@sema-agent/server 7.79.3 → 7.80.1

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
@@ -98,14 +98,20 @@ export interface TaskRequestBody {
     jobId?: string;
     /** Personalization seam: the caller's OWN skills for this task, threaded into core's
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
-     *  baseline can never be shadowed by user content — see mergeUserSkills). Caps: ≤10 skills, content ≤32KB
-     *  each. User skills are user-authored content in the user's OWN principal-isolated task (self-harm
-     *  surface, not privilege widening); scenario/center skills remain the only trusted layer. */
-    skills?: Array<{
-        name: string;
-        description: string;
-        content: string;
-    }>;
+     *  baseline can never be shadowed by user content — see mergeUserSkills). User skills are user-authored
+     *  content in the user's OWN principal-isolated task (self-harm surface, not privilege widening);
+     *  scenario/center skills remain the only trusted layer.
+     *
+     *  🔴 **类型 = core 的 `SkillSpec` 本体,不是它的手抄子集**(S-377):这里曾写死
+     *  `{ name; description; content }` —— core 闭集六位里的三位,而 `manifest` / `files` / `baseDir`
+     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`mergeUserSkills` 原样透传到
+     *  `TaskSpec.skills`)。一份会漂的手抄 = 声明面比真受理面**窄**,SDK 消费方按声明写代码就以为发不了,
+     *  而 core 加键(7.20.0 [ref] 的 `baseDir`)时这里连红都不会红。改成 core 本体后,闭集由 tsc 看守。
+     *  ⚠️ 受理**判据**(形/尺寸)仍在 `validateUserSkills` + `spec-fields.ts` 的 `SKILL_FIELD_SHAPES`——
+     *  类型说「哪些键存在」,门说「值合不合法」,两者不是一件事。
+     *  (旧注里的「Caps: ≤10 skills, content ≤32KB each」两条帽早已随 [ref] / core 1.293 退役,一并纠正:
+     *   今天只剩 `content ≤ 1 MiB` 这一条 core 加载门孪生。) */
+    skills?: SkillSpec[];
     /** §7 P0.5 (用户按需选像): the sandbox image PROFILE this task wants (e.g.
      *  "code-full" / "code-python"). An INTENT, never a digest — the service resolves it to a published digest with
      *  the caller's principal (fail-closed visibility re-admit) and applies it per-pod. Only supported on the k8s

package/dist/parked-decide.d.ts

@@ -260,6 +260,15 @@ export type WorkflowParkedDecidePlan = {
  * 三句里持久数据那一句要的就是这个形:响亮拒,不做静默双读(读 `agents[]` 补一份身份正是被退役的双算)。
  *
  * 体上只带 `runId`(那是操作员唯一用得上的坐标;真源都读不出来,任何计数都是编的)。
+ *
+ * 🔴 **S-376(词域门,7.80.1):拒文逐字改,status / errorCode / 体键零变。** 旧句把本注里的内部机件整段
+ * 搬上了 wire(「the parks the run owns」「when it parks」「join your checkpoint to a park」「its own parked
+ * legs」)—— 那些名字调用方一个都拿不到。新句把承重的四件事一件不少地留着(不投递 / 卡仍 pending 什么都没
+ * 伪造 / 恢复动作 `Workflow({resumeFromRunId})` / 只有引擎也拒才是真恢复不了)。
+ * ⚠️ **新句刻意不提 `checkpointToken`**(codex 对抗复审 r1 指出、亲核属实):契约 D-1 逐字写着它是
+ * server-INTERNAL、不上 `/v1/approvals` 记录、合规 SDK 绝不发送 —— 让调用方去找一个它既没发也拿不到的
+ * 字段是错指路。新句说的是「无法确认这项待决审批属于这条 run」。判据与冻结钉见
+ * `test/api-error-text-lexicon.test.ts`。
  */
 export declare function denyWorkflowParksUnreadable(origin: Extract<ParkOrigin, {
     kind: "workflow_parks_unreadable";

package/dist/parked-decide.js

@@ -89,7 +89,7 @@ export function denyWorkflowParksUnreadable(origin) {
     return {
         status: 409,
         body: {
-            error: "this parked workflow agent's run record carries no readable list of the parks the run owns — the engine writes that list when it parks, and it is the only proof that this checkpoint token belongs to that run. This route cannot join your checkpoint to a park without it, so the decision is NOT delivered rather than answered with a receipt nothing can redeem. The approval card stays pending and nothing is forged. Resume the run itself instead: the engine derives the parks such a record owns from its journal and its own parked legs, proves each against the checkpoint store, and writes the list onto the record once that admission completes — after which this route works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+            error: "this decision cannot be matched to the pending step it belongs to: this run's record was written by an older engine, or one of its entries is damaged, so it no longer says which pending steps the run owns — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and the engine rebuilds that list from its own records as it admits the resume, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
             errorCode: "decide.workflow_parks_unreadable",
             runId: origin.runId,
         },
@@ -102,7 +102,7 @@ export function planWorkflowParkedDecide(origin, req) {
             deny: {
                 status: 400,
                 body: {
-                    error: "remember:\"session\" is not supported for a parked WORKFLOW agent: this lane's 200 means the decision was handed to the host's next turn, not that the engine committed it — an exemption granted here could outlive a decision the engine later rejects. Re-issue the decide without `remember`.",
+                    error: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
                     errorCode: "decide.workflow_remember_unsupported",
                     runId: origin.runId,
                 },
@@ -116,7 +116,7 @@ export function planWorkflowParkedDecide(origin, req) {
             deny: {
                 status: 409,
                 body: {
-                    error: "this parked workflow agent's run carries no originating session — the deployment has nowhere to deliver the decision (a directly-started workflow, not a Workflow tool call)",
+                    error: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
                     errorCode: "decide.workflow_host_unknown",
                     runId: origin.runId,
                 },

package/dist/run-local.js

@@ -23,6 +23,7 @@ import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
+import { toolsRunOnThisHost } from "./task-cwd.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
@@ -424,7 +425,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    const skills = loadSkills(config.skillsDir);
+    const skills = loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) });
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;

package/dist/spec-fields.js

@@ -1,5 +1,6 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
+import { isValidCwd } from "./task-cwd.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -65,45 +66,47 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const skillOk = (s) => {
-    if (!plainObject(s))
+const skillManifestOk = (m) => {
+    if (!plainObject(m))
         return false;
-    for (const k of Object.keys(s)) {
-        if (k !== "name" && k !== "description" && k !== "content" && k !== "manifest" && k !== "files")
+    for (const k of Object.keys(m)) {
+        if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
             return false;
     }
-    if (typeof s.name !== "string" || s.name.length === 0)
+    if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
         return false;
-    if (typeof s.description !== "string")
+    if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
         return false;
-    if (typeof s.content !== "string" || s.content.length === 0 || s.content.length > MAX_AGENT_SKILL_CONTENT_CHARS)
+    if (m.egress !== undefined && typeof m.egress !== "boolean")
         return false;
-    if (s.manifest !== undefined) {
-        const m = s.manifest;
-        if (!plainObject(m))
-            return false;
-        for (const k of Object.keys(m)) {
-            if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
-                return false;
-        }
-        if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
-            return false;
-        if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
-            return false;
-        if (m.egress !== undefined && typeof m.egress !== "boolean")
-            return false;
-        if (typeof m.lineageId !== "string" || m.lineageId.length === 0)
+    return typeof m.lineageId === "string" && m.lineageId.length > 0;
+};
+const skillFilesOk = (v) => Array.isArray(v) &&
+    v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
+const SKILL_FIELD_SHAPES = {
+    name: { required: true, ok: (v) => typeof v === "string" && v.length > 0 },
+    description: { required: true, ok: (v) => typeof v === "string" },
+    content: { required: true, ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AGENT_SKILL_CONTENT_CHARS },
+    manifest: { required: false, ok: skillManifestOk },
+    files: { required: false, ok: skillFilesOk },
+    baseDir: { required: false, ok: isValidCwd },
+};
+const skillOk = (s) => {
+    if (!plainObject(s))
+        return false;
+    for (const k of Object.keys(s)) {
+        if (!Object.hasOwn(SKILL_FIELD_SHAPES, k))
             return false;
     }
-    if (s.files !== undefined) {
-        if (!Array.isArray(s.files))
-            return false;
-        for (const f of s.files) {
-            if (!plainObject(f))
-                return false;
-            if (typeof f.path !== "string" || f.path.length === 0 || typeof f.content !== "string")
+    for (const [k, shape] of Object.entries(SKILL_FIELD_SHAPES)) {
+        const v = s[k];
+        if (v === undefined) {
+            if (shape.required)
                 return false;
+            continue;
         }
+        if (!shape.ok(v))
+            return false;
     }
     return true;
 };
@@ -134,7 +137,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     skills: {
-        desc: "an array of { name, description, content } skill objects (optional manifest/files; files entries need { path, content }) — no count cap; the engine renders the listing within its own byte budget",
+        desc: "an array of { name, description, content } skill objects (optional manifest/files/baseDir; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
         ok: (v) => Array.isArray(v) && v.every(skillOk),
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },

package/dist/task-cwd.d.ts

@@ -52,6 +52,27 @@ export declare function cwdHonored(config: {
     };
     requirePrincipal?: boolean;
 }): boolean;
+/**
+ * S-377 —— 「**工具跑的那台机器**就是本进程这台吗」。回答的是一个**文件系统同一性**问题,不是权限问题:
+ * server 盘上的一条绝对路径(出厂 `SKILLS_DIR` 下某个技能自己的目录)对模型的工具**有没有意义**。
+ *
+ * · `host`(run-on-this-machine,无容器)⇒ 真;
+ * · `undefined`(in-process 单用户 lane)⇒ 真 —— 该 lane 根本没挂手(core 落 `StubExecutionEnv`),
+ *   路径对谁都不可达,但它在**文件系统同一性**这条轴上确实是同一台机器,判真让规则只剩一条;
+ * · 其余每一条(`k8s` / `e2b` / `ssh` / `adb` / `device` / `local-docker`)⇒ 假:工具的盘在别处,
+ *   server 自己的路径在那边**不存在**,声明它等于给模型一条指向不存在文件的线索,还顺带把本机目录
+ *   布局说了出去。
+ *
+ * 🔴 **为什么不复用 {@link cwdHonored}**:那一只是**权限**判据(单用户 ∧ host),它的 `requirePrincipal`
+ * 那一半防的是「一个租户的输入把 agent 指向另一个租户的文件」。本谓词判的路径不是调用方给的,是**运维
+ * 自己烤进镜像**的出厂内容 —— 每个租户拿到的是同一份,没有跨租户面。把租户判据搭进来会让多租户 host
+ * 部署平白失去这条线索,那是**用错轴**(与 `deviceCwdHonored` 拒绝并进 `cwdHonored` 同一条理由)。
+ */
+export declare function toolsRunOnThisHost(config: {
+    remoteExec?: {
+        provider?: string;
+    };
+}): boolean;
 /**
  * device lane 的**平行**判别式(device-executor-lane-v2 §4.3.3,车A-4)——「员工在自己设备的项目目录
  * 里干活」是这条车道的存在理由,所以 caller cwd 必须被尊重。

package/dist/task-cwd.js

@@ -20,6 +20,9 @@ export function dirCoversPath(dir, target) {
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }
+export function toolsRunOnThisHost(config) {
+    return config.remoteExec === undefined || config.remoteExec.provider === undefined || config.remoteExec.provider === "host";
+}
 export function deviceCwdHonored(config) {
     return config.remoteExec?.provider === "device";
 }

package/dist/trace/core-keyset-guard.d.ts

@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection";
 type WiringSectionExcluded = "governance" | "configFingerprint";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -100,6 +100,9 @@ type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, key
 type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
 type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
 type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
+type WiringWriteProtectionHandled = "targetView";
+type _GuardWiringWriteProtection = AssertAllKeysHandled<Exclude<keyof WiringSection<"writeProtection">, WiringWriteProtectionHandled>>;
+type _GuardWiringWriteProtectionReverse = AssertAllKeysHandled<Exclude<WiringWriteProtectionHandled, keyof WiringSection<"writeProtection">>>;
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
@@ -180,6 +183,8 @@ export type CoreKeysetGuards = [
     _GuardMailboxAppend,
     _GuardMailboxAppendReverse,
     _GuardWiringSections,
+    _GuardWiringWriteProtection,
+    _GuardWiringWriteProtectionReverse,
     _GuardWiringSectionsReverse,
     _GuardWiringLeg,
     _GuardWiringLegReverse,

package/dist/trace/project.d.ts

@@ -584,6 +584,26 @@ export declare function workspaceChangedEventData(ev: {
  *       (「connection state is a fact about this leg's attempt, not about the assembly」)。
  *    ⚠️ 空数组 ≠ 缺席:core 顶注逐字「an empty array is "this leg declared no servers", absence is an older
  *       mint or an external derivation」⇒ 空数组照铸,别折成缺席。
+ *  · `writeProtection`(`{ targetView: "spelling-only" | "target" }`;core 7.20.1 [ref] / clay [ref] 丙,
+ *    S-361 提货件)—— **裁:租户可见,逐字透传**。它是 per-leg 的读面:「这条腿的写保护判官,拿到的是
+ *    哪一种目标读法」——`"target"` = 判官握着执行环境,拼法没命中时会在**解析后的真目标**上再判一次;
+ *    `"spelling-only"` = 没有环境,拼法就是全部判决,只经别名/软链够到受保护行的写被清掉。
+ *    ① **同主体同受众**:同一条腿、调用方自己的 run。而且这件事对该调用方**本就行为可观测** —— 在无手
+ *       车道上用一只声明了 `pathTarget` 写面的 MCP 工具对别名写一次就看得见(S-361 亲核可达)。剥掉它
+ *       并不收走任何能力,只收走那句诚实的标签,等于把 [ref] 刚刚消灭的**静默**在租户半场原样重建。
+ *    ② **值的形**:core 的**两词闭集**,判据走 core 导出的 `WRITE_PROTECTION_TARGET_VIEWS` 常量(不抄
+ *       词表 —— 与 `delivered` 的 `MCP_DELIVERY_VERDICTS` 同一条);引擎派生、非用户内容 ⇒ 不脱敏、逐字。
+ *    ③ 🔴 **最小披露仍然成立**:本键只答「判官有哪一种读法」,**从不**答「判官握着哪些路径」——
+ *       名表逐行内容(`rows` / `source` / `droppedDefaultRows`)照旧只在 operator 面
+ *       (`GET /v1/diagnostics/wiring` 的 `writeProtection` 键,S-138),租户面照旧只有
+ *       `/v1/capabilities.writeProtection.{armed, rows, replaced}` 三项计数。两者语义不同、同名不同物:
+ *       诊断面那一格是**本 server 装配的名表**(boot 产物),本段是**core 判官的自报读法**(per-leg)。
+ *    ④ **不是 governance 侧信道**:它是「这条腿接没接手」的函数,与 lockedConfig/compliance/
+ *       memoryAdmission/retention 四位无函数关系。⚠️ 但它**进** core 的 `configFingerprint`(core 顶注
+ *       逐字:which view the judge got is an ASSEMBLY fact)—— 指纹本就只发 operator 面,不受影响。
+ *    ⚠️ **缺席 = 第三态**:core 的段是 **present-iff 编译出了判官**,`writeProtectedPaths: []` 的部署
+ *       整段缺席。缺席**绝不**折成 `"spelling-only"`(那是「判官在、但只认拼法」,完全不同的一件事),
+ *       也不铸 `writeProtection: {}`。词出闭集同样**不**折进缺席,走 `dropProjectedFace` 留痕(见那里)。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
  * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { redactErrorMessage, redactModelText } from "../observability/run-terminal-log.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -481,6 +481,19 @@ export function wiringManifestEventData(ev) {
         const lane = str(lspIn.lane);
         return { mounted, ...(lane === undefined ? {} : { lane }) };
     })();
+    const wpIn = sec(m.writeProtection);
+    const writeProtection = (() => {
+        if (m.writeProtection === undefined)
+            return undefined;
+        if (wpIn === undefined)
+            return dropProjectedFace("wiring_manifest.writeProtection is not an object");
+        const targetView = str(wpIn.targetView);
+        if (targetView === undefined)
+            return dropProjectedFace("wiring_manifest.writeProtection.targetView is not a non-empty string");
+        if (!WRITE_PROTECTION_TARGET_VIEWS.includes(targetView))
+            return dropProjectedFace("wiring_manifest.writeProtection.targetView is outside core WRITE_PROTECTION_TARGET_VIEWS");
+        return { targetView };
+    })();
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -523,6 +536,7 @@ export function wiringManifestEventData(ev) {
         ...(mcp !== undefined ? { mcp } : {}),
         ...(hooks !== undefined ? { hooks } : {}),
         ...(lsp !== undefined ? { lsp } : {}),
+        ...(writeProtection !== undefined ? { writeProtection } : {}),
         ...identityFields(ev),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.79.3",
+  "version": "7.80.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.20.0",
+    "@sema-agent/core": "7.20.1",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",