS = ["args"];
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;
@@ -24,57 +21,31 @@ export function mcpInjectionHonored(config) {
         return false;
     return config.requirePrincipal !== true;
 }
-function isStringRecord(v) {
-    return !!v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
-}
 function isRecord(v) {
     return v !== null && typeof v === "object" && !Array.isArray(v);
 }
-function isStringArray(v) {
-    return Array.isArray(v) && v.every((a) => typeof a === "string");
-}
 function isElicitationFlag(v) {
     return typeof v === "boolean";
 }
-function describeShape(v) {
-    if (v === undefined)
-        return "nothing (the key is absent)";
-    if (v === null)
-        return "null";
-    if (Array.isArray(v))
-        return "an array";
-    if (typeof v === "string")
-        return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
-    if (typeof v === "object")
-        return "an object";
-    return `a ${typeof v}`;
-}
-function describeNotStringArray(v) {
-    return Array.isArray(v) ? "an array with a non-string element" : describeShape(v);
-}
-function describeNotStringRecord(v) {
-    return isRecord(v) ? "an object with a non-string value" : describeShape(v);
-}
 const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
 function readRequestTransport(t) {
     if (!t || typeof t !== "object")
-        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeShape(t)}`);
+        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
     const tr = t;
     const lost = [];
     if (tr.kind === "stdio") {
         if (typeof tr.command !== "string" || tr.command.length === 0)
-            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeShape(tr.command)}`);
+            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
         if (tr.args !== undefined && !isStringArray(tr.args))
             lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
-        if (tr.env !== undefined && !isStringRecord(tr.env))
-            lost.push({ path: "transport.env", reason: `must be an object of string values — got ${describeNotStringRecord(tr.env)}` });
+        const env = readTransportRecord("transport.env", tr.env, lost);
         return {
             ok: true,
             transport: {
                 kind: "stdio",
                 command: tr.command,
                 ...(isStringArray(tr.args) ? { args: tr.args } : {}),
-                ...(isStringRecord(tr.env) ? { env: tr.env } : {}),
+                ...(env !== undefined ? { env } : {}),
             },
             lost,
         };
@@ -83,23 +54,34 @@ function readRequestTransport(t) {
         if (typeof tr.url !== "string" || !/^https?:\/\//i.test(tr.url))
             return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
         const ids = readMcpIdentityHeaders(tr);
-        if (tr.headers !== undefined && !isStringRecord(tr.headers))
-            lost.push({ path: "transport.headers", reason: `must be an object of string values — got ${describeNotStringRecord(tr.headers)}` });
+        const headers = readTransportRecord("transport.headers", tr.headers, lost);
         if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
-            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeShape(tr.principalHeader)}` });
+            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
         }
         return {
             ok: true,
             transport: {
                 kind: "http",
                 url: tr.url,
-                ...(isStringRecord(tr.headers) ? { headers: tr.headers } : {}),
+                ...(headers !== undefined ? { headers } : {}),
                 ...ids,
             },
             lost,
         };
     }
-    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeShape(tr.kind)}`);
+    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
+}
+function readTransportRecord(path, raw, lost) {
+    if (raw === undefined)
+        return undefined;
+    const read = readPlainStringRecord(raw);
+    if (!read.ok) {
+        lost.push({ path, reason: `must be a plain object of string values — ${read.member === undefined ? read.fault : `its member "${echoKeyName("", read.member)}" ${read.fault}`}` });
+        return undefined;
+    }
+    for (const m of read.stripped)
+        lost.push({ path: echoKeyName(`${path}.`, m.name), reason: m.fault });
+    return read.record;
 }
 const bad = (field) => ({ ok: false, field });
 const MALFORMED_NAME = "<malformed>";
@@ -129,7 +111,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     let judged = axes;
     let toolAxesReread;
     if (!axes.ok && storedToolAxes !== undefined) {
-        const again = readMcpToolAxes(storedToolAxes(o.toolAxes));
+        const again = readMcpToolAxes(storedToolAxes.mcp(o.toolAxes));
         if (again.ok) {
             judged = again;
             toolAxesReread = axes.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "");
@@ -146,12 +128,14 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
             noteBadOrigin(spec.name, o.contentOrigin);
     }
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
+    if (o.startupTimeoutMs !== undefined)
+        spec.startupTimeoutMs = o.startupTimeoutMs;
     const faces = readMcpToolFaces(o.toolFaces);
     if (!faces.ok)
         return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
-    return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}) };
+    return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}), transportLost: read.lost };
 }
 export function validateRequestMcp(raw) {
     if (raw !== undefined && raw !== null && !Array.isArray(raw))
@@ -164,19 +148,22 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
     const dropped = [];
     const badContentOrigin = [];
     const toolAxesReread = [];
+    const transportLost = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
                 toolAxesReread.push({ server: v.spec.name, problem: v.toolAxesReread });
+            if (v.transportLost.length > 0)
+                transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread, transportLost };
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -195,7 +182,7 @@ export function requestEntryIdentityIssue(entry) {
         return undefined;
     return mcpIdentityHeadersIssue(t);
 }
-export function requestEntryIdentityRefusal(entry, at) {
+function requestEntryIdentityRefusal(entry, at) {
     const issue = requestEntryIdentityIssue(entry);
     if (issue === undefined || !isRecord(entry))
         return undefined;
@@ -205,14 +192,44 @@ export function requestEntryIdentityRefusal(entry, at) {
     const value = isRecord(transport) ? transport.assertionHeader : undefined;
     return entryFieldRefusal(entry, at, { path: "transport.assertionHeader", reason: describeMcpAssertionHeaderNotAString(value) });
 }
-export function assertRequestMcpEntries(bodyMcp) {
-    if (!Array.isArray(bodyMcp))
-        return;
-    for (let i = 0; i < Math.min(bodyMcp.length, MAX_REQUEST_MCP_SERVERS); i++) {
-        const refusal = requestEntryRefusal(bodyMcp[i], `mcpServers[${i}]`);
+export function requestMcpDeclarationRefusal(list) {
+    if (list === undefined || list === null)
+        return undefined;
+    if (!Array.isArray(list))
+        return listRefusal(`mcpServers is ${describeValueShape(list)}, not an array of MCP server declarations`);
+    if (list.length > MAX_REQUEST_MCP_SERVERS)
+        return listRefusal(`mcpServers carries ${list.length} declarations, above this deployment's ceiling of ${MAX_REQUEST_MCP_SERVERS}`);
+    for (let i = 0; i < list.length; i++) {
+        const refusal = requestEntryRefusal(list[i], `mcpServers[${i}]`);
         if (refusal !== undefined)
-            throw createCodedHttpError(400, refusal.errorCode, refusal.message);
+            return refusal;
     }
+    return undefined;
+}
+export function assertRequestMcpEntries(bodyMcp) {
+    const refusal = requestMcpDeclarationRefusal(bodyMcp);
+    if (refusal !== undefined)
+        throw createCodedHttpError(400, refusal.errorCode, refusal.message, refusal.unknownKeys === undefined ? undefined : { unknownKeys: [...refusal.unknownKeys] });
+}
+const LIST_REFUSAL_TAIL = "The request is refused rather than acting on part of the list: declarations that silently did not apply would read as in effect to whoever sent them. " +
+    "Fix the list (an empty list declares none).";
+function listRefusal(head) {
+    return { errorCode: "request.field_invalid", message: `${head}. ${LIST_REFUSAL_TAIL}` };
+}
+const ENTRY_KEY_SET = new Set(MCP_SERVER_ENTRY_KEYS);
+const STDIO_TRANSPORT_KEY_SET = new Set(STDIO_MCP_TRANSPORT_KEYS);
+const HTTP_TRANSPORT_KEY_SET = new Set(HTTP_MCP_TRANSPORT_KEYS);
+const NO_TOLERATED_KEYS = new Set();
+function entryUnknownKeys(entry, at) {
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(entry, `${at}.`, ENTRY_KEY_SET, NO_TOLERATED_KEYS, buckets);
+    const t = entry.transport;
+    if (isRecord(t)) {
+        const keys = t.kind === "stdio" ? STDIO_TRANSPORT_KEY_SET : t.kind === "http" ? HTTP_TRANSPORT_KEY_SET : undefined;
+        if (keys !== undefined)
+            scanKeyClosure(t, `${at}.transport.`, keys, NO_TOLERATED_KEYS, buckets);
+    }
+    return buckets.unknown.sort();
 }
 const ENTRY_KEY_JUDGES = {
     allowTools: (o) => o.allowTools === undefined || isStringArray(o.allowTools)
@@ -222,14 +239,15 @@ const ENTRY_KEY_JUDGES = {
         ? undefined
         : {
             path: "contentOrigin",
-            reason: `must be one of ${CONTENT_ORIGIN_WORDS.map((w) => `"${w}"`).join(" | ")} — got ${describeBadContentOrigin(o.contentOrigin)}` +
+            reason: `must be one of ${MCP_CONTENT_ORIGINS.map((w) => `"${w}"`).join(" | ")} — got ${describeBadContentOrigin(o.contentOrigin)}` +
                 ` (omit the key for the default: this server's tools classify as external content)`,
         },
-    elicitation: (o) => (o.elicitation === undefined || isElicitationFlag(o.elicitation) ? undefined : { path: "elicitation", reason: `must be a boolean — got ${describeShape(o.elicitation)}` }),
+    elicitation: (o) => (o.elicitation === undefined || isElicitationFlag(o.elicitation) ? undefined : { path: "elicitation", reason: `must be a boolean — got ${describeValueShape(o.elicitation)}` }),
     name: (o) => (isUsableWireName(o.name) ? undefined : { path: "name", reason: `must be a non-empty string within the wire-name length bound — got ${describeBadWireName(o.name)}` }),
     source: (o) => o.source === undefined || isMcpSourceLabel(o.source)
         ? undefined
-        : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeShape(o.source)}` },
+        : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeValueShape(o.source)}` },
+    startupTimeoutMs: () => undefined,
     toolAxes: (o) => {
         const read = readMcpToolAxes(o.toolAxes);
         return read.ok ? undefined : { path: "toolAxes", reason: read.problem };
@@ -254,7 +272,17 @@ function entryFieldRefusal(entry, at, issue) {
 }
 function requestEntryRefusal(entry, at) {
     if (!isRecord(entry))
-        return undefined;
+        return listRefusal(`${at} is ${describeValueShape(entry)}, not an MCP server declaration (an object)`);
+    const unknownKeys = entryUnknownKeys(entry, at);
+    if (unknownKeys.length > 0) {
+        return {
+            errorCode: "request.body_shape",
+            message: `body: unrecognized key(s) on an MCP declaration — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+                `${keyClosureClause(unknownKeys, "unknown (not an mcpServers[] key — check the spelling)")}. ` +
+                `Accepted per entry: ${[...MCP_SERVER_ENTRY_KEYS].sort().join(",")} (transport.kind "stdio": ${[...STDIO_MCP_TRANSPORT_KEYS].sort().join(",")}; "http": ${[...HTTP_MCP_TRANSPORT_KEYS].sort().join(",")})`,
+            unknownKeys: unknownKeys.slice(0, MAX_KEY_ECHO),
+        };
+    }
     const identity = requestEntryIdentityRefusal(entry, at);
     if (identity !== undefined)
         return identity;
@@ -265,12 +293,6 @@ function requestEntryRefusal(entry, at) {
     }
     return undefined;
 }
-export function requestEntryToolAxesRefusal(entry, at) {
-    if (!isRecord(entry))
-        return undefined;
-    const issue = ENTRY_KEY_JUDGES.toolAxes(entry);
-    return issue === undefined ? undefined : entryFieldRefusal(entry, at, issue);
-}
 export function deploymentClosedMcpNames(baseline, reservedNames) {
     return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
 }
@@ -311,7 +333,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
             entries: v.badContentOrigin,
-            allowed: CONTENT_ORIGIN_WORDS,
+            allowed: MCP_CONTENT_ORIGINS,
             note: "declaration DROPPED — these servers keep the pre-378 default (external content, session gets marked); the servers themselves still mount",
         });
     }
@@ -337,6 +359,18 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
+    for (const t of v.transportLost) {
+        if (!mounted.has(t.server))
+            continue;
+        logger?.warn("mcp_transport_members_dropped", {
+            server: t.server,
+            lost: t.lost.slice(0, MAX_KEY_ECHO),
+            ...(t.lost.length > MAX_KEY_ECHO ? { lostTotal: t.lost.length } : {}),
+            note: "this replayed request carries parts of this server's transport declaration that cannot be handed to the engine — an env / headers record that is not a plain object of string values (left out whole, as the pre-upgrade server read it), " +
+                "a member named \"__proto__\" in env / headers (only that member is left out: the engine refuses the name), args that are not a list of strings, a principalHeader that is not a string; " +
+                "the server mounts with the rest. A new submission with the same entry is refused (400)",
+        });
+    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toCoreMcpServerSpec), reservedNames),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],

package/dist/task-settings.d.ts

@@ -47,7 +47,7 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type PathRuleBases, type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
+import { type PathRuleBases, type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PermissionMode } from "@sema-agent/core";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
@@ -216,7 +216,7 @@ export interface ParsedTaskSettings {
     ultracode?: boolean;
     /** hooks hook-runner(阶段一):经 `parseHooksConfig`(契约包分类器 + 服务侧上限 + 本仓会跑的条目类型)判过的 hooks 配置。像 shellEnv 一样
      *  这里只 PARSE;应用点(main.ts resolveSpec)按单用户闸(`requirePrincipal !== true`)决定翻不翻成
-     *  core `TaskSpec.hooks` 回调——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
+     *  任务座 `TaskSpec.mods` 上的一张注册 `settings.hooks`——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
     hooks?: RunnableHooksConfig;
     /** [ref](7.77.0)—— CC settings 同名键:上下文窗口里**留给技能清单**的比例((0,1];CC 默认 0.01 = 1%)。
      *  超预算时引擎把描述裁短、再不够退成 name-only(`cli259.js` 的清单渲染算法),**从不**拒掉一条技能 ——
@@ -324,7 +324,7 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
  * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
  * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
- *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不铸 `TaskSpec.mods` 的 `settings.hooks` 注册 + 一条 `task_hooks_ignored`;
  *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
  *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
  *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
@@ -350,24 +350,10 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  value must not become active prompt content after rollout (context exhaustion / spend hole). Over-cap ⇒ dropped +
  *  warned — the rider was inert pre-upgrade, so dropping preserves the stored task's prior behavior; a 4xx here would
  *  permanently brick that task's resume instead (same defensive posture as parseTaskSettings' outputStyle drop).
- *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field). */
-/** TRUE when `text` is an ALREADY-ASSEMBLED system prompt — core's migration guard detects the same three
- *  constitution anchors and takes the pass-through assembler arm, whose section subset (OPAQUE_KEPT, dist-read)
- *  has NO `core/role.append`: any append rider (top-level or settings.outputStyle) would be SILENTLY discarded
- *  there. Shared predicate for the submit 400 gate, the resolveSpec resume mirror, and the center-declaration
- *  probe — one definition so the three gates can't drift. */
-export declare function hasConstitutionAnchors(text: unknown): boolean;
-/** codex R9 (provider-aware append-less detection): mirrors core's ACTUAL pass-through triggers instead of a raw
- *  body-text heuristic — the assembler's migration guard probes (a) `stableBlocks` identity declarations and
- *  (b) `stableSystem` OUTPUT for the three anchors; a plain `userSystemPrompt` under the DEFAULT provider (no
- *  scenario provider) never triggers it and `core/role.append` is retained, so an anchored systemPrompt there
- *  must NOT block/strip a rider (R9 false-positive: unbranded default / scan rejected valid combos). Probing
- *  calls the provider hooks with a minimal ctx — server providers (and centerPromptProvider) are pure functions
- *  of ctx, and the same hooks run again inside core's assembly; a hook throw = conservative false (core will
- *  fail the task loudly on its own). `replaceAll` owns the whole prompt(legacy free-form `system()` 腿已随 core 2.0.0 删除)
- *  (REPLACE_ALL_EXCLUDED strips role.append) → append-less true. */
-export declare function providerDropsAppend(provider: PromptProvider | undefined, userSystemPrompt: string | undefined): boolean;
-export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
+ *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field).
+ *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
+ *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
+export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
 /** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
  *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
  *  since [ref] — the sandbox lanes wire a gate of their own shape instead of no gate). */

package/dist/task-settings.js

@@ -1,7 +1,8 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
@@ -93,8 +94,9 @@ function bucketIssueMessage(f, rule) {
         case "over_cap":
             switch (rule) {
                 case "rule_policy":
-                    return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
-                        `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+                    return limitRefusal(f.field, "entries", f.count, f.cap, {
+                        tail: "Refused rather than truncated: a truncated list silently drops the rules past the cap, and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list",
+                    }).message;
                 case "allow_layer":
                     return describeAllowLayerOverCap(f.field, f.count);
             }
@@ -138,7 +140,7 @@ export function settingsPermissionBucketIssue(perms) {
                 case "allow_layer": {
                     const over = allowLayerEntryCountIssue(field, v);
                     if (over !== undefined)
-                        fields = { field, reason: "over_cap", count: over.count, cap: over.cap };
+                        fields = { field, reason: "over_cap", count: over.facts.count, cap: over.facts.cap };
                     else if (!ruleEntryListShapeOk(v))
                         fields = { field, reason: "bad_entry", index: v.findIndex((x) => typeof x !== "string") };
                     break;
@@ -262,34 +264,7 @@ export function parseTaskSettings(raw, seats = {}) {
         out.skillListingMaxDescChars = maxDesc;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
-export function hasConstitutionAnchors(text) {
-    return typeof text === "string" && text.includes(CYBER_RISK) && text.includes(URL_SAFETY) && text.includes(HARNESS_SECTION_ANCHOR);
-}
-export function providerDropsAppend(provider, userSystemPrompt) {
-    if (!provider)
-        return false;
-    if (provider.replaceAll === true)
-        return true;
-    const ctx = { userSystemPrompt, tools: [], memoryEnabled: false, consolidationEnabled: false };
-    if (provider.stableBlocks) {
-        try {
-            return provider.stableBlocks(ctx).some((d) => d.slot === "identity" && hasConstitutionAnchors(d.text));
-        }
-        catch {
-            return false;
-        }
-    }
-    if (provider.stableSystem) {
-        try {
-            return hasConstitutionAnchors(provider.stableSystem(ctx));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
-export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
+export function acceptAppendSystemPrompt(v, warn) {
     if (v === undefined)
         return undefined;
     if (typeof v !== "string" || v.length === 0) {
@@ -300,10 +275,6 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
         warn?.(`appendSystemPrompt dropped: ${v.length} chars exceeds the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (pre-cap stored body on a resume leg?)`);
         return undefined;
     }
-    if (packDropsAppend === true) {
-        warn?.("appendSystemPrompt dropped: the effective prompt pack cannot mount the append rider (assembled-identity/stableSystem pass-through, replaceAll, or legacy provider — no core/role.append section)");
-        return undefined;
-    }
     return v;
 }
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };

package/dist/text-bidi.d.ts

@@ -1,50 +1,7 @@
-/**
- * `text-bidi.ts` —— 双向控制符(bidi)与 C0 控制符字符类的**单一属主**。
- *
- * ## 为什么有这个文件
- * 同一条字符类此前在本仓有两份逐字手抄(`session-titler.ts` 的 `sanitizeTitle`、
- * `plugins/send-user-file.ts` 的 `sanitizeSendFileName`),第三份还要给审批卡的 bidi **在场检测**用。
- * 这是一条安全语义上的词表(它划定「人眼看到的顺序可能不是字节顺序」那一族码点),三份手抄必然漂移 ——
- * 单一属主的纪律与 `APPROVAL_GATE_KINDS` 同源(CLAUDE.md 硬条款:词表是闭集,不许散落副本)。
- *
- * ## 两条类刻意分开(**别合并**)
- *  · {@link BIDI_CONTROL_CHARS} —— **只有** bidi 一族(LRM/RLM、嵌入与覆写、隔离符)。它是**检测**用的:
- *    问的是「这串文本里有没有能让人眼读到与执行顺序不同的东西」。C0 控制符不属于这一问 —— 一条 Bash
- *    命令里出现换行、一段 diff 里出现制表符都是**正常**的,把它们算进来会让检测位恒为真、从而毫无判别力。
- *  · {@link CONTROL_AND_BIDI_CHARS} —— bidi ∪ C0/DEL,**清洗**用的(标题、文件名这类要落一行的短串)。
- *    清洗面比检测面宽是对的:那两处要的是「只留可打印的一行」。
- *
- * ## 案锚
- * Trojan Source([ref]②;`docs/DISEASE-SHAPES.md` 的不可见字符条):字面控制符让**人审与机器门看到
- * 两份不同的文本**。审批卡是本仓唯一一处「把模型写的命令交给人眼判断」的面,所以它需要的是**披露**
- * (告诉壳「这串里有 bidi」),不是清洗 —— 清洗会改掉即将被执行的那串字节,让卡上显示的与真正跑的不是
- * 同一个东西,那比不披露更坏。
- */
-/**
- * bidi 一族的字符类**内容**(不含方括号,便于拼进更大的类)。
- *
- * 逐字 = Unicode 的 `Bidi_Control=Yes` **全集**(12 个码点),不是「常见的那几个」:
- *  · U+061C = ALM(Arabic Letter Mark);U+200E/200F = LRM/RLM;
- *  · U+202A-202E = 嵌入/覆写族(含 RLO);U+2066-2069 = 隔离符族。
- *
- * 🔴 **U+061C 是 codex 交叉复审 [medium] 验真后补的**:首版漏了它 —— 而漏一个码点在**检测**面上不是
- * 「覆盖率差一点」,是一条完整的跳过路(只用 ALM 构造的输入让在场位缺席,壳于是照常按干净渲染)。
- * 交叉锚:core 自己的 `APPROVER_REFUSED_CHARS_RE`(`dist/core/tool-policy.js`)同样含 `\\u061c`。
- *
- * ⚠️ 与 core 那只**更宽**的集合的差额如实登记(刻意,不是漏):core 还含 C1(`\\u0080-\\u009f`)与
- * U+2028/U+2029(行/段分隔符)。那两族**不是 bidi**(不影响阅读方向),属于「不可打印 / 换行伪装」的
- * 另一问;本类是 bidi 专用,混进来会让 {@link hasBidiControls} 的语义从「方向可能骗你」滑成「有奇怪
- * 字符」。清洗面要不要跟着加宽是另一件(见 {@link CONTROL_AND_BIDI_CHARS} 的注)。
- */
-export declare const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
-/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。
- *  ⚠️ 仍**不含** C1(`€-Ÿ`)与 U+2028/U+2029:加宽是行为变更、要各自的判据支撑,不搭本批的车
- *  (登记在此,别当成漏)。两处存量消费方(标题、文件名)较其手抄前身**多剥一枚 U+061C**
- *  (经 {@link BIDI_CONTROL_CHARS} 内插带入)—— 对本清洗类是有意收紧,merge-rescan 745 验真后
- *  钉在两消费方各自的测试里;除此之外与手抄前身逐字同集。 */
-export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
+/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。bidi 半场内插 core 的类,C0/DEL 半场是本仓清洗面自己的。 */
+export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061C\\u200E\\u200F\\u202A-\\u202E\\u2066-\\u2069";
 /** 清洗用的全局正则(`String.replace` 会在返回前把 `lastIndex` 归零,故模块级常量可安全复用)。 */
 export declare const CONTROL_AND_BIDI_STRIP_RE: RegExp;
-/** 这串文本里**有没有** bidi 控制符。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
+/** 这串文本里**有没有** bidi 控制符(判官 = core 的 {@link carriesBidiControls})。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
 export declare function hasBidiControls(text: string): boolean;
 //# sourceMappingURL=text-bidi.d.ts.map

package/dist/text-bidi.js

@@ -1,8 +1,8 @@
-export const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
+import { BIDI_CONTROL_CHARS, carriesBidiControls } from "@sema-agent/core";
 export const CONTROL_AND_BIDI_CHARS = `\\u0000-\\u001f\\u007f${BIDI_CONTROL_CHARS}`;
 export const CONTROL_AND_BIDI_STRIP_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`, "g");
-const BIDI_DETECT_RE = new RegExp(`[${BIDI_CONTROL_CHARS}]`);
+const WHOLE_TEXT_SCAN = { maxNodes: 1, maxChars: Number.MAX_SAFE_INTEGER };
 export function hasBidiControls(text) {
-    return BIDI_DETECT_RE.test(text);
+    return carriesBidiControls(text, WHOLE_TEXT_SCAN);
 }
 //# sourceMappingURL=text-bidi.js.map

package/dist/tool-approval.d.ts

@@ -509,7 +509,7 @@ export interface ToolApprovalFrame {
     readRootCandidate?: ReadRootGrantCandidate;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
-     * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。
+     * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类与在场谓词的属主是 core 的 `BIDI_CONTROL_CHARS` / `carriesBidiControls`,经 `text-bidi.ts` 的 `hasBidiControls` 取)。
      *
      * 🔴 **真才带,缺席绝不编 `false`**(与 `governanceForced`/`requiresRealApproval` 同形)。缺席的含义是
      * 「没扫到」——它同时覆盖「真的没有」与「args 序列化不了(循环引用)所以扫不了」两形,消费端**禁**把

package/dist/trace/core-keyset-guard.d.ts

@@ -50,7 +50,7 @@ type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded,
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "cause" | "inputHasBidi" | "rememberRefused";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started" | "compaction_started";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
 type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -67,6 +67,16 @@ type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[
 type WiringLegHandled = "kind";
 type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
 type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
+type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
+type WiringModRowHandled = "name" | "seat" | "tier" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
+type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
+type _GuardWiringModRowReverse = AssertAllKeysHandled<Exclude<WiringModRowHandled, WiringModRowKeys>>;
+type WiringModSkipKeys = keyof NonNullable<Extract<WiringSection<"mods">[number], {
+    events: unknown;
+}>["skipped"]>[number];
+type WiringModSkipHandled = "registration" | "cause" | "reason";
+type _GuardWiringModSkip = AssertAllKeysHandled<Exclude<WiringModSkipKeys, WiringModSkipHandled>>;
+type _GuardWiringModSkipReverse = AssertAllKeysHandled<Exclude<WiringModSkipHandled, WiringModSkipKeys>>;
 type WiringAskHandled = "form" | "provenance" | "effective";
 type _GuardWiringAsk = AssertAllKeysHandled<Exclude<keyof WiringSection<"ask">, WiringAskHandled>>;
 type _GuardWiringAskReverse = AssertAllKeysHandled<Exclude<WiringAskHandled, keyof WiringSection<"ask">>>;
@@ -136,6 +146,11 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
+type PromptAssembledFrame = Extract<TraceEvent, {
+    kind: "prompt.assembled";
+}>;
+type PromptManifestNotOnRow = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["prompt_manifest"]["excluded"][number];
+type _GuardPromptManifestNotOnRowReverse = AssertAllKeysHandled<Exclude<PromptManifestNotOnRow, keyof PromptAssembledFrame>>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
@@ -148,9 +163,9 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "promptForm";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -294,6 +309,10 @@ export type CoreKeysetGuards = [
     _GuardWiringFleetReverse,
     _GuardSubagentTranscriptTierWords,
     _GuardSubagentTranscriptTierWordsReverse,
+    _GuardWiringModRow,
+    _GuardWiringModRowReverse,
+    _GuardWiringModSkip,
+    _GuardWiringModSkipReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
     _GuardWiringRules,
@@ -306,6 +325,7 @@ export type CoreKeysetGuards = [
     _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,
     _GuardPermissionTraceReverse,
+    _GuardPromptManifestNotOnRowReverse,
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
     _GuardInboxSummaryReverse,