@te-river/opencode-team-mode 1.6.0 → 1.6.2

package/dist/host/v2-browser-gate.js

@@ -0,0 +1,319 @@
+import { checkWebUrl } from "../tm/webfetch.js";
+import { isEnvFilePath } from "../envprotect.js";
+/**
+ * The native browser catalog, put behind OUR gate.
+ *
+ * The host ships 45 `browser_*` tools and renders them in its own side panel, which
+ * is why they are the attractive option (docs/research/browser-pane.md). The cost is
+ * that they are the one part of the surface we did not police: `permission.evaluate`
+ * was observed NOT firing for them in a live 2.0.16 session, so the domain list, the
+ * address red line and the R6 env-file rule all had a working bypass the length of a
+ * tool name. This module closes it at the only seam that is left — `tool.hook
+ * ("execute.before")`, whose `input` is mutable and which sees the exact URL the
+ * model is about to navigate to.
+ *
+ * TWO enforcement layers, because the before-hook's power to abort is a host promise
+ * nobody has made to us:
+ *
+ *  1. refuse at the door: throw with the governance sentence, which is how v1's
+ *     governed tools already answer an out-of-policy target.
+ *  2. if the call happens anyway, take the ANSWER away: an `execute.after` for the
+ *     same tool and session right after our refusal means the throw did not stop it,
+ *     so the page content is replaced by the same refusal. The request may still have
+ *     left the machine (we cannot un-spawn the host's browser from here), but the
+ *     private page never reaches the context window, the run store or the trajectory.
+ *
+ * Layer 2 is also the measurement: `leaked` is the count of refusals the host walked
+ * past. Zero after a session of browser work is the evidence the gate has teeth; a
+ * non-zero number says so in `tm_stats` instead of letting us claim a block we did not
+ * perform — which is the product rule, not a logging nicety.
+ *
+ * Scope discipline (#22) applies first: a non-Team session's browser calls are the
+ * user's own configuration's business, and an unattributable one is treated as NOT
+ * ours. Only Team roles get this rule injected, and only they get the stricter one.
+ */
+/** How long after a refusal we still credit the call to it. Generous on purpose: a
+ *  host that queues the tool and then answers is the case we are measuring. */
+const LEAK_WINDOW_MS = 30_000;
+/** The four host-vs-tm_browser differences that cost rounds in the user's real task log,
+ *  said once per session at the result where each one bites. */
+export const NATIVE_BROWSER_NOTE = "（宿主原生浏览器的读法，本会话只说一次：① snapshot/find 的结果是 {tab, content, truncated}，" +
+    "可寻址记号写成 `@e8 [link]`，不是 tm_browser 的 `[ref=e12]`；② evaluate 的参数名是 `script`（不是 fn），" +
+    "而且它求值的是表达式：传 `() => …` 这种函数源文本不会被调用，结果同样是 {} —— 要么写成表达式，" +
+    "要么自己写成 `(()=>{…})()`，返回对象也要自己 JSON.stringify 成标量；③ screenshot 需要一个真正可见且聚焦的" +
+    "桌面标签页，宿主在后台窗口下必定失败，别为它反复 focus；④ wait 的 state 取值不是 playwright 那一套" +
+    "（实测 `load` 和 `text` 在 2.0.18 上直接 error，宿主不给原因），别拿它当渲染完成的判据；" +
+    "⑤ SPA 首帧常是空 content：先重拍再猜，或者直接用站方自己的搜索接口/搜索框，而不是猜 URL 路径。）";
+function locatableText(result) {
+    const content = result?.content;
+    if (!Array.isArray(content))
+        return null;
+    const index = content.findIndex((p) => p && typeof p === "object" && p.type === "text" && typeof p.text === "string");
+    if (index < 0)
+        return null;
+    const part = content[index];
+    return { parts: content, index, text: String(part.text ?? "") };
+}
+/** The host spells its browser tools `browser_snapshot` on the direct surface and
+ *  `browser.snapshot` as a Code Mode catalog path — the user's own desktop log shows both,
+ *  and a matcher that knows only one of them silently governs nothing. */
+function isNativeBrowserTool(name) {
+    return name.startsWith("browser_") || name.startsWith("browser.");
+}
+/** Did this `execute` program actually drive the browser? Read from the host's own
+ *  `result.metadata.toolCalls[]` (the exported desktop session carries it), because the
+ *  program TEXT only tells us what was written, not what ran. */
+function droveBrowser(result) {
+    const calls = result?.metadata?.toolCalls;
+    if (!Array.isArray(calls))
+        return false;
+    return calls.some((c) => isNativeBrowserTool(String(c?.tool ?? "")));
+}
+/** The three verbs whose result shape a model gets wrong without being told (the snapshot's
+ *  `content` vs `text`, `find`'s empty answer, `evaluate`'s non-scalar return). Matched on the
+ *  suffix so BOTH host spellings count — `browser_snapshot` on the direct surface and
+ *  `browser.snapshot` as a catalog path — because a note that fires for the spelling nobody
+ *  uses is the same dead code as a gate that returns before its own branch. */
+const NOTE_VERBS = ["snapshot", "find", "evaluate"];
+function wantsReadingNote(tool) {
+    return NOTE_VERBS.includes(tool.replace(/^browser[._]/, ""));
+}
+/** The addresses a browser call can carry. `url` on navigate / tabs.open, `path` on
+ *  preview and the file verbs, and nothing on the pure-input verbs (click, fill),
+ *  which are governed by whatever page is already open. */
+function targetOf(input) {
+    const rec = input;
+    if (!rec || typeof rec !== "object")
+        return null;
+    for (const key of ["url", "targetUrl"]) {
+        const v = rec[key];
+        if (typeof v === "string" && v.trim())
+            return { kind: "url", value: v.trim() };
+    }
+    if (typeof rec.path === "string" && rec.path.trim())
+        return { kind: "path", value: rec.path.trim() };
+    return null;
+}
+/** Every http(s) host named in a Code Mode program that is refused WITHOUT consent by
+ *  the address red line. Only the hostname is read out and reported — never the program
+ *  text, which is the user's code and may carry a token in its query string. */
+function hardUrlHosts(program) {
+    const hits = [];
+    for (const m of program.matchAll(/https?:\/\/([^\s"'`)<>,\\]+)/gi)) {
+        const raw = m[1] ?? "";
+        let host = "";
+        try {
+            host = new URL("http://" + raw.replace(/^[^@]*@/, "")).hostname;
+        }
+        catch {
+            continue;
+        }
+        if (!host)
+            continue;
+        const v = checkWebUrl("http://" + host + "/", []);
+        if (!v.ok && !v.askable)
+            hits.push(host);
+    }
+    return hits;
+}
+export function applyV2BrowserGate(ctx, opts) {
+    const report = { seen: 0, classified: 0, refused: 0, codeModeRefused: 0, leaked: 0, held: 0, annotated: 0, foreignSkipped: 0, byTool: {} };
+    const registrations = [];
+    /** key = `${tool}\n${sessionID}` → the refusal we owe that call's answer */
+    const annotated = new Set();
+    const pending = new Map();
+    const off = /^(0|false|no|off)$/i.test(String(opts.env?.TM_V2_BROWSER_GATE ?? "").trim());
+    const keyOf = (tool, sessionID) => `${tool}\n${String(sessionID ?? "")}`;
+    const decide = (target) => {
+        if (target.kind === "path") {
+            // R6, applied to the one native verb that reads from the server's own disk.
+            return isEnvFilePath(target.value)
+                ? `原生浏览器要预览的路径 ${target.value} 是环境文件家族（R6 红线），不放行：这类读取没有任何"看起来对不对"可判断，也不存在可批准的窗口。`
+                : null;
+        }
+        const verdict = checkWebUrl(target.value, opts.allowlist);
+        return verdict.ok ? null : verdict.message;
+    };
+    const fireBefore = (raw) => {
+        const event = raw;
+        const tool = String(event?.tool ?? event?.name ?? "");
+        // `execute` is checked in the same breath as the direct verbs, NOT after a
+        // `browser_*` early return: the code-mode leg used to sit BELOW that return, so the
+        // whole branch was unreachable and a navigate inside a program was gated by nothing
+        // but the model's own memory. Proven by reading the compiled hook, not by reasoning.
+        const isExecute = tool === "execute";
+        if (!isExecute && !isNativeBrowserTool(tool))
+            return;
+        if (opts.scope && opts.scope.count(opts.scope.decide(event)) !== "ours") {
+            report.foreignSkipped++;
+            return;
+        }
+        report.seen++;
+        if (off)
+            return;
+        // Code Mode reaches the SAME browser through `tools.browser.tabs.open(...)`, and an
+        // inner call may never surface as its own execute.before event — so a gate that only
+        // reads `input.url` can be walked around by putting the navigate inside a program.
+        // The address red line is the part worth defending there: a program is source text,
+        // and the hosts it names are judgement-free metadata ranges.
+        if (isExecute) {
+            const program = event?.input?.program;
+            if (typeof program === "string" && /browser[._]|browser_/.test(program)) {
+                for (const host of hardUrlHosts(program)) {
+                    report.classified++;
+                    report.refused++;
+                    report.codeModeRefused++;
+                    const message = `你放进 execute 程序里的浏览器调用指向 ${host}，那是不容路由 / 元数据地址段——R6 同级红线，任何配置都不能批准，` +
+                        `所以我没有让这个程序跑起来。要本机服务请用有头浏览器自己开，要公网内容请给公开主机名。`;
+                    pending.set(keyOf(tool, event?.sessionID), { message, at: Date.now() });
+                    throw new Error(message);
+                }
+            }
+            return;
+        }
+        const target = targetOf(event?.input);
+        if (!target)
+            return;
+        report.classified++;
+        report.byTool[tool] ??= { seen: 0, refused: 0, leaked: 0 };
+        report.byTool[tool].seen++;
+        const message = decide(target);
+        if (!message)
+            return;
+        report.refused++;
+        report.byTool[tool].refused++;
+        pending.set(keyOf(tool, event?.sessionID), { message, at: Date.now() });
+        // Layer 1. Thrown rather than returned: the input is mutable, but silently
+        // rewriting a URL the model chose is the guesswork this product refuses — the
+        // model has to see the refusal, and the host has to be the one that surfaces it.
+        throw new Error(message);
+    };
+    const fireAfter = (raw) => {
+        const event = raw;
+        const tool = String(event?.tool ?? event?.name ?? "");
+        const isExecute = tool === "execute";
+        if (!isExecute && !isNativeBrowserTool(tool))
+            return;
+        if (off)
+            return;
+        // No scope re-check here: the owner question was answered at the door, and a
+        // foreign session never has a pending refusal for this lookup to match.
+        const key = keyOf(tool, event?.sessionID);
+        const owed = pending.get(key);
+        let stripped = false;
+        if (owed) {
+            pending.delete(key);
+            const now = Date.now();
+            if (now - owed.at > LEAK_WINDOW_MS) {
+                report.held++;
+            }
+            else {
+                // Layer 2: the host produced an answer to a call we refused. Take the content out
+                // and put the refusal in its place — the model must never read a page our policy
+                // says it may not, and a silent pass would be the exact claim we cannot make.
+                report.leaked++;
+                if (report.byTool[tool])
+                    report.byTool[tool].leaked++;
+                const found = locatableText(event?.result);
+                stripped = !!found;
+                if (found) {
+                    found.parts[found.index] = {
+                        type: "text",
+                        text: `${owed.message}
+
+（这道门禁本来是在请求前生效的：${tool} 的调用被宿主放过去了，所以我把它的返回换成了这段拒绝语。这个页面的内容没有进入上下文、run store 或轨迹；请求本身已经发生，这一条我没有能力撤回。）`,
+                    };
+                    for (let i = found.index + 1; i < found.parts.length; i++) {
+                        const p = found.parts[i];
+                        if (p && typeof p === "object" && p.type === "text" && typeof p.text === "string")
+                            found.parts[i] = { type: "text", text: "" };
+                    }
+                }
+            }
+        }
+        // Once per session, at the result where the confusion actually happened: the host's
+        // browser surface differs from tm_browser's in ways that each cost a round in the
+        // user's real-task log (a guessed `snap.text`, an `fn` argument that is really
+        // `script`, a function source that reads as `{}`, a screenshot retried after `focus`,
+        // a `wait` state the host rejects, a MediaWiki URL guessed instead of the site's own
+        // search). This is the cheapest place to say it — the tool description is the host's,
+        // and the prompt would charge every role for text only the browsing ones use. The
+        // Code Mode shape is why `execute` is included: the model drives the browser through
+        // `tools.browser.*` there and never sees a `browser_*` tool call at all.
+        if (stripped)
+            return;
+        const sid = String(event?.sessionID ?? "");
+        const wantsNote = isExecute
+            ? droveBrowser(event?.result)
+            : wantsReadingNote(tool);
+        if (!sid || annotated.has(sid) || !wantsNote)
+            return;
+        const found = locatableText(event?.result);
+        if (!found)
+            return;
+        annotated.add(sid);
+        report.annotated++;
+        found.parts[found.index] = { type: "text", text: `${found.text}\n\n${NATIVE_BROWSER_NOTE}` };
+    };
+    const toolDomain = ctx?.tool;
+    if (typeof toolDomain?.hook === "function") {
+        const hook = toolDomain.hook;
+        for (const [name, cb] of [
+            ["execute.before", fireBefore],
+            ["execute.after", fireAfter],
+        ]) {
+            try {
+                const reg = hook(name, cb);
+                // The host's transform/hook registrars are async; hold the promise so teardown
+                // can await it rather than disposing a registration that never landed.
+                registrations.push({
+                    dispose: async () => {
+                        try {
+                            await reg.then?.((r) => r?.dispose?.());
+                        }
+                        catch {
+                            /* a host that already tore down its registry has nothing left to free */
+                        }
+                    },
+                });
+            }
+            catch {
+                /* a host that refuses the hook is reported by the capability probe, not here */
+            }
+        }
+    }
+    // Sweep refusals that never saw an answer: the door held (the call was aborted and
+    // nothing came back), which is the good case and still has to be counted.
+    const sweeper = setInterval(() => {
+        const now = Date.now();
+        for (const [k, v] of pending) {
+            if (now - v.at > LEAK_WINDOW_MS) {
+                pending.delete(k);
+                report.held++;
+            }
+        }
+    }, LEAK_WINDOW_MS);
+    if (typeof sweeper === "object" && sweeper && "unref" in sweeper)
+        sweeper.unref?.();
+    // The host reloads plugins IN THIS PROCESS, so an interval that outlives teardown is
+    // not a harmless one: every boot would add another sweeper counting the same
+    // refusals. Clearing it is part of releasing the registration, not a nicety.
+    registrations.push({
+        dispose: async () => {
+            clearInterval(sweeper);
+        },
+    });
+    return {
+        registrations,
+        report,
+        fireBefore,
+        fireAfter,
+    };
+}
+export function browserGateSummary(r) {
+    if (!r.seen)
+        return "原生 browser_* 没被调用过（门禁在场，没数据）";
+    const teeth = r.refused === 0 ? "没有拒绝发生过" : r.leaked === 0 ? `${r.refused} 次拒绝全部拦停在门口` : `${r.refused} 次拒绝中 ${r.leaked} 次被宿主放过去（已在返回处换成拒绝语）`;
+    return `原生 browser_*/Code Mode：看过 ${r.seen} 次调用（其中 Code Mode 程序拒绝 ${r.codeModeRefused} 次） · 可判定目标 ${r.classified} 次 · 拒绝 ${r.refused} 次（${teeth}）· 拦下后无返回 ${r.held} 次 · 非 Team 跳过 ${r.foreignSkipped} 次 · 原生读法提示发了 ${r.annotated} 个会话`;
+}
+//# sourceMappingURL=v2-browser-gate.js.map

package/dist/host/v2-browser-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-browser-gate.js","sourceRoot":"","sources":["../../src/host/v2-browser-gate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;+EAC+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B;gEACgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAC9B,qEAAqE;IACrE,oFAAoF;IACpF,0DAA0D;IAC1D,4EAA4E;IAC5E,mEAAmE;IACnE,6DAA6D;IAC7D,4DAA4D,CAAA;AAmC9D,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,OAAO,GAAI,MAAgC,EAAE,OAAO,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAgB,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,CAAgB,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;IACrJ,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAe,CAAA;IACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAA;AACjE,CAAC;AAED;;0EAE0E;AAC1E,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACnE,CAAC;AAED;;iEAEiE;AACjE,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAI,MAAoE,EAAE,QAAQ,EAAE,SAAS,CAAA;IACxG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAE,CAAwB,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED;;;;+EAI+E;AAC/E,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AACnD,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;2DAE2D;AAC3D,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,GAAG,GAAG,KAAkF,CAAA;IAC9F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAU,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IACpG,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;gFAEgF;AAChF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,IAIC;IAED,MAAM,MAAM,GAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC7J,MAAM,aAAa,GAAqB,EAAE,CAAA;IAC1C,4EAA4E;IAC5E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAA;IAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAEzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,SAAkB,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAA;IAEzF,MAAM,MAAM,GAAG,CAAC,MAA+C,EAAiB,EAAE;QAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,4EAA4E;YAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChC,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,qDAAqD;gBAClF,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACzD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAC5C,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,GAAY,EAAQ,EAAE;QACxC,MAAM,KAAK,GAAG,GAAuG,CAAA;QACrH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACrD,2EAA2E;QAC3E,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAA;QACpC,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAM;QACpD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAiD,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACpH,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAA;QACb,IAAI,GAAG;YAAE,OAAM;QACf,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,oFAAoF;QACpF,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAI,KAAK,EAAE,KAA2C,EAAE,OAAO,CAAA;YAC5E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzC,MAAM,CAAC,UAAU,EAAE,CAAA;oBACnB,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,MAAM,CAAC,eAAe,EAAE,CAAA;oBACxB,MAAM,OAAO,GACX,2BAA2B,IAAI,sCAAsC;wBACrE,6CAA6C,CAAA;oBAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;oBACvE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC1B,CAAC;YACH,CAAC;YACD,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,CAAC,UAAU,EAAE,CAAA;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACvE,2EAA2E;QAC3E,8EAA8E;QAC9E,iFAAiF;QACjF,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,GAAY,EAAQ,EAAE;QACvC,MAAM,KAAK,GAAG,GAAwG,CAAA;QACtH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAA;QACpC,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAM;QACpD,IAAI,GAAG;YAAE,OAAM;QACf,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,EAAE,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,kFAAkF;gBAClF,iFAAiF;gBACjF,8EAA8E;gBAC9E,MAAM,CAAC,MAAM,EAAE,CAAA;gBACf,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;gBACrD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBAC1C,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAA;gBAClB,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;wBACzB,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO;;kBAEf,IAAI,iFAAiF;qBAC5F,CAAA;oBACD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAsB,CAAA;wBAC7C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;4BAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;oBAChI,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,oFAAoF;QACpF,kFAAkF;QAClF,+EAA+E;QAC/E,sFAAsF;QACtF,qFAAqF;QACrF,sFAAsF;QACtF,kFAAkF;QAClF,qFAAqF;QACrF,yEAAyE;QACzE,IAAI,QAAQ;YAAE,OAAM;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,SAAS;YACzB,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAC7B,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS;YAAE,OAAM;QACpD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClB,MAAM,CAAC,SAAS,EAAE,CAAA;QAClB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,mBAAmB,EAAE,EAAE,CAAA;IAC9F,CAAC,CAAA;IAED,MAAM,UAAU,GAAI,GAAwD,EAAE,IAAI,CAAA;IAClF,IAAI,OAAO,UAAU,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAA2E,CAAA;QACnG,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACvB,CAAC,gBAAgB,EAAE,UAAU,CAAC;YAC9B,CAAC,eAAe,EAAE,SAAS,CAAC;SACpB,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC1B,+EAA+E;gBAC/E,uEAAuE;gBACvE,aAAa,CAAC,IAAI,CAAC;oBACjB,OAAO,EAAE,KAAK,IAAI,EAAE;wBAClB,IAAI,CAAC;4BACH,MAAO,GAA+B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;wBACtE,CAAC;wBAAC,MAAM,CAAC;4BACP,yEAAyE;wBAC3E,CAAC;oBACH,CAAC;iBACF,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,0EAA0E;IAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACjB,MAAM,CAAC,IAAI,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE,cAAc,CAAC,CAAA;IAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO;QAAG,OAAkC,CAAC,KAAK,EAAE,EAAE,CAAA;IAC/G,qFAAqF;IACrF,6EAA6E;IAC7E,6EAA6E;IAC7E,aAAa,CAAC,IAAI,CAAC;QACjB,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,aAAa,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO;QACL,aAAa;QACb,MAAM;QACN,UAAU;QACV,SAAS;KACV,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,8BAA8B,CAAA;IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,sBAAsB,CAAA;IAC5I,OAAO,6BAA6B,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,eAAe,eAAe,CAAC,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,cAAc,iBAAiB,CAAC,CAAC,SAAS,MAAM,CAAA;AACxO,CAAC"}

package/dist/host/v2-capabilities.d.ts

@@ -0,0 +1,78 @@
+import type { CapabilityRow } from "../capabilities.js";
+/**
+ * The host-capability matrix, built from what THIS v2 session observed.
+ *
+ * v1's probe can classify a seam as `ok` by watching a hook fire or an event
+ * arrive.  v2 needs the same table even more — a 2.x host is moving under us, and
+ * every promise on this line (per-role tool trim, JIT over native tools, the
+ * address red line, the forced background) lives or dies on a hook the host may or
+ * may not call.  What it must NOT do is reuse v1's row list: those seam names are
+ * v1's SDK, and a row that says "declared" because a type file mentions a name is
+ * worth nothing when the host never calls it (that is precisely how the invented
+ * `session.hook("prompt")` nearly got built on).
+ *
+ * So every row here is derived from an observation the runtime already made — the
+ * probe's attached/missing sets, the guard's and offloader's counters — and a row
+ * that we merely know from types says `declared` and names the missing proof.
+ */
+interface Inputs {
+    ctx: unknown;
+    probe: {
+        report: {
+            ctxDomains: string[];
+            hooksMissing: string[];
+            executed: string[];
+            executedAfter: string[];
+            actions: string[];
+            evaluations: number;
+            agentsSeen: string[];
+        };
+    };
+    guardsInstalled: boolean;
+    backgroundForced: boolean;
+    offload: {
+        active: boolean;
+        registrations: unknown[];
+        report: {
+            seen: number;
+            offloaded: number;
+        };
+    };
+    sessionHooks: number;
+    temperature: number | false | null;
+    hasTodoSeam: boolean;
+    hasAsk: boolean;
+    /** what the boot round-trip self-check found: absent | round-trip | read-back-mismatch | threw */
+    storageState: string;
+    /** Team-scope isolation (#22): how many hook events resolved to one of our six
+     *  roles, how many were somebody else's, and how many the host never told us. */
+    scope?: {
+        report: {
+            ours: number;
+            foreign: number;
+            unknown: number;
+        };
+    };
+    /** The `ctx.event.subscribe()` feed (#8).  `received` is the observation that
+     *  makes this row `ok` rather than `declared`: an event that actually arrived. */
+    eventFeed?: {
+        active: boolean;
+        received: number;
+        forwarded: number;
+        unknown: Record<string, number>;
+        stopped?: string;
+    };
+    /** #33 — what `tm_join { cancel: true }` actually got from `ctx.session.interrupt`.
+     *  Absent means the bridge never wrapped the seam, which is itself the row's story:
+     *  for a whole release v2 had no stop path at all, and nothing printed that fact. */
+    stop?: {
+        tried: number;
+        confirmed: number;
+        refused: number;
+        unknown: number;
+        error?: string;
+    };
+}
+export declare function v2CapabilityRows(i: Inputs): CapabilityRow[];
+export {};
+//# sourceMappingURL=v2-capabilities.d.ts.map

package/dist/host/v2-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-capabilities.d.ts","sourceRoot":"","sources":["../../src/host/v2-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;;;;;;;;;GAeG;AAEH,UAAU,MAAM;IACd,GAAG,EAAE,OAAO,CAAA;IACZ,KAAK,EAAE;QACL,MAAM,EAAE;YACN,UAAU,EAAE,MAAM,EAAE,CAAA;YACpB,YAAY,EAAE,MAAM,EAAE,CAAA;YACtB,QAAQ,EAAE,MAAM,EAAE,CAAA;YAClB,aAAa,EAAE,MAAM,EAAE,CAAA;YACvB,OAAO,EAAE,MAAM,EAAE,CAAA;YACjB,WAAW,EAAE,MAAM,CAAA;YACnB,UAAU,EAAE,MAAM,EAAE,CAAA;SACrB,CAAA;KACF,CAAA;IACD,eAAe,EAAE,OAAO,CAAA;IACxB,gBAAgB,EAAE,OAAO,CAAA;IACzB,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;IACnG,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,OAAO,CAAA;IACf,kGAAkG;IAClG,YAAY,EAAE,MAAM,CAAA;IACpB;qFACiF;IACjF,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;IACtE;sFACkF;IAClF,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvH;;yFAEqF;IACrF,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9F;AAID,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA6K3D"}

package/dist/host/v2-capabilities.js

@@ -0,0 +1,173 @@
+const has = (list, want) => list.some(want);
+export function v2CapabilityRows(i) {
+    const domains = i.probe.report.ctxDomains;
+    const missing = i.probe.report.hooksMissing;
+    const saw = (point) => !missing.some((m) => m.includes(point));
+    const rows = [
+        {
+            seam: 'session.hook("context")',
+            feature: "每个角色不再被 DENY 的工具从请求里删掉 · 温度 0.2 · 黑板根目录送给 lead",
+            state: i.probe.report.agentsSeen.length ? "ok" : i.sessionHooks ? "declared" : "missing",
+            evidence: "hook",
+            note: i.probe.report.agentsSeen.length
+                ? `已在这些角色的请求上跑过：${i.probe.report.agentsSeen.join(" ")}`
+                : "挂上了，但本进程还没等到一次请求——升级后先看这一行有没有变成 ok",
+        },
+        {
+            seam: 'session.hook("compaction")',
+            feature: "压缩后仍然活着的清单（回复骨架 / 卸载句柄 / 未结算子代理 id / 黑板路径）",
+            state: saw("compaction") ? "declared" : "missing",
+            evidence: "static",
+            note: "v2 只在真正压缩前调用它，插件无法自己制造一次，所以这里最多是 declared，不是 ok",
+        },
+        {
+            seam: 'tool.hook("execute.before")',
+            feature: "每次 subagent 派发强制 background（前台会把 lead 整轮钉住）",
+            state: i.probe.report.executed.length ? "ok" : i.backgroundForced ? "declared" : "missing",
+            evidence: "hook",
+            note: i.probe.report.executed.length ? `见过的工具：${i.probe.report.executed.join(" ")}` : undefined,
+        },
+        {
+            seam: 'tool.hook("execute.after")',
+            feature: "JIT 上下文治理覆盖宿主自己的工具（原生 read/shell/webfetch 与 Code Mode 的大输出不再直接进上下文）",
+            state: i.offload.registrations.length === 0 ? "missing" : i.offload.report.offloaded > 0 ? "ok" : i.offload.report.seen > 0 ? "ok" : "declared",
+            evidence: "runtime",
+            note: i.offload.report.seen
+                ? `本进程已看 ${i.offload.report.seen} 次原生结果，其中 ${i.offload.report.offloaded} 次被卸载`
+                : "缝挂上了，还没遇到一次够大的原生输出（这不是坏消息，但要等真遇到才算 ok）",
+        },
+        {
+            seam: 'permission.hook("evaluate")',
+            feature: "egress 红线（元数据/链路本地/私网）套到宿主原生 webfetch · 按命令行判定的 R6",
+            state: i.guardsInstalled ? (i.probe.report.evaluations > 0 ? "ok" : "declared") : "missing",
+            evidence: "hook",
+            note: i.probe.report.evaluations > 0 ? `看到 ${i.probe.report.evaluations} 次评估，动作：${i.probe.report.actions.join(" ") || "无"}` : i.guardsInstalled ? "挂上了但还没被调用过" : undefined,
+        },
+        {
+            seam: "工具 ctx.ask（宿主官方确认框）",
+            feature: "白名单外的目标逐次征求你的同意 · v2 上退化为直接拒绝",
+            state: i.hasAsk ? "declared" : "missing",
+            evidence: "runtime",
+            note: i.hasAsk ? undefined : "2.0.16 的 ToolContext 不带 ask（实测：我们自己在工具 options 里声明 permission 也没触发评估）。受治理的调用因此一律 fail closed，这是这个平台的事实，不是我们的选择",
+        },
+        {
+            seam: "宿主 session 树（children / todo / messages）",
+            feature: "tm_join 收子代理结果 · 目标探针读宿主清单",
+            state: i.probe.report.ctxDomains.includes("session") ? "not-seen" : "missing",
+            evidence: "runtime",
+            note: i.probe.report.ctxDomains.includes("session")
+                ? "ctx 有 session 域，但我们尚未从中读到子会话/清单（v1 客户端那套 API 形状在 v2 未验；tm_join 现在会明说这一格没查成）"
+                : undefined,
+        },
+        {
+            seam: "ctx.event.subscribe() → 事件流",
+            feature: "看见别的会话发生了什么（结算、注入、跨会话信号）",
+            state: !i.eventFeed
+                ? domains.includes("event")
+                    ? "declared"
+                    : "missing"
+                : i.eventFeed.received > 0
+                    ? "ok"
+                    : i.eventFeed.active
+                        ? "not-seen"
+                        : "missing",
+            // Counted, not asserted: `active` only means subscribe() returned
+            // something iterable.  `received > 0` is the observation that a 2.x host
+            // really does push session events at a plugin, which is what tm_join's
+            // settle detection needed and never had (#8).
+            evidence: i.eventFeed && i.eventFeed.received > 0 ? "event" : "static",
+            // This row used to say the opposite — that the public shape needed an Effect
+            // runtime and therefore could not be used with our empty `dependencies`. A
+            // live 2.0.16 probe disproved it, so the correction is the whole point: the
+            // seam is reachable with zero dependencies, and the catch is not the
+            // dependency but the scope (server-wide, every session's events).
+            note: "实测（docs/research/agent-data-exchange.md）：subscribe() 零依赖可用，但流是**全服务器**的 —— 用它必须先按 sessionID 过滤，否则会把别人会话的事件读进我们的上下文与轨迹",
+        },
+        {
+            seam: "ctx.storage",
+            feature: "LEDGER 的落点（v2 没有 todowrite）",
+            // Four facts, and only one of them is "fine": the round-trip proved it, an
+            // absent domain is not there to build on, a probe that threw or came back
+            // different is a failure (NOT `not-seen`, which would read as "haven't got
+            // round to it yet"), and `declared` is reserved for the one case where the
+            // domain exists and nothing has been tried — which is exactly what it means.
+            state: i.storageState === "round-trip"
+                ? "ok"
+                : i.storageState === "absent" || i.storageState === "threw" || i.storageState === "read-back-mismatch"
+                    ? "missing"
+                    : domains.includes("storage")
+                        ? "declared"
+                        : "missing",
+            evidence: "runtime",
+            note: i.storageState === "round-trip"
+                ? "启动自检写入标记并读回成功 —— 清单可以落在这里"
+                : i.storageState === "absent"
+                    ? "这个宿主没给 storage 域"
+                    : i.storageState === "threw" || i.storageState === "read-back-mismatch"
+                        ? `自检没通过（${i.storageState}）：域在，但我们写的东西没有原样回来`
+                        : "域在，本次启动还没往里写过东西",
+        },
+        {
+            seam: "Team 作用域隔离",
+            feature: "每个钩子动手之前先问「这是我们六个角色吗」——不是就完全别碰（build / plan / 用户自己的 agent 保持刚装好 OpenCode 的样子）",
+            // ok only means what it says: a resolved call was actually skipped or served.
+            // `unknown` is not a pass — it is the host not telling us who owns the call,
+            // and every one of those is a call our governance deliberately did NOT touch.
+            state: !i.scope ? "declared" : i.scope.report.unknown ? "unverified" : "ok",
+            evidence: "runtime",
+            note: !i.scope
+                ? "本进程的钩子还没被调用过，没东西可判"
+                : ` ours=${i.scope.report.ours} foreign=${i.scope.report.foreign} unknown=${i.scope.report.unknown}` +
+                    (i.scope.report.unknown
+                        ? " —— 这些次宿主没在事件里带 agent：按「不是我们的」处理，宁可少治理，也不多改别人的会话"
+                        : ""),
+        },
+    ];
+    // #33 — can the lead STOP a background child at all? Before this the answer was "no",
+    // and no row said so: tm_join's cancel:true fell through to 宿主无 abort 接口 in a tool
+    // reply only the model sees, so a user asking "kill it" got silence from the panel and
+    // the plugin's own capability table claimed nothing about it.
+    rows.push({
+        seam: "ctx.session.interrupt",
+        feature: "tm_join { cancel: true } 停掉跑飞的后台子代理",
+        // `ok` requires the host to have confirmed a stop with interrupted=true. attempted-but-
+        // never-confirmed is `declared`: the seam is wired, nobody has exercised it. An absent
+        // interrupt domain is `missing`, which is the honest row for "this host gave no stop
+        // path" and the only way a future upgrade that drops it becomes a line rather than a
+        // rumour.
+        state: !i.stop
+            ? "declared"
+            : i.stop.confirmed > 0
+                ? "ok"
+                : i.stop.tried > 0
+                    ? "declared"
+                    : domains.includes("session")
+                        ? "declared"
+                        : "missing",
+        evidence: i.stop && i.stop.confirmed > 0 ? "runtime" : "static",
+        note: i.stop && i.stop.tried
+            ? `已试 ${i.stop.tried} 次：宿主确认中断 ${i.stop.confirmed} · idle no-op ${i.stop.refused} · 未回布尔 ${i.stop.unknown}` +
+                (i.stop.error ? `（最后一次宿主错误：${i.stop.error}）` : "")
+            : "缝已接上（POST /api/session/{id}/interrupt 的契约是 interrupted=true / false=idle no-op），本进程还没被 cancel:true 用过",
+    });
+    if (typeof i.temperature === "number") {
+        rows.push({
+            seam: "options.temperature",
+            feature: "所有角色 0.2（v2 上 agent 配置里的 temperature 是 legacy 字段、runner 不发，所以只能走请求层）",
+            state: i.probe.report.agentsSeen.length ? "ok" : "declared",
+            evidence: "runtime",
+            note: `本进程请求里带的温度：${i.temperature}`,
+        });
+    }
+    if (!i.hasTodoSeam) {
+        rows.push({
+            seam: "GET /session/{id}/todo",
+            feature: "目标探针（清单还有未完成项时不许把该轮当收尾）",
+            state: "missing",
+            evidence: "runtime",
+            note: "v2 的 client 垫片没有这个端点；tm_join 现在会明说'这一轮目标核对没做成'，而不是沉默",
+        });
+    }
+    return rows;
+}
+//# sourceMappingURL=v2-capabilities.js.map

package/dist/host/v2-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-capabilities.js","sourceRoot":"","sources":["../../src/host/v2-capabilities.ts"],"names":[],"mappings":"AAqDA,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAE,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEtF,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAA;IACzC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAA;IAC3C,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACtE,MAAM,IAAI,GAAoB;QAC5B;YACE,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,gDAAgD;YACzD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACxF,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;gBACpC,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACvD,CAAC,CAAC,oCAAoC;SACzC;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjD,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,iDAAiD;SACxD;QACD;YACE,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,6CAA6C;YACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC1F,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SAChG;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,qEAAqE;YAC9E,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC/I,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;gBACzB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,OAAO;gBAC9E,CAAC,CAAC,wCAAwC;SAC7C;QACD;YACE,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,oDAAoD;YAC7D,KAAK,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC3K;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,+BAA+B;YACxC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACxC,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gHAAgH;SAC9I;QACD;YACE,IAAI,EAAE,0CAA0C;YAChD,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC7E,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,SAAS;SACd;QACD;YACE,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;gBACf,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACzB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;gBACb,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM;wBAClB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS;YACnB,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,8CAA8C;YAC9C,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YACtE,6EAA6E;YAC7E,2EAA2E;YAC3E,4EAA4E;YAC5E,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,EAAE,uHAAuH;SAC9H;QACD;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6BAA6B;YACtC,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,6EAA6E;YAC7E,KAAK,EACH,CAAC,CAAC,YAAY,KAAK,YAAY;gBAC7B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,oBAAoB;oBACpG,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC3B,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,IAAI,EACF,CAAC,CAAC,YAAY,KAAK,YAAY;gBAC7B,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ;oBAC3B,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,oBAAoB;wBACrE,CAAC,CAAC,SAAS,CAAC,CAAC,YAAY,oBAAoB;wBAC7C,CAAC,CAAC,iBAAiB;SAC5B;QACD;YACE,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,+EAA+E;YACxF,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YAC3E,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK;gBACZ,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,kDAAkD;wBACpD,CAAC,CAAC,EAAE,CAAC;SACZ;KACF,CAAA;IACD,sFAAsF;IACtF,mFAAmF;IACnF,uFAAuF;IACvF,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,qCAAqC;QAC9C,wFAAwF;QACxF,uFAAuF;QACvF,qFAAqF;QACrF,qFAAqF;QACrF,UAAU;QACV,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;YACZ,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC;gBACpB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;oBAChB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC3B,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC/D,IAAI,EACF,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK;YACpB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,iBAAiB,CAAC,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE;gBACzG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,uGAAuG;KAC9G,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC3D,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE;SACpC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,yBAAyB;YAClC,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,sDAAsD;SAC7D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}