@sema-agent/server 7.100.0 → 7.101.1

package/dist/config.js

@@ -24,6 +24,8 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
+import { allowlistedEnv } from "./server-secret-env.js";
+import { ENV_NAME_ALLOWLIST_KNOBS, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -84,15 +86,6 @@ export function parseUsageWindows(raw) {
     });
     return Object.freeze(out);
 }
-function resolveEnvForward(csvNames) {
-    const out = {};
-    for (const name of csvNames.split(",").map((s) => s.trim()).filter(Boolean)) {
-        const v = process.env[name];
-        if (v !== undefined && v !== "")
-            out[name] = v;
-    }
-    return out;
-}
 function env(name, fallback) {
     const v = process.env[name];
     if (v === undefined || v === "") {
@@ -496,6 +489,73 @@ function parseNameListEnv(name, raw, opts) {
     }
     return names;
 }
+const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
+const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
+function parseEnvNameAllowlist(knob, singleUserTurnkey) {
+    const raw = process.env[knob];
+    if (raw === undefined || raw === "")
+        return undefined;
+    const spec = ENV_NAME_ALLOWLIST_KNOBS[knob];
+    const segments = raw.split(",").map((s) => s.trim());
+    segments.forEach((seg, i) => {
+        const problem = seg.length === 0
+            ? "empty"
+            : !ENV_VAR_NAME_RE.test(seg)
+                ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
+                : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
+                    ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
+                    : undefined;
+        if (problem === undefined)
+            return;
+        throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
+            " — refusing to start rather than silently allowing a partial list (#157). The value is not echoed (a pasted NAME=value pair may carry a secret)." +
+            ` Write ${knob}=NAME,NAME with bare variable names, e.g. ${spec.example}.`);
+    });
+    if (!singleUserTurnkey) {
+        const posture = spec.multiTenant;
+        switch (posture.kind) {
+            case "ignored":
+                CONFIG_WARNINGS.push({
+                    env: knob,
+                    raw: ENV_NAME_ALLOWLIST_WITHHELD,
+                    kind: "ineffective",
+                    detail: `REQUIRE_PRINCIPAL=true (multi-tenant / hosted posture): the named allowlist (${segments.length} entr${segments.length === 1 ? "y" : "ies"}) is ignored — ${posture.why}`,
+                });
+                return [];
+            case "honored":
+                CONFIG_NOTICES.push({
+                    event: "config_env_forwarded_multi_tenant",
+                    fields: {
+                        env: knob,
+                        entries: String(segments.length),
+                        note: `this worker-level allowlist is forwarded as configured to every tenant (deployer-explicit channel); ${describeAllowlistPostures()}`,
+                    },
+                });
+                break;
+            default: {
+                const unreachable = posture;
+                throw new Error(`unhandled name-list posture: ${String(unreachable)}`);
+            }
+        }
+    }
+    const present = allowlistedEnv(segments, process.env);
+    const resolved = [];
+    segments.forEach((name, i) => {
+        if (Object.hasOwn(present, name)) {
+            if (!resolved.includes(name))
+                resolved.push(name);
+            return;
+        }
+        CONFIG_WARNINGS.push({
+            env: knob,
+            raw: ENV_NAME_ALLOWLIST_WITHHELD,
+            kind: "entry-rejected",
+            detail: `entry #${i + 1} of ${segments.length}: no variable of that name in this process's environment — nothing to pass on (not echoed: a value pasted in place of a name, e.g. ${knob}=$NPM_TOKEN, can pass the name check)`,
+        });
+    });
+    return resolved;
+}
 function assertReadDenyBuiltinsResolvable(tiers, exclude) {
     const check = (which, config) => {
         try {
@@ -802,11 +862,6 @@ export function isRosterGateArmed(configCenter) {
 function parseModelDomain() {
     const gatewayBaseUrl = firstSetEnv("MODEL_GATEWAY_BASEURL");
     const modelId = env("MODEL_ID", "");
-    if (modelId === "") {
-        throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
-            "or configure models via the sema-registry catalog; the old silent default was an internal-only model name " +
-            "that made every external deployment fail far from the cause (gateway 400)");
-    }
     const explicitProvider = process.env.MODEL_PROVIDER;
     if (explicitProvider !== undefined && explicitProvider !== "") {
         const refusal = modelProviderRefusal(explicitProvider);
@@ -874,7 +929,13 @@ function parseModelDomain() {
         ...(extraBody ? { extraBody } : {}),
     };
     const cheapId = process.env.MODEL_CHEAP_ID;
-    const cheapModel = cheapId
+    if (cheapId && modelId === "") {
+        CONFIG_NOTICES.push({
+            event: "model_cheap_slot_without_main",
+            fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+        });
+    }
+    const cheapModel = cheapId && modelId !== ""
         ? {
             ...model,
             id: cheapId,
@@ -893,7 +954,7 @@ function parseModelDomain() {
         }
         : undefined;
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
-    if (applyAutoCompactWindow(model, mainAct) === "removed-1m") {
+    if (applyAutoCompactWindow(model, mainAct) === "removed-1m" && modelId !== "") {
         CONFIG_NOTICES.push({
             event: "auto_compact_window_not_derived_1m",
             fields: {
@@ -903,7 +964,8 @@ function parseModelDomain() {
             },
         });
     }
-    noticeAutoCompactAboveWindow("main", "MODEL_AUTO_COMPACT_TOKENS", model);
+    if (modelId !== "")
+        noticeAutoCompactAboveWindow("main", "MODEL_AUTO_COMPACT_TOKENS", model);
     if (cheapModel) {
         const cheapAct = optFinitePositiveEnv("MODEL_CHEAP_AUTO_COMPACT_TOKENS");
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
@@ -919,7 +981,7 @@ function parseModelDomain() {
         }
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
-    const models = { default: model, [model.id]: model };
+    const models = modelId === "" ? {} : { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
     const gatewayApiKey = process.env.MODEL_API_KEY;
@@ -979,6 +1041,7 @@ function parseModelDomain() {
         models,
         modelApiKeyEnv: {},
         modelApiKeys: {},
+        modelRefusals: {},
         modelQuotaWeights: {},
         tiers: {},
         projects: {},
@@ -1650,6 +1713,7 @@ function parseOrchestrationDomain(ctx) {
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
+    const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
     {
         const lane = process.env.REMOTE_EXEC;
         if (lane !== undefined && lane !== "") {
@@ -1698,7 +1762,7 @@ function parseOrchestrationDomain(ctx) {
                 ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")),
                 ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")),
                 ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: boolEnv("E2B_ALLOW_NET", true) } : {}),
-                ...(process.env.E2B_SANDBOX_ENV ? { sandboxEnv: resolveEnvForward(process.env.E2B_SANDBOX_ENV) } : {}),
+                ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("E2B_SANDBOX_ENV", singleUserTurnkey)),
                 ...(process.env.E2B_MOUNT_PATH ? { mountPath: process.env.E2B_MOUNT_PATH } : {}),
                 orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
@@ -1773,7 +1837,7 @@ function parseOrchestrationDomain(ctx) {
                                                             ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
                                                             : {}),
                                                         ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
-                                                        ...(process.env.DOCKER_SANDBOX_ENV ? { env: resolveEnvForward(process.env.DOCKER_SANDBOX_ENV) } : {}),
+                                                        ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
                                                     }
                                                     :
                                                         process.env.REMOTE_EXEC === "device"
@@ -1844,6 +1908,7 @@ function parseOrchestrationDomain(ctx) {
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
         lspEnabled: boolEnv("LSP_ENABLED", false),
         lspHostEnabled,
+        lspEnvAllow,
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
@@ -2070,7 +2135,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
@@ -2096,7 +2161,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
-    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [

package/dist/deployment-governance.d.ts

@@ -70,8 +70,26 @@ export interface PathAdjudication {
 export interface LiveQuestionFace {
     hasLiveContext(): boolean;
 }
-/** durable 轴的审批基线入参。缺席 ⇒ adjudicated allow-all 基线(见 {@link createApprovalBaselinePolicy})。 */
+/**
+ * S-694 —— 审批基线的**席**:这条腿上「一个名单产的 `ask` 由谁来服」。闭集三形,每条腿**显式**说出自己那一形
+ * ({@link createApprovalBaselinePolicy} 的席参数必填、按 `kind` 穷举 —— 闭集 +1 = 编译红):
+ *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。AskUserQuestion 的问答门
+ *    **只**叠在这一形上(它的 `ask` 语义就是 durable park)。
+ *  · `live`    —— Runner 的活 onAsk 席当场服 ask(run-local 的 `createLocalApprover`:TTY 问 y/N / 无 TTY 当场拒;
+ *    core `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退,ask 落回调)。三张名单与 durable 席**同一只**策略。
+ *  · `absent`  —— 没有谁服 ask ⇒ adjudicated allow-all;**只**服务零名单(HTTP 腿「durable 关 ∧ 单用户零意图」)。
+ *    带名单进来 = 响亮拒:名单被一条没有席的腿静默吞掉,正是 S-694 的病形。
+ *
+ * 🔴 由来(S-694):修前席是一个**可选**参数、缺席即 allow-all。run-local 调它时没传 ⇒ 三张名单一张都不进策略,
+ * 而这条腿其实**有**一只活 onAsk 席 —— [ref] 件一把「没有 durable 赎回腿」等同成了「ask 无处可服」。
+ * 席必填之后,「这条腿能不能服 ask」是每个调用点必须写出来的一句话,不再是一个忘了写就成立的缺省。
+ */
+export type ApprovalSeat = DurableApprovalSeat | LiveApprovalSeat | AbsentApprovalSeat;
+/** 席的形名(补偿 warn 等只需要「哪一形」的读者读它,不必铸整只席)。 */
+export type ApprovalSeatKind = ApprovalSeat["kind"];
+/** durable 席:checkpoint suspend/resume 服 ask,问答门叠在名单策略上。 */
 export interface DurableApprovalSeat {
+    readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
     /** 每会话「本会话不再询问」探针(canonical toolName 键空间)。 */
@@ -79,6 +97,14 @@ export interface DurableApprovalSeat {
     /** 豁免短路时的审计钩子。 */
     readonly onExempted?: DurableAskOptions["onExempted"];
 }
+/** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店)。 */
+export interface LiveApprovalSeat {
+    readonly kind: "live";
+}
+/** absent 席:这条腿没有谁服 ask ⇒ adjudicated allow-all,只服务零名单。 */
+export interface AbsentApprovalSeat {
+    readonly kind: "absent";
+}
 /**
  * [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
  * `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
@@ -179,8 +205,9 @@ export interface OperatorWarning {
 }
 /** {@link buildOnlySensitiveBaselineWarning} 读的座位量 —— 「这个部署到底有没有一道**真**门」。 */
 export interface GateSeatView {
-    /** durable 审批门(checkpoint suspend/resume)是否在这条腿上真装。 */
-    readonly durableEnabled: boolean;
+    /** 这条腿审批基线的**席**(与喂 {@link createApprovalBaselinePolicy} 的是同一只,S-694:此前是一个与席分家的
+     *  `durableEnabled` 布尔,于是有活 onAsk 席的 run-local 腿被判成「没有门」)。 */
+    readonly approvalSeat: ApprovalSeatKind;
     /** 单用户 turnkey 的 auto-accept 基线是否适用(= 零门意图的既定姿势,不是 misconfig)。 */
     readonly singleUserAutoAcceptBaseline: boolean;
 }
@@ -192,8 +219,10 @@ export interface GateSeatView {
  * 此前是「这个部署一个门都没接」这个 misconfig 的**唯一**提示,而守卫集只挡那二十来个路径段、其余写
  * 目标照旧无裁决 —— 信号不能因为我们铺了基线就静默消失,所以由我们自己按同一判据说一次。
  *
- * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 两条产**真**门的腿都不在场(durable 门关 ∧ 单用户
- * auto-accept 基线不适用)。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * 判据(与信号消失的条件逐字互补):守卫集在场 ∧ 这条腿的审批基线**没有席**(`absent`)∧ 单用户
+ * auto-accept 基线不适用。三个量都是部署常量 ⇒ 消费腿在 boot 期说一次,不是每任务一次。
+ * S-694:席读的是喂审批基线的**同一只**({@link ApprovalSeat})—— `durable` / `live` 两形都有人服 ask、名单
+ * 进策略,「守卫集是唯一的策略」这句话在它们上面不成立。今天真发的只剩 HTTP 腿「durable 关 ∧ 多租户」那一形。
  *
  * ⚠️ 单一属主([ref] 件三):HTTP 腿与 run-local 腿共用本判据与文案。两处各写一份 = 一处改了另一处
  * 没改,而两份都长得像对的 —— 那正是本文件存在的理由。
@@ -211,18 +240,22 @@ export declare function createDeploymentGovernanceInputs(config: DeploymentGover
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
- * 两形:
- *  · `durable` 在场 ⇒ durable 轴 = AskUserQuestion 判决门 + F4 高危写审批门(deny/neverAuto/预算/
- *    会话豁免全在 `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
- *  · `durable` 缺席 ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、
+ * 三形,按席穷举(S-694,席的定义见 {@link ApprovalSeat}):
+ *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/会话豁免全在
+ *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
+ *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
+ *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。
+ *  · `absent`  ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、
  *    effect-aware 的策略。CC 的信任模型是 auto-accept,但门**机制**必须在场(core 原则「机制留、默认
  *    可更宽」)—— 满足 core 的 `hasEffectAwareGate`,恢复可观测性与 hook/tighten 点,而运维照旧用
  *    `AUTONOMY`/`commandPolicy` 收紧不可逆操作(由 `applyRuntimeGovernance` tighten-only 叠上)。
+ *    🔴 本形**只**服务零名单:名单在场却递 absent 席 = 名单被静默吞掉(S-694 的病形),响亮拒。
  *
  * ⚠️ 「零门意图才铺 allow-all」这条准入判据**不在本口**:它是消费腿的部署形判断(单用户/多租户、
- * 有无 checkpoint 店),属主是 `hasOperatorGateIntent`/`assertGateIntentServiceable`(src/approval.ts)。
- * 本口只按调用方给的形铸策略,绝不替它判「这个部署该不该有门」。
+ * 有无 checkpoint 店),属主是 `hasOperatorGateIntent` / `gateIntentUnserviceableReason`(src/approval.ts)。
+ * 本口只按调用方给的席铸策略,绝不替它判「这个部署该不该有门」;absent 臂那条拒是**席与名单自相矛盾**的
+ * 一致性断言(调用方已判过的事实在这里被违反),不是第二份准入判据。
  */
-export declare function createApprovalBaselinePolicy(config: ApprovalBaselineConfigView, durable?: DurableApprovalSeat): ToolPolicy;
+export declare function createApprovalBaselinePolicy(config: ApprovalBaselineConfigView, seat: ApprovalSeat): ToolPolicy;
 export {};
 //# sourceMappingURL=deployment-governance.d.ts.map

package/dist/deployment-governance.js

@@ -1,6 +1,6 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
-import { createDurableAskPolicy } from "./approval.js";
+import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
@@ -58,8 +58,19 @@ export function assertGuardPatternsUsable(config) {
     }
 }
 export function buildOnlySensitiveBaselineWarning(config, seat) {
-    if (config.sensitiveWritePatterns.length === 0 || seat.durableEnabled || seat.singleUserAutoAcceptBaseline)
+    if (config.sensitiveWritePatterns.length === 0 || seat.singleUserAutoAcceptBaseline)
         return undefined;
+    switch (seat.approvalSeat) {
+        case "durable":
+        case "live":
+            return undefined;
+        case "absent":
+            break;
+        default: {
+            const unhandled = seat.approvalSeat;
+            throw new Error(`approval seat "${String(unhandled)}" has no arm in the only-sensitive-baseline warning`);
+        }
+    }
     return {
         event: "tool_policy_only_sensitive_baseline",
         fields: {
@@ -95,16 +106,33 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
         ...(sensitivePathPolicy ? { sensitivePathPolicy } : {}),
     };
 }
-export function createApprovalBaselinePolicy(config, durable) {
-    if (durable === undefined)
-        return createAllowDenyPolicy({});
-    return combinePolicies(createDurableQuestionGate(durable.question), createDurableAskPolicy({
+export function createApprovalBaselinePolicy(config, seat) {
+    switch (seat.kind) {
+        case "durable":
+            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat));
+        case "live":
+            return createApprovalListPolicy(config, {});
+        case "absent":
+            if (hasApprovalListIntent(config)) {
+                throw new Error("approval baseline: this leg has no approval seat (nobody can answer an ask), yet an approval list is in force " +
+                    "(APPROVAL_REQUIRE / APPROVAL_DENY / APPROVAL_NEVER_AUTO, or the center's governance.approvalRequire) — the list would be silently ignored. " +
+                    "The caller must hand a durable or live seat, or refuse the list before it reaches this leg.");
+            }
+            return createAllowDenyPolicy({});
+        default: {
+            const unhandled = seat;
+            throw new Error(`approval seat ${JSON.stringify(unhandled)} has no baseline arm`);
+        }
+    }
+}
+function createApprovalListPolicy(config, memory) {
+    return createDurableAskPolicy({
         requireApproval: config.approvalRequire,
         deny: config.approvalDeny,
         autoBudget: config.approvalAutoBudget,
         neverAuto: config.approvalNeverAuto,
-        ...(durable.exempt ? { exempt: durable.exempt } : {}),
-        ...(durable.onExempted ? { onExempted: durable.onExempted } : {}),
-    }));
+        ...(memory.exempt ? { exempt: memory.exempt } : {}),
+        ...(memory.onExempted ? { onExempted: memory.onExempted } : {}),
+    });
 }
 //# sourceMappingURL=deployment-governance.js.map

package/dist/env-name-allowlist-knobs.d.ts

@@ -0,0 +1,37 @@
+/**
+ * S-699 / S-713 —— **名单型 env 旋钮**的闭集表(纯叶:零值依赖,任何层都可值引而不成装载环)。
+ *
+ * 解析规则(未设 / 形错拒启 / 姿态 / 生效名单)的全文在 `config.ts` `parseEnvNameAllowlist` 的头注;本表只装**各旋钮自己的**事实,
+ * 不是解析规则:
+ *  · `example` 进拒句;
+ *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数。
+ *    - `LSP_ENV_ALLOW` ⇒ ignored:host 腿语言服务器在多租户姿态下本来就不起,名单无处作数,设了要说出来(S-699)。
+ *    - 两只沙箱名单 ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
+ *      带外凭据(e2b / docker 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
+ * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红。
+ *
+ * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
+ * {@link describeAllowlistPostures} 的读数 —— 今天三处:`config_env_forwarded_multi_tenant.note`(`config.ts` 解析器)、LSP 剥除现场的
+ * 出路句(`observability/secret-env-scrub.ts`)、配置目录 `LSP_ENV_ALLOW` 行(`config-catalog.ts`)。修前三处各手抄一遍,表改一格它们
+ * 当场撒谎。为什么是纯叶:`config-catalog.ts` 被 `config.ts` 值引,表留在 `config.ts` 会成装载环。
+ */
+export type EnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+export type EnvNameAllowlistPosture = {
+    readonly kind: "honored";
+} | {
+    readonly kind: "ignored";
+    readonly why: string;
+};
+export type EnvNameAllowlistKnobTable = {
+    readonly [K in EnvNameAllowlistKnob]: {
+        readonly example: string;
+        readonly multiTenant: EnvNameAllowlistPosture;
+    };
+};
+export declare const ENV_NAME_ALLOWLIST_KNOBS: EnvNameAllowlistKnobTable;
+/**
+ * 多租户姿态句 —— **由表派生**,不许在别处手写。形:`under REQUIRE_PRINCIPAL=true: <旋钮> is ignored; <旋钮> / <旋钮> are forwarded as configured`
+ * (按 {@link POSTURE_PHRASE} 的 kind 序分组、组内按表序;空组不出现)。只有旋钮名与姿态,不带任何名单内容。
+ */
+export declare function describeAllowlistPostures(table?: EnvNameAllowlistKnobTable): string;
+//# sourceMappingURL=env-name-allowlist-knobs.d.ts.map

package/dist/env-name-allowlist-knobs.js

@@ -0,0 +1,24 @@
+export const ENV_NAME_ALLOWLIST_KNOBS = {
+    LSP_ENV_ALLOW: {
+        example: "LSP_ENV_ALLOW=NPM_TOKEN,CARGO_REGISTRIES_MY_REG_TOKEN",
+        multiTenant: { kind: "ignored", why: "the host-lane language server is not started in this posture, and the language-server env keeps the full secret strip" },
+    },
+    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+};
+const POSTURE_PHRASE = {
+    ignored: { one: "is ignored", many: "are ignored" },
+    honored: { one: "is forwarded as configured", many: "are forwarded as configured" },
+};
+export function describeAllowlistPostures(table = ENV_NAME_ALLOWLIST_KNOBS) {
+    const knobs = Object.keys(table);
+    const groups = Object.keys(POSTURE_PHRASE).flatMap((kind) => {
+        const named = knobs.filter((k) => table[k].multiTenant.kind === kind);
+        if (named.length === 0)
+            return [];
+        const phrase = POSTURE_PHRASE[kind];
+        return [`${named.join(" / ")} ${named.length === 1 ? phrase.one : phrase.many}`];
+    });
+    return `under REQUIRE_PRINCIPAL=true: ${groups.join("; ")}`;
+}
+//# sourceMappingURL=env-name-allowlist-knobs.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -248,13 +248,19 @@ export type FleetFrame = {
      * durable 行压根不存在 —— 三形共同点是**没有终局可投影**,而本副本的行必然陈旧。此时造一个终态
      * 就是编:判死的属主始终是 durable 侧的 reaper。所以只陈述「这条行离场了」,不逼消费端结算。
      * (cli 侧裁量 [ref]:渲「离场」**不清行** —— 行保留、中性离场形、active 扣除、折叠排后。)
+     * 🔴 S-751:子代行的陈述级退场之前,对账腿先问过它的属主(bg registry 非终态 ∨ 有待决审批 ⇒ 留行);
+     * 本帧因此只在「静默满一周期 ∧ 属主不作保」时出现。而它**不封被退那一代**(见 {@link cycleSeq})——
+     * 之后同一代(或更大代)的帧到达 = 那一行其实还活着,行**复活**;更小的代照旧是前代迟到帧。
      * ADDITIVE / tolerate-absent。
      */
     removeReason?: "orphaned";
     /** [ref] §2 判死×判代合成规则:退场帧带**被退那一代**的 {@link FleetTaskRow.cycleSeq}。
      *  消费端因此能把 `retire(gen=N)` 之后的 `frame(gen=N+1)` 读成**复活**(行重生,退休不粘住新代),
-     *  而 `retire(gen=N)` 之后的 `frame(gen=N)` 读成**前代迟到帧,忽略**。缺席同 {@link FleetTaskRow.cycleSeq}
-     *  ——「无此概念」,不是「第一代」。 */
+     *  而**结算级** `retire(gen=N)`(本帧无 `removeReason`)之后的 `frame(gen=N)` 读成**前代迟到帧,忽略**。
+     *  🔴 S-751:**陈述级**退场(`removeReason:"orphaned"`)之后的 `frame(gen=N)` = **复活**,不是迟到帧 ——
+     *  陈述级退场从不断言「这一代结束了」(它说的只是「本副本一个周期没听到这一行」),所以同代的下一帧
+     *  就是它还活着的证据(本仓 {@link FleetEventBus.removeTask} 对这一形不封代,消费端同读);更小的代照旧忽略。
+     *  缺席同 {@link FleetTaskRow.cycleSeq} ——「无此概念」,不是「第一代」。 */
     cycleSeq?: number;
 } | {
     type: "workflow";
@@ -452,7 +458,10 @@ export declare class FleetEventBus {
     private readonly tasks;
     private readonly workflows;
     /** [ref] / codex R1-F2:**代际墓碑** —— 已离场行的最后已知 `cycleSeq`(行本身已从 `tasks` 删掉,
-     *  代际状态却必须活得比行久一点,否则前代迟到帧会在空 Map 上把幽灵行重铸出来)。有界 LRU。 */
+     *  代际状态却必须活得比行久一点,否则前代迟到帧会在空 Map 上把幽灵行重铸出来)。有界 LRU。
+     *  🔴 S-751:碑上多记一位 `ended` = 「**这一代结束了**」是否被断言过。离场**恒**保住代际状态(`gen` 之前的帧
+     *  永远是前代迟到帧 —— 与行还在 Map 里时那道闸同一个判据);只有作「这一代结束了」断言的离场(结算级 / 投影级
+     *  常规清场)才把 `gen` **这一代本身**也封掉。陈述级退场(`removeReason:"orphaned"`)不作这个断言 ⇒ 同代帧 = 复活。 */
     private readonly retiredGen;
     private static readonly RETIRED_GEN_MAX;
     constructor(now?: () => number);
@@ -472,7 +481,7 @@ export declare class FleetEventBus {
     /** Drop a task row (terminal + swept) + fan out the removal. Idempotent (a no-op if already gone).
      *
      *  `opts`([ref],两键均 ADDITIVE):`removeReason:"orphaned"` = **陈述级退场**(没有结算语义,见
-     *  {@link FleetFrame} 的 `task_remove` 臂);`cycleSeq` = 被退那一代的代际号。发布方的常规清场
+     *  {@link FleetFrame} 的 `task_remove` 臂;S-751 起**不封被退那一代**,同代帧 = 复活);`cycleSeq` = 被退那一代的代际号。发布方的常规清场
      *  (`onTerminal`/`onChildTerminal`)不传 opts ⇒ 帧逐字节与本改动之前相同。 */
     removeTask(id: string, opts?: {
         removeReason?: "orphaned";
@@ -489,6 +498,23 @@ export declare class FleetEventBus {
     backgroundChildLaneRow(scope: string | undefined, childUuid: string): string | undefined;
     /** [ref] 让位迁移料的读面:迁移「只补缺席位」需要看得见存活行现有什么(BCE 是权威车道,不覆盖)。 */
     taskRow(id: string): Readonly<FleetTaskRow> | undefined;
+    /**
+     * S-751:一条子代行在它两只**属主账**上的键。三个 id 域互不相同,换算只有本类做得了(两种行 id 都是本文件
+     * 铸的,两域之间唯一的 join —— 让位登记簿 —— 也住在这里),所以换算只写这一处:
+     *  · 行 id —— BCE 车道 = registry handle 本身(`e.taskId`);run-leg 车道 = `${runId} ${子代 task_progress taskId}`
+     *    (`fleetRunPublisher` 的 `childId`);
+     *  · `handle` —— core bg registry / `BackgroundAgentStore` 的行键,**只认** `DURABLE_AGENT_HANDLE_RE` 形
+     *    (`wa*` 不在 bg 账上);
+     *  · `sessionIds` —— 子代自己的 core session id(uuid 域)= 待决审批 `originTaskId` 的值域
+     *    (core `AskRequest.sourceTaskId`:「the issuing task's session id」),**不是** handle。是**集合**:同一行名下
+     *    可以先后挂过几个子代 session(`wa*` 重试换 session、复活换 session),让位登记簿对每一个都留着 claim ——
+     *    只取其一(此前取最早那个)会漏掉当前这一次的卡(codex r1 F3)。
+     * 换不出的键就缺席 / 空(不猜):父链接行 / 顶层 run 行两者皆无;BCE 行在本车道学到子代 uuid 之前 `sessionIds` 为空。
+     */
+    childOwnerKeys(row: Pick<FleetTaskRow, "id" | "scope">): {
+        handle?: string;
+        sessionIds: readonly string[];
+    };
     /** Upsert a workflow row (MERGE by `id`) + fan out. */
     publishWorkflow(delta: Partial<FleetWorkflowRow> & {
         id: string;

package/dist/fleet/fleet-bus.js

@@ -1,5 +1,5 @@
 import { EventEmitter } from "node:events";
-import { deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
+import { DURABLE_AGENT_HANDLE_RE, deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
 import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
@@ -74,7 +74,7 @@ export class FleetEventBus {
             return;
         if (existing === undefined && delta.retiredBy === undefined) {
             const tomb = this.retiredGen.get(delta.id);
-            if (tomb !== undefined && delta.cycleSeq !== undefined && delta.cycleSeq <= tomb)
+            if (tomb !== undefined && delta.cycleSeq !== undefined && (delta.cycleSeq < tomb.gen || (tomb.ended && delta.cycleSeq === tomb.gen)))
                 return;
         }
         const merged = { ...(existing ?? { id: delta.id, status: "running" }), ...delta };
@@ -97,10 +97,12 @@ export class FleetEventBus {
         if (existing !== undefined && opts?.cycleSeq !== undefined && existing.cycleSeq !== undefined && existing.cycleSeq > opts.cycleSeq)
             return;
         if (this.tasks.delete(id)) {
-            const gen = existing?.cycleSeq ?? opts?.cycleSeq;
+            const prior = this.retiredGen.get(id);
+            const gen = existing?.cycleSeq ?? opts?.cycleSeq ?? prior?.gen;
             if (gen !== undefined) {
+                const ended = opts?.removeReason !== "orphaned" || (prior !== undefined && prior.gen === gen && prior.ended);
                 this.retiredGen.delete(id);
-                this.retiredGen.set(id, gen);
+                this.retiredGen.set(id, { gen, ended });
                 if (this.retiredGen.size > FleetEventBus.RETIRED_GEN_MAX) {
                     const oldest = this.retiredGen.keys().next();
                     if (!oldest.done)
@@ -138,6 +140,20 @@ export class FleetEventBus {
     taskRow(id) {
         return this.tasks.get(id);
     }
+    childOwnerKeys(row) {
+        const sp = row.id.lastIndexOf(" ");
+        if (sp > 0) {
+            const sessionId = row.id.slice(sp + 1);
+            const claimed = this.bceClaims.get(FleetEventBus.bceKey(row.scope, sessionId));
+            return { sessionIds: [sessionId], ...(claimed !== undefined && DURABLE_AGENT_HANDLE_RE.test(claimed) ? { handle: claimed } : {}) };
+        }
+        const prefix = FleetEventBus.bceKey(row.scope, "");
+        const sessionIds = [];
+        for (const [k, rowId] of this.bceClaims)
+            if (rowId === row.id && k.startsWith(prefix))
+                sessionIds.push(k.slice(prefix.length));
+        return { sessionIds, ...(DURABLE_AGENT_HANDLE_RE.test(row.id) ? { handle: row.id } : {}) };
+    }
     publishWorkflow(delta) {
         const merged = { ...(this.workflows.get(delta.id) ?? { id: delta.id, status: "running" }), ...delta };
         this.workflows.set(delta.id, merged);

package/dist/fleet/fleet-reconciler.d.ts

@@ -33,10 +33,17 @@
  * 「**静默满一个对账周期**」(本腿订阅总线自记每行的最后帧时刻):还在出帧 = 活着的证据。
  * durable 行**在场**的那三格没有这个歧义(`getRun` 命中 = 它就是一条 run 行),故照矩阵即时处置。
  *
- * ## 子代行(§1)
- * 随父:父行退休/退场时**同扫**(与 `onTerminal` 的 removal 集同姿势)。子代**不读 durable** ——
- * bg 子代的 durable 真源在 core 侧 registry,server 不越界重判。无父可循的孤儿子行(父行已不在 bus)
- * 按「bus 内滞留超一个对账周期且无新帧」陈述级退场。
+ * ## 子代行(§1;🔴 S-751 起改为「活性由属主说了算」)
+ * 子代行**不读 durable run 店**(它不是 run 行)。它的活性属主有两只,都在本仓可读 —— 读它们**不是**越界重判,
+ * 是问属主(S-751 之前此处写「bg 子代的 durable 真源在 core 侧 registry,server 不越界重判」,于是判据里只剩
+ * 「静默」这一条,而 registry 的读半场 `RunnerDeps.backgroundAgentStore` 一直就在本仓):
+ *  ① core bg registry(`BackgroundAgentStore` 行 `status` 非终态 = `running` / `parked`);
+ *  ② 本副本审批面的待决卡(子代发起、没人答的 ask —— 子代卡在那儿,当然不出帧)。
+ * **一条规则**:无父可循(父从未在 / 父本周期刚退休或退场)∧ 静默满一个对账周期 ∧ 两只属主都不作保 ⇒
+ * 陈述级退场。父离场**不再无条件同扫**子代(那是报案的一半病:父轮结束、子代一次工具调用 ≥60s 或审批卡
+ * 60s 没人答 ⇒ 活子代被扫);父离场只让子代「无父可循」,子代与既有孤儿走**同一只**判据、同一个循环。
+ * 同一问也挂在「durable 无行」那一格上:父链接未解析的 `a*` 行与顶层行同形(见上方收窄段),run 账不认识它
+ * ≠ 它死了。另一半病(陈述级退场立了代际墓碑、吞掉活子代之后的同代帧)的修在 `fleet-bus.ts` `removeTask`。
  *
  * ## workflow 行(§1)
  * 只做同款「durable 终局投影」([ref] 的 snapshot pull 腿 + reapers 的 workflow recover 腿已在场),
@@ -77,7 +84,7 @@
  * 与 `fleet-terminal-window.ts` 同一论证:两侧边界都由语义定死(比周期短 = 幽灵行仍在面板上,比周期长 =
  * 拿对账腿当历史列表),旋钮只会让部署方去调一个没有正确取值的数;fleet 面现有零旋钮,从之。
  */
-import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
+import { type BackgroundAgentRecord, type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type RunRecord } from "../plugins/store-contracts.js";
@@ -111,6 +118,12 @@ export interface FleetReconcileRunPort {
 export interface FleetReconcileWorkflowPort {
     get(id: string): Promise<WorkflowRun | null | undefined>;
 }
+/** S-751:core bg registry 账(`BackgroundAgentStore`)的只读窄口 —— 与 {@link FleetReconcileRunPort} 同一条
+ *  单写者纪律(接口上没有写方法)。生产 = `RunnerDeps.backgroundAgentStore` **同实例**(结构上就是它的 `get`
+ *  一面);`null` = 账上没有这一行。 */
+export interface FleetReconcileAgentPort {
+    get(handle: string, scope: string): Promise<Pick<BackgroundAgentRecord, "status"> | null>;
+}
 export interface FleetReconcilerDeps {
     bus: FleetEventBus;
     /**
@@ -130,6 +143,14 @@ export interface FleetReconcilerDeps {
     subscribeRunTerminal?: (fn: (rec: RunTerminalRecord) => void) => () => void;
     runs?: FleetReconcileRunPort;
     workflows?: FleetReconcileWorkflowPort | WorkflowRunStore;
+    /** S-751:子代活性的属主①(bg registry 账)。缺席 = 没有 bg 店的部署(纯内存 dev),这一问问不了。 */
+    agents?: FleetReconcileAgentPort;
+    /**
+     * S-751:子代活性的属主②:这只子代此刻有没有**待决**审批卡。只问是非(与 {@link isLiveOnThisReplica} 同姿势,
+     * 不搬 Map)。入参是 ask 发起者域(子代自己的 core session id,= 卡上的 `originTaskId`),**不是**行 id ——
+     * 行 id → 该域的换算只在 `FleetEventBus.childOwnerKeys`。生产 = `ToolApprovalCoordinator.hasLivePendingFrom`。
+     */
+    hasPendingAsk?: (originTaskId: string) => boolean;
     /** 本副本 id(与 `RunRecord.instanceId` 同域)。只进日志/读数 —— 两条 `running` 臂的**处置相同**
      *  (都是陈述级退场),分不分得出 claim 属谁不改变行为,故它不是判据。 */
     instanceId?: string;
@@ -150,8 +171,10 @@ export interface FleetReconcileTally {
     retired: number;
     /** 陈述级退场的行数(顶层 + 孤儿子行)。 */
     orphaned: number;
-    /** 随父同扫的子行数。 */
+    /** 父本周期刚离场、自己又判成孤儿而陈述级退场的子行数(S-751 前 = 随父无条件同扫的数)。 */
     childrenSwept: number;
+    /** S-751:静默满一周期、无父可循(或 run 账不认识),但属主作保而**留行**的子行数。 */
+    childrenKeptAlive: number;
     /** durable 终局 ⇒ 投影退休的 workflow 行数。 */
     workflowsRetired: number;
     /** 本周期实际发出的 durable 点读次数。 */