@sema-agent/server 7.78.0 → 7.78.1

package/dist/approval-card.d.ts

@@ -21,7 +21,7 @@
  * 没有方法、没有捕获的行为。
  */
 import { z } from "zod";
-import { type AskEvidenceAbsence, type RuleOffer } from "@sema-agent/core";
+import { type AskEvidenceAbsence, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import type { AskRow } from "./plugins/approval-ask-store-sql.js";
 /** 模型自由文本(`sourceAgentName` / `delegation.agentName`)的限长(设计稿 §6.2)。设计 §3.1 把
  *  「限长 + 脱敏」写成 **server 新增责任**(引擎无此层):spawning model 挑的名字是自由文本,
@@ -269,6 +269,29 @@ export type ProbeCauseProjection = z.infer<typeof ProbeCauseSchema>;
  * (截出来的是另一个机器码);`shown` 超限 ⇒ **截条目**,`total` 逐字保真。
  */
 export declare function readProbeCause(req: unknown): ProbeCauseProjection | undefined;
+/**
+ * [ref](core 7.19.0)—— `readRootCandidate.dir` 的**上限**。core 自己的同族界是
+ * `READ_ROOT_CANDIDATE_DIR_MAX = 1024`(`src/core/read-root-candidate.ts`),**未从包根导出**,故钉本地
+ * 孪生 + 本出处注记(与 `MAX_SKILL_CONTENT_CHARS` 同款处置)。
+ *
+ * 🔴 超限的方向是**整只丢,不截** —— core 契约 `shell.read_boundary.grant_candidate_is_the_grant`:卡上
+ * 显示的串就是人要加进读目录的那个串,截过的目录是**另一个**目录,加进去也清不掉这只 ask。与
+ * {@link MAX_PROBE_CAUSE_CODE} 的 `code` 超限整只丢逐字同判据。
+ */
+export declare const MAX_READ_ROOT_CANDIDATE_DIR = 1024;
+/** 窄读的输出形 —— **就是 core 的那只型**,不在本仓再声明一份同形结构(重声明 = 上游改形那天本仓静默不红)。 */
+export type ReadRootCandidateProjection = ReadRootGrantCandidate;
+/**
+ * [ref] —— `AskRequest.readRootCandidate` 的边界窄读:**把这个目录加进本会话的读目录,这只 ask 就不会
+ * 再出现**。活卡帧的**唯一**铸造点。
+ *
+ * 🔴 **零判读**:server 既不从命令文本重推目录、也不校验它是不是真的能清掉这只 ask —— 那是 core 已经
+ * 做过的判断(它把提议的根放回读边界又走了一遍),在下游再判一次就是同一个事实的第二个判官。
+ * 🔴 形不合 ⇒ **按缺席处置**;超限 ⇒ **整只丢**(见 {@link MAX_READ_ROOT_CANDIDATE_DIR})。
+ * 🔴 **缺席不是断言**:它同时覆盖「这一族 ask 没有任何目录能清掉」(敏感路径 deny 行、读边界压根读不懂
+ * 的命令、递归遍历、非读边界 ask……)与「老引擎」两形 —— 消费端只读在场,永远不读缺席。
+ */
+export declare function readReadRootCandidate(req: unknown): ReadRootCandidateProjection | undefined;
 /**
  * [ref] 件 G2 —— `AskRequest.ruleEvidence` 的形(帧 / `card_json` / 读面共用;窄读入口是
  * {@link readRuleEvidence})。三对成员各 = 值**或**五词命名缺席(`AskEvidenceAbsence`),core 引擎

package/dist/approval-card.js

@@ -160,6 +160,19 @@ export function readProbeCause(req) {
         ...(raw.further !== undefined ? { further: family(raw.further) } : {}),
     };
 }
+export const MAX_READ_ROOT_CANDIDATE_DIR = 1024;
+const ReadRootCandidateEnvelopeSchema = z.object({
+    readRootCandidate: z.object({ dir: z.string().min(1), clearsThisAsk: z.literal(true) }).optional(),
+});
+export function readReadRootCandidate(req) {
+    const parsed = ReadRootCandidateEnvelopeSchema.safeParse(req);
+    const raw = parsed.success ? parsed.data.readRootCandidate : undefined;
+    if (raw === undefined)
+        return undefined;
+    if (raw.dir.length > MAX_READ_ROOT_CANDIDATE_DIR)
+        return undefined;
+    return { dir: raw.dir, clearsThisAsk: true };
+}
 const MAX_EVIDENCE_DOT_ACTOR = 256;
 const MAX_EVIDENCE_DOTS = 16;
 const AskEvidenceAbsenceSchema = z.custom((v) => typeof v === "string" && ASK_EVIDENCE_ABSENCE_VALUES.includes(v));

package/dist/boot/resolve-spec.js

@@ -279,6 +279,7 @@ export function createResolveSpec(ctx) {
             additionalReadDirectories,
             enablePlanMode: config.planModeEnabled ? true : undefined,
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
+            ...(effMode === "bypassPermissions" ? { writeFace: "open" } : {}),
             ...(effMode === "auto" ? { autoModeRequested: true } : {}),
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
@@ -367,6 +368,8 @@ export function createResolveSpec(ctx) {
                 return merged && config.toolDeferLongtail ? applyLongtailDefer(merged, true) : merged;
             })(cap.tools),
             skills: mergeUserSkills(cap.skills, body.skills, logger),
+            ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
+            ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined),
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,

package/dist/http/routes/approvals-assistant.d.ts

@@ -6,6 +6,28 @@ import { type RouteCtx } from "../route-ctx.js";
 export declare const ASSISTANT_PREEMPT_RE: RegExp;
 export declare const ASSISTANT_RESUME_RE: RegExp;
 export declare const ASSISTANT_PLAN_REVIEW_RE: RegExp;
+/**
+ * S-342 —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
+ *
+ * ## 三个域,三个属主(这才是归一:每个域的读法只写一次,而不是三处各挑一种写法)
+ * `body.reason` 在这条路由上会被读三次,而它们的属主**不是同一个**:
+ *  · **签名域**(直连门的 HMAC 信封第五位)—— 属主是**跨仓字节契约**(§6.2 / `approvalHmacMessage`,
+ *    签名器在 cli / SDK)。那份契约明写空串与 `null` 是两个不同的被签值。⇒ **逐字线值,永不折叠**;
+ *    在这里折一刀,一份合法签发的空理由证明就永远 401(合并复审 R1 [high] 真复现过)。
+ *  · **上送域**(`resumePlanReview` / `resumeCheckpoint` 的 `reason` 尾参)—— 属主是**引擎的单铸点**
+ *    (7.19.0 / [ref] 把「人的结算」收进一个铸点,空文本在那里折成缺席,live 与 durable decide 两条路径同形)。
+ *    ⇒ **原样透传**;跨仓宪法「源头修复禁下游旁路」:在下游再折一次就是同一语义的第二个写者,
+ *    今天两者答案相同,上游哪天改法就变成一条谁都查不出来的分歧。
+ *  · **本仓自铸域**(幂等回放的**身份**)—— 属主就是本仓:它回答「这次重试与首决是不是同一个决议」。
+ *    ⇒ **本函数**。此前那里是一个裸真值判(`body.reason ? …`),与上面两处混在一起看就是三种拼法;
+ *    收进一只具名读法之后,「什么算一个理由」在本仓只有这一个答案,而另外两个域各自点名了自己的属主。
+ *
+ * 值域前置门(非串 400 / 超长 413)在两条路由里各自先跑,本函数只做「空串 ⇒ 缺席」这一件事。
+ * 纯空白**仍是**一条理由(上游把这一形逐字钉成 current behaviour,本仓跟着它、不自作主张多折一层)。
+ */
+export declare function decisionReasonOf(body: {
+    reason?: unknown;
+}): string | undefined;
 /** Structural check for an operator-supplied QuestionAnswer (durable ask resume, TC-5.4). Strict on the
  *  load-bearing shape — `answers[]` non-empty, each `{header: string, selected: string[], note?: string}` —
  *  so a typo'd payload fails the request instead of resuming the task with an answer the tool can't use. */

package/dist/http/routes/approvals-assistant.js

@@ -20,6 +20,9 @@ import { sendResumeOutcome } from "../route-ctx.js";
 export const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
 export const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
 export const ASSISTANT_PLAN_REVIEW_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/plan_review$/;
+export function decisionReasonOf(body) {
+    return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
+}
 export function isQuestionAnswer(v) {
     if (!v || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -564,7 +567,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 payload: {
                     ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
                     ...(answer !== undefined ? { answer } : {}),
-                    ...(body.reason ? { reason: body.reason } : {}),
+                    ...((r) => (r !== undefined ? { reason: r } : {}))(decisionReasonOf(body)),
                 },
                 deciderPrincipal,
                 explicitOperator,

package/dist/http/routes/tasks.js

@@ -13,7 +13,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData, liveIdentityFields } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -502,12 +502,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 }
                                 else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     const e = ev;
-                                    const ident = {
-                                        ...(e.eventId !== undefined ? { eventId: e.eventId } : {}),
-                                        ...(e.parentToolCallId !== undefined ? { parentToolCallId: e.parentToolCallId } : {}),
-                                        ...(e.sourceTaskId !== undefined ? { sourceTaskId: e.sourceTaskId } : {}),
-                                        ...(e.bgAgentId !== undefined ? { bgAgentId: e.bgAgentId } : {}),
-                                    };
+                                    const ident = liveIdentityFields(e);
                                     const textEnd = ev.type === "text_end" ? textEndEventData(e) : undefined;
                                     const arm = ev.type === "text_delta"
                                         ? { type: "text_delta", delta: e.delta, ...ident }
@@ -523,7 +518,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         sseData(res, arm);
                                 }
                                 else {
-                                    sseData(res, ev);
+                                    sseData(res, { ...ev });
                                 }
                             }
                         });
@@ -616,7 +611,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     if (deps.toolApproval) {
                         const toolApproval = deps.toolApproval;
                         prepared.spec.onAsk = windowZero
-                            ? () => Promise.resolve(toolApproval.unattendedAskOutcome())
+                            ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId: askTaskId, owner: askOwner, toolName: askReq.toolName }))
                             : toolApproval.boundAsk({
                                 owner: askOwner,
                                 taskId: askTaskId,

package/dist/http/server.d.ts

@@ -730,18 +730,42 @@ export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & Servi
 export type ServiceDeps = FlatServiceDeps & ServiceDepGroups;
 /** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export declare function flattenServiceDeps(deps: ServiceDeps): FlatServiceDeps;
-/** Personalization caps: server-pinned hard limits — a UI may be stricter, never looser. */
-export declare const MAX_USER_SKILLS = 10;
 /** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在
  *  dist/core/runner/synthetic-tools.js:84,未从 core 包根导出,故钉本地孪生+本出处注记)。修7 曾对齐旧
  *  20k 截断门([ref] 飞轮考据:20k 是压缩保留区口径,invoke 时刻用错),core 1.293 撤门后本门跟随回收
- *  ([ref]① 收口)——HTTP 面与引擎加载门同值,超限 400 fail-loud 而非引擎侧整拒后难诊断。 */
+ *  ([ref]① 收口)——HTTP 面与引擎加载门同值,超限 400 fail-loud 而非引擎侧整拒后难诊断。
+ *
+ *  🔴 **这是技能面**唯一**剩下的尺寸门,而且它不是超集帽**:引擎在装配期对超 1 MiB 的技能本就整拒
+ *  (config 阶段错误),门上先答只是把同一个判决搬到调用方看得懂的地方。[ref] 退役的三条帽
+ *  (条数 / description / name 长度)都没有这个性质——它们是本仓自造的、CC 与引擎都没有的门。 */
 export declare const MAX_SKILL_CONTENT_CHARS = 1048576;
 export declare const MAX_SYSTEM_PROMPT_CHARS = 16384;
 /** Cap on a request's `outputSchema` (JSON-serialized) — an uncapped schema bloats the prompt + the per-turn
  *  validation cost. 32KB comfortably holds a rich nested schema while bounding the abuse surface. */
 export declare const MAX_OUTPUT_SCHEMA_CHARS = 32768;
-/** Validate `body.skills` (caps + shape). Returns an error string (→ 400) or null when acceptable. */
+/**
+ * Validate `body.skills` —— **形**校验 + 一条引擎孪生门。返回错误串(→ 400)或 null。
+ *
+ * 🔴 **[ref](7.77.0,硬 BREAKING;零别名零双读)**:此前这里有三条本仓自造的拒绝臂,全部退役 ——
+ *  · `at most 10 skills per request`(条数帽);
+ *  · `skill.description must be a string of at most 1024 characters`(描述长度帽);
+ *  · `skill.name must be a non-empty string of at most 64 characters` 里的 **长度**那一半。
+ *
+ * 退役的判据是**上游两侧都没有同形门**:CC 2.1.259 的技能清单渲染(`cli259.js:23195` 的预算算法)
+ * 在超预算时把**描述裁短**、再不够就退成 name-only,**从不**因为条数多或描述长而拒掉一条技能;
+ * 它的 `Ir()` 名字校验也只判非空 / 无配对代理 / 无首尾空白 / 无括号逗号控制字符,没有长度帽。
+ * 引擎侧同理:唯一整拒的是 1 MiB 的单技能加载门。于是那三条帽是「装了 11 个技能就 400」这种
+ * 纯本仓面的伤——收益是零(预算由渲染侧按字节兜),代价是用户装不进自己的技能库。
+ *
+ * **补偿**(三问的第三问):`settings.skillListingBudgetFraction` / `settings.skillListingMaxDescChars`
+ * 两个旋钮直达引擎的渲染预算(per-turn 成本的真属主)。
+ * ⚠️ **fraction 是**单向**的**:引擎的预算 = `min(窗口 × fraction, 8 000 字节)`,8 000 是**投递车道的结构
+ * 上限**(清单帧与同 turn 的其它附件共用一份完整送达额度)⇒ **调低生效、调高被夹**;调高唯一的用处是让
+ * 一个声明窗口小于 200 000 token 的模型把清单预算拿回大窗口的水平。别把这句读成「调用方可以随便加大」。
+ * 体积面照旧由**非技能专属**的 8 MiB 请求体上限兜住(`MAX_BODY`),那是一条一直都在的门。
+ *
+ * 🔴 **server 侧禁裁列表 / 禁截描述**:渲染归引擎(单一属主)。本函数只判「这一条技能的形能不能用」。
+ */
 export declare function validateUserSkills(skills: unknown): string | null;
 /**
  * Managed-Agents-style HTTP/SSE service surface.

package/dist/http/server.js

@@ -10,6 +10,7 @@ import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifi
 import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, taskSettingsKeyIssue } from "../task-settings.js";
+import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
@@ -37,6 +38,7 @@ import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartE
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
+import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
@@ -95,7 +97,6 @@ export function flattenServiceDeps(deps) {
         return deps;
     return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
 }
-export const MAX_USER_SKILLS = 10;
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
@@ -104,15 +105,13 @@ export function validateUserSkills(skills) {
         return null;
     if (!Array.isArray(skills))
         return "skills must be an array of { name, description, content }";
-    if (skills.length > MAX_USER_SKILLS)
-        return `at most ${MAX_USER_SKILLS} skills per request`;
     for (const s of skills) {
         if (s === null || typeof s !== "object")
             return "each skill must be an object { name, description, content }";
-        if (typeof s["name"] !== "string" || s["name"].length === 0 || s["name"].length > 64)
-            return "skill.name must be a non-empty string of at most 64 characters";
-        if (typeof s["description"] !== "string" || s["description"].length > 1024)
-            return "skill.description must be a string of at most 1024 characters";
+        if (typeof s["name"] !== "string" || s["name"].length === 0)
+            return "skill.name must be a non-empty string";
+        if (typeof s["description"] !== "string")
+            return "skill.description must be a string";
         if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS)
             return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
     }
@@ -525,6 +524,13 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "objective must not be empty or whitespace-only (an empty user message poisons the session history on strict providers)");
             return null;
         }
+        {
+            const bodyKeyIssue = taskBodyKeyIssue(body);
+            if (bodyKeyIssue) {
+                sendError(res, 400, "request.body_shape", bodyKeyIssue.message, { unknownKeys: bodyKeyIssue.unknownKeys, unsupportedKeys: bodyKeyIssue.unsupportedKeys });
+                return null;
+            }
+        }
         if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > 64)) {
             sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
             return null;
@@ -644,6 +650,20 @@ export function createHttpServer(rawDeps) {
                 sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
                 return null;
             }
+            if (st.skillListingBudgetFraction !== undefined) {
+                const v = st.skillListingBudgetFraction;
+                if (typeof v !== "number" || !Number.isFinite(v) || v <= 0 || v > 1) {
+                    sendError(res, 400, "request.field_invalid", "settings.skillListingBudgetFraction must be a number greater than 0 and at most 1");
+                    return null;
+                }
+            }
+            if (st.skillListingMaxDescChars !== undefined) {
+                const v = st.skillListingMaxDescChars;
+                if (typeof v !== "number" || !Number.isSafeInteger(v) || v <= 0) {
+                    sendError(res, 400, "request.field_invalid", "settings.skillListingMaxDescChars must be a positive integer");
+                    return null;
+                }
+            }
             if (st.hooks !== undefined && st.hooks !== null) {
                 const hooksParsed = parseHooksConfig(st.hooks);
                 if (!hooksParsed.config) {
@@ -1355,7 +1375,7 @@ export function createHttpServer(rawDeps) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.windowZero
-                ? () => Promise.resolve(toolApproval.unattendedAskOutcome())
+                ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId, owner: principal ?? null, toolName: askReq.toolName }))
                 : toolApproval.boundAsk({
                     owner: principal ?? null,
                     taskId,
@@ -1532,6 +1552,7 @@ export function createHttpServer(rawDeps) {
                 const startSeq = rs && taskId ? await rs.maxSeq(taskId) : 0;
                 let text = "";
                 let reasoning = "";
+                let reasoningEventId;
                 const persistThinking = deps.config.traceThinking;
                 const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
@@ -1555,8 +1576,9 @@ export function createHttpServer(rawDeps) {
                 const anchor = new TurnAnchorCapture(captureTurnAnchor, () => deps.metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
                 const flush = async () => {
                     if (reasoning) {
-                        await append("reasoning", modelTextEventData({ text: reasoning }));
+                        await append("reasoning", modelTextEventData({ text: reasoning, eventId: reasoningEventId }));
                         reasoning = "";
+                        reasoningEventId = undefined;
                     }
                     if (text) {
                         await append("text", modelTextEventData({ text, eventId: anchor.firstTextEventId }));
@@ -1632,10 +1654,14 @@ export function createHttpServer(rawDeps) {
                                 text += ev.delta;
                                 anchor.onText(ev.eventId);
                                 break;
-                            case "reasoning_delta":
-                                if (persistThinking)
-                                    reasoning += ev.delta;
+                            case "reasoning_delta": {
+                                const rb = reasoningDeltaBytes(ev);
+                                if (persistThinking && rb !== undefined) {
+                                    reasoning += rb;
+                                    reasoningEventId ??= reasoningSegmentEventId(ev.eventId);
+                                }
                                 break;
+                            }
                             case "tool_start":
                                 anchor.onTool();
                                 await flush();

package/dist/request-key-closure.d.ts

@@ -0,0 +1,30 @@
+/** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
+ *  放大成流量面。超出部分只报数。 */
+export declare const MAX_KEY_ECHO = 20;
+/** 键名回显的清洗:剥控制/双向字符(键名进的是 JSON 错误体与运维日志,一个 RLO 能把两行字读反),
+ *  再按 {@link MAX_KEY_ECHO_CHARS} 截断。清洗之外**逐字**,不做大小写/近似猜测。 */
+export declare function echoKeyName(prefix: string, key: string): string;
+/** 一次键闭集裁决的产物:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
+export interface KeyClosureIssue {
+    message: string;
+    /** 词表外的键(拼错/未来键),全路径形,已清洗+截断+排序+封顶。 */
+    unknownKeys: string[];
+    /** 上游合约(CC / SDK / 引擎)里合法、但本 service 不在这一面接线的键,同形。 */
+    unsupportedKeys: string[];
+}
+/** 逐键分拣:受理集内跳过,`tolerated` 命中进 `unsupported`,其余进 `unknown`。两桶都拒,标签只影响文案。 */
+export declare function scanKeyClosure(bag: object, prefix: string, accepted: ReadonlySet<string>, tolerated: ReadonlySet<string>, into: {
+    unknown: string[];
+    unsupported: string[];
+}): void;
+/** 一张分类表的文案片段(封顶后只报数)。 */
+export declare function keyClosureClause(names: string[], label: string): string;
+/**
+ * FRESH 提交面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
+ * 全部受理 ⇒ `null`。
+ *
+ * 判据边界(与 settings 那只同源,有意窄):只判**键名**;体本身非对象 ⇒ 本门不判(留给既有的
+ * 「missing 'objective' string」那道门,免得同一个体被两句话抢答)。
+ */
+export declare function taskBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
+//# sourceMappingURL=request-key-closure.d.ts.map

package/dist/request-key-closure.js

@@ -0,0 +1,56 @@
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+export const MAX_KEY_ECHO = 20;
+const MAX_KEY_ECHO_CHARS = 64;
+export function echoKeyName(prefix, key) {
+    const clean = key.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return `${prefix}${clean.length > MAX_KEY_ECHO_CHARS ? `${clean.slice(0, MAX_KEY_ECHO_CHARS)}…` : clean}`;
+}
+export function scanKeyClosure(bag, prefix, accepted, tolerated, into) {
+    for (const k of Object.keys(bag)) {
+        if (accepted.has(k))
+            continue;
+        (tolerated.has(k) ? into.unsupported : into.unknown).push(echoKeyName(prefix, k));
+    }
+}
+export function keyClosureClause(names, label) {
+    const shown = names.slice(0, MAX_KEY_ECHO);
+    const more = names.length - shown.length;
+    return `${label}: ${shown.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+}
+const TASK_BODY_DECLARED_KEYS = [
+    "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
+    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "enableFork", "excludeTools",
+    "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
+    "maxTokens", "mcpServers", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
+    "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
+    "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
+    "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
+    "verify", "verifyRounds",
+];
+const TASK_BODY_SCENARIO_KEYS = ["businessContext", "lenses", "repo", "rounds", "team"];
+const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);
+const UNSUPPORTED_BODY = new Set(["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "writeFace"]);
+export function taskBodyKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", ACCEPTED_BODY, UNSUPPORTED_BODY, buckets);
+    if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
+        return null;
+    buckets.unknown.sort();
+    buckets.unsupported.sort();
+    const parts = [
+        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a task-request key — check the spelling)")] : []),
+        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (an engine seat this service derives, never reads from the body)")] : []),
+    ];
+    return {
+        message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+            `${parts.join("; ")}. ` +
+            `Accepted: ${[...ACCEPTED_BODY].sort().join(",")}`,
+        unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
+        unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
+    };
+}
+//# sourceMappingURL=request-key-closure.js.map

package/dist/runs.js

@@ -95,6 +95,8 @@ export function resumeAtHttpStatus(result) {
         return 400;
     if (code === "config.invalid_checkpoint_store")
         return 400;
+    if (code === "config.skill_listing_budget_invalid")
+        return 400;
     if (code === "config.memory_capture_unsupported")
         return 409;
     if (!code.startsWith("resume_at."))
@@ -196,7 +198,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.windowZero
-            ? () => Promise.resolve(coordinator.unattendedAskOutcome())
+            ? (askReq) => Promise.resolve(coordinator.unattendedAskOutcome({ taskId, owner: elicitOwner ?? owner, toolName: askReq.toolName }))
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,

package/dist/runtime-governance.d.ts

@@ -84,13 +84,27 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  */
 export declare function compileCommandPolicy(rules: CommandRule[] | undefined): ToolPolicy | undefined;
 /**
- * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the three primitives — TRAP #2):
- *  - `read-only` / `plan` → `handsReadOnly: true` (read + propose, never mutate; the §6 verifier read-only
- *    boundary). `plan` shares the SAME safety boundary as `read-only`; the "present a plan for approval" intent
- *    is higher up (UX), not a distinct TaskSpec safety field, so both map to read-only hands.
+ * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
+ *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
+ *    §6 verifier read-only boundary). `plan` shares the SAME safety boundary as `read-only`; the "present a plan
+ *    for approval" intent is higher up (UX), not a distinct TaskSpec safety field, so both map to read-only hands.
  *  - `ask` → `shellGate: "always"` (every `Bash` command tightens to an `irreversible_ask` durable suspend —
  *    the fail-closed default for an unattended deployment with no parsed classifier).
  *  - `auto` / `undefined` → `{}` (no extra tightening; still subject to the deployment baseline + commandPolicy).
+ *
+ * 🔴 **为什么只读那两档同时说 `writeFace:"roots"`**([ref] 随批;不是补丁,是把这一档的表态说全):
+ * core 7.18.0 的 `resolveContainmentFace` 第 1 行把「只读(verifier)挂载 × 任务层 `writeFace:"open"`」
+ * 判成**真实矛盾**并**抛** `config.write_face_readonly_conflict`(理由逐字:那种挂载根本不带写面,
+ * 声明一个开放写面 = 为一次调用没有的工具表态)。而 `permissionMode:"bypassPermissions"` 自 [ref] 起
+ * 会在阶段④铸出 `writeFace:"open"` —— 于是「`AUTONOMY=read-only` 的部署 × 一个 bypass 请求」这一格
+ * 不修就是**整条 run 当场配置错误失败**。
+ *
+ * 修在这里而不是在写点加一条「若 handsReadOnly 则别写」的判据:两个字段**在这一档里是同一件事**
+ * (「这条 run 没有写面」),而 `tightenTaskSpec` 本来就把 `writeFace` 当 tighten-only 安全字段收
+ * (`base:"open"` × `override:"roots"` ⇒ `"roots"`,反向 throw)—— 用既有的合并表表达它,规则数不变;
+ * 在写点加判据则是让阶段④去读一个它不拥有的治理事实,那才是第二个判官。
+ * 与 `ask → shellGate:"always"` 同姿势:这一档**自己就是**一次「围栏在」的表态,所以无表态的请求上
+ * 它照样把键写出来(不是「只在有 open 时才压」——那又是一条判据)。
  */
 export declare function autonomyOverrides(autonomy: Autonomy | undefined): Partial<TaskSpec>;
 /**

package/dist/runtime-governance.js

@@ -85,7 +85,7 @@ export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
         case "plan":
-            return { handsReadOnly: true };
+            return { handsReadOnly: true, writeFace: "roots" };
         case "ask":
             return { shellGate: "always" };
         case "auto":
@@ -163,7 +163,7 @@ export function applyRuntimeGovernance(base, governance) {
         const shellObserver = createGovernanceShellGateMarkPolicy(marksOf);
         overrides.toolPolicy = governancePolicy === undefined ? shellObserver : combinePolicies(governancePolicy, shellObserver);
     }
-    if (overrides.toolPolicy === undefined && overrides.handsReadOnly === undefined && overrides.shellGate === undefined) {
+    if (Object.keys(overrides).length === 0) {
         return base;
     }
     return tightenTaskSpec(base, overrides);

package/dist/spec-fields.d.ts

@@ -38,7 +38,9 @@ export declare function normalizeAttachments(v: unknown): TaskSpec["attachments"
 export declare function normalizeResumeAtMode(v: unknown, resumeAtResolved: boolean): "at" | "before" | undefined;
 /** [ref] 防御上限:一份请求最多带多少个 agent 定义。core 侧无上限;这里封一个防御值 —— 每个定义都进
  *  系统提示(whenToUse/skills/systemPrompt 全是 prompt 载荷),不设界就是 per-turn token 成本洞(与
- *  MAX_USER_SKILLS 同轴)。32 足够覆盖 CC 式 `.claude/agents/` 全家桶还有余量。 */
+ *  上限)。32 足够覆盖 CC 式 `.claude/agents/` 全家桶还有余量。⚠️ 这条帽守的是 **agent 定义**的条数
+ *  (每个定义的 whenToUse/systemPrompt 都是无条件进系统提示的 prompt 载荷),与 [ref] 退役的
+ *  **技能**条数帽不是同一轴:技能清单由引擎按预算渲染(超了裁描述),agent 定义没有那个预算面。 */
 export declare const MAX_TASK_AGENTS = 32;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =

package/dist/spec-fields.js

@@ -58,7 +58,6 @@ const MAX_AGENT_TEXT_CHARS = 4_096;
 const MAX_AGENT_SYSTEM_PROMPT_CHARS = 65_536;
 const MAX_AGENT_TOOLS = 64;
 const MAX_AGENT_TOOL_NAME_CHARS = 128;
-const MAX_AGENT_SKILLS = 10;
 const MAX_AGENT_SKILL_CONTENT_CHARS = 1_048_576;
 const MAX_AGENT_MAX_TURNS = 1_000;
 const boundedString = (max) => (v) => typeof v === "string" && v.length <= max;
@@ -73,9 +72,9 @@ const skillOk = (s) => {
         if (k !== "name" && k !== "description" && k !== "content" && k !== "manifest" && k !== "files")
             return false;
     }
-    if (typeof s.name !== "string" || s.name.length === 0 || s.name.length > MAX_AGENT_NAME_CHARS)
+    if (typeof s.name !== "string" || s.name.length === 0)
         return false;
-    if (typeof s.description !== "string" || s.description.length > 1_024)
+    if (typeof s.description !== "string")
         return false;
     if (typeof s.content !== "string" || s.content.length === 0 || s.content.length > MAX_AGENT_SKILL_CONTENT_CHARS)
         return false;
@@ -135,8 +134,8 @@ const TASK_AGENT_FIELD_SHAPES = {
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     skills: {
-        desc: `an array of at most ${MAX_AGENT_SKILLS} { name, description, content } skill objects (optional manifest/files; files entries need { path, content })`,
-        ok: (v) => Array.isArray(v) && v.length <= MAX_AGENT_SKILLS && v.every(skillOk),
+        desc: "an array of { name, description, content } skill objects (optional manifest/files; files entries need { path, content }) — no count cap; the engine renders the listing within its own byte budget",
+        ok: (v) => Array.isArray(v) && v.every(skillOk),
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },
     isolation: { desc: '"worktree"', ok: (v) => v === "worktree" },

package/dist/task-settings.d.ts

@@ -37,6 +37,7 @@
  */
 import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider } from "@sema-agent/core";
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
+import { type KeyClosureIssue } from "./request-key-closure.js";
 /** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [ref]/[ref] five-word
  *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set ([ref] P2-1 corpus check): CC's own
  *  full enum is SIX words (= ours + `dontAsk`), CC's managed/remote form accepts FOUR (= ours − `bypassPermissions`,
@@ -160,6 +161,13 @@ export interface ParsedTaskSettings {
      *  这里只 PARSE;应用点(main.ts resolveSpec)按单用户闸(`requirePrincipal !== true`)决定翻不翻成
      *  core `TaskSpec.hooks` 回调——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
     hooks?: HooksConfig;
+    /** [ref](7.77.0)—— CC settings 同名键:上下文窗口里**留给技能清单**的比例((0,1];CC 默认 0.01 = 1%)。
+     *  超预算时引擎把描述裁短、再不够退成 name-only(`cli259.js` 的清单渲染算法),**从不**拒掉一条技能 ——
+     *  这正是本版把技能条数/描述两条帽整条退役后的补偿面:per-turn 成本的旋钮在**渲染侧**,不在受理侧。
+     *  server 零加工透传到 `TaskSpec`,默认值属主是引擎(缺席 ⇒ 整键不写)。 */
+    skillListingBudgetFraction?: number;
+    /** 同族第二键:每条技能描述在清单里的字符帽(正整数;CC 默认 1536)。超出由引擎**截断**,不是拒。 */
+    skillListingMaxDescChars?: number;
 }
 /** The result of parsing an untrusted `body.settings`: the applied subset + the names of present-but-deferred
  *  fields (so the caller can log/advertise them — no silent drop). `null` settings ⇒ `{ settings: undefined }`. */
@@ -180,10 +188,15 @@ export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
- *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 在 {@link parseTaskSettings};
- *  `webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
- *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
+ *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
+ *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
+ *
+ *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
+ *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
+ *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
+ *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。 */
+export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
 export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响
@@ -202,17 +215,6 @@ export declare const TASK_SETTINGS_UNSUPPORTED_KEYS: readonly ["apiKeyHelper", "
 /** 同上,`settings.permissions` 子层(出处 = SDK `SettingsPermissions` 的三个声明键)。
  *  `additionalDirectories` 有**同请求替代面**:顶层 `body.additionalDirectories`([ref],resolve-spec 真消费)。 */
 export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["additionalDirectories", "disableBypassPermissionsMode"];
-/** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
- *  放大成流量面。超出部分只报数。 */
-export declare const MAX_SETTINGS_KEY_ECHO = 20;
-/** {@link taskSettingsKeyIssue} 的拒体:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
-export interface TaskSettingsKeyIssue {
-    message: string;
-    /** 词表外的键(拼错/未来键),`settings.x` / `settings.permissions.x` 全路径形,已清洗+截断+排序+封顶。 */
-    unknownKeys: string[];
-    /** CC/SDK 合约合法但本 service 不接线的键,同形。 */
-    unsupportedKeys: string[];
-}
 /**
  * FRESH 提交面的 `settings` 键闭集裁决:顶层或 `permissions` 子层出现受理集之外的键 ⇒ 返回拒体(调用方 400
  * `request.body_shape`);全部受理 ⇒ `null`。
@@ -224,7 +226,7 @@ export interface TaskSettingsKeyIssue {
  *    「settings must be an object」/「settings.permissions must be an object」两道门,免得同一个体被两句话抢答。
  *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
  */
-export declare function taskSettingsKeyIssue(raw: unknown): TaskSettingsKeyIssue | null;
+export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | null;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
  * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE