@sema-agent/server 3.4.1 → 3.5.0

package/dist/bench/s1/reviewer.d.ts

@@ -22,7 +22,6 @@ export declare const THINK_MS: {
     /** A pre-action plan review (`CheckpointGate.kind === "plan_review"`). */
     readonly plan_review: 45000;
 };
-export type GateKind = keyof typeof THINK_MS;
 /** Look up the fixed modeled think-time for a gate kind (defaults to the `human` rubric for an unknown kind). */
 export declare function thinkMsForGate(gateKind: string): number;
 /** The trap slice the reviewer needs to apply its rubric (kept narrow to avoid a circular import on tasks.ts). */

package/dist/capabilities/select-environment-tool.js

@@ -1,5 +1,5 @@
 /**
- * RFC A2 (docs/design/ENV-SELECT-AND-REGION-SOURCE.md) — the model-facing `SelectEnvironment` tool.
+ * RFC A2 (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md) — the model-facing `SelectEnvironment` tool.
  * A 切片先行;挂载路线 = RFC 判定②(a):deployment 经 `spec.tools` 注入(同 lsp/
  * 自定义工具),core 收编等真用起来再谈。
  *

package/dist/capabilities/skills.js

@@ -20,7 +20,7 @@ export function loadSkills(dir) {
     };
     // sort 保证加载顺序稳定(冲突报错的"先到者"也因此确定)。dotfile/dot 目录跳过(.DS_Store/.git 类
     // 环境杂物,不是 skill 内容);isFileLike 兼容 symlink(Dirent.isFile() 对 symlink 恒 false,而旧扁平
-    // 实现 readFileSync 是跟链接的——不兼容会让 `skills/foo.md -> 共享文件` 无声消失)。
+    // 实现 readFileSync 是跟链接的——不兼容会让 skills 目录下 `foo.md -> 共享文件` 这种软链无声消失)。
     const isFileLike = (entry, p) => entry.isFile() || (entry.isSymbolicLink() && statSync(p).isFile());
     const isDirLike = (entry, p) => entry.isDirectory() || (entry.isSymbolicLink() && statSync(p).isDirectory());
     for (const entry of entries.slice().sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {

package/dist/config-center/skills-mcp.d.ts

@@ -4,7 +4,7 @@ import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import type { CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
- * Merge center skills OVER the image baseline (design/41-sibling B1; `docs/MCP-SKILLS.md`). Load order =
+ * Merge center skills OVER the image baseline (design/41-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → center skills lazily fetched by hash and overlaid BY NAME (center
  * wins on a clash → can override a built-in; guarded center-side by publisher RBAC + the publish gate).
  * `enabled:false` is skipped. Content is verified + cached by hash (same hash fetched once). A skill whose

package/dist/config-center/skills-mcp.js

@@ -8,7 +8,7 @@
 import { skillContentHash } from "@sema-agent/registry-core";
 import { fetchSkillContent } from "./http-client.js";
 /**
- * Merge center skills OVER the image baseline (design/41-sibling B1; `docs/MCP-SKILLS.md`). Load order =
+ * Merge center skills OVER the image baseline (design/41-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → center skills lazily fetched by hash and overlaid BY NAME (center
  * wins on a clash → can override a built-in; guarded center-side by publisher RBAC + the publish gate).
  * `enabled:false` is skipped. Content is verified + cached by hash (same hash fetched once). A skill whose

package/dist/config-types.d.ts

@@ -357,6 +357,10 @@ export interface ServiceConfigFlat {
      *  `BIND_HOST`(兼容 `HOST`)。显式值恒生效;缺省见 {@link resolveBindHost}——**无鉴权写面
      *  (allowUnauthedWrites 且零凭证)自动收窄到 127.0.0.1**,其余维持全接口(既有部署零影响)。 */
     bindHost?: string;
+    /** [2062]③ `bindHost` 的取值来源(BIND_HOST 显式 / HOST 兼容名 / 未设)。`"HOST"` 时 main.ts 打一行
+     *  启动告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给引擎——bind 面被 shell
+     *  环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。 */
+    bindHostSource?: "BIND_HOST" | "HOST";
     /** D-1 附件孤儿对象 GC 的 grace(毫秒;`ATTACHMENT_ORPHAN_GRACE_MS`,默认 1h,**0=关掉本腿**)。
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
@@ -864,7 +868,7 @@ export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" |
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
 export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */

package/dist/config.js

@@ -873,6 +873,9 @@ function parseAuthDomain(ctx) {
     return {
         // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
         bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
+        // [2062]③ 来源记账:HOST 是 zsh 会替用户设的名字(HOST=机器名),{...process.env} 起底的壳会把它
+        // 静默继承给引擎——bind 面被 shell 环境暗配而部署者不知情。main.ts 对 "HOST" 来源打一行启动告警。
+        bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : process.env.HOST ? "HOST" : undefined,
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
@@ -1224,7 +1227,7 @@ const MEMORY_GROUP_KEYS = [
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
-    "principalJwtMaxTtlSec", "bindHost",
+    "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
     "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",

package/dist/elicitation.d.ts

@@ -25,9 +25,6 @@ export interface ElicitationRunContext {
     emit: (frame: ElicitationFrame) => void | Promise<void>;
     abortSignal?: AbortSignal;
 }
-/** @deprecated design/158 N22: the root word got truncated at naming time — `ElicitationFrame` / `ElicitationThrottle` /
- *  `ElicitationCoordinator` all spell it out; this alias was the odd one. Use {@link ElicitationRunContext}. */
-export type ElicitRunContext = ElicitationRunContext;
 export interface ElicitationThrottle {
     /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ decline. */
     maxConcurrentPerRun: number;
@@ -49,10 +46,6 @@ export declare function parseElicitationResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseElicitResponse: typeof parseElicitationResponse;
 /**
  * Coordinates inbound MCP elicitations for one server instance. Process-local + same-replica (the pending map is in
  * memory, like `steerableRuns`): a respond that lands on another replica finds nothing → 404. Present (passed into

package/dist/elicitation.js

@@ -65,10 +65,6 @@ export function parseElicitationResponse(body) {
     }
     return { ok: true, value: { action: b.action } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseElicitResponse = parseElicitationResponse;
 /** redactDeep + size-bound an UNTRUSTED `requestedSchema` before it is persisted to the durable log / streamed
  *  (the same redact-at-write contract every other untrusted structured field honors, e.g. tool_end.output). A JSON
  *  Schema's free-text carriers (description/title/default/enum) can smuggle a secret. Over the byte cap ⇒ undefined

package/dist/env-facts.js

@@ -1,5 +1,5 @@
 /**
- * RFC A1 (docs/design/ENV-SELECT-AND-REGION-SOURCE.md) — the sandbox envFacts composer (service 半场).
+ * RFC A1 (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md) — the sandbox envFacts composer (service 半场).
  * Shape ratified REV-1: `TaskSpec.envFacts?: { profile?, capabilities?[], pkgSource?, egress? }`.
  * Core injects it into model context (escape+bound core-side); this module only COMPOSES the facts
  * from deployment-trusted sources (image catalog entry + operator region config + exec-lane posture).

package/dist/http/routes/approvals-assistant.js

@@ -214,6 +214,19 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
+                // 🔴 `needsAttention` = 「此刻有一个**可解的活门**」= `!!gate`,**不是**「run 行停着」([2034]/[2035]
+                // 附带登记的 handler↔§3 文档出入,2026-07-30 裁定 (b):改文档对齐本行,常驻钉
+                // `test/assistant-tasks-needs-attention.test.ts`)。gate 来自 `listByScope`,三个实现都只回
+                // `status='pending'` 的行 ⇒ 分歧态 = run 停在 suspended/needs_review 而 pending checkpoint 已不在。
+                // 该态**可达且周期性发生**:TTL 收割的两半(checkpointStore.reapExpired 只动 checkpoint /
+                // runStore.failSuspendedWithExpiredCheckpoint 才动 run 行)在 boot/reapers.ts 同一 tick 里互不 await。
+                // 三问:① 需要方=triage 视图,它拿这一位只做「哪张卡现在能动 + 排前面」(比较器第一级);
+                // ② 若改按 status 算,分歧态会产出**不可解之卡**——标成待处理、排进前段,而 /decide 必 404、
+                //    /plan_review 与 /resume 同族拒,且与同一行的 `gate:null` 自相矛盾;现写法的代价是这段窗口里
+                //    「只渲染 needsAttention 段」的客户端看不到它;
+                // ③ 补偿=(a) 行**不消失**——它仍在本列表里带真实 `status`,「所有还停着的任务」由 status 回答;
+                //    (b) failSuspendedWithExpiredCheckpoint 三个 run store 全实装、每 tick 无条件跑(不受
+                //    APPROVAL_TIMEOUT_SEC 开关),窗口由 REAP_INTERVAL_SEC 封顶后收敛成 failed。
                 return { taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate, createdAt: r.createdAt, updatedAt: r.updatedAt };
             })
                 .sort((a, b) => Number(b.needsAttention) - Number(a.needsAttention) || (b.gate?.severity ?? 0) - (a.gate?.severity ?? 0) || (b.gate?.spentMicroUsd ?? 0) - (a.gate?.spentMicroUsd ?? 0));

package/dist/http/routes/session-sync.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/158 A9 域模块 —— 2c session-sync 面(docs/DESIGN-session-sync.md §15 + §5–§10)。
+ * design/158 A9 域模块 —— 2c session-sync 面(sema-internal server/docs/DESIGN-session-sync.md §15 + §5–§10)。
  *
  * 路由:`/v1/sessions/:id/sync/{manifest,entries,import,plan,blobs,snapshots/:k/blobs/:b,import/:staging/entries}`。
  * 每条都像 fork/delete 一样 owner-gated;无持久 session store 时 501(能力面与路由解析同真值)。

package/dist/http/routes/session-sync.js

@@ -49,7 +49,7 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
     const { readJson, readRawBody, safeDecode, sessionOwnerScopeForWrite } = ctx.helpers;
     const { pendingStagings, importLeases, touchImportLease, cleanupStaging } = ctx.local.sessionSync;
-    // ── 2c session-sync (P1d) — the cloud as a SYNC PEER (docs/DESIGN-session-sync.md §15 + §5–§10) ──────────────
+    // ── 2c session-sync (P1d) — the cloud as a SYNC PEER (sema-internal server/docs/DESIGN-session-sync.md §15 + §5–§10) ──────────────
     // The real 2c topology is TWO PROCESSES (the local shell's local backend + this cloud service); these routes let
     // the local peer PULL a session's whole state out of the cloud or PUSH its own in. Both halves are STREAMING
     // implementations that fan out across ALL four session subsystems (entries + fileSnapshot + sessionPolicy +

package/dist/http/server.d.ts

@@ -466,4 +466,6 @@ export declare function clampVerifyRounds(v: unknown): number;
 export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
     denyExpiredApprovals: (now: number) => Promise<void>;
 };
+/** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
+export declare function routeLabel(_method: string, url: string): string;
 //# sourceMappingURL=server.d.ts.map

package/dist/http/server.js

@@ -35,15 +35,15 @@ import { handleFleet } from "./routes/fleet.js";
 import { handleTraceUsage } from "./routes/trace-usage.js";
 import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
 import { handleNotifyWake } from "./routes/notify-wake.js";
-import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_PREEMPT_RE, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
-import { handleRuns, handleRunVerbs, RUN_CANCEL_RE, RUN_STEER_RE, RUN_DETACH_RE, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
 import { handleSideQuery } from "./routes/side-query.js";
 import { handleTasks } from "./routes/tasks.js";
 import { handleLeader } from "./routes/leader.js";
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
-import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
+import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 // design/158 A9:装配器缝——发送器/身份门下沉到 http/ 叶子模块,routes/* 与 server.ts 共用同一实现
 // (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
@@ -2452,50 +2452,65 @@ function isBillableSubmitPath(url) {
 // ⚠️ SSE 帧纪律(2026-07-12):center BFF 中继凭「data 无 type 字段」识别心跳帧并吞掉
 // (AgentEvent 是 closed oneof 全带 type,故可控)。**未来新增任何 SSE data 帧必须带 type 字段**,否则会被
 // 中继当心跳吞掉、永远到不了前端。heartbeat 帧(`event: heartbeat` + `data: {}`)是唯一豁免。
+/** 路由标签表(表驱动;[2061] 批1 层A 重写)。顺序=具体先于泛化。
+ *  🔴 本表由 `test/route-shape-roster.test.ts` 棘轮看守:门机器枚举源码全部路由模式并断言每条都映射到
+ *  非 "other"——新路由不补此表该门当场红(census 抓获本表曾漂掉 56 条模式:session-sync/workspace/
+ *  workflows/subagents/attachments/images/leader 等整族全折 "other",metrics 不可分桶)。 */
+const ROUTE_LABEL_PATTERNS = [
+    [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
+    [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
+    [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
+    [/^\/v1\/runs\/[^/]+\/events$/, "/v1/runs/:id/events"],
+    [/^\/v1\/runs\/[^/]+\/subagents\/[^/]+\/(steer|resume|output|stream)$/, "/v1/runs/:id/subagents/:sub/*"],
+    [/^\/v1\/runs\/[^/]+\/tasks\/[^/]+\/(output|stop)$/, "/v1/runs/:id/tasks/:tid/*"],
+    [/^\/v1\/runs\/[^/]+$/, "/v1/runs/:id"],
+    [/^\/v1\/images\/bakes\/[^/]+\/events$/, "/v1/images/bakes/:id/events"],
+    [/^\/v1\/images\/bakes\/[^/]+\/cancel$/, "/v1/images/bakes/:id/cancel"],
+    [/^\/v1\/images\/bakes\/[^/]+\/claim$/, "/v1/images/bakes/:id/claim"],
+    [/^\/v1\/images\/bakes\/[^/]+\/ingest$/, "/v1/images/bakes/:id/ingest"],
+    [/^\/v1\/images\/bakes\/[^/]+$/, "/v1/images/bakes/:id"],
+    [/^\/v1\/images\/digests\/[^/]+$/, "/v1/images/digests/:digest"],
+    [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
+    [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
+    [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
+    [/^\/v1\/approvals\/[^/]+$/, "/v1/approvals/:id"],
+    [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/snapshots\/[^/]+\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/snapshots/:key/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
+    [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
+    [/^\/v1\/(elicitations|questions|tool-approvals)\/[^/]+\/respond$/, "/v1/$hitl/:id/respond"],
+    [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
+    [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
+    [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
+    [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
+    [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
+    [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
+    [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
+    [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
+    [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
+];
+const ROUTE_LABEL_LITERALS = new Set([
+    "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
+    "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/tasks/source-summary",
+    "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/approvals/stream",
+    "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
+    "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
+    "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
+    "/v1/memory/export", "/v1/sendfile-links",
+]);
 /** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
-function routeLabel(_method, url) {
-    if (RUN_STEER_RE.test(url))
-        return "/v1/runs/:id/steer";
-    if (RUN_DETACH_RE.test(url))
-        return "/v1/runs/:id/detach";
-    if (RUN_CANCEL_RE.test(url))
-        return "/v1/runs/:id/cancel";
-    if (/^\/v1\/runs\/[^/]+\/events$/.test(url))
-        return "/v1/runs/:id/events";
-    if (/^\/v1\/runs\/[^/]+$/.test(url))
-        return "/v1/runs/:id";
-    if (url === "/v1/images/bakes")
-        return "/v1/images/bakes";
-    if (BAKE_EVENTS_RE.test(url))
-        return "/v1/images/bakes/:id/events";
-    if (BAKE_CANCEL_RE.test(url))
-        return "/v1/images/bakes/:id/cancel";
-    if (BAKE_CLAIM_RE.test(url))
-        return "/v1/images/bakes/:id/claim";
-    if (BAKE_INGEST_RE.test(url))
-        return "/v1/images/bakes/:id/ingest";
-    if (BAKE_ID_RE.test(url))
-        return "/v1/images/bakes/:id";
-    if (url === "/v1/approvals/stream")
-        return "/v1/approvals/stream"; // native-push SSE — distinct from a /:id decide
-    if (/^\/v1\/approvals\/[^/]+$/.test(url))
-        return "/v1/approvals/:id";
-    if (/^\/v1\/sessions\/[^/]+\/wake$/.test(url))
-        return "/v1/sessions/:id/wake";
-    if (/^\/v1\/sessions\/[^/]+\/fork$/.test(url))
-        return "/v1/sessions/:id/fork";
-    if (/^\/v1\/sessions\/[^/]+\/init$/.test(url))
-        return "/v1/sessions/:id/init";
-    if (/^\/v1\/sessions\/[^/]+$/.test(url))
-        return "/v1/sessions/:id";
-    if (ASSISTANT_PREEMPT_RE.test(url))
-        return "/v1/assistant/tasks/:id/preempt";
-    if (ASSISTANT_RESUME_RE.test(url))
-        return "/v1/assistant/tasks/:id/resume";
-    if (ASSISTANT_PLAN_REVIEW_RE.test(url))
-        return "/v1/assistant/tasks/:id/plan_review";
-    const known = ["/health", "/metrics", "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities"];
-    if (known.includes(url))
+export function routeLabel(_method, url) {
+    for (const [re, label] of ROUTE_LABEL_PATTERNS)
+        if (re.test(url))
+            return label;
+    if (ROUTE_LABEL_LITERALS.has(url))
         return url;
     return "other";
 }

package/dist/leader/grader-env-factory.d.ts

@@ -1,6 +1,6 @@
 /**
  * The OUT-OF-PROCESS grader plumbing for the leader × `runRepairLoop` integration
- * (`docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2 + the authoritative §10 layer). Two distinct consumers:
+ * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2 + the authoritative §10 layer). Two distinct consumers:
  *
  *  - **R1 (single-agent oracle, §10.1)** — the `RepairOracle` closure (`repair-oracle.ts`) reuses the EXISTING
  *    integration sandbox as its grader at ZERO extra sandbox cost. It needs only a `GraderHandle` (a writeFile +

package/dist/leader/grader-env-factory.js

@@ -1,6 +1,6 @@
 /**
  * The OUT-OF-PROCESS grader plumbing for the leader × `runRepairLoop` integration
- * (`docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2 + the authoritative §10 layer). Two distinct consumers:
+ * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2 + the authoritative §10 layer). Two distinct consumers:
  *
  *  - **R1 (single-agent oracle, §10.1)** — the `RepairOracle` closure (`repair-oracle.ts`) reuses the EXISTING
  *    integration sandbox as its grader at ZERO extra sandbox cost. It needs only a `GraderHandle` (a writeFile +
@@ -126,7 +126,7 @@ export function createGraderEnvFactory(_cfg) {
     return async () => {
         throw new Error("createGraderEnvFactory: the standalone control-plane grader is the auto-accept slice (LEADER_GRADER_FACTORY) — " +
             "NOT wired in v1 (which reuses the integration sandbox for R1 and re-seeds it for R2). " +
-            "See docs/LEADER-REPAIRLOOP-INTEGRATION.md §3.2/§7.");
+            "See sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md §3.2/§7.");
     };
 }
 //# sourceMappingURL=grader-env-factory.js.map

package/dist/leader/repair-oracle.d.ts

@@ -1,6 +1,6 @@
 /**
  * The PROFILE-injected `RepairOracle` closure for the leader's single-agent self-repair loop
- * (`runRepairLoop`, core design/78 / D1). See `docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
+ * (`runRepairLoop`, core design/78 / D1). See `sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
  * §10 corrected layer). The closure GRADES a worker's candidate in an ISOLATED grader env (the reused
  * integration sandbox, distinct from the worker env) and maps the result to a core `OracleResult`. core only
  * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type

package/dist/leader/repair-oracle.js

@@ -1,6 +1,6 @@
 /**
  * The PROFILE-injected `RepairOracle` closure for the leader's single-agent self-repair loop
- * (`runRepairLoop`, core design/78 / D1). See `docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
+ * (`runRepairLoop`, core design/78 / D1). See `sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
  * §10 corrected layer). The closure GRADES a worker's candidate in an ISOLATED grader env (the reused
  * integration sandbox, distinct from the worker env) and maps the result to a core `OracleResult`. core only
  * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type

package/dist/leader/repair-wire.d.ts

@@ -1,6 +1,6 @@
 /**
  * The WIRE that wraps core `runRepairLoop` onto the leader's single-agent path
- * (`docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.3 + the authoritative §10 layer). It owns the three things the
+ * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.3 + the authoritative §10 layer). It owns the three things the
  * `RepairOracle` closure (`repair-oracle.ts`) and the core engine CANNOT resolve themselves:
  *
  *  1. **The grader handle (R1, §10.1)** — the reused integration sandbox's writeFile/exec + `integBase`, bound by

package/dist/leader/repair-wire.js

@@ -1,6 +1,6 @@
 /**
  * The WIRE that wraps core `runRepairLoop` onto the leader's single-agent path
- * (`docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.3 + the authoritative §10 layer). It owns the three things the
+ * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.3 + the authoritative §10 layer). It owns the three things the
  * `RepairOracle` closure (`repair-oracle.ts`) and the core engine CANNOT resolve themselves:
  *
  *  1. **The grader handle (R1, §10.1)** — the reused integration sandbox's writeFile/exec + `integBase`, bound by

package/dist/lsp/types.d.ts

@@ -8,5 +8,5 @@
  * `LspTransport` IMPLEMENTATION (`WsLspTransport` in ws-transport.ts) — core has no WebSocket transport (raw TCP
  * doesn't traverse E2B's HTTP proxy; WS does). "1:1-copy-CC" is the protocol; the WS transport is ours.
  */
-export type { LspOperation, LspRequestParams, LspResult, LspLocation, LspSymbolInfo, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
+export type { LspOperation, LspRequestParams, LspResult, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
 //# sourceMappingURL=types.d.ts.map

package/dist/main.js

@@ -784,7 +784,7 @@ async function main() {
         // 🔴 复审 2026-07-28(E-HIGH-1)修:此键是 **ServiceDeps** 字段,原先被 spread 进 `runnerDeps`
         // (core 的 RunnerDeps 无此字段,条件 spread 绕过 TS 多余属性检查 ⇒ 编译期无声)⇒ HTTP 面恒
         // undefined、413 前置是死枝、超帽仍走 502。落错家的死键病族(verify-cost 先例)——接线钉见
-        // test/review-2026-07-28-batch1.test.ts。
+        // test/deps-literal-shape-gate.test.ts(2026-07-28 那批复审文件已按仓规折进主题文件,钉本体在 E-HIGH-1 那个 describe)。
         snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
             ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
             : undefined,
@@ -816,6 +816,14 @@ async function main() {
             ? { note: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
             : {}),
     });
+    // [2062]③ HOST 继承暗通道告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给
+    // 引擎——bind 面被 shell 环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。
+    if (config.bindHostSource === "HOST") {
+        logger.warn("bind_host_from_HOST_env", {
+            bindHost,
+            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
+        });
+    }
     // fleet worker 接线(announce/heartbeat + usage 批报;lease 消费后一拍):boot 完成后
     // 注册(=首次心跳)。门 = center lane 配置 ∧ FLEET_ADVERTISE_ADDRESS 显式声明(不自猜可达地址);任一缺 → undefined
     // = 非 fleet 部署零行为。draining 翻转的即刻 announce 在 drainThenShutdown;退出 DELETE 在 hardShutdown。

package/dist/memory-sync.js

@@ -1,4 +1,4 @@
-// 142-S2.5 中心侧同步 API 的执行内核(设计 docs/design/142-S4-DATAPLANE.md §2.5;裁定:
+// 142-S2.5 中心侧同步 API 的执行内核(设计 sema-internal server/docs/design/142-S4-DATAPLANE.md §2.5;裁定:
 // **plan 随数据走,core 零运行时半场**——core 的 `reconcileMemoryEntries`/`nextSyncBaseline`/
 // `screenInboundEntries` 是纯函数导出,持数据的一侧(本 server=DB 权威+per-(scope,peer) 游标)直接
 // import 调用算 plan 并执行 CAS;API 面全在 server,core 的承诺=纯函数语义稳定。

package/dist/observability/metrics.js

@@ -254,7 +254,7 @@ export function createMetrics() {
     // E18 resume-at: a per-turn anchor capture (getLeafId→put) failed (e.g. an un-migrated DB missing resume_anchor) —
     // best-effort, never fails the run; this surfaces a SYSTEMATIC capture outage instead of a silent feature stoppage.
     m.counter("resume_anchor_capture_failed", "E18 resume-at per-turn anchor captures that failed (best-effort, run unaffected)");
-    // Silent-fallback telemetry P0 batch (docs/design/SILENT-FALLBACK-TELEMETRY.md, service half):
+    // Silent-fallback telemetry P0 batch (sema-internal server/docs/design/SILENT-FALLBACK-TELEMETRY.md, service half):
     // S4 — brain-layer liveness phases (rate_limited/retrying/reconnecting/circuit_open) were previously visible
     // only on the live SSE stream; count them so upstream throttling/outage is graphable per phase.
     m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open)");

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -62,8 +62,6 @@ export interface HardenedVmLimits {
      *  A script exceeding it OOMs the WORKER (killed), never the shared main process. Default 128. */
     maxHeapMb?: number;
 }
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export declare function setScriptRealmRejectionObserver(observer: (summary: string) => void): void;
 export declare function installScriptRealmRejectionGuard(): void;
 /**
  * The membrane handed to a surface's `buildGlobals` callback to construct the CONTEXT-LOCAL bindings the

package/dist/orchestration/hardened-vm-runner.js

@@ -48,11 +48,6 @@ function scrubProtoDeep(value) {
  * their global posture, and only then is the hazard live. Idempotent.
  */
 let rejectionGuardInstalled = false;
-let onScriptRealmRejection;
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export function setScriptRealmRejectionObserver(observer) {
-    onScriptRealmRejection = observer;
-}
 export function installScriptRealmRejectionGuard() {
     if (rejectionGuardInstalled)
         return;
@@ -62,7 +57,7 @@ export function installScriptRealmRejectionGuard() {
             // cross-realm ⇒ minted in a vm context ⇒ an un-awaited rejection inside an untrusted script. Contain.
             const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
             try {
-                (onScriptRealmRejection ?? ((s) => console.warn(`hardened-vm: un-awaited script rejection contained: ${s}`)))(summary);
+                console.warn(`hardened-vm: un-awaited script rejection contained: ${summary}`);
             }
             catch {
                 /* the guard must never become a crash source itself */

package/dist/plan-cache-probe.js

@@ -1,4 +1,6 @@
-// Verbatim from core strategy-store.ts (keep in sync if core changes its stopword set).
+// Verbatim from core strategy-store.ts. 🔴 「keep in sync」不是靠这句话 —— lockstep 活钉在
+// test/plan-cache-probe.test.ts(真读 core 的 dist strategy-store.js 做 set diff + 切词正则/阈值同源),
+// 任一侧改词表当场红。2026-07-30 之前这里只有声明没有钉:删掉一个词全量零红(实测)。
 const STOP = new Set([
     "the", "and", "for", "with", "from", "this", "that", "into", "your", "you", "are", "was", "were", "has",
     "have", "had", "not", "but", "all", "any", "can", "use", "using", "via", "then", "than", "out", "get",

package/dist/plugins/approval-exemption-store.js

@@ -1,6 +1,6 @@
 /**
  * Per-session per-toolName approval exemption ("本会话不再询问",
- * design: docs/design/APPROVAL-SESSION-EXEMPTION.md).
+ * design: sema-internal server/docs/design/APPROVAL-SESSION-EXEMPTION.md).
  *
  * SEMANTICS (the boundary that keeps this an APPROVAL MEMORY, not a policy loosen): a granted row makes the
  * F4 ask-gate SKIP the human ask for that (sessionId, canonicalToolName) — it is consulted ONLY after

package/dist/plugins/pg-pool.js

@@ -117,7 +117,7 @@ export const PG_SCHEMA_STATEMENTS = [
    )`,
     `CREATE INDEX IF NOT EXISTS idx_resume_anchor_session ON resume_anchor (session_id)`,
     // Per-session per-toolName approval exemption (the PG twin — see tidb-pool.ts /
-    // docs/design/APPROVAL-SESSION-EXEMPTION.md).
+    // sema-internal server/docs/design/APPROVAL-SESSION-EXEMPTION.md).
     `CREATE TABLE IF NOT EXISTS approval_exemption (
      session_id VARCHAR(64)    NOT NULL,
      tool_name  VARCHAR(190)   NOT NULL,

package/dist/plugins/remote-env-k8s.d.ts

@@ -69,7 +69,7 @@ export interface K8sEnvConfig {
      * image/command), which are set OUTSIDE the patched fields.
      */
     podSpecPatch?: PodSpecPatch;
-    /** RFC B5 (docs/design/ENV-SELECT-AND-REGION-SOURCE.md 抽象点②): operator-trusted env injected into the
+    /** RFC B5 (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md 抽象点②): operator-trusted env injected into the
      *  sandbox container (e.g. `SEMA_PKG_SOURCE=cn|global` — the runtime package-source selector the image's
      *  pkg-source.sh hook materializes at start). Deployment-region config, NEVER task-controlled. Absent = the
      *  pod is byte-identical to today. */

package/dist/plugins/tidb-pool.js

@@ -305,7 +305,7 @@ export const SCHEMA_STATEMENTS = [
    )`,
     // Per-session per-toolName approval exemption ("本会话不再询问") — an APPROVAL MEMORY the
     // F4 ask-gate consults AFTER deny/neverAuto (both always win). tool_name is CANONICAL space. GC'd with
-    // the session (E21 delete). See docs/design/APPROVAL-SESSION-EXEMPTION.md.
+    // the session (E21 delete). See sema-internal server/docs/design/APPROVAL-SESSION-EXEMPTION.md.
     `CREATE TABLE IF NOT EXISTS approval_exemption (
      session_id VARCHAR(64)  NOT NULL,
      tool_name  VARCHAR(190) NOT NULL,

package/dist/question.d.ts

@@ -39,10 +39,6 @@ export declare function parseQuestionResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseQuestionAnswer: typeof parseQuestionResponse;
 /**
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present

package/dist/question.js

@@ -63,10 +63,6 @@ export function parseQuestionResponse(body) {
     }
     return { ok: true, value: { answers: out } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseQuestionAnswer = parseQuestionResponse;
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
  *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */

package/dist/router/route-orchestration.d.ts

@@ -1,5 +1,5 @@
 /**
- * The A value router — cash out the S1 supervisor value verdict (docs/S1-VALUE-VERDICT.md §6.3) into a per-task
+ * The A value router — cash out the S1 supervisor value verdict (sema-internal server/docs/S1-VALUE-VERDICT.md §6.3) into a per-task
  * orchestration decision: run a task as `single` / `supervisor` / `team`.
  *
  * The verdict, in one line: **competent tasks have SUP/TEAM dominated (pure overhead) ⇒ default single; the real

package/dist/router/route-orchestration.js

@@ -1,5 +1,5 @@
 /**
- * The A value router — cash out the S1 supervisor value verdict (docs/S1-VALUE-VERDICT.md §6.3) into a per-task
+ * The A value router — cash out the S1 supervisor value verdict (sema-internal server/docs/S1-VALUE-VERDICT.md §6.3) into a per-task
  * orchestration decision: run a task as `single` / `supervisor` / `team`.
  *
  * The verdict, in one line: **competent tasks have SUP/TEAM dominated (pure overhead) ⇒ default single; the real

package/dist/sandbox-pkg-source.d.ts

@@ -1,5 +1,5 @@
 /**
- * RFC B5/B4 抽象点② (docs/design/ENV-SELECT-AND-REGION-SOURCE.md): the deployment-region package-source →
+ * RFC B5/B4 抽象点② (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md): the deployment-region package-source →
  * sandbox env derivation. ENV-FIRST: pod/sandbox env OVERRIDES the image's baked `ENV` (k8s container env wins
  * over image config and is visible to every exec'd process; e2b sandboxEnv likewise) — so the env-overridable
  * ecosystem pieces (pip/uv/npm/corepack/go/rustup/flutter/playwright/nuget) switch region on EXISTING images,

package/dist/sandbox-pkg-source.js

@@ -1,5 +1,5 @@
 /**
- * RFC B5/B4 抽象点② (docs/design/ENV-SELECT-AND-REGION-SOURCE.md): the deployment-region package-source →
+ * RFC B5/B4 抽象点② (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md): the deployment-region package-source →
  * sandbox env derivation. ENV-FIRST: pod/sandbox env OVERRIDES the image's baked `ENV` (k8s container env wins
  * over image config and is visible to every exec'd process; e2b sandboxEnv likewise) — so the env-overridable
  * ecosystem pieces (pip/uv/npm/corepack/go/rustup/flutter/playwright/nuget) switch region on EXISTING images,

package/dist/session-sync-kernel.d.ts

@@ -11,7 +11,7 @@
  */
 import type { SessionTreeEntry } from "@sema-agent/core";
 /**
- * P1d-β (PUSH streaming, docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
+ * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
  * handle. The whole-bundle `importSession` (session-sync.ts) buffers every entry in one JSON body (server memory ∝ session size);
  * β instead STREAMS the entry log (NDJSON) into a SHADOW session id, validating it ONLINE per line through core's
  * StreamingImportValidator (the single invariant gate — core 1.143.0), then ATOMICALLY swaps

package/dist/session-sync.d.ts

@@ -1,6 +1,6 @@
 /**
  * 2c session-sync — P1b ORCHESTRATION: export a session's WHOLE portable state from one StoreBackend and import it
- * verbatim into another (the seamless local↔cloud "save state" move; docs/DESIGN-session-sync.md §5–§10). All the
+ * verbatim into another (the seamless local↔cloud "save state" move; sema-internal server/docs/DESIGN-session-sync.md §5–§10). All the
  * per-store PRIMITIVES already exist (P1a entries + P1b snapshots/policy/anchor); this module is the COORDINATOR that
  * (a) reads them into a {@link SessionBundle} and (b) replays them across backends in the §8 fail-closed atomic order.
  *

package/dist/task-settings.d.ts

@@ -20,7 +20,7 @@
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
  *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[816] 拍照。
  *
- * 🔴 SYNC WITH shell `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
+ * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
  * the shell's LOCAL-Runner resolver — both compose the SAME core primitives (`createAllowDenyPolicy` /
  * `combinePolicies` / `tightenTaskSpec`), so the deny-wins ENFORCEMENT is core-single-source. Only the COMPOSITION
  * is duplicated for the remote path; a proposed follow-up extracts it to `@sema-agent/sdk` for true

package/dist/task-settings.js

@@ -20,7 +20,7 @@
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
  *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[816] 拍照。
  *
- * 🔴 SYNC WITH shell `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
+ * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
  * the shell's LOCAL-Runner resolver — both compose the SAME core primitives (`createAllowDenyPolicy` /
  * `combinePolicies` / `tightenTaskSpec`), so the deny-wins ENFORCEMENT is core-single-source. Only the COMPOSITION
  * is duplicated for the remote path; a proposed follow-up extracts it to `@sema-agent/sdk` for true

package/dist/tool-approval.d.ts

@@ -53,11 +53,6 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export declare const parseToolApprovalDecision: typeof parseToolApprovalResponse;
 /**
  * Coordinates the live tool-approval HITL for the singleton runner. Process-local + same-replica (the pending map is
  * in memory, like QuestionCoordinator): a respond that lands on another replica finds nothing → 404. Present (passed

package/dist/tool-approval.js

@@ -85,11 +85,6 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export const parseToolApprovalDecision = parseToolApprovalResponse;
 /** [1550] RB-39② 兑现:判别式换 core 1.378 显式键 `fromSubagent`(委派子代 gate 发起的 ask 恒带,受信
  *  internals 事实——worker 不可伪造/不可抑制)。取代 [1546] MED-1 的「在场 ∧ ≠ 宿主 sessionId」权宜式
  *  (旧判别式靠 ctx.sessionId 参与推导,sessionless adhoc 场景无法区分;显式键不依赖 ctx,恒定准确)。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.4.1",
+  "version": "3.5.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",