@sema-agent/server 7.100.0 → 7.101.0

package/dist/config.js

@@ -24,6 +24,8 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
+import { allowlistedEnv } from "./server-secret-env.js";
+import { ENV_NAME_ALLOWLIST_KNOBS, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -84,15 +86,6 @@ export function parseUsageWindows(raw) {
     });
     return Object.freeze(out);
 }
-function resolveEnvForward(csvNames) {
-    const out = {};
-    for (const name of csvNames.split(",").map((s) => s.trim()).filter(Boolean)) {
-        const v = process.env[name];
-        if (v !== undefined && v !== "")
-            out[name] = v;
-    }
-    return out;
-}
 function env(name, fallback) {
     const v = process.env[name];
     if (v === undefined || v === "") {
@@ -496,6 +489,73 @@ function parseNameListEnv(name, raw, opts) {
     }
     return names;
 }
+const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
+const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
+function parseEnvNameAllowlist(knob, singleUserTurnkey) {
+    const raw = process.env[knob];
+    if (raw === undefined || raw === "")
+        return undefined;
+    const spec = ENV_NAME_ALLOWLIST_KNOBS[knob];
+    const segments = raw.split(",").map((s) => s.trim());
+    segments.forEach((seg, i) => {
+        const problem = seg.length === 0
+            ? "empty"
+            : !ENV_VAR_NAME_RE.test(seg)
+                ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
+                : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
+                    ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
+                    : undefined;
+        if (problem === undefined)
+            return;
+        throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
+            " — refusing to start rather than silently allowing a partial list (#157). The value is not echoed (a pasted NAME=value pair may carry a secret)." +
+            ` Write ${knob}=NAME,NAME with bare variable names, e.g. ${spec.example}.`);
+    });
+    if (!singleUserTurnkey) {
+        const posture = spec.multiTenant;
+        switch (posture.kind) {
+            case "ignored":
+                CONFIG_WARNINGS.push({
+                    env: knob,
+                    raw: ENV_NAME_ALLOWLIST_WITHHELD,
+                    kind: "ineffective",
+                    detail: `REQUIRE_PRINCIPAL=true (multi-tenant / hosted posture): the named allowlist (${segments.length} entr${segments.length === 1 ? "y" : "ies"}) is ignored — ${posture.why}`,
+                });
+                return [];
+            case "honored":
+                CONFIG_NOTICES.push({
+                    event: "config_env_forwarded_multi_tenant",
+                    fields: {
+                        env: knob,
+                        entries: String(segments.length),
+                        note: `this worker-level allowlist is forwarded as configured to every tenant (deployer-explicit channel); ${describeAllowlistPostures()}`,
+                    },
+                });
+                break;
+            default: {
+                const unreachable = posture;
+                throw new Error(`unhandled name-list posture: ${String(unreachable)}`);
+            }
+        }
+    }
+    const present = allowlistedEnv(segments, process.env);
+    const resolved = [];
+    segments.forEach((name, i) => {
+        if (Object.hasOwn(present, name)) {
+            if (!resolved.includes(name))
+                resolved.push(name);
+            return;
+        }
+        CONFIG_WARNINGS.push({
+            env: knob,
+            raw: ENV_NAME_ALLOWLIST_WITHHELD,
+            kind: "entry-rejected",
+            detail: `entry #${i + 1} of ${segments.length}: no variable of that name in this process's environment — nothing to pass on (not echoed: a value pasted in place of a name, e.g. ${knob}=$NPM_TOKEN, can pass the name check)`,
+        });
+    });
+    return resolved;
+}
 function assertReadDenyBuiltinsResolvable(tiers, exclude) {
     const check = (which, config) => {
         try {
@@ -802,11 +862,6 @@ export function isRosterGateArmed(configCenter) {
 function parseModelDomain() {
     const gatewayBaseUrl = firstSetEnv("MODEL_GATEWAY_BASEURL");
     const modelId = env("MODEL_ID", "");
-    if (modelId === "") {
-        throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
-            "or configure models via the sema-registry catalog; the old silent default was an internal-only model name " +
-            "that made every external deployment fail far from the cause (gateway 400)");
-    }
     const explicitProvider = process.env.MODEL_PROVIDER;
     if (explicitProvider !== undefined && explicitProvider !== "") {
         const refusal = modelProviderRefusal(explicitProvider);
@@ -874,7 +929,13 @@ function parseModelDomain() {
         ...(extraBody ? { extraBody } : {}),
     };
     const cheapId = process.env.MODEL_CHEAP_ID;
-    const cheapModel = cheapId
+    if (cheapId && modelId === "") {
+        CONFIG_NOTICES.push({
+            event: "model_cheap_slot_without_main",
+            fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+        });
+    }
+    const cheapModel = cheapId && modelId !== ""
         ? {
             ...model,
             id: cheapId,
@@ -893,7 +954,7 @@ function parseModelDomain() {
         }
         : undefined;
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
-    if (applyAutoCompactWindow(model, mainAct) === "removed-1m") {
+    if (applyAutoCompactWindow(model, mainAct) === "removed-1m" && modelId !== "") {
         CONFIG_NOTICES.push({
             event: "auto_compact_window_not_derived_1m",
             fields: {
@@ -903,7 +964,8 @@ function parseModelDomain() {
             },
         });
     }
-    noticeAutoCompactAboveWindow("main", "MODEL_AUTO_COMPACT_TOKENS", model);
+    if (modelId !== "")
+        noticeAutoCompactAboveWindow("main", "MODEL_AUTO_COMPACT_TOKENS", model);
     if (cheapModel) {
         const cheapAct = optFinitePositiveEnv("MODEL_CHEAP_AUTO_COMPACT_TOKENS");
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
@@ -919,7 +981,7 @@ function parseModelDomain() {
         }
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
-    const models = { default: model, [model.id]: model };
+    const models = modelId === "" ? {} : { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
     const gatewayApiKey = process.env.MODEL_API_KEY;
@@ -979,6 +1041,7 @@ function parseModelDomain() {
         models,
         modelApiKeyEnv: {},
         modelApiKeys: {},
+        modelRefusals: {},
         modelQuotaWeights: {},
         tiers: {},
         projects: {},
@@ -1650,6 +1713,7 @@ function parseOrchestrationDomain(ctx) {
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
+    const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
     {
         const lane = process.env.REMOTE_EXEC;
         if (lane !== undefined && lane !== "") {
@@ -1698,7 +1762,7 @@ function parseOrchestrationDomain(ctx) {
                 ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")),
                 ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")),
                 ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: boolEnv("E2B_ALLOW_NET", true) } : {}),
-                ...(process.env.E2B_SANDBOX_ENV ? { sandboxEnv: resolveEnvForward(process.env.E2B_SANDBOX_ENV) } : {}),
+                ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("E2B_SANDBOX_ENV", singleUserTurnkey)),
                 ...(process.env.E2B_MOUNT_PATH ? { mountPath: process.env.E2B_MOUNT_PATH } : {}),
                 orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
@@ -1773,7 +1837,7 @@ function parseOrchestrationDomain(ctx) {
                                                             ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
                                                             : {}),
                                                         ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
-                                                        ...(process.env.DOCKER_SANDBOX_ENV ? { env: resolveEnvForward(process.env.DOCKER_SANDBOX_ENV) } : {}),
+                                                        ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
                                                     }
                                                     :
                                                         process.env.REMOTE_EXEC === "device"
@@ -1844,6 +1908,7 @@ function parseOrchestrationDomain(ctx) {
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
         lspEnabled: boolEnv("LSP_ENABLED", false),
         lspHostEnabled,
+        lspEnvAllow,
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
@@ -2070,7 +2135,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
@@ -2096,7 +2161,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
-    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [

package/dist/deployment-governance.d.ts

@@ -70,8 +70,26 @@ export interface PathAdjudication {
 export interface LiveQuestionFace {
     hasLiveContext(): boolean;
 }
-/** durable 轴的审批基线入参。缺席 ⇒ adjudicated allow-all 基线(见 {@link createApprovalBaselinePolicy})。 */
+/**
+ * S-694 —— 审批基线的**席**:这条腿上「一个名单产的 `ask` 由谁来服」。闭集三形,每条腿**显式**说出自己那一形
+ * ({@link createApprovalBaselinePolicy} 的席参数必填、按 `kind` 穷举 —— 闭集 +1 = 编译红):
+ *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。AskUserQuestion 的问答门
+ *    **只**叠在这一形上(它的 `ask` 语义就是 durable park)。
+ *  · `live`    —— Runner 的活 onAsk 席当场服 ask(run-local 的 `createLocalApprover`:TTY 问 y/N / 无 TTY 当场拒;
+ *    core `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退,ask 落回调)。三张名单与 durable 席**同一只**策略。
+ *  · `absent`  —— 没有谁服 ask ⇒ adjudicated allow-all;**只**服务零名单(HTTP 腿「durable 关 ∧ 单用户零意图」)。
+ *    带名单进来 = 响亮拒:名单被一条没有席的腿静默吞掉,正是 S-694 的病形。
+ *
+ * 🔴 由来(S-694):修前席是一个**可选**参数、缺席即 allow-all。run-local 调它时没传 ⇒ 三张名单一张都不进策略,
+ * 而这条腿其实**有**一只活 onAsk 席 —— [ref] 件一把「没有 durable 赎回腿」等同成了「ask 无处可服」。
+ * 席必填之后,「这条腿能不能服 ask」是每个调用点必须写出来的一句话,不再是一个忘了写就成立的缺省。
+ */
+export type ApprovalSeat = DurableApprovalSeat | LiveApprovalSeat | AbsentApprovalSeat;
+/** 席的形名(补偿 warn 等只需要「哪一形」的读者读它,不必铸整只席)。 */
+export type ApprovalSeatKind = ApprovalSeat["kind"];
+/** durable 席:checkpoint suspend/resume 服 ask,问答门叠在名单策略上。 */
 export interface DurableApprovalSeat {
+    readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
     /** 每会话「本会话不再询问」探针(canonical toolName 键空间)。 */
@@ -79,6 +97,14 @@ export interface DurableApprovalSeat {
     /** 豁免短路时的审计钩子。 */
     readonly onExempted?: DurableAskOptions["onExempted"];
 }
+/** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店)。 */
+export interface LiveApprovalSeat {
+    readonly kind: "live";
+}
+/** absent 席:这条腿没有谁服 ask ⇒ adjudicated allow-all,只服务零名单。 */
+export interface AbsentApprovalSeat {
+    readonly kind: "absent";
+}
 /**
  * [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
  * `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
@@ -179,8 +205,9 @@ export interface OperatorWarning {
 }
 /** {@link buildOnlySensitiveBaselineWarning} 读的座位量 —— 「这个部署到底有没有一道**真**门」。 */
 export interface GateSeatView {
-    /** durable 审批门(checkpoint suspend/resume)是否在这条腿上真装。 */
-    readonly durableEnabled: boolean;
+    /** 这条腿审批基线的**席**(与喂 {@link createApprovalBaselinePolicy} 的是同一只,S-694:此前是一个与席分家的
+     *  `durableEnabled` 布尔,于是有活 onAsk 席的 run-local 腿被判成「没有门」)。 */
+    readonly approvalSeat: ApprovalSeatKind;
     /** 单用户 turnkey 的 auto-accept 基线是否适用(= 零门意图的既定姿势,不是 misconfig)。 */
     readonly singleUserAutoAcceptBaseline: boolean;
 }
@@ -192,8 +219,10 @@ export interface GateSeatView {
  * 此前是「这个部署一个门都没接」这个 misconfig 的**唯一**提示,而守卫集只挡那二十来个路径段、其余写
  * 目标照旧无裁决 —— 信号不能因为我们铺了基线就静默消失,所以由我们自己按同一判据说一次。
  *
- * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 两条产**真**门的腿都不在场(durable 门关 ∧ 单用户
- * auto-accept 基线不适用)。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
+ * auto-accept 基线不适用。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * S-694:席读的是喂审批基线的**同一只**({@link ApprovalSeat})—— `durable` / `live` 两形都有人服 ask、名单
+ * 进策略,「守卫集是唯一的策略」这句话在它们上面不成立。今天真发的只剩 HTTP 腿「durable 关 ∧ 多租户」那一形。
  *
  * ⚠️ 单一属主([ref] 件三):HTTP 腿与 run-local 腿共用本判据与文案。两处各写一份 = 一处改了另一处
  * 没改,而两份都长得像对的 —— 那正是本文件存在的理由。
@@ -211,18 +240,22 @@ export declare function createDeploymentGovernanceInputs(config: DeploymentGover
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
- * 两形:
- *  · `durable` 在场 ⇒ durable 轴 = AskUserQuestion 判决门 + F4 高危写审批门(deny/neverAuto/预算/
- *    会话豁免全在 `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
- *  · `durable` 缺席 ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、
+ * 三形,按席穷举(S-694,席的定义见 {@link ApprovalSeat}):
+ *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/会话豁免全在
+ *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
+ *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
+ *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。
+ *  · `absent`  ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、
  *    effect-aware 的策略。CC 的信任模型是 auto-accept,但门**机制**必须在场(core 原则「机制留、默认
  *    可更宽」)—— 满足 core 的 `hasEffectAwareGate`,恢复可观测性与 hook/tighten 点,而运维照旧用
  *    `AUTONOMY`/`commandPolicy` 收紧不可逆操作(由 `applyRuntimeGovernance` tighten-only 叠上)。
+ *    🔴 本形**只**服务零名单:名单在场却递 absent 席 = 名单被静默吞掉(S-694 的病形),响亮拒。
  *
  * ⚠️ 「零门意图才铺 allow-all」这条准入判据**不在本口**:它是消费腿的部署形判断(单用户/多租户、
- * 有无 checkpoint 店),属主是 `hasOperatorGateIntent`/`assertGateIntentServiceable`(src/approval.ts)。
- * 本口只按调用方给的形铸策略,绝不替它判「这个部署该不该有门」。
+ * 有无 checkpoint 店),属主是 `hasOperatorGateIntent` / `gateIntentUnserviceableReason`(src/approval.ts)。
+ * 本口只按调用方给的席铸策略,绝不替它判「这个部署该不该有门」;absent 臂那条拒是**席与名单自相矛盾**的
+ * 一致性断言(调用方已判过的事实在这里被违反),不是第二份准入判据。
  */
-export declare function createApprovalBaselinePolicy(config: ApprovalBaselineConfigView, durable?: DurableApprovalSeat): ToolPolicy;
+export declare function createApprovalBaselinePolicy(config: ApprovalBaselineConfigView, seat: ApprovalSeat): ToolPolicy;
 export {};
 //# sourceMappingURL=deployment-governance.d.ts.map

package/dist/deployment-governance.js

@@ -1,6 +1,6 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
-import { createDurableAskPolicy } from "./approval.js";
+import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
@@ -58,8 +58,19 @@ export function assertGuardPatternsUsable(config) {
     }
 }
 export function buildOnlySensitiveBaselineWarning(config, seat) {
-    if (config.sensitiveWritePatterns.length === 0 || seat.durableEnabled || seat.singleUserAutoAcceptBaseline)
+    if (config.sensitiveWritePatterns.length === 0 || seat.singleUserAutoAcceptBaseline)
         return undefined;
+    switch (seat.approvalSeat) {
+        case "durable":
+        case "live":
+            return undefined;
+        case "absent":
+            break;
+        default: {
+            const unhandled = seat.approvalSeat;
+            throw new Error(`approval seat "${String(unhandled)}" has no arm in the only-sensitive-baseline warning`);
+        }
+    }
     return {
         event: "tool_policy_only_sensitive_baseline",
         fields: {
@@ -95,16 +106,33 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
         ...(sensitivePathPolicy ? { sensitivePathPolicy } : {}),
     };
 }
-export function createApprovalBaselinePolicy(config, durable) {
-    if (durable === undefined)
-        return createAllowDenyPolicy({});
-    return combinePolicies(createDurableQuestionGate(durable.question), createDurableAskPolicy({
+export function createApprovalBaselinePolicy(config, seat) {
+    switch (seat.kind) {
+        case "durable":
+            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat));
+        case "live":
+            return createApprovalListPolicy(config, {});
+        case "absent":
+            if (hasApprovalListIntent(config)) {
+                throw new Error("approval baseline: this leg has no approval seat (nobody can answer an ask), yet an approval list is in force " +
+                    "(APPROVAL_REQUIRE / APPROVAL_DENY / APPROVAL_NEVER_AUTO, or the center's governance.approvalRequire) — the list would be silently ignored. " +
+                    "The caller must hand a durable or live seat, or refuse the list before it reaches this leg.");
+            }
+            return createAllowDenyPolicy({});
+        default: {
+            const unhandled = seat;
+            throw new Error(`approval seat ${JSON.stringify(unhandled)} has no baseline arm`);
+        }
+    }
+}
+function createApprovalListPolicy(config, memory) {
+    return createDurableAskPolicy({
         requireApproval: config.approvalRequire,
         deny: config.approvalDeny,
         autoBudget: config.approvalAutoBudget,
         neverAuto: config.approvalNeverAuto,
-        ...(durable.exempt ? { exempt: durable.exempt } : {}),
-        ...(durable.onExempted ? { onExempted: durable.onExempted } : {}),
-    }));
+        ...(memory.exempt ? { exempt: memory.exempt } : {}),
+        ...(memory.onExempted ? { onExempted: memory.onExempted } : {}),
+    });
 }
 //# sourceMappingURL=deployment-governance.js.map

package/dist/env-name-allowlist-knobs.d.ts

@@ -0,0 +1,37 @@
+/**
+ * S-699 / S-713 —— **名单型 env 旋钮**的闭集表(纯叶:零值依赖,任何层都可值引而不成装载环)。
+ *
+ * 解析规则(未设 / 形错拒启 / 姿态 / 生效名单)的全文在 `config.ts` `parseEnvNameAllowlist` 的头注;本表只装**各旋钮自己的**事实,
+ * 不是解析规则:
+ *  · `example` 进拒句;
+ *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数。
+ *    - `LSP_ENV_ALLOW` ⇒ ignored:host 腿语言服务器在多租户姿态下本来就不起,名单无处作数,设了要说出来(S-699)。
+ *    - 两只沙箱名单 ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
+ *      带外凭据(e2b / docker 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
+ * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红。
+ *
+ * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
+ * {@link describeAllowlistPostures} 的读数 —— 今天三处:`config_env_forwarded_multi_tenant.note`(`config.ts` 解析器)、LSP 剥除现场的
+ * 出路句(`observability/secret-env-scrub.ts`)、配置目录 `LSP_ENV_ALLOW` 行(`config-catalog.ts`)。修前三处各手抄一遍,表改一格它们
+ * 当场撒谎。为什么是纯叶:`config-catalog.ts` 被 `config.ts` 值引,表留在 `config.ts` 会成装载环。
+ */
+export type EnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+export type EnvNameAllowlistPosture = {
+    readonly kind: "honored";
+} | {
+    readonly kind: "ignored";
+    readonly why: string;
+};
+export type EnvNameAllowlistKnobTable = {
+    readonly [K in EnvNameAllowlistKnob]: {
+        readonly example: string;
+        readonly multiTenant: EnvNameAllowlistPosture;
+    };
+};
+export declare const ENV_NAME_ALLOWLIST_KNOBS: EnvNameAllowlistKnobTable;
+/**
+ * 多租户姿态句 —— **由表派生**,不许在别处手写。形:`under REQUIRE_PRINCIPAL=true: <旋钮> is ignored; <旋钮> / <旋钮> are forwarded as configured`
+ * (按 {@link POSTURE_PHRASE} 的 kind 序分组、组内按表序;空组不出现)。只有旋钮名与姿态,不带任何名单内容。
+ */
+export declare function describeAllowlistPostures(table?: EnvNameAllowlistKnobTable): string;
+//# sourceMappingURL=env-name-allowlist-knobs.d.ts.map

package/dist/env-name-allowlist-knobs.js

@@ -0,0 +1,24 @@
+export const ENV_NAME_ALLOWLIST_KNOBS = {
+    LSP_ENV_ALLOW: {
+        example: "LSP_ENV_ALLOW=NPM_TOKEN,CARGO_REGISTRIES_MY_REG_TOKEN",
+        multiTenant: { kind: "ignored", why: "the host-lane language server is not started in this posture, and the language-server env keeps the full secret strip" },
+    },
+    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+};
+const POSTURE_PHRASE = {
+    ignored: { one: "is ignored", many: "are ignored" },
+    honored: { one: "is forwarded as configured", many: "are forwarded as configured" },
+};
+export function describeAllowlistPostures(table = ENV_NAME_ALLOWLIST_KNOBS) {
+    const knobs = Object.keys(table);
+    const groups = Object.keys(POSTURE_PHRASE).flatMap((kind) => {
+        const named = knobs.filter((k) => table[k].multiTenant.kind === kind);
+        if (named.length === 0)
+            return [];
+        const phrase = POSTURE_PHRASE[kind];
+        return [`${named.join(" / ")} ${named.length === 1 ? phrase.one : phrase.many}`];
+    });
+    return `under REQUIRE_PRINCIPAL=true: ${groups.join("; ")}`;
+}
+//# sourceMappingURL=env-name-allowlist-knobs.js.map

package/dist/fleet-client.d.ts

@@ -4,7 +4,8 @@
  *  - **可选分层(D3)**:仅当 center 已配置(sema-registry lane 的 baseUrl+token+worker)∧ `FLEET_ADVERTISE_ADDRESS`
  *    显式声明时才启动 —— 不配 center 的部署零行为变化。address 不自猜(k8s pod IP / docker alias / 127.0.0.1:port
  *    只有部署环境自己知道,故用显式 env)。
- *  - **announce=注册=心跳同形状幂等 upsert**:boot 后 POST 一次 + 每 heartbeatMs 续;`ready = bootDone ∧ !draining`。
+ *  - **announce=注册=心跳同形状幂等 upsert**:boot 后 POST 一次 + 每 heartbeatMs 续;`ready` 今 = `!draining`(实现只读
+ *    `isDraining()`,announce 本身在 boot 之后才起;S-740 起与 /health 就绪同一只谓词 —— 车OC 6b 注释改真,实现归 S-740)。
  *  - **draining 翻转即刻再 announce**(第一时间自摘流,比任何观测都快);退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键

package/dist/hooks/hook-llm.js

@@ -1,5 +1,6 @@
 import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
-import { matchCatalogModel } from "../model-select.js";
+import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
@@ -32,21 +33,29 @@ export function createHookLlm(deps) {
     };
     const hookModelFor = (requested) => {
         const shape = (ref) => shapeFrom(ref, config.models[ref], config.models[ref]?.id ?? ref);
+        const unavailable = (field, ref) => {
+            if (config.models[ref] !== undefined)
+                return undefined;
+            const hit = refusedCatalogEntry(ref, config.modelRefusals);
+            return hit === undefined ? undefined : { ok: false, error: modelUnavailableMessage(field, ref, hit.name, hit.refusal) };
+        };
         if (requested === undefined) {
             const sum = config.roles.summarize;
             const roleModel = typeof sum === "string" ? sum : sum && typeof sum === "object" && "model" in sum && typeof sum.model === "string" ? sum.model : undefined;
             if (roleModel !== undefined)
-                return config.models[roleModel] ? shape(roleModel) : shapeFrom(config.model.id, config.model, roleModel);
+                return unavailable("summarize role model", roleModel) ?? (config.models[roleModel] ? shape(roleModel) : shapeFrom(config.model.id, config.model, roleModel));
             return shapeFrom(config.model.id, config.model, config.model.id);
         }
         if (config.models[requested])
             return shape(requested);
-        const byId = matchCatalogModel(requested, config.models);
+        if (Object.hasOwn(config.modelRefusals ?? {}, requested))
+            return unavailable("hook model", requested);
+        const byId = matchCatalogModel(requested, config.models, config.modelRefusals);
         if (byId !== undefined)
             return shape(byId);
         if (requested === config.model.id)
             return shapeFrom(requested, config.model, requested);
-        return { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };
+        return unavailable("hook model", requested) ?? { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };
     };
     const judgeRoute = (pick, perModelKey, deploymentKey, declaredRoot) => {
         const credential = resolveRouteCredential({

package/dist/host-lsp-manager.d.ts

@@ -9,7 +9,8 @@
  * `scrubServerSecrets` 的结果)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) —— 与模型可驱动的 host shell(`inheritEnv:"scrub"`)
+ * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
  * 剥掉了什么经既有观测面留痕(site = `server.lsp.spawn-env`,每 site×key 一次披露 + 逐次计数)—— core 那侧
@@ -19,11 +20,22 @@
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
  * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
  *
+ * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
+ * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
+ * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
+ * env = {@link scrubServerSecrets}(process.env) 之上把 `config.lspEnvAllow` 点到的键经 {@link allowlistedEnv}(与 host shell
+ * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥。名单由 `config.ts` 解析(形错拒启;
+ * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。
+ * 放回的键不是剥除 ⇒ 不进 `secret_env_scrubbed` 的键表与计数;剥掉的键经既有现场 `server.lsp.spawn-env` 一行 warn
+ * (带当前放行名单与出路句),这一行就是「剥了什么」的用户可见面 —— 语言服务器侧从不报。
+ *
  * ## 两个调用点
  * `boot/execution-env.ts`(服务的 host 车道)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })`;
  * 现在都经本函数 —— 构造形只有一份,剥除规则也就只能有一份(源码对账钉在 `test/secret-env-scrub-disclosure.test.ts`)。
+ * 两处都交整份 `config`(类型只要 `lspEnvAllow` 一格),放行名单因此只有一个读点。
  */
 import { NodeLspManager } from "@sema-agent/core";
+import type { ServiceConfig } from "./config-types.js";
 /** 构造宿主车道的本地语言服务器管理器(`create*`:返回活对象)。`log` = 管理器的观测钩(open/heal/degrade/evict 事件)。 */
-export declare function createHostLspManager(log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
+export declare function createHostLspManager(config: Pick<ServiceConfig, "lspEnvAllow">, log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
 //# sourceMappingURL=host-lsp-manager.d.ts.map

package/dist/host-lsp-manager.js

@@ -1,12 +1,13 @@
 import { NodeLspManager } from "@sema-agent/core";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { scrubServerSecrets } from "./server-secret-env.js";
-export function createHostLspManager(log) {
-    const findings = [];
-    const scrubbed = scrubServerSecrets(process.env, findings);
-    recordSecretEnvScrub("server.lsp.spawn-env", findings);
+import { allowlistedEnv, scrubServerSecrets } from "./server-secret-env.js";
+export function createHostLspManager(config, log) {
+    const scrubFindings = [];
+    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(config.lspEnvAllow, process.env) };
+    const findings = scrubFindings.filter((f) => composed[f.key] === undefined);
+    recordSecretEnvScrub("server.lsp.spawn-env", findings, config.lspEnvAllow);
     const env = {};
-    for (const [k, v] of Object.entries(scrubbed))
+    for (const [k, v] of Object.entries(composed))
         if (v !== undefined)
             env[k] = v;
     return new NodeLspManager({ log, env });

package/dist/http/admission.js

@@ -1,5 +1,6 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
@@ -39,7 +40,15 @@ const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
+    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+}
+function refuseUnavailableModel(res, config, field, ref) {
+    const hit = refusedCatalogEntry(ref, config.modelRefusals);
+    if (hit === undefined)
+        return false;
+    const message = modelUnavailableMessage(field, ref.slice(0, 120), hit.name, hit.refusal);
+    sendError(res, 400, "request.model_unavailable", message);
+    return true;
 }
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
@@ -419,8 +428,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const agentsBare = deps.config.models ?? {};
-            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
+            const agentsCatalog = selectableCatalog(agentsBare, deps.config.tiers, deps.config.modelRefusals);
             const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
+            if (um !== undefined && refuseUnavailableModel(res, deps.config, `agents[${um.index}].model`, um.ref))
+                return null;
             if (um !== undefined) {
                 sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
                 return null;
@@ -494,8 +505,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.model, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "model", body.model))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
@@ -506,8 +519,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.compactionModel, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.compactionModel, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "compactionModel", body.compactionModel))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }