@sema-agent/server 3.19.0 → 3.20.0

package/dist/boot/stores.js

@@ -304,12 +304,14 @@ export async function openStores(ctx) {
         }
     }
     const sessionStore = createSessionStore(config, backend, metrics); // S25: stale-affinity evict fingerprint
-    // S6 startup guard: multi-tenant isolation needs an owner-aware (TiDB) store. Refuse to start with
-    // REQUIRE_PRINCIPAL on an in-memory store that can't enforce session ownership.
-    if (config.requirePrincipal && !sessionStore.ownerOf) {
-        throw new Error("REQUIRE_PRINCIPAL=true needs an owner-aware session store (SESSION_BACKEND=tidb); " +
-            "the in-memory store cannot enforce session ownership.");
-    }
+    // 🪦 S6 启动门(旧):判据曾是 `!sessionStore.ownerOf`,core 2.11.0 给 TtlSessionStore 补了 owner 面后**恒假**。
+    //    2026-08-01 复审一度把判据改成「归属能否跨重启存活」以复活它 —— **那是错的,已撤**(cli [C46] 的
+    //    多租真机围栏当场证伪:`REQUIRE_PRINCIPAL=true` + 内存店必须**起得来**且真隔离)。
+    //    错在威胁模型:内存店重启后**会话数据本身也没了**,"先到者认领 session id" 认领到的是空壳,
+    //    alice 的历史随进程消失 —— 归属丢失 ≠ 数据泄露。真正危险的是**数据留存而归属丢失**的 file 形,
+    //    那一形由下面那道 local 门拦住(它的论证里 "session/run CONTENT is durable there" 正是这个区别)。
+    //    ⇒ 这道门防的威胁(store 没有归属能力)已被 core 2.11.0 消除,补偿该撤,不该换个判据续命。
+    //    判据跟目的走、不跟补偿走(cli [C46] 的原话,我抄下)。反向钉见 test/security.test.ts。
     // The local in-memory backend HAS an ownerOf (LocalSessionStore), so the guard above passes — but its owner map is
     // process-local + lost on restart, so it cannot DURABLY enforce multi-tenant ownership (post-restart a session id is
     // re-claimable by whoever attaches first). Refuse REQUIRE_PRINCIPAL on it: a real multi-tenant

package/dist/capabilities/scenarios.d.ts

@@ -1,4 +1,4 @@
-import { type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
+import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
 import type { Metrics } from "../observability/metrics.js";
 import type { Logger } from "../observability/logger.js";
 import { GiteaClient } from "./repo-tools.js";
@@ -42,7 +42,7 @@ export interface ScenarioDeps {
      *  main.ts 构造一次注入)。在场 ⇒ 装配实参携 `webFetch.summarize`——带 prompt 的 WebFetch 走 cheap
      *  模型摘要而非整页灌上下文([1870] L1 的 ~660× 放大就是这缝);缺席 ⇒ `webFetch` 键不铸(修前
      *  字节形,core 落「summarization unavailable」诚实兜底)。 */
-    webFetchSummarize?: (content: string, prompt: string, signal?: AbortSignal) => Promise<string>;
+    webFetchSummarize?: NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
     metrics?: Metrics;
     logger?: Logger;
     /** OA backend coordinates for the `oa` scenario (read /api/v1, write /api/assets). */

package/dist/config.d.ts

@@ -11,6 +11,20 @@ export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat
  *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
+/** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
+ *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
+export declare function numEnv(name: string, fallback: string): number;
+/**
+ * 数值 env 的核心判据,**接受 raw 值**(而非自己去读 process.env),这样注入式配置也能复用同一条判据。
+ *
+ * 提出来的理由(2026-08-01 gap-sweep):`leader/wire.ts` 的四个资源旋钮各自手写了
+ * `Number(x) || default`,因为 numEnv 只会读 process.env、够不到它们注入进来的 env 对象。
+ * 结果是同一个失败模式在另一处复发,而且**回落方向更坏**:那边落到的是慷慨的默认值,
+ * 症状从「设了没生效」变成「想收紧却被松绑」。判据只有一份,谁都能调,才不会各写各的。
+ *
+ * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
+ */
+export declare function parseNumOrFail(name: string, raw: string | undefined): number;
 export declare function drainConfigWarnings(): Array<{
     env: string;
     raw: string;

package/dist/config.js

@@ -73,8 +73,22 @@ function env2(primary, alias, fallback) {
 }
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
-function numEnv(name, fallback) {
-    const raw = env(name, fallback);
+export function numEnv(name, fallback) {
+    return parseNumOrFail(name, env(name, fallback));
+}
+/**
+ * 数值 env 的核心判据,**接受 raw 值**(而非自己去读 process.env),这样注入式配置也能复用同一条判据。
+ *
+ * 提出来的理由(2026-08-01 gap-sweep):`leader/wire.ts` 的四个资源旋钮各自手写了
+ * `Number(x) || default`,因为 numEnv 只会读 process.env、够不到它们注入进来的 env 对象。
+ * 结果是同一个失败模式在另一处复发,而且**回落方向更坏**:那边落到的是慷慨的默认值,
+ * 症状从「设了没生效」变成「想收紧却被松绑」。判据只有一份,谁都能调,才不会各写各的。
+ *
+ * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
+ */
+export function parseNumOrFail(name, raw) {
+    if (raw === undefined)
+        return NaN;
     const n = Number(raw);
     if (!Number.isFinite(n))
         throw new Error(`env ${name}="${raw}" must be a number`);

package/dist/http/server.js

@@ -5,7 +5,7 @@ import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, Checkpoin
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof } from "../security.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof, isDestructiveSessionWrite } from "../security.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
@@ -533,32 +533,16 @@ export function createHttpServer(rawDeps) {
             sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
             return;
         }
-        // E6 (review): the operator session-policy PUT is a mutating operator-gated write — apply the SAME fail-closed
-        // no-service-token guard as the POST submit paths (an un-authed worker must not accept policy writes from anything
-        // in-cluster; without it a forged principal header alone could tighten/DoS a session's tools).
-        if (req.method === "PUT" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            /^\/v1\/sessions\/[^/]+\/policy$/.test(url)) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting session-policy writes");
-            return;
-        }
-        // 🔴 E6 的**兄弟路径**(2026-08-01 缝合审):上面那道门只挂在 policy 的 PUT 腿上,而 session-sync 的
-        // import 提交腿(`routes/session-sync.ts` 的 ② policy 段)对**同一个 sessionPolicyStore** 调 `putRules`。
-        // 该腿的授权门是 `sessionOwnerScopeForWrite`,在「无 service token + 未开 ALLOW_UNAUTHED_WRITES +
-        // 未开 REQUIRE_PRINCIPAL」这一形下是 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 走两阶段
-        // import,顺带重写它的 policy 规则。`operatorOk` 走 explicitOperatorOk(无 operator 名单时为 false)
-        // ⇒ 只能 tighten 不能放宽 —— 但上面那道门自己写明的威胁就是「forged principal 可以 **tighten/DoS**
-        // 一个会话的工具」,严丝合缝落在同一句话上。
+        // E6 fail-closed:对**既有会话**的破坏性写,在「无 service token + 未开 ALLOW_UNAUTHED_WRITES」
+        // 这一形下一律拒。此形下 `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内任意调用方可对任意
+        // session 动手;policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」。
         //
-        // 拦在 **Phase A**(建 staging 之前),不是 Phase B:否则会先落一半状态再拒。
-        // 辖域取整条 import 而非只跳过 policy 段 —— 同一个理由:这一形下不信任调用方写 policy,就没有道理
-        // 信任它整段替换会话的 entries(import 的破坏面比 policy 更大)。
-        if (req.method === "POST" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            /^\/v1\/sessions\/[^/]+\/sync\/import$/.test(url)) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting a session-sync import");
+        // 🔴 2026-08-01 复审:这里原本是**逐条路由白名单**(PUT …/policy 与 POST …/sync/import 两块),
+        //    而 `DELETE /v1/sessions/:id`(删整条会话)**不在其中** —— 同一威胁形、爆炸半径更大却没门。
+        //    改成族判定(`isDestructiveSessionWrite`),新增破坏性会话路由自动落进门内。
+        //    import 腿仍拦在 **Phase A**(建 staging 之前),因为族判据匹配的就是那个 URL,不是 Phase B。
+        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
         // design/158 A9:能力/场景/模型目录域(routes/capabilities.ts)。位置=全局 service-credential 门之后、

package/dist/leader/wire.js

@@ -11,6 +11,7 @@
  * network; the MVP seeds the base from the Coordinator (no worker→remote net). MVP Planner = caller-provided
  * `subtasks` (an LLM DAG-planner is a follow-up).
  */
+import { parseNumOrFail } from "../config.js";
 import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -104,14 +105,19 @@ export async function stageWorkerEnv(env, opts) {
  * (URL) silently killed long autonomous builds or expired the diff upload mid-run. core's turn cap is now a
  * high net (10000), so the leader gives each worker an explicit triple bound; a sub-task's own limits override.
  */
+// 🔴 2026-08-01 gap-sweep:四个旋钮原为 `Number(x) || default` —— 非法值(`"20usd"`/`"1800000ms"`)
+// 得 NaN 后**静默落到慷慨的默认值**,方向是**松绑**:运维想把 worker 预算从 $100 收到 $20,实际拿到
+// $100(5 倍);想把寿命从 24h 收到 30min,实际拿到 24h,而 leaderTimeoutMs 还级联 presignTtlSec
+// ⇒ diff 上传预签名 URL 的暴露窗口一起放大。改走与 numEnv 同源的 parseNumOrFail:非法值当场报错。
+// 刻意**零行为变更**:`|| default` 保留,所以未设与显式 0 的既有语义一个没动。
 export function leaderResourceConfig(env = process.env) {
-    const leaderTimeoutMs = Math.max(600_000, Math.floor(Number(env.LEADER_TIMEOUT_MS ?? "0")) || 86_400_000); // default 24h (was 10min)
-    const workerMaxTurns = Math.floor(Number(env.LEADER_WORKER_MAX_TURNS ?? "0")) || 10_000;
-    const workerBudgetUsd = Number(env.LEADER_WORKER_BUDGET_USD ?? "0") || 100;
+    const leaderTimeoutMs = Math.max(600_000, Math.floor(parseNumOrFail("LEADER_TIMEOUT_MS", env.LEADER_TIMEOUT_MS) || 0) || 86_400_000); // default 24h (was 10min)
+    const workerMaxTurns = Math.floor(parseNumOrFail("LEADER_WORKER_MAX_TURNS", env.LEADER_WORKER_MAX_TURNS) || 0) || 10_000;
+    const workerBudgetUsd = (parseNumOrFail("LEADER_WORKER_BUDGET_USD", env.LEADER_WORKER_BUDGET_USD) || 0) || 100;
     const resourceSuspendOn = String(env.LEADER_RESOURCE_SUSPEND ?? "").toLowerCase() === "true";
     // Per-slice window: a fraction of the total so a worker suspends+resumes several times across its budget
     // (default = total/4, min $1). Smaller window ⇒ more, shorter slices ⇒ progress saved more often.
-    const sliceMaxCostUsd = Number(env.LEADER_WORKER_SLICE_BUDGET_USD ?? "0") || Math.max(1, workerBudgetUsd / 4);
+    const sliceMaxCostUsd = (parseNumOrFail("LEADER_WORKER_SLICE_BUDGET_USD", env.LEADER_WORKER_SLICE_BUDGET_USD) || 0) || Math.max(1, workerBudgetUsd / 4);
     return {
         leaderTimeoutMs,
         workerMaxTurns,

package/dist/main.js

@@ -7,7 +7,7 @@ import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
 import { subagentSendUserFileExtraTools } from "./capabilities/send-user-file-tool.js";
 import { brainSummary } from "./brain.js";
-import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv } from "./config.js";
+import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv, numEnv } from "./config.js";
 import { isPricingConfigured } from "./budget.js"; // 缝合审 M3:capabilities.pricingConfigured 的单一真源判据
 import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
 import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
@@ -362,7 +362,12 @@ async function main() {
     // Per-task wall-clock override (seconds). 0/absent = keep the built-in 600 (1500 council/debate/team) —
     // the override only ever RAISES (Math.max at the use site), so a misconfigured low value cannot shrink
     // the council budget.
-    const taskTimeoutSec = Math.max(0, Math.floor(Number(process.env.TASK_TIMEOUT_SEC ?? "0")) || 0);
+    // 🔴 2026-08-01 env fail-loud 族:原为 `Math.max(0, Math.floor(Number(env ?? "0")) || 0)` ——
+    // `TASK_TIMEOUT_SEC="3600s"`(带单位后缀,运维最常见的写法)得 NaN,再被 `|| 0` 折成 0,
+    // 而 0 在这里的语义是**无超时**。运维以为设了一小时上限,实际把超时关掉了,方向恰好相反,
+    // 且启动期零提示。改走 numEnv:非法值当场 fail-loud 并指名键与实际值。
+    // (numEnv 的注释早就预言了这个失败模式,只是它没 export、跨文件够不到,于是这两处手写了。)
+    const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
     // [854]④ per-request 配速的运营方上限旋钮(可选;缺省不设=不封顶):body.limits 每键各自被对应旋钮
     // Math.min 封顶(normalizeLimits)。多租部署想约束 caller 自报配速时才设;单用户 turnkey 通常留空。
     // ⚠️ 语义=只钳「显式请求值」,不是全队默认限额:body 缺席(或重放体里的非法值被 defensive DROP)⇒ 该键
@@ -552,6 +557,9 @@ async function main() {
     //  ② **fail-soft**:core resolveTaskModel 在无可解析角色时 throw,这是全仓唯一 boot 期裸调用;
     //     center 发一张既无 summarize 又无 default 的 roles 表就会拒启。解析失败 ⇒ 本次不摘要
     //     (core 的 summarize 抛错是 fail-open:回退原文+note),绝不崩 boot。
+    // core 2.13.0:返回形放宽为 additive union(`string | { text, truncated? }`)—— 这里**原样转发**
+    // core summarizer 的返回值,不在本仓收窄成 string(收窄会把 core 的截断披露 `truncated` 吃掉,
+    // 让「内容被截断」这个事实在 fence 外消失)。
     const webFetchSummarize = async (content, prompt, signal) => {
         const model = (() => {
             try {

package/dist/plugins/web-search.d.ts

@@ -90,6 +90,20 @@ export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) =
  * stays captured in this closure — it is never surfaced to the model or the tool args.
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
+/**
+ * `WEB_SEARCH_SEARXNG_PARAMS` / `settings.webSearch.searxngParams` 的解析 —— SearXNG 实例侧参数
+ * (`engines=` / `language=` 等)。
+ *
+ * 🔴 [2240] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
+ * 两条门都没有位置填它,于是我在 [2239] 说的「这条是给你们的」是句空话。单测直接构造
+ * `WebSearchBackendConfig` 传进去,**天然绕过了配置入口这一层**,于是「能力在」与「配得进」之间
+ * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
+ *
+ * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,
+ * 所以分隔符取 `;` 而不是 `,`。整串解析不出任何一对 ⇒ **返回 undefined,键整个不铸**
+ * (不产出空对象:空对象会让下游以为「配了但是空的」,与本仓「缺席就要缺席得干净」同源)。
+ */
+export declare function parseSearxngParams(raw: unknown): Record<string, string> | undefined;
 /**
  * #81④ 探活门控 —— **默认 OFF**,显式开才探。
  *

package/dist/plugins/web-search.js

@@ -152,11 +152,17 @@ async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
  * ⚠️ core adapter **不管**这三样,必须留在外层(换真源最容易丢的就是它们,已上红先钉):
  *   ① `maxResults` 截断 ② 统一形状 `{title,url,snippet}` ③ 坏 payload 观测器。
  */
-async function searxngSearch(fetchImpl, cfg, query, max, signal, opts) {
+async function searxngSearch(fetchImpl, cfg, query, max, signal, timeoutMs, opts) {
     if (!cfg.endpoint)
         throw new Error("WEB_SEARCH_ENDPOINT (the SearXNG instance URL) is required for the searxng provider");
+    // 🔴 timeoutMs 必须显式传:core 的 adapter 内部是 `options.timeoutMs ?? 10_000`,不传就用它自己的
+    //    10 秒。外层 createWebSearchBackend 那道 withTimeout 只在**更短**时先到 —— 部署方把
+    //    WEB_SEARCH_TIMEOUT_MS 设成大于 10s 的值(慢实例/自建 SearXNG 的常见需要)会被**静默封顶在 10s**,
+    //    而 3.18.0 的 CHANGELOG 还把 core「自带 timeout」当纯收益卖(见 3.20.0 的更正段)。
+    //    两层同值不冲突:内层是 adapter 自己的 AbortSignal.any,外层是本文件的 withTimeout。
     const search = createSearxngSearchBackend(cfg.endpoint, {
         fetchImpl,
+        timeoutMs,
         ...(cfg.searxngParams ? { extraParams: cfg.searxngParams } : {}),
     });
     let rows;
@@ -196,7 +202,7 @@ export function createWebSearchBackend(cfg) {
             switch (cfg.provider) {
                 case "brave": return await braveSearch(fetchImpl, cfg, q, maxResults, sig);
                 case "tavily": return await tavilySearch(fetchImpl, cfg, q, maxResults, sig, opts);
-                case "searxng": return await searxngSearch(fetchImpl, cfg, q, maxResults, sig, opts);
+                case "searxng": return await searxngSearch(fetchImpl, cfg, q, maxResults, sig, timeoutMs, opts);
             }
         }
         finally {
@@ -205,6 +211,41 @@ export function createWebSearchBackend(cfg) {
     };
     return { search, maxResults };
 }
+/**
+ * `WEB_SEARCH_SEARXNG_PARAMS` / `settings.webSearch.searxngParams` 的解析 —— SearXNG 实例侧参数
+ * (`engines=` / `language=` 等)。
+ *
+ * 🔴 [2240] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
+ * 两条门都没有位置填它,于是我在 [2239] 说的「这条是给你们的」是句空话。单测直接构造
+ * `WebSearchBackendConfig` 传进去,**天然绕过了配置入口这一层**,于是「能力在」与「配得进」之间
+ * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
+ *
+ * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,
+ * 所以分隔符取 `;` 而不是 `,`。整串解析不出任何一对 ⇒ **返回 undefined,键整个不铸**
+ * (不产出空对象:空对象会让下游以为「配了但是空的」,与本仓「缺席就要缺席得干净」同源)。
+ */
+export function parseSearxngParams(raw) {
+    if (typeof raw === "object" && raw !== null) {
+        // settings 门传的是已解析的表;只收「字符串→字符串」,任一值非字符串 ⇒ 整表不铸(不半吞)。
+        const entries = Object.entries(raw);
+        if (entries.length === 0 || entries.some(([, v]) => typeof v !== "string"))
+            return undefined;
+        return Object.fromEntries(entries);
+    }
+    if (typeof raw !== "string")
+        return undefined;
+    const out = {};
+    for (const pair of raw.split(";")) {
+        const i = pair.indexOf("=");
+        if (i <= 0)
+            continue;
+        const k = pair.slice(0, i).trim();
+        const v = pair.slice(i + 1).trim();
+        if (k && v)
+            out[k] = v;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 /**
  * #81④ 探活门控 —— **默认 OFF**,显式开才探。
  *
@@ -224,12 +265,14 @@ export function webSearchConfigFromEnv(env = process.env) {
     const provider = env.WEB_SEARCH_PROVIDER?.trim().toLowerCase();
     if (provider !== "brave" && provider !== "tavily" && provider !== "searxng")
         return undefined;
+    const searxngParams = parseSearxngParams(env.WEB_SEARCH_SEARXNG_PARAMS); // [2240] 部署 env 门
     const maxRaw = Number(env.WEB_SEARCH_MAX_RESULTS ?? "");
     const timeoutRaw = Number(env.WEB_SEARCH_TIMEOUT_MS ?? "");
     return {
         provider,
         ...(env.WEB_SEARCH_API_KEY ? { apiKey: env.WEB_SEARCH_API_KEY } : {}),
         ...(env.WEB_SEARCH_ENDPOINT ? { endpoint: env.WEB_SEARCH_ENDPOINT } : {}),
+        ...(searxngParams ? { searxngParams } : {}), // [2240] 解析不出任何一对 ⇒ 键整个不铸(不产出空对象)
         ...(Number.isFinite(maxRaw) && maxRaw > 0 ? { maxResults: Math.floor(maxRaw) } : {}),
         ...(Number.isFinite(timeoutRaw) && timeoutRaw > 0 ? { timeoutMs: Math.floor(timeoutRaw) } : {}),
     };
@@ -253,6 +296,12 @@ export function webSearchConfigFromSettings(raw) {
         provider,
         ...(typeof s.apiKey === "string" && s.apiKey ? { apiKey: s.apiKey } : {}),
         ...(typeof s.endpoint === "string" && s.endpoint ? { endpoint: s.endpoint } : {}),
+        // [2240]:与 endpoint **同门同辖域** —— 安全边界不在字段粒度,而在调用方把整条门 gate 到
+        // 单用户 host lane(见本函数头注的 SSRF 段)。单独把它挡在门外是个没有理由的例外。
+        ...(() => {
+            const p = parseSearxngParams(s.searxngParams);
+            return p ? { searxngParams: p } : {};
+        })(),
         ...(max ? { maxResults: max } : {}),
     };
 }

package/dist/run-local.js

@@ -31,7 +31,7 @@ import { createBrain } from "./brain.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
-import { loadConfig, logConfigDiagnostics } from "./config.js";
+import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -440,7 +440,12 @@ export async function runLocal(argv, deps = {}) {
     // wins with its raise-only floor (team 1500s — a multi-agent coordinator legitimately exceeds 600s).
     // [854]④ 不落此腿:per-request body.limits 是 HTTP body 车道(resolveTaskLimits,main.ts resolveSpec);
     // run-local 无 body,配速仍走 env(要 CLI flag 时另开件,别在这里半做)。
-    const taskTimeoutSec = Math.max(0, Math.floor(Number(process.env.TASK_TIMEOUT_SEC ?? "0")) || 0);
+    // 🔴 2026-08-01 env fail-loud 族:原为 `Math.max(0, Math.floor(Number(env ?? "0")) || 0)` ——
+    // `TASK_TIMEOUT_SEC="3600s"`(带单位后缀,运维最常见的写法)得 NaN,再被 `|| 0` 折成 0,
+    // 而 0 在这里的语义是**无超时**。运维以为设了一小时上限,实际把超时关掉了,方向恰好相反,
+    // 且启动期零提示。改走 numEnv:非法值当场 fail-loud 并指名键与实际值。
+    // (numEnv 的注释早就预言了这个失败模式,只是它没 export、跨文件够不到,于是这两处手写了。)
+    const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "team");
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
     const spec = {

package/dist/security.d.ts

@@ -23,6 +23,23 @@ export interface SessionListItem {
 /** A SessionStore that may additionally expose tenant-ownership ops (the TiDB store does) AND the
  *  `SessionRepo` enumeration/lifecycle seam (§0.5: list/fork/delete homed on the session abstraction's own
  *  tables, not the `task_run` runs ledger). All optional — an in-memory dev store implements none. */
+/**
+ * E6 fail-closed 守卫的辖域判据:**这个请求是不是一次「破坏性会话写」**。
+ *
+ * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
+ * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一威胁形、爆炸半径**更大**,却没门。
+ *
+ * 威胁形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
+ * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
+ *
+ * ⇒ 枚举改**族判定**:新增一条破坏性会话路由时自动落进门内,不必记得回来加白名单。
+ * 这是本仓「同一条论证只在枚举到的路径上执行」这一族的第 N 次,修法统一为把判据提成函数。
+ *
+ * 辖域**只含**对**既有会话**的破坏性写:改规则 / 整段替换 / 删除 / 分叉(读源会话全历史)。
+ * 不含读面,也不含 `POST /v1/tasks` 那条提交腿 —— 它有自己的同族门(别重复拦,双拦会让错误归因变糊)。
+ */
+export declare function isDestructiveSessionWrite(method: string, url: string): boolean;
 export type OwnerAwareSessionStore = SessionStore & {
     ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
     register?: (sessionId: string, owner: string | null) => Promise<void>;

package/dist/security.js

@@ -11,6 +11,34 @@ import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: see re-ex
 // `verifiedPrincipal` still calls verifyPrincipalJwt for the direct-door branch (value import below); every
 // symbol from both groups is re-exported near the bottom of this file so existing importers keep working.
 import { verifyPrincipalJwt } from "./principal-jwt.js";
+/** A SessionStore that may additionally expose tenant-ownership ops (the TiDB store does) AND the
+ *  `SessionRepo` enumeration/lifecycle seam (§0.5: list/fork/delete homed on the session abstraction's own
+ *  tables, not the `task_run` runs ledger). All optional — an in-memory dev store implements none. */
+/**
+ * E6 fail-closed 守卫的辖域判据:**这个请求是不是一次「破坏性会话写」**。
+ *
+ * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
+ * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一威胁形、爆炸半径**更大**,却没门。
+ *
+ * 威胁形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
+ * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
+ *
+ * ⇒ 枚举改**族判定**:新增一条破坏性会话路由时自动落进门内,不必记得回来加白名单。
+ * 这是本仓「同一条论证只在枚举到的路径上执行」这一族的第 N 次,修法统一为把判据提成函数。
+ *
+ * 辖域**只含**对**既有会话**的破坏性写:改规则 / 整段替换 / 删除 / 分叉(读源会话全历史)。
+ * 不含读面,也不含 `POST /v1/tasks` 那条提交腿 —— 它有自己的同族门(别重复拦,双拦会让错误归因变糊)。
+ */
+export function isDestructiveSessionWrite(method, url) {
+    if (method === "DELETE")
+        return /^\/v1\/sessions\/[^/]+$/.test(url);
+    if (method === "PUT")
+        return /^\/v1\/sessions\/[^/]+\/policy$/.test(url);
+    if (method === "POST")
+        return /^\/v1\/sessions\/[^/]+\/(sync\/import|fork)$/.test(url);
+    return false;
+}
 /** The shape core's `uuidv7()` mints: canonical 8-4-4-4-12 lowercase hex with version nibble `7` and the RFC-4122
  *  variant (`8`/`9`/`a`/`b`). Used to shape-validate a caller-supplied session id on the §0.5 fork/delete routes so
  *  a crafted id (LIKE metacharacters, over-long, non-canonical) is rejected up front — a SECOND layer behind the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.19.0",
+  "version": "3.20.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^2.12.0",
+    "@sema-agent/core": "^2.13.0",
     "@sema-agent/registry-core": "^0.11.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",