@sema-agent/server 7.89.0 → 7.90.0

package/dist/boot/fatal-exit.d.ts

@@ -0,0 +1,3 @@
+/** `err` 的 fatal 日志文本:`String(err)` 过形状律一次。纯函数,零副作用。 */
+export declare function buildFatalErrorText(err: unknown): string;
+//# sourceMappingURL=fatal-exit.d.ts.map

package/dist/boot/fatal-exit.js

@@ -0,0 +1,5 @@
+import { redactSecrets } from "../trace/redact.js";
+export function buildFatalErrorText(err) {
+    return redactSecrets(String(err));
+}
+//# sourceMappingURL=fatal-exit.js.map

package/dist/boot/resolve-spec.js

@@ -303,6 +303,7 @@ export function createResolveSpec(ctx) {
             ...(retainBackgroundProcessesFromBody(body.retainBackgroundProcesses, config.requirePrincipal, (event, fields) => logger.warn(event, { ...fields, sessionId: auth?.sessionId ?? null })) === true
                 ? { retainBackgroundProcesses: true }
                 : {}),
+            ...(body.excludeAllTools === true ? { excludeAllTools: true } : {}),
             ...(() => { const v = toolNameListFromBody(body.excludeTools); return v ? { excludeTools: v } : {}; })(),
             ...(() => { const v = toolNameListFromBody(body.deferTools); return v ? { deferTools: v } : {}; })(),
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
@@ -541,6 +542,7 @@ export function createResolveSpec(ctx) {
             declaredCapable: effectiveMemoryPersistenceCapable(config),
             hands: gated.hands,
             handsReadOnly: governed.handsReadOnly === true,
+            excludeAllTools: governed.excludeAllTools === true,
             excludeTools: governed.excludeTools,
             remoteExecutionEnv: config.remoteExec !== undefined,
         })) {

package/dist/brain.js

@@ -1,22 +1,31 @@
 import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, hasAuthCarrier, resolveRouteCredential, routeRefusalText, } from "@sema-agent/core";
-import { normalizeBaseUrl } from "@sema-agent/core";
+import { routeKeyOf } from "@sema-agent/core";
 import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
 import { catalogBrainLane } from "./model-provider.js";
-import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
+import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
-    const entry = normalizeBaseUrl(baseUrl);
+    const entry = routeKeyOf(baseUrl);
     if (entry === "")
         return false;
-    return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => normalizeBaseUrl(u) === entry);
+    return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => routeKeyOf(u) === entry);
 }
 function degradeDeclaredRoot(fallbackBaseUrl, config) {
     const armed = Boolean(config.gatewayApiKey) && isOffDeploymentRoot(fallbackBaseUrl, config);
     return armed ? config.gatewayBaseUrl : (fallbackBaseUrl || config.gatewayBaseUrl);
 }
 export const FAST_FAIL_MAX_RETRIES = 2;
+function constructRouteBrain(label, sourceUrls, construct) {
+    try {
+        return construct();
+    }
+    catch (e) {
+        const text = buildDisplaySafeRefusal(e instanceof Error ? e.message : String(e), sourceUrls.map((u) => u ?? ""));
+        throw new Error(`${label}: ${text}`, { cause: undefined });
+    }
+}
 const DEFAULT_RESILIENCE = buildDefaultResilience();
 export function createBrain(config, deps = {}) {
     const { fetchImpl, breakerState } = deps;
@@ -34,7 +43,7 @@ export function createBrain(config, deps = {}) {
             : {};
     const routes = [config.gatewayBaseUrl, ...config.gatewayFallbackUrls];
     const openaiBrains = routes.map((baseUrl, i) => {
-        const brain = createOpenAIBrain({
+        const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
             baseUrl,
             get apiKey() {
                 return config.gatewayApiKey;
@@ -42,7 +51,7 @@ export function createBrain(config, deps = {}) {
             ...retryCap,
             fetchImpl,
             ...timeouts,
-        });
+        }));
         const isLast = i === routes.length - 1;
         return r.circuitBreaker && !isLast
             ? createCircuitBreakerBrain(brain, {
@@ -54,18 +63,19 @@ export function createBrain(config, deps = {}) {
             : brain;
     });
     const gatewayBrain = openaiBrains.length > 1 ? createFailoverBrain(openaiBrains) : openaiBrains[0];
-    const anthropicBrain = config.anthropic
-        ? createAnthropicBrain({
-            ...(config.anthropic.authToken
-                ? { headers: { Authorization: `Bearer ${config.anthropic.authToken}` } }
-                : { apiKey: config.anthropic.apiKey }),
-            baseUrl: config.anthropic.baseUrl ?? "https://api.anthropic.com",
-            version: config.anthropic.version,
-            cacheBreakpoints: config.anthropic.cacheBreakpoints,
-            ...(config.anthropic.maxRetries !== undefined ? { maxRetries: config.anthropic.maxRetries } : {}),
+    const anthropicCfg = config.anthropic;
+    const anthropicBrain = anthropicCfg
+        ? constructRouteBrain("anthropic route", [anthropicCfg.baseUrl], () => createAnthropicBrain({
+            ...(anthropicCfg.authToken
+                ? { headers: { Authorization: `Bearer ${anthropicCfg.authToken}` } }
+                : { apiKey: anthropicCfg.apiKey }),
+            baseUrl: anthropicCfg.baseUrl ?? "https://api.anthropic.com",
+            version: anthropicCfg.version,
+            cacheBreakpoints: anthropicCfg.cacheBreakpoints,
+            ...(anthropicCfg.maxRetries !== undefined ? { maxRetries: anthropicCfg.maxRetries } : {}),
             fetchImpl,
             ...timeouts,
-        })
+        }))
         : undefined;
     let brain = anthropicBrain
         ? createRoutingBrain({ anthropic: anthropicBrain }, { fallback: gatewayBrain })
@@ -81,7 +91,7 @@ export function createBrain(config, deps = {}) {
             const fallback = fallbackLane === "anthropic" && anthropicBrain
                 ?
                     anthropicBrain
-                : createOpenAIBrain({
+                : constructRouteBrain(`degrade target "${degradeTo}"`, [fallbackModel.baseUrl, config.gatewayBaseUrl], () => createOpenAIBrain({
                     get baseUrl() {
                         return degradeDeclaredRoot(fallbackModel.baseUrl, config);
                     },
@@ -91,7 +101,7 @@ export function createBrain(config, deps = {}) {
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,
-                });
+                }));
             const degradeEntryModel = {
                 ...fallbackModel,
                 get headers() {
@@ -158,7 +168,10 @@ export function brainSummary(config) {
             const verdict = adjudicateModelRoute({ id: target.id, baseUrl: target.baseUrl }, resolveRouteCredential({ ...(config.gatewayApiKey ? { configApiKey: config.gatewayApiKey } : {}) }), { baseUrl: degradeDeclaredRoot(target.baseUrl, config) });
             return verdict.ok
                 ? { reactiveDegradeRoutePairing: `ok:${verdict.posture}`, reactiveDegradeRouteRefusal: null }
-                : { reactiveDegradeRoutePairing: `broken:${verdict.code}`, reactiveDegradeRouteRefusal: redactSecrets(routeRefusalText(verdict)) };
+                : {
+                    reactiveDegradeRoutePairing: `broken:${verdict.code}`,
+                    reactiveDegradeRouteRefusal: buildDisplaySafeRefusal(routeRefusalText(verdict), [target.baseUrl ?? "", degradeDeclaredRoot(target.baseUrl, config)]),
+                };
         })()),
     };
 }

package/dist/capabilities/memory-notice.d.ts

@@ -51,6 +51,12 @@ export interface MemoryFaceFacts {
     hands: ScenarioHands;
     /** 折完 governance+settings 后的最终 `handsReadOnly`(plan 模式 / autonomy 收窄)。手带只剩读腿。 */
     handsReadOnly: boolean;
+    /** 折完之后的最终 `TaskSpec.excludeAllTools`(S-493;core 7.8.0 [ref])。`true` = **整只**工具面卸空
+     *  (core `prepareDeferClassify` 对它直接 `roster.unmountWhere(() => true)`)⇒ 手带在场也一条落盘路都不剩。
+     *  🔴 它与下面那张名单是**同一个语义面**(「哪些工具不在 roster 上」)的两种声明,判据合成一只
+     *  {@link isUnmounted} —— 上游同版的姊妹谓词 `fullShellReachable` 也正是把 `spec.excludeAllTools !== true`
+     *  当一个合取项(`prepare-inherited-gate.js:174` 亲读),本仓与它同口径。 */
+    excludeAllTools: boolean;
     /** 折完之后的最终 `TaskSpec.excludeTools`(roster 真卸载,不是延迟披露)。**全部**已知落盘路都被排掉
      *  ⇒ 手带在场也等于没有写通道 —— core 的 `rosterCanPersist` 也是按排除后的 roster 算的,这里跟上。 */
     excludeTools: readonly string[] | undefined;
@@ -71,7 +77,7 @@ export interface MemoryFaceFacts {
  *  ① engine 在场 ⇒ **否**(引擎的座位,见文件头注);
  *  ② 部署显式声明 ⇒ 声明说了算(`true` 撤回 / `false` 强制)—— operator 的部署事实压过我们的推断,
  *     与 core 对 `memoryPersistenceCapable` 的处置同向;
- *  ③ 否则推断:有已知落盘路(手带在场且不是只读)⇒ 否;没有 ⇒ 是。
+ *  ③ 否则推断:有已知落盘路(手带在场、不是只读、不在 remote 车道、且没被卸载决定卸光)⇒ 否;没有 ⇒ 是。
  */
 export declare function shouldDiscloseNoPersistentMemory(facts: MemoryFaceFacts): boolean;
 /**

package/dist/capabilities/memory-notice.js

@@ -2,11 +2,11 @@ import { NO_PERSISTENT_MEMORY_NOTICE } from "@sema-agent/core";
 import { hasConstitutionAnchors } from "../task-settings.js";
 export const KNOWN_PERSISTENCE_TOOL_NAMES = ["Write", "Edit", "NotebookEdit", "Bash"];
 export const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
-function anyPersistenceToolSurvives(excludeTools) {
-    if (excludeTools === undefined || excludeTools.length === 0)
-        return true;
-    const excluded = new Set(excludeTools);
-    return KNOWN_PERSISTENCE_TOOL_NAMES.some((name) => !excluded.has(name));
+function isUnmounted(facts, name) {
+    return facts.excludeAllTools || (facts.excludeTools?.includes(name) ?? false);
+}
+function anyPersistenceToolSurvives(facts) {
+    return KNOWN_PERSISTENCE_TOOL_NAMES.some((name) => !isUnmounted(facts, name));
 }
 export function shouldDiscloseNoPersistentMemory(facts) {
     if (facts.memoryFaceMounted)
@@ -17,7 +17,7 @@ export function shouldDiscloseNoPersistentMemory(facts) {
         return true;
     if (facts.remoteExecutionEnv)
         return true;
-    return !anyPersistenceToolSurvives(facts.excludeTools);
+    return !anyPersistenceToolSurvives(facts);
 }
 const NOTICE_BLOCK = { id: NO_PERSISTENT_MEMORY_SECTION_ID, slot: "behavior", text: NO_PERSISTENT_MEMORY_NOTICE };
 function mountNotice(decls) {

package/dist/capabilities/team.d.ts

@@ -20,6 +20,43 @@ import type { Logger } from "../observability/logger.js";
  * registerTeams` 那条消费腿——本文件旧注里「registry pushes more at runtime via GET /api/config/effective → teams」
  * 是 doc-rot。今天 `registerTeams` 只剩公共信任边界这一层意义(调用方=测试),注册表在生产上恒等于 BUILTIN_TEAMS;
  * 中心侧的多 agent 讨论配置面是 `collab` 域(0.7 继任者),投影成命名 workflow(capabilities/collab-workflows.ts)。
+ *
+ * 🔴 **成员重派阶梯收窄(core 7.24.0 [ref];本仓 7.90.0 提货批的读数说明,零改动)** —— 一次讨论**花的子 run
+ * 数掉一半**,上游实测:两成员一轮的讨论从 **6 个子 run 变 3 个**。原因:`runTurn` 此前对**每一个**没有
+ * 「completed 且有正文」落地的成员轮都重派一次(同目标、同提示词、同模型、同工具面),包括那些**结局上
+ * 不可能变**的终局;现在只对引擎能**肯定**认出是确定性的两种终局拒绝重派(`blocked` 因由 = 宿主
+ * `UserPromptSubmit` 的拒绝,照字面信;`failed` 且治理表判 TERMINAL 的码,读 `classifySubagentError`)。
+ *
+ * 🔴 **这不是「丢了重试」,读数变低也不是故障**(写在这里是因为它唯一会被误读的地方就是账单与子代行数):
+ *  · 其余一切**照旧**保留第二次尝试 —— 那个分类器的 `logic`/`unknown` 桶是**else 臂**(它不认识的码全落
+ *    那里),把「永不重派」挂在 else 臂上会让**将来每一个新码**默默变成不可重派,所以那条判决留在表里。
+ *    ⚠️ **本句在 7.90.0(core 7.24.2 / [ref])修了措辞**:上一版写的是「`stream_torn` 住在 `logic` 桶里
+ *    (else 臂)…负控挑它最有判别力」—— core 本版给三个 in-band 终局输出码**各自开了行**
+ *    (`stream_torn → network`(transient)/ `refusal → logic` / `length_empty → logic`),所以
+ *    `stream_torn` **已经不在 else 臂上了**(本车亲跑差分实测:`classifySubagentError({code:"stream_torn"})`
+ *    从 7.24.1 的 `{errorKind:"logic", retryable:false}` 变 7.24.2 的 `{errorKind:"network", retryable:true}`
+ *    —— 注意 `errorKind` 与 `retryable` **两个字段都翻了**,提货单只点了后者)。
+ *    **结局没变**(`stream_torn` 照旧重派 ⇒ 仍 6):重派闸 `canDifferOnRetry` 判的是「`blocked` 因由 + 治理表
+ *    判 TERMINAL」,从不读桶名 —— 变的是**理由**(从「掉进 else 臂」变成「表里那一行说它 transient」)。
+ *    ⇒ 拿 `stream_torn` 当 **else 臂**负控从本版起**没有判别力了**(它是一条有行的码);要挑 else 臂代表,
+ *    挑**未知码** / **无码的 `failed`** / **空正文的 `completed`** —— 那三形才真的落 else 臂。
+ *  · `[unavailable: <status>/<code>]` 标记、讨论转录、预算记账的**形一个字节没变**。
+ *  · **本仓没有任何按子 run 数计费 / 计量的座**(2026-09-19 车JG 亲扫:`billable` 是 `http/route-table.ts` 上
+ *    「这条路由算不算一次计费提交」的路由性质,与子 run 无关;`council_runs_total` 数的是**议会被调用了几次**,
+ *    不是子代;成员轮不建 run-store 行,它们是 TaskRegistry 上的 `a*` 句柄)。⇒ 本版在本仓**零改动**,
+ *    唯一会动的读数是 `GET /v1/runs/:id/subagents` 的**行数**与经 `stats` 透传的**用量/花费**(都变低),
+ *    两者都是上游事实的透传、本仓不据行数做任何裁决。
+ *
+ * 🔴 **判据按「前缀族」写,不按具体码字**(test 仓对 core 7.24.0 的实测②,本仓照此记账;将来真在本仓开
+ * 计量点时钉法同此):引擎读的是治理表对**码**的裁决,而裁决是按**前缀族**给的 —— 一个族里凭空合成的码
+ * (test 实测的 `usage.FAKE_prefix_only`)照样判 TERMINAL ⇒ **3**。所以正控/负控各挑**一个**代表就够,
+ * 逐字抄那张码表只会在上游加一行的那天变成谎:
+ *  · **⇒ 3(不重派)**:`blocked` 因由,以及 7 个被治理表判 TERMINAL 的前缀族失败码(合成同前缀码同判);
+ *  · **⇒ 仍 6(照旧两次)**:两个 transient 码 `memory.admission_required` / `config.compliance_required`,
+ *    以及 `stream_torn` / `refusal` / `length_empty` / 未知码 / 无码的 `failed` / 空正文的 `completed`。
+ *    🔴 **这六形自 core 7.24.2([ref])起不再同源**:前三形在分类器里**各有一行**
+ *    (`stream_torn → network` transient / `refusal`、`length_empty` → `logic`),后三形才是真的 **else 臂**。
+ *    结局(仍 6)对六形都没变,但**负控要挑真 else 臂**:未知码 / 无码的 `failed` / 空正文的 `completed`。
  */
 type TeamFn = typeof runTeamDiscussion;
 export interface TeamMemberTemplate {

package/dist/config-catalog.js

@@ -5,6 +5,7 @@ import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-sear
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -55,7 +56,7 @@ export const CONFIG_CATALOG = [
     r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
     r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(与 AUTH_TOKEN 二选一,AUTH_TOKEN 优先;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(设了则不发 x-api-key)", { danger: [...SEC, ...BILL] }),
-    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`)"),
+    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment` —— fragment 从不上线,后缀会落进被丢弃的那一半)"),
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
@@ -282,8 +283,8 @@ export const CONFIG_CATALOG = [
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
-    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`)", { configKey: "gatewayFallbackUrls" }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
     r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
@@ -478,19 +479,6 @@ function primitiveConfigValue(config, key) {
         return v;
     return undefined;
 }
-const REDACTED_UNPARSEABLE_URL = "(redacted:unparseable-url)";
-function stripUrlUserinfo(v) {
-    if (!URL.canParse(v))
-        return REDACTED_UNPARSEABLE_URL;
-    const u = new URL(v);
-    u.username = "";
-    u.password = "";
-    if (u.search === "" && u.hash === "" && u.href === v)
-        return v;
-    u.search = "";
-    u.hash = "";
-    return u.href;
-}
 function sanitizeEnumValue(spec, v) {
     const words = spec.echoWords ?? spec.enumValues;
     if (v === null)
@@ -511,9 +499,9 @@ function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
         if (typeof v === "string")
-            return { value: v.includes(",") ? v.split(",").map((s) => stripUrlUserinfo(s.trim())).filter((s) => s.length > 0) : stripUrlUserinfo(v) };
+            return { value: v.includes(",") ? v.split(",").map((s) => buildDisplaySafeUrl(s.trim())).filter((s) => s.length > 0) : buildDisplaySafeUrl(v) };
         if (Array.isArray(v))
-            return { value: v.map((s) => stripUrlUserinfo(s)) };
+            return { value: v.map((s) => buildDisplaySafeUrl(s)) };
         return { value: v };
     }
     if (type === "csv" && typeof v === "string")

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
-import type { Autonomy } from "./runtime-governance.js";
+import { type Autonomy } from "./runtime-governance.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
  *  every existing `from "./config.js"` importer compiles unchanged (pure-type consumers should prefer

package/dist/config.js

@@ -17,9 +17,10 @@ import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -27,7 +28,6 @@ function csv(name) {
         .map((s) => s.trim())
         .filter(Boolean);
 }
-const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
 export function parseAutonomy(raw) {
     const v = raw?.trim();
     if (!v)
@@ -1972,9 +1972,9 @@ function parseA2aServe() {
         throw new Error(`A2A_SERVE_URL must not carry userinfo (credentials before "@") — it is published verbatim on the ANONYMOUSLY readable agent card, so those credentials would be handed to every discovery caller. ` +
             `Inbound authentication on this endpoint is header-shaped (a service credential), not URL-embedded; strip the userinfo and keep the secret in the caller's headers.`);
     }
-    const a2aDisplaySafe = buildDisplaySafeUrl(rawUrl);
-    if (a2aDisplaySafe !== parsed.href) {
-        throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aDisplaySafe}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
+    const a2aCredentialScan = redactSecrets(parsed.href);
+    if (a2aCredentialScan !== parsed.href) {
+        throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aCredentialScan}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
             `so it must not carry credentials of ANY shape: no userinfo, no credential-named query parameter (api_key/token/…), no token-shaped path segment or parameter value. ` +
             `Keep A2A_SERVE_URL to scheme://host[:port][/path] and move the secret into the caller's headers.`);
     }

package/dist/hooks/hook-llm.js

@@ -1,6 +1,6 @@
-import { adjudicateModelRoute, normalizeBaseUrl, resolveRouteCredential, routeRefusalText } from "@sema-agent/core";
+import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
 import { matchCatalogModel } from "../model-select.js";
-import { redactSecrets } from "../trace/redact.js";
+import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
         return raw;
@@ -53,9 +53,13 @@ export function createHookLlm(deps) {
         });
         const verdict = adjudicateModelRoute({ id: pick.catalogRef, baseUrl: pick.baseUrl }, credential, { ...(declaredRoot !== undefined ? { baseUrl: declaredRoot } : {}) });
         if (!verdict.ok) {
-            return { ok: false, error: `hook model "${pick.catalogRef}" cannot be routed — ${routeRefusalText(verdict)}` };
+            return {
+                ok: false,
+                error: `hook model "${pick.catalogRef}" cannot be routed (${verdict.code}) — ` +
+                    buildDisplaySafeRefusal(routeRefusalText(verdict), [pick.baseUrl, declaredRoot ?? ""]),
+            };
         }
-        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && normalizeBaseUrl(pick.baseUrl) !== normalizeBaseUrl(declaredRoot)) {
+        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
             return {
                 ok: false,
                 error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
@@ -91,7 +95,7 @@ export function createHookLlm(deps) {
                 const routed = judgeRoute(pick, perModelKey, config.anthropic?.authToken ?? config.anthropic?.apiKey, routeBase);
                 if (!routed.ok)
                     return routed;
-                url = `${pick.baseUrl.replace(/\/+$/, "")}/v1/messages`;
+                url = joinRequestUrl(pick.baseUrl, "/v1/messages");
                 headers = {
                     "content-type": "application/json",
                     "anthropic-version": config.anthropic?.version ?? "2023-06-01",
@@ -112,7 +116,7 @@ export function createHookLlm(deps) {
                 if (!routed.ok)
                     return routed;
                 const hookKey = routed.credential.apiKey;
-                url = `${pick.baseUrl.replace(/\/+$/, "")}/chat/completions`;
+                url = joinRequestUrl(pick.baseUrl, "/chat/completions");
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });
             }

package/dist/hooks/hook-runner.js

@@ -52,7 +52,9 @@ const BRAIN_TO_TURN_ERROR = {
     max_output_tokens: "max_output_tokens",
 };
 function toAssistantTurnError(errorKind) {
-    return (errorKind !== undefined ? BRAIN_TO_TURN_ERROR[errorKind] : undefined) ?? "unknown";
+    if (errorKind === undefined)
+        return "unknown";
+    return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
 export function parseHooksConfig(raw) {
     const parsed = HooksConfig.safeParse(raw);
@@ -1148,6 +1150,21 @@ export function createTaskHooks(config, ctx) {
     }
     return hooks;
 }
+const HOOK_SLOT_FOLD = {
+    preToolUse: "custom",
+    preToolUseObservational: "custom",
+    postToolUse: "custom",
+    postToolUseFailure: "custom",
+    postToolBatch: "custom",
+    userPromptSubmit: "custom",
+    stop: "custom",
+    preCompact: "custom",
+    timeoutMs: "scalar",
+    postCompact: "observe-void",
+    stopFailure: "observe-void",
+    permissionDenied: "observe-void",
+};
+const OBSERVE_VOID_HOOK_SLOTS = Object.keys(HOOK_SLOT_FOLD).filter((k) => HOOK_SLOT_FOLD[k] === "observe-void");
 export function composeHooks(deployment, task) {
     if (!deployment)
         return task;
@@ -1270,7 +1287,7 @@ export function composeHooks(deployment, task) {
             };
         };
     }
-    for (const slot of ["stopFailure", "postCompact", "permissionDenied"]) {
+    for (const slot of OBSERVE_VOID_HOOK_SLOTS) {
         const ds = d[slot];
         const ts = t[slot];
         if (ds && ts) {

package/dist/http/admission.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -430,6 +430,10 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
+        if (body.excludeAllTools !== undefined && typeof body.excludeAllTools !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "excludeAllTools must be a boolean");
+            return null;
+        }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
@@ -453,8 +457,8 @@ export function createAdmission(ctx) {
         }
         {
             const v = body.permissionMode;
-            if (v !== undefined && v !== "default" && v !== "acceptEdits" && v !== "plan" && v !== "bypassPermissions" && v !== "auto") {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+            if (v !== undefined && !isSettingsPermissionMode(v)) {
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return null;
             }
         }
@@ -464,8 +468,8 @@ export function createAdmission(ctx) {
                 const p = s.permissions;
                 if (p !== null && typeof p === "object" && !Array.isArray(p)) {
                     const m = p.defaultMode;
-                    if (m !== undefined && m !== "default" && m !== "acceptEdits" && m !== "plan" && m !== "bypassPermissions" && m !== "auto") {
-                        sendError(res, 400, "request.field_invalid", 'settings.permissions.defaultMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                    if (m !== undefined && !isSettingsPermissionMode(m)) {
+                        sendError(res, 400, "request.field_invalid", `settings.permissions.defaultMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                         return null;
                     }
                     const d = p.disableAutoMode;

package/dist/http/routes/capabilities.js

@@ -18,7 +18,7 @@ import { projectApprovalsStreamLiveCapability } from "../../capabilities/approva
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict } from "../../task-settings.js";
+import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../../task-settings.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
@@ -52,7 +52,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const requestedModeRaw = new URLSearchParams(match.search).get("permissionMode");
             const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
             if (requestedModeRaw !== null && requestedMode === undefined) {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);

package/dist/http/routes/session-sync.js

@@ -13,6 +13,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -215,10 +216,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.field_invalid", "entryIds must be an array of strings");
                     return;
                 }
-                if (!Array.isArray(body.policy) || !Array.isArray(body.anchors)) {
+                if (!Array.isArray(body.anchors)) {
                     sendError(res, 400, "request.body_shape", "malformed import metadata");
                     return;
                 }
+                const policyRead = readSessionRulesRecords(body.policy);
+                if (policyRead.problem !== undefined) {
+                    sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);
+                    return;
+                }
                 let fileHistory = null;
                 if (body.fileHistory !== undefined && body.fileHistory !== null) {
                     const door = validateFileHistoryExport(body.fileHistory);
@@ -235,7 +241,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const resolution = body.resolution;
                 const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
                 const entryIds = body.entryIds;
-                const policy = body.policy;
+                const policy = policyRead.records;
                 const anchors = body.anchors;
                 const dstIds = (await deps.sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);

package/dist/http/routes/sessions.js

@@ -5,6 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -741,25 +742,26 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.invalid_json", "invalid JSON body");
                 return;
             }
-            if (typeof body.rules !== "object" || body.rules === null || Array.isArray(body.rules)) {
-                sendError(res, 400, "request.body_shape", "rules must be a SessionPermissionRules object");
-                return;
+            const read = readSessionPermissionRules(body.rules);
+            if (read.problem !== undefined) {
+                switch (read.problem.kind) {
+                    case "not-an-object":
+                        sendError(res, 400, "request.body_shape", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    case "field-not-string-array":
+                        sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    default: {
+                        const unhandled = read.problem;
+                        throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+                    }
+                }
             }
             if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
                 sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");
                 return;
             }
-            const raw = body.rules;
-            const rules = {};
-            for (const f of ["toolAllow", "toolDeny", "allowDirs", "commandAllow", "commandDeny"]) {
-                if (raw[f] === undefined)
-                    continue;
-                if (!Array.isArray(raw[f]) || !raw[f].every((x) => typeof x === "string")) {
-                    sendError(res, 400, "request.field_invalid", `${f} must be an array of strings`);
-                    return;
-                }
-                rules[f] = raw[f];
-            }
+            const rules = read.rules;
             try {
                 const stored = await store.putRules(sessionId, target, rules, { ...(typeof body.expectedRev === "number" ? { expectedRev: body.expectedRev } : {}), operator });
                 sendJson(res, 200, { rules: stored });

package/dist/http/wire-types.d.ts

@@ -264,6 +264,18 @@ export interface TaskRequestBody {
      *  it takes the same single-user gate as backgroundShell/hooks (multi-tenant warns + ignores; advertised via
      *  capabilities.retainBackgroundProcesses). Boolean fail-loud at submit; only `true` rides the spec. */
     retainBackgroundProcesses?: boolean;
+    /** S-493(core 7.8.0 [ref] `TaskSpec.excludeAllTools`,cli L-207 / 板 [ref]): **整只工具面卸载**
+     *  —— 调用方工具、脚手架、手、MCP、skills 一个都不挂,模型这一 run 里没有任何工具可调、终局是纯文本。
+     *
+     *  🔴 **与 {@link excludeTools} 是两种语义,刻意不折叠**:`"*"` 是一个合法的调用方工具名,所以「卸全部」
+     *  不能写成一条通配规则(那会把「卸全部」与「卸一只叫 `*` 的工具」塌成一件事)。两键同带 ⇒ 各自生效
+     *  (全卸之后名单里那几只本来也不在,不矛盾、不拒)。
+     *  只 literal `true` 上 spec(`false` / 缺席 = 名册照旧,不挂键保持 byte-compat —— 挂一个 `false` 上去
+     *  等于替引擎重申了一次它自己的缺省);非 boolean 由 HTTP 门 400 `request.field_invalid`,resume 重放
+     *  defensive DROP。per-run 工具面**收窄**无跨租户面 ⇒ 无租户门(`excludeTools` 同姿势)。
+     *  探测:本键在不在受理面由**键闭集**自己回答 —— 没接线的 server 版本对它 400 `request.body_shape`
+     *  并逐字列名,所以**不加能力位**(一个键一条探测路,不长第二条)。 */
+    excludeAllTools?: boolean;
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/main.js

@@ -1,4 +1,5 @@
 import { createLogger } from "./observability/logger.js";
+import { buildFatalErrorText } from "./boot/fatal-exit.js";
 import { runStage01 } from "./boot/stage-01-config.js";
 import { runStage02 } from "./boot/stage-02-registry-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
@@ -22,7 +23,7 @@ async function main() {
     await runStage10(s09);
 }
 void main().catch((err) => {
-    createLogger().error("fatal", { err: String(err) });
+    createLogger().error("fatal", { err: buildFatalErrorText(err) });
     process.exit(1);
 });
 //# sourceMappingURL=main.js.map