@sema-agent/server 7.132.0 → 7.133.0

package/dist/caller-text-echo.js

@@ -1,24 +1,21 @@
-import { TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/settings-schema";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
 export const CALLER_TEXT_ECHO_MAX_CHARS = 64;
 export function echoCallerText(text, opts) {
     const max = opts?.maxChars ?? CALLER_TEXT_ECHO_MAX_CHARS;
     if (!Number.isInteger(max) || max < 1)
         throw new RangeError(`echoCallerText: maxChars must be a positive integer, got ${String(max)}`);
-    const clean = text.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    const clean = stripControlAndBidi(text);
     return clean.length > max ? `${clean.slice(0, max)}…` : clean;
 }
 export function quotedCallerText(text) {
     return `"${echoCallerText(text)}"`;
 }
-export function describeBadWireName(v) {
-    if (typeof v !== "string")
-        return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
-    if (v.length === 0)
-        return "empty";
-    return `${quotedCallerText(v)} (${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS})`;
+export function clipDataText(s, max) {
+    return s.length > max ? `${s.slice(0, max)}…(${s.length})` : s;
 }
-export function describeBadContentOrigin(v) {
-    return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+export function capText(s, max) {
+    if (s === undefined)
+        return undefined;
+    return s.length > max ? s.slice(0, max) : s;
 }
 //# sourceMappingURL=caller-text-echo.js.map

package/dist/capabilities/center-plugins.d.ts

@@ -104,6 +104,13 @@ export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {
 }, opts: {
     cacheRoot: string;
     allowHosts: readonly string[];
+    /**
+     * S-379 —— 「**工具跑的那台机器**的盘就是本进程这台盘吗」,由**组合根**算好传入(`boot/web-admin.ts` 传 `toolsRunOnThisHost(config)`,与出厂自扫
+     * `loadDeploymentSkills` 读的是同一只函数 —— 判据属主在 `task-cwd.ts`,这里不第二次判车道、不 import 车道词)。真 ⇒ 目录形 plugin 技能带上自己的
+     * 目录(`SkillSpec.baseDir`:`Skill` 结果首行 + `${SKILL_ROOT}` 替换);假 ⇒ 不带(fail-closed:沙箱 / 远端车道上这条路径在工具那边不存在)。
+     * 🔴 **必填,不给缺省**:修前这个调用点手上根本没有这一事实,fail-closed 默认把 host 车道也一并挡成「永不带」而没有任何红 —— 必填让「漏传」是编译错。
+     */
+    toolsShareThisFilesystem: boolean;
     logger?: Logger;
     /** 测试口:跳过 validate(materialize 只接受已验声明;真 git 腿用本地 bare repo,validate 层的
      *  https-only 单独测——两层分开,谁也不掩护谁)。生产恒 false/缺席。 */

package/dist/capabilities/center-plugins.js

@@ -196,7 +196,7 @@ export async function applyCenterPlugins(baseline, eff, opts) {
             }
             if (!rootCheck.dir)
                 continue;
-            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir, ...(opts.logger !== undefined ? { logger: opts.logger } : {}) });
+            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir, toolsShareThisFilesystem: opts.toolsShareThisFilesystem, ...(opts.logger !== undefined ? { logger: opts.logger } : {}) });
             for (const skill of loaded) {
                 if (taken.has(skill.spec.name)) {
                     out.letGo.push({ plugin: v.name, skill: skill.spec.name });

package/dist/capabilities/composite-members.d.ts

@@ -45,7 +45,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"];
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
-    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];
+    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "tightenOnlySeats"];
     readonly settings: readonly ["permissions"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];

package/dist/capabilities/composite-members.js

@@ -6,7 +6,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
-    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],
+    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "tightenOnlySeats"],
     settings: ["permissions"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],

package/dist/capabilities/execution-lane.js

@@ -1,8 +1,8 @@
 import { toolsRunOnThisHost } from "../task-cwd.js";
-import { executionLaneCaps, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 export function projectExecutionLaneCapability(config) {
     const lane = executionLaneOf(config.remoteExec?.provider);
-    const handsWired = executionLaneCaps(lane).coreRemoteExecutionEnv === "supported";
+    const handsWired = laneWiresExecutionEnv(lane);
     return {
         provider: lane,
         toolsOnThisHost: toolsRunOnThisHost(config),

package/dist/capabilities/hands-lane.d.ts

@@ -39,6 +39,14 @@ export interface HandsRunnerPair {
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
+/**
+ * 一个场景在一台部署上起的 run **有没有工作区** —— core prepare 的 `handsEnabled`(`ownedEnv || deps.executionEnv`)在本仓的镜像,**唯一一只判官**。
+ * 两个条件缺一不可:场景挂手({@link pickHandsRunner} 选有手 Runner,即带 `executionEnvFactory` 的那只)∧ 这台部署的执行车道有手
+ * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`in-process` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
+ * (`config.user_attachment_invalid`「this run has no workspace」)与场景详情读面的 `attachmentSupplies` 都落在这一只的答案上。
+ * **穷举 switch**:`ScenarioHands` 加词而此处不表态 = 编译红(与 {@link pickHandsRunner} 同一条纪律)。
+ */
+export declare function runHasWorkspace(hands: ScenarioHands, laneHasHands: boolean): boolean;
 /**
  * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
  *
@@ -78,6 +86,19 @@ export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
  */
 export declare const HANDS_DUAL_USE_TOOL_NAMES: readonly string[];
 export declare const HANDS_EXCLUSIVE_TOOL_NAMES: readonly string[];
+/**
+ * S-1376:办公向场景(`cowork`)**保留**的手带工具 —— 文件读三件。办公场景挂手(`hands: "full"`:run 有工作区,附件 `path` 受理,这三件要这只手),
+ * 但不带编码类工具;「编码类」的定义是**手独占名单减去这张保留表**({@link OFFICE_EXCLUDED_TOOL_NAMES}),不是另抄一张编码工具名单:
+ * core 往 band 里加新的手带工具,办公场景**默认就卸它**(fail-closed),要保留得在这里显式点名并过评审。
+ * 保留表里每一项必须是 band 全集的成员(对表钉在 `test/cowork-scenario.test.ts`)。
+ */
+export declare const OFFICE_KEPT_HAND_TOOL_NAMES: readonly string[];
+/**
+ * 办公向场景从 roster 里**真卸载**的手带工具名单(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,工具 schema 不进 `tools[]`;不是策略 deny)=
+ * 手独占名单({@link HANDS_EXCLUSIVE_TOOL_NAMES},两用件不在内:委派 / workflow 车道要它们)∖ {@link OFFICE_KEPT_HAND_TOOL_NAMES}。
+ * 今天 = Edit · Write · NotebookEdit · Bash · RepoMap · LSP · EnterWorktree · ExitWorktree · Monitor。
+ */
+export declare const OFFICE_EXCLUDED_TOOL_NAMES: readonly string[];
 /** 手独占名单的 deny 策略(纵深层)。名单是常量 ⇒ 每次调用产出等价策略,构造成本可忽略。 */
 export declare function handsDenyPolicy(): ToolPolicy;
 /**

package/dist/capabilities/hands-lane.js

@@ -12,6 +12,14 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
+export function runHasWorkspace(hands, laneHasHands) {
+    switch (hands) {
+        case "full":
+            return laneHasHands;
+        case "none":
+            return false;
+    }
+}
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",
@@ -23,6 +31,8 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
 ].filter((n, i, all) => judgeRuleToolName(n, TOOL_NAME_ROSTER).kind === "current" && all.indexOf(n) === i));
 export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
+export const OFFICE_KEPT_HAND_TOOL_NAMES = Object.freeze(["Read", "Glob", "Grep"]);
+export const OFFICE_EXCLUDED_TOOL_NAMES = Object.freeze(HANDS_EXCLUSIVE_TOOL_NAMES.filter((n) => !OFFICE_KEPT_HAND_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {
     return createAllowDenyPolicy({ deny: [...HANDS_EXCLUSIVE_TOOL_NAMES] });
 }

package/dist/capabilities/mcp-probe.d.ts

@@ -134,8 +134,10 @@ export interface McpProbeFaceBody {
     /** 这份读数还能复用多久(秒)= {@link MCP_PROBE_CACHE_TTL_MS}。 */
     readonly ttlSec: number;
     /**
-     * 逐字 = `wiring_manifest.mcp[]` 在 wire 上的那一行 —— **同一只投影**
-     * ({@link projectWiringManifestMcpRows},契约 §G.7),不是本面自己挑的一份键。与入参申报**同序同长**
+     * 每一行 = `wiring_manifest.mcp[]` 在 wire 上的那一行 —— **同一只投影**
+     * ({@link projectWiringManifestMcpRows},契约 §G.7),不是本面自己挑的一份键 —— **外加本面独有的两个可选键**
+     * `toolNames` / `toolNamesTruncated`({@link buildMcpProbeFaceRows};名字的来源只有同一次探测的读数
+     * `servers[i].tools`,§G.7 的行与 `wiring_manifest.mcp[]` 上都没有它们)。与入参申报**同序同长**
      * (core `@contract mcp.probe.index_aligned`;下标对齐,不按 name)。
      *
      * 🔴 **`error`(远端原话)因此在本面上同样缺席**,而这**不是**本车的选择:§G.7 第 3 条是一条成文裁定
@@ -168,10 +170,10 @@ export interface McpProbeRefusal {
  * (`source` 写坏的 F 类丢弃)不会在一次被拒的探测上虚记。
  *
  * ## 唯一一处按门分的后果:声明了 `assertionHeader`(引擎尚无断言头座)
- * 事实只有一个、读它的谓词只有一只(`declaresMcpAssertionHeader`):这台 server 声明的断言头本版**承载、不发送**,交给引擎的规格里没有它。
+ * 事实只有一个、读它的谓词只有一只(`specWithholdsMcpAssertionHeader`,读发送开关 `MCP_ASSERTION_HEADER_SENT`):这台 server 声明的断言头本版**承载、不发送**,交给引擎的规格里没有它。
  * 新提交照挂并给运维一行 info(`mcp_assertion_header_not_sent`;settings 面同读法);本面**整条拒** —— 拨出去的不是申报的那一份,一台握手放行、
  * 调用才要断言的对端会被答成 connected,而它的调用会被拒。判据同一只、后果按门分(与重放腿对同一组身份头「降级到升级前读法」同一个姿势);
- * 引擎长出同名座的那天,`toCoreMcpServerSpec` 的剥键与这一拒一起退役(`mcp-assertion-header.ts` 的退役门编译红)。
+ * 引擎长出同名座的那天,开关翻真,`toCoreMcpServerSpec` 的剥键与这一拒一起退役(`mcp-assertion-header.ts` 的退役门编译红)。
  */
 export declare function readMcpProbeBody(raw: unknown): {
     ok: true;
@@ -234,6 +236,28 @@ export interface McpProbeLocal {
 }
 /** 带行为的东西 ⇒ `create*`(工厂命名律:`build*` 出纯数据,`create*` 出活对象)。 */
 export declare function createMcpProbeLocal(): McpProbeLocal;
+/**
+ * S-1734 —— 一行的**本面独有**两键:`toolNames` / `toolNamesTruncated`。两条口走同一只 {@link createMcpProbeWalk},
+ * 所以这是它们**唯一**的铸点。
+ *
+ * ## 来源只有一个
+ * core 7.52.0 的 `probeMcpServers().servers[i].tools` —— 这台"会挂上"的工具名,形是引擎的命名空间形
+ * `mcp__<server>__<tool>`(= 会话面板 `toolNames` 同一只来源,过了 schema 闸与逐台白名单之后的名册,`tools.length` 恒等于该行的 `toolCount`)。
+ * server **不拼、不改名、不加前缀**:引擎是什么形,wire 上就是什么形。
+ *
+ * ## 失败方向(与 `toolCount` 不编 0 同律,逐键独立)
+ *  · 这一格的 `tools` 缺席 / 非数组 / 带任何非串元素(含稀疏数组的空槽) ⇒ **两个键都缺席**(不编 `[]`:编出来的空名单会被读成「这台没有工具」;
+ *    带非串元素的数组整只不要 —— 少一半的名单看着像完整的那一份,而「会撒谎的读面比大的读面更贵」);
+ *  · 在场的 `[]` 原样保留(core 对没连上的台给 `[]`,`toolCount` 同行为 0 —— 与「写了就在场」同律,不折成缺席);
+ *  · 超过 {@link import("../panel-tool-names.js").PANEL_MAX_TOOL_NAMES} 只截**表**:`toolNamesTruncated: true`,`toolCount` 仍是 §G.7 投影出的真数。
+ *
+ * ## 下标对齐是承诺,不是约定
+ * `rows` 与 `readings` 按**下标**配(core `@contract mcp.probe.index_aligned`,名字不保证唯一)。读数不是数组、或条数与行数不等 ⇒
+ * **抛** {@link McpProbeMisaligned},不发一份会配错的名单 —— 与 {@link createMcpProbeWalk} 对 `rows` 条数的那道断言同一条纪律、同一个具名型
+ * (今天结构上不可达,所以是断言而不是兜底路径;一旦发生是服务内部的读数违约,两条口都答 5xx,不归到调用方的申报)。
+ * `rows` 一个字都不被改写(不过滤、不排序、不改已有键)。
+ */
+export declare function buildMcpProbeFaceRows(rows: readonly Record<string, unknown>[], readings: unknown): Array<Record<string, unknown>>;
 /**
  * 一次走查。**两只 promise,两件事**(合并树 codex ① [high],亲跑复现后按类修):
  *  · `answer` —— **HTTP 应答面**:到本面的期限就 reject {@link McpProbeIncomplete},调用腿据它答 503;
@@ -254,6 +278,14 @@ export interface McpProbeWalk {
     readonly dials: Promise<unknown>;
 }
 export declare function createMcpProbeWalk(specs: readonly McpServerSpec[], principal: string | undefined, now?: () => number): McpProbeWalk;
+/**
+ * 下标对齐的**内部断言**没过(行数 ≠ 申报数,或读数条数 ≠ 行数):core 的 `@contract mcp.probe.index_aligned` 在今天结构上保证它不发生,
+ * 所以它一旦发生,是**这台服务内部的读数违约**,不是调用方的申报写错 —— 修申报修不好它。**具名型**而不是按文案或按「非 Incomplete 的 reject」分诊:
+ * 调用腿据它把 `POST` 也答成 5xx(与 `GET` 同),而不是落进「core 物化拒了这份申报 ⇒ 400 点名调用方」那一臂。
+ */
+export declare class McpProbeMisaligned extends Error {
+    constructor(message: string);
+}
 /** 整次走查没在 {@link MCP_PROBE_WALK_TIMEOUT_MS} 内落地。**具名型**而不是一个字符串比较:调用腿要据它
  *  分诊(503 + 退避),而按错误文案分诊是本仓明令不许的形。 */
 export declare class McpProbeIncomplete extends Error {

package/dist/capabilities/mcp-probe.js

@@ -4,8 +4,9 @@ import { createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { canonicalJson } from "../canonical-json.js";
 import { keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
 import { requestMcpDeclarationRefusal, validateRequestMcp } from "../task-mcp.js";
-import { declaresMcpAssertionHeader, toCoreMcpServerSpec } from "../mcp-assertion-header.js";
+import { specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "../mcp-assertion-header.js";
 import { projectWiringManifestMcpRows } from "../trace/project.js";
+import { buildBoundedToolNames } from "../panel-tool-names.js";
 export const MCP_PROBE_REFUSAL_CODES = [
     "capability.mcp_injection_required",
     "limit.rate_exceeded",
@@ -70,7 +71,7 @@ export function readMcpProbeBody(raw) {
                 " so nothing in your body needs changing — if you see it, this deployment has a bug worth reporting"),
         };
     }
-    const carried = validated.ok.findIndex(declaresMcpAssertionHeader);
+    const carried = validated.ok.findIndex(specWithholdsMcpAssertionHeader);
     if (carried >= 0) {
         return {
             ok: false,
@@ -138,6 +139,22 @@ export function createMcpProbeLocal() {
         inflight: () => [...cache.values()].filter((v) => v.settledAt === undefined).length,
     };
 }
+export function buildMcpProbeFaceRows(rows, readings) {
+    if (!Array.isArray(readings) || readings.length !== rows.length) {
+        const got = Array.isArray(readings) ? `${readings.length} readings` : "no reading array";
+        throw new McpProbeMisaligned(`mcp probe returned ${got} for the ${rows.length} rows it must align with by index — refusing to publish tool names a consumer would mis-pair`);
+    }
+    return rows.map((row, i) => {
+        const reading = readings[i];
+        const tools = typeof reading === "object" && reading !== null ? reading.tools : undefined;
+        if (!isStringList(tools))
+            return row;
+        return { ...row, ...buildBoundedToolNames(tools) };
+    });
+}
+function isStringList(v) {
+    return Array.isArray(v) && Array.from(v).every((t) => typeof t === "string");
+}
 export function createMcpProbeWalk(specs, principal, now = Date.now) {
     const bound = buildMcpProbeWalkTimeoutMs(specs.length);
     const controller = new AbortController();
@@ -160,9 +177,9 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
             const result = await Promise.race([dials, deadline]);
             const rows = projectWiringManifestMcpRows(result.entries) ?? [];
             if (rows.length !== specs.length) {
-                throw new Error(`mcp probe row count ${rows.length} does not match the ${specs.length} declarations it must align with by index — refusing to publish a list a consumer would mis-pair`);
+                throw new McpProbeMisaligned(`mcp probe row count ${rows.length} does not match the ${specs.length} declarations it must align with by index — refusing to publish a list a consumer would mis-pair`);
             }
-            return { probedAt: new Date(now()).toISOString(), ttlSec: Math.floor(MCP_PROBE_CACHE_TTL_MS / 1000), servers: rows };
+            return { probedAt: new Date(now()).toISOString(), ttlSec: Math.floor(MCP_PROBE_CACHE_TTL_MS / 1000), servers: buildMcpProbeFaceRows(rows, result.servers) };
         }
         finally {
             if (timer !== undefined)
@@ -172,6 +189,12 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
     answer.catch(() => undefined);
     return { answer, dials };
 }
+export class McpProbeMisaligned extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpProbeMisaligned";
+    }
+}
 export class McpProbeIncomplete extends Error {
     boundMs;
     constructor(boundMs) {

package/dist/capabilities/scenarios.d.ts

@@ -1,9 +1,10 @@
-import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type Runner, type SkillSpec, type TaskListStore, type TaskSpec, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
+import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type Runner, type SkillSpec, type TaskListStore, type TaskSpec, type ToolSpec, type WebSearchConfig, USER_ATTACHMENT_SEAT } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import { type SubagentExtraToolSet } from "./builtin-tools.js";
 import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill } from "./skills.js";
-import type { ScenarioHands } from "./hands-lane.js";
+import { type ScenarioHands } from "./hands-lane.js";
+import type { DelegationRootWitness } from "../delegated-session-owner.js";
 /**
  * Scenario routing — a deployment serves many scenarios from one image. Each request's `scenario`
  * selects a pre-wired capability bundle: tools (incl. subagent roster) + its prompt seats + skills.
@@ -26,6 +27,12 @@ export interface ScenarioBundle {
      * `scan` 声明 clone-free 四件、实际拿到全量可写手)。
      */
     hands: ScenarioHands;
+    /**
+     * S-1376:本场景从 roster 里**真卸载**的工具名(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,schema 不进 `tools[]`;不是策略 deny)。缺席 = 不卸。
+     * 经 {@link buildExcludeToolsSeat} 与调用方自己的 `excludeTools` 取并后写进 `TaskSpec`(HTTP 腿与 run-local 腿同一只写点)—— 场景只能多卸,调用方也只能多卸。
+     * 与 `hands` 正交:`hands: "none"` 是整只手不挂(scan / code-review),本键是挂手之后卸掉其中一部分(cowork 卸编码类工具、留文件读)。
+     */
+    excludeTools?: readonly string[];
     /** 本场景对提示的贡献(缺席 = 不贡献:引擎目录的缺省角色)。经 {@link buildPromptSeats} 写进 `TaskSpec`,这是场景到提示的唯一通道。 */
     prompt?: ScenarioPrompt;
     /** [ref] 场景解释层定死的终验开关(core TaskSpec.finalVerification):bench 实测产品默认请求与
@@ -53,6 +60,12 @@ export interface ScenarioPrompt {
  *  · `systemPrompt` = 角色文本(场景自己的在前、调用方 `systemPrompt` 在后,`\n\n` 相连;空串不占位;两者都缺席 ⇒ 键不写,调用方给的空串原样交引擎)。
  */
 export declare function buildPromptSeats(scenarioName: string, prompt: ScenarioPrompt | undefined, callerSystemPrompt: string | undefined): Pick<TaskSpec, "promptBinding" | "promptRole" | "systemPrompt">;
+/**
+ * 一次请求写进 `TaskSpec` 的**工具卸载座** —— `excludeTools` 的唯一写点,HTTP 腿(`resolveSpec`)与 `run-local` 同用这一只(同 {@link buildPromptSeats}):
+ * 场景自己的卸载名单在前,调用方请求体里的 `excludeTools` 接在后(两边都只会**多卸**,调用方拿不回场景卸掉的)。
+ * 场景没有卸载名单 ⇒ 调用方的名单**逐字原样**(不去重、不重排;缺席 ⇒ 键不写),这是 cowork 之前所有场景的字节形。
+ */
+export declare function buildExcludeToolsSeat(scenarioExcludes: readonly string[] | undefined, callerExcludes: readonly string[] | undefined): Pick<TaskSpec, "excludeTools">;
 /**
  * [ref]:场景工厂的**服务端事实**上下文 —— 与 `req`(= 调用方请求体,不可信)分开的第三个入参。
  * 这里的每一位都由鉴权信道解析,调用方无法自报;新增位一律走本接口,绝不往 `req` 上加。
@@ -64,11 +77,19 @@ export interface ScenarioContext {
      * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「sessionId comes from `auth`, NEVER the
      * body」的逐字纪律)。
      *
-     * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对深于一层的行只取 boot 期那只裸 Agent 工具、
+     * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对不交座的行、boot 期那一次 Agent 工具探针、
      * `builtinScenarioDetails` 的工具名探针)。此时会话级设施退化为 per-call 实例 —— 不为它发明
      * 一个假 session。
      */
     sessionId?: string;
+    /**
+     * S-1770 / S-1808:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
+     * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
+     * `rootSessionId` 与赎回腿 claim 前后两读的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
+     * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
+     * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客晋升或认领。
+     */
+    delegationRoot?: DelegationRootWitness;
 }
 export type Scenario = (req: ScenarioRequest, principal?: string, ctx?: ScenarioContext) => ScenarioBundle;
 export interface ScenarioDeps {
@@ -82,6 +103,11 @@ export interface ScenarioDeps {
      *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/untrusted tenant model
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
+    /**
+     * S-1652:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
+     * 「这个场景的 run 有没有工作区」({@link runHasWorkspace}),进而给出附件可受理供给集。**缺席按没有手读**(宁少说不多说:不广告一个会撞 400 的 `path`)。
+     */
+    handsLane?: boolean;
     /** Deployment-injected WebSearch backend (Brave/Tavily/SearXNG via `WEB_SEARCH_PROVIDER`). When set,
      *  `assembleCodeTools` mounts the WebSearch tool; absent ⇒ not assembled (core ships no search backend). */
     webSearch?: WebSearchConfig;
@@ -125,7 +151,12 @@ export interface ScenarioDeps {
      *    后续按需再做)。
      */
     checkpointStore?: CheckpointStore;
-    ensureChildSessionDurable?: (sessionId: string) => Promise<void>;
+    /**
+     * S-1770:比 core 挂点多一个参数 —— `root` = **委派树根的见证,由取用这只 bundle 的调用方交出**({@link ScenarioContext.delegationRoot};缺席 = 没有根可交)。
+     * core 的挂点只给子代 id,停驻写下 / 定夺的宿主行属主却要按委派继承律取委派树根的属主;场景工厂把见证绑进交给 core 的那只闭包,同一棵树里任何深度的后台子代
+     * 停驻都经它(子代沿用父的委派工具实例)。
+     */
+    ensureChildSessionDurable?: (sessionId: string, root: DelegationRootWitness | undefined) => Promise<void>;
     /**
      * [ref]([ref] F2 症状 → [ref] 定谳):**会话级**任务清单店解析器,属主 =
      * `boot/task-list-lane.ts` 的 {@link import("../boot/task-list-lane.js").createTaskListLane}
@@ -185,22 +216,47 @@ export interface ScenarioDetail {
     available: boolean;
     /** 机读原因键;仅 `available:false` 时在场(缺席=没有理由)。消费方按键分支,禁匹配英文文案。 */
     unavailableReason?: ScenarioUnavailableReason;
+    /**
+     * S-1652:**这个场景在本部署上受理的附件供给**(顶层能力位 `userAttachments.supplies` 的子集,保持席位序;键恒在场,不是 `null`)。
+     * 顶层能力位说的是引擎席位**能承载**的三种供给(常量);`path` 读的是这一 run 的工作区,只有「场景挂手 ∧ 部署的执行车道有手」的 run 才有
+     * (判官 {@link runHasWorkspace}),其余整条 `path` 条目由引擎 prepare 拒 `config.user_attachment_invalid` —— 宿主发之前读这一格,不靠撞 400。
+     * `content_text` / `content_image` 与工作区无关,恒在。
+     */
+    attachmentSupplies: UserAttachmentSupplyWord[];
 }
+/** 引擎附件席位的供给词(`USER_ATTACHMENT_SEAT.supplies` 的成员;取型,不手抄)。 */
+export type UserAttachmentSupplyWord = (typeof USER_ATTACHMENT_SEAT)["supplies"][number];
+/**
+ * 场景详情上的附件供给集 = 席位供给里去掉「这一 run 没有工作区时受理不了」的 `path`。**判据只有 {@link runHasWorkspace} 一只**:
+ * 内建与 center 两条产线共用本函数,引擎 prepare 的拒与本读面说的是同一个判决(同源钉在 `test/user-attachments.test.ts` ⑦b)。
+ */
+export declare function attachmentSuppliesFor(hands: ScenarioHands, handsLane: boolean): UserAttachmentSupplyWord[];
 /** 内建四场景详情。default/code 工厂对良性请求无副作用可真调(拿真实工具名单);code-review/scan 是
  *  fail-loud 语义(缺 GIT_API 配置/principal 即 throw)→ 探针失败落静态表兜底(表↔工厂一致性由测试锁:
  *  测试喂 fake deps 真调工厂对账工具名)。enabled 对内建恒 true(约定②)。 */
 /** 内建场景名的闭集(`GET /v1/capabilities.scenarios` 与场景详情口的内建成员)。{@link builtinScenarioDetails} 的返回型按它键控 ⇒ 加 / 删一个内建场景而
  *  这里没跟 = 编译红;wire 变更清单的自铸登记表(`trace/self-minted-wire.ts` 的 `builtinScenario`)同按它 `satisfies`。 */
-export declare const BUILTIN_SCENARIO_NAMES: readonly ["code", "default", "code-review", "scan"];
+export declare const BUILTIN_SCENARIO_NAMES: readonly ["code", "default", "code-review", "scan", "cowork"];
 export type BuiltinScenarioName = (typeof BUILTIN_SCENARIO_NAMES)[number];
+/**
+ * 内建场景对手带工具面的表态 —— **全仓唯一声明处**:各场景工厂产出的 bundle 的 `hands` 与场景详情读面的 `attachmentSupplies` 都读这张表,
+ * 不在三个工厂里各写一份字面量再靠对表格拴住。按 {@link BuiltinScenarioName} 键控 ⇒ 加 / 删一个内建场景而这里没跟 = 编译红。
+ */
+export declare const BUILTIN_SCENARIO_HANDS: {
+    readonly code: "full";
+    readonly default: "full";
+    readonly "code-review": "none";
+    readonly scan: "none";
+    readonly cowork: "full";
+};
 /**
  * `branded` = 这台部署是不是品牌部署 —— 部署座挂品牌行读的同一只判官(`brand-identity.ts` `isBrandedDeployment`)交进来;没有默认值:每个调用点说出这件事实。
  * 品牌部署上,品牌行 `when.binding` 那张表里的场景(`BRAND_IDENTITY_SCENARIOS`)的 `promptSummary` 点名 Sema 产品身份 —— 读面说的就是模型收到的。
  */
-export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "repoClient">, branded: boolean): Record<string, ScenarioDetail>;
+export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "repoClient" | "handsLane">, branded: boolean): Record<string, ScenarioDetail>;
 /** center 条目详情(有效性判定与 centerScenarios 完全同款:无效条目既不进 overlay 也不进详情——
  *  保证约定①「详情显示的来源=运行实际用的定义」永不错位)。 */
-export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient">): Record<string, ScenarioDetail>;
+export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient" | "handsLane">): Record<string, ScenarioDetail>;
 export interface CenterScenarioSpec {
     name: string;
     toolset: string;

package/dist/capabilities/scenarios.js

@@ -1,16 +1,23 @@
-import { WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
+import { USER_ATTACHMENT_SEAT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError, createCodedHttpError } from "../security.js";
 import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { NOW_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
 import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
+import { OFFICE_EXCLUDED_TOOL_NAMES, runHasWorkspace } from "./hands-lane.js";
 import { BRAND_IDENTITY_SCENARIOS } from "./brand-identity.js";
 export function buildPromptSeats(scenarioName, prompt, callerSystemPrompt) {
     const parts = [prompt?.roleText, callerSystemPrompt].filter((t) => typeof t === "string" && t.length > 0);
     const systemPrompt = parts.length > 0 ? parts.join("\n\n") : callerSystemPrompt;
     return { promptBinding: scenarioName, ...(prompt?.role !== undefined ? { promptRole: prompt.role } : {}), ...(systemPrompt !== undefined ? { systemPrompt } : {}) };
 }
+export function buildExcludeToolsSeat(scenarioExcludes, callerExcludes) {
+    if (scenarioExcludes === undefined || scenarioExcludes.length === 0)
+        return callerExcludes !== undefined ? { excludeTools: [...callerExcludes] } : {};
+    const own = new Set(scenarioExcludes);
+    return { excludeTools: [...scenarioExcludes, ...(callerExcludes ?? []).filter((n) => !own.has(n))] };
+}
 export { SEMA_IDENTITY } from "./prompts/identity.js";
 function requestWebSearchBackend(verdict, deployment, logger) {
     switch (verdict.kind) {
@@ -31,6 +38,8 @@ export function buildScenarios(deps) {
         const webSearch = requestWebSearchBackend(deps.requirePrincipal !== true
             ? judgeRequestWebSearch(req?.settings?.webSearch)
             : { kind: "absent" }, deps.webSearch, deps.logger);
+        const ensureChildSessionDurable = deps.ensureChildSessionDurable;
+        const delegationRoot = ctx?.delegationRoot;
         return {
             tools: [
                 nowTool(),
@@ -49,7 +58,7 @@ export function buildScenarios(deps) {
                             scope: "default",
                             ...(deps.backgroundAgentStore ? { agentStore: deps.backgroundAgentStore } : {}),
                             ...(deps.checkpointStore ? { checkpointStore: deps.checkpointStore } : {}),
-                            ...(deps.ensureChildSessionDurable ? { ensureChildSessionDurable: deps.ensureChildSessionDurable } : {}),
+                            ...(ensureChildSessionDurable !== undefined ? { ensureChildSessionDurable: (childSessionId) => ensureChildSessionDurable(childSessionId, delegationRoot) } : {}),
                         },
                         ...createSubagentExtraTools(deps.subagentExtraTools),
                         ...(deps.logger
@@ -59,7 +68,7 @@ export function buildScenarios(deps) {
                     ...(webSearch ? { webSearch } : {}),
                 }).filter((t) => t.name !== WEB_FETCH_TOOL_NAME || deps.requirePrincipal !== true),
             ],
-            hands: "full",
+            hands: BUILTIN_SCENARIO_HANDS.default,
             skills: skillsForScenario(deps.skills, "default"),
         };
     };
@@ -67,6 +76,7 @@ export function buildScenarios(deps) {
         default: defaultScenario,
         code: (req, principal, ctx) => ({
             ...defaultScenario(req, principal, ctx),
+            hands: BUILTIN_SCENARIO_HANDS.code,
             prompt: { role: "code" },
         }),
         "code-review": (req) => codeReview(deps, req),
@@ -77,10 +87,17 @@ export function buildScenarios(deps) {
             }
             return {
                 tools: [...repoToolsFor(repoClient, parseRepo(req.repo)), nowTool()],
-                hands: "none",
+                hands: BUILTIN_SCENARIO_HANDS.scan,
                 skills: skillsForScenario(deps.skills, "scan"),
             };
         },
+        cowork: (req, principal, ctx) => ({
+            ...defaultScenario(req, principal, ctx),
+            hands: BUILTIN_SCENARIO_HANDS.cowork,
+            skills: skillsForScenario(deps.skills, "cowork"),
+            excludeTools: OFFICE_EXCLUDED_TOOL_NAMES,
+            prompt: { role: "cowork" },
+        }),
     };
 }
 export function selectScenario(scenarios, name) {
@@ -91,11 +108,22 @@ export function selectScenario(scenarios, name) {
         throw new Error(`scenario "${name}" is not registered — resolve a request's scenario through gateScenarioRequest, which only returns registered names`);
     return picked;
 }
+export function attachmentSuppliesFor(hands, handsLane) {
+    const workspace = runHasWorkspace(hands, handsLane);
+    return USER_ATTACHMENT_SEAT.supplies.filter((supply) => workspace || supply !== "path");
+}
 function availabilityFields(deps, toolset) {
     const verdict = scenarioAvailability(deps, toolset);
     return verdict.available ? { available: true } : { available: false, unavailableReason: verdict.reason };
 }
-export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan"];
+export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan", "cowork"];
+export const BUILTIN_SCENARIO_HANDS = {
+    code: "full",
+    default: "full",
+    "code-review": "none",
+    scan: "none",
+    cowork: "full",
+};
 export function builtinScenarioDetails(scenarios, deps, branded) {
     const probe = (name, req, principal, fallback) => {
         try {
@@ -109,6 +137,7 @@ export function builtinScenarioDetails(scenarios, deps, branded) {
     const mk = (name, summary, toolset, tools, promptSummary) => ({
         name, source: "builtin", builtin: true, summary, toolset, tools, promptSummary, enabled: true,
         ...availabilityFields(deps, toolset),
+        attachmentSupplies: attachmentSuppliesFor(BUILTIN_SCENARIO_HANDS[name], deps.handsLane === true),
     });
     const brandedScenario = (name) => branded && BRAND_IDENTITY_SCENARIOS.includes(name);
     const details = {
@@ -116,6 +145,7 @@ export function builtinScenarioDetails(scenarios, deps, branded) {
         default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, [NOW_TOOL_NAME]), brandedScenario("default") ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
         "code-review": mk("code-review", "代码评审(clone-free 只读仓库工具)", "repo-readonly", probe("code-review", { repo: "probe/probe" }, undefined, REPO_TOOLS), "评审员提示词(产出契约)"),
         scan: mk("scan", "中性只读仓库扫描(输出契约由 objective+skills 决定)", "repo-readonly", probe("scan", { repo: "probe/probe" }, undefined, REPO_TOOLS), "无场景附加提示词(objective+center skills 拥有输出契约)"),
+        cowork: mk("cowork", "办公向场景(default 的工具面去编码类工具:文件读 / 浏览 / 连接器挂载;Cowork 角色基底)", "office", probe("cowork", {}, undefined, [NOW_TOOL_NAME]), "core Cowork 角色基底(promptRole: cowork;办公向,不带编码 persona)"),
     };
     return details;
 }
@@ -126,7 +156,8 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             continue;
         if (typeof spec.name !== "string" || !SCENARIO_NAME_RE.test(spec.name))
             continue;
-        if (!Object.hasOwn(TOOLSETS, spec.toolset) || !TOOLSETS[spec.toolset])
+        const toolset = Object.hasOwn(TOOLSETS, spec.toolset) ? TOOLSETS[spec.toolset] : undefined;
+        if (!toolset)
             continue;
         out[spec.name] = {
             name: spec.name,
@@ -138,6 +169,7 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             promptSummary: "",
             enabled: true,
             ...availabilityFields(deps, spec.toolset),
+            attachmentSupplies: attachmentSuppliesFor(toolset.hands, deps.handsLane === true),
         };
     }
     return out;
@@ -213,7 +245,7 @@ function codeReview(deps, req) {
     const coords = parseRepo(req.repo);
     const repoTools = repoToolsFor(repoClient, coords);
     const skills = skillsForScenario(deps.skills, "code-review");
-    const hands = "none";
+    const hands = BUILTIN_SCENARIO_HANDS["code-review"];
     return { tools: [...repoTools, nowTool()], hands, skills, prompt: { roleText: REVIEWER_ROLE_TEXT } };
 }
 const REVIEWER_ROLE_TEXT = "You are a senior code reviewer. Call repo_tree to map the repository, then repo_read_file to read " +