@sema-agent/server 4.1.1 → 4.1.3

package/dist/approval.d.ts

@@ -35,7 +35,7 @@ export declare function hasOperatorGateIntent(config: {
  * a **suspend** (persists a checkpoint, ends `status:"suspended"`) — no held connection, resumable on any
  * replica. (Contrast {@link createOaApprovalPolicy}, which holds the call open by polling a TiDB row.)
  */
-export declare function createDurableAskPolicy(opts: {
+export interface DurableAskOptions {
     requireApproval: string[];
     deny?: string[];
     autoBudget?: number;
@@ -46,7 +46,8 @@ export declare function createDurableAskPolicy(opts: {
     exempt?: (canonicalToolName: string) => Promise<boolean>;
     /** Audit hook — fired when an exemption short-circuits the ask (the `approval_exempted` log line). */
     onExempted?: (canonicalToolName: string, rawToolName: string) => void;
-}): ToolPolicy;
+}
+export declare function createDurableAskPolicy(opts: DurableAskOptions): ToolPolicy;
 export interface OaApprovalOptions {
     store: ApprovalStore;
     /** Tool names that require an operator decision before they run. */

package/dist/approval.js

@@ -30,12 +30,6 @@ export function hasOperatorGateIntent(config) {
         config.approvalNeverAuto.length > 0 || // ← 漏了这格,见上面的由来
         config.durableApproval);
 }
-/**
- * Durable approval policy (core 1.67 / design/45): returns three-state **`ask`** for gated tools instead of
- * polling. With `TaskSpec.durableApproval` set + a `checkpointStore` on the Runner, core turns that `ask` into
- * a **suspend** (persists a checkpoint, ends `status:"suspended"`) — no held connection, resumable on any
- * replica. (Contrast {@link createOaApprovalPolicy}, which holds the call open by polling a TiDB row.)
- */
 export function createDurableAskPolicy(opts) {
     // 🔒 CANONICAL-space matching (mirrors core 1.202 `createAllowDenyPolicy` + the design/116 S8 discipline):
     // configured names AND the live request name both normalize via `canonicalToolName`, so an operator rule written

package/dist/bake-runner/main.js

@@ -12,6 +12,7 @@ import { readFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { createLogger } from "../observability/logger.js";
 import { parseNumOrFailNonNegative } from "../config.js";
+import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { BakeRunner, } from "./runner.js";
 const exec = promisify(execCb);
 function loadEnv() {
@@ -224,11 +225,6 @@ function makeHostOps(env) {
         },
     };
 }
-/** Shell-quote a single argument for the `exec` string forms above (df/git/docker take server-fixed paths/refs, but
- *  a defensive quote keeps a surprising RECIPE_DIR/ref from breaking the command — argv to build.sh is a vector). */
-function shellSafe(s) {
-    return `'${s.replace(/'/g, "'\\''")}'`;
-}
 function makeClock() {
     return {
         now: () => Date.now(),

package/dist/boot/config-center.js

@@ -46,6 +46,7 @@ import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../con
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
+import { SHA256_HEX_RE } from "../digest-form.js";
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     // Config-center: pull the effective config on boot and apply it OVER the env
@@ -324,7 +325,7 @@ export async function createConfigCenterRuntime(ctx) {
             const cacheDir = defaultSkillCacheDir();
             for (const m of enabledSkills) {
                 const hex = m.contentHash.replace(/^sha256:/, "").toLowerCase();
-                if (!/^[0-9a-f]{64}$/.test(hex))
+                if (!SHA256_HEX_RE.test(hex))
                     return false;
                 try {
                     const text = await fsReadFile(join(cacheDir, hex), "utf8");

package/dist/boot/execution-env.d.ts

@@ -16,8 +16,8 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;
     perSessionCwd: Map<string, string>;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    setSessionCwd: (sid: string, value: string) => void;
+    setSessionShellEnv: (sid: string, value: Record<string, string>) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;

package/dist/boot/execution-env.js

@@ -34,6 +34,21 @@ import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js"
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
+/**
+ * #97 R11: the perSessionCwd/perSessionShellEnv setters below share one idiom (delete-then-set so a
+ * re-set moves the tail to MRU, then oldest-first eviction on overflow). Local to this file — NOT the
+ * public {@link import("../bounded-session-map.js").BoundedSessionMap} seam, because both callers below
+ * still hand out the raw `Map` (its declared type threads through `resolve-spec.ts` as `Map<string, V>`,
+ * not a class instance) — this only DRYs the two identical closures, it changes no public shape.
+ */
+function boundedSessionSetter(map, maxEntries) {
+    return (sid, value) => {
+        map.delete(sid); // re-insert at the tail = most-recently-used
+        map.set(sid, value);
+        if (map.size > maxEntries)
+            map.delete(map.keys().next().value); // evict oldest
+    };
+}
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
     // design/48 v1b: deployment-level remote execution(部署级路由 + 懒汉连接). When
@@ -54,22 +69,12 @@ export function createExecutionEnv(ctx) {
     // re-sends cwd on every request, so evicting a stale session is harmless (it re-registers on next use).
     const MAX_CWD_SESSIONS = 4096;
     const perSessionCwd = new Map();
-    const setSessionCwd = (sid, cwd) => {
-        perSessionCwd.delete(sid); // re-insert at the tail = most-recently-used
-        perSessionCwd.set(sid, cwd);
-        if (perSessionCwd.size > MAX_CWD_SESSIONS)
-            perSessionCwd.delete(perSessionCwd.keys().next().value); // evict oldest
-    };
+    const setSessionCwd = boundedSessionSetter(perSessionCwd, MAX_CWD_SESSIONS);
     // [R-survey / TOC shellEnv seam, core PLAN批注] per-session `settings.env` → the host lane's agent shell env
     // (resolveSpec registers it gated by cwdHonored — single-user host lane only; the host factory merges it by
     // ctx.sessionId). design/107 "env = capability axis". Same LRU bound + re-send-on-every-request semantics as cwd.
     const perSessionShellEnv = new Map();
-    const setSessionShellEnv = (sid, env) => {
-        perSessionShellEnv.delete(sid);
-        perSessionShellEnv.set(sid, env);
-        if (perSessionShellEnv.size > MAX_CWD_SESSIONS)
-            perSessionShellEnv.delete(perSessionShellEnv.keys().next().value);
-    };
+    const setSessionShellEnv = boundedSessionSetter(perSessionShellEnv, MAX_CWD_SESSIONS);
     let executionEnvFactory;
     // SVC-3 worktree isolation: the reaper (defined far below) reuses ONE long-lived git base env + repoRoot to
     // `git worktree prune` crash-orphaned worktrees. Holders are populated when the wrapper is wired (host lane).

package/dist/boot/resolve-spec.js

@@ -39,7 +39,7 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, memorySpecForRequest } from "../security.js";
+import { HttpError, memorySpecForRequest, encodeCheckpointScope } from "../security.js";
 import { mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
@@ -747,7 +747,7 @@ export function createResolveSpec(ctx) {
                 ? {
                     checkpointStore,
                     durableApproval: {
-                        scope: auth?.principal ?? "_",
+                        scope: encodeCheckpointScope(auth?.principal),
                         ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
                     },
                     // design/80 seam #2: opt this task into resource/preempt durable-suspend (design/74 third state)
@@ -760,7 +760,7 @@ export function createResolveSpec(ctx) {
                         ttlSec: config.resourceSuspendTtlSec,
                         isVerify: body.verify === true,
                         isCascade: body.cascade === true,
-                        scope: auth?.principal ?? "_",
+                        scope: encodeCheckpointScope(auth?.principal),
                     })),
                     onQuestion: QUESTION_AWAITS_RESUME,
                 }

package/dist/bounded-session-map.d.ts

@@ -0,0 +1,25 @@
+/**
+ * #97 R11 收编:两个既有 session-keyed registry({@link import("./per-task-image.js").PerTaskImageRegistry}
+ * 与 {@link import("./capabilities/select-environment-tool.js").SessionEnvironmentSelection})共享的同一形
+ * (delete-then-set + 容量闩逐最老 + get 吞 undefined)收编到一处——基准实现逐字取自
+ * `PerTaskImageRegistry`(唯一行为变化:泛型化 value 类型)。两消费类改为持有本类的组合薄壳,自己的
+ * 构造器/方法签名不变。
+ */
+/**
+ * KEYED BY sessionId, NON-removing `get`, bounded by oldest-first eviction on overflow.
+ *
+ * `set` re-inserts at the tail (Map iteration order = insertion order) via delete-then-set, so a re-set
+ * of an EXISTING key becomes the newest entry — the eviction below always removes the map's current
+ * first key, so a key that was just re-set is the LAST to be evicted, not the first.
+ */
+export declare class BoundedSessionMap<V> {
+    private readonly maxEntries;
+    private readonly map;
+    constructor(maxEntries?: number);
+    /** A re-set (same key) overwrites and moves the entry to the newest position; on overflow the oldest
+     *  insertion is evicted. */
+    set(sessionId: string, value: V): void;
+    /** `undefined` sessionId or an unregistered session both → `undefined` (non-removing read). */
+    get(sessionId: string | undefined): V | undefined;
+}
+//# sourceMappingURL=bounded-session-map.d.ts.map

package/dist/bounded-session-map.js

@@ -0,0 +1,37 @@
+/**
+ * #97 R11 收编:两个既有 session-keyed registry({@link import("./per-task-image.js").PerTaskImageRegistry}
+ * 与 {@link import("./capabilities/select-environment-tool.js").SessionEnvironmentSelection})共享的同一形
+ * (delete-then-set + 容量闩逐最老 + get 吞 undefined)收编到一处——基准实现逐字取自
+ * `PerTaskImageRegistry`(唯一行为变化:泛型化 value 类型)。两消费类改为持有本类的组合薄壳,自己的
+ * 构造器/方法签名不变。
+ */
+/**
+ * KEYED BY sessionId, NON-removing `get`, bounded by oldest-first eviction on overflow.
+ *
+ * `set` re-inserts at the tail (Map iteration order = insertion order) via delete-then-set, so a re-set
+ * of an EXISTING key becomes the newest entry — the eviction below always removes the map's current
+ * first key, so a key that was just re-set is the LAST to be evicted, not the first.
+ */
+export class BoundedSessionMap {
+    maxEntries;
+    map = new Map();
+    constructor(maxEntries = 4096) {
+        this.maxEntries = maxEntries;
+    }
+    /** A re-set (same key) overwrites and moves the entry to the newest position; on overflow the oldest
+     *  insertion is evicted. */
+    set(sessionId, value) {
+        this.map.delete(sessionId);
+        this.map.set(sessionId, value);
+        if (this.map.size > this.maxEntries) {
+            const oldest = this.map.keys().next().value;
+            if (oldest !== undefined)
+                this.map.delete(oldest);
+        }
+    }
+    /** `undefined` sessionId or an unregistered session both → `undefined` (non-removing read). */
+    get(sessionId) {
+        return sessionId === undefined ? undefined : this.map.get(sessionId);
+    }
+}
+//# sourceMappingURL=bounded-session-map.js.map

package/dist/capabilities/center-plugins.d.ts

@@ -38,9 +38,14 @@ export declare function gitClonePlan(o: {
     steps: string[][];
     env: Record<string, string>;
 };
+/** manifest 本体尺寸上限(#97 redesign⑥ V2-⑦:**新的本地输入上限**,非既有格式事实——manifest 只被
+ *  消费一个 `skillsPath` 字段,几行 JSON;超界视为畸形输入整条拒装)。 */
+export declare const PLUGIN_MANIFEST_MAX_BYTES: number;
 /** 条款 5 的 manifest 半场:`.claude-plugin/plugin.json` 的 `skillsPath`(缺省 `skills/`;cli plugin
  *  布局同族)。返回 ok:true+dir:undefined = 插件没有 skills 目录(可以只有 commands——那是 cli 壳的
- *  半场,worker 装 0 个 skill 不算失败);ok:false = 路径逃逸,整条拒装。 */
+ *  半场,worker 装 0 个 skill 不算失败);ok:false = 路径逃逸/manifest 本体畸形,整条拒装。
+ *  manifest 臂分立(V2-⑦,原 broad-catch 是 fail-open):**不存在**=可选面,缺省 skills/;**存在但**
+ *  本体逃逸根外/非普通文件/超界/读失败/JSON 坏 = ok:false 走既有 warning 面。 */
 export declare function resolvePluginSkillsRoot(cloneRoot: string): {
     ok: true;
     dir?: string;

package/dist/capabilities/center-plugins.js

@@ -22,9 +22,9 @@
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { promises as fsp, realpathSync, existsSync, readFileSync } from "node:fs";
+import { promises as fsp, realpathSync, existsSync, readFileSync, lstatSync, statSync } from "node:fs";
 import { join, resolve, isAbsolute, sep } from "node:path";
-import { loadSkills } from "./skills.js";
+import { assertConfined, loadSkills } from "./skills.js";
 const execFileP = promisify(execFile);
 /** 缺省 clone host 白名单(契约条款 1;国内镜像走本名单加 https 镜像域,不开 http 口)。 */
 export const DEFAULT_PLUGIN_ALLOW_HOSTS = ["github.com"];
@@ -83,22 +83,45 @@ export function gitClonePlan(o) {
         env,
     };
 }
+/** manifest 本体尺寸上限(#97 redesign⑥ V2-⑦:**新的本地输入上限**,非既有格式事实——manifest 只被
+ *  消费一个 `skillsPath` 字段,几行 JSON;超界视为畸形输入整条拒装)。 */
+export const PLUGIN_MANIFEST_MAX_BYTES = 64 * 1024;
 /** 条款 5 的 manifest 半场:`.claude-plugin/plugin.json` 的 `skillsPath`(缺省 `skills/`;cli plugin
  *  布局同族)。返回 ok:true+dir:undefined = 插件没有 skills 目录(可以只有 commands——那是 cli 壳的
- *  半场,worker 装 0 个 skill 不算失败);ok:false = 路径逃逸,整条拒装。 */
+ *  半场,worker 装 0 个 skill 不算失败);ok:false = 路径逃逸/manifest 本体畸形,整条拒装。
+ *  manifest 臂分立(V2-⑦,原 broad-catch 是 fail-open):**不存在**=可选面,缺省 skills/;**存在但**
+ *  本体逃逸根外/非普通文件/超界/读失败/JSON 坏 = ok:false 走既有 warning 面。 */
 export function resolvePluginSkillsRoot(cloneRoot) {
     let skillsPath = "skills";
+    const rootReal = realpathSync(cloneRoot);
+    const manifestPath = join(cloneRoot, ".claude-plugin", "plugin.json");
+    let manifestPresent = false;
     try {
-        const manifest = JSON.parse(readFileSync(join(cloneRoot, ".claude-plugin", "plugin.json"), "utf8"));
-        if (typeof manifest.skillsPath === "string" && manifest.skillsPath !== "")
-            skillsPath = manifest.skillsPath;
+        lstatSync(manifestPath); // 条目在场判定(lstat:悬空 symlink 也算在场——它该走拒绝臂,不是缺席臂)
+        manifestPresent = true;
     }
     catch {
-        /* 无 manifest / 坏 JSON ⇒ 缺省 skills/(manifest 是可选面) */
+        /* 无 manifest ⇒ 缺省 skills/(manifest 是可选面) */
+    }
+    if (manifestPresent) {
+        try {
+            assertConfined(manifestPath, rootReal, "plugin manifest");
+            const st = statSync(manifestPath);
+            if (!st.isFile())
+                return { ok: false, reason: `plugin manifest is not a regular file (${manifestPath})` };
+            if (st.size > PLUGIN_MANIFEST_MAX_BYTES) {
+                return { ok: false, reason: `plugin manifest exceeds ${PLUGIN_MANIFEST_MAX_BYTES} bytes (got ${st.size})` };
+            }
+            const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+            if (typeof manifest.skillsPath === "string" && manifest.skillsPath !== "")
+                skillsPath = manifest.skillsPath;
+        }
+        catch (e) {
+            return { ok: false, reason: `plugin manifest rejected: ${e instanceof Error ? e.message : String(e)}` };
+        }
     }
     if (isAbsolute(skillsPath))
         return { ok: false, reason: `skillsPath must be relative (got ${skillsPath})` };
-    const rootReal = realpathSync(cloneRoot);
     const candidate = resolve(rootReal, skillsPath);
     // 先做词法前缀判定(../ 逃逸在 realpath 之前就拒——目标可能不存在)
     if (candidate !== rootReal && !candidate.startsWith(rootReal + sep)) {
@@ -180,7 +203,7 @@ export async function applyCenterPlugins(baseline, eff, opts) {
             }
             if (!rootCheck.dir)
                 continue; // 无 skills 目录:合法(commands-only 插件,cli 壳的半场)
-            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir }); // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸)
+            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir }); // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸)
             for (const skill of loaded) {
                 if (taken.has(skill.spec.name)) {
                     // 收紧④:plugin 让位(方向与 center-wins 相反,理由见模块顶注)。

package/dist/capabilities/center-prompts.js

@@ -21,6 +21,7 @@
  */
 import { verifyPromptArtifact } from "@sema-agent/core";
 import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+import { SHA256_HEX_RE } from "../digest-form.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
  *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6,lens2 §G:消 config-lkg → capabilities 的
  *  唯一分层反向边)。此处 re-export 保兼容——既有消费者(main/run-local/测试)零改动。 */
@@ -39,7 +40,7 @@ export function withPromptArtifactBackfill(inner, fetchRaw, log) {
         put: (e) => inner.put(e),
         get: async (digest, opts) => {
             const hex = digest.replace(/^sha256:/i, "").toLowerCase();
-            if (!/^[0-9a-f]{64}$/.test(hex))
+            if (!SHA256_HEX_RE.test(hex))
                 return undefined; // malformed request — never a network trip
             const canonical = `sha256:${hex}`;
             const local = await inner.get(canonical, opts);

package/dist/capabilities/sandbox-file-send.d.ts

@@ -35,6 +35,7 @@
  */
 import type { ExecutionEnv, ExecutionEnvFactory } from "@sema-agent/core";
 import type { IssuedFileLink, PreparedDirectUpload } from "../plugins/send-user-file.js";
+import { shellQuote as shq } from "../plugins/remote-shell.js";
 /** Leak backstop (codex review HIGH): core skips destroy on suspend/review paths and a crash may skip it
  *  entirely — the suspendVM wrap covers the common case, this bound covers the rest. Far above any real
  *  per-replica concurrency. 修6: at the cap the registry REFUSES the new registration instead of FIFO-evicting
@@ -91,8 +92,7 @@ export declare class TaskEnvRegistry {
  *    adb/local-docker remain a follow-on).
  */
 export declare function sandboxSendLaneEnabled(provider: string | undefined, requirePrincipal: boolean): boolean;
-/** Single-quote a path for POSIX sh (the only metacharacter inside '' is ' itself). */
-export declare function shq(s: string): string;
+export { shq };
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/sandbox-file-send.js

@@ -1,4 +1,5 @@
 import { hasDestroy } from "@sema-agent/core";
+import { shellQuote as shq } from "../plugins/remote-shell.js";
 /** Leak backstop (codex review HIGH): core skips destroy on suspend/review paths and a crash may skip it
  *  entirely — the suspendVM wrap covers the common case, this bound covers the rest. Far above any real
  *  per-replica concurrency. 修6: at the cap the registry REFUSES the new registration instead of FIFO-evicting
@@ -138,10 +139,11 @@ export function sandboxSendLaneEnabled(provider, requirePrincipal) {
         return requirePrincipal !== true;
     return false;
 }
-/** Single-quote a path for POSIX sh (the only metacharacter inside '' is ' itself). */
-export function shq(s) {
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
+// design/158 R10: the quoting logic itself now lives solely in remote-shell.ts's shellQuote (this module's
+// former standalone copy was byte-identical; its JSDoc note was folded into that owner). `shq` stays a
+// re-exported alias — not a plain call-through rename — because two test files import `shq` by name from
+// this module.
+export { shq };
 /** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
  *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
  *  URI, so an error can quote the URL re-encoded; codex review MED). */

package/dist/capabilities/select-environment-tool.d.ts

@@ -13,8 +13,7 @@ export interface EnvironmentCatalog extends SandboxImageResolver {
  *  honest v1 boundary: a worker restart drops the selection (the model can re-select; nothing fails closed
  *  the wrong way, the session just falls back to the worker default image). */
 export declare class SessionEnvironmentSelection {
-    private readonly maxEntries;
-    private readonly map;
+    private readonly bounded;
     constructor(maxEntries?: number);
     set(sessionId: string, profile: string): void;
     get(sessionId: string | undefined): string | undefined;

package/dist/capabilities/select-environment-tool.js

@@ -21,28 +21,24 @@
  * (tenant-neutral profile names only — the list enters model context).
  */
 import { Type } from "typebox";
+import { BoundedSessionMap } from "../bounded-session-map.js";
 import { resolveSandboxImageRef } from "../per-task-image.js";
 /** Session-keyed selected PROFILE (intent). Mirrors PerTaskImageRegistry's bounded-eviction shape, but holds
  *  the profile string so every subsequent task re-resolves fail-closed (re-admit discipline). In-memory —
  *  honest v1 boundary: a worker restart drops the selection (the model can re-select; nothing fails closed
  *  the wrong way, the session just falls back to the worker default image). */
 export class SessionEnvironmentSelection {
-    maxEntries;
-    map = new Map();
+    // #97 R11: same BoundedSessionMap basis as PerTaskImageRegistry (composition, not inheritance) — this
+    // class's own ctor/method surface is unchanged.
+    bounded;
     constructor(maxEntries = 4096) {
-        this.maxEntries = maxEntries;
+        this.bounded = new BoundedSessionMap(maxEntries);
     }
     set(sessionId, profile) {
-        this.map.delete(sessionId);
-        this.map.set(sessionId, profile);
-        if (this.map.size > this.maxEntries) {
-            const oldest = this.map.keys().next().value;
-            if (oldest !== undefined)
-                this.map.delete(oldest);
-        }
+        this.bounded.set(sessionId, profile);
     }
     get(sessionId) {
-        return sessionId === undefined ? undefined : this.map.get(sessionId);
+        return this.bounded.get(sessionId);
     }
 }
 const capList = (caps) => Object.entries(caps ?? {})

package/dist/capabilities/skills.d.ts

@@ -42,6 +42,10 @@ export interface LoadSkillsOptions {
     /** 不可信 lane 的约束根(通常=clone root)。缺席=受控 lane,不做逐条目约束。 */
     confineTo?: string;
 }
+/** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
+ *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。
+ *  `label` = 错误文本里的对象名(center-plugins 用它约束 manifest 本体,报错不该指成 skill entry)。 */
+export declare function assertConfined(p: string, rootReal: string, label?: string): void;
 export declare function loadSkills(dir: string, opts?: LoadSkillsOptions): LoadedSkill[];
 /** Skills applicable to a scenario: those tagged with it, plus untagged (global) ones. */
 export declare function skillsForScenario(loaded: LoadedSkill[], scenario: string): SkillSpec[];

package/dist/capabilities/skills.js

@@ -1,17 +1,18 @@
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { join, sep } from "node:path";
 /** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
- *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。 */
-function assertConfined(p, rootReal) {
+ *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。
+ *  `label` = 错误文本里的对象名(center-plugins 用它约束 manifest 本体,报错不该指成 skill entry)。 */
+export function assertConfined(p, rootReal, label = "skill entry") {
     let real;
     try {
         real = realpathSync(p);
     }
     catch (e) {
-        throw new Error(`skill entry ${p} is unreadable (dangling symlink or missing): ${e instanceof Error ? e.message : String(e)}`);
+        throw new Error(`${label} ${p} is unreadable (dangling symlink or missing): ${e instanceof Error ? e.message : String(e)}`);
     }
     if (real !== rootReal && !real.startsWith(rootReal + sep)) {
-        throw new Error(`skill entry ${p} escapes the plugin root (resolves outside ${rootReal}) — untrusted checkouts may not link to host files`);
+        throw new Error(`${label} ${p} escapes the plugin root (resolves outside ${rootReal}) — untrusted checkouts may not link to host files`);
     }
 }
 export function loadSkills(dir, opts) {

package/dist/config-center/http-client.js

@@ -6,6 +6,7 @@
  */
 import { createHash } from "node:crypto";
 import { readEffectiveWire } from "@sema-agent/registry-core";
+import { centerPromptsFromEffective } from "../prompts-domain-validate.js"; // #100 worker 腿 prompts 边界归一(中立叶)
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[2281] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
@@ -35,6 +36,14 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
     // 警告(值已被收编接受)不算 error,不进 domainErrors——与本地店同口径。
     const warnings = [];
     const wire = readEffectiveWire(await res.json(), (w) => warnings.push(w));
+    // #100 边界单点归一(§V2-B):worker 腿 prompts 键在**这里**定形——0.13.0 起 wire 值 verbatim 到手,
+    // 存储原文(global lane 合法下发形/emptyEffective 底座)归一为「键缺席」或 catalog 投影,下游
+    // boot/adopt/refresh/deferred/LKG 存取全部只见「缺席或消费形」(裸 `.prompts` 直读有棘轮钉拦)。
+    const centerPrompts = centerPromptsFromEffective(wire);
+    if (centerPrompts === undefined)
+        delete wire.prompts;
+    else
+        wire.prompts = centerPrompts;
     const domainErrors = warnings
         .filter((w) => w.kind === "domain-defaulted")
         .map((w) => ({ domain: w.domain, error: (w.error instanceof Error ? w.error.message : String(w.error)).slice(0, 600) }));

package/dist/config-center/skills-mcp.js

@@ -7,6 +7,7 @@
  */
 import { skillContentHash } from "@sema-agent/registry-core";
 import { fetchSkillContent } from "./http-client.js";
+import { SHA256_HEX_RE } from "../digest-form.js";
 /**
  * Merge center skills OVER the image baseline (design/41-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → center skills lazily fetched by hash and overlaid BY NAME (center
@@ -26,7 +27,7 @@ diskCacheDir) {
         if (!diskCacheDir)
             return undefined;
         const hex = hash.replace(/^sha256:/, "");
-        if (!/^[0-9a-f]{64}$/.test(hex))
+        if (!SHA256_HEX_RE.test(hex))
             return undefined; // hash 形不对=不碰盘(路径安全)
         try {
             const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");

package/dist/digest-form.d.ts

@@ -0,0 +1,15 @@
+/**
+ * design/158 R12 收编叶子 — the sha256 content-address SHAPE constants, single-sourced. A neutral leaf (no
+ * imports of its own) so both `security.ts`-adjacent modules and prompt/image/session-sync consumers can
+ * depend on it without a layering edge. Six call sites across the tree each ran their OWN literal copy of one
+ * of these two regexes (a bare-hex form and a scheme-qualified form) — same shape, independently typed out.
+ * This module is the single point of truth for the SHAPE; each consumer's accept POLICY (prefix-stripping,
+ * case-folding order) is UNCHANGED by this collection — those policies differ across call sites (a real,
+ * pre-existing divergence, not introduced here) and are tracked for a follow-up cross-repo alignment, not
+ * unified in this refactor.
+ */
+/** A bare sha256 content-address: exactly 64 lowercase-hex characters, no scheme prefix. */
+export declare const SHA256_HEX_RE: RegExp;
+/** A scheme-qualified sha256 content-address: `sha256:` followed by 64 lowercase-hex characters. */
+export declare const SHA256_DIGEST_RE: RegExp;
+//# sourceMappingURL=digest-form.d.ts.map

package/dist/digest-form.js

@@ -0,0 +1,15 @@
+/**
+ * design/158 R12 收编叶子 — the sha256 content-address SHAPE constants, single-sourced. A neutral leaf (no
+ * imports of its own) so both `security.ts`-adjacent modules and prompt/image/session-sync consumers can
+ * depend on it without a layering edge. Six call sites across the tree each ran their OWN literal copy of one
+ * of these two regexes (a bare-hex form and a scheme-qualified form) — same shape, independently typed out.
+ * This module is the single point of truth for the SHAPE; each consumer's accept POLICY (prefix-stripping,
+ * case-folding order) is UNCHANGED by this collection — those policies differ across call sites (a real,
+ * pre-existing divergence, not introduced here) and are tracked for a follow-up cross-repo alignment, not
+ * unified in this refactor.
+ */
+/** A bare sha256 content-address: exactly 64 lowercase-hex characters, no scheme prefix. */
+export const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+/** A scheme-qualified sha256 content-address: `sha256:` followed by 64 lowercase-hex characters. */
+export const SHA256_DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+//# sourceMappingURL=digest-form.js.map

package/dist/http/route-ctx.d.ts

@@ -22,6 +22,7 @@ import type { IdempotencyCache } from "./idempotency.js";
 import type { ImagesLocal } from "./routes/images.js";
 import type { SessionsLocal } from "./routes/sessions.js";
 import type { SessionSyncLocal } from "./routes/session-sync.js";
+import type { VerifyRoundsSpec } from "./verify-rounds.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。 */
 export interface RunRegistry {
     idemCache: IdempotencyCache<{
@@ -80,10 +81,7 @@ export interface RouteRequestState {
 export interface PreparedTaskSubmission {
     spec: TaskSpec;
     auth?: RequestAuth;
-    verify?: {
-        maxRounds: number;
-        costCeilingMicroUsd?: number;
-    };
+    verify?: VerifyRoundsSpec;
     cascade?: boolean;
     jobId?: string;
     body: TaskRequestBody;
@@ -97,10 +95,7 @@ export interface DriveResumeArgs {
     taskConfig: Omit<TaskSpec, "objective" | "sessionId">;
     resumeObjective: string;
     outcome: ResumeOutcome;
-    verifyRounds: {
-        maxRounds: number;
-        costCeilingMicroUsd?: number;
-    } | undefined;
+    verifyRounds: VerifyRoundsSpec | undefined;
     /** codex M2: side-effects that must land AFTER the markResuming CAS is WON (decide accepted, sibling races
      *  lost — never fires on the 409/404 paths) and BEFORE the model leg drives (so the resumed leg's own next
      *  ask sees them — the decide leg's exemption grant). Contract: must not throw (callers swallow internally);

package/dist/http/routes/approvals-assistant.js

@@ -1,5 +1,5 @@
 import { canonicalToolName } from "@sema-agent/core";
-import { principalFrom, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS } from "../../security.js";
+import { principalFrom, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS, decodeCheckpointScope } from "../../security.js";
 import { redactedPreview } from "../../trace/redact.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
@@ -586,7 +586,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 // like null (open), as the sibling sites already do (the 5040/5599/5653 normalizations). Without this an
                 // anonymous single-user durable worker DEADLOCKS its own approvals (decide → 404 forever; workflow audit
                 // 2026-07-13, confirmed by both verify lenses).
-                const ownsIt = cpScope == null || cpScope === "_" || cpScope === deciderPrincipal; // null/"_" = anonymous/dev (open)
+                const decodedCpScope = cpScope != null ? decodeCheckpointScope(cpScope) : undefined;
+                const ownsIt = cpScope == null || decodedCpScope === undefined || decodedCpScope === deciderPrincipal; // null/"_" = anonymous/dev (open)
                 if (!ownsIt) {
                     sendError(res, 404, "not_found.approval", "approval not found");
                     return;

package/dist/http/routes/runs.js

@@ -1,5 +1,5 @@
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
-import { HttpError, verifiedPrincipal, isUuidV7 } from "../../security.js";
+import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { runInBackground } from "../../runs.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
@@ -661,7 +661,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
-                const cpScope = run.owner ?? "_"; // 匿名提交哨兵,与 main.ts putCtx 的 principal ?? "_" 同域
+                const cpScope = encodeCheckpointScope(run.owner); // 匿名提交哨兵,与 main.ts putCtx 的 principal ?? "_" 同域
                 const wakeToken = mintCheckpointToken();
                 await cs.put(wakeToken, {
                     token: wakeToken,