@sema-agent/server 7.78.1 → 7.79.0

package/dist/plugins/remote-env-k8s.js

@@ -78,7 +78,7 @@ export class RemoteK8sExecutionEnv {
         this.cwd = this.cfg.mountPath;
         this.homeDir = config.homeDir;
         this.deps = deps ?? {};
-        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot };
+        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));
         this.backgroundCapabilities = {
             supported: true,

package/dist/plugins/remote-env-ssh.d.ts

@@ -61,9 +61,20 @@ export interface SshEnvDeps {
     connectOnce?: (signal?: AbortSignal) => Promise<ConnectResult>;
 }
 export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,在真机上解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
     cwd: string;

package/dist/plugins/remote-env-ssh.js

@@ -16,7 +16,7 @@ function exitCodeForSignalKill(signal) {
     return 128 + (signalNumber(`SIG${signal}`) ?? 9);
 }
 export class RemoteSshExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     cwd;
     conn;
     sftpPromise;

package/dist/run-local.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { terminalProjection } from "@sema-agent/core";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -429,7 +430,7 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const taskListLane = createTaskListLane({ logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, metrics, logger,
+        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, metrics, logger,
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,

package/dist/runs.d.ts

@@ -97,6 +97,57 @@ export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, ta
 export declare function isSessionConflictResult(result: {
     terminal: TerminalCause;
 }): boolean;
+/**
+ * E18 resume-at CALLER error → an HTTP 4xx. A bad/stale resume-at target (the resolved entryId is gone or is not a
+ * settled message boundary) surfaces as a FAILED TaskResult carrying a `resume_at.*` errorCode (core swallows the
+ * prepare-throw into the result, exactly like a session conflict — runtask catch → status:"failed"+errorCode). The
+ * sync path otherwise 200s a failed result; map these to 4xx so a caller mistake reads as one. `not_found` (the
+ * entry is genuinely absent) → 404; everything else (not_a_message / conflicts_resume / no_session) → 422.
+ *
+ * [ref] Phase3: `requireExistingSession` on a genuinely-missing/purged session ALSO surfaces as a failed result
+ * (core prepare-task maps the store's `not_found` → `resume.session_not_found`); map it to 404 (the session is gone),
+ * the same "caller mistake reads as a 4xx, not a silent 200 fresh run" discipline.
+ *
+ * [ref] rewind exclusive mode (core 1.292 resumeAtMode:"before"): its two edge rejections ride the same `resume_at.*`
+ * prefix (before_target_not_user / before_root_unsupported → 422 via the existing branch, errorCode passed through
+ * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
+ * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
+ * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
+ *
+ * [ref] 件A([ref] 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
+ * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
+ * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
+ * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
+ * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
+ * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
+ *
+ * [ref] (core 7.0.0 片2/3, [ref] S-3): the session capture opt-out's four prepare-throw refusals ride the
+ * same pipe. `memory.capture_optout_denied` is TERMINAL (the principal's `allowMemoryOptOut` verdict is an
+ * explicit `false`, or the posture is `capture-required` / `governed`-with-absent-verdict — a retry cannot
+ * change it) → 403, the `memory.admission_denied` twin. `memory.capture_optout_unpersisted` is the
+ * declaration arm's "control-plane record could not be written" refusal — a store outage, retry may succeed
+ * → 503 (transient fail-closed, the `memory.admission_required` twin; no retryAfterMs on this one — core
+ * mints none, so the sync leg forwards no hint rather than inventing one). `config.memory_capture_spelling`
+ * is a TaskSpec authoring mistake (the only legal spelling is the string "off") → 400, the
+ * `config.memory_erasure_request` family shape. `config.memory_capture_unsupported` is the DEPLOYMENT SHAPE
+ * refusing the declaration (remote/per-run execution with no durable capture-record carrier: the record
+ * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
+ * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
+ * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
+ *
+ * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
+ * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
+ * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
+ * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
+ * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
+ * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
+ * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
+ * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
+ * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
+ * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
+ * 委派入口接线那天零改动即生效。同族其余五码今天**仍落 200-with-failed-body**,那是本批**之前**就存在的
+ * 缺口(不是本批回归),已在上述对表格里逐码显式登记为债务,并由那道门看住不许陈腐。
+ */
 export declare function resumeAtHttpStatus(result: {
     terminal: TerminalCause;
 }): number | undefined;

package/dist/runs.js

@@ -1,5 +1,6 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, terminalProjection, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, stripResumeToken } from "./terminal.js";
+import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { redactErrorMessage } from "./observability/run-terminal-log.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
@@ -66,16 +67,6 @@ export function isSessionConflictResult(result) {
         return result.terminal.code === "conflict";
     return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
 }
-const GOVERNANCE_HTTP_STATUS = {
-    "memory.admission_denied": 403,
-    "memory.admission_required": 503,
-    "memory.capture_optout_denied": 403,
-    "config.tool_mount_denied": 400,
-    "config.locked_key": 400,
-    "usage.window_exhausted": null,
-    "config.compliance_required": null,
-    "config.compliance_denied": null,
-};
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
     if (code === undefined)

package/dist/spec-fields.d.ts

@@ -37,8 +37,8 @@ export declare function normalizeAttachments(v: unknown): TaskSpec["attachments"
  */
 export declare function normalizeResumeAtMode(v: unknown, resumeAtResolved: boolean): "at" | "before" | undefined;
 /** [ref] 防御上限:一份请求最多带多少个 agent 定义。core 侧无上限;这里封一个防御值 —— 每个定义都进
- *  系统提示(whenToUse/skills/systemPrompt 全是 prompt 载荷),不设界就是 per-turn token 成本洞(与
- *  上限)。32 足够覆盖 CC 式 `.claude/agents/` 全家桶还有余量。⚠️ 这条帽守的是 **agent 定义**的条数
+ *  系统提示(whenToUse/skills/systemPrompt 全是 prompt 载荷),不设界就是 per-turn token 成本洞。
+ *  32 足够覆盖 CC 式 `.claude/agents/` 全家桶还有余量。⚠️ 这条帽守的是 **agent 定义**的条数
  *  (每个定义的 whenToUse/systemPrompt 都是无条件进系统提示的 prompt 载荷),与 [ref] 退役的
  *  **技能**条数帽不是同一轴:技能清单由引擎按预算渲染(超了裁描述),agent 定义没有那个预算面。 */
 export declare const MAX_TASK_AGENTS = 32;

package/dist/task-a2a.js

@@ -1,6 +1,8 @@
 import { resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
+import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
+import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("a2a") === true)
@@ -49,16 +51,16 @@ function normalizeA2aPeer(e) {
             if (!ax || typeof ax !== "object" || Array.isArray(ax))
                 return null;
             const a = ax;
-            if (a.effect !== undefined && a.effect !== "read" && a.effect !== "write" && a.effect !== "idempotent")
+            if (a.effect !== undefined && !isToolEffect(a.effect))
                 return null;
             if (a.egress !== undefined && typeof a.egress !== "boolean")
                 return null;
-            if (a.irreversibility !== undefined && a.irreversibility !== "always" && a.irreversibility !== "never")
+            if (a.irreversibility !== undefined && !isToolAxisIrreversibility(a.irreversibility))
                 return null;
             const entry = {
-                ...(a.effect !== undefined ? { effect: a.effect } : {}),
-                ...(a.egress !== undefined ? { egress: a.egress } : {}),
-                ...(a.irreversibility !== undefined ? { irreversibility: a.irreversibility } : {}),
+                ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
+                ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
+                ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
             };
             if (Object.keys(entry).length > 0)
                 axes[skill] = entry;
@@ -91,7 +93,7 @@ export function assertRequestA2aUnlocked(bodyA2a, lockedKeys) {
         return;
     if (bodyA2a === undefined || bodyA2a === null)
         return;
-    throw new HttpError(400, "`a2aPeers` is administratively locked by this deployment (locked key \"a2a\") — task-supplied A2A peers are refused; locks are config-time and there is no request-time unlock", {
+    throw new HttpError(GOVERNANCE_HTTP_STATUS["config.locked_key"], "`a2aPeers` is administratively locked by this deployment (locked key \"a2a\") — task-supplied A2A peers are refused; locks are config-time and there is no request-time unlock", {
         code: "config.locked_key",
     });
 }

package/dist/task-cwd.d.ts

@@ -18,6 +18,30 @@ export declare const MAX_CWD_CHARS = 4096;
  *     先改这里**:把判据换成 core 的 `isAbsoluteForFamily`,并把家族从这条 cwd 自己的拼法取。
  *  钉见 `test/task-cwd.test.ts` 的「[ref] 路径家族接缝」格(实测读数,不是推断)。 */
 export declare function isValidCwd(cwd: unknown): cwd is string;
+/**
+ * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
+ * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符
+ * 统一剥掉(根 `/` 除外),让同一目标只有一个 key —— 前缀判域(见 {@link dirCoversPath})靠的就是
+ * key 的唯一性。
+ *
+ * 🔴 **单点**(S-351 起):此前它的一份私有副本住在 `boot/deferred-sandbox-path-env.ts`(沙箱代理的
+ * `absolutePath` 词法臂),而写门豁免域与任务根的判域现在读的是同一条律 —— 两份各自归一就是两个 key
+ * 空间,而「豁免域盖没盖住任务根」这种判断在两个 key 空间里可以同时答是和否。
+ * (core 内部有同形的 `normalizeAbsPathLexically`,但未从包根导出;此处是 Node 标准库的等价运算,
+ *  不是它的抄本——若日后 core 导出,这里应改为直接复用。)
+ */
+export declare function normalizeAbsolutePathLexically(p: string): string;
+/**
+ * **词法**判域:`dir` 是不是 `target` 本身或它的祖先(= `target` ⊆ `dir`,「等于 ∪ 后代」)。
+ *
+ * 这是 core `assertExemptDirsDoNotCoverRoot` 那条律的本仓同形(亲读安装树
+ * `dist/core/fs-write-gate-policy.js:11-28` → `swallowedFenceRoot` → `isWithin(root, p)`:
+ * 先各自词法归一,再判 `p === root` 或 `p` 以 `root + "/"` 起头)。**两端都只做词法**,不 realpath ——
+ * 写门的构造期本来就没有 I/O(core 同理),承诺 canonical 是承诺一件此刻做不到的事。
+ *
+ * 段感知由「归一后 + 分隔符前缀」保证:`/a/bc` **不在** `/a/b` 域内。
+ */
+export declare function dirCoversPath(dir: string, target: string): boolean;
 /**
  * The deployment-level gate: does THIS deployment honor a caller-supplied `cwd`? TRUE only for the single-user
  * `host` lane (see module header). All cloud/container lanes + any multi-tenant deployment → FALSE (cwd ignored).

package/dist/task-cwd.js

@@ -8,6 +8,15 @@ export function isValidCwd(cwd) {
         path.isAbsolute(cwd) &&
         !cwd.split(/[/\\]/).includes(".."));
 }
+export function normalizeAbsolutePathLexically(p) {
+    const collapsed = path.posix.normalize(p.replace(/^\/+/, "/"));
+    return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
+}
+export function dirCoversPath(dir, target) {
+    const root = normalizeAbsolutePathLexically(dir);
+    const p = normalizeAbsolutePathLexically(target);
+    return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
+}
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }

package/dist/task-mcp.js

@@ -1,9 +1,11 @@
 import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError } from "./security.js";
+import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
+import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export function mcpInjectionHonored(config) {
@@ -72,9 +74,9 @@ function normalizeServer(e, noteBadOrigin) {
                 continue;
             const a = ax;
             const entry = {
-                ...(a.effect === "read" || a.effect === "write" || a.effect === "idempotent" ? { effect: a.effect } : {}),
+                ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
                 ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
-                ...(a.irreversibility === "always" || a.irreversibility === "never" ? { irreversibility: a.irreversibility } : {}),
+                ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
             };
             if (Object.keys(entry).length > 0)
                 axes[tool] = entry;
@@ -123,7 +125,7 @@ export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
         return;
     if (bodyMcp === undefined || bodyMcp === null)
         return;
-    throw new HttpError(400, "`mcpServers` is administratively locked by this deployment (locked key \"mcp\") — task-supplied MCP servers are refused; locks are config-time and there is no request-time unlock", {
+    throw new HttpError(GOVERNANCE_HTTP_STATUS["config.locked_key"], "`mcpServers` is administratively locked by this deployment (locked key \"mcp\") — task-supplied MCP servers are refused; locks are config-time and there is no request-time unlock", {
         code: "config.locked_key",
     });
 }

package/dist/task-settings.d.ts

@@ -119,10 +119,40 @@ export declare function effectivePermissionMode(body: {
  * 把它折进来会逼出一个 `undefined` 返回值,而那正是「写 off」与「不写」被混同的入口(core 的
  * 缺席默认是 off,但**写**一个 off 会成为 governance 的 base,与缺席不是同一件事)。
  *
- * 🔴 **闭集 exhaustive switch,无 default 臂**:五个模式词是封闭词表,新增一个模式而不更新本表
+ * 🔴 **闭集穷举表,无 default 臂**:五个模式词是封闭词表,新增一个模式而不更新本表
  * 是**编译错误**([ref] 的安全轴纪律:词表的未知项不许有静默兜底臂)。
  */
 export declare function shellGateForMode(effMode: SettingsPermissionMode): "off" | "classify";
+/**
+ * [ref] —— 生效模式 → `TaskSpec.writeFace`(**写**面的 roots 容纳判断)。`"open"` = 工作区根之外也能写;
+ * `undefined` = **不写这个键**(core 缺省 `"roots"`,与 7.77.0 及以前逐字节相同)。表逐字在
+ * {@link MODE_ENGINE_FACES},裁定与硬边界写在 `resolve-spec.ts` 的写点上。
+ *
+ * 🔴 与 {@link shellGateForMode} 同律:入参非可选 —— 「表态缺席」不是这张表的一行(那是调用点判的
+ * 「整个键都不写」),把它折进来就会逼出第二个 `undefined` 语义。
+ */
+export declare function writeFaceForMode(effMode: SettingsPermissionMode): "open" | undefined;
+/**
+ * [ref] ① —— 生效模式 → `TaskSpec.autoModeRequested`(auto **意图**座,CC 250「用户开」半场)。
+ * `true` 只有 auto 一行;`undefined` = 不写键。表逐字在 {@link MODE_ENGINE_FACES}。
+ */
+export declare function autoModeRequestedForMode(effMode: SettingsPermissionMode): true | undefined;
+/**
+ * S-346 —— [ref] 技能清单预算两旋钮的**值域谓词**(一对具名单铸点)。
+ *
+ * 两层同问这一只:FRESH 提交面的 400 门(`http/server.ts`)问「合不合法」,RESUME 宽容层
+ * ({@link parseTaskSettings})问「收不收下」—— 这两句话在这两个键上是**同一个问题的正反面**
+ * (400 的条件恰是受理条件的否定)。修前它们各写一遍字面比较,而承重的两件事
+ * (`Number.isFinite` 挡 `NaN`/`Infinity`、`Number.isSafeInteger` 与引擎受理域**同字**)
+ * 靠两份注释各自记着 —— 任一处漏一个判据,同一个坏值就会在一条腿上 400、在另一条腿上被收下。
+ *
+ * 值域**抄 CC settings schema**,不自创;server 侧零加工(不夹紧、不换算、不复刻 core 的默认值),
+ * 判据全文见两个调用点的顶注。
+ */
+export declare function skillListingBudgetFractionOk(v: unknown): v is number;
+/** {@link skillListingBudgetFractionOk} 的孪生(`int().positive()`;`isSafeInteger` 而不是 `isInteger` 的
+ *  理由见那里)。 */
+export declare function skillListingMaxDescOk(v: unknown): v is number;
 /** The validated, service-trusted subset of `SemaSettings` we project onto the spec. `env` is parsed only to REPORT
  *  it as received-but-deferred when off the host lane (never silently dropped); a MALFORMED `hooks` likewise reports
  *  deferred (submit 路径另有 400 fail-loud),valid `hooks` 进 applied shape(hook-runner 阶段一)。 */

package/dist/task-settings.js

@@ -35,15 +35,26 @@ export function effectivePermissionMode(body, settings) {
     return requested;
 }
 export function shellGateForMode(effMode) {
-    switch (effMode) {
-        case "bypassPermissions":
-            return "off";
-        case "auto":
-        case "default":
-        case "acceptEdits":
-        case "plan":
-            return "classify";
-    }
+    return MODE_ENGINE_FACES[effMode].shellGate;
+}
+const MODE_ENGINE_FACES = {
+    bypassPermissions: { shellGate: "off", writeFace: "open", autoModeRequested: undefined },
+    auto: { shellGate: "classify", writeFace: undefined, autoModeRequested: true },
+    default: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
+    acceptEdits: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
+    plan: { shellGate: "classify", writeFace: undefined, autoModeRequested: undefined },
+};
+export function writeFaceForMode(effMode) {
+    return MODE_ENGINE_FACES[effMode].writeFace;
+}
+export function autoModeRequestedForMode(effMode) {
+    return MODE_ENGINE_FACES[effMode].autoModeRequested;
+}
+export function skillListingBudgetFractionOk(v) {
+    return typeof v === "number" && Number.isFinite(v) && v > 0 && v <= 1;
+}
+export function skillListingMaxDescOk(v) {
+    return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
 export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
 export const MAX_SETTINGS_PERMISSION_RULES = 1_000;
@@ -162,10 +173,10 @@ export function parseTaskSettings(raw) {
     if (hooksConfig)
         out.hooks = hooksConfig;
     const fraction = s.skillListingBudgetFraction;
-    if (typeof fraction === "number" && Number.isFinite(fraction) && fraction > 0 && fraction <= 1)
+    if (skillListingBudgetFractionOk(fraction))
         out.skillListingBudgetFraction = fraction;
     const maxDesc = s.skillListingMaxDescChars;
-    if (typeof maxDesc === "number" && Number.isSafeInteger(maxDesc) && maxDesc > 0)
+    if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred };
 }

package/dist/tool-axis-words.d.ts

@@ -0,0 +1,30 @@
+/**
+ * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词,**两面共用一份**。
+ *
+ * ## 病(修前)
+ * `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构
+ * (`effect` / `egress` / `irreversibility`),而两个**闭集词表**是**手抄的字面串**:四份字面量
+ * (两文件 × 两个词轴),没有一份钉在 core 的型上。后果不是「今天判错了」,而是**判据比声明窄**这件事
+ * 没有任何门看得见 —— core 哪天给 `ToolEffect` 加一个词(或把 `irreversibility` 的两词改成三词,它在
+ * `AskOrigin` 那一面**已经**是 `never|maybe|always` 三词了),两条请求腿会把那个**合法**的新词
+ * **静默剔除**(MCP 腿)或**整条 server 判假**(A2A 腿),而 tsc 一声不吭。
+ *
+ * ## 修法
+ * 词表留在本仓(运行期要它),但**两向钉死在 core 的型上**:core 加词 ⇒ 正向门红;本表留了一个 core
+ * 已经没有的词 ⇒ 反向门红。两个面共用**同一只**谓词,于是「什么算一个合法的轴值」在本仓只有一个答案。
+ *
+ * 🔴 **只管值域,不管处置**:两条腿对坏值的处置**刻意不同**(MCP = 丢这一键、留 server;A2A = 整条拒),
+ * 判据与理由各写在各自的调用点。合并处置会抹掉那条真实的分歧(MCP 的 `toolAxes` 有 server-hint 腿可折,
+ * A2A 收下的就是最终值),而分歧本身是裁定过的。
+ */
+import type { McpServerSpec, ToolEffect } from "@sema-agent/core";
+/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明两面逐字同声明。 */
+export type ToolAxisEntry = NonNullable<McpServerSpec["toolAxes"]>[string];
+/** 轴覆写上那个**两词**的不可逆档(⚠️ 与 `AskOrigin` 面的**三词** `never|maybe|always` 不是同一个词表:
+ *  覆写面只收两极,`maybe` 是引擎按工具自己的声明定的,调用方说不出口)。 */
+export type ToolAxisIrreversibility = NonNullable<ToolAxisEntry["irreversibility"]>;
+/** 值是不是一个合法的 `effect` 词(两条请求腿共用)。 */
+export declare function isToolEffect(v: unknown): v is ToolEffect;
+/** 值是不是一个合法的**覆写面** `irreversibility` 词(两条请求腿共用)。 */
+export declare function isToolAxisIrreversibility(v: unknown): v is ToolAxisIrreversibility;
+//# sourceMappingURL=tool-axis-words.d.ts.map

package/dist/tool-axis-words.js

@@ -0,0 +1,9 @@
+const TOOL_EFFECT_WORDS = ["read", "write", "idempotent"];
+const TOOL_AXIS_IRREVERSIBILITY_WORDS = ["always", "never"];
+export function isToolEffect(v) {
+    return typeof v === "string" && TOOL_EFFECT_WORDS.includes(v);
+}
+export function isToolAxisIrreversibility(v) {
+    return typeof v === "string" && TOOL_AXIS_IRREVERSIBILITY_WORDS.includes(v);
+}
+//# sourceMappingURL=tool-axis-words.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.78.1",
+  "version": "7.79.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.19.0",
+    "@sema-agent/core": "7.20.0",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",