@sema-agent/server 7.131.0 → 7.133.0

package/dist/capabilities/scenarios.d.ts

@@ -1,13 +1,14 @@
-import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type TaskListStore, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
+import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type Runner, type SkillSpec, type TaskListStore, type TaskSpec, type ToolSpec, type WebSearchConfig, USER_ATTACHMENT_SEAT } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import { type SubagentExtraToolSet } from "./builtin-tools.js";
 import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill } from "./skills.js";
-import type { ScenarioHands } from "./hands-lane.js";
+import { type ScenarioHands } from "./hands-lane.js";
+import type { DelegationRootWitness } from "../delegated-session-owner.js";
 /**
  * Scenario routing — a deployment serves many scenarios from one image. Each request's `scenario`
- * selects a pre-wired capability bundle: tools (incl. subagent roster) + a whole-harness prompt +
- * skills. Heavy bits (HTTP clients, skill files) are startup singletons; per task we only bind
+ * selects a pre-wired capability bundle: tools (incl. subagent roster) + its prompt seats + skills.
+ * Heavy bits (HTTP clients, skill files) are startup singletons; per task we only bind
  * coordinates and build cheap closures, so there is no per-request "assembly" cost.
  */
 export interface ScenarioRequest {
@@ -26,12 +27,45 @@ export interface ScenarioBundle {
      * `scan` 声明 clone-free 四件、实际拿到全量可写手)。
      */
     hands: ScenarioHands;
-    promptProvider?: PromptProvider;
+    /**
+     * S-1376:本场景从 roster 里**真卸载**的工具名(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,schema 不进 `tools[]`;不是策略 deny)。缺席 = 不卸。
+     * 经 {@link buildExcludeToolsSeat} 与调用方自己的 `excludeTools` 取并后写进 `TaskSpec`(HTTP 腿与 run-local 腿同一只写点)—— 场景只能多卸,调用方也只能多卸。
+     * 与 `hands` 正交:`hands: "none"` 是整只手不挂(scan / code-review),本键是挂手之后卸掉其中一部分(cowork 卸编码类工具、留文件读)。
+     */
+    excludeTools?: readonly string[];
+    /** 本场景对提示的贡献(缺席 = 不贡献:引擎目录的缺省角色)。经 {@link buildPromptSeats} 写进 `TaskSpec`,这是场景到提示的唯一通道。 */
+    prompt?: ScenarioPrompt;
     /** [ref] 场景解释层定死的终验开关(core TaskSpec.finalVerification):bench 实测产品默认请求与
      *  bench 态差距三件之一。[ref] 起无场景定死(autonomous 退役)——纯 caller 显式旋钮;spec 组装处 OR 折入(场景只会
      *  多加一轮收官验证,绝不收窄 caller 意图),壳/caller 不感知。 */
     finalVerification?: true;
 }
+/**
+ * 一个场景对提示的贡献 —— 只有两个座,都是 `TaskSpec` 上的任务类座位:
+ *  · `role`:选目录里的哪一种角色基底(`TaskSpec.promptRole`;缺席 = 引擎缺省 `general`);
+ *  · `roleText`:场景自己的角色文本,写在调用方 `systemPrompt` 之前一起进 `TaskSpec.systemPrompt`(它整替选中的角色基底)。
+ * 两者都**不许**是引擎目录的文本(抄目录文本 = 第二份文本;逐字含锁定段的角色文本引擎在 prepare 拒 `prompt.assembled_role_refused`)。
+ * 宪法、行为段、记忆段、追加段的落位全归引擎。
+ */
+export interface ScenarioPrompt {
+    readonly role?: NonNullable<TaskSpec["promptRole"]>;
+    readonly roleText?: string;
+}
+/**
+ * 一次请求写进 `TaskSpec` 的提示座 —— **`promptBinding` 的唯一写点**,HTTP 腿(`resolveSpec`)与 `run-local` 同用这一只:
+ *  · `promptBinding` = 场景名,恒写:它是引擎提示选择器的一维,每一类 overlay(中心 artifact / 部署注册 / 任务)的 `when.binding` 都读它 ——
+ *    不写 ⇒ 每条 `anyOf` 恒假、每条 `noneOf` 恒真,按场景定向的中心段与部署的品牌行全部失效。场景名过了场景门的文法
+ *    (`SCENARIO_NAME_RE`,≤ 32 个 ASCII 字)⇒ 恒在引擎 binding 文法之内(非空白、≤ `PROMPT_BINDING_MAX_CHARS` 码点);委派子代经父 spec 座继承它。
+ *  · `promptRole` = 场景的角色选择器(缺席 = 引擎缺省 `general`);
+ *  · `systemPrompt` = 角色文本(场景自己的在前、调用方 `systemPrompt` 在后,`\n\n` 相连;空串不占位;两者都缺席 ⇒ 键不写,调用方给的空串原样交引擎)。
+ */
+export declare function buildPromptSeats(scenarioName: string, prompt: ScenarioPrompt | undefined, callerSystemPrompt: string | undefined): Pick<TaskSpec, "promptBinding" | "promptRole" | "systemPrompt">;
+/**
+ * 一次请求写进 `TaskSpec` 的**工具卸载座** —— `excludeTools` 的唯一写点,HTTP 腿(`resolveSpec`)与 `run-local` 同用这一只(同 {@link buildPromptSeats}):
+ * 场景自己的卸载名单在前,调用方请求体里的 `excludeTools` 接在后(两边都只会**多卸**,调用方拿不回场景卸掉的)。
+ * 场景没有卸载名单 ⇒ 调用方的名单**逐字原样**(不去重、不重排;缺席 ⇒ 键不写),这是 cowork 之前所有场景的字节形。
+ */
+export declare function buildExcludeToolsSeat(scenarioExcludes: readonly string[] | undefined, callerExcludes: readonly string[] | undefined): Pick<TaskSpec, "excludeTools">;
 /**
  * [ref]:场景工厂的**服务端事实**上下文 —— 与 `req`(= 调用方请求体,不可信)分开的第三个入参。
  * 这里的每一位都由鉴权信道解析,调用方无法自报;新增位一律走本接口,绝不往 `req` 上加。
@@ -43,11 +77,19 @@ export interface ScenarioContext {
      * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「sessionId comes from `auth`, NEVER the
      * body」的逐字纪律)。
      *
-     * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对深于一层的行只取 boot 期那只裸 Agent 工具、
+     * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对不交座的行、boot 期那一次 Agent 工具探针、
      * `builtinScenarioDetails` 的工具名探针)。此时会话级设施退化为 per-call 实例 —— 不为它发明
      * 一个假 session。
      */
     sessionId?: string;
+    /**
+     * S-1770 / S-1808:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
+     * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
+     * `rootSessionId` 与赎回腿 claim 前后两读的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
+     * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
+     * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客晋升或认领。
+     */
+    delegationRoot?: DelegationRootWitness;
 }
 export type Scenario = (req: ScenarioRequest, principal?: string, ctx?: ScenarioContext) => ScenarioBundle;
 export interface ScenarioDeps {
@@ -61,6 +103,11 @@ export interface ScenarioDeps {
      *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/untrusted tenant model
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
+    /**
+     * S-1652:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
+     * 「这个场景的 run 有没有工作区」({@link runHasWorkspace}),进而给出附件可受理供给集。**缺席按没有手读**(宁少说不多说:不广告一个会撞 400 的 `path`)。
+     */
+    handsLane?: boolean;
     /** Deployment-injected WebSearch backend (Brave/Tavily/SearXNG via `WEB_SEARCH_PROVIDER`). When set,
      *  `assembleCodeTools` mounts the WebSearch tool; absent ⇒ not assembled (core ships no search backend). */
     webSearch?: WebSearchConfig;
@@ -70,14 +117,6 @@ export interface ScenarioDeps {
      *  字节形,core 落「summarization unavailable」诚实兜底)。 */
     webFetchSummarize?: NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
     logger?: Logger;
-    /**
-     * When true, the `default` scenario carries the Sema product identity (see {@link semaIdentityProvider}).
-     * Set by the local/TOC deployment (CONFIG_PROVIDER=local / run-local) so the local engine answers "who
-     * are you" as Sema instead of the model's hallucinated identity. Business scenarios (code-review)
-     * keep their own prompts; cloud (CONFIG_PROVIDER≠local) leaves the default scenario neutral unless turned
-     * on, so integrators that inject their own persona are unaffected.
-     */
-    brandIdentity?: boolean;
     /**
      * core 1.287 `SubagentToolOptions.extraTools` seam wire-through — per-SPAWN dynamic tool injection into the
      * delegated (Agent-tool) child roster. Deployment-injected per-task tools (today: SendUserFile — its instance is
@@ -112,7 +151,12 @@ export interface ScenarioDeps {
      *    后续按需再做)。
      */
     checkpointStore?: CheckpointStore;
-    ensureChildSessionDurable?: (sessionId: string) => Promise<void>;
+    /**
+     * S-1770:比 core 挂点多一个参数 —— `root` = **委派树根的见证,由取用这只 bundle 的调用方交出**({@link ScenarioContext.delegationRoot};缺席 = 没有根可交)。
+     * core 的挂点只给子代 id,停驻写下 / 定夺的宿主行属主却要按委派继承律取委派树根的属主;场景工厂把见证绑进交给 core 的那只闭包,同一棵树里任何深度的后台子代
+     * 停驻都经它(子代沿用父的委派工具实例)。
+     */
+    ensureChildSessionDurable?: (sessionId: string, root: DelegationRootWitness | undefined) => Promise<void>;
     /**
      * [ref]([ref] F2 症状 → [ref] 定谳):**会话级**任务清单店解析器,属主 =
      * `boot/task-list-lane.ts` 的 {@link import("../boot/task-list-lane.js").createTaskListLane}
@@ -126,8 +170,9 @@ export interface ScenarioDeps {
     taskListStoreFor?: (sessionId: string) => TaskListStore;
 }
 /**
- * Sema product identity, prepended to the core default base for the `default` scenario when
- * {@link ScenarioDeps.brandIdentity} is on. Honest about the substrate (the engine runs whichever model
+ * Sema product identity — the brand line of the `default` / `code` scenarios on a branded deployment (local / TOC). It is not a
+ * scenario seat: it is one deployment-class overlay (`capabilities/brand-identity.ts`, minted by `createDeploymentMods`) whose
+ * `when.binding` names the two scenarios. Honest about the substrate (the engine runs whichever model
  * the operator configured — not Claude/Anthropic), so the agent never inherits the model's training-time
  * "I am Claude" hallucination.
  *
@@ -138,34 +183,10 @@ export interface ScenarioDeps {
  * that maker's misstate its own substrate. Same for
  * the gateway protocol (the brain stack serves Anthropic-compatible routes too — routing brain +
  * createAnthropicBrain — so "OpenAI-compatible gateway" would be the same class of lie). Neutral wording
- * (zero core-seam need; interpolating the model id would need a `StablePromptContext.model`
- * seam and reads poorly for ugly preset ids). The anti-"I am Claude" design is kept — only the baked
+ * (interpolating the model id reads poorly for ugly preset ids). The anti-"I am Claude" design is kept — only the baked
  * substrate facts are removed.
  */
 export { SEMA_IDENTITY } from "./prompts/identity.js";
-/**
- * Prompt provider for the branded `default` scenario: SEMA_IDENTITY on top of the ROLE base — the
- * task's own `body.systemPrompt`, or core's {@link DEFAULT_SYSTEM_PROMPT} when none. Core 1.243
- * (提示词主权批) appends the constitution structurally AFTER this role layer (harness
- * safety blocks + modes + memory guidance + the prefix-cache-safe `<user_memory>` tail), so identity
- * cannot displace the safety blocks. The pre-1.243 form (identity + `defaultPromptProvider.stableSystem`,
- * i.e. an ALREADY-assembled prompt) would now trip the migration guard (anchor-detect → pass-through +
- * `onError(phase:"prompt-constitution")`) — this role-only form is the guard-free contract.
- */
-export declare function semaIdentityProvider(): PromptProvider;
-/**
- * `code` 场景的提示词提供者([ref] 造,[ref] clay 裁定改名 autonomous→code):role 基底 = core
- * {@link CODE_SYSTEM_PROMPT}(core 1.298 [ref] 改名批正名,旧名 FULL_BODY_SYSTEM_PROMPT=恒等
- * 别名过渡窗;CODE_AGENT persona + AUTONOMY_SELF_AUDIT + ANTI_VERBOSITY +
- * TOOL_PARAM_JSON;[ref] 谱系定论 = CC 生产编码提示词的蒸馏去牌版,底本随 CC 版本对表 cc-anchors,
- * 非自研)——与 bench 的请求组装完全同源,引用 core 常量随版本走,绝不复制字符串(tb bench 实测:
- * 产品默认请求与同引擎 bench 态的差距根因就在这三件 persona/自检/终验)。品牌层与
- * {@link semaIdentityProvider} 同构:brandIdentity 开时 SEMA_IDENTITY 叠在 role 基底之上;任务自带
- * systemPrompt 按同一优先序赢过基底(role 合成规则与 default 场景一致)。宪法由 core 1.243 在 role
- * 层之后结构化追加——此处只产 role-only 形态(guard-free 契约,同 semaIdentityProvider 注释)。
- * 无 systemPrompt 且无品牌时原样返回 core 常量(测试以引用比对锁 bench 同源,不做字符串快照)。
- */
-export declare function codePromptProvider(brand: boolean): PromptProvider;
 export declare function buildScenarios(deps: ScenarioDeps): Record<string, Scenario>;
 /**
  * Resolve the scenario bundle for a name. `undefined` = no preference ⇒ the built-in `default`; any OTHER name must be
@@ -195,18 +216,47 @@ export interface ScenarioDetail {
     available: boolean;
     /** 机读原因键;仅 `available:false` 时在场(缺席=没有理由)。消费方按键分支,禁匹配英文文案。 */
     unavailableReason?: ScenarioUnavailableReason;
+    /**
+     * S-1652:**这个场景在本部署上受理的附件供给**(顶层能力位 `userAttachments.supplies` 的子集,保持席位序;键恒在场,不是 `null`)。
+     * 顶层能力位说的是引擎席位**能承载**的三种供给(常量);`path` 读的是这一 run 的工作区,只有「场景挂手 ∧ 部署的执行车道有手」的 run 才有
+     * (判官 {@link runHasWorkspace}),其余整条 `path` 条目由引擎 prepare 拒 `config.user_attachment_invalid` —— 宿主发之前读这一格,不靠撞 400。
+     * `content_text` / `content_image` 与工作区无关,恒在。
+     */
+    attachmentSupplies: UserAttachmentSupplyWord[];
 }
+/** 引擎附件席位的供给词(`USER_ATTACHMENT_SEAT.supplies` 的成员;取型,不手抄)。 */
+export type UserAttachmentSupplyWord = (typeof USER_ATTACHMENT_SEAT)["supplies"][number];
+/**
+ * 场景详情上的附件供给集 = 席位供给里去掉「这一 run 没有工作区时受理不了」的 `path`。**判据只有 {@link runHasWorkspace} 一只**:
+ * 内建与 center 两条产线共用本函数,引擎 prepare 的拒与本读面说的是同一个判决(同源钉在 `test/user-attachments.test.ts` ⑦b)。
+ */
+export declare function attachmentSuppliesFor(hands: ScenarioHands, handsLane: boolean): UserAttachmentSupplyWord[];
 /** 内建四场景详情。default/code 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan 是
  *  fail-loud 语义(缺 GIT_API 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
  *  测试喂 fake deps 真调工厂对账工具名)。enabled 对内建恒 true(约定②)。 */
 /** 内建场景名的闭集(`GET /v1/capabilities.scenarios` 与场景详情口的内建成员)。{@link builtinScenarioDetails} 的返回型按它键控 ⇒ 加 / 删一个内建场景而
  *  这里没跟 = 编译红;wire 变更清单的自铸登记表(`trace/self-minted-wire.ts` 的 `builtinScenario`)同按它 `satisfies`。 */
-export declare const BUILTIN_SCENARIO_NAMES: readonly ["code", "default", "code-review", "scan"];
+export declare const BUILTIN_SCENARIO_NAMES: readonly ["code", "default", "code-review", "scan", "cowork"];
 export type BuiltinScenarioName = (typeof BUILTIN_SCENARIO_NAMES)[number];
-export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "brandIdentity" | "repoClient">): Record<string, ScenarioDetail>;
+/**
+ * 内建场景对手带工具面的表态 —— **全仓唯一声明处**:各场景工厂产出的 bundle 的 `hands` 与场景详情读面的 `attachmentSupplies` 都读这张表,
+ * 不在三个工厂里各写一份字面量再靠对表格拴住。按 {@link BuiltinScenarioName} 键控 ⇒ 加 / 删一个内建场景而这里没跟 = 编译红。
+ */
+export declare const BUILTIN_SCENARIO_HANDS: {
+    readonly code: "full";
+    readonly default: "full";
+    readonly "code-review": "none";
+    readonly scan: "none";
+    readonly cowork: "full";
+};
+/**
+ * `branded` = 这台部署是不是品牌部署 —— 部署座挂品牌行读的同一只判官(`brand-identity.ts` `isBrandedDeployment`)交进来;没有默认值:每个调用点说出这件事实。
+ * 品牌部署上,品牌行 `when.binding` 那张表里的场景(`BRAND_IDENTITY_SCENARIOS`)的 `promptSummary` 点名 Sema 产品身份 —— 读面说的就是模型收到的。
+ */
+export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "repoClient" | "handsLane">, branded: boolean): Record<string, ScenarioDetail>;
 /** center 条目详情(有效性判定与 centerScenarios 完全同款:无效条目既不进 overlay 也不进详情——
  *  保证约定①「详情显示的来源=运行实际用的定义」永不错位)。 */
-export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient">): Record<string, ScenarioDetail>;
+export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient" | "handsLane">): Record<string, ScenarioDetail>;
 export interface CenterScenarioSpec {
     name: string;
     toolset: string;

package/dist/capabilities/scenarios.js

@@ -1,31 +1,24 @@
-import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
+import { USER_ATTACHMENT_SEAT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError, createCodedHttpError } from "../security.js";
 import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { NOW_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
-import { stablePrompt } from "./prompt.js";
 import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
-export { SEMA_IDENTITY } from "./prompts/identity.js";
-import { SEMA_IDENTITY } from "./prompts/identity.js";
-export function semaIdentityProvider() {
-    return {
-        stableBlocks: (ctx) => [
-            { id: "sema/identity", slot: "identity", text: `${SEMA_IDENTITY}\n\n${ctx.userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT}` },
-        ],
-    };
+import { OFFICE_EXCLUDED_TOOL_NAMES, runHasWorkspace } from "./hands-lane.js";
+import { BRAND_IDENTITY_SCENARIOS } from "./brand-identity.js";
+export function buildPromptSeats(scenarioName, prompt, callerSystemPrompt) {
+    const parts = [prompt?.roleText, callerSystemPrompt].filter((t) => typeof t === "string" && t.length > 0);
+    const systemPrompt = parts.length > 0 ? parts.join("\n\n") : callerSystemPrompt;
+    return { promptBinding: scenarioName, ...(prompt?.role !== undefined ? { promptRole: prompt.role } : {}), ...(systemPrompt !== undefined ? { systemPrompt } : {}) };
 }
-export function codePromptProvider(brand) {
-    const roleBase = (ctx) => ctx.userSystemPrompt ?? (ctx.promptProfile === "classic" ? CODE_SYSTEM_PROMPT : CODE_AGENT_PROMPT);
-    if (!brand) {
-        return { stableSystem: (ctx) => roleBase(ctx) };
-    }
-    return {
-        stableBlocks: (ctx) => [
-            { id: "sema/identity", slot: "identity", text: `${SEMA_IDENTITY}\n\n${roleBase(ctx)}` },
-        ],
-    };
+export function buildExcludeToolsSeat(scenarioExcludes, callerExcludes) {
+    if (scenarioExcludes === undefined || scenarioExcludes.length === 0)
+        return callerExcludes !== undefined ? { excludeTools: [...callerExcludes] } : {};
+    const own = new Set(scenarioExcludes);
+    return { excludeTools: [...scenarioExcludes, ...(callerExcludes ?? []).filter((n) => !own.has(n))] };
 }
+export { SEMA_IDENTITY } from "./prompts/identity.js";
 function requestWebSearchBackend(verdict, deployment, logger) {
     switch (verdict.kind) {
         case "absent":
@@ -45,6 +38,8 @@ export function buildScenarios(deps) {
         const webSearch = requestWebSearchBackend(deps.requirePrincipal !== true
             ? judgeRequestWebSearch(req?.settings?.webSearch)
             : { kind: "absent" }, deps.webSearch, deps.logger);
+        const ensureChildSessionDurable = deps.ensureChildSessionDurable;
+        const delegationRoot = ctx?.delegationRoot;
         return {
             tools: [
                 nowTool(),
@@ -63,7 +58,7 @@ export function buildScenarios(deps) {
                             scope: "default",
                             ...(deps.backgroundAgentStore ? { agentStore: deps.backgroundAgentStore } : {}),
                             ...(deps.checkpointStore ? { checkpointStore: deps.checkpointStore } : {}),
-                            ...(deps.ensureChildSessionDurable ? { ensureChildSessionDurable: deps.ensureChildSessionDurable } : {}),
+                            ...(ensureChildSessionDurable !== undefined ? { ensureChildSessionDurable: (childSessionId) => ensureChildSessionDurable(childSessionId, delegationRoot) } : {}),
                         },
                         ...createSubagentExtraTools(deps.subagentExtraTools),
                         ...(deps.logger
@@ -73,16 +68,16 @@ export function buildScenarios(deps) {
                     ...(webSearch ? { webSearch } : {}),
                 }).filter((t) => t.name !== WEB_FETCH_TOOL_NAME || deps.requirePrincipal !== true),
             ],
-            hands: "full",
+            hands: BUILTIN_SCENARIO_HANDS.default,
             skills: skillsForScenario(deps.skills, "default"),
-            ...(deps.brandIdentity ? { promptProvider: semaIdentityProvider() } : {}),
         };
     };
     return {
         default: defaultScenario,
         code: (req, principal, ctx) => ({
             ...defaultScenario(req, principal, ctx),
-            promptProvider: codePromptProvider(deps.brandIdentity === true),
+            hands: BUILTIN_SCENARIO_HANDS.code,
+            prompt: { role: "code" },
         }),
         "code-review": (req) => codeReview(deps, req),
         scan: (req) => {
@@ -92,10 +87,17 @@ export function buildScenarios(deps) {
             }
             return {
                 tools: [...repoToolsFor(repoClient, parseRepo(req.repo)), nowTool()],
-                hands: "none",
+                hands: BUILTIN_SCENARIO_HANDS.scan,
                 skills: skillsForScenario(deps.skills, "scan"),
             };
         },
+        cowork: (req, principal, ctx) => ({
+            ...defaultScenario(req, principal, ctx),
+            hands: BUILTIN_SCENARIO_HANDS.cowork,
+            skills: skillsForScenario(deps.skills, "cowork"),
+            excludeTools: OFFICE_EXCLUDED_TOOL_NAMES,
+            prompt: { role: "cowork" },
+        }),
     };
 }
 export function selectScenario(scenarios, name) {
@@ -106,12 +108,23 @@ export function selectScenario(scenarios, name) {
         throw new Error(`scenario "${name}" is not registered — resolve a request's scenario through gateScenarioRequest, which only returns registered names`);
     return picked;
 }
+export function attachmentSuppliesFor(hands, handsLane) {
+    const workspace = runHasWorkspace(hands, handsLane);
+    return USER_ATTACHMENT_SEAT.supplies.filter((supply) => workspace || supply !== "path");
+}
 function availabilityFields(deps, toolset) {
     const verdict = scenarioAvailability(deps, toolset);
     return verdict.available ? { available: true } : { available: false, unavailableReason: verdict.reason };
 }
-export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan"];
-export function builtinScenarioDetails(scenarios, deps) {
+export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan", "cowork"];
+export const BUILTIN_SCENARIO_HANDS = {
+    code: "full",
+    default: "full",
+    "code-review": "none",
+    scan: "none",
+    cowork: "full",
+};
+export function builtinScenarioDetails(scenarios, deps, branded) {
     const probe = (name, req, principal, fallback) => {
         try {
             return ((Object.hasOwn(scenarios, name) ? scenarios[name] : undefined)?.(req, principal)?.tools ?? []).map((t) => t.name);
@@ -124,14 +137,15 @@ export function builtinScenarioDetails(scenarios, deps) {
     const mk = (name, summary, toolset, tools, promptSummary) => ({
         name, source: "builtin", builtin: true, summary, toolset, tools, promptSummary, enabled: true,
         ...availabilityFields(deps, toolset),
+        attachmentSupplies: attachmentSuppliesFor(BUILTIN_SCENARIO_HANDS[name], deps.handsLane === true),
     });
+    const brandedScenario = (name) => branded && BRAND_IDENTITY_SCENARIOS.includes(name);
     const details = {
-        code: mk("code", "编码主场景([891] 出厂缺省;CC 编码 persona 蒸馏版,default 全量工具面;终验旋钮独立)", "full-body", probe("code", {}, undefined, [NOW_TOOL_NAME]), deps.brandIdentity
-            ? "Sema 产品身份 + core 编码完全体提示词(CODE_AGENT persona+自治自检;CC 血统对表)"
-            : "core 编码完全体提示词(CODE_AGENT persona+自治自检;CC 血统对表)"),
-        default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, [NOW_TOOL_NAME]), deps.brandIdentity ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
+        code: mk("code", "编码主场景([891] 出厂缺省;CC 编码 persona 蒸馏版,default 全量工具面;终验旋钮独立)", "full-body", probe("code", {}, undefined, [NOW_TOOL_NAME]), `${brandedScenario("code") ? "Sema 产品身份 + " : ""}core 编码完全体提示词(CODE_AGENT persona+自治自检;CC 血统对表)`),
+        default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, [NOW_TOOL_NAME]), brandedScenario("default") ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
         "code-review": mk("code-review", "代码评审(clone-free 只读仓库工具)", "repo-readonly", probe("code-review", { repo: "probe/probe" }, undefined, REPO_TOOLS), "评审员提示词(产出契约)"),
         scan: mk("scan", "中性只读仓库扫描(输出契约由 objective+skills 决定)", "repo-readonly", probe("scan", { repo: "probe/probe" }, undefined, REPO_TOOLS), "无场景附加提示词(objective+center skills 拥有输出契约)"),
+        cowork: mk("cowork", "办公向场景(default 的工具面去编码类工具:文件读 / 浏览 / 连接器挂载;Cowork 角色基底)", "office", probe("cowork", {}, undefined, [NOW_TOOL_NAME]), "core Cowork 角色基底(promptRole: cowork;办公向,不带编码 persona)"),
     };
     return details;
 }
@@ -142,7 +156,8 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             continue;
         if (typeof spec.name !== "string" || !SCENARIO_NAME_RE.test(spec.name))
             continue;
-        if (!Object.hasOwn(TOOLSETS, spec.toolset) || !TOOLSETS[spec.toolset])
+        const toolset = Object.hasOwn(TOOLSETS, spec.toolset) ? TOOLSETS[spec.toolset] : undefined;
+        if (!toolset)
             continue;
         out[spec.name] = {
             name: spec.name,
@@ -154,6 +169,7 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             promptSummary: "",
             enabled: true,
             ...availabilityFields(deps, spec.toolset),
+            attachmentSupplies: attachmentSuppliesFor(toolset.hands, deps.handsLane === true),
         };
     }
     return out;
@@ -229,14 +245,13 @@ function codeReview(deps, req) {
     const coords = parseRepo(req.repo);
     const repoTools = repoToolsFor(repoClient, coords);
     const skills = skillsForScenario(deps.skills, "code-review");
-    const hands = "none";
-    return { tools: [...repoTools, nowTool()], hands, skills, promptProvider: directReviewerPrompt };
+    const hands = BUILTIN_SCENARIO_HANDS["code-review"];
+    return { tools: [...repoTools, nowTool()], hands, skills, prompt: { roleText: REVIEWER_ROLE_TEXT } };
 }
-const reviewBody = "Produce ONE prioritized review: a short summary, then findings grouped by severity " +
-    "(blocker / major / minor), each with `path:line`, the problem, and a concrete fix. Cite real code — never invent files or symbols.";
-const directReviewerPrompt = stablePrompt("You are a senior code reviewer. Call repo_tree to map the repository, then repo_read_file to read " +
+const REVIEWER_ROLE_TEXT = "You are a senior code reviewer. Call repo_tree to map the repository, then repo_read_file to read " +
     "the files in scope, then review them yourself. " +
-    reviewBody);
+    "Produce ONE prioritized review: a short summary, then findings grouped by severity " +
+    "(blocker / major / minor), each with `path:line`, the problem, and a concrete fix. Cite real code — never invent files or symbols.";
 export function mergeUserSkills(scenarioSkills, userSkills, logger) {
     if (!userSkills || userSkills.length === 0)
         return scenarioSkills;

package/dist/capabilities/skills.d.ts

@@ -1,5 +1,6 @@
 import type { SkillSpec } from "@sema-agent/core";
 import type { RemoteExecProvider } from "../execution-lane-caps.js";
+import { type Logger } from "../observability/logger.js";
 /**
  * Built-in skills baked into the image, loaded ONCE at startup (no per-task disk IO). A skill is a
  * Markdown capability (frontmatter + body). core uses **progressive disclosure** (core ≥1.98.0):
@@ -26,6 +27,10 @@ import type { RemoteExecProvider } from "../execution-lane-caps.js";
  *   description: when to use it
  *   scenarios: code-review, oa     # which scenarios get it; omit = all scenarios
  *   ---
+ *
+ * 🔴 **frontmatter 读不了的技能不装,不降成全局技能**(安全轴:`scenarios` 是场景围栏,丢了它技能就对每个场景可见):文件第一行是围栏(`---`,行尾只许空白 / 制表 / CR,
+ * 与 CC 2.1.296 的开头正则同判)而块没有收尾 ⇒ {@link parseFrontmatter} 答 `unclosed`,这一个技能被**拒载**并落一行 `skill_refused` warn(点名技能与文件、不带正文);
+ * 兄弟技能照装。第一行不是围栏的文件没有 frontmatter,是正当的全局技能。
  */
 export interface LoadedSkill {
     spec: SkillSpec;
@@ -52,6 +57,8 @@ export interface LoadSkillsOptions {
      * core 的律也明写缺席 ⇒ 结果逐字节与 baseDir 到货之前相同)。两个方向不对称 ⇒ 默认取轻的那边。
      */
     toolsShareThisFilesystem?: boolean;
+    /** 拒载一行 warn 的出口(见文件头注「frontmatter 读不了的技能不装」)。缺席 ⇒ 进程的 JSON 行 logger(`createLogger("warn")`,stderr)—— 拒载没有「安静」的形;装配点传自己的 logger 只为字段与级别跟部署同一份。 */
+    logger?: Logger;
 }
 /** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
  *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。
@@ -70,12 +77,20 @@ export declare function loadDeploymentSkills(config: {
     readonly remoteExec?: {
         readonly provider: RemoteExecProvider;
     } | undefined;
-}): LoadedSkill[];
+}, logger?: Logger): LoadedSkill[];
 /** Skills applicable to a scenario: those tagged with it, plus untagged (global) ones.
  *  [ref]:alias 窗撤销,单键查询——退役旧名标签不再命中(迁移面在 7.44 发车帖/MIGRATION 记载)。 */
 export declare function skillsForScenario(loaded: LoadedSkill[], scenario: string): SkillSpec[];
-export declare function parseFrontmatter(raw: string): {
-    meta: Record<string, string>;
-    body: string;
+/** {@link parseFrontmatter} 的三种读数(闭集):`absent` = 第一行不是围栏,没有 frontmatter(正当的全局技能)· `block` = 围栏收好了的块 · `unclosed` = 第一行是围栏而块没收好(读不了 —— 调用方拒载)。 */
+export type FrontmatterRead = {
+    readonly kind: "absent";
+    readonly body: string;
+} | {
+    readonly kind: "block";
+    readonly meta: Record<string, string>;
+    readonly body: string;
+} | {
+    readonly kind: "unclosed";
 };
+export declare function parseFrontmatter(raw: string): FrontmatterRead;
 //# sourceMappingURL=skills.d.ts.map

package/dist/capabilities/skills.js

@@ -1,6 +1,7 @@
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { toolsRunOnThisHost } from "../task-cwd.js";
+import { createLogger } from "../observability/logger.js";
 export function assertConfined(p, rootReal, label = "skill entry") {
     let real;
     try {
@@ -14,6 +15,7 @@ export function assertConfined(p, rootReal, label = "skill entry") {
     }
 }
 export function loadSkills(dir, opts) {
+    const logger = opts?.logger ?? createLogger("warn");
     let entries;
     try {
         entries = readdirSync(dir, { withFileTypes: true });
@@ -41,7 +43,10 @@ export function loadSkills(dir, opts) {
             if (confineRoot !== undefined)
                 assertConfined(join(dir, entry.name), confineRoot);
             const raw = readFileSync(join(dir, entry.name), "utf8");
-            push(parseSkill(raw, entry.name.replace(/\.md$/, "")), join(dir, entry.name));
+            const source = join(dir, entry.name);
+            const parsed = parseSkill(raw, entry.name.replace(/\.md$/, ""), source, logger);
+            if (parsed !== undefined)
+                push(parsed, source);
         }
         else if (isDirLike(entry, join(dir, entry.name))) {
             const skillDir = join(dir, entry.name);
@@ -56,7 +61,9 @@ export function loadSkills(dir, opts) {
             }
             if (confineRoot !== undefined)
                 assertConfined(join(skillDir, "SKILL.md"), confineRoot);
-            const skill = parseSkill(raw, entry.name);
+            const skill = parseSkill(raw, entry.name, join(skillDir, "SKILL.md"), logger);
+            if (skill === undefined)
+                continue;
             const files = collectAttachments(skillDir, "", confineRoot);
             if (files.length > 0)
                 skill.spec.files = files;
@@ -67,8 +74,8 @@ export function loadSkills(dir, opts) {
     }
     return out;
 }
-export function loadDeploymentSkills(config) {
-    return loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) });
+export function loadDeploymentSkills(config, logger) {
+    return loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config), ...(logger !== undefined ? { logger } : {}) });
 }
 function collectAttachments(skillDir, rel, confineRoot) {
     const files = [];
@@ -93,8 +100,19 @@ function collectAttachments(skillDir, rel, confineRoot) {
     }
     return files;
 }
-function parseSkill(raw, fallbackName) {
-    const { meta, body } = parseFrontmatter(raw);
+function parseSkill(raw, fallbackName, source, logger) {
+    const fm = parseFrontmatter(raw);
+    if (fm.kind === "unclosed") {
+        logger.warn("skill_refused", {
+            skill: fallbackName,
+            source,
+            reason: "frontmatter_unclosed",
+            note: "the file opens a frontmatter fence (`---`) that is never closed, so its `scenarios` restriction cannot be read — this skill is NOT loaded (it is not demoted to a global skill); close the fence or remove the opening line",
+        });
+        return undefined;
+    }
+    const meta = fm.kind === "block" ? fm.meta : {};
+    const body = fm.body;
     const name = meta.name ?? fallbackName;
     const description = meta.description ?? firstHeading(body) ?? name;
     const scenarios = (meta.scenarios ?? "")
@@ -106,17 +124,19 @@ function parseSkill(raw, fallbackName) {
 export function skillsForScenario(loaded, scenario) {
     return loaded.filter((k) => k.scenarios.length === 0 || k.scenarios.includes(scenario)).map((k) => k.spec);
 }
+const FRONTMATTER_OPENS_RE = /^---[ \t]*\r?(?:\n|$)/;
+const FRONTMATTER_BLOCK_RE = /^---[ \t]*\r?\n(?:---[ \t]*\r?(?:\n|$)|([\s\S]*?)\r?\n---[ \t]*\r?(?:\n|$))([\s\S]*)$/;
 export function parseFrontmatter(raw) {
-    const m = /^---\r?\n([\s\S]*?)\r?\n---[ \t]*\r?(?:\n|$)([\s\S]*)$/.exec(raw);
+    const m = FRONTMATTER_BLOCK_RE.exec(raw);
     if (!m)
-        return { meta: {}, body: raw };
+        return FRONTMATTER_OPENS_RE.test(raw) ? { kind: "unclosed" } : { kind: "absent", body: raw };
     const meta = {};
-    for (const line of m[1].split("\n")) {
+    for (const line of (m[1] ?? "").split("\n")) {
         const kv = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line.trim());
         if (kv)
             meta[kv[1]] = kv[2].trim();
     }
-    return { meta, body: m[2] };
+    return { kind: "block", meta, body: m[2] };
 }
 function firstHeading(body) {
     for (const line of body.split("\n")) {