@sema-agent/server 7.132.0 → 7.134.0

package/dist/hooks/hook-source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * 请求面**来源**闭集 —— 一个 hook 组(`settings.hooks[event][i].source`)是谁写的。词表与「托管与否」的映射**只在这里**;
+ * hooks 执行器按它分车道(`hook-runner.ts` 的三相),将来请求面别处的来源键(MCP 服务器条目)读同一张词表,不另立第二份。
+ *
+ * 词表(闭集;集外词 = 形错,受理面整份拒,fail-closed;缺席 = 非托管):
+ *  · `managedPolicy`          —— 组织策略(托管设置)。**托管**,且是终判相。
+ *  · `managedPlugin:<name>`   —— 托管设置启用的插件(壳在「只许托管 hook」治理下仍保留它们)。**托管**。
+ *  · `user` / `project` / `local` / `flag` —— 设置文件的各层与启动时给的 `--settings`。非托管。
+ *  · `plugin:<name>`          —— 用户启用的插件。非托管(来源不可信)。
+ * `<name>` 非空、至多 {@link MAX_HOOK_SOURCE_NAME_CHARS} 字;**名只留痕,不作判据**(相只看前缀)。
+ */
+/** 不带名的来源词 → 它跑在哪一相。`satisfies Record<…>`:加一个词不写相 = 编译红。 */
+declare const HOOK_SOURCE_WORD_PHASE: {
+    readonly managedPolicy: "managedPolicy";
+    readonly user: "unmanaged";
+    readonly project: "unmanaged";
+    readonly local: "unmanaged";
+    readonly flag: "unmanaged";
+};
+/** 带名的来源前缀(`<prefix>:<name>`)→ 它跑在哪一相。 */
+declare const HOOK_SOURCE_PREFIX_PHASE: {
+    readonly managedPlugin: "managedPlugin";
+    readonly plugin: "unmanaged";
+};
+type HookSourceWord = keyof typeof HOOK_SOURCE_WORD_PHASE;
+type HookSourcePrefix = keyof typeof HOOK_SOURCE_PREFIX_PHASE;
+/** 一个 hook 组的来源(闭集;见文件头)。 */
+export type HookGroupSource = HookSourceWord | `${HookSourcePrefix}:${string}`;
+/**
+ * 执行相 —— **固定次序**就是这张数组的次序:非托管 → 托管插件 → 托管策略(终判)。后一相在前一相的最终输入上跑;结果按信任序(倒序)读。
+ * 托管 = 后两相;非托管与托管各一只事件墙钟(见 `hook-runner.ts`)。
+ */
+export declare const HOOK_PHASES: readonly ["unmanaged", "managedPlugin", "managedPolicy"];
+export type HookPhase = (typeof HOOK_PHASES)[number];
+/** 来源的名的长度上限(`managedPlugin:` / `plugin:` 之后那一段)。 */
+export declare const MAX_HOOK_SOURCE_NAME_CHARS = 128;
+/** 受理面的读法:合形 ⇒ 来源;否则 `undefined`(调用方铸拒)。只认 own 词(`Object.hasOwn`:原型上的名字不是词表成员)。 */
+export declare function readHookGroupSource(raw: unknown): HookGroupSource | undefined;
+/** 来源 → 相。缺席 ⇒ 非托管(老包不带 `source`:行为与此前逐字同)。 */
+export declare function hookPhaseOf(source: HookGroupSource | undefined): HookPhase;
+/** 拒句里的词表(由两张表派生,不另写一份)。 */
+export declare const HOOK_SOURCE_VOCABULARY_SENTENCE: string;
+export {};
+//# sourceMappingURL=hook-source.d.ts.map

package/dist/hooks/hook-source.js

@@ -0,0 +1,40 @@
+const HOOK_SOURCE_WORD_PHASE = {
+    managedPolicy: "managedPolicy",
+    user: "unmanaged",
+    project: "unmanaged",
+    local: "unmanaged",
+    flag: "unmanaged",
+};
+const HOOK_SOURCE_PREFIX_PHASE = {
+    managedPlugin: "managedPlugin",
+    plugin: "unmanaged",
+};
+export const HOOK_PHASES = ["unmanaged", "managedPlugin", "managedPolicy"];
+export const MAX_HOOK_SOURCE_NAME_CHARS = 128;
+export function readHookGroupSource(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    if (Object.hasOwn(HOOK_SOURCE_WORD_PHASE, raw))
+        return raw;
+    const colon = raw.indexOf(":");
+    if (colon <= 0)
+        return undefined;
+    const prefix = raw.slice(0, colon);
+    const name = raw.slice(colon + 1);
+    if (!Object.hasOwn(HOOK_SOURCE_PREFIX_PHASE, prefix))
+        return undefined;
+    if (name.length === 0 || name.length > MAX_HOOK_SOURCE_NAME_CHARS)
+        return undefined;
+    return raw;
+}
+export function hookPhaseOf(source) {
+    if (source === undefined)
+        return "unmanaged";
+    if (Object.hasOwn(HOOK_SOURCE_WORD_PHASE, source))
+        return HOOK_SOURCE_WORD_PHASE[source];
+    return HOOK_SOURCE_PREFIX_PHASE[source.slice(0, source.indexOf(":"))];
+}
+export const HOOK_SOURCE_VOCABULARY_SENTENCE = `${Object.keys(HOOK_SOURCE_WORD_PHASE).join(" / ")}, or ${Object.keys(HOOK_SOURCE_PREFIX_PHASE)
+    .map((p) => `${p}:<name>`)
+    .join(" / ")} with a non-empty name of at most ${MAX_HOOK_SOURCE_NAME_CHARS} characters`;
+//# sourceMappingURL=hook-source.js.map

package/dist/http/active-run-conflict.d.ts

@@ -39,16 +39,8 @@ export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an act
  * **不是** token 摘要,理由是「最需要它的投影面恰恰是拿不到 token 的那些」——本载体就是其中之一)。
  * ⚠️ 它**不是** askId 的替代:askId 是 `approval_ask` 行的身份,checkpointId 是 checkpoint 行的身份,
  * 两者一对多且今天仍无反查读口(那条记账原样有效,别据本键认为它已销账)。
- * ⚠️ **辖域如实**:本批只把这一位投到**本载体**(409 体 + 其 done 帧)。另外三条 park 读面今天都**没有**
- * 这一格,而且它们的**代价不同**(亲核过读面真码,别按一句「都补上」估工):
- *   · `/v1/assistant/inbox` 读 `listByScope` ⇒ core 的 `CheckpointSummary`,**值已经在手**(core
- *     `summarizeCheckpoint` 单源投影里就带着),补它 = 那张显式白名单上加一行,零 SQL 面;
- *   · `GET /v1/approvals` 与 `/v1/approvals/stream` 读的是**本仓自己的** `PendingCheckpoint`
- *     (`checkpoint-store-sql.ts` 的 `listPending`,**按列 SELECT、刻意不拉 blob** —— 那是它避免读放大
- *     的既定姿势),所以这一位**不在手**:要补得给 checkpoint 表反范式一列(与 `gate_kind` /
- *     `bound_input_hash` / `risk_descriptor` 同族)⇒ **SQL 面 = 双库集成门**,不是顺手一行。
- * 补它们是另一批的事(各自过三问:谁需要跨面 join、join 不上谁受伤、补偿是什么),别在文档或消费码里
- * 预支「两面能对上」。
+ * 7.133.0 起三条 durable 读面(运维队列行 `GET /v1/approvals` + `/v1/approvals/stream` 帧、停驻收件 `GET /v1/assistant/inbox` 行)同带这一格,
+ * 同一信任边界({@link trustedCheckpointId}),在那三面上它是 join 键(有可信值就带;缺它的行照列、键缺席 + 计数,见 `checkpoint-identity.ts`)。
  *
  * 🔴 **keyset 门辖域外,故在此成文**:`src/trace/core-keyset-guard.ts` 的七个面是
  * TaskNotificationPayload / BackgroundChildEvent / RosterEntry / AskRequest+ToolApprovalFrame /
@@ -62,11 +54,11 @@ export interface PendingGateMaterial {
     /** 见 {@link PendingGateMaterial} 顶注:`true` 才在场,恒不写 `false`。 */
     governanceForced?: true;
     /** [ref](core 5.42.0):这道 park 门的**非秘密稳定身份**(`Checkpoint.checkpointId`)。逐字过境,
-     *  server 绝不自铸、绝不派生(信任边界校验见 `safeCheckpointIdOf`)。
+     *  server 绝不自铸、绝不派生(信任边界校验见 `checkpoint-identity.ts` 的 `trustedCheckpointId`)。
      *  🔴 **缺席是三成因合流的一个形**(R3-[low] 验真后改真 —— 此前这里只写了第一条,那是失真):
      *    ① **legacy 行**:该键诞生前 park 的(core 明写「absent ⇒ legacy row, read compatibly, no backfill」);
-     *    ② **服务端校验拒绝**:行上有值但没过 `safeCheckpointIdOf`(空串 / 超长 / 含 token) ⇒ **数据污染**,
-     *       而它在运维面上今天**与 ① 不可分辨**(见该函数顶注末段的残留登记);
+     *    ② **服务端校验拒绝**:行上有值但没过 `trustedCheckpointId`(空串 / 超长 / 含 token) ⇒ **数据污染**;
+     *       本载体上它与 ① 同形(键缺席、不计数 —— best-effort 分诊材料),durable 读面上两者分计(`checkpoint-identity.ts` 头注);
      *    ③ **材料读取失败**:整只 `pendingGate` 都不在(那时本键连位置都没有)。
      *  ⇒ 读作「不知道这道门叫什么」,**不是**「这道门没有身份」,更**不是**「这一定是条老行」。
      *

package/dist/http/active-run-conflict.js

@@ -2,6 +2,8 @@ import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { refusalBody } from "./refusal-body.js";
+import { trustedCheckpointId } from "../checkpoint-identity.js";
 export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
 export function resumeEntryForGate(kind, ids) {
     switch (kind) {
@@ -18,15 +20,6 @@ export function resumeEntryForGate(kind, ids) {
             return null;
     }
 }
-const MAX_CHECKPOINT_ID_CHARS = 128;
-function safeCheckpointIdOf(raw, token) {
-    if (typeof raw !== "string" || raw === "" || raw.length > MAX_CHECKPOINT_ID_CHARS)
-        return undefined;
-    const secret = token === undefined || token === null ? "" : String(token).toLowerCase();
-    if (secret !== "" && raw.toLowerCase().includes(secret))
-        return undefined;
-    return raw;
-}
 export function isActiveRunConflictBody(body) {
     return typeof body === "object" && body !== null && "activeTaskId" in body && body.errorCode === "conflict.session_active_run";
 }
@@ -42,12 +35,15 @@ export function toDoneFrameResult(body) {
         ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
     };
 }
+function activeRunConflictBody(message, facts) {
+    const body = refusalBody({ errorCode: "conflict.session_active_run", message, facts });
+    if (!isActiveRunConflictBody(body))
+        throw new Error("session-active-run conflict body lost its identity keys (errorCode / activeTaskId)");
+    return body;
+}
 export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
-    const base = {
-        error: ACTIVE_RUN_CONFLICT_BASE_TEXT,
-        errorCode: "conflict.session_active_run",
-        activeTaskId: activeTaskId ?? null,
-    };
+    const baseFacts = { activeTaskId: activeTaskId ?? null };
+    const base = activeRunConflictBody(ACTIVE_RUN_CONFLICT_BASE_TEXT, baseFacts);
     if (!activeTaskId)
         return base;
     try {
@@ -60,13 +56,12 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             const updatedAtMs = row?.updatedAt !== undefined ? new Date(row.updatedAt).getTime() : Number.NaN;
             const staleMs = (deps.runStaleSec ?? 0) * 1000;
             const stale = staleMs > 0 && Number.isFinite(updatedAtMs) && Date.now() - updatedAtMs > staleMs;
-            return {
-                ...base,
-                error: "session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)",
+            return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
+                ...baseFacts,
                 activeTaskStatus: status,
                 ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
                 ...(stale ? { stale: true } : {}),
-            };
+            });
         }
         const cs = deps.checkpointStore;
         let pendingGate;
@@ -79,7 +74,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             const kind = gate?.kind;
             const decidePath = kind ? resumeEntryForGate(kind, { sessionId, taskId: activeTaskId }) : null;
             const governanceForced = governanceOriginOf(gate, deps.governance);
-            const checkpointId = safeCheckpointIdOf(row?.checkpointId, token);
+            const checkpointId = trustedCheckpointId(row?.checkpointId, token);
             if (kind && decidePath) {
                 pendingGate = {
                     kind,
@@ -89,14 +84,9 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
                 };
             }
         }
-        return {
-            ...base,
-            error: pendingGate
-                ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
-                : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`,
-            activeTaskStatus: status,
-            ...(pendingGate ? { pendingGate } : {}),
-        };
+        return activeRunConflictBody(pendingGate
+            ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
+            : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`, { ...baseFacts, activeTaskStatus: status, ...(pendingGate ? { pendingGate } : {}) });
     }
     catch {
         recordFailOpen("server.approvals.active-run-conflict-material-unavailable");

package/dist/http/admission.js

@@ -1,23 +1,27 @@
 import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
-import { modelUnavailableMessage } from "../model-entry-refusal.js";
+import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, parseHooksConfig, hooksMatcherIssue } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
-import { skillToolListsOverCap } from "../rule-entry-list.js";
-import { limitRefusal } from "../limit-refusal.js";
-import { quotedCallerText } from "../caller-text-echo.js";
+import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
+import { limitFacts, limitRefusal } from "../limit-refusal.js";
+import { fieldConflictFacts } from "../field-conflict.js";
+import { echoCallerText, quotedCallerText } from "../caller-text-echo.js";
 import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
+import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { sendError, sendHttpError } from "./send.js";
 import { refuseSubmitBody } from "./request-guards.js";
@@ -27,38 +31,56 @@ const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
+const MAX_JOB_ID_CHARS = 64;
+const MAX_CLIENT_TIMEZONE_CHARS = 64;
+const MAX_CLIENT_USER_EMAIL_CHARS = 256;
+const MAX_SANDBOX_IMAGE_PROFILE_CHARS = 128;
+const MAX_RESUME_AT_CHARS = 64;
+const overCharsFacts = (field, v, cap) => (typeof v === "string" && v.length > cap ? limitFacts(field, "characters", v.length, cap) : undefined);
+const multiAttemptFields = (body) => {
+    const out = [];
+    if (body.verify === true)
+        out.push("verify");
+    if (body.cascade === true)
+        out.push("cascade");
+    return out;
+};
 export function validateUserSkills(skills) {
     if (skills === undefined)
         return null;
     if (!Array.isArray(skills))
         return { message: "skills must be an array of { name, description, content }" };
     for (let k = 0; k < skills.length; k++) {
-        const shape = userSkillShapeIssue(skills[k]);
+        const shape = userSkillShapeIssue(skills[k], k);
         if (shape !== null)
-            return { message: shape };
+            return shape;
         const over = skillToolListsOverCap(skills[k], `skills[${k}]`, "top");
         if (over !== undefined)
             return { message: over.message, ...(over.extra !== undefined ? { facts: over.extra } : {}) };
     }
     return null;
 }
-function userSkillShapeIssue(item) {
+function userSkillShapeIssue(item, index) {
     if (item === null || typeof item !== "object")
-        return "each skill must be an object { name, description, content }";
+        return { message: "each skill must be an object { name, description, content }" };
     const s = item;
     if (typeof s["name"] !== "string" || s["name"].length === 0)
-        return "skill.name must be a non-empty string";
+        return { message: "skill.name must be a non-empty string" };
     if (typeof s["description"] !== "string")
-        return "skill.description must be a string";
-    if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS)
-        return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
-    if (s["baseDir"] !== undefined && !isAbsoluteHostPath(s["baseDir"]))
-        return `skill.baseDir must be an absolute path string of at most ${ABSOLUTE_HOST_PATH_MAX} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`;
+        return { message: "skill.description must be a string" };
+    if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS) {
+        const facts = overCharsFacts(`skills[${index}].content`, s["content"], MAX_SKILL_CONTENT_CHARS);
+        return { message: `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`, ...(facts === undefined ? {} : { facts }) };
+    }
+    if (s["baseDir"] !== undefined && !isAbsoluteHostPath(s["baseDir"])) {
+        const facts = overCharsFacts(`skills[${index}].baseDir`, s["baseDir"], ABSOLUTE_HOST_PATH_MAX);
+        return { message: `skill.baseDir must be an absolute path string of at most ${ABSOLUTE_HOST_PATH_MAX} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`, ...(facts === undefined ? {} : { facts }) };
+    }
     if (skillCarriesRetiredManifest(s))
-        return SKILL_MANIFEST_RETIRED;
+        return { message: SKILL_MANIFEST_RETIRED };
     for (const key of ["allowedTools", "disallowedTools"]) {
         if (s[key] !== undefined && !skillToolListOk(s[key]))
-            return `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))`;
+            return { message: `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))` };
     }
     return null;
 }
@@ -72,7 +94,7 @@ function refuseUnavailableModel(res, config, field, ref) {
     const hit = refusedCatalogEntry(ref, config.modelRefusals);
     if (hit === undefined)
         return false;
-    const message = modelUnavailableMessage(field, ref.slice(0, 120), hit.name, hit.refusal);
+    const message = modelUnavailableMessage(field, ref, hit.name, hit.refusal);
     sendError(res, 400, "request.model_unavailable", message);
     return true;
 }
@@ -96,7 +118,7 @@ export function createAdmission(ctx) {
         {
             const refusal = refuseSubmitBody(sqlWallsOf(deps.sqlEngine), body);
             if (refusal !== null) {
-                const facts = { wallSource: refusal.wallSource };
+                const facts = { ...limitFacts("body", "bytes", refusal.bytes, refusal.limitBytes), wallSource: refusal.wallSource };
                 switch (refusal.wallSource) {
                     case "reported":
                         switch (refusal.by) {
@@ -149,8 +171,8 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > 64)) {
-            sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
+        if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > MAX_JOB_ID_CHARS)) {
+            sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters", overCharsFacts("jobId", body.jobId, MAX_JOB_ID_CHARS));
             return null;
         }
         {
@@ -161,7 +183,7 @@ export function createAdmission(ctx) {
             }
         }
         if (typeof body.systemPrompt === "string" && body.systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-            sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
+            sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`, limitFacts("systemPrompt", "characters", body.systemPrompt.length, MAX_SYSTEM_PROMPT_CHARS));
             return null;
         }
         if (body.appendSystemPrompt !== undefined) {
@@ -170,7 +192,7 @@ export function createAdmission(ctx) {
                 return null;
             }
             if (body.appendSystemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendError(res, 400, "request.field_invalid", `appendSystemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
+                sendError(res, 400, "request.field_invalid", `appendSystemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`, limitFacts("appendSystemPrompt", "characters", body.appendSystemPrompt.length, MAX_SYSTEM_PROMPT_CHARS));
                 return null;
             }
         }
@@ -203,14 +225,12 @@ export function createAdmission(ctx) {
                 }
             }
             if (typeof st.outputStyle === "string" && st.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-                sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`);
+                sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`, limitFacts("settings.outputStyle", "characters", st.outputStyle.length, MAX_SETTINGS_OUTPUT_STYLE_CHARS));
                 return null;
             }
-            if (typeof st.outputStyle === "string" &&
-                st.outputStyle.length > 0 &&
-                typeof body.appendSystemPrompt === "string" &&
-                body.appendSystemPrompt.length + 2 + st.outputStyle.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`);
+            const foldedChars = typeof st.outputStyle === "string" && st.outputStyle.length > 0 && typeof body.appendSystemPrompt === "string" ? body.appendSystemPrompt.length + 2 + st.outputStyle.length : 0;
+            if (foldedChars > MAX_SYSTEM_PROMPT_CHARS) {
+                sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`, fieldConflictFacts("system_prompt_fold", ["appendSystemPrompt", "settings.outputStyle"], { count: foldedChars, cap: MAX_SYSTEM_PROMPT_CHARS }));
                 return null;
             }
             const perms = st.permissions;
@@ -225,6 +245,20 @@ export function createAdmission(ctx) {
                     return null;
                 }
             }
+            {
+                const seatIssue = tightenOnlySeatIssue(st);
+                if (seatIssue) {
+                    sendError(res, 400, "request.field_invalid", seatIssue.message, seatIssue.fields);
+                    return null;
+                }
+            }
+            {
+                const familiesIssue = approvalFrameFamiliesIssue(st);
+                if (familiesIssue) {
+                    sendError(res, 400, "request.field_invalid", familiesIssue.message, familiesIssue.fields);
+                    return null;
+                }
+            }
             const envRaw = st.env;
             if (envRaw !== undefined && envRaw !== null) {
                 if (typeof envRaw !== "object" || Array.isArray(envRaw)) {
@@ -233,12 +267,16 @@ export function createAdmission(ctx) {
                 }
                 const entries = Object.entries(envRaw);
                 if (entries.length > MAX_SETTINGS_ENV_VARS) {
-                    sendError(res, 400, "request.field_invalid", `settings.env must have at most ${MAX_SETTINGS_ENV_VARS} variables`);
+                    sendError(res, 400, "request.field_invalid", `settings.env must have at most ${MAX_SETTINGS_ENV_VARS} variables`, limitFacts("settings.env", "entries", entries.length, MAX_SETTINGS_ENV_VARS));
                     return null;
                 }
                 for (const [k, val] of entries) {
-                    if (k.length > MAX_SETTINGS_ENV_KEY_CHARS || (typeof val === "string" && val.length > MAX_SETTINGS_ENV_VALUE_CHARS)) {
-                        sendError(res, 400, "request.field_invalid", `settings.env keys must be ≤${MAX_SETTINGS_ENV_KEY_CHARS} chars and values ≤${MAX_SETTINGS_ENV_VALUE_CHARS} chars`);
+                    const keyOver = k.length > MAX_SETTINGS_ENV_KEY_CHARS;
+                    const valueOver = typeof val === "string" && val.length > MAX_SETTINGS_ENV_VALUE_CHARS;
+                    if (keyOver || valueOver) {
+                        const field = `settings.env.${echoCallerText(k, { maxChars: MAX_SETTINGS_ENV_KEY_CHARS })}`;
+                        const facts = keyOver ? limitFacts(field, "characters", k.length, MAX_SETTINGS_ENV_KEY_CHARS) : limitFacts(field, "characters", val.length, MAX_SETTINGS_ENV_VALUE_CHARS);
+                        sendError(res, 400, "request.field_invalid", `settings.env keys must be ≤${MAX_SETTINGS_ENV_KEY_CHARS} chars and values ≤${MAX_SETTINGS_ENV_VALUE_CHARS} chars`, facts);
                         return null;
                     }
                 }
@@ -284,13 +322,14 @@ export function createAdmission(ctx) {
         }
         if (Array.isArray(body.images)) {
             if (body.images.length > MAX_IMAGES_PER_REQUEST) {
-                sendError(res, 413, "request.payload_too_large", `at most ${MAX_IMAGES_PER_REQUEST} images per request`);
+                sendError(res, 413, "request.payload_too_large", `at most ${MAX_IMAGES_PER_REQUEST} images per request`, limitFacts("images", "entries", body.images.length, MAX_IMAGES_PER_REQUEST));
                 return null;
             }
-            for (const img of body.images) {
+            for (const [i, img] of body.images.entries()) {
                 const data = img.data;
-                if (typeof data === "string" && Buffer.byteLength(data, "utf8") > MAX_IMAGE_BASE64_BYTES) {
-                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes (the engine's inline-image limit — the model API's 5 MB image cap)`);
+                const dataBytes = typeof data === "string" ? Buffer.byteLength(data, "utf8") : 0;
+                if (dataBytes > MAX_IMAGE_BASE64_BYTES) {
+                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes (the engine's inline-image limit — the model API's 5 MB image cap)`, limitFacts(`images[${i}].data`, "bytes", dataBytes, MAX_IMAGE_BASE64_BYTES));
                     return null;
                 }
             }
@@ -301,17 +340,17 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "clientContext must be an object");
                 return null;
             }
-            if (cc.timeZone !== undefined && (typeof cc.timeZone !== "string" || cc.timeZone.length > 64)) {
-                sendError(res, 400, "request.field_invalid", "clientContext.timeZone must be a string of at most 64 characters");
+            if (cc.timeZone !== undefined && (typeof cc.timeZone !== "string" || cc.timeZone.length > MAX_CLIENT_TIMEZONE_CHARS)) {
+                sendError(res, 400, "request.field_invalid", "clientContext.timeZone must be a string of at most 64 characters", overCharsFacts("clientContext.timeZone", cc.timeZone, MAX_CLIENT_TIMEZONE_CHARS));
                 return null;
             }
-            if (cc.userEmail !== undefined && (typeof cc.userEmail !== "string" || cc.userEmail.length > 256)) {
-                sendError(res, 400, "request.field_invalid", "clientContext.userEmail must be a string of at most 256 characters");
+            if (cc.userEmail !== undefined && (typeof cc.userEmail !== "string" || cc.userEmail.length > MAX_CLIENT_USER_EMAIL_CHARS)) {
+                sendError(res, 400, "request.field_invalid", "clientContext.userEmail must be a string of at most 256 characters", overCharsFacts("clientContext.userEmail", cc.userEmail, MAX_CLIENT_USER_EMAIL_CHARS));
                 return null;
             }
         }
-        if (body.sandboxImageProfile !== undefined && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0 || body.sandboxImageProfile.length > 128)) {
-            sendError(res, 400, "request.field_invalid", "sandboxImageProfile must be a non-empty string of at most 128 characters");
+        if (body.sandboxImageProfile !== undefined && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0 || body.sandboxImageProfile.length > MAX_SANDBOX_IMAGE_PROFILE_CHARS)) {
+            sendError(res, 400, "request.field_invalid", "sandboxImageProfile must be a non-empty string of at most 128 characters", overCharsFacts("sandboxImageProfile", body.sandboxImageProfile, MAX_SANDBOX_IMAGE_PROFILE_CHARS));
             return null;
         }
         if (body.capabilitiesNeeded !== undefined && (!Array.isArray(body.capabilitiesNeeded) || body.capabilitiesNeeded.some((c) => typeof c !== "string"))) {
@@ -319,11 +358,11 @@ export function createAdmission(ctx) {
             return null;
         }
         if (Array.isArray(body.capabilitiesNeeded) && body.capabilitiesNeeded.length > 0 && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0)) {
-            sendError(res, 400, "request.field_conflict", "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)");
+            sendError(res, 400, "request.field_conflict", "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)", fieldConflictFacts("image_profile", ["capabilitiesNeeded", "sandboxImageProfile"]));
             return null;
         }
         if (typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 && (body.cascade === true || body.verify === true)) {
-            sendError(res, 400, "request.field_conflict", "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)");
+            sendError(res, 400, "request.field_conflict", "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)", fieldConflictFacts("cascade_verify", ["sandboxImageProfile", ...multiAttemptFields(body)]));
             return null;
         }
         if (body.outputSchema !== undefined) {
@@ -331,8 +370,9 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "outputSchema must be a JSON Schema object");
                 return null;
             }
-            if (JSON.stringify(body.outputSchema).length > MAX_OUTPUT_SCHEMA_CHARS) {
-                sendError(res, 400, "request.field_invalid", `outputSchema must serialize to at most ${MAX_OUTPUT_SCHEMA_CHARS} characters`);
+            const schemaChars = JSON.stringify(body.outputSchema).length;
+            if (schemaChars > MAX_OUTPUT_SCHEMA_CHARS) {
+                sendError(res, 400, "request.field_invalid", `outputSchema must serialize to at most ${MAX_OUTPUT_SCHEMA_CHARS} characters`, limitFacts("outputSchema", "characters", schemaChars, MAX_OUTPUT_SCHEMA_CHARS));
                 return null;
             }
         }
@@ -341,12 +381,12 @@ export function createAdmission(ctx) {
             return null;
         }
         if (body.resumeAt !== undefined) {
-            if (typeof body.resumeAt !== "string" || body.resumeAt.length === 0 || body.resumeAt.length > 64) {
-                sendError(res, 400, "request.field_invalid", "resumeAt must be a non-empty message eventId string (≤64 chars)");
+            if (typeof body.resumeAt !== "string" || body.resumeAt.length === 0 || body.resumeAt.length > MAX_RESUME_AT_CHARS) {
+                sendError(res, 400, "request.field_invalid", "resumeAt must be a non-empty message eventId string (≤64 chars)", overCharsFacts("resumeAt", body.resumeAt, MAX_RESUME_AT_CHARS));
                 return null;
             }
             if (body.verify === true || body.cascade === true) {
-                sendError(res, 400, "request.field_conflict", "resumeAt is not supported with verify or cascade (those start a fresh/replaced session)");
+                sendError(res, 400, "request.field_conflict", "resumeAt is not supported with verify or cascade (those start a fresh/replaced session)", fieldConflictFacts("cascade_verify", ["resumeAt", ...multiAttemptFields(body)]));
                 return null;
             }
         }
@@ -356,7 +396,7 @@ export function createAdmission(ctx) {
                 return null;
             }
             if (body.resumeAt === undefined) {
-                sendError(res, 400, "request.field_conflict", "resumeAtMode requires resumeAt (it qualifies the rewind target)");
+                sendError(res, 400, "request.field_conflict", "resumeAtMode requires resumeAt (it qualifies the rewind target)", fieldConflictFacts("resume_anchor", ["resumeAtMode", "resumeAt"]));
                 return null;
             }
         }
@@ -407,7 +447,7 @@ export function createAdmission(ctx) {
             }
         }
         if (fileHistoryRestoreConflict(body)) {
-            sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE);
+            sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE, fieldConflictFacts("file_history_restore", ["fileHistory", ...fileHistoryRestoreKeysInBody(body)]));
             return null;
         }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
@@ -514,7 +554,7 @@ export function createAdmission(ctx) {
             if (um !== undefined && refuseUnavailableModel(res, deps.config, `agents[${um.index}].model`, um.ref))
                 return null;
             if (um !== undefined) {
-                sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
+                sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${echoModelRef(um.ref)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
                 return null;
             }
         }
@@ -541,9 +581,12 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        if (body.disableSkills === true && ((body.skills?.length ?? 0) > 0 || (body.agents ?? []).some((a) => (a.skills?.length ?? 0) > 0))) {
-            sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other");
-            return null;
+        if (body.disableSkills === true) {
+            const skillSeats = [...((body.skills?.length ?? 0) > 0 ? ["skills"] : []), ...(body.agents ?? []).flatMap((a, i) => ((a.skills?.length ?? 0) > 0 ? [`agents[${i}].skills`] : []))];
+            if (skillSeats.length > 0) {
+                sendError(res, 400, "request.field_conflict", "disableSkills: true means this run installs no skill at all (not the deployment's, not the request's), so it cannot come with a non-empty skills or agents[].skills — send one or the other", fieldConflictFacts("skills_disabled", ["disableSkills", ...skillSeats]));
+                return null;
+            }
         }
         {
             const v = body.userInvokedSkills;
@@ -608,7 +651,7 @@ export function createAdmission(ctx) {
             if (matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined) {
                 if (refuseUnavailableModel(res, deps.config, "model", body.model))
                     return null;
-                sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
+                sendError(res, 400, "request.unknown_reference", `unknown model "${echoModelRef(body.model)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
         }
@@ -622,7 +665,7 @@ export function createAdmission(ctx) {
             if (matchCatalogModel(body.compactionModel, catalog, deps.config.modelRefusals) === undefined) {
                 if (refuseUnavailableModel(res, deps.config, "compactionModel", body.compactionModel))
                     return null;
-                sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
+                sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${echoModelRef(body.compactionModel)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
         }
@@ -663,17 +706,24 @@ export function createAdmission(ctx) {
         const verify = verifyRoundsFromBody(body);
         const cascade = body.cascade === true;
         if (cascade && verify) {
-            sendError(res, 400, "request.field_conflict", "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)");
+            sendError(res, 400, "request.field_conflict", "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)", fieldConflictFacts("cascade_verify", ["verify", "cascade"]));
             return null;
         }
         if (body.suggestNextPrompts && (verify || cascade)) {
-            sendError(res, 400, "request.field_conflict", "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)");
+            sendError(res, 400, "request.field_conflict", "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)", fieldConflictFacts("cascade_verify", ["suggestNextPrompts", ...multiAttemptFields(body)]));
             return null;
         }
         if (cascade && deps.config.cascadeLadder.length === 0) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
+        {
+            const refusal = requestTrustRefusal({ permissions: parseTaskSettings(body.settings).settings?.permissions, skills: body.skills, userInvokedSkills: body.userInvokedSkills }, callerTrust(req, deps.config));
+            if (refusal !== undefined) {
+                sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
+                return null;
+            }
+        }
         const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
@@ -691,7 +741,8 @@ export function createAdmission(ctx) {
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}) };
+            const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {