@sema-agent/server 7.133.0 → 7.135.0

package/dist/capabilities/mcp-probe.d.ts

@@ -1,7 +1,7 @@
 /**
- * S-481 —— **无 run 可读的逐台 MCP 状态面**的 server 半场(设计稿 `2026-09-19-s481-mcp-status-face-v1`)。
+ * [ref] —— **无 run 可读的逐台 MCP 状态面**的 server 半场(设计稿 `2026-09-19-s481-mcp-status-face-v1`)。
  *
- * ## 病(deploy 报案 I-1 / cli L-303)
+ * ## 病(deploy 报案 I-1 / cli [ref])
  * 壳的一次性命令(`sema mcp list`)与交互会话对同一台 MCP 服务器给出**相反**的答案:命令行报 Failed、
  * 会话里那台 server 的工具却能用。根因不是判定不同,而是**没有面** —— 一个从未起过 run 的会话在本服务上
  * 只有 `GET /v1/capabilities.mcp` 那一枚布尔,壳只能自己去拨号、自己造词。
@@ -33,6 +33,7 @@
  *    在 core 那边没有任何期限(core `docs/KNOWN-LIMITS.md`)—— 那一形上本面同样没有期限,补偿只有限速与缓存。
  */
 import { type McpServerSpec } from "@sema-agent/core";
+import type { UrlCredentialFacts } from "../url-credential.js";
 /**
  * 本面的**拒码闭集**(设计稿 §2 的四枚)。闭集写成型,是为了让 {@link MCP_PROBE_HTTP_STATUS} 那张表
  * 「漏一枚 = 编译红」—— [ref] 的安全轴纪律:词表是闭集,未处置的成员必须是编译错误而不是运行期惊喜。
@@ -40,7 +41,7 @@ import { type McpServerSpec } from "@sema-agent/core";
 export declare const MCP_PROBE_REFUSAL_CODES: readonly ["capability.mcp_injection_required", "limit.rate_exceeded", "request.body_shape", "request.field_invalid", "state.mcp_probe_incomplete"];
 export type McpProbeRefusalCode = (typeof MCP_PROBE_REFUSAL_CODES)[number];
 /**
- * 🔴 **状态档取单表**(`GOVERNANCE_HTTP_STATUS` 的同族形,S-201② 的那条律):一个码在本服务上只有**一个**
+ * 🔴 **状态档取单表**(`GOVERNANCE_HTTP_STATUS` 的同族形,[ref]② 的那条律):一个码在本服务上只有**一个**
  * 状态,而路由层**一个字面量都不许手写**。写成 `as const satisfies` 两头都占:格是字面量型(直接当
  * `sendError` 的状态参数用,零 `?? 400` 兜底 —— 兜底就是第二份真源),`satisfies` 保住闭集门。
  */
@@ -52,7 +53,7 @@ export declare const MCP_PROBE_HTTP_STATUS: {
     readonly "state.mcp_probe_incomplete": 503;
 };
 /**
- * 每 principal 的固定窗限速。**刻意不挂任何无关旋钮**(S-470 的同一条教训,`DEVICE_ENROLL_RATE_POLICY`
+ * 每 principal 的固定窗限速。**刻意不挂任何无关旋钮**([ref] 的同一条教训,`DEVICE_ENROLL_RATE_POLICY`
  * 先例):全局 `RATE_LIMIT_RPM` 缺省是 `0` = 关断,把一条真拨号的面挂在它上面 = 出厂形不限速。
  * 12/60s 是**安全地板**,不是可调参数;窗是**每副本**的(多副本部署上有效上界 = 12 × 副本数,如实记)。
  */
@@ -157,6 +158,8 @@ export interface McpProbeRefusal {
     readonly message: string;
     /** `request.body_shape` 专用:词表外 / 本面不接线的键,全路径形(已清洗+截断+排序+封顶)。 */
     readonly unknownKeys?: readonly string[];
+    /** [ref]:申报的 `transport.url` 带凭据 ⇒ `field` + `reason`(与提交腿同一只回答者交回的同一组机读位,原样转述)。 */
+    readonly facts?: UrlCredentialFacts;
 }
 /**
  * `POST …/probe` 的体读器:闭形、逐条点名、零静默丢。成功 ⇒ 交给 core 的 `specs`(**原样**转发被读出来的
@@ -164,7 +167,7 @@ export interface McpProbeRefusal {
  *
  * ## 申报「能不能原样用」:问提交腿 fresh 门**同一只**回答者,不另判
  * 本面只判自己那一层(体是对象、顶层只受理 `mcpServers`、这个键必填);`mcpServers` 本身 —— 列表的形、上限、每条的键名与键值 —— 全部交给
- * `task-mcp.ts` 的 `requestMcpDeclarationRefusal`,拒(码 + 句 + `unknownKeys`)原样转述:同一份申报在两扇门上只有一个答案,零拨号之前就给。
+ * `task-mcp.ts` 的 `requestMcpDeclarationRefusal`,拒(码 + 句 + `unknownKeys` + url 带凭据那一形的 `field` / `reason`)原样转述:同一份申报在两扇门上只有一个答案,零拨号之前就给。
  * 回答者受理的申报由**同一只**读器(`validateRequestMcp`)交回,读器的产物就是申报本身(只差判官自己的合法归一),经 `toCoreMcpServerSpec`
  * 得到的就是一条任务提交会交给引擎的那一份 —— 本面拨的正是它。读器只在回答者受理之后才跑,所以它对重放存量 body 才有的降级留痕
  * (`source` 写坏的 F 类丢弃)不会在一次被拒的探测上虚记。
@@ -237,7 +240,7 @@ export interface McpProbeLocal {
 /** 带行为的东西 ⇒ `create*`(工厂命名律:`build*` 出纯数据,`create*` 出活对象)。 */
 export declare function createMcpProbeLocal(): McpProbeLocal;
 /**
- * S-1734 —— 一行的**本面独有**两键:`toolNames` / `toolNamesTruncated`。两条口走同一只 {@link createMcpProbeWalk},
+ * [ref] —— 一行的**本面独有**两键:`toolNames` / `toolNamesTruncated`。两条口走同一只 {@link createMcpProbeWalk},
  * 所以这是它们**唯一**的铸点。
  *
  * ## 来源只有一个
@@ -308,7 +311,7 @@ export declare function buildMcpInjectionRefusal(): McpProbeRefusal;
  *
  * ⚠️ **如实交代一条覆盖边界**:全仓的 `api-error-text-freeze` 门锚的是 `sendError(res, <字面三位数>,
  * "<字面码>", …)`,而本面刻意**不在调用点写字面状态**(状态从 {@link MCP_PROBE_HTTP_STATUS} 单表取,
- * S-201② 那条律),于是这四句结构上够不着那道门。⇒ 它们由 `test/mcp-status-face-s481.test.ts` 的
+ * [ref]② 那条律),于是这四句结构上够不着那道门。⇒ 它们由 `test/mcp-status-face-s481.test.ts` 的
  * 「四句逐字节」那一格钉住(改一个字当场红)。把那道全局门扩到「常量表出站」形是另一台车。
  */
 export declare function buildMcpProbeRateRefusal(): McpProbeRefusal;

package/dist/capabilities/mcp-probe.js

@@ -1,7 +1,7 @@
 import { probeMcpServers } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { createFixedWindowRateLimiter } from "../device-enrollment.js";
-import { canonicalJson } from "../canonical-json.js";
+import { canonicalJsonStringify } from "@sema-agent/core";
 import { keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
 import { requestMcpDeclarationRefusal, validateRequestMcp } from "../task-mcp.js";
 import { specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "../mcp-assertion-header.js";
@@ -86,7 +86,7 @@ export function buildMcpProbeIdentity(principal) {
     return principal !== undefined && principal.length > 0 ? principal : "local";
 }
 export function buildMcpProbeCacheKey(principal, specs) {
-    return `${buildMcpProbeIdentity(principal)}::${createHash("sha256").update(canonicalJson(specs), "utf8").digest("hex")}`;
+    return `${buildMcpProbeIdentity(principal)}::${createHash("sha256").update(canonicalJsonStringify(specs), "utf8").digest("hex")}`;
 }
 export function buildMcpProbeRateKey(principal) {
     return `mcp-probe:${buildMcpProbeIdentity(principal)}`;

package/dist/capabilities/sandbox-file-send.d.ts

@@ -21,7 +21,7 @@
  * silently). But the TENANT judgment INVERTS: an ssh peer is ONE persistent real machine shared by every
  * task (sshExecutionEnvFactory ignores ctx — same host + same mountPath for all tasks; destroy() only
  * disconnects, files persist; capabilities.isolation:false). "Scoped read = tenant boundary" does NOT
- * hold there, so the ssh lane is SINGLE-USER ONLY (same gate as host) — see `sandboxSendLaneEnabled`.
+ * hold there, so the ssh lane is SINGLE-USER ONLY (same gate as host) — the deployment-shape row `sandboxSendUserFile`.
  *
  * The presigned PUT URL is a capability secret: it never enters model context (the tool returns delivery
  * metadata only) and is REDACTED from every error surfaced from here (curl stderr may echo the URL).
@@ -74,23 +74,6 @@ export declare class TaskEnvRegistry {
      *  here forever; the bounded-size backstop covers any remaining no-destroy crash path. */
     wrapFactory(factory: ExecutionEnvFactory): ExecutionEnvFactory;
 }
-/**
- * Which REMOTE_EXEC lanes may register the sandbox-send TaskEnvRegistry (and thus mount the sandbox-lane
- * SendUserFile source), under which tenancy gate. The judgment per lane (2026-07-14 ssh backfill review):
- *
- *  - e2b / k8s: one task = one disposable sandbox; the sandbox filesystem IS the tenant's task workspace,
- *    so a sandbox-scoped read is tenant-scoped by construction → open to any tenant.
- *  - ssh: the peer is ONE persistent real machine SHARED across tasks (factory ignores ctx: every task
- *    gets the same host+mountPath; destroy=disconnect only, files persist). Tenant A's task can read the
- *    residue of tenant B's task → the isolation premise FAILS. Multi-tenant here would be an
- *    arbitrary-host-path-read → public-URL exfil face, so the lane opens ONLY single-user
- *    (`requirePrincipal !== true`), the exact gate the host lane uses. NOT a lane to "fix later with a
- *    per-task workspace": tasks legitimately operate outside any workspace on a real host ([ref] —
- *    batch deployment), so per-task dirs would not restore the boundary anyway.
- *  - adb / local-docker / host / unset: no registry (host+unset use the local-fs source in main.ts;
- *    adb/local-docker remain a follow-on).
- */
-export declare function sandboxSendLaneEnabled(provider: string | undefined, requirePrincipal: boolean): boolean;
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/sandbox-file-send.js

@@ -79,13 +79,6 @@ export class TaskEnvRegistry {
         };
     }
 }
-export function sandboxSendLaneEnabled(provider, requirePrincipal) {
-    if (provider === "e2b" || provider === "k8s")
-        return true;
-    if (provider === "ssh")
-        return requirePrincipal !== true;
-    return false;
-}
 export function redactPutUrl(text, url) {
     return text
         .split(url)

package/dist/capabilities/scenarios.d.ts

@@ -2,7 +2,7 @@ import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, t
 import type { Logger } from "../observability/logger.js";
 import { type SubagentExtraToolSet } from "./builtin-tools.js";
 import { type RepoReadClient } from "./repo-tools.js";
-import { type LoadedSkill } from "./skills.js";
+import { type LoadedSkill, type ScenarioSkillEntry } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
 import type { DelegationRootWitness } from "../delegated-session-owner.js";
 /**
@@ -28,7 +28,7 @@ export interface ScenarioBundle {
      */
     hands: ScenarioHands;
     /**
-     * S-1376:本场景从 roster 里**真卸载**的工具名(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,schema 不进 `tools[]`;不是策略 deny)。缺席 = 不卸。
+     * [ref]:本场景从 roster 里**真卸载**的工具名(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,schema 不进 `tools[]`;不是策略 deny)。缺席 = 不卸。
      * 经 {@link buildExcludeToolsSeat} 与调用方自己的 `excludeTools` 取并后写进 `TaskSpec`(HTTP 腿与 run-local 腿同一只写点)—— 场景只能多卸,调用方也只能多卸。
      * 与 `hands` 正交:`hands: "none"` 是整只手不挂(scan / code-review),本键是挂手之后卸掉其中一部分(cowork 卸编码类工具、留文件读)。
      */
@@ -83,7 +83,7 @@ export interface ScenarioContext {
      */
     sessionId?: string;
     /**
-     * S-1770 / S-1808:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
+     * [ref] / [ref]:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
      * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
      * `rootSessionId` 与赎回腿 claim 前后两读的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
      * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
@@ -104,7 +104,7 @@ export interface ScenarioDeps {
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
     /**
-     * S-1652:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
+     * [ref]:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
      * 「这个场景的 run 有没有工作区」({@link runHasWorkspace}),进而给出附件可受理供给集。**缺席按没有手读**(宁少说不多说:不广告一个会撞 400 的 `path`)。
      */
     handsLane?: boolean;
@@ -123,7 +123,7 @@ export interface ScenarioDeps {
      * execute-time late-bound via ctx.taskId → TaskEnvRegistry, so ONE spec serves every spawn) cannot ride the
      * ASSEMBLY-time static `subagent.tools` pool; core evaluates the factory at each spawn and merges its product into the
      * pool, then it goes through core's `resolveToolSubset` whitelist like any other tool (agent-def allowTools/denyTools
-     * still govern — no extra gate needed on our side). A SET, not a bare factory (core 7.46.0 #1432): its `tools` are both
+     * still govern — no extra gate needed on our side). A SET, not a bare factory (core 7.46.0 [ref]): its `tools` are both
      * what a spawn can be handed and the roster the delegation tool declares (`extraToolNames`), so the factory cannot hand
      * out a tool the roster does not name. Absent ⇒ the delegation tool injects `Now` alone.
      */
@@ -152,7 +152,7 @@ export interface ScenarioDeps {
      */
     checkpointStore?: CheckpointStore;
     /**
-     * S-1770:比 core 挂点多一个参数 —— `root` = **委派树根的见证,由取用这只 bundle 的调用方交出**({@link ScenarioContext.delegationRoot};缺席 = 没有根可交)。
+     * [ref]:比 core 挂点多一个参数 —— `root` = **委派树根的见证,由取用这只 bundle 的调用方交出**({@link ScenarioContext.delegationRoot};缺席 = 没有根可交)。
      * core 的挂点只给子代 id,停驻写下 / 定夺的宿主行属主却要按委派继承律取委派树根的属主;场景工厂把见证绑进交给 core 的那只闭包,同一棵树里任何深度的后台子代
      * 停驻都经它(子代沿用父的委派工具实例)。
      */
@@ -217,12 +217,18 @@ export interface ScenarioDetail {
     /** 机读原因键;仅 `available:false` 时在场(缺席=没有理由)。消费方按键分支,禁匹配英文文案。 */
     unavailableReason?: ScenarioUnavailableReason;
     /**
-     * S-1652:**这个场景在本部署上受理的附件供给**(顶层能力位 `userAttachments.supplies` 的子集,保持席位序;键恒在场,不是 `null`)。
+     * [ref]:**这个场景在本部署上受理的附件供给**(顶层能力位 `userAttachments.supplies` 的子集,保持席位序;键恒在场,不是 `null`)。
      * 顶层能力位说的是引擎席位**能承载**的三种供给(常量);`path` 读的是这一 run 的工作区,只有「场景挂手 ∧ 部署的执行车道有手」的 run 才有
      * (判官 {@link runHasWorkspace}),其余整条 `path` 条目由引擎 prepare 拒 `config.user_attachment_invalid` —— 宿主发之前读这一格,不靠撞 400。
      * `content_text` / `content_image` 与工作区无关,恒在。
      */
     attachmentSupplies: UserAttachmentSupplyWord[];
+    /**
+     * [ref]:**这个场景交进每一个 run 的部署技能**(本部署技能目录 + 配置源交来的;不含请求体自带的 `skills`)—— 名字 / 描述 / 来处,不带正文。
+     * 与工厂交进 `TaskSpec` 的那一份是**同一只过滤**(技能范围 + `skills.ts` 的 `skillsInScope`)的两个投影:同一组、同一个序。名字就是 `userInvokedSkills` 点名用的串。
+     * 键恒在场;没有技能 ⇒ `[]`。
+     */
+    skills: ScenarioSkillEntry[];
 }
 /** 引擎附件席位的供给词(`USER_ATTACHMENT_SEAT.supplies` 的成员;取型,不手抄)。 */
 export type UserAttachmentSupplyWord = (typeof USER_ATTACHMENT_SEAT)["supplies"][number];
@@ -249,14 +255,26 @@ export declare const BUILTIN_SCENARIO_HANDS: {
     readonly scan: "none";
     readonly cowork: "full";
 };
+/**
+ * [ref]:内建场景的**技能范围**(技能 `scenarios` 标签按哪个名字匹配)—— **全仓唯一声明处**:各场景工厂交进 `TaskSpec` 的技能与场景卡上的技能清单都按这张表取范围,
+ * 再过同一只过滤(`skills.ts` 的 `skillsInScope`),两边因此恒为同一组技能。按 {@link BuiltinScenarioName} 键控 ⇒ 加 / 删一个内建场景而这里没跟 = 编译红。
+ * `code` 的范围是 `default`:它与 default 共用一只工厂(工具 / 技能面恒等由构造保证),打了 `scenarios: code` 的技能不进 code 的 run。center 场景的范围是它自己的名字。
+ */
+export declare const BUILTIN_SCENARIO_SKILL_SCOPE: {
+    readonly code: "default";
+    readonly default: "default";
+    readonly "code-review": "code-review";
+    readonly scan: "scan";
+    readonly cowork: "cowork";
+};
 /**
  * `branded` = 这台部署是不是品牌部署 —— 部署座挂品牌行读的同一只判官(`brand-identity.ts` `isBrandedDeployment`)交进来;没有默认值:每个调用点说出这件事实。
  * 品牌部署上,品牌行 `when.binding` 那张表里的场景(`BRAND_IDENTITY_SCENARIOS`)的 `promptSummary` 点名 Sema 产品身份 —— 读面说的就是模型收到的。
  */
-export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "repoClient" | "handsLane">, branded: boolean): Record<string, ScenarioDetail>;
+export declare function builtinScenarioDetails(scenarios: Record<string, Scenario>, deps: Pick<ScenarioDeps, "repoClient" | "handsLane" | "skills">, branded: boolean): Record<string, ScenarioDetail>;
 /** center 条目详情(有效性判定与 centerScenarios 完全同款:无效条目既不进 overlay 也不进详情——
  *  保证约定①「详情显示的来源=运行实际用的定义」永不错位)。 */
-export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient" | "handsLane">): Record<string, ScenarioDetail>;
+export declare function centerScenarioDetails(specs: CenterScenarioSpec[] | undefined, builtinNames: string[], deps: Pick<ScenarioDeps, "repoClient" | "handsLane" | "skills">): Record<string, ScenarioDetail>;
 export interface CenterScenarioSpec {
     name: string;
     toolset: string;
@@ -300,7 +318,7 @@ export declare function centerScenarios(deps: ScenarioDeps, specs: CenterScenari
  * Personalization seam: merge the caller's own skills AFTER the scenario's, with
  * SCENARIO-WINS on a name clash — the scenario / center skills own the name (they are the deployment's baseline
  * wording, not an enforcement face: permissions / write gates / hooks do not ride on skills, and a caller may
- * unload the whole set with `disableSkills`, S-946); user content never shadows them. Duplicate names within the user list keep the first. Clashes are logged for audit
+ * unload the whole set with `disableSkills`, [ref]); user content never shadows them. Duplicate names within the user list keep the first. Clashes are logged for audit
  * (silent drops would make "my skill didn't fire" undebuggable). Input is already shape/size-validated
  * by the HTTP layer (validateUserSkills); this stays pure merge policy.
  */

package/dist/capabilities/scenarios.js

@@ -4,7 +4,7 @@ import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./buil
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { NOW_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
 import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
-import { skillsForScenario } from "./skills.js";
+import { scenarioSkillEntries, skillsForScenario } from "./skills.js";
 import { OFFICE_EXCLUDED_TOOL_NAMES, runHasWorkspace } from "./hands-lane.js";
 import { BRAND_IDENTITY_SCENARIOS } from "./brand-identity.js";
 export function buildPromptSeats(scenarioName, prompt, callerSystemPrompt) {
@@ -69,7 +69,7 @@ export function buildScenarios(deps) {
                 }).filter((t) => t.name !== WEB_FETCH_TOOL_NAME || deps.requirePrincipal !== true),
             ],
             hands: BUILTIN_SCENARIO_HANDS.default,
-            skills: skillsForScenario(deps.skills, "default"),
+            skills: skillsForScenario(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE.default),
         };
     };
     return {
@@ -77,6 +77,7 @@ export function buildScenarios(deps) {
         code: (req, principal, ctx) => ({
             ...defaultScenario(req, principal, ctx),
             hands: BUILTIN_SCENARIO_HANDS.code,
+            skills: skillsForScenario(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE.code),
             prompt: { role: "code" },
         }),
         "code-review": (req) => codeReview(deps, req),
@@ -88,13 +89,13 @@ export function buildScenarios(deps) {
             return {
                 tools: [...repoToolsFor(repoClient, parseRepo(req.repo)), nowTool()],
                 hands: BUILTIN_SCENARIO_HANDS.scan,
-                skills: skillsForScenario(deps.skills, "scan"),
+                skills: skillsForScenario(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE.scan),
             };
         },
         cowork: (req, principal, ctx) => ({
             ...defaultScenario(req, principal, ctx),
             hands: BUILTIN_SCENARIO_HANDS.cowork,
-            skills: skillsForScenario(deps.skills, "cowork"),
+            skills: skillsForScenario(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE.cowork),
             excludeTools: OFFICE_EXCLUDED_TOOL_NAMES,
             prompt: { role: "cowork" },
         }),
@@ -124,6 +125,13 @@ export const BUILTIN_SCENARIO_HANDS = {
     scan: "none",
     cowork: "full",
 };
+export const BUILTIN_SCENARIO_SKILL_SCOPE = {
+    code: "default",
+    default: "default",
+    "code-review": "code-review",
+    scan: "scan",
+    cowork: "cowork",
+};
 export function builtinScenarioDetails(scenarios, deps, branded) {
     const probe = (name, req, principal, fallback) => {
         try {
@@ -138,6 +146,7 @@ export function builtinScenarioDetails(scenarios, deps, branded) {
         name, source: "builtin", builtin: true, summary, toolset, tools, promptSummary, enabled: true,
         ...availabilityFields(deps, toolset),
         attachmentSupplies: attachmentSuppliesFor(BUILTIN_SCENARIO_HANDS[name], deps.handsLane === true),
+        skills: scenarioSkillEntries(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE[name]),
     });
     const brandedScenario = (name) => branded && BRAND_IDENTITY_SCENARIOS.includes(name);
     const details = {
@@ -170,6 +179,7 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             enabled: true,
             ...availabilityFields(deps, spec.toolset),
             attachmentSupplies: attachmentSuppliesFor(toolset.hands, deps.handsLane === true),
+            skills: scenarioSkillEntries(deps.skills, spec.name),
         };
     }
     return out;
@@ -244,7 +254,7 @@ function codeReview(deps, req) {
     }
     const coords = parseRepo(req.repo);
     const repoTools = repoToolsFor(repoClient, coords);
-    const skills = skillsForScenario(deps.skills, "code-review");
+    const skills = skillsForScenario(deps.skills, BUILTIN_SCENARIO_SKILL_SCOPE["code-review"]);
     const hands = BUILTIN_SCENARIO_HANDS["code-review"];
     return { tools: [...repoTools, nowTool()], hands, skills, prompt: { roleText: REVIEWER_ROLE_TEXT } };
 }

package/dist/capabilities/send-user-file-tool.d.ts

@@ -53,7 +53,7 @@ export declare function sendUserFileTool(deps: {
  * posture (their denyTools sets predate this tool, so core's resolveToolSubset would let it through). `ctx.agentType`
  * carries the spawned definition's name (core subagent.js); membership in core's builtin catalog ⇒ inject nothing.
  *
- * 🔴 S-1058(7.116.0):修前这里还有一道 **F1 部署策略预判** —— 部署审批面(`APPROVAL_DENY` / `REQUIRE` / `NEVER_AUTO`)点名 SendUserFile 就一只都
+ * 🔴 [ref](7.116.0):修前这里还有一道 **F1 部署策略预判** —— 部署审批面(`APPROVAL_DENY` / `REQUIRE` / `NEVER_AUTO`)点名 SendUserFile 就一只都
  * 不注入,前提是「subRunner 不带策略、core 的子代不继承父的 toolPolicy」(core 1.287 时的事实)。core 自 7.40.1 起顶层 run 解析后的调用方策略
  * (`spec.toolPolicy ?? deps.toolPolicy`)与它冻结的审批席经继承链(`InheritedGate.parentConstraints`)判子代的注入工具:deny ⇒ 零执行;ask ⇒ 顶层
  * 审批席被问一次;无审批席 ⇒ 拒(core 7.41.0 钉)。本仓在真实装配上亲跑十格(spec / deps 两槽 × deny / ask 允 / ask 拒 / 无审批席 / 耐久车道无活席,

package/dist/capabilities/skills.d.ts

@@ -36,8 +36,16 @@ export interface LoadedSkill {
     spec: SkillSpec;
     /** Scenarios this skill applies to; empty = global (every scenario). */
     scenarios: string[];
+    /**
+     * [ref] —— 这只技能的**来处**,由铸它的那条装载腿写下(唯一写点;之后谁都不改写,只投影):`factory` = 本部署的技能目录(`SKILLS_DIR`,{@link loadDeploymentSkills});
+     * `center` = 本部署的配置源交来的(中心 / 本地 `config.d` 的技能清单 `applySkillsManifest`,或配置声明的插件 `applyCenterPlugins`)。配置源按名盖掉出厂同名技能 ⇒ 盖上来的那只是 `center`。
+     * 场景卡的技能清单原样投这一位(`GET /v1/capabilities/scenarios/:name` 的 `skills[].source`)。
+     */
+    source: SkillSource;
 }
-/** 加载 lane 的信任级。缺席(受控 lane:烤制进镜像的 skills 目录)= 维持既有语义,symlink 照跟
+/** 技能来处的闭集(见 {@link LoadedSkill.source})。 */
+export type SkillSource = "factory" | "center";
+/** 加载 lane 的事实:来处(`source`,必填)与信任级。`confineTo` 缺席(受控 lane:烤制进镜像的 skills 目录)= 维持既有语义,symlink 照跟
  *  ——那个便利是有意的(`foo.md -> 共享文件`)。`confineTo` 在场(**不可信 lane**:第三方 git checkout,
  *  见 center-plugins 的 plugin 装载)= 每个被读条目 realpath 后必须仍在该根之内,逃逸即抛。
  *  🔴 为什么信任级必须是**参数**而不是注释里的假设:本函数的头注原写着「skills dir 全受控」,而
@@ -45,12 +53,13 @@ export interface LoadedSkill {
  *  于是 checkout 里某个 skill 条目(`任意 .md -> /宿主/任意文件`)会被读进 spec.files 进入提示词。resolvePluginSkillsRoot
  *  只 realpath 守了 skills **根**,根下逐条目没守。 */
 export interface LoadSkillsOptions {
+    /** [ref]:这条装载腿铸出的技能的来处({@link LoadedSkill.source})—— **必填**:装载器自己判断不了它读的是哪一种目录,由调用的那条腿说出这件事实。 */
+    source: SkillSource;
     /** 不可信 lane 的约束根(通常=clone root)。缺席=受控 lane,不做逐条目约束。 */
     confineTo?: string;
     /**
-     * S-377 —— 「**工具跑的那台机器**的盘就是本进程这台盘吗」。真 ⇒ 目录形态技能带上自己的目录
-     * (`SkillSpec.baseDir`);假/缺席 ⇒ **不带**。判据的单一属主 = `task-cwd.ts` 的
-     * {@link import("../task-cwd.js").toolsRunOnThisHost}(调用方按它算,别在这里第二次判 lane)。
+     * [ref] —— 「**工具跑的那台机器**的盘就是本进程这台盘吗」。真 ⇒ 目录形态技能带上自己的目录
+     * (`SkillSpec.baseDir`);假/缺席 ⇒ **不带**。判据的单一属主 = 部署形表行 `toolsOnThisHost`(`deployment-shape.ts`;调用方按它算,别在这里第二次判 lane)。
      *
      * 🔴 **缺席 = 不带**,是**故意的 fail-closed 方向**:带了一条工具那边不存在的路径,伤是「模型按它去
      * 读、扑空,顺带看到本机目录布局」;不带的伤只是少一条线索(附件本来就随 invoke 全文内联投递,
@@ -64,13 +73,13 @@ export interface LoadSkillsOptions {
  *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。
  *  `label` = 错误文本里的对象名(center-plugins 用它约束 manifest 本体,报错不该指成 skill entry)。 */
 export declare function assertConfined(p: string, rootReal: string, label?: string): void;
-export declare function loadSkills(dir: string, opts?: LoadSkillsOptions): LoadedSkill[];
+export declare function loadSkills(dir: string, opts: LoadSkillsOptions): LoadedSkill[];
 /**
- * S-602 —— **出厂技能**的装载腿(`SKILLS_DIR` 自扫)。stage-07 与 run-local 两处装配点**都调这一只**:改前两处
- * 各写一遍 `loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) })`,测试只能
+ * [ref] —— **出厂技能**的装载腿(`SKILLS_DIR` 自扫)。stage-07 与 run-local 两处装配点**都调这一只**:改前两处
+ * 各写一遍 `loadSkills(config.skillsDir, { toolsShareThisFilesystem: <车道判据>(config) })`,测试只能
  * 直传布尔去证 `loadSkills`(`baked-skills.test.ts`),证不到「config → 装配腿 → baseDir」这一段;收成一只
- * 之后,联合格从 config 走到 `baseDir`(`test/capabilities-http.test.ts` S-602 段)证的就是两处装配点本人。
- * 判据属主不变:`task-cwd.ts` 的 {@link toolsRunOnThisHost}(S-602 起 in-process ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
+ * 之后,联合格从 config 走到 `baseDir`(`test/capabilities-http.test.ts` [ref] 段)证的就是两处装配点本人。
+ * 判据属主:部署形表行 `toolsOnThisHost`([ref];[ref] 起 in-process ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
  */
 export declare function loadDeploymentSkills(config: {
     readonly skillsDir: string;
@@ -78,9 +87,19 @@ export declare function loadDeploymentSkills(config: {
         readonly provider: RemoteExecProvider;
     } | undefined;
 }, logger?: Logger): LoadedSkill[];
-/** Skills applicable to a scenario: those tagged with it, plus untagged (global) ones.
- *  [ref]:alias 窗撤销,单键查询——退役旧名标签不再命中(迁移面在 7.44 发车帖/MIGRATION 记载)。 */
-export declare function skillsForScenario(loaded: LoadedSkill[], scenario: string): SkillSpec[];
+/** 一个技能范围交进 `TaskSpec` 的技能(场景工厂的 `skills`)。范围从哪来见 `scenarios.ts` 的 `BUILTIN_SCENARIO_SKILL_SCOPE`(center 场景 = 它自己的名字)。 */
+export declare function skillsForScenario(loaded: readonly LoadedSkill[], scope: string): SkillSpec[];
+/**
+ * [ref] —— 场景卡技能清单的一条(`GET /v1/capabilities/scenarios/:name` 的 `skills[]`):名字 / 描述 / 来处,**不带正文**,也不带技能上的两只工具清单
+ * (`allowedTools` / `disallowedTools`)。名字就是提交体 `userInvokedSkills` 点名时用的那个串。
+ */
+export interface ScenarioSkillEntry {
+    readonly name: string;
+    readonly description: string;
+    readonly source: SkillSource;
+}
+/** 一个技能范围的卡上清单 —— 与 {@link skillsForScenario} 同一只过滤、同一个序,只是投影不同。 */
+export declare function scenarioSkillEntries(loaded: readonly LoadedSkill[], scope: string): ScenarioSkillEntry[];
 /** {@link parseFrontmatter} 的三种读数(闭集):`absent` = 第一行不是围栏,没有 frontmatter(正当的全局技能)· `block` = 围栏收好了的块 · `unclosed` = 第一行是围栏而块没收好(读不了 —— 调用方拒载)。 */
 export type FrontmatterRead = {
     readonly kind: "absent";

package/dist/capabilities/skills.js

@@ -1,6 +1,6 @@
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
-import { toolsRunOnThisHost } from "../task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { createLogger } from "../observability/logger.js";
 export function assertConfined(p, rootReal, label = "skill entry") {
     let real;
@@ -15,7 +15,7 @@ export function assertConfined(p, rootReal, label = "skill entry") {
     }
 }
 export function loadSkills(dir, opts) {
-    const logger = opts?.logger ?? createLogger("warn");
+    const logger = opts.logger ?? createLogger("warn");
     let entries;
     try {
         entries = readdirSync(dir, { withFileTypes: true });
@@ -25,15 +25,15 @@ export function loadSkills(dir, opts) {
     }
     const out = [];
     const seen = new Map();
-    const push = (skill, source) => {
+    const push = (skill, file) => {
         const prior = seen.get(skill.spec.name);
         if (prior !== undefined) {
-            throw new Error(`duplicate skill name "${skill.spec.name}": ${prior} vs ${source}`);
+            throw new Error(`duplicate skill name "${skill.spec.name}": ${prior} vs ${file}`);
         }
-        seen.set(skill.spec.name, source);
+        seen.set(skill.spec.name, file);
         out.push(skill);
     };
-    const confineRoot = opts?.confineTo !== undefined ? realpathSync(opts.confineTo) : undefined;
+    const confineRoot = opts.confineTo !== undefined ? realpathSync(opts.confineTo) : undefined;
     const isFileLike = (entry, p) => entry.isFile() || (entry.isSymbolicLink() && statSync(p).isFile());
     const isDirLike = (entry, p) => entry.isDirectory() || (entry.isSymbolicLink() && statSync(p).isDirectory());
     for (const entry of entries.slice().sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
@@ -43,10 +43,10 @@ export function loadSkills(dir, opts) {
             if (confineRoot !== undefined)
                 assertConfined(join(dir, entry.name), confineRoot);
             const raw = readFileSync(join(dir, entry.name), "utf8");
-            const source = join(dir, entry.name);
-            const parsed = parseSkill(raw, entry.name.replace(/\.md$/, ""), source, logger);
+            const file = join(dir, entry.name);
+            const parsed = parseSkill(raw, entry.name.replace(/\.md$/, ""), file, opts.source, logger);
             if (parsed !== undefined)
-                push(parsed, source);
+                push(parsed, file);
         }
         else if (isDirLike(entry, join(dir, entry.name))) {
             const skillDir = join(dir, entry.name);
@@ -61,13 +61,13 @@ export function loadSkills(dir, opts) {
             }
             if (confineRoot !== undefined)
                 assertConfined(join(skillDir, "SKILL.md"), confineRoot);
-            const skill = parseSkill(raw, entry.name, join(skillDir, "SKILL.md"), logger);
+            const skill = parseSkill(raw, entry.name, join(skillDir, "SKILL.md"), opts.source, logger);
             if (skill === undefined)
                 continue;
             const files = collectAttachments(skillDir, "", confineRoot);
             if (files.length > 0)
                 skill.spec.files = files;
-            if (opts?.toolsShareThisFilesystem === true)
+            if (opts.toolsShareThisFilesystem === true)
                 skill.spec.baseDir = resolve(skillDir);
             push(skill, join(skillDir, "SKILL.md"));
         }
@@ -75,7 +75,7 @@ export function loadSkills(dir, opts) {
     return out;
 }
 export function loadDeploymentSkills(config, logger) {
-    return loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config), ...(logger !== undefined ? { logger } : {}) });
+    return loadSkills(config.skillsDir, { source: "factory", toolsShareThisFilesystem: DEPLOYMENT_SHAPE_PREDICATES.toolsOnThisHost.holds(config), ...(logger !== undefined ? { logger } : {}) });
 }
 function collectAttachments(skillDir, rel, confineRoot) {
     const files = [];
@@ -100,12 +100,12 @@ function collectAttachments(skillDir, rel, confineRoot) {
     }
     return files;
 }
-function parseSkill(raw, fallbackName, source, logger) {
+function parseSkill(raw, fallbackName, file, origin, logger) {
     const fm = parseFrontmatter(raw);
     if (fm.kind === "unclosed") {
         logger.warn("skill_refused", {
             skill: fallbackName,
-            source,
+            source: file,
             reason: "frontmatter_unclosed",
             note: "the file opens a frontmatter fence (`---`) that is never closed, so its `scenarios` restriction cannot be read — this skill is NOT loaded (it is not demoted to a global skill); close the fence or remove the opening line",
         });
@@ -119,10 +119,16 @@ function parseSkill(raw, fallbackName, source, logger) {
         .split(",")
         .map((s) => s.trim())
         .filter(Boolean);
-    return { spec: { name, description, content: body.trim() }, scenarios };
+    return { spec: { name, description, content: body.trim() }, scenarios, source: origin };
 }
-export function skillsForScenario(loaded, scenario) {
-    return loaded.filter((k) => k.scenarios.length === 0 || k.scenarios.includes(scenario)).map((k) => k.spec);
+function skillsInScope(loaded, scope) {
+    return loaded.filter((k) => k.scenarios.length === 0 || k.scenarios.includes(scope));
+}
+export function skillsForScenario(loaded, scope) {
+    return skillsInScope(loaded, scope).map((k) => k.spec);
+}
+export function scenarioSkillEntries(loaded, scope) {
+    return skillsInScope(loaded, scope).map((k) => ({ name: k.spec.name, description: k.spec.description, source: k.source }));
 }
 const FRONTMATTER_OPENS_RE = /^---[ \t]*\r?(?:\n|$)/;
 const FRONTMATTER_BLOCK_RE = /^---[ \t]*\r?\n(?:---[ \t]*\r?(?:\n|$)|([\s\S]*?)\r?\n---[ \t]*\r?(?:\n|$))([\s\S]*)$/;

package/dist/capabilities/tool-defer.d.ts

@@ -19,7 +19,7 @@
  *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
  *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
  *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(web-admin 曾有同形近名 `deferModelPlane`,
- *    与本轴无关,已于 S-668 波 0 退役)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
+ *    与本轴无关,已于 [ref] 波 0 退役)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
  *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,
  *    不再是「一定占位」的保证** —— 长尾集单独一只(下面实测 ≈842 字符)远在阈值之下,于是这根旋钮在