@sema-agent/server 7.80.0 → 7.80.2

package/dist/boot/runner-deps.d.ts

@@ -9,7 +9,7 @@
  * (`runnerTierFrozen` 判据就取自构造那一刻的 `config.tiers`)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
-import { type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
+import { type CacheBreakFinding, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
 import type { buildPricing, createTracer } from "../budget.js";
 import type { ServiceConfig } from "../config.js";
@@ -60,6 +60,22 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
  *  的 dist 扫描格钉住(core 加词/收进 d.ts 那天先红)。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
+/** S-386:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
+ *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
+ *  `dist/index.d.ts:128`;实现在 `dist/core/cache-break-detector.d.ts`),于是 core 加词/删词 ⇒
+ *  `Record<PromptCacheBreakCause, …>` 少键/多键 = **编译错**(CLAUDE.md [ref]「词表是闭集 + 穷举」)。
+ *  ⚠️ 首版在这里**手抄**了五个字面量,并在本注与 CHANGELOG 里声称「core 加词 = 编译错」—— 复审实测
+ *  证伪(给 core d.ts 加词后 tsc 照绿,只有一格正则扫描会红):抄来的联合与 core 无编译期联系。
+ *  运行期收到词表外的值(`ctx.classification` 在 core 的 onError 契约上只是 `string`)走最响的那一档
+ *  (error)并标 `classificationKnown:false`,退化方向永远是**多一条告警**。
+ *
+ *  🔴 定级判据是**事实**,不是 provider 名单:`dist/core/cache-break-detector.js` 的 `observe()` 里
+ *  `const before = prev.cacheRead; if (before <= 0) return undefined` —— 探测器只有在**上一轮真的从
+ *  前缀缓存读到过 token** 时才会给出 finding。所以「带 classification」这件事本身就证明了「这条路由
+ *  在服务前缀缓存」,前缀 bug 四词(model-switch / tool-schema / tool-set / system-prefix)落 error
+ *  是有据的;`server-or-ttl` 在 agentic 任务里是常态(慢工具 ⇒ 5min+ 间隔,provider 缓存到期)⇒ warn。 */
+export type PromptCacheBreakCause = CacheBreakFinding["cause"];
+export declare const PROMPT_CACHE_BREAK_CAUSE_LEVEL: Readonly<Record<PromptCacheBreakCause, "error" | "warn">>;
 export interface RunnerDepsCtx {
     config: ServiceConfig;
     logger: Logger;

package/dist/boot/runner-deps.js

@@ -24,6 +24,14 @@ export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
     "shared-memory-not-mounted",
     "shell-gate-off",
 ]);
+export const PROMPT_CACHE_BREAK_CAUSE_LEVEL = {
+    "model-switch": "error",
+    "tool-schema": "error",
+    "tool-set": "error",
+    "system-prefix": "error",
+    "server-or-ttl": "warn",
+};
+const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUSE_LEVEL));
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
@@ -224,9 +232,20 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "prompt-cache") {
-                metrics.inc("prompt_cache_low_hit_total");
-                const fields = { sessionId: ctx.sessionId, ...(ctx.classification ? { classification: ctx.classification } : {}), err: String(err) };
-                if (ctx.classification === "server-or-ttl")
+                const classification = ctx.classification;
+                const causeLevel = classification === undefined ? undefined : PROMPT_CACHE_BREAK_LEVELS.get(classification);
+                const level = classification === undefined ? "warn" : (causeLevel ?? "error");
+                const fields = {
+                    sessionId: ctx.sessionId,
+                    confirmed: classification !== undefined,
+                    ...(classification !== undefined ? { classification, classificationKnown: causeLevel !== undefined } : {}),
+                    err: String(err),
+                };
+                metrics.inc("prompt_cache_low_hit_total", {
+                    ...(classification !== undefined ? { classification: causeLevel !== undefined ? classification : "unknown" } : {}),
+                    level,
+                });
+                if (level === "warn")
                     logger.warn("prompt_cache_break", fields);
                 else
                     logger.error("prompt_cache_break", fields);

package/dist/boot/stage-07-capability-layer.js

@@ -8,6 +8,7 @@ import { webSearchConfigFromEnv, createWebSearchBackend, shouldProbeWebSearchOnB
 import { createAuthorizer } from "../security.js";
 import { assertGateIntentServiceable, buildForceDurableGateInertNotice, hasOperatorGateIntent } from "../approval.js";
 import { loadSkills } from "../capabilities/skills.js";
+import { toolsRunOnThisHost } from "../task-cwd.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
 import { buildScenarios, builtinScenarioDetails } from "../capabilities/scenarios.js";
 import { RateLimiter } from "../observability/rate-limit.js";
@@ -108,7 +109,7 @@ export async function runStage07(ctx) {
         ? backend.rateLimiter(config.rateLimitPerMin, counterDegradeHook).startRefresh()
         : new RateLimiter(config.rateLimitPerMin);
     bindRateLimiter(rateLimiter);
-    let skills = loadSkills(config.skillsDir);
+    let skills = loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) });
     skills = await configCenter.applyCenterCapabilities(skills);
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();

package/dist/capabilities/skills.d.ts

@@ -41,6 +41,16 @@ export interface LoadedSkill {
 export interface LoadSkillsOptions {
     /** 不可信 lane 的约束根(通常=clone root)。缺席=受控 lane,不做逐条目约束。 */
     confineTo?: string;
+    /**
+     * S-377 —— 「**工具跑的那台机器**的盘就是本进程这台盘吗」。真 ⇒ 目录形态技能带上自己的目录
+     * (`SkillSpec.baseDir`);假/缺席 ⇒ **不带**。判据的单一属主 = `task-cwd.ts` 的
+     * {@link import("../task-cwd.js").toolsRunOnThisHost}(调用方按它算,别在这里第二次判 lane)。
+     *
+     * 🔴 **缺席 = 不带**,是**故意的 fail-closed 方向**:带了一条工具那边不存在的路径,伤是「模型按它去
+     * 读、扑空,顺带看到本机目录布局」;不带的伤只是少一条线索(附件本来就随 invoke 全文内联投递,
+     * core 的律也明写缺席 ⇒ 结果逐字节与 baseDir 到货之前相同)。两个方向不对称 ⇒ 默认取轻的那边。
+     */
+    toolsShareThisFilesystem?: boolean;
 }
 /** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
  *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。

package/dist/capabilities/skills.js

@@ -1,5 +1,5 @@
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { join, sep } from "node:path";
+import { join, resolve, sep } from "node:path";
 export function assertConfined(p, rootReal, label = "skill entry") {
     let real;
     try {
@@ -59,6 +59,8 @@ export function loadSkills(dir, opts) {
             const files = collectAttachments(skillDir, "", confineRoot);
             if (files.length > 0)
                 skill.spec.files = files;
+            if (opts?.toolsShareThisFilesystem === true)
+                skill.spec.baseDir = resolve(skillDir);
             push(skill, join(skillDir, "SKILL.md"));
         }
     }

package/dist/http/admission.js

@@ -7,7 +7,7 @@ import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
-import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
+import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { sendError, httpErrorCode } from "./send.js";
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
@@ -27,6 +27,8 @@ export function validateUserSkills(skills) {
             return "skill.description must be a string";
         if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS)
             return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
+        if (s["baseDir"] !== undefined && !isValidCwd(s["baseDir"]))
+            return `skill.baseDir must be an absolute path string of at most ${MAX_CWD_CHARS} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`;
     }
     return null;
 }

package/dist/http/resume-legs.js

@@ -1031,16 +1031,17 @@ export function createResumeLegs(ctx) {
     async function startFreshHostTurn(sessionId, objective, principal, req, trustedInternals, runId) {
         const cs = deps.checkpointStore;
         if (!deps.runStore) {
-            return { status: 501, body: { error: "delivering a workflow decision on the host's next turn requires a durable run store (DB_BACKEND=mysql|pg|local)", errorCode: "capability.run_store_required" } };
+            return { status: 501, body: { error: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)", errorCode: "capability.run_store_required" } };
         }
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx) {
             return {
                 status: 409,
                 body: {
-                    error: "the workflow's originating session no longer has the rebuild inputs for a new turn: a session's resume context is garbage-collected once it is stale AND that session itself has no pending checkpoint and no active run (REAP_RUN_STALE_SEC, default 120s) — a workflow CHILD's park does not hold the HOST session's row open. Raise REAP_RUN_STALE_SEC to cover how long approvals may sit before someone decides them, or resume the workflow run yourself with the runId below",
+                    error: "this approval waited too long to be delivered: the session this run was started from no longer keeps what a new turn would need, because that state is dropped once the session has been idle past this deployment's retention window (REAP_RUN_STALE_SEC — its current value is staleAfterSec below). Nothing was decided and the approval is still pending: resume the run yourself with the runId below, or ask whoever operates this deployment to raise REAP_RUN_STALE_SEC so approvals can sit longer before someone decides them",
                     errorCode: "conflict.resume_context_unavailable",
                     runId,
+                    staleAfterSec: deps.config.runStaleSec,
                 },
             };
         }
@@ -1108,7 +1109,7 @@ export function createResumeLegs(ctx) {
         }
         const gateKind = cp.gate?.kind;
         if (gateKind !== "task_done") {
-            return { status: 409, body: { error: `cannot wake: this checkpoint awaits a pending gate decision (gate "${gateKind ?? "unknown"}") — resolve it through its own decide entry`, errorCode: "wake.gate_pending" } };
+            return { status: 409, body: { error: `cannot wake: this session is waiting on a pending gate decision (gate "${gateKind ?? "unknown"}") — resolve it through its own decide entry`, errorCode: "wake.gate_pending" } };
         }
         const trusted = operator;
         if (message !== undefined) {

package/dist/http/routes/admin-drain.js

@@ -24,7 +24,7 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 return;
             }
             if (!deps.drainState) {
-                sendError(res, 501, "capability.drain_state_required", "this deployment has no drain state wired (embedded host?) — the declared reason would have nowhere to surface");
+                sendError(res, 501, "capability.drain_state_required", "this deployment has no drain state wired (embedded in another process?) — the declared reason would have nowhere to surface");
                 return;
             }
             deps.drainState.reason = reason.trim();

package/dist/http/routes/admin-memory-optout.js

@@ -23,7 +23,7 @@ export async function handleMemoryOptOut(req, res, match, ctx) {
     const operator = principal;
     const store = deps.memoryOptOutGrant;
     if (store === undefined) {
-        sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no forgetting twin — wire a SQL backend to administer opt-out grants");
+        sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no companion store for forgetting — wire a SQL backend to administer opt-out grants");
         return;
     }
     if (target !== undefined && (target === null || memoryOptOutPrincipalShapeProblem(target) !== undefined)) {

package/dist/http/routes/approvals-assistant.js

@@ -501,7 +501,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 if (!deps.approvalExemptionStore) {
-                    sendError(res, 501, "capability.store_required", "approval exemptions need a store backend (DB_BACKEND / LOCAL lane)");
+                    sendError(res, 501, "capability.store_required", "approval exemptions need a store backend (DB_BACKEND=mysql|pg|local)");
                     return;
                 }
                 if (!body.checkpointToken && !body.boundCallId) {

package/dist/http/routes/notify-wake.js

@@ -92,7 +92,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 }
             }
             if (!deps.workflowCompletionInbox) {
-                sendError(res, 501, "capability.workflow_store_required", "external notify park requires the workflow completion inbox (WORKFLOW_RUN_STORE)");
+                sendError(res, 501, "capability.workflow_store_required", "external notify requires the workflow completion inbox (WORKFLOW_RUN_STORE)");
                 return;
             }
             await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));

package/dist/http/routes/run-memory-capture.js

@@ -72,7 +72,7 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 }
             }
             if (isParkedRunStatus(run.status)) {
-                sendError(res, 409, "steering.not_running", "run is parked on a pending decision — the memory-capture opt-out verb needs a live turn, and a resumed continuation rebuilds its spec from the persisted body (it cannot take a new declaration); the opt-out becomes effective on this session's next NEW submit (POST /v1/tasks with this sessionId and memoryCapture: 'off') — content captured until then stays captured");
+                sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the memory-capture opt-out verb needs a live turn, and a resumed continuation rebuilds its spec from the persisted body (it cannot take a new declaration); the opt-out becomes effective on this session's next NEW submit (POST /v1/tasks with this sessionId and memoryCapture: 'off') — content captured until then stays captured");
                 return;
             }
             if (isTerminalRunStatus(run.status)) {
@@ -84,7 +84,7 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 409, "steering.not_running", "run is live on another replica — the memory-capture opt-out verb must reach the replica holding the stream; resend it there, or declare memoryCapture: 'off' on the next submit");
                 return;
             }
-            sendError(res, 409, "steering.not_running", "no live steerable face for this run on this replica — verify/cascade execution lanes expose none; declare memoryCapture: 'off' on the next submit of this session instead");
+            sendError(res, 409, "steering.not_running", "no live steerable face for this run on this replica — a verify or cascade submission exposes none; declare memoryCapture: 'off' on the next submit of this session instead");
             return;
         }
         default:

package/dist/http/routes/runs.js

@@ -350,7 +350,7 @@ export async function handleRuns(req, res, match, ctx) {
                     continue;
                 }
                 if (now?.status === "running") {
-                    sendError(res, 409, "conflict.run_not_running", "the cancel flag could not be set: this run was not in 'running' state at the moment of each attempt (it keeps flipping between running and a park) — retry cancel", { taskId, status: now.status });
+                    sendError(res, 409, "conflict.run_not_running", "the cancel flag could not be set: this run was not in 'running' state at the moment of each attempt (it keeps flipping between running and a pending-decision state; the `status` below is the word the row actually had) — retry cancel", { taskId, status: now.status });
                     return;
                 }
                 sendJson(res, 202, { taskId, status: now?.status ?? "failed", cancelRequested: now?.cancelRequested ?? false, note: "run already terminal — cancel is a no-op" });
@@ -528,7 +528,7 @@ export async function handleRuns(req, res, match, ctx) {
                 sendDuplicateKey();
                 return;
             }
-            sendNotRunning("run is no longer parked on a pending decision (resolved or expired)");
+            sendNotRunning("run is no longer waiting on a pending decision (resolved or expired)");
             return;
         }
         if (run.status === "running") {
@@ -537,7 +537,7 @@ export async function handleRuns(req, res, match, ctx) {
                 sendNotRunning("run is live on another replica — a live steer must reach the replica holding the stream; resend it there, or use POST /v1/runs/:id/cancel for a run-level stop");
             }
             else {
-                sendNotRunning("no live steerable face for this run on this replica — verify/cascade execution lanes expose none (those legs return a result, not a live stream); use POST /v1/runs/:id/cancel for a run-level stop");
+                sendNotRunning("no live steerable face for this run on this replica — a verify or cascade submission exposes none (those return a result, not a live stream); use POST /v1/runs/:id/cancel for a run-level stop");
             }
             return;
         }
@@ -637,7 +637,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (mintResult.noResumeCtx) {
-                sendError(res, 409, "conflict.resume_context_unavailable", "run already ended and this session's resume context is gone — a steer parked now could never be delivered by POST /v1/sessions/:id/wake; submit a new task instead");
+                sendError(res, 409, "conflict.resume_context_unavailable", "run already ended and this session's resume context is gone — a steer queued now could never be delivered by POST /v1/sessions/:id/wake; submit a new task instead");
                 return;
             }
             if (mintResult.parked) {
@@ -723,7 +723,7 @@ export async function handleRuns(req, res, match, ctx) {
         const sendInterruptNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const sendNoLiveTurn = (status, streamJustSettled) => {
             if (isParkedRunStatus(status)) {
-                sendError(res, 409, "interrupt.nothing_in_flight", "run is parked on a pending decision — there is no in-flight turn to interrupt; to deliver input use POST /v1/runs/:id/steer (it parks onto the checkpoint and injects on resume)");
+                sendError(res, 409, "interrupt.nothing_in_flight", "run is waiting on a pending decision — there is no in-flight turn to interrupt; to deliver input use POST /v1/runs/:id/steer (it waits with the pending decision and is delivered when the run resumes)");
                 return;
             }
             if (streamJustSettled) {
@@ -736,7 +736,7 @@ export async function handleRuns(req, res, match, ctx) {
                     sendError(res, 409, "interrupt.not_held", "run is live on another replica — interrupt must reach the replica holding the stream; resend it there, or use POST /v1/runs/:id/cancel for a run-level stop");
                 }
                 else {
-                    sendError(res, 409, "interrupt.not_held", "no live interruptible turn face for this run on this replica — verify/cascade execution lanes expose none (those legs return a result, not a live stream); use POST /v1/runs/:id/cancel for a run-level stop");
+                    sendError(res, 409, "interrupt.not_held", "no live interruptible turn face for this run on this replica — a verify or cascade submission exposes none (those return a result, not a live stream); use POST /v1/runs/:id/cancel for a run-level stop");
                 }
                 return;
             }
@@ -1004,7 +1004,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
     if (match.decl.id === "run-task-output" || match.decl.id === "run-task-stop") {
         const stopVerb = match.decl.id === "run-task-stop";
         if (!deps.runStore || !deps.taskHandleOutput || !deps.taskHandleStop) {
-            sendError(res, 501, "capability.run_store_required", "task-handle verbs require the run store + task-registry seams");
+            sendError(res, 501, "capability.run_store_required", "task-handle verbs require the run store and the task registry");
             return;
         }
         if (stopVerb && rateLimited(req, res))
@@ -1259,7 +1259,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
         });
         const askStore = gate.active ? gate.askStore : undefined;
         if (!askStore) {
-            sendError(res, 501, "feature.approval_ask_disabled", "the durable stream-approval ask ledger is not enabled on this worker (needs STREAM_APPROVAL_ENABLED plus a DURABLE store backend — the local lane keeps asks in memory and would lose accepted decisions on restart)");
+            sendError(res, 501, "feature.approval_ask_disabled", "the durable stream-approval ask ledger is not enabled on this worker (needs STREAM_APPROVAL_ENABLED plus a DURABLE store backend — the local backend keeps asks in memory and would lose accepted decisions on restart)");
             return;
         }
         const principal = gatedPrincipal(req, deps.config);

package/dist/http/routes/session-sync.js

@@ -457,7 +457,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 if (pending.resolution !== undefined && overwriteWipeIncapable(deps.sessionPolicyStore)) {
                     await pending.handle.abort().catch(() => undefined);
                     cleanupStaging(stagingId);
-                    sendError(res, 501, "capability.policy_purge_required", "overwrite-dst cannot proceed: this deployment's session-policy store has no deleteBySession purge seam, so the destination's stale policy rows cannot be wiped and the import would land a MIXED state (the source's conversation plus the destination's leftover policy rows, which keep gating). Upgrade the policy store (every in-tree store carries deleteBySession since core 1.423), or re-run without resolution overwrite-dst");
+                    sendError(res, 501, "capability.policy_purge_required", "overwrite-dst cannot proceed: this deployment's session-policy store has no deleteBySession purge verb, so the destination's stale policy rows cannot be wiped and the import would land a MIXED state (the source's conversation plus the destination's leftover policy rows, which keep gating). Upgrade the policy store (every in-tree store carries deleteBySession since core 1.423), or re-run without resolution overwrite-dst");
                     return;
                 }
                 try {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
@@ -98,14 +98,20 @@ export interface TaskRequestBody {
     jobId?: string;
     /** Personalization seam: the caller's OWN skills for this task, threaded into core's
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
-     *  baseline can never be shadowed by user content — see mergeUserSkills). Caps: ≤10 skills, content ≤32KB
-     *  each. User skills are user-authored content in the user's OWN principal-isolated task (self-harm
-     *  surface, not privilege widening); scenario/center skills remain the only trusted layer. */
-    skills?: Array<{
-        name: string;
-        description: string;
-        content: string;
-    }>;
+     *  baseline can never be shadowed by user content — see mergeUserSkills). User skills are user-authored
+     *  content in the user's OWN principal-isolated task (self-harm surface, not privilege widening);
+     *  scenario/center skills remain the only trusted layer.
+     *
+     *  🔴 **类型 = core 的 `SkillSpec` 本体,不是它的手抄子集**(S-377):这里曾写死
+     *  `{ name; description; content }` —— core 闭集六位里的三位,而 `manifest` / `files` / `baseDir`
+     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`mergeUserSkills` 原样透传到
+     *  `TaskSpec.skills`)。一份会漂的手抄 = 声明面比真受理面**窄**,SDK 消费方按声明写代码就以为发不了,
+     *  而 core 加键(7.20.0 [ref] 的 `baseDir`)时这里连红都不会红。改成 core 本体后,闭集由 tsc 看守。
+     *  ⚠️ 受理**判据**(形/尺寸)仍在 `validateUserSkills` + `spec-fields.ts` 的 `SKILL_FIELD_SHAPES`——
+     *  类型说「哪些键存在」,门说「值合不合法」,两者不是一件事。
+     *  (旧注里的「Caps: ≤10 skills, content ≤32KB each」两条帽早已随 [ref] / core 1.293 退役,一并纠正:
+     *   今天只剩 `content ≤ 1 MiB` 这一条 core 加载门孪生。) */
+    skills?: SkillSpec[];
     /** §7 P0.5 (用户按需选像): the sandbox image PROFILE this task wants (e.g.
      *  "code-full" / "code-python"). An INTENT, never a digest — the service resolves it to a published digest with
      *  the caller's principal (fail-closed visibility re-admit) and applies it per-pod. Only supported on the k8s

package/dist/observability/metrics.js

@@ -206,7 +206,7 @@ export function createMetrics() {
     m.histogram("task_cache_hit_rate", "Prefix-cache hit rate per task (core-computed stats.cacheHitRate, 0..1)", [
         0.05, 0.1, 0.25, 0.5, 0.75, 0.9, 0.95, 1,
     ]);
-    m.counter("prompt_cache_low_hit_total", "Tasks the Runner flagged with a low prefix-cache hit rate");
+    m.counter("prompt_cache_low_hit_total", "Prefix-cache advisories the Runner handed the host, by {classification,level} (S-386: the design/31 break causes carry a classification; the task-end low-hit heuristic and the two cache-family wiring advisories carry none)");
     m.counter("model_cost_micro_usd_total", "Authoritative model spend (integer micro-USD) over all brain calls, by model");
     m.histogram("brain_first_token_ms", "Time to first content token per brain call (gateway-hang signal)", [
         50, 100, 250, 500, 1000, 2000, 5000, 10000, 30000,

package/dist/parked-decide.d.ts

@@ -260,6 +260,15 @@ export type WorkflowParkedDecidePlan = {
  * 三句里持久数据那一句要的就是这个形:响亮拒,不做静默双读(读 `agents[]` 补一份身份正是被退役的双算)。
  *
  * 体上只带 `runId`(那是操作员唯一用得上的坐标;真源都读不出来,任何计数都是编的)。
+ *
+ * 🔴 **S-376(词域门,7.80.1):拒文逐字改,status / errorCode / 体键零变。** 旧句把本注里的内部机件整段
+ * 搬上了 wire(「the parks the run owns」「when it parks」「join your checkpoint to a park」「its own parked
+ * legs」)—— 那些名字调用方一个都拿不到。新句把承重的四件事一件不少地留着(不投递 / 卡仍 pending 什么都没
+ * 伪造 / 恢复动作 `Workflow({resumeFromRunId})` / 只有引擎也拒才是真恢复不了)。
+ * ⚠️ **新句刻意不提 `checkpointToken`**(codex 对抗复审 r1 指出、亲核属实):契约 D-1 逐字写着它是
+ * server-INTERNAL、不上 `/v1/approvals` 记录、合规 SDK 绝不发送 —— 让调用方去找一个它既没发也拿不到的
+ * 字段是错指路。新句说的是「无法确认这项待决审批属于这条 run」。判据与冻结钉见
+ * `test/api-error-text-lexicon.test.ts`。
  */
 export declare function denyWorkflowParksUnreadable(origin: Extract<ParkOrigin, {
     kind: "workflow_parks_unreadable";

package/dist/parked-decide.js

@@ -89,7 +89,7 @@ export function denyWorkflowParksUnreadable(origin) {
     return {
         status: 409,
         body: {
-            error: "this parked workflow agent's run record carries no readable list of the parks the run owns — the engine writes that list when it parks, and it is the only proof that this checkpoint token belongs to that run. This route cannot join your checkpoint to a park without it, so the decision is NOT delivered rather than answered with a receipt nothing can redeem. The approval card stays pending and nothing is forged. Resume the run itself instead: the engine derives the parks such a record owns from its journal and its own parked legs, proves each against the checkpoint store, and writes the list onto the record once that admission completes — after which this route works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+            error: "this decision cannot be matched to the pending step it belongs to: this run's record was written by an older engine, or one of its entries is damaged, so it no longer says which pending steps the run owns — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and the engine rebuilds that list from its own records as it admits the resume, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
             errorCode: "decide.workflow_parks_unreadable",
             runId: origin.runId,
         },
@@ -102,7 +102,7 @@ export function planWorkflowParkedDecide(origin, req) {
             deny: {
                 status: 400,
                 body: {
-                    error: "remember:\"session\" is not supported for a parked WORKFLOW agent: this lane's 200 means the decision was handed to the host's next turn, not that the engine committed it — an exemption granted here could outlive a decision the engine later rejects. Re-issue the decide without `remember`.",
+                    error: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
                     errorCode: "decide.workflow_remember_unsupported",
                     runId: origin.runId,
                 },
@@ -116,7 +116,7 @@ export function planWorkflowParkedDecide(origin, req) {
             deny: {
                 status: 409,
                 body: {
-                    error: "this parked workflow agent's run carries no originating session — the deployment has nowhere to deliver the decision (a directly-started workflow, not a Workflow tool call)",
+                    error: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
                     errorCode: "decide.workflow_host_unknown",
                     runId: origin.runId,
                 },

package/dist/run-local.js

@@ -23,6 +23,7 @@ import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
+import { toolsRunOnThisHost } from "./task-cwd.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
@@ -424,7 +425,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    const skills = loadSkills(config.skillsDir);
+    const skills = loadSkills(config.skillsDir, { toolsShareThisFilesystem: toolsRunOnThisHost(config) });
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;

package/dist/spec-fields.js

@@ -1,5 +1,6 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
+import { isValidCwd } from "./task-cwd.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -65,45 +66,47 @@ const toolList = (v) => Array.isArray(v) &&
     v.length <= MAX_AGENT_TOOLS &&
     v.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_AGENT_TOOL_NAME_CHARS);
 const plainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const skillOk = (s) => {
-    if (!plainObject(s))
+const skillManifestOk = (m) => {
+    if (!plainObject(m))
         return false;
-    for (const k of Object.keys(s)) {
-        if (k !== "name" && k !== "description" && k !== "content" && k !== "manifest" && k !== "files")
+    for (const k of Object.keys(m)) {
+        if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
             return false;
     }
-    if (typeof s.name !== "string" || s.name.length === 0)
+    if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
         return false;
-    if (typeof s.description !== "string")
+    if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
         return false;
-    if (typeof s.content !== "string" || s.content.length === 0 || s.content.length > MAX_AGENT_SKILL_CONTENT_CHARS)
+    if (m.egress !== undefined && typeof m.egress !== "boolean")
         return false;
-    if (s.manifest !== undefined) {
-        const m = s.manifest;
-        if (!plainObject(m))
-            return false;
-        for (const k of Object.keys(m)) {
-            if (k !== "allowTools" && k !== "allowPaths" && k !== "egress" && k !== "lineageId")
-                return false;
-        }
-        if (!(Array.isArray(m.allowTools) && m.allowTools.every((x) => typeof x === "string")))
-            return false;
-        if (m.allowPaths !== undefined && !(Array.isArray(m.allowPaths) && m.allowPaths.every((x) => typeof x === "string")))
-            return false;
-        if (m.egress !== undefined && typeof m.egress !== "boolean")
-            return false;
-        if (typeof m.lineageId !== "string" || m.lineageId.length === 0)
+    return typeof m.lineageId === "string" && m.lineageId.length > 0;
+};
+const skillFilesOk = (v) => Array.isArray(v) &&
+    v.every((f) => plainObject(f) && typeof f.path === "string" && f.path.length > 0 && typeof f.content === "string");
+const SKILL_FIELD_SHAPES = {
+    name: { required: true, ok: (v) => typeof v === "string" && v.length > 0 },
+    description: { required: true, ok: (v) => typeof v === "string" },
+    content: { required: true, ok: (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AGENT_SKILL_CONTENT_CHARS },
+    manifest: { required: false, ok: skillManifestOk },
+    files: { required: false, ok: skillFilesOk },
+    baseDir: { required: false, ok: isValidCwd },
+};
+const skillOk = (s) => {
+    if (!plainObject(s))
+        return false;
+    for (const k of Object.keys(s)) {
+        if (!Object.hasOwn(SKILL_FIELD_SHAPES, k))
             return false;
     }
-    if (s.files !== undefined) {
-        if (!Array.isArray(s.files))
-            return false;
-        for (const f of s.files) {
-            if (!plainObject(f))
-                return false;
-            if (typeof f.path !== "string" || f.path.length === 0 || typeof f.content !== "string")
+    for (const [k, shape] of Object.entries(SKILL_FIELD_SHAPES)) {
+        const v = s[k];
+        if (v === undefined) {
+            if (shape.required)
                 return false;
+            continue;
         }
+        if (!shape.ok(v))
+            return false;
     }
     return true;
 };
@@ -134,7 +137,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     allowTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     denyTools: { desc: `an array of at most ${MAX_AGENT_TOOLS} non-empty strings of at most ${MAX_AGENT_TOOL_NAME_CHARS} characters each`, ok: toolList },
     skills: {
-        desc: "an array of { name, description, content } skill objects (optional manifest/files; files entries need { path, content }) — no count cap; the engine renders the listing within its own byte budget",
+        desc: "an array of { name, description, content } skill objects (optional manifest/files/baseDir; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
         ok: (v) => Array.isArray(v) && v.every(skillOk),
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },

package/dist/task-cwd.d.ts

@@ -52,6 +52,27 @@ export declare function cwdHonored(config: {
     };
     requirePrincipal?: boolean;
 }): boolean;
+/**
+ * S-377 —— 「**工具跑的那台机器**就是本进程这台吗」。回答的是一个**文件系统同一性**问题,不是权限问题:
+ * server 盘上的一条绝对路径(出厂 `SKILLS_DIR` 下某个技能自己的目录)对模型的工具**有没有意义**。
+ *
+ * · `host`(run-on-this-machine,无容器)⇒ 真;
+ * · `undefined`(in-process 单用户 lane)⇒ 真 —— 该 lane 根本没挂手(core 落 `StubExecutionEnv`),
+ *   路径对谁都不可达,但它在**文件系统同一性**这条轴上确实是同一台机器,判真让规则只剩一条;
+ * · 其余每一条(`k8s` / `e2b` / `ssh` / `adb` / `device` / `local-docker`)⇒ 假:工具的盘在别处,
+ *   server 自己的路径在那边**不存在**,声明它等于给模型一条指向不存在文件的线索,还顺带把本机目录
+ *   布局说了出去。
+ *
+ * 🔴 **为什么不复用 {@link cwdHonored}**:那一只是**权限**判据(单用户 ∧ host),它的 `requirePrincipal`
+ * 那一半防的是「一个租户的输入把 agent 指向另一个租户的文件」。本谓词判的路径不是调用方给的,是**运维
+ * 自己烤进镜像**的出厂内容 —— 每个租户拿到的是同一份,没有跨租户面。把租户判据搭进来会让多租户 host
+ * 部署平白失去这条线索,那是**用错轴**(与 `deviceCwdHonored` 拒绝并进 `cwdHonored` 同一条理由)。
+ */
+export declare function toolsRunOnThisHost(config: {
+    remoteExec?: {
+        provider?: string;
+    };
+}): boolean;
 /**
  * device lane 的**平行**判别式(device-executor-lane-v2 §4.3.3,车A-4)——「员工在自己设备的项目目录
  * 里干活」是这条车道的存在理由,所以 caller cwd 必须被尊重。

package/dist/task-cwd.js

@@ -20,6 +20,9 @@ export function dirCoversPath(dir, target) {
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }
+export function toolsRunOnThisHost(config) {
+    return config.remoteExec === undefined || config.remoteExec.provider === undefined || config.remoteExec.provider === "host";
+}
 export function deviceCwdHonored(config) {
     return config.remoteExec?.provider === "device";
 }

package/dist/trace/core-keyset-guard.d.ts

@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection";
 type WiringSectionExcluded = "governance" | "configFingerprint";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -100,6 +100,9 @@ type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, key
 type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
 type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
 type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
+type WiringWriteProtectionHandled = "targetView";
+type _GuardWiringWriteProtection = AssertAllKeysHandled<Exclude<keyof WiringSection<"writeProtection">, WiringWriteProtectionHandled>>;
+type _GuardWiringWriteProtectionReverse = AssertAllKeysHandled<Exclude<WiringWriteProtectionHandled, keyof WiringSection<"writeProtection">>>;
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
@@ -180,6 +183,8 @@ export type CoreKeysetGuards = [
     _GuardMailboxAppend,
     _GuardMailboxAppendReverse,
     _GuardWiringSections,
+    _GuardWiringWriteProtection,
+    _GuardWiringWriteProtectionReverse,
     _GuardWiringSectionsReverse,
     _GuardWiringLeg,
     _GuardWiringLegReverse,

package/dist/trace/project.d.ts

@@ -584,6 +584,26 @@ export declare function workspaceChangedEventData(ev: {
  *       (「connection state is a fact about this leg's attempt, not about the assembly」)。
  *    ⚠️ 空数组 ≠ 缺席:core 顶注逐字「an empty array is "this leg declared no servers", absence is an older
  *       mint or an external derivation」⇒ 空数组照铸,别折成缺席。
+ *  · `writeProtection`(`{ targetView: "spelling-only" | "target" }`;core 7.20.1 [ref] / clay [ref] 丙,
+ *    S-361 提货件)—— **裁:租户可见,逐字透传**。它是 per-leg 的读面:「这条腿的写保护判官,拿到的是
+ *    哪一种目标读法」——`"target"` = 判官握着执行环境,拼法没命中时会在**解析后的真目标**上再判一次;
+ *    `"spelling-only"` = 没有环境,拼法就是全部判决,只经别名/软链够到受保护行的写被清掉。
+ *    ① **同主体同受众**:同一条腿、调用方自己的 run。而且这件事对该调用方**本就行为可观测** —— 在无手
+ *       车道上用一只声明了 `pathTarget` 写面的 MCP 工具对别名写一次就看得见(S-361 亲核可达)。剥掉它
+ *       并不收走任何能力,只收走那句诚实的标签,等于把 [ref] 刚刚消灭的**静默**在租户半场原样重建。
+ *    ② **值的形**:core 的**两词闭集**,判据走 core 导出的 `WRITE_PROTECTION_TARGET_VIEWS` 常量(不抄
+ *       词表 —— 与 `delivered` 的 `MCP_DELIVERY_VERDICTS` 同一条);引擎派生、非用户内容 ⇒ 不脱敏、逐字。
+ *    ③ 🔴 **最小披露仍然成立**:本键只答「判官有哪一种读法」,**从不**答「判官握着哪些路径」——
+ *       名表逐行内容(`rows` / `source` / `droppedDefaultRows`)照旧只在 operator 面
+ *       (`GET /v1/diagnostics/wiring` 的 `writeProtection` 键,S-138),租户面照旧只有
+ *       `/v1/capabilities.writeProtection.{armed, rows, replaced}` 三项计数。两者语义不同、同名不同物:
+ *       诊断面那一格是**本 server 装配的名表**(boot 产物),本段是**core 判官的自报读法**(per-leg)。
+ *    ④ **不是 governance 侧信道**:它是「这条腿接没接手」的函数,与 lockedConfig/compliance/
+ *       memoryAdmission/retention 四位无函数关系。⚠️ 但它**进** core 的 `configFingerprint`(core 顶注
+ *       逐字:which view the judge got is an ASSEMBLY fact)—— 指纹本就只发 operator 面,不受影响。
+ *    ⚠️ **缺席 = 第三态**:core 的段是 **present-iff 编译出了判官**,`writeProtectedPaths: []` 的部署
+ *       整段缺席。缺席**绝不**折成 `"spelling-only"`(那是「判官在、但只认拼法」,完全不同的一件事),
+ *       也不铸 `writeProtection: {}`。词出闭集同样**不**折进缺席,走 `dropProjectedFace` 留痕(见那里)。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
  * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { redactErrorMessage, redactModelText } from "../observability/run-terminal-log.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -481,6 +481,19 @@ export function wiringManifestEventData(ev) {
         const lane = str(lspIn.lane);
         return { mounted, ...(lane === undefined ? {} : { lane }) };
     })();
+    const wpIn = sec(m.writeProtection);
+    const writeProtection = (() => {
+        if (m.writeProtection === undefined)
+            return undefined;
+        if (wpIn === undefined)
+            return dropProjectedFace("wiring_manifest.writeProtection is not an object");
+        const targetView = str(wpIn.targetView);
+        if (targetView === undefined)
+            return dropProjectedFace("wiring_manifest.writeProtection.targetView is not a non-empty string");
+        if (!WRITE_PROTECTION_TARGET_VIEWS.includes(targetView))
+            return dropProjectedFace("wiring_manifest.writeProtection.targetView is outside core WRITE_PROTECTION_TARGET_VIEWS");
+        return { targetView };
+    })();
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -523,6 +536,7 @@ export function wiringManifestEventData(ev) {
         ...(mcp !== undefined ? { mcp } : {}),
         ...(hooks !== undefined ? { hooks } : {}),
         ...(lsp !== undefined ? { lsp } : {}),
+        ...(writeProtection !== undefined ? { writeProtection } : {}),
         ...identityFields(ev),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.80.0",
+  "version": "7.80.2",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.20.0",
+    "@sema-agent/core": "7.20.1",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",