@sema-agent/server 4.2.0 → 5.0.0

package/dist/plugins/tidb-pool.js

@@ -198,32 +198,8 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (session_id),
      KEY idx_task (task_id)
    )`,
-    // Human-in-the-loop approval gate (F4). A pending row is durable so an operator's decision can
-    // arrive on any instance; the instance running the task polls this row to release its wait.
-    `CREATE TABLE IF NOT EXISTS approval (
-     id          VARCHAR(64)  NOT NULL,
-     task_id     VARCHAR(64)  NULL,
-     session_id  VARCHAR(64)  NULL,
-     owner       VARCHAR(190) NULL,
-     -- scope — single-DB fleet scope guard (defense-in-depth): the run's tenant identity (owner-sourced), so the
-     -- approval READ paths (getStatus / get / listPending / decide) can null-safe-filter on it. A NULL scope row
-     -- (an untenanted run — and, on the pre-folding schema, any PRE-MIGRATION row) is matched by a NULL scope arg
-     -- via MySQL <=> / PG IS NOT DISTINCT FROM — see tidb-approval-store.ts / pg-approval-store.ts.
-     -- expireStale deliberately stays GLOBAL (fleet maintenance, not a tenant read).
-     scope       VARCHAR(190) NULL,
-     tool_name   VARCHAR(190) NOT NULL,
-     args        JSON         NULL,
-     status      VARCHAR(16)  NOT NULL,
-     reason      TEXT         NULL,
-     decided_by  VARCHAR(190) NULL,
-     created_at  DATETIME(3)  NOT NULL,
-     decided_at  DATETIME(3)  NULL,
-     PRIMARY KEY (id),
-     KEY idx_owner_status (owner, status),
-     -- idx_scope_status: the scope-filtered READ paths (listPending WHERE scope <=> ?) would full-scan without it.
-     KEY idx_scope_status (scope, status),
-     KEY idx_status (status)
-   )`,
+    // ([2354]/[2356] A-5,5.0.0:F4 轮询车道的 `approval` 表 DDL 已随车道退役——存量库里的旧表留置不动,
+    //  代码零读写;durable 门只用下面的 checkpoint 表。)
     // Durable-checkpoint (core 1.67 / design/45): a policy `ask` persisted as a suspended task so an operator
     // can `resume` it from any replica. `checkpoint` = core's blob + CAS status; `outcome` persisted on resolve
     // (R20 #1). Timestamps are epoch-ms BIGINT (the core Checkpoint uses ms numbers, not DATETIME).
@@ -396,7 +372,7 @@ export const SCHEMA_STATEMENTS = [
     // = JSON.stringify(TaskResult). The (run_id, ordinal) PK makes append IDEMPOTENT (ON DUPLICATE KEY = OVERWRITE /
     // last-write-wins) so a resumed run re-appending its replayed prefix verbatim leaves no dup — the byte-match of
     // core's InMemoryWorkflowJournalStore (byOrdinal.set). LOAD-BEARING (a resume replays it), unlike the best-effort
-    // task_event observation log. GC'd by the run reaper (deleteByRun). See tidb-workflow-journal-store.ts.
+    // task_event observation log. GC'd by the run reaper (deleteByRun). See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id     VARCHAR(191) NOT NULL,
      ordinal    INT          NOT NULL,
@@ -621,7 +597,7 @@ export const SCHEMA_STATEMENTS = [
     // Admission sentinel: ONE always-present row per builder pool, `SELECT … FOR UPDATE`-locked to SERIALIZE the
     // createBakeIfIdle busy-check+insert. A bare conditional INSERT…SELECT WHERE NOT EXISTS does NOT serialize two
     // concurrent admissions under TiDB's REPEATABLE READ (nor PG's READ COMMITTED), so without this lock two keyless
-    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (pg-image-bake.ts).
+    // POSTs can both admit a non-dryRun bake. Dialect-uniform with the PG twin (image-bake-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS image_bake_admit (
      pool VARCHAR(32) NOT NULL,
      PRIMARY KEY (pool)

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -8,7 +8,7 @@
  * {@link import("@sema-agent/core").InMemoryWorkflowJournalStore} (single-replica, lost on crash); this is the
  * byte-match durable twin so a workflow survives a replica crash and RESUMES (replay the longest unchanged
  * PREFIX of recorded `ctx.agent` results, run only the first changed/new call + everything after it live). The
- * journal is LOAD-BEARING (unlike the best-effort {@link import("./tidb-run-store.js")} observation layer):
+ * journal is LOAD-BEARING (unlike the best-effort {@link import("./run-store-sql.js")} observation layer):
  * append/load failures MUST throw — a silently-dropped entry would silently re-run already-done work.
  *
  * Schema = `workflow_journal (run_id, ordinal) PK` (DDL in tidb-pool.ts / pg-pool.ts ensureSchema). `ordinal`

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,5 @@
 import { callKeyOrdinal } from "@sema-agent/core";
-import { oversizeJournalResult } from "./workflow-journal-limits.js";
+import { oversizeJournalResult } from "@sema-agent/core";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {

package/dist/principal-jwt.js

@@ -1,7 +1,7 @@
 /**
  * design/80 D-G: principal crypto-binding (the direct-door IDENTITY gate) + the combined direct-door proof
- * verifier. Split out of `security.ts` (design/158 A13, internal-lossless — the facade re-exports every symbol
- * below unchanged; `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
+ * verifier. Split out of `security.ts` (design/158 A13; consumers import from HERE — [2354] cleared the security.ts compat re-exports;
+ * `verifyDirectDoorProof` imports {@link verifyApprovalHmac} from `./approval-hmac.js` for the
  * integrity half of the combined proof; `security.ts`'s own `verifiedPrincipal` imports {@link verifyPrincipalJwt}
  * from here for the direct-door identity branch).
  *

package/dist/prompts-domain-validate.d.ts

@@ -41,9 +41,10 @@ export interface PromptsDomainFaces {
 }
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */

package/dist/prompts-domain-validate.js

@@ -3,7 +3,7 @@
  * lens2 §G:`config-lkg.ts → capabilities/center-prompts.ts` 是全仓唯一一条显式分层反向边,config 层
  * 值 import capabilities 层)。本模块只依赖 node 内置 + `@sema-agent/core`,不依赖 capabilities/
  * config 任何东西,config-lkg(LKG 读侧复判)与 capabilities(候选门)同引即无反向边。
- * center-prompts.ts 原位置 re-export 保兼容,语义/文案零改动——逐字搬运。
+ * 消费者直引本模块([2354] 兼容面全清:center-prompts.ts 的原位兼容 re-export 已删);语义/文案零改动——逐字搬运。
  *
  * ─── 以下为原 center-prompts.ts 的判形半场,注释原样保留 ───
  *
@@ -107,9 +107,10 @@ export const CORE_ENGINE_VERSION = (() => {
 })();
 /**
  * prompts 域候选门 v2(validateCenterPrompts 的双轴升级;整拒语义不变=任一在场轴坏形 ⇒ 整个 prompts
- * 面拒绝采用,LKG/内置继续服务)。两形都认:
- *  - legacy 平铺(无 schemaVersion 键)= declaration 轴单轴(存量 center 停发平铺前的兼容窗);
- *  - `{schemaVersion:1, declarations?, catalog?}`(registry-core `EffectivePromptsWire`)= 至少一轴。
+ * 面拒绝采用,LKG/内置继续服务)。唯一认可形=`{schemaVersion:1, declarations?, catalog?}`
+ * (registry-core `EffectivePromptsWire`)至少一轴。[2373]B-9(5.0.0):legacy 平铺兼容窗到期删——
+ * 0.13.0 起 EffectivePromptsWire 首字段是 `schemaVersion: z.ZodLiteral<1>`,与 server 共用 ^0.13.0 的
+ * 合规 center 不可能再发平铺;非合规体=响亮拒绝(整拒落 LKG/内置),不再静默吸收。
  * catalog 轴的语义权威=core `verifyPromptArtifact`(形/digest 逐位复算/ARTIFACT_LIMITS/compatibleCore
  * range 全在 core 一处——[1242]③ a 解,上限单真源永不漂)。
  */
@@ -118,10 +119,8 @@ export function validatePromptsDomain(raw) {
         return { ok: false, error: "prompts is not an object" };
     const w = raw;
     if (w.schemaVersion === undefined) {
-        const legacy = validateCenterPrompts(raw);
-        if (!legacy.ok)
-            return legacy;
-        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
+        // [2373]B-9:平铺形拒绝(兼容窗 5.0.0 到期)。文案带指引=下游冒烟立刻可自修,不是哑谜。
+        return { ok: false, error: "prompts payload has no schemaVersion — the legacy flat shape was retired in 5.0.0; wrap as {schemaVersion:1, declarations:{...}} (registry-core EffectivePromptsWire)" };
     }
     if (w.schemaVersion !== 1)
         return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };

package/dist/router/route-orchestration.js

@@ -19,7 +19,7 @@
  * router's chosen arm per trap; the objective hidden-test oracle confirms danger→SUP prevents + competent→single
  * is not-worse) BEFORE it is wired into the live task path — never ship an unvalidated router.
  */
-import { canonicalToolName } from "@sema-agent/core";
+import {} from "@sema-agent/core";
 /**
  * The routing decision (pure). Order matters: explicit caller choice first, then (a) danger, then (b) structural,
  * else the single default. `team` is NEVER produced here — it only ever appears via {@link RoutingSignals.explicitMode}.
@@ -105,7 +105,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
  *  a notebook ungated (the exact "write tool bypasses the SUP gate" hole the review-HIGH closed for Edit/Write).
  *  Curated, NOT derived from HAND_TOOL_EFFECTS: that taxonomy is replay-safety (Write="idempotent"; Bash="write" but
  *  shell-gated), not "is an fs mutation". CANONICAL names only (core 1.202 retired MultiEdit into an Edit alias —
- *  `canonicalToolName` in the check below folds a replayed legacy "MultiEdit" call onto "Edit", so batch edits stay
+ *  (5.0.0:折叠面退役——重放的旧名调用由 core roster 层响亮 miss,不再折到 "Edit";raw 直比)
  *  gated without a stale alias entry here). */
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 /**
@@ -119,7 +119,7 @@ const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
     const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
     const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(canonicalToolName(req.toolName)) ? ask(req.toolName) : { action: "allow" }),
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
     return { shellGate: "always", toolPolicy: writeGate };
 }

package/dist/run-local.js

@@ -30,7 +30,8 @@ import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeLspManager,
 import { createBrain } from "./brain.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
+import { applyCatalogToSource } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
@@ -40,7 +41,8 @@ import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
-import { HttpError, memoryEngineBackendFor, memorySpecForRequest } from "./security.js";
+import { HttpError } from "./security.js";
+import { memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing } from "./budget.js";
 import { createKeyResolver } from "./key-resolver.js";
@@ -395,7 +397,6 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const scenarioDeps = {
         runner, subRunner, model: "default", skills, repoClient, metrics, logger,
-        oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         ...(webSearch ? { webSearch } : {}),
         brandIdentity: true, // run-local is always a local/TOC deployment → brand the default scenario as Sema.
     };
@@ -411,7 +412,7 @@ export async function runLocal(argv, deps = {}) {
     const requested = args.scenario ?? config.defaultScenario;
     const scenarioName = scenarios[requested] ? requested : "default";
     // A scenario may THROW HttpError synchronously when a prerequisite is unmet (e.g. `scan` needs
-    // GIT_API_BASEURL + a repo; `oa` needs OA_* + an authenticated principal — neither of which a one-shot CLI
+    // GIT_API_BASEURL + a repo — which a one-shot CLI may not
     // supplies). The server catches this in resolveSpec/prepareSpec and returns a clean 4xx; here we mirror that
     // with the doctor-style UX (message to stderr + exit 2) instead of letting it bubble to the fatal exit-1 path.
     let cap;

package/dist/runs.js

@@ -65,10 +65,12 @@ export async function backgroundAgentOutput(registry, handle, access, agentStore
  *  onServedTerminal (ack the completion as served) and suppress the workflow completion push. Refusals
  *  return the registry's own not_found shape, indistinguishable from an unknown handle (the route 404s it). */
 const TASK_HANDLE_KINDS = new Set(["background_bash", "monitor", "background_agent"]);
-/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查 legacy
- *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim、`resolveInternal` 含 legacyToTaskId、
- *  stopTask 还有 byName 臂)。裸 `!row` 回落会让垫充空白句柄(" "+wfId)/legacy shellId/agent 名字从
- *  回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop 全部复活(复审实测复现)。
+/** 1.250 复审 F1(HIGH):durable 回落的**形判门**——`getAccessibleTask` 是精确键(不 trim、不查
+ *  别名),而 core `pollTask/stopTask` 是通用解析面(先 trim;[2380] RB-479-A②:`legacyToTaskId`
+ *  shellId 索引已随 5.0.0 整族删,b* task_id 是唯一 registry 地址——本门防的「legacy shellId 穿缝」
+ *  一臂如今在 core 层就响亮 not_found;stopTask 仍有 byName 臂)。裸 `!row` 回落会让垫充空白句柄
+ *  (" "+wfId)/agent 名字从回落缝穿进 live 分支——kind 门要防的 onServedTerminal/游标消费/按名 stop
+ *  全部复活(复审实测复现)。
  *  只有 **a\* 精确形**才回落:`DURABLE_AGENT_HANDLE_RE` = core 公共导出(core 1.369,[1518] ask 即答
  *  ——两边判词同源,镜像私拷已删)。残余(documented):恰为 a\* 形的 agent **名字**
  *  在无 durable 行时仍会进 core stopTask 的 byName 臂——同 access 元组内、名字域与句柄域同形的病态窄面,
@@ -526,8 +528,8 @@ promptManifests) {
             // the top stream NEVER carries it), so this sink is the ONLY path a tick reaches the top-run consumers. 1.78
             // (review HIGH): fan it out to the DURABLE event log too (via the shared whitelist+redact builder, fire-and-
             // forget — `++seq` is a sync increment so sink-vs-loop appends get unique seqs), not just the fleet bus —
-            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below is
-            // forward-compat only (dead against core ≤1.208). core swallow-guards a throwing sink.
+            // previously no fleet bus wired ⇒ ticks dropped entirely, and the stream-switch task_progress case below was
+            // forward-compat then — [2373]B-4:floor ^4.0.0 下它是热路径(腐注方向已翻转,勿按旧注当死支)。core swallow-guards a throwing sink.
             const fwdInternals = {
                 onForwardEvent: (e) => {
                     fleetPublisher?.onForwardEvent(e);

package/dist/runtime-caps-resolver.d.ts

@@ -68,8 +68,9 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
  *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403

package/dist/runtime-caps-resolver.js

@@ -20,13 +20,13 @@ const defaultLogger = createLogger();
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
  *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。registry-core 类型未收编
- *  → unknown 宽读透传(allowObservers 0.10.2 期同款先例);center 发键即活。 */
+ *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[2373]B-6a:registry-core
+ *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
+ *  (allowObservers 同款收编先例)。 */
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    // 宽读(additive wide-read):registry-core 0.10.3 类型未含 autoMode,center 下发先行时走 unknown 读。
-    const autoMode = ent.autoMode;
+    const autoMode = ent.autoMode; // [2373]B-6a:0.13.0 类型直读(宽读逃逸已收编)
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
     if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode)) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");

package/dist/runtime-governance.d.ts

@@ -29,13 +29,10 @@ export type CommandRule = {
     command: string;
     decision: "allow" | "ask" | "deny";
 };
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export declare function isDelegationToolName(name: string): boolean;
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated

package/dist/runtime-governance.js

@@ -23,17 +23,13 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { canonicalToolName, combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-/** True when `name` names a DELEGATION tool — the subagent tool (CC-187 canonical `"Agent"`, core 1.202
- *  `DEFAULT_SUBAGENT_TOOL_NAME`; legacy alias `"Task"`). CANONICAL-space compare (`canonicalToolName`) so both
- *  spellings match — the pre-1.202 raw `!== "Task"` compare in the read-only strip (main.ts) silently stopped
- *  matching when core renamed the tool (fail-open: a plan-mode / hands-read-only parent could delegate to a
- *  WRITABLE-hands child, because core does not propagate handsReadOnly to a delegated child).
- *  core 1.257 (design/136 BREAKING): the standalone `Fork` tool is retired — a fork is now
- *  `Agent(subagent_type:"fork")`, i.e. an Agent call, already matched by DEFAULT_SUBAGENT_TOOL_NAME. */
+import { combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
+/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
+ *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
+ *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
+ *  fail-open(那个教训的解=引用常量,不是折叠)。 */
 export function isDelegationToolName(name) {
-    const c = canonicalToolName(name);
-    return c === DEFAULT_SUBAGENT_TOOL_NAME;
+    return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
 /** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
  *  not just the name predicate — is pinned by tests): core does not propagate `handsReadOnly` to a delegated
@@ -77,10 +73,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
     return {
         check(req) {
-            // Out of scope for non-shell tools: this gate only speaks about shell command names. Canonical-space
-            // lookup ("Bash" has no alias today — identity; uniform with every other service policy face, so a
-            // future core alias or a pre-rename durable replay can't slip the gate).
-            if (!shellTools.has(canonicalToolName(req.toolName)))
+            // Out of scope for non-shell tools: this gate only speaks about shell command names. RAW(5.0.0):
+            // live 名恒 canonical,pre-rename 重放由 core 响亮拒——折叠臂退役。
+            if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -100,9 +95,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
  *  (letters/digits and `. _ - +`, covering `python3.11`/`docker-compose`/`g++`) and reject the rest FAIL-LOUD at
  *  config-apply. 🔴 Kept ALIGNED with the `@sema-agent/registry-core` contract-layer regex (center fixed the
  *  glob→exact contract bug in 0.1.26 + publish-validates with this SAME pattern) so the contract gate and this
- *  defense-in-depth gate agree. The dep is
- *  `^0.1.26` (additive-compatible), so an additive contract bump stays aligned; a contract regex CHANGE would
- *  need this updated in lockstep (the two layers are coupled by design, not by a frozen byte-equality guarantee). */
+ *  defense-in-depth gate agree. [2373]B-11:旧注靠「dep=^0.1.26 additive 窗」论证对齐,地板抬到 ^0.13.0 后
+ *  该论证失效——现由机器钉逐字节对表(test/runtime-governance.test.ts 读安装包正则比对),lockstep 不再
+ *  是注释请求。2026-08-02 亲核 0.13.0 dist/types.js:703:两正则逐字节相同。 */
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
 /** The three legal per-command decisions (mirrors the registry `runtime.commandPolicy[].decision` enum). */
 const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);

package/dist/sealed-key.d.ts

@@ -76,7 +76,7 @@ export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Prom
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/sealed-key.js

@@ -150,7 +150,7 @@ export async function ensureSealedKeyStore(dir, logger) {
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN / REGISTRY_ADMIN_TOKEN in this service's env). Without
+ * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).

package/dist/security.d.ts

@@ -3,8 +3,6 @@ import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
  *  output (§0.5). Mirrors {@link RunStore}'s shipped `SessionSummary` shape so the wire response is unchanged. */
 export interface SessionListItem {
@@ -215,7 +213,4 @@ export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | und
 export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -3,9 +3,8 @@ import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 // design/158 A4: the env→key-set decoders (parseApprovalHmacKeys / parsePrincipalJwks + their row types) moved to
 // the leaf ./auth-keys.js so config.ts's env-load no longer value-imports this whole auth module (lens2 §F). The
 // verifiers that consume the parsed key-sets now live in ./approval-hmac.js / ./principal-jwt.js (design/158 A13);
-// the four names are RE-EXPORTED for compat.
-export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
-import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: see re-export block below (moved to ./memory-scope.js)
+// import all four names from ./auth-keys.js directly ([2354] 兼容面全清 — the compat re-export here is gone).
+import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: moved to ./memory-scope.js (this file's createAuthorizer still calls it)
 // design/158 A13: the approval-envelope HMAC (integrity) group and the principal-JWT/direct-door (identity)
 // group moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js respectively — this file's own
 // `verifiedPrincipal` still calls verifyPrincipalJwt for the direct-door branch (value import below); every
@@ -333,15 +332,12 @@ export function verifiedPrincipal(req, config) {
 }
 // design/158 N17: memoryScopeFor / memoryEngineRemoteLanePosture / memoryEngineBackendFor / memorySpecForRequest
 // moved VERBATIM to the leaf ./memory-scope.js (security.ts's name says auth; these four resolve memory-plane
-// config, unrelated). Re-exported here so existing importers (main.ts, config.ts, http/server.ts, run-local.ts,
-// index.ts, tests) keep working untouched — this file's own createAuthorizer below still calls memoryScopeFor.
-export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
-// design/158 A13: approval-envelope HMAC (integrity, {@link verifyApprovalHmac}/{@link approvalHmacMessage}/
-// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, {@link verifyPrincipalJwt}/
+// config, unrelated). Import them from ./memory-scope.js directly ([2354] 兼容面全清 — the compat re-export here
+// is gone); this file's own createAuthorizer below still calls memoryScopeFor.
+// design/158 A13: approval-envelope HMAC (integrity, verifyApprovalHmac/approvalHmacMessage/
+// MAX_APPROVAL_REASON_CHARS) and principal-JWT/direct-door proof (identity, verifyPrincipalJwt/
 // approvalBnd/verifyDirectDoorProof) moved VERBATIM to ./approval-hmac.js and ./principal-jwt.js — this file
 // keeps only the authenticator/principal-shape/SSO-mount group (createAuthorizer, verifiedPrincipal,
-// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope) plus this re-export so existing
-// importers of the moved names keep working unchanged.
-export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
-export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
+// assertPrincipalShape, principalFrom, setSsoPrincipal/setSsoScope). Import the moved names from their
+// new homes directly ([2354] 兼容面全清 — the compat re-exports here are gone).
 //# sourceMappingURL=security.js.map

package/dist/session-sync.d.ts

@@ -30,8 +30,6 @@ export interface FileSnapshotImportFace {
  *  seam is absent (an older/in-memory dev store). Callers gate on the RETURN VALUE, not a separate `typeof` check,
  *  so there is exactly one place that knows the shape of the probe. */
 export declare function fileSnapshotImportFace(fs: unknown): FileSnapshotImportFace | undefined;
-export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
-export type { StagingHandle, ImportStagingStore, SyncRelation } from "./session-sync-kernel.js";
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its

package/dist/session-sync.js

@@ -12,15 +12,6 @@ export function fileSnapshotImportFace(fs) {
         return undefined;
     return { importManifest: candidate.bind(fs) };
 }
-// ── PURE KERNEL moved to ./session-sync-kernel.ts (design/158 A2) ─────────────────────────────────────────────
-// The §7 relation classifier (classifySyncRelationship[ByIds]), the staging-id scheme (stagingIdFor /
-// STAGING_ID_MARKER / realIdOfStaging), the StagingHandle / ImportStagingStore contracts and SyncConflictError
-// lived here (lines ~26–187) but depend on NOTHING in this repo — while THIS module value-imports StoreBackend and
-// type-imports security's OwnerAwareSessionStore. The three DB session adapters (local/pg/tidb) and security.ts
-// need only those pure symbols, and security.ts importing them from HERE formed the repo's only true type cycle
-// (security ↔ session-sync; lens2 §B/§E). They now live in the leaf module session-sync-kernel.ts (same shape as
-// session-sync-content.ts) and are RE-EXPORTED verbatim below, so existing importers of this module keep working.
-export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
 /** Narrow `backend.session()` to the optional ownership/export seam (the concrete TiDB/PG/Local stores carry it;
  *  the bare in-memory dev store doesn't → the methods are optional, exactly like the fork route narrows). */
 function ownerAware(backend) {
@@ -77,7 +68,8 @@ export async function exportSession(sessionId, srcBackend) {
     // snapshots — listKeys → per-key manifest. exportManifest may be absent (no snapshot export seam) → no snapshots.
     const fs = srcBackend.fileSnapshot();
     const snapshots = [];
-    if (typeof fs.listKeys === "function" && typeof fs.exportManifest === "function") {
+    // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
+    if (typeof fs.exportManifest === "function") {
         const keys = await fs.listKeys(sessionId);
         for (const key of keys) {
             const manifest = await fs.exportManifest(sessionId, key);
@@ -93,9 +85,9 @@ export async function exportSession(sessionId, srcBackend) {
         : [];
     // anchors — every E18 resume anchor (eventId→entryId + source owner). resumeAnchor is REQUIRED on all backends.
     const anchorStore = srcBackend.resumeAnchor();
-    const anchors = typeof anchorStore.listBySession === "function"
-        ? await anchorStore.listBySession(sessionId)
-        : [];
+    // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
+    // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
+    const anchors = await anchorStore.listBySession(sessionId);
     // getBlob — bound to the SOURCE snapshot store so the importer pulls bytes content-addressed (deduped), lazily.
     // A source without getBlob (no blobs to move) supplies a getter that always returns undefined → snapshots with a
     // missing blob fail the §10 validation below before any write (never a partial restore).
@@ -131,7 +123,8 @@ export async function exportSessionManifest(sessionId, srcBackend) {
     // snapshots / policy / anchors — IDENTICAL to exportSession (no entry payloads loaded anywhere here).
     const fs = srcBackend.fileSnapshot();
     const snapshots = [];
-    if (typeof fs.listKeys === "function" && typeof fs.exportManifest === "function") {
+    // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
+    if (typeof fs.exportManifest === "function") {
         const keys = await fs.listKeys(sessionId);
         for (const key of keys) {
             const manifest = await fs.exportManifest(sessionId, key);
@@ -145,9 +138,9 @@ export async function exportSessionManifest(sessionId, srcBackend) {
         ? await policyStore.listBySession(sessionId)
         : [];
     const anchorStore = srcBackend.resumeAnchor();
-    const anchors = typeof anchorStore.listBySession === "function"
-        ? await anchorStore.listBySession(sessionId)
-        : [];
+    // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
+    // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
+    const anchors = await anchorStore.listBySession(sessionId);
     // getBlob — bound to the SOURCE snapshot store (content-addressed, lazy), exactly like exportSession.
     const getBlobFn = fs.getBlob?.bind(fs);
     const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;

package/dist/spec-fields.js

@@ -159,17 +159,17 @@ const skillOk = (s) => {
     }
     return true;
 };
-/** MemorySpecInput 闭合白名单(core dist/core/memory.d.ts:92 亲读)。core 的 normalizeMemorySpec 会直接
- *  迭代 `scopes` —— 非数组形状(如 {scopes:{length:1}})在服务门不拦就是 core 运行期异常(cross-review 抓获)。 */
+/** MemorySpecInput 闭合白名单(core dist/core/memory.d.ts 亲读)。core 的 normalizeMemorySpec 会直接
+ *  迭代 `scopes` —— 非数组形状(如 {scopes:{length:1}})在服务门不拦就是 core 运行期异常(cross-review 抓获)。
+ *  core 5.1.0([2390]②,原 [2387] 预告):单数 `scope` 键已删,`scopes: string[]` 唯一拼法——白名单
+ *  同步剔键,收了就是穿门死键(用户以为设了 scope,core 静默无视)。 */
 const memoryOk = (v) => {
     if (!plainObject(v))
         return false;
     for (const k of Object.keys(v)) {
-        if (k !== "scope" && k !== "scopes" && k !== "writeScope" && k !== "enabled" && k !== "scopeContract")
+        if (k !== "scopes" && k !== "writeScope" && k !== "enabled" && k !== "scopeContract")
             return false;
     }
-    if (v.scope !== undefined && typeof v.scope !== "string")
-        return false;
     if (v.scopes !== undefined && !(Array.isArray(v.scopes) && v.scopes.every((x) => typeof x === "string")))
         return false;
     if (v.writeScope !== undefined && v.writeScope !== null && typeof v.writeScope !== "string")
@@ -212,7 +212,7 @@ const TASK_AGENT_FIELD_SHAPES = {
         desc: `a positive integer of at most ${MAX_AGENT_MAX_TURNS}`,
         ok: (v) => typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= MAX_AGENT_MAX_TURNS,
     },
-    memory: { desc: "a memory spec object ({ scope?, scopes?, writeScope?, enabled?, scopeContract? })", ok: memoryOk },
+    memory: { desc: "a memory spec object ({ scopes?, writeScope?, enabled?, scopeContract? })", ok: memoryOk },
     observer: { desc: `a string of at most ${MAX_AGENT_TEXT_CHARS} characters`, ok: boundedString(MAX_AGENT_TEXT_CHARS) },
     observerMessage: { desc: `a string of at most ${MAX_AGENT_TEXT_CHARS} characters`, ok: boundedString(MAX_AGENT_TEXT_CHARS) },
 };

package/dist/task-settings.js

@@ -35,7 +35,7 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, canonicalToolName, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
@@ -250,10 +250,10 @@ function createAskListPolicy(askNames) {
     // Canonical-space matching, mirroring core's `createAllowDenyPolicy` (1.202): a rule written against a legacy
     // alias ("MultiEdit"/"Task") keeps asking after a CC-parity rename, and a durable-resume replay carrying a
     // pre-rename `req.toolName` can't slip a rule written in the new names (ask only ever tightens — widening-safe).
-    const askSet = new Set(askNames.map(canonicalToolName));
+    const askSet = new Set(askNames); // RAW(5.0.0):折叠面退役
     return {
         check(req) {
-            return askSet.has(canonicalToolName(req.toolName))
+            return askSet.has(req.toolName)
                 ? { action: "ask", message: `tool "${req.toolName}" requires approval by your settings`, decisionReason: "rule" }
                 : { action: "allow" };
         },
@@ -266,7 +266,7 @@ function createAskListPolicy(askNames) {
 /** [1245]/[1247]③ — the mode-derived dynamic-workflow ask gate (CC "Run a dynamic workflow?" dialog, engine half).
  *  core mounts `run_workflow` with effect="write" and NO exemption in the gate stack, but the mode-derived leg here
  *  only ever gated fs writes — so manual/default mode ran workflows un-asked ([1245] clay dogfood). This leg keys
- *  the canonical name (`Workflow`; run_workflow/RunWorkflow aliases fold in via canonicalToolName on BOTH sides)
+ *  the canonical name(`Workflow`;5.0.0:旧拼法 aliases 已随 core RB-476 退役,raw 直比)
  *  and attaches on default/auto/acceptEdits, independent of the fs-gate wiring (workflow gating is not
  *  fs-dependent — sandbox lanes get it too). acceptEdits asks ON PURPOSE: CC's acceptEdits auto-allows file edits
  *  only, a workflow confirmation is not an edit ([1248]② — cli to verify against the 212 live shell; flip there
@@ -277,7 +277,7 @@ const WORKFLOW_ASK_NAMES = ["Workflow"];
 function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
-            if (canonicalToolName(req.toolName) !== "Workflow")
+            if (req.toolName !== "Workflow")
                 return { action: "allow" };
             // codex F2 (durable lane): the "don't ask again this session" grant (decide remember="session" →
             // approvalExemptionStore) is probed at the POLICY layer here — the durable lane parks every policy `ask`
@@ -286,7 +286,7 @@ function createWorkflowAskPolicy(isExempt) {
             // (canonical toolName key space, one grant serves all layers); a THROWN probe ⇒ not exempt (fail-closed).
             if (isExempt) {
                 try {
-                    if (await isExempt(canonicalToolName(req.toolName)))
+                    if (await isExempt(req.toolName))
                         return { action: "allow", decisionReason: "rule" };
                 }
                 catch {
@@ -307,7 +307,7 @@ function createWorkflowAskPolicy(isExempt) {
 function createWorkflowPlanDenyPolicy() {
     return {
         check(req) {
-            return canonicalToolName(req.toolName) === "Workflow"
+            return req.toolName === "Workflow"
                 ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
                 : { action: "allow" };
         },