@sema-agent/server 7.135.0 → 7.136.0

package/dist/trace/self-minted-wire.d.ts

@@ -831,6 +831,215 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /**
+     * 呈卡帧 `approval_request` 的 `card`(= `card_json` 的耐久卡信封)上本版新铸的键:引擎卡词 `approvalCard`。活铸帧的 `card`、落库的卡信封、断连重放帧的 `card` 三面同源同词
+     * (帧顶层那一份照旧在,同值)。在场律 `present-iff`:引擎铸了卡词且过了闭集窄读才有,引擎没铸 ⇒ 缺席(不编 `generic`);本版之前落下的行卡上没有 ⇒ 重放照旧不带。
+     * 卡信封的其余键不在本表(它们不是本版新上 wire)。
+     */
+    readonly approvalRequestCardKey: {
+        readonly at: "approval_request 帧 card.<键>(活铸帧的 card · 落库的卡信封 card_json · 断连重放帧的 card)";
+        readonly members: {
+            readonly approvalCard: {
+                readonly attr: "present-iff";
+                readonly since: "7.136.0";
+            };
+        };
+    };
+    /**
+     * 停驻技能卡的「批它放行了什么」三位,本版起在运维队列行与订阅流 `pending` 帧上也带(此前只有助手收件箱行与活卡帧带)。三位由一只投影 `skillCardFacts` 投,
+     * `satisfies Record<keyof SkillCardFacts, …>`:投影加 / 删一位而本表没跟 ⇒ tsc 红。在场律 `present-iff`:只在这一行有该位时才带键(普通卡三位三面都缺席,缺席不是断言)。
+     */
+    readonly approvalQueuePendingKey: {
+        readonly at: "GET /v1/approvals pending[] 行 · GET /v1/approvals/stream pending 帧(停驻技能卡的批准绑定三位;与助手收件箱行同一只投影)";
+        readonly members: {
+            boundGrantDigest: {
+                attr: string;
+                since: string;
+            };
+            boundGrants: {
+                attr: string;
+                since: string;
+            };
+            classifierNoRuling: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /**
+     * 逐端点「应答面 → HTTP 状态」映射里**本版改了状态的面**(形照 `submitIdempotency`:`<端点>#<面>` → 状态;面是调用方能观察到的那一形,不是内部分支名)。
+     * `since` 记**这一面以这个状态答**的起始版本;每个成员的旧状态写在 CHANGELOG 对应条里(旧状态的那一形此前没有登记,清单里它们是「本版新上 wire」,不是 changed)。
+     * 同一端点上状态没变的面(如 `/decide` 对同一张卡的 approve 仍 409)不入表。
+     */
+    readonly endpointFaceStatus: {
+        readonly at: "逐端点应答面 → 状态(<端点>#<面> → 状态;只登记本版改了状态的面)";
+        readonly members: {
+            readonly "POST /v1/approvals/:sessionId/decide#deny(\u590D\u6D3B\u4E0D\u4E86\u7684\u505C\u9A7B\u884C:\u65E0 agent \u540D / \u65E0\u6839\u4F1A\u8BDD\u951A;\u4F53 { taskId, status: failed, decision: deny })": {
+                readonly attr: 200;
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/sessions/:id/sync/manifest#store_connection_fault(\u4F53 state.file_history_unreadable + permanence: transient)": {
+                readonly attr: 503;
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/sessions/:id/sync/entries#store_connection_fault(\u5E94\u7B54\u5934\u53D1\u51FA\u4E4B\u524D;\u4F53\u540C\u4E0A)": {
+                readonly attr: 503;
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/sessions/:id/sync/history/blobs/:hash#store_connection_fault(\u4F53\u540C\u4E0A)": {
+                readonly attr: 503;
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/sessions/:id/events#corrupt_archive(DB_BACKEND=local;\u5F00\u6D41\u4E4B\u524D;\u4F53 corrupt_session)": {
+                readonly attr: 500;
+                readonly since: "7.136.0";
+            };
+            readonly "PATCH /v1/sessions/:id#corrupt_archive(DB_BACKEND=local;\u4F53 corrupt_session)": {
+                readonly attr: 500;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/sessions/:id/sync/import#identical_repush_blob_missing(\u4F53 missing_blob)": {
+                readonly attr: 422;
+                readonly since: "7.136.0";
+            };
+            readonly "PATCH /v1/sessions/:id#title_no_visible_character(\u4F53 request.field_invalid)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/sessions/:id/sync/import#title_no_visible_character(Phase A \u4F53\u7684 title;\u4F53 request.field_invalid)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tasks|/v1/tasks/stream|/v1/runs#images_url_credential(\u65B0\u63D0\u4EA4;\u4F53 request.field_invalid + field images[i].url + reason url_userinfo|url_credential_param)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_malformed(\u65B0\u63D0\u4EA4;\u5217\u8868\u4E0D\u662F\u6570\u7EC4 / \u6761\u76EE\u4E0D\u662F\u5BF9\u8C61 / \u952E\u503C\u5224\u4E0D\u51FA\u5F62;\u4F53 request.field_invalid)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_unknown_key(\u65B0\u63D0\u4EA4;\u8BCD\u8868\u5916\u7684\u952E;\u4F53 request.body_shape + unknownKeys)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tool-approvals/:id/respond#new_owner_after_adoption(\u6536\u7F16\u4E4B\u540E\u7684\u65B0\u5C5E\u4E3B;\u672C\u526F\u672C\u4E0A\u4ECD\u6709\u5F15\u64CE\u817F\u5728\u7B49\u7684\u6D3B\u5361,\u51B3\u8BAE\u4EA4\u7ED9\u90A3\u6761\u817F)": {
+                readonly attr: 200;
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/tool-approvals/:id#previous_owner_after_adoption(\u6536\u7F16\u4E4B\u540E\u7684\u524D\u5C5E\u4E3B;\u6309\u95EE\u8BFB\u53E3)": {
+                readonly attr: 404;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tool-approvals/:id/respond#edited_rule_text_refused_after_adoption(\u533F\u540D\u6D3B\u5361\u6536\u7F16\u7ED9\u5177\u540D\u4E3B\u4F53\u540E\u65B0\u5C5E\u4E3B\u4EA4\u574F\u89C4\u5219\u6587\u672C;\u4F53 request.body_shape;\u5951\u7EA6\u6210\u6587\u7684\u5224\u636E,\u4ECA\u5929\u7ECF /v1/adoption \u5230\u4E0D\u4E86)": {
+                readonly attr: 400;
+                readonly since: "7.136.0";
+            };
+            readonly "POST /v1/tasks|/v1/runs#command_line_slots_without_sealed_key_store(stdio MCP \u7684 command / args \u4E0E command hook \u7684 command / args;\u4F53 conflict.checkpoint_ctx_unsealable + field + reason no_key_store;POST /v1/tasks/stream \u5728\u7EC8\u5C40\u5E27\u4E0A\u5E26\u672C\u7801;\u672C\u670D\u52A1\u81EA\u5DF1\u7684\u88C5\u914D\u4E0B\u4E0D\u53EF\u8FBE(\u88C5\u914D\u671F\u5DF2\u5BF9\u300C\u5E97\u5728\u800C\u5C01\u7B7E\u5668\u7F3A\u5E2D\u300D\u62D2\u542F,\u89C1 submit-ctx.ts \u81EA\u8FF0))": {
+                readonly attr: 409;
+                readonly since: "7.136.0";
+            };
+            readonly "ALL authenticated routes#bearer_token_without_scope_claim(\u9274\u6743\u6865\u9A8C\u8BC1\u817F;\u914D\u4E86 service \u51ED\u636E\u6216\u591A\u79DF REQUIRE_PRINCIPAL \u7684\u90E8\u7F72;\u4F53\u901A\u7528 auth.unauthorized)": {
+                readonly attr: 401;
+                readonly since: "7.136.0";
+            };
+        };
+    };
+    /**
+     * 拒体 / 应答体**句子的形**里本版换了或新增的(`<码>#<座>` → 句型)。句子是展示文本,机读分支按 `errorCode` / `field` / `reason`;本表登记的是「句型换了」,
+     * 给按字面匹配句子的消费方对账(码、状态、体键在这些成员上都没变,变的只有 `message`)。`attr` 写句型的骨架(`<…>` 是占位),旧句型写在 CHANGELOG 对应条里。
+     */
+    readonly refusalSentenceForm: {
+        readonly at: "拒体 message 的句型(<码>#<座> → 句型骨架;码 / 状态 / 机读位不变)";
+        readonly members: {
+            readonly "409 decide.row_unrevivable#no_agent_name": {
+                readonly attr: "ends: deny it to close the card (the agent then ends as failed)";
+                readonly since: "7.136.0";
+            };
+            readonly "409 decide.row_unrevivable#no_root_anchor": {
+                readonly attr: "ends: deny it to close the card (the agent then ends as failed)";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#mcpServers.over_cap(\u53D7\u7406\u53E3 \u00B7 POST /v1/capabilities/mcp/probe \u540C\u53E5)": {
+                readonly attr: "head: <field> has <count> entries — at most <cap> are accepted";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#a2aPeers.over_cap": {
+                readonly attr: "tail: 声明列表拒绝骨架的句尾(与 mcpServers 共用 request-declaration-refusal)";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#a2aPeers[i].url|cardUrl.credential": {
+                readonly attr: "<field> (peer <name>) is not a usable declaration — <rule> …";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#title.no_visible_character(PATCH /v1/sessions/:id \u00B7 \u4F1A\u8BDD\u540C\u6B65 2c \u5BFC\u5165\u7684 title)": {
+                readonly attr: "title must contain at least one visible character";
+                readonly since: "7.136.0";
+            };
+            readonly "503 state.file_history_unreadable#store_connection_fault(\u4F1A\u8BDD\u540C\u6B65\u4E09\u6761\u62C9\u53D6\u8BFB\u817F)": {
+                readonly attr: "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later";
+                readonly since: "7.136.0";
+            };
+            readonly "connect_failed(run \u5931\u8D25\u7EC8\u5C40)#snapshot_bucket_missing(k8s \u8F66\u9053\u8BFB latest \u5F97 404 NoSuchBucket;\u8FDE\u6C99\u7BB1\u5931\u8D25,\u4E00\u53EA pod \u90FD\u4E0D\u5EFA)": {
+                readonly attr: "workspace space pointer read failed (snapshot_bucket_missing): the workspace snapshot bucket <name> (WORKSPACE_SNAPSHOT_BUCKET; default workspaces) does not exist in the object store — refusing to start this run … Ways out: create the bucket, or set WORKSPACE_SNAPSHOT_BUCKET to one that exists, or set WORKSPACE_PERSIST=off …";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#images[i].url.credential": {
+                readonly attr: "<field> <规则句> — the URL is kept as written (a parked task's resume context, logs), while images[i] can carry the image bytes inline: send { data, mimeType } instead of a URL that holds the credential";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#a2aPeers.not_array": {
+                readonly attr: "head: a2aPeers is <shape>, not an array of A2A peer declarations";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#a2aPeers[i].not_object": {
+                readonly attr: "head: a2aPeers[i] is <shape>, not an A2A peer declaration (an object)";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.field_invalid#a2aPeers[i].<key>.unusable(url / cardUrl \u51ED\u636E\u62D2\u4E4B\u5916\u7684\u952E\u503C\u574F\u5F62)": {
+                readonly attr: "<field> (peer <name>) is not a usable declaration — <rule> …";
+                readonly since: "7.136.0";
+            };
+            readonly "400 request.body_shape#a2aPeers[i].unknown_key": {
+                readonly attr: "body: unrecognized key(s) on an A2A peer declaration — refused rather than dropped …; Accepted per entry: <keys>";
+                readonly since: "7.136.0";
+            };
+            readonly "409 conflict.checkpoint_ctx_unsealable#submit(\u63D0\u4EA4\u9762:\u672C\u670D\u52A1\u6CA1\u6709\u4FDD\u7BA1\u5E97)": {
+                readonly attr: "slots: static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey";
+                readonly since: "7.136.0";
+            };
+            readonly "409 conflict.checkpoint_ctx_unsealable#resume(\u7EED\u8DD1\u4E0A\u4E0B\u6587\u8BFB\u53E3)": {
+                readonly attr: "slots: static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey";
+                readonly since: "7.136.0";
+            };
+        };
+    };
+    /**
+     * 文件历史店的故障答里 `permanence`(店对这次故障的重试类判断,体键,店没判则缺席)的 `transient` 一词:本版起库断连等**连接类故障**店判 `transient`,
+     * 出现在 `422 adopt_failed` / `restore_failed` 等店答与 `503 state.file_history_unreadable` 体上(词表属主 = 引擎的 `GovernanceRetryClass` 两词,另一词 `terminal` 自 7.135.0 起由永久码带,不在本表)。
+     * 在场律 `present-iff`:店判了才带,没判缺席。
+     */
+    readonly storeFaultPermanence: {
+        readonly at: "文件历史店故障答的体键 permanence(422 adopt_failed · restore_failed 等 · 503 state.file_history_unreadable)";
+        readonly members: {
+            readonly transient: {
+                readonly attr: "present-iff";
+                readonly since: "7.136.0";
+            };
+        };
+    };
+    /**
+     * `GET /v1/config/catalog` 的 `rows[]` 里**本版新增的行**(成员 = 行名,属性 = 行的域)。目录行集本身是 `config-catalog.ts` 的 `CONFIG_CATALOG`,不在本表整份登记 ——
+     * 本表只登「这一版新上 wire 的行」;已有行的字面(`semantics` / `derivedDefaultNote`)改动登在 `wireValueRule`。钉 `test/wire-changes-server.test.ts` ⑥:成员必须是目录里的行、域一致。
+     */
+    readonly configCatalogRow: {
+        readonly at: "GET /v1/config/catalog rows[](<行名> → 域;只登本版新增的行)";
+        readonly members: {
+            readonly SEALED_KEY_DIR: {
+                readonly attr: "store";
+                readonly since: "7.136.0";
+            };
+        };
+    };
     /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
     readonly wireValueRule: {
         readonly at: "出口值变换(<端点>#<键> → 变换)";
@@ -897,6 +1106,64 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "durableMediaCardKeyDropped";
                 readonly since: "7.127.2";
             };
+            /**
+             * 7.136.0:助手收件箱行的 `objective` 值语义换了(键名与可空性不变):此前 = 停驻上下文里的目标原文(不截断、不脱敏),本版起 = 这道门所属 run 的目标预览
+             * (run 行的 `objectivePreview` 列,写入时已脱敏、约 120 字符;与 tasks 视图读同一列)。
+             */
+            readonly "GET /v1/assistant/inbox#objective": {
+                readonly attr: "runRowObjectivePreview";
+                readonly since: "7.136.0";
+            };
+            /**
+             * 7.136.0:`elicitation_complete.action` 的取词律 —— 没人应答的释放(答题窗到期 · run 中止 · 腿退出时仍挂着)一律放 `cancel`,`decline` 只留给「拒」;
+             * 此前答题窗到期那一帧放 `decline`。词表(accept / decline / cancel)与帧形不变,变的是到期那一帧的值。
+             */
+            readonly "SSE elicitation_complete#action(\u6CA1\u4EBA\u5E94\u7B54\u7684\u91CA\u653E)": {
+                readonly attr: "cancel-not-decline";
+                readonly since: "7.136.0";
+            };
+            /**
+             * 7.136.0:`GET /v1/config/catalog` 已有行的字面(`semantics` 说明句 / `derivedDefaultNote` 缺席说明;键与行集不变,只是字面换了或新增):
+             * `MCP_ELICITATION_*` 四行的缺席出厂窗来源词由「core 出厂窗」改成「本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)」;两条 `ANTHROPIC_*` 凭据行改述「只发某一种头、互斥、同设拒启」;
+             * `WORKSPACE_SNAPSHOT_BUCKET` 补上起服核桶与运行期读 `latest` 的处置;`WORKSPACE_SNAPSHOT_PREFIX` 改述多段路径与拒启条件并新增缺席说明。
+             * 成员写成 `GET /v1/config/catalog#rows[<行名>].<semantics|derivedDefaultNote>`,行名与字段由 `test/wire-changes-server.test.ts` ⑥ 对着 `CONFIG_CATALOG` 核。
+             */
+            readonly "GET /v1/config/catalog#rows[MCP_ELICITATION_MAX_CONCURRENT].derivedDefaultNote": {
+                readonly attr: "default-window-source:server";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[MCP_ELICITATION_MAX_TOTAL].derivedDefaultNote": {
+                readonly attr: "default-window-source:server";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[MCP_ELICITATION_MIN_INTERVAL_MS].derivedDefaultNote": {
+                readonly attr: "default-window-source:server";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[MCP_ELICITATION_TTL_MS].derivedDefaultNote": {
+                readonly attr: "default-window-source:server";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[ANTHROPIC_API_KEY].semantics": {
+                readonly attr: "x-api-key-only;mutually-exclusive;both-set-refuses-boot";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[ANTHROPIC_AUTH_TOKEN].semantics": {
+                readonly attr: "bearer-only;mutually-exclusive;both-set-refuses-boot";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_BUCKET].semantics": {
+                readonly attr: "boot-checks-bucket;runtime-latest-no-such-bucket-fails-run";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].semantics": {
+                readonly attr: "multi-segment-prefix;bad-segment-refuses-boot";
+                readonly since: "7.136.0";
+            };
+            readonly "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].derivedDefaultNote": {
+                readonly attr: "absent=>kata";
+                readonly since: "7.136.0";
+            };
         };
     };
 };

package/dist/trace/self-minted-wire.js

@@ -287,6 +287,74 @@ export const SELF_MINTED_WIRE = {
             aliases: { attr: "always", since: "7.135.0" },
         },
     },
+    approvalRequestCardKey: {
+        at: "approval_request 帧 card.<键>(活铸帧的 card · 落库的卡信封 card_json · 断连重放帧的 card)",
+        members: {
+            approvalCard: { attr: "present-iff", since: "7.136.0" },
+        },
+    },
+    approvalQueuePendingKey: {
+        at: "GET /v1/approvals pending[] 行 · GET /v1/approvals/stream pending 帧(停驻技能卡的批准绑定三位;与助手收件箱行同一只投影)",
+        members: {
+            boundGrantDigest: { attr: "present-iff", since: "7.136.0" },
+            boundGrants: { attr: "present-iff", since: "7.136.0" },
+            classifierNoRuling: { attr: "present-iff", since: "7.136.0" },
+        },
+    },
+    endpointFaceStatus: {
+        at: "逐端点应答面 → 状态(<端点>#<面> → 状态;只登记本版改了状态的面)",
+        members: {
+            "POST /v1/approvals/:sessionId/decide#deny(复活不了的停驻行:无 agent 名 / 无根会话锚;体 { taskId, status: failed, decision: deny })": { attr: 200, since: "7.136.0" },
+            "GET /v1/sessions/:id/sync/manifest#store_connection_fault(体 state.file_history_unreadable + permanence: transient)": { attr: 503, since: "7.136.0" },
+            "GET /v1/sessions/:id/sync/entries#store_connection_fault(应答头发出之前;体同上)": { attr: 503, since: "7.136.0" },
+            "GET /v1/sessions/:id/sync/history/blobs/:hash#store_connection_fault(体同上)": { attr: 503, since: "7.136.0" },
+            "GET /v1/sessions/:id/events#corrupt_archive(DB_BACKEND=local;开流之前;体 corrupt_session)": { attr: 500, since: "7.136.0" },
+            "PATCH /v1/sessions/:id#corrupt_archive(DB_BACKEND=local;体 corrupt_session)": { attr: 500, since: "7.136.0" },
+            "POST /v1/sessions/:id/sync/import#identical_repush_blob_missing(体 missing_blob)": { attr: 422, since: "7.136.0" },
+            "PATCH /v1/sessions/:id#title_no_visible_character(体 request.field_invalid)": { attr: 400, since: "7.136.0" },
+            "POST /v1/sessions/:id/sync/import#title_no_visible_character(Phase A 体的 title;体 request.field_invalid)": { attr: 400, since: "7.136.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#images_url_credential(新提交;体 request.field_invalid + field images[i].url + reason url_userinfo|url_credential_param)": { attr: 400, since: "7.136.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_malformed(新提交;列表不是数组 / 条目不是对象 / 键值判不出形;体 request.field_invalid)": { attr: 400, since: "7.136.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_unknown_key(新提交;词表外的键;体 request.body_shape + unknownKeys)": { attr: 400, since: "7.136.0" },
+            "POST /v1/tool-approvals/:id/respond#new_owner_after_adoption(收编之后的新属主;本副本上仍有引擎腿在等的活卡,决议交给那条腿)": { attr: 200, since: "7.136.0" },
+            "GET /v1/tool-approvals/:id#previous_owner_after_adoption(收编之后的前属主;按问读口)": { attr: 404, since: "7.136.0" },
+            "POST /v1/tool-approvals/:id/respond#edited_rule_text_refused_after_adoption(匿名活卡收编给具名主体后新属主交坏规则文本;体 request.body_shape;契约成文的判据,今天经 /v1/adoption 到不了)": { attr: 400, since: "7.136.0" },
+            "POST /v1/tasks|/v1/runs#command_line_slots_without_sealed_key_store(stdio MCP 的 command / args 与 command hook 的 command / args;体 conflict.checkpoint_ctx_unsealable + field + reason no_key_store;POST /v1/tasks/stream 在终局帧上带本码;本服务自己的装配下不可达(装配期已对「店在而封签器缺席」拒启,见 submit-ctx.ts 自述))": { attr: 409, since: "7.136.0" },
+            "ALL authenticated routes#bearer_token_without_scope_claim(鉴权桥验证腿;配了 service 凭据或多租 REQUIRE_PRINCIPAL 的部署;体通用 auth.unauthorized)": { attr: 401, since: "7.136.0" },
+        },
+    },
+    refusalSentenceForm: {
+        at: "拒体 message 的句型(<码>#<座> → 句型骨架;码 / 状态 / 机读位不变)",
+        members: {
+            "409 decide.row_unrevivable#no_agent_name": { attr: "ends: deny it to close the card (the agent then ends as failed)", since: "7.136.0" },
+            "409 decide.row_unrevivable#no_root_anchor": { attr: "ends: deny it to close the card (the agent then ends as failed)", since: "7.136.0" },
+            "400 request.field_invalid#mcpServers.over_cap(受理口 · POST /v1/capabilities/mcp/probe 同句)": { attr: "head: <field> has <count> entries — at most <cap> are accepted", since: "7.136.0" },
+            "400 request.field_invalid#a2aPeers.over_cap": { attr: "tail: 声明列表拒绝骨架的句尾(与 mcpServers 共用 request-declaration-refusal)", since: "7.136.0" },
+            "400 request.field_invalid#a2aPeers[i].url|cardUrl.credential": { attr: "<field> (peer <name>) is not a usable declaration — <rule> …", since: "7.136.0" },
+            "400 request.field_invalid#title.no_visible_character(PATCH /v1/sessions/:id · 会话同步 2c 导入的 title)": { attr: "title must contain at least one visible character", since: "7.136.0" },
+            "503 state.file_history_unreadable#store_connection_fault(会话同步三条拉取读腿)": { attr: "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later", since: "7.136.0" },
+            "connect_failed(run 失败终局)#snapshot_bucket_missing(k8s 车道读 latest 得 404 NoSuchBucket;连沙箱失败,一只 pod 都不建)": { attr: "workspace space pointer read failed (snapshot_bucket_missing): the workspace snapshot bucket <name> (WORKSPACE_SNAPSHOT_BUCKET; default workspaces) does not exist in the object store — refusing to start this run … Ways out: create the bucket, or set WORKSPACE_SNAPSHOT_BUCKET to one that exists, or set WORKSPACE_PERSIST=off …", since: "7.136.0" },
+            "400 request.field_invalid#images[i].url.credential": { attr: "<field> <规则句> — the URL is kept as written (a parked task's resume context, logs), while images[i] can carry the image bytes inline: send { data, mimeType } instead of a URL that holds the credential", since: "7.136.0" },
+            "400 request.field_invalid#a2aPeers.not_array": { attr: "head: a2aPeers is <shape>, not an array of A2A peer declarations", since: "7.136.0" },
+            "400 request.field_invalid#a2aPeers[i].not_object": { attr: "head: a2aPeers[i] is <shape>, not an A2A peer declaration (an object)", since: "7.136.0" },
+            "400 request.field_invalid#a2aPeers[i].<key>.unusable(url / cardUrl 凭据拒之外的键值坏形)": { attr: "<field> (peer <name>) is not a usable declaration — <rule> …", since: "7.136.0" },
+            "400 request.body_shape#a2aPeers[i].unknown_key": { attr: "body: unrecognized key(s) on an A2A peer declaration — refused rather than dropped …; Accepted per entry: <keys>", since: "7.136.0" },
+            "409 conflict.checkpoint_ctx_unsealable#submit(提交面:本服务没有保管店)": { attr: "slots: static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey", since: "7.136.0" },
+            "409 conflict.checkpoint_ctx_unsealable#resume(续跑上下文读口)": { attr: "slots: static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey", since: "7.136.0" },
+        },
+    },
+    storeFaultPermanence: {
+        at: "文件历史店故障答的体键 permanence(422 adopt_failed · restore_failed 等 · 503 state.file_history_unreadable)",
+        members: {
+            transient: { attr: "present-iff", since: "7.136.0" },
+        },
+    },
+    configCatalogRow: {
+        at: "GET /v1/config/catalog rows[](<行名> → 域;只登本版新增的行)",
+        members: {
+            SEALED_KEY_DIR: { attr: "store", since: "7.136.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {
@@ -298,6 +366,17 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/runs/:id/events#tool_end.output[](媒体块)": { attr: "durableMediaDescriptor+totalChars", since: "7.127.0" },
             "SSE tool_end#structured.file.base64(媒体卡)": { attr: "verbatim-bytes;backlog>64MiB⇒key-dropped", since: "7.127.2" },
             "GET /v1/runs/:id/events#tool_end.structured.file.base64(媒体卡)": { attr: "durableMediaCardKeyDropped", since: "7.127.2" },
+            "GET /v1/assistant/inbox#objective": { attr: "runRowObjectivePreview", since: "7.136.0" },
+            "SSE elicitation_complete#action(没人应答的释放)": { attr: "cancel-not-decline", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[MCP_ELICITATION_MAX_CONCURRENT].derivedDefaultNote": { attr: "default-window-source:server", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[MCP_ELICITATION_MAX_TOTAL].derivedDefaultNote": { attr: "default-window-source:server", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[MCP_ELICITATION_MIN_INTERVAL_MS].derivedDefaultNote": { attr: "default-window-source:server", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[MCP_ELICITATION_TTL_MS].derivedDefaultNote": { attr: "default-window-source:server", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[ANTHROPIC_API_KEY].semantics": { attr: "x-api-key-only;mutually-exclusive;both-set-refuses-boot", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[ANTHROPIC_AUTH_TOKEN].semantics": { attr: "bearer-only;mutually-exclusive;both-set-refuses-boot", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_BUCKET].semantics": { attr: "boot-checks-bucket;runtime-latest-no-such-bucket-fails-run", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].semantics": { attr: "multi-segment-prefix;bad-segment-refuses-boot", since: "7.136.0" },
+            "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].derivedDefaultNote": { attr: "absent=>kata", since: "7.136.0" },
         },
     },
 };

package/dist/url-credential-refusal.d.ts

@@ -0,0 +1,52 @@
+/**
+ * **请求面「URL 里带凭据」座位的拒体铸点**([ref] / [ref];判官本身在契约包)。
+ *
+ * ## 谁判、谁铸
+ * 「这个 URL 里带着凭据吗」的**判官**(`findUrlCredential` / `findUrlUserinfo` / 规则句 `urlCredentialRule` / 拒因词 `URL_CREDENTIAL_REASONS` / 凭据名表 `CREDENTIAL_PARAM_NAMES`)
+ * 住 `@sema-agent/settings-schema` 包根(14.5.0 起;规则、拒因词与规则句由本仓上移时逐字搬走,本仓零副本)。规则一条:URL 里的凭据 = 日志脱敏器已经在用的那个定义 ——
+ * userinfo(只有用户名也算),或 query / fragment 里名字整名在凭据名表上的参数(名字按收方的读法读:`URLSearchParams` 解一次码,ASCII 大小写不敏感);答首个命中,值从不进答案。
+ * 契约包只判「有没有」:**拒体的形**(HTTP 码、字段坐标、出路句)是座位自己的铸点 —— 本模块就是这一处,下面的导出之外没有第二处。
+ *
+ * ## 座位(同读包根的判官;座位只决定读哪个值、坐标怎么写、凭据改走哪个已封签的位)
+ *  · 请求面 MCP `transport.url`(`task-mcp.ts` 条目判官表):读器只判 `http(s)://` 前缀,解析不了的 url 由拨号期失败答(fetch 对带 userinfo 的 URL 本就构造即抛);
+ *  · 请求面 A2A 对端 `url` / `cardUrl`(`task-a2a.ts` 的条目判官表 `assertRequestA2aEntries`,fresh 腿):`url` / `cardUrl` 先判是 http(s) 串、再问判官;超过 32 条的列表整份 400(判官看过每一条,或这份体不收);
+ *  · 请求面图片 `images[i].url`(`request-image-urls.ts` 的 `assertRequestImageUrls`,fresh 腿):`{ url }` 臂的串值;没有封签的头位,出路是图片字节走内联 `{ data, mimeType }`;
+ *  · 请求面 http 钩子 `url`(`hooks/hook-runner.ts` 的 `hooksUrlCredentialIssue`,`admission.ts` 的 settings 子树门):按配置序扫读者交回的配置;
+ *  · 请求面搜索后端 `endpoint`(`plugins/web-search.ts` 的 `judgeFreshRequestWebSearch`,fresh 提交门):载体之间有差 —— 部署 env 与续跑重放读法只因 userinfo 拒(`findUrlUserinfo`),凭据名参数只在 fresh 门拒;
+ *  · `SANDBOX_PKG_SOURCE=custom` 的六只地址(`sandbox-pkg-source.ts` 唯一读口):不是层级式 http(s) / 含反斜杠 ⇒ 起服拒(读者是包管理器,不是 WHATWG);拒句走 `url-refusal.ts` 的另一只铸点(值只回显 origin)。
+ * 请求面五类座位的拒是同一个形:`400 request.field_invalid` + 体顶层 `field`(体内全坐标)/ `reason`(判官的拒因闭集两词),机读位、原因句骨架与整句只在本模块的铸点
+ * ({@link urlCredentialFacts} / {@link urlCredentialRefusalReason} / {@link buildRequestUrlCredentialRefusal})。
+ *
+ * ## 为什么拒、而不是封或剥
+ * 条目有凭据座位的地方(MCP 的 `transport.headers` 是停驻封签位之一),凭据只走那个座:URL 照原样进停驻上下文、日志与读面,封签闭集刻意不收 URL 一类自由文本。
+ * 剥掉 / 改写 = 交引擎的不是申报的那一份;半封一只 URL = 封签规则多一种半值封法。受理口拒,拒句点名座位。
+ */
+import { type UrlCredential, type UrlCredentialReason } from "@sema-agent/settings-schema";
+/** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用)。 */
+export type UrlCredentialFacts = {
+    readonly field: string;
+    readonly reason: UrlCredentialReason;
+};
+/** 机读位的唯一铸点:`field` 是座位给的体内全坐标,`reason` 是判官的拒因词(不另造)。 */
+export declare function urlCredentialFacts(field: string, credential: UrlCredential): UrlCredentialFacts;
+/**
+ * 出路句(停驻封签的位是请求头):凭据改写进这一条的 `headers`(停驻任务的续跑上下文里只以封签存在)。MCP `transport.headers` · A2A 对端 `headers` ·
+ * http 钩子条目 `headers` 三座同一句骨架,`place` 是那一条的 `headers` 在请求体里的坐标。
+ */
+export declare function urlCredentialHeaderExit(place: string): string;
+/**
+ * 原因句骨架(各座同一句,值不回显):规则句 + 「URL 原样存」的事实 + 出路。`exit` 是座位给的出路句(`urlCredentialHeaderExit` 或座位自己的)。
+ * 为什么说「原样存」:封签闭集刻意不收 URL 一类自由文本,所以 URL 照原样进停驻上下文、日志与读面 —— 凭据只许走为它设的座。
+ */
+export declare function urlCredentialRefusalReason(credential: UrlCredential, exit: string): string;
+/** 一处请求面拒的整句 + 机读位({@link buildRequestUrlCredentialRefusal} 的产物)。 */
+export interface UrlCredentialRefusal {
+    readonly message: string;
+    readonly facts: UrlCredentialFacts;
+}
+/**
+ * 请求面 URL 座位的拒(整句 + 机读位),`<field>[ (<subject>)] <原因句>`。`subject` 是座位给的条目指认(MCP 的 server 名 / A2A 的 peer 名;坐标本身唯一的座位不带)。
+ * MCP 与 A2A 两座的整句要接条目判官表的统一句尾(`request-declaration-refusal.ts`),所以它们取 {@link urlCredentialRefusalReason} + {@link urlCredentialFacts},另几座(http 钩子 / 搜索后端 / 图片)走这一只。
+ */
+export declare function buildRequestUrlCredentialRefusal(field: string, credential: UrlCredential, exit: string, subject?: string): UrlCredentialRefusal;
+//# sourceMappingURL=url-credential-refusal.d.ts.map

package/dist/url-credential-refusal.js

@@ -0,0 +1,14 @@
+import { urlCredentialRule } from "@sema-agent/settings-schema";
+export function urlCredentialFacts(field, credential) {
+    return { field, reason: credential.reason };
+}
+export function urlCredentialHeaderExit(place) {
+    return `${place} is stored sealed: send the credential as a header in ${place} (for example "Authorization": "Bearer …")`;
+}
+export function urlCredentialRefusalReason(credential, exit) {
+    return `${urlCredentialRule(credential)} — the URL is kept as written (a parked task's resume context, logs), while ${exit}`;
+}
+export function buildRequestUrlCredentialRefusal(field, credential, exit, subject) {
+    return { message: `${field}${subject === undefined ? "" : ` (${subject})`} ${urlCredentialRefusalReason(credential, exit)}`, facts: urlCredentialFacts(field, credential) };
+}
+//# sourceMappingURL=url-credential-refusal.js.map

package/dist/url-refusal.d.ts

@@ -14,11 +14,10 @@
  * ## 读者
  * 中心基址三席 + 公告地址 + 请求期 `centerFetch`(`web-admin-client/center-request.ts` `pathBaseUrlRefusal`:禁 userinfo / query / fragment)·
  * 续签 issuer(只问形)· 模型路由三键(`model-route-url.ts`:禁 userinfo / fragment,query 照收)· `MEMORY_EMBEDDER_ENDPOINT` 与
- * `A2A_SERVE_URL`(禁 userinfo)· `SANDBOX_PKG_SOURCE=custom` 六只地址(形 + 带凭据,后者的判官是 `url-credential.ts`,拒句经 {@link buildUrlCredentialRefusal})。
+ * `A2A_SERVE_URL`(禁 userinfo)· `SANDBOX_PKG_SOURCE=custom` 六只地址(形 + 带凭据,后者的判官是契约包根的 `findUrlCredential`,拒句经 {@link buildUrlCredentialRefusal})。
  * 「scheme 只有判官与展示铸点读」由 `test/config-url-display-safe.test.ts` 的读者普查门钉住。
  */
-import { type HttpUrlFlaw } from "@sema-agent/settings-schema";
-import { type UrlCredential } from "./url-credential.js";
+import { type HttpUrlFlaw, type UrlCredential } from "@sema-agent/settings-schema";
 /**
  * 拒句里值的样子(纯函数):合格的 http(s) 形 ⇒ 只到 origin(`scheme://host[:port]`,过展示铸点),origin 之后还有东西(userinfo /
  * 路径 / query / fragment)⇒ 接一枚 `/…`;其余(不透明 / 不可解析 / 层级式非 http(s))⇒ 展示铸点的占位 `«redacted:url»` ——
@@ -29,11 +28,21 @@ import { type UrlCredential } from "./url-credential.js";
  * 这几处不赌形状律的覆盖面:座位名 + 规则词已经说清了哪一席错在哪,值只需要认得出是哪一台主机。
  */
 export declare function buildRefusalShownUrl(raw: string): string;
+/**
+ * **自由文本里每一条嵌着的 http(s) URL 换成它的展示形**({@link buildRefusalShownUrl}:`scheme://host[:port]`,origin 之后还有东西接 `/…`;读法不唯一 / 读不出的串给展示铸点的占位),
+ * 句子其余部分逐字不动。用在宿主不控制句子的日志面 —— 引擎把「拨不通的 A2A 对端 / MCP 服务器」连同被拨的 URL 拼成一句交来(`onError`),宿主手里没有那条 URL 的结构化值,
+ * 只能在文本上换。展示形的铸点仍只有 {@link buildRefusalShownUrl} 一只(userinfo / 路径 / query / fragment 一个字节不进,不赌形状律认得出的令牌形);本函数只负责「找到文本里的 URL」。
+ * 非 http(s) 的 scheme 不在射程(这两座的 URL 读器只收 http(s))。纯函数。
+ *
+ * 已知的界(不是兜底):URL 串里含**裸空白**的(userinfo 里写了空格)在第一个空白处被截 —— 余下的尾巴留在句里。那一形是调用方在受理口就被拒的(userinfo 一律 400),
+ * 到不了这里的只有存量停驻体 / 部署基线;引擎的警告句对该形也是把 URL 原样拼进去,没有结构化值可救。
+ */
+export declare function buildShownUrlsInText(text: string): string;
 /**
  * 拒句的**唯一**铸点:`<subject> <规则句>[; <规则句>…]; got "<值的样子>"`(`build*` = 纯数据)。
  * 值只经 {@link buildRefusalShownUrl} 出现;`flaws` 来自 settings-schema 的 `httpUrlFlaws`(调用方按首个拒因选自己的码与出路句)。
  */
 export declare function buildHttpUrlRefusal(subject: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
-/** 「带凭据」那一形的拒句([ref];判官 `url-credential.ts` 的 `findUrlCredential`):同一只铸点形,规则句换成凭据判官的那一句。 */
+/** 「带凭据」那一形的拒句([ref];判官 = 契约包根的 `findUrlCredential`):同一只铸点形,规则句换成凭据判官的那一句。 */
 export declare function buildUrlCredentialRefusal(subject: string, raw: string, credential: UrlCredential): string;
 //# sourceMappingURL=url-refusal.d.ts.map

package/dist/url-refusal.js

@@ -1,6 +1,5 @@
-import { httpUrlRule, isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { httpUrlRule, isHierarchicalUrl, urlCredentialRule } from "@sema-agent/settings-schema";
 import { DISPLAY_SAFE_URL_TOKEN, buildDisplaySafeUrl } from "./trace/redact.js";
-import { urlCredentialRule } from "./url-credential.js";
 export function buildRefusalShownUrl(raw) {
     if (!isHierarchicalUrl(raw))
         return DISPLAY_SAFE_URL_TOKEN;
@@ -12,6 +11,13 @@ export function buildRefusalShownUrl(raw) {
     const origin = `${u.protocol}//${u.host}`;
     return `${buildDisplaySafeUrl(origin)}${u.href === `${origin}/` ? "" : "/…"}`;
 }
+const EMBEDDED_HTTP_URL = /https?:\/\/[^\s"'`<>()[\]{}]+/gi;
+export function buildShownUrlsInText(text) {
+    return text.replace(EMBEDDED_HTTP_URL, (token) => {
+        const trail = /[.,;:!?]+$/.exec(token)?.[0] ?? "";
+        return buildRefusalShownUrl(trail === "" ? token : token.slice(0, -trail.length)) + trail;
+    });
+}
 export function buildHttpUrlRefusal(subject, raw, flaws) {
     return composeUrlRefusal(subject, raw, flaws.map(httpUrlRule));
 }

package/dist/workspace-space.d.ts

@@ -63,6 +63,33 @@ export interface WorkspaceSpacePolicy {
 export interface WorkspaceSyncCapability extends WorkspaceSpacePolicy {
     timeoutMs: number;
 }
+/** `WORKSPACE_SNAPSHOT_PREFIX` unset ⇒ this prefix (the first segment of every snapshot object key of both lanes). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+/**
+ * The ONE form of a snapshot-key segment — the partition (incarnation / session id), the snapshot id, the object name and each segment of
+ * the key prefix all pass it before a key is signed: it starts with a letter or digit, then letters, digits, `.`, `_`, `-`. No `/`, no `..`,
+ * no empty segment, no character a key could be rewritten or traversed by.
+ */
+export declare const SNAPSHOT_KEY_SEGMENT: RegExp;
+/** The refusal code of a `WORKSPACE_SNAPSHOT_PREFIX` outside the closed form (the `config.*` family; fatal-exit prints it). */
+export declare const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+/**
+ * Why a snapshot key prefix is outside the closed form (`undefined` = inside): a prefix is a `/`-separated path of {@link SNAPSHOT_KEY_SEGMENT}s —
+ * one segment (`kata`, the form every release has accepted) or several (`libA/ws`, so one bucket can be partitioned by owner). Answers the
+ * first bad segment (1-based) and why. The ONE judge: the config loader refuses boot with it, the adapter refuses to sign a key with it.
+ */
+export declare function snapshotKeyPrefixProblem(prefix: string): {
+    readonly segment: number;
+    readonly of: number;
+    readonly value: string;
+    readonly why: string;
+} | undefined;
+/**
+ * `WORKSPACE_SNAPSHOT_PREFIX` — the key prefix of both lanes' snapshot objects (`<prefix>/<incarnation>/space/…`, `<prefix>/<sessionId>/…`): a
+ * `/`-separated path of plain segments, one or more (`kata`, `libA/ws`). Unset / empty ⇒ `undefined` (the adapter's default
+ * {@link WORKSPACE_SNAPSHOT_PREFIX_DEFAULT} holds). A bad value refuses boot naming the first bad segment — the value is a path, never a secret, so it is echoed.
+ */
+export declare function parseWorkspaceSnapshotPrefix(raw: string | undefined): string | undefined;
 /** The refusal code of a `WORKSPACE_SNAPSHOT_EXCLUDE` item outside the closed form (the `config.*` family; fatal-exit prints it). */
 export declare const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 /**

package/dist/workspace-space.js

@@ -9,6 +9,32 @@ export const WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE = { min: 30_000, max: 3_600_000
 export function workspaceSnapshotTimeoutOf(lane) {
     return lane.workspaceSnapshotTimeoutMs ?? WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT;
 }
+export const WORKSPACE_SNAPSHOT_PREFIX_DEFAULT = "kata";
+export const SNAPSHOT_KEY_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const WORKSPACE_SNAPSHOT_PREFIX_INVALID = "config.workspace_snapshot_prefix_invalid";
+export function snapshotKeyPrefixProblem(prefix) {
+    const segments = prefix.split("/");
+    for (const [i, value] of segments.entries()) {
+        if (SNAPSHOT_KEY_SEGMENT.test(value))
+            continue;
+        const why = value === ""
+            ? "empty (a leading, trailing or doubled /)"
+            : value === "." || value === ".."
+                ? "a . / .. segment (it would walk out of its own prefix)"
+                : "not a plain key segment (it must start with a letter or digit and hold only letters, digits, . _ -)";
+        return { segment: i + 1, of: segments.length, value, why };
+    }
+    return undefined;
+}
+export function parseWorkspaceSnapshotPrefix(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const bad = snapshotKeyPrefixProblem(raw);
+    if (bad === undefined)
+        return raw;
+    throw Object.assign(new Error(`env WORKSPACE_SNAPSHOT_PREFIX: segment #${bad.segment} of ${bad.of} (${JSON.stringify(bad.value)}) is ${bad.why} — the prefix is a "/"-separated path of plain key segments ` +
+        "(each starts with a letter or digit, then letters, digits, . _ -; e.g. WORKSPACE_SNAPSHOT_PREFIX=kata or libA/ws); refusing to start rather than sign snapshot keys under a prefix that does not say what it means"), { code: WORKSPACE_SNAPSHOT_PREFIX_INVALID });
+}
 export const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snapshot_exclude_invalid";
 export function parseWorkspaceSnapshotExclude(raw) {
     if (raw === undefined || raw.trim() === "")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.135.0",
+  "version": "7.136.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -37,6 +37,7 @@
     "scripts/drain-check.pg.sql",
     "deploy/sema-up",
     "docs/DEVICE-EXECUTOR-PROTOCOL.md",
+    "wire-changes/",
     "USAGE.md",
     "MIGRATION.md"
   ],
@@ -69,7 +70,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.55.0",
-    "@sema-agent/settings-schema": "14.4.0",
+    "@sema-agent/settings-schema": "14.5.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",