@sema-agent/server 7.104.0 → 7.106.0

package/dist/http/routes/runs.js

@@ -1,6 +1,5 @@
 import { persistedPlaneOf } from "../../terminal.js";
-import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal.js";
-import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
@@ -126,14 +125,9 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
             return run ? { status: run.status, updatedAt: run.updatedAt } : undefined;
         },
         getEvents: (id, after) => runStore.getEvents(id, after),
-        retainedFrom: (id) => runStore.retainedFrom(id),
         formatEvent: (ev) => {
             const type = normalizeRunEventType(ev.type);
-            const redacted = type === "done" && ev.data && typeof ev.data === "object" && ev.data.result && typeof ev.data.result === "object"
-                ? { ...ev.data, result: memoRedactTerminalResult("ev.done.result", ev.data.result) }
-                : type === "failed" ? memoRedactedRead("ev.failed", ev.data, (d) => redactLedgerEventData(type, d))
-                    : isModelTextLedgerEventType(type) ? memoRedactedRead("ev.model-text", ev.data, (d) => redactLedgerEventData(type, d))
-                        : redactLedgerEventData(type, ev.data);
+            const redacted = redactLedgerEventForRead(type, ev.data);
             const data = screenedStoredEventData(type, redacted);
             return { id: ev.seq, event: type, data: { type, ...(data ?? {}) } };
         },

package/dist/http/routes/session-sync.js

@@ -13,7 +13,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
-import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem, legacyToolNameProblemOf } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -235,6 +235,11 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const policyRead = readSessionRulesRecords(body.policy);
                 if (policyRead.problem !== undefined) {
+                    const legacy = legacyToolNameProblemOf(policyRead.problem);
+                    if (legacy !== undefined) {
+                        sendError(res, 400, "rules.legacy_tool_name", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`, { field: legacy.field, name: legacy.name });
+                        return;
+                    }
                     sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);
                     return;
                 }

package/dist/http/routes/sessions.js

@@ -6,7 +6,7 @@ import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
+import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -777,7 +777,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.invalid_json", "invalid JSON body");
                 return;
             }
-            const read = readSessionPermissionRules(body.rules);
+            const read = readWritableSessionPermissionRules(body.rules);
             if (read.problem !== undefined) {
                 switch (read.problem.kind) {
                     case "not-an-object":
@@ -786,6 +786,9 @@ export async function handleSessions(req, res, match, ctx) {
                     case "field-not-string-array":
                         sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
                         return;
+                    case "legacy-tool-name":
+                        sendError(res, 400, "rules.legacy_tool_name", describeSessionPermissionRulesProblem(read.problem), { field: read.problem.field, name: read.problem.name });
+                        return;
                     default: {
                         const unhandled = read.problem;
                         throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);

package/dist/http/routes/side-query.js

@@ -3,6 +3,7 @@ import { HttpError } from "../../security.js";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { admitProviderEcho } from "../../observability/run-terminal.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -28,6 +29,12 @@ function isModelRole(value) {
 function passthroughModelRole(value) {
     return value;
 }
+function shapeSideQueryEcho(result) {
+    if (result.responseModel === undefined || admitProviderEcho(result.responseModel, "side-query.responseModel"))
+        return result;
+    const { responseModel: _outOfShape, ...admitted } = result;
+    return admitted;
+}
 export async function handleSideQuery(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
@@ -100,7 +107,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     deps.sideQueryAccounting?.(principal, { model: modelId, usage: rr.usage });
                     deps.metrics?.inc?.("side_query_total", { result: "ok" });
                     if (!res.writableEnded)
-                        sendJson(res, 200, result);
+                        sendJson(res, 200, shapeSideQueryEcho(result));
                 }
                 catch (e) {
                     deps.metrics?.inc?.("side_query_total", { result: "error" });

package/dist/http/routes/tasks.js

@@ -22,6 +22,7 @@ import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../app
 import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
+import { commitSessionInheritEnv } from "../session-inherit-env.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
@@ -248,6 +249,7 @@ export async function handleTasks(req, res, match, ctx) {
                     }
                     durableTaskId = tid;
                 }
+                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (prepared.spec.sessionId)
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
@@ -633,7 +635,7 @@ export async function handleTasks(req, res, match, ctx) {
                     if (deps.toolApproval) {
                         const toolApproval = deps.toolApproval;
                         prepared.spec.onAsk = windowZero
-                            ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId: askTaskId, owner: askOwner, toolName: askReq.toolName }))
+                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })
                             : toolApproval.boundAsk({
                                 owner: askOwner,
                                 taskId: askTaskId,
@@ -795,6 +797,7 @@ export async function handleTasks(req, res, match, ctx) {
                     deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id);
                     durableTaskId = tid;
                 }
+                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }

package/dist/http/routes/trace-usage.d.ts

@@ -6,6 +6,8 @@
  *
  * ⚠️ 三块都跑在全局 service-credential 门**之前**(与 /metrics 同款待遇)——只读 traceToken 单凭据的调用方
  * (registry 中继的姿势)在全局门会被 401,挂门后=门内 traceToken 支持成死代码(1.148 a2 实机抓获)。
+ * S-672(7.105.0):门前不等于不设防 —— 本域坐在读路谓词段,先过 `dispatch.ts` 的 `readCredentialOk`
+ * (部署配了 service 凭据时要「service token / traceToken / 已验 principal」之一),块内这几道门在它之后。
  * 因此本域在 `handle()` 里的位置就是契约的一部分:必须留在鉴权门上方,顺序不可与其他域对调。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/trace-usage.js

@@ -1,4 +1,5 @@
 import { projectEvents, taskSummary, mapTraceEvent } from "../../trace/project.js";
+import { redactLedgerEventForRead } from "../../observability/run-terminal.js";
 import { projectArtifacts } from "../../trace/artifacts.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../../usage-analytics.js";
 import { sleep } from "../sse-log.js";
@@ -220,6 +221,7 @@ async function handleToolResult(res, store, runStore, taskId, ownedRun, ref, que
         return notFound();
     sendJson(res, 200, { content: slice.content, offset: slice.offset, totalChars: slice.totalChars });
 }
+const readFaceEvent = (ev) => ({ ...ev, data: redactLedgerEventForRead(ev.type, ev.data) });
 async function handleTaskTurns(res, runStore, taskId, query) {
     const run = await runStore.getRun(taskId);
     if (!run) {
@@ -229,7 +231,7 @@ async function handleTaskTurns(res, runStore, taskId, query) {
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 20) || 20));
     const cursorSeq = Number(query.get("cursor") ?? 0) || 0;
     const [events, retainedFrom] = await Promise.all([runStore.getEvents(taskId, 0), runStore.retainedFrom(taskId)]);
-    const all = projectEvents(events);
+    const all = projectEvents(events.map(readFaceEvent));
     const eligible = cursorSeq > 0 ? all.filter((t) => t.seq < cursorSeq) : all;
     const turns = eligible.slice(Math.max(0, eligible.length - limit));
     const oldest = turns[0];
@@ -244,13 +246,6 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs, search) {
     }
     const lastId = Number(req.headers["last-event-id"] ?? new URLSearchParams(search).get("from") ?? 0);
     let from = Number.isFinite(lastId) ? lastId : 0;
-    if (from > 0) {
-        const retainedFrom = await runStore.retainedFrom(taskId);
-        if (retainedFrom > from + 1) {
-            sendError(res, 416, "limit.retention_evicted", "resume point evicted past retention", { retainedFrom });
-            return;
-        }
-    }
     sseHeaders(res);
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "delta", resumeFrom: from })}\n\n`);
     let closed = false;
@@ -261,7 +256,7 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs, search) {
     let lastBeat = Date.now();
     const write = (events) => {
         for (const ev of events) {
-            const out = mapTraceEvent(ev.type, ev.seq, (ev.data ?? {}));
+            const out = mapTraceEvent(ev.type, ev.seq, (readFaceEvent(ev).data ?? {}));
             if (out)
                 res.write(`id: ${ev.seq}\nevent: ${out.event}\ndata: ${JSON.stringify(out.data)}\n\n`);
             from = ev.seq;

package/dist/http/server.d.ts

@@ -104,18 +104,27 @@ export interface ServiceCoreDeps {
      *  缺席(桩)⇒ 只走结构化日志终点,行为逐字不变。
      *  ⚠️ 7.69.0(R-1)起 **resume 家族也递这一位** —— 四条 resume 腿收敛到 `resolveResumeSpec` 一只 resolver,
      *  通告口接一次、四腿同得(见 http/server.ts 的 `resolveResumeSpec` 顶注);此处旧注写作「resume 家族缺席」
-     *  已过期,按新行为改。 */
+     *  已过期,按新行为改。
+     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
+     *  装配器在**全部折叠之后**经 `createUnattendedLeg` / `withUnattendedLeg` 重挂那条腿(表 / 根取续跑 Runner 的同名座)。只由续跑腿
+     *  按服务端写的 ctx 位递,绝不从请求体读。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
         onNotice?: (notice: EngineNotice) => void;
+        unattendedLeg?: true;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。
-     * 装配点(main.ts)把「场景判别位 → Runner 对」的映射整只闭包传进来 —— 本层不解释场景,只取用。
-     * 缺席 ⇒ 恒 {@link ServiceDeps.runner}(单 Runner 部署形 = [ref] 之前的行为,逐字不变;测试桩即此形)。
+     * 装配点(`boot/stage-10-http-server.ts`)传的是 `createHandsRunnerSelector` —— 选路规则只有那一份实现,
+     * 本层不解释场景,只取用。
+     * 🔴 **必填**(S-175,7.105.0):修前这一席可选,缺席 ⇒ 静默落 {@link ServiceDeps.runner} —— 最宽的那只
+     * (带全量手的主 Runner)。而同一轴上「车道**字段**缺席」早已是拒(S-149,`handsLaneOf` 抛
+     * `HandsLaneUnstampedError`),席缺席回落最宽 = 同一件事两条律。现在缺席是**编译错**;绕过类型
+     * (JS 嵌入方 / `as` 硬转)造的 deps 在 {@link createHttpServer} 入口**拒启**。单 Runner 的嵌入方显式传
+     * `runnerFor: () => runner` —— 那是一句表态,不是一个回落。
      */
-    runnerFor?: (spec: TaskSpec) => Runner;
+    runnerFor: (spec: TaskSpec) => Runner;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -334,6 +343,12 @@ export interface ServiceSeamDeps {
      * 所以三者的在场性是同一个事实;族内 501 谓词因此可以是「三件齐」这一句话。
      */
     deviceEnrollment?: import("../device-enrollment.js").DeviceEnrollment;
+    /**
+     * S-895 × 7.106.0 合并复审 X1:host 车道会话登记簿的 `inheritEnv` **写口**(`boot/execution-env.ts` 的 `setSessionInheritEnv`)。
+     * 唯一调用者 = `http/session-inherit-env.ts` 的 `commitSessionInheritEnv`(四个 run 认领点在认领之后调;判据与残余见那只文件)。
+     * 缺席 = 本部署不是 host 车道(没有工厂读这一格)⇒ 提交点 no-op。装配 = `boot/stage-10-http-server.ts`(host 车道才给)。
+     */
+    bindSessionInheritEnv?: import("./session-inherit-env.js").SessionInheritEnvCommitCtx["bindSessionInheritEnv"];
     /** Audit回溯: current context (+ summary) for a session, plus its owner. Enables GET /v1/sessions/:id. */
     sessionAudit?: (sessionId: string) => Promise<({
         owner: string | null;
@@ -646,8 +661,14 @@ export interface ServiceDeploymentDeps {
      *  main.ts passes the effective store label (`durable(pg)` / `durable(mysql)` / `durable(local)` / "memory",
      *  same derivation as the boot `listening` log). Absent → fall back to the raw config enum. */
     sessionStoreLabel?: string;
-    /** S5 (SILENT-FALLBACK P0-b): true when the boot auto-probe degraded the store backend to in-memory. */
-    storeDegraded?: boolean;
+    /** S5 → S-866 ①:持久化姿态的**唯一**装配值(`store-posture.ts`,`boot/stores.ts` 铸):`/health` 的 `storeDegraded` / `durable:false`
+     *  (present-iff `degradedReason` 在场)与 caps `store` 同读它,gauge `store_backend_degraded` 在装配点读同一只。
+     *  缺席 = 这个进程不是由 composition root 装起来的(测试夹具形)⇒ `/health` 不带降级位、caps `store` 取诚实下限
+     *  (`declared` = 配置词,`backend:"memory"` —— 本面不知道任何装出来的后端)。 */
+    storePosture?: import("../store-posture.js").StorePosture;
+    /** S-866 ②:caps `centerWiring` 的读面(`capabilities/center-wiring.ts` `createCenterWiringReader`;入参 = 请求的已验 principal)。
+     *  缺席 = 没接中心(或测试夹具)⇒ 键整个缺席。 */
+    centerWiring?: (principal: string | undefined) => import("../capabilities/center-wiring.js").CenterWiring;
     /**
      * Graceful drain — shared mutable state between main.ts (flips `draining` on SIGTERM) and this server:
      *  • while `draining`, NEW model-running submissions (the billable submit paths) get 503 + Retry-After, so an
@@ -749,7 +770,7 @@ export interface ServiceDeploymentDeps {
     /** S-131:SQL 引擎姿态的 **live getter**(`sql-engine-posture.ts` 的单一推导点 —— boot 期借一条池连接
      *  触发驱动的连接初始化,读的是 `SET` 之后**回读复核**过的真值)。两个读面共用:
      *  `GET /v1/diagnostics/wiring` 的 `sqlEngine` 段(operator-only,全量含版本)与 `GET /v1/capabilities`
-     *  的 `sql` 位(窄投影)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
+     *  的 `store.sql` 位(窄投影;7.106.0 前是顶层 `sql`,S-866 ①)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
      *  缺席 / 返回 null = 本部署没有 SQL 后端(env-only worker、local 文件后端)—— 诚实缺席,不铸空壳。 */
     sqlEngineFacts?: () => import("../plugins/sql-driver.js").SqlEngineFacts | null;
     /** S-138:**写保护名表**的姿态(`write-protection.ts` 的 boot 期单一推导点 —— 与递给每只 Runner 的
@@ -856,7 +877,7 @@ export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
 /** SSE: replay durable events after Last-Event-ID, then tail until the run is terminal (or stale). */
 /**
  * The differences a concrete log (task_run | image_bake) feeds the ONE resumable SSE reader (P2.8). Everything
- * the reader does — Last-Event-ID/`?from=` resume, the 416 retention boundary, the per-poll concurrent
+ * the reader does — Last-Event-ID/`?from=` resume (every row with seq > from; no eviction answer, S-211 ①), the per-poll concurrent
  * status+events read, the terminal re-fetch (the terminal event lands in the gap before the status flips), the
  * stale fallback, the 15-min cap, the 15s idle heartbeat — is provider-agnostic and lives in `streamSseLog`.
  * 🔴 The task_run provider MUST keep the existing wire bytes EXACTLY (center's relay + 730+ tests depend on it).

package/dist/http/server.js

@@ -38,6 +38,9 @@ export function flattenServiceDeps(deps) {
 }
 export function createHttpServer(rawDeps) {
     const deps = flattenServiceDeps(rawDeps);
+    if (typeof deps.runnerFor !== "function") {
+        throw new Error("createHttpServer: the runnerFor seat is required (it picks each task's Runner from its execution lane) — pass the hands-lane selector, or `runnerFor: () => runner` for a single-Runner embedding; refusing to start rather than run every task on the widest Runner");
+    }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const cancelledViaVerb = new Set();
@@ -118,7 +121,7 @@ export function createHttpServer(rawDeps) {
     });
     deps.deviceHub?.attach(server);
     function runnerFor(spec) {
-        return deps.runnerFor?.(spec) ?? deps.runner;
+        return deps.runnerFor(spec);
     }
     function recordTaskResult(result) {
         const plane = outwardPlane(result.terminal);

package/dist/http/session-inherit-env.d.ts

@@ -0,0 +1,37 @@
+/**
+ * S-895 × 7.106.0 合并复审 X1(gpt-6 腿 A F1 [high],验证腿 B verified)—— 请求键 `inheritEnv` 的**会话绑定唯一提交点**。
+ *
+ * ── 分界(与 `device-placement.ts` 的首绑写协议同一句判据)──────────────────────────────────────────────────
+ * 凡需要「这条会话此刻归我这条 run」才成立的事,排在 run 认领之后;其余全排在建任何东西之前。`inheritEnv` 的三道判
+ * (值形 / 车道 / 射程)是**读**,住在 `resolveSpec`(两腿同判,任何副作用之前);而「本会话的 host 工厂下一次造环境按哪个词」
+ * 是**写**,它只属于一条**被受理**的 run —— 修前它写在 `resolveSpec` 的最后一步,仍先于路由层的拒(`/v1/tasks/stream` 的
+ * verify / cascade 400 `request.field_conflict`、会话占用 409、`/v1/runs` 的建行 409、placement 拒、续跑的 CAS 输 / 配额 429 …),
+ * 一条被拒的 `"all"` 于是把同会话上一条已受理的 `"scrub"` 放宽成整份继承。
+ *
+ * ── 调用点(类级机器门钉住:`test/inherit-env-request-key.test.ts`「X1 类级机器门」)───────────────────────────
+ * 四个 run 认领点在认领(与 placement 提交)成功之后、起跑之前各调一次 —— 流式提交 / 同步提交(`routes/tasks.ts`)、durable 建行腿
+ * (`durable-run-leg.ts`,`/v1/runs` · A2A · `/decide` 第三车道共用)、续跑驱动腿(`resume-legs.ts` 的 `driveResumeLeg`,markResuming
+ * 赢或 wake 新行建成之后)。无 run 店的部署没有认领这回事:调用点落在认领段**之后**的同一位置,等价于「起跑前、一切拒之后」。
+ * 写的值 = 受理时那条请求体的键(续跑腿 = 盘上那条体的键);缺席 = 清掉(缺省清洗;理由在 `setSessionInheritEnv` 顶注)。
+ *
+ * ── 残余(如实,S-908)──────────────────────────────────────────────────────────────────────────────────────
+ * 登记簿仍按**会话**键控、host 工厂在 run 起跑那一刻现读(core `ExecutionEnvFactoryContext` 只带 sessionId / taskId,没有 per-run 座)。
+ * 有 run 店的部署上认领本身串行化同会话的 run(`task_active` 唯一键),「写 → 读」落在同一条认领窗里;没有 run 店的部署上同会话
+ * 并发受理的两条 run 仍是「最后写者赢」。续跑腿在 markResuming 赢之后写,core 的 pre-CAS 守卫(D-1 绑定 / 过期 token)之后才拒的续跑
+ * 已写下**那条 park 任务自己**盘上的值(不是别的请求的),下一条受理的 run 照写覆盖。根治 = core 的 per-run 座(S-908)。
+ * 射程只在单用户 host 部署(`"all"` 的射程门)⇒ 写者恒是同一主人。
+ */
+import type { TaskInheritEnv } from "../request-value-closure.js";
+/** 提交点的依赖 —— 逐字取自 `ServiceDeps` 的同名键(同一只 deps 对象喂进来)。 */
+export interface SessionInheritEnvCommitCtx {
+    /** host 车道会话登记簿的写口(`boot/execution-env.ts` 的 `setSessionInheritEnv`);缺席 = 本部署不是 host 车道 ⇒ 没有消费点。 */
+    bindSessionInheritEnv?: ((sessionId: string, policy: TaskInheritEnv | undefined) => void) | undefined;
+}
+/**
+ * 在 run 认领之后调用:把受理的那条请求的 `inheritEnv`(缺席 = 清)写进本会话的绑定。`sessionId` 缺席(不接 authorizer 的嵌入形)⇒
+ * 不写 —— `"all"` 在那一形已被 `resolveSpec` 响亮拒,`"scrub"` / 缺席与工厂缺省同形。
+ */
+export declare function commitSessionInheritEnv(ctx: SessionInheritEnvCommitCtx, sessionId: string | undefined, body: {
+    readonly inheritEnv?: TaskInheritEnv | undefined;
+}): void;
+//# sourceMappingURL=session-inherit-env.d.ts.map

package/dist/http/session-inherit-env.js

@@ -0,0 +1,6 @@
+export function commitSessionInheritEnv(ctx, sessionId, body) {
+    if (sessionId === undefined || ctx.bindSessionInheritEnv === undefined)
+        return;
+    ctx.bindSessionInheritEnv(sessionId, body.inheritEnv);
+}
+//# sourceMappingURL=session-inherit-env.js.map

package/dist/http/sse-lifecycle.d.ts

@@ -33,7 +33,7 @@
  * ## 为什么注册完还要回看一眼状态
  *
  * 光「订阅未来事件」不够:`'close'` **只发一次**,而四条腿的接线全都排在若干次 await 之后
- * (trace 是 `getRun`/`retainedFrom`,runs 是 subagent probe,sse-log 是 `retainedFrom`)。客户端
+ * (trace 是 `getRun`,runs 是 subagent probe;sse-log 自 S-211 ① 起写头前已无 await,此前是 `retainedFrom`)。客户端
  * 在那段慢查询里断开 ⇒ 两个 close 都在监听器注册**之前**烧完(实测:后装的监听器不会被补发)⇒
  * 清理整条不发生,泵对着死连接轮询到 15 分钟帽。这不是假想:`sse-log.ts` 的 preamble 注里记着的
  * 同一个坑,当时只把 preamble 挪到了接线之后,而接线本身前面还有别的 await。

package/dist/http/sse-log.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref] A9 seam —— 通用可恢复 SSE 泵(P2.8),从 `http/server.ts` 整段搬出的原文。
  *
- * task_run 与 image_bake 两条日志共用同一套 liveness/heartbeat/416/终态复取/15 分钟帽逻辑;域模块
+ * task_run 与 image_bake 两条日志共用同一套 liveness/heartbeat/终态复取/15 分钟帽逻辑;域模块
  * (routes/images.ts)与 server.ts 都要用它,所以它必须住在 http/ 叶子里(routes/* 值 import server.ts
  * 会闭合运行时装载环)。
  */
@@ -17,8 +17,6 @@ export interface SseLogProvider<E extends {
     } | null | undefined>;
     /** Events with seq strictly greater than `after`, ascending. */
     getEvents(id: string, after: number): Promise<E[]>;
-    /** Earliest retained seq → the 416 resume boundary. */
-    retainedFrom(id: string): Promise<number>;
     /** Map ONE event to its SSE frame (the `id:`/`event:`/`data:` lines differ per log). */
     formatEvent(ev: E): {
         id: number;
@@ -31,13 +29,12 @@ export interface SseLogProvider<E extends {
         data: unknown;
     };
     /**
-     * [ref] 车3 §5:**开流 preamble** —— 在 416 判定与 `sseHeaders` **之后**、日志 tail **之前**写的
+     * [ref] 车3 §5:**开流 preamble** —— 在 `sseHeaders` **之后**、日志 tail **之前**写的
      * 一批**非账本**帧(今天唯一的用户 = 审批未决卡的全量对账基准)。
      *
-     * 🔴 为什么必须是这里的内部 hook,而不是调用方在 `streamSseLog` **之前**自己写:本 helper 的判序是
-     * ①读 `last-event-id`/`?from=` → ②保留期比对、超界直接 `sendError(416)` → ③`sseHeaders` → ④tail。
-     * 在 ① 之前写任何字节 = 提前提交 200 头 ⇒ ② 的 416 分支**结构上不可能再触发**(或触发
-     * headers-already-sent),而调用方自己先调 `sseHeaders` 又会被本 helper 重复写头。
+     * 为什么是这里的内部 hook,而不是调用方在 `streamSseLog` **之前**自己写:写头是本 helper 的事,调用方
+     * 先调 `sseHeaders` 会被这里重复写头。(S-211 ① 之前本 helper 在写头之前还有一道 416 判定,那是这条
+     * 理由的另一半 —— 判定随「账本不存在局部头部裁剪」一起删了,见 {@link streamSseLog} 头注。)
      *
      * 返回帧**不带 `id:`** —— 它不是账本行,不参与 `Last-Event-ID` 游标(壳的规则:preamble 给的是
      * 权威全量卡集,账本重放里的同 id 帧只用于时间线渲染)。
@@ -83,7 +80,13 @@ export declare function collectSsePreamble(preamble: (signal: AbortSignal) => Pr
     data: unknown;
 }>>;
 /** The shared resumable SSE pump (P2.8) — provider supplies the log-specific differences; the liveness/
- *  heartbeat/416/terminal-re-fetch/15-min-cap logic is identical for task_run + image_bake. */
+ *  heartbeat/terminal-re-fetch/15-min-cap logic is identical for task_run + image_bake.
+ *
+ *  🔴 S-211 ①:**没有「续读点已被淘汰」这一答**。两条日志都**没有局部头部裁剪腿** —— `task_event` 唯一的删除者
+ *  是整棵会话树连删(会话删除 / 托管留存,`task_run` 行同批消失 ⇒ 调用方开流前 404),`image_bake_event` 库里一条
+ *  删除语句都没有。此前这里按 `retainedFrom > from + 1` 答 416 `limit.retention_evicted`:真淘汰永远走不到它,
+ *  唯一走得到的形是「写失败耗掉了号」留下的**头部缺行**(ledger-sink 账本留洞)—— 那一形里什么都没被淘汰,416
+ *  是一句谎。续读语义因此只有一句:投 `seq > from` 的每一行(缺的行就是缺的,不补、不猜)。 */
 export declare function streamSseLog<E extends {
     seq: number;
 }>(req: IncomingMessage, res: ServerResponse, provider: SseLogProvider<E>, id: string, staleMs: number): Promise<void>;

package/dist/http/sse-log.js

@@ -1,5 +1,5 @@
 import { bindSseLifecycle } from "./sse-lifecycle.js";
-import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
+import { sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
 export const SSE_PREAMBLE_TIMEOUT_MS = 2_000;
 export async function collectSsePreamble(preamble, onFailure, timeoutMs = SSE_PREAMBLE_TIMEOUT_MS) {
     const timedOut = Symbol("preamble-timeout");
@@ -34,13 +34,6 @@ export async function collectSsePreamble(preamble, onFailure, timeoutMs = SSE_PR
 export async function streamSseLog(req, res, provider, id, staleMs) {
     const lastId = Number(req.headers["last-event-id"] ?? new URL(req.url ?? "", "http://x").searchParams.get("from") ?? 0);
     let from = Number.isFinite(lastId) ? lastId : 0;
-    if (from > 0) {
-        const retainedFrom = await provider.retainedFrom(id);
-        if (retainedFrom > from + 1) {
-            sendError(res, 416, "limit.retention_evicted", "resume point evicted past retention", { retainedFrom });
-            return;
-        }
-    }
     sseHeaders(res);
     let closed = false;
     bindSseLifecycle(req, res, () => {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApproverPosture, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
@@ -197,8 +197,9 @@ export interface TaskRequestBody {
      *  这条 run 零历史店调用:编辑照常落盘,但不做首次触碰备份、不铸回合边界、不做 fork 携带;委派出去的子代继承
      *  (core `ParentSpecSeat` 从本位铸,本仓零接线)。`wiring_manifest.fileHistory` 报 `"disabled"`。
      *  同一个提交里再要还原(`restoreFiles` / `rewindFilesTo` / 退役 `rewindFiles`)= 体内矛盾 ⇒ **受理时** 400
-     *  `request.field_conflict`(`request-value-closure.ts` 的 `FILE_HISTORY_DISABLED_NO_RESTORE`):core 的 `rewind.capture_disabled`
-     *  落在会话按 `resumeAt` 分叉之后、拒后不回滚,所以本层在副作用之前拒。续跑腿不过这道门。
+     *  `request.field_conflict`(`request-value-closure.ts` 的 `FILE_HISTORY_DISABLED_NO_RESTORE`):立门时 core 的 `rewind.capture_disabled`
+     *  落在会话按 `resumeAt` 分叉之后、拒后不回滚,所以本层在副作用之前拒(S-865 / core 7.35.0 #1195 起 core 在分叉**之前**拒,
+     *  本层 400 照旧有效)。续跑腿不过这道门。
      *  ⚠️ 拼写门**两腿同判、响亮拒**:fresh 400 `request.field_invalid`;resume 重放同判(与 `memoryCapture` / `memory`
      *  同一张单成员闭集表,`request-value-closure.ts` 的 `singleMemberOffFieldIssue`)。
      *  Rides the persisted body onto resume legs —— 它是这条 run 的策略,不是一次性历史动作(与 `rewindFilesTo` 不同,续跑不剥)。 */
@@ -330,31 +331,6 @@ export interface TaskRequestBody {
      *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
      *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
     permissionMode?: SettingsPermissionMode;
-    /**
-     * **#1000**(core 7.26.0 `TaskSpec.approverPosture`;CC-116 装配口)—— 宿主对这个 run 的**审批姿态声明**:
-     * 「这些卡由我自己自动答」。一个词(`"bypass"`),闭集属主在 core(`ApproverPosture` / `APPROVER_POSTURES`)。
-     *
-     * 🔴 **它不授权任何东西,也不是一只门**(core 头注逐字:"a statement about who answers this run's approval
-     * cards, never an instruction to the gate";引擎只把它**渲**给模型,没有任何裁决腿读它)。所以它与
-     * {@link permissionMode} 的 `"bypassPermissions"` **不是**一回事,也不能互相派生:后者选的是**门的形状**
-     * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
-     * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
-     *
-     * 🔴 **值域上本仓零判据**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
-     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不抄词表、不加第二道值域门** ——
-     * 在下游再判一次就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加
-     * 第二个词就会被静默 400 掉。型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
-     *
-     * 🔴 **但「原样过境」自 7.95.0(S-591 腿③)起不再成立 —— 它有一道**准入**闸**:本键是一句**宿主姿态
-     * 声明**(「这个 run 的审批卡由宿主自己自动答」),而在**托管 / 多租**部署上提交方**不是**宿主。
-     * 所以托管形上它被**忽略 + 留声**(`task_approver_posture_ignored`,`honored:false`),与同族的
-     * `settings.hooks` / `cwd` / `settings.env` 三条逐字同姿势;单用户 turnkey 与 device 车道照旧过境
-     * (射程判据单点 = `src/hosted-posture.ts` 的 `taskApproverPostureHonored`)。
-     * ⚠️ **刻意不是 400/422**:本键零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒ 拒会把一条 parked
-     * 任务永久砖死(clay 裁定① 2026-09-22;本仓成文结论「砖死 resume 比降级糟」)。
-     * ⇒ 这一条与「值域零判据」**不矛盾**:值域仍归引擎,本仓判的是**这台部署认不认这句声明**。
-     */
-    approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries
@@ -418,6 +394,21 @@ export interface TaskRequestBody {
      *  (a caller can't point a shared/cloud worker at an arbitrary host path). Validated absolute (prepareSpec 400s a
      *  relative cwd — it would silently resolve against the SERVICE process cwd). */
     cwd?: string;
+    /**
+     * S-895(7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
+     * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
+     *  · `"all"` —— 整份继承(`{ ...process.env }` 逐字原样,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
+     *    `hostPostureDeclarationsHonored`(`hosted-posture.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
+     *    422 `request.host_posture_refused`;
+     *  · `"scrub"` —— 缺省清洗(剥凭据形变量),**任何车道、任何部署**都受理(它就是缺省;7.106.0 合并复审 X7)。
+     * **缺席 = 缺省清洗**:不带键的请求把本会话的绑定清掉(不继承上一条请求的声明 —— 这一位是「本条请求要什么」,
+     * 粘到下一条上就是替一个没说话的请求放宽)。名单形(`string[]`)**不上 wire**(那是嵌入方构造执行环境的选项)。
+     * 🔒 **只有 host 车道有消费点**:别的车道(e2b / k8s / local-docker / ssh / adb / device / in-process)带 `"all"` ⇒
+     * 400 `request.field_invalid`「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
+     * Rides the persisted body onto resume legs:重放照射程与车道重判(部署由单用户改托管后 revive ⇒ 同一只拒,
+     * resume-legs 折成 `409 resume_blocked_by_policy`)。
+     */
+    inheritEnv?: "all" | "scrub";
     /**
      * S-470(device lane 首绑写协议,design `device-executor-lane-v2` §4.3.2)—— 这条**根会话**要执行在
      * 哪台已注册的员工设备上(`POST /v1/devices/enroll` 返回的 `dev_<ulid>`)。

package/dist/index.d.ts

@@ -26,5 +26,6 @@ export type { TaskRequestBody } from "./http/wire-types.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
-export { isSealedKeyPoison, SealedKeyPoisonedError, type SealedKeyPoison, type SealedKeyPoisonReason } from "./sealed-key.js";
+export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
+export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -23,5 +23,6 @@ export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
 export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
-export { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";
+export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
+export { RETIRED_ENVS } from "./config.js";
 //# sourceMappingURL=index.js.map