@sema-agent/settings-schema 2.1.0 → 3.0.1

package/conformance/cases/cli02-control-and-zero-width-chars/expected.json

@@ -0,0 +1,115 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": [
+          {
+            "elicitation": false,
+            "enabled": true,
+            "name": "s1",
+            "notes": "line1\nline2​tail",
+            "rosters": [],
+            "scenarios": [],
+            "transport": {
+              "kind": "http",
+              "url": "https://x.example"
+            }
+          }
+        ]
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "ok-name-id",
+            "name": "ok-name",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "models",
+        "kind": "entry-dropped",
+        "path": [
+          "models",
+          0
+        ]
+      },
+      {
+        "domain": "models",
+        "kind": "entry-dropped",
+        "path": [
+          "models",
+          1
+        ]
+      }
+    ],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 4213710307592750
+  }
+}

package/conformance/cases/cli02-control-and-zero-width-chars/input.json

@@ -0,0 +1,42 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "models": {
+      "models": [
+        {
+          "name": "a\u0007b",
+          "provider": "openai",
+          "id": "a\u0007b-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        },
+        {
+          "name": "zero​width",
+          "provider": "openai",
+          "id": "zero​width-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        },
+        {
+          "name": "ok-name",
+          "provider": "openai",
+          "id": "ok-name-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        }
+      ]
+    },
+    "mcp": {
+      "servers": [
+        {
+          "name": "s1",
+          "transport": {
+            "kind": "http",
+            "url": "https://x.example"
+          },
+          "notes": "line1\nline2​tail"
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/cli02-control-and-zero-width-chars/meta.json

@@ -0,0 +1,9 @@
+{
+  "contributor": "cli",
+  "claim": "壳视角②:控制字符 / 零宽字符落在两种字段上,结局**不同**,而这正是壳要知道的:落在 name(有字符集)⇒ 条目被丢 + 点名;落在自由文本(mcp 备注)⇒ **逐字原样承运**,一个字节都不转义、不折叠。转义是显示面的责任,读侧不许代劳 —— 代劳了,壳就再也拿不到运维真正写下的那个串。",
+  "firstRedOn": [
+    "settings-schema@1.0.0",
+    "settings-schema@1.10.0",
+    "settings-schema@1.5.0"
+  ]
+}

package/conformance/cases/cli03-credential-pasted-into-unknown-key/expected.json

@@ -0,0 +1,92 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": [
+          {
+            "approved": false,
+            "drain": false,
+            "enabled": true,
+            "labels": [],
+            "name": "h1"
+          }
+        ]
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "hosts",
+        "keys": [
+          [
+            "hosts",
+            0,
+            "url"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      }
+    ],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/cli03-credential-pasted-into-unknown-key/input.json

@@ -0,0 +1,16 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "hosts": {
+      "hosts": [
+        {
+          "name": "h1",
+          "url": "https://user:sk-live-ZZZZZZZZZZZZZZZZZZZZ@example.com"
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/cli03-credential-pasted-into-unknown-key/meta.json

@@ -0,0 +1,9 @@
+{
+  "contributor": "cli",
+  "claim": "壳视角③:一条带 userinfo 凭据的 URL 被粘进 hosts 条目。**真读数与提案不同**:HostEntry 根本没有 `url` 字段 ⇒ 它是未知键,被剥掉、只报**键路径**。于是不变量成立且更强:凭据既不进 effective、也不进告警(告警里只有 ['hosts',0,'url'] 这串坐标)。本条的机器门 = 告警面零命中语料秘密。",
+  "firstRedOn": [],
+  "secrets": [
+    "sk-live-ZZZZZZZZZZZZZZZZZZZZ",
+    "https://user:sk-live-ZZZZZZZZZZZZZZZZZZZZ@example.com"
+  ]
+}

package/conformance/cases/cli04-env-value-with-newline/expected.json

@@ -0,0 +1,93 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": [
+          {
+            "coords": {},
+            "enabled": true,
+            "env": {
+              "BAR": "c\rd",
+              "FOO": "a\nb"
+            },
+            "host": "default",
+            "image": "sema-server:latest",
+            "name": "w1",
+            "runtime": {
+              "memoryBackend": "off",
+              "rateLimitRpm": 0,
+              "requirePrincipal": false,
+              "sessionBackend": "auto"
+            },
+            "secretRefs": {
+              "apiKeyEnv": "OPENAI_API_KEY"
+            }
+          }
+        ]
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/cli04-env-value-with-newline/input.json

@@ -0,0 +1,23 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "workers": {
+      "workers": [
+        {
+          "name": "w1",
+          "runtime": {},
+          "secretRefs": {
+            "apiKeyEnv": "OPENAI_API_KEY"
+          },
+          "env": {
+            "FOO": "a\nb",
+            "BAR": "c\rd"
+          }
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/cli04-env-value-with-newline/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "cli",
+  "claim": "壳视角④:worker 的 env 值里有换行 / 回车 ⇒ 读侧**原样承运**(不折叠、不截断、不静默改写)。壳的 `/config show` 单行渲染会断行,那是显示面的事;读侧一改,配置就与运维写下的不是同一份。注意这一域是非便携域:local-root 腿看不到它,只报 unread-config-file —— 三腿三样,壳要知道自己问的是哪一腿。",
+  "firstRedOn": []
+}

package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json

@@ -0,0 +1,109 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-id",
+            "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaaa-id",
+            "name": "prefix-shared-name-aaaa",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaab-id",
+            "name": "prefix-shared-name-aaab",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 1318036626730287
+  }
+}

package/conformance/cases/cli05-long-and-prefix-colliding-names/input.json

@@ -0,0 +1,30 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "models": {
+      "models": [
+        {
+          "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+          "provider": "openai",
+          "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        },
+        {
+          "name": "prefix-shared-name-aaaa",
+          "provider": "openai",
+          "id": "prefix-shared-name-aaaa-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        },
+        {
+          "name": "prefix-shared-name-aaab",
+          "provider": "openai",
+          "id": "prefix-shared-name-aaab-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        }
+      ]
+    }
+  }
+}

package/conformance/cases/cli05-long-and-prefix-colliding-names/meta.json

@@ -0,0 +1,5 @@
+{
+  "contributor": "cli",
+  "claim": "壳视角⑤:300 字节的模型名、以及一组只在尾部有差别的同前缀名 ⇒ 读侧**不截断、不去重**,逐字全量送到壳手里。截断是壳的责任;读侧代为截断会让两条不同的模型在下游变成同一条(而且没有任何告警)。",
+  "firstRedOn": []
+}

package/conformance/cases/t01-absent-domain-key-not-null/expected.json

@@ -0,0 +1,93 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": [
+          {
+            "approved": true,
+            "drain": false,
+            "enabled": true,
+            "labels": [],
+            "name": "box1"
+          }
+        ]
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "m0-id",
+            "name": "m0",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    }
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2247688933988744
+  }
+}

package/conformance/cases/t01-absent-domain-key-not-null/input.json

@@ -0,0 +1,29 @@
+{
+  "meta": {
+    "version": 7,
+    "updatedAt": "2026-09-16T00:00:00.000Z"
+  },
+  "domains": {
+    "models": {
+      "models": [
+        {
+          "name": "m0",
+          "provider": "openai",
+          "id": "m0-id",
+          "apiKeyEnv": "OPENAI_API_KEY"
+        }
+      ]
+    },
+    "hosts": {
+      "hosts": [
+        {
+          "name": "box1",
+          "approved": true
+        }
+      ]
+    },
+    "web-admin-ui": {
+      "theme": "dark"
+    }
+  }
+}

package/conformance/cases/t01-absent-domain-key-not-null/meta.json

@@ -0,0 +1,6 @@
+{
+  "contributor": "test",
+  "claim": "告警对象上 `domain` **缺席**(不是 `null`、不是空串)时,三腿必须原样传成缺席。消费方普遍写 `{domain: w.domain, …}` 这种投影(web-admin [7285] ③ 实测 `unread-config-file` 无必填 `domain`),谁把缺席折成 `null` 或 `\"\"`,谁就让下游多红一处而自己看不见。",
+  "firstRedOn": [],
+  "note": "一条输入里同时放两条 `unread-config-file`:`hosts.json`(非便携域 ⇒ **带** `domain`)与 `web-admin-ui.json`(非域名 ⇒ **不带** `domain`)。两种形并排,所以「把缺席一律折成 null」与「把 domain 整个丢掉」两种错法都会红,而不是只挡住其中一种。诚实边界:`unread-config-file` 是 `config.d/` 扫描**独有**的 kind(闭集里唯一 `domain` 可选的那条),所以「缺席传成缺席」这件事**结构上只在 local-root 腿上可观察**;domains / wire 两腿在本条上是零告警的正控(它们不该凭空造出这条告警)。firstRedOn 空是**实跑**出来的:五个历史版本(1.0.0/1.5.0/1.10.0/2.0.0/2.1.0)在本条上全绿 ⇒ 护栏,不是回归凭证。"
+}