@sema-agent/server 7.104.0 → 7.106.0

package/dist/config.d.ts

@@ -32,8 +32,43 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
+/** [ref] 兼容面全清:退役 env 名墓碑——老名**在场即拒启**带新名指引。静默忽略=部署带着失效配置无感跑;双读=兼容层吸收
+ *  下游冒烟。都不要。
+ *
+ *  🪦 **墓碑是永久的响亮拒,不设到期**(S-588)。一行墓碑就是那句拒启句本身,成本一行;删掉它 = 旧名重新被悄悄忽略。
+ *  ⇒ 本表只增不减,**唯一的删除条件是这个名字要被赋予新含义**:那一次提交同时删掉墓碑行,并在 MIGRATION 写明旧名改作何用。
+ *  (与一次性迁移不是一回事:迁移码每次起服都跑、碰真数据,所以有窗、窗关即删码 —— 见 `plugins/one-time-migrations.ts`
+ *  的登记表;墓碑不碰数据,只拒启。)
+ *  A tombstone is a permanent loud refusal with no expiry: deleting a row lets the retired name be silently ignored again,
+ *  so a row goes only when the name is given a new meaning — in that same commit, with a MIGRATION note.
+ *
+ *  **旧名在场即拒,替代名在不在都一样**:判据只问旧名在不在场,不看替代键设没设、设成什么 ——「新旧两个名字都留着」正是
+ *  迁移到一半的部署最常见的形,旧名在那一形里若被静默忽略,运维会以为它还在生效。server 3.0.0 的旧负名(`X_DISABLED` →
+ *  `X_ENABLED`)同在本表(`replaced` 族:极性相反,照抄旧值过去恰好是反义),与其余墓碑走同一只 {@link rejectRetiredEnvs};
+ *  那几个旋钮的读点只读正名(`boolEnv`),不再有第二套「正名缺席才看旧名」的判据(S-588 之前的 `boolEnvWithLegacyNegated`)。
+ *
+ *  墓碑分三族(A4 两族 + S-753 第三族),每族各说各的尾句 —— 族是**闭集**,渲染是穷举表(加一族不写尾句 = 编译红):
+ *   · `renamed`  = 同一能力换了个键名,值语义逐字不变 ⇒ 「照新名改写即可」;
+ *   · `replaced` = 有替代键,但**值语义变了**(缺省 / `0` 义 / 计量段 / 极性不同)⇒ 点名新键 + 说清变了什么,**不许**说「语义不变」
+ *                  —— 照抄旧值过去就是另一个意思(S-753:`MODEL_CONNECT_TIMEOUT_MS` → `MODEL_FIRST_BYTE_TIMEOUT_MS`);
+ *   · `removed`  = 能力本身没了,`why` 是「为什么没了」,**没有可 rename 的目标**。
+ *  拒句带码 `[config.env_key_retired]`(拒启码,拼法随 `config.*` 家族;与中心凭证两码同形,出现在拒句方括号里)。
+ *  空串 = 未设(与 `env()` 同一条约定:compose `${X:-}` 透传的空值不是一次表态),不拒。 */
+export type RetiredEnv = readonly [old: string, to: string, kind: "renamed"] | readonly [old: string, to: string, kind: "replaced", why: string] | readonly [old: string, why: string, kind: "removed"];
+export type RetiredEnvKind = RetiredEnv[2];
 /** 墓碑拒启码(机读;拒句方括号里)。 */
 export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
+export declare const RETIRED_ENVS: readonly RetiredEnv[];
+/** S-885 —— 墓碑表的 wire 投影一行(`GET /v1/config/catalog` 的 `retired[]`):按族定形 —— renamed 只带 `replacement`;replaced 带
+ *  `replacement` + `reason`(值语义怎么变了);removed 只带 `reason`(能力为什么没了)。 */
+export interface RetiredEnvWire {
+    readonly name: string;
+    readonly kind: RetiredEnvKind;
+    readonly replacement?: string;
+    readonly reason?: string;
+}
+/** 墓碑表 → wire 投影(纯数据 ⇒ `build*`)。**同一张表、同序**;族是闭集,穷举 switch(加一族不写这里 ⇒ 编译红)。 */
+export declare function buildRetiredEnvWire(): RetiredEnvWire[];
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;
@@ -91,10 +126,23 @@ interface ConfigWarning {
     detail?: string;
 }
 export declare function drainConfigWarnings(): ConfigWarning[];
-export declare function drainConfigNotices(): Array<{
+/** Boot NOTICES ([ref]④): non-error decisions loadConfig makes that the operator should see once (e.g. the
+ *  MODEL_PROVIDER inference below). Same pre-logger collection pattern as CONFIG_WARNINGS, but each entry
+ *  carries its own event name + fields (the warnings drain has one fixed "invalid, using default" message
+ *  which would misdescribe an inference). main.ts drains + logs right after createLogger.
+ *
+ *  S-176 —— 每条带一个**级别**(闭集两词,排空处穷举 switch)。此前这一格固定按 warn 排空,于是「每次 boot 都成立的
+ *  常态事实」(posture 派生的档位)在这里没有位置:进 warn 会让一台一个字节都没配错的单机每次启动报警,另开一个
+ *  收集器又是第五条日志族。级别写在**铸点**(不是按事件名在排空处猜):
+ *   · `warn` —— 运维要看一眼的决定(推断出的 provider、被丢掉的缺省行、no-op 旋钮……):既有的每一条;
+ *   · `info` —— 常态事实,每次这样配就每次成立,不是异常(与执行车道落点那一行同级)。 */
+type ConfigNoticeLevel = "warn" | "info";
+export interface ConfigNotice {
+    level: ConfigNoticeLevel;
     event: string;
     fields: Record<string, string>;
-}>;
+}
+export declare function drainConfigNotices(): ConfigNotice[];
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [ref]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics

package/dist/config.js

@@ -10,14 +10,14 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { readFaceForPosture } from "./read-face-posture.js";
+import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, isSingleMachineDefaultLane } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
@@ -27,6 +27,7 @@ import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { parseUnattendedPermissionMode } from "./unattended-permission-mode.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -105,7 +106,7 @@ function defaultSkillsDir() {
     }
 }
 export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-const RETIRED_ENVS = [
+export const RETIRED_ENVS = [
     ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
     ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
     ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
@@ -135,6 +136,25 @@ const RETIRED_ENVS = [
     ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
     ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
 ];
+for (const row of RETIRED_ENVS)
+    Object.freeze(row);
+Object.freeze(RETIRED_ENVS);
+export function buildRetiredEnvWire() {
+    return RETIRED_ENVS.map((row) => {
+        switch (row[2]) {
+            case "renamed":
+                return { name: row[0], kind: row[2], replacement: row[1] };
+            case "replaced":
+                return { name: row[0], kind: row[2], replacement: row[1], reason: row[3] };
+            case "removed":
+                return { name: row[0], kind: row[2], reason: row[1] };
+            default: {
+                const unhandled = row;
+                throw new Error(`unhandled retired-env kind: ${String(unhandled[2])}`);
+            }
+        }
+    });
+}
 const RETIRED_ENV_SENTENCE = {
     renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
     replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
@@ -205,11 +225,11 @@ export function drainConfigNotices() {
     return CONFIG_NOTICES.splice(0, CONFIG_NOTICES.length);
 }
 let EXEC_LANE_NOTICE;
-function buildExecLaneNotice(remoteExec, configProvider) {
-    const explicit = process.env.REMOTE_EXEC !== undefined && process.env.REMOTE_EXEC !== "";
+function buildExecLaneNotice(remoteExec) {
+    const lane = executionLaneOf(remoteExec?.provider);
     return {
-        lane: executionLaneOf(remoteExec?.provider),
-        source: explicit ? "explicit-env" : configProvider === "local" ? "default-local-provider" : "default-unset",
+        lane,
+        source: lane === "in-process" ? "default-unset" : isSingleMachineDefaultLane(remoteExec) ? "default-local-provider" : "explicit-env",
     };
 }
 function parseConfigProvider() {
@@ -251,8 +271,20 @@ export function logConfigDiagnostics(logger) {
             }
         }
     }
-    for (const n of drainConfigNotices())
-        logger.warn(n.event, n.fields);
+    for (const n of drainConfigNotices()) {
+        switch (n.level) {
+            case "warn":
+                logger.warn(n.event, n.fields);
+                break;
+            case "info":
+                logger.info?.(n.event, n.fields);
+                break;
+            default: {
+                const unreachable = n.level;
+                throw new Error(`unhandled config notice level: ${String(unreachable)}`);
+            }
+        }
+    }
     const laneNotice = EXEC_LANE_NOTICE;
     EXEC_LANE_NOTICE = undefined;
     if (laneNotice && logger.info)
@@ -531,6 +563,7 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 return [];
             case "honored":
                 CONFIG_NOTICES.push({
+                    level: "warn",
                     event: "config_env_forwarded_multi_tenant",
                     fields: {
                         env: knob,
@@ -634,6 +667,7 @@ function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
     const dropped = posture.droppedDefaultRows ?? [];
     CONFIG_NOTICES.push(posture.source === "off"
         ? {
+            level: "warn",
             event: "write_protection_table_disabled",
             fields: {
                 env: "WRITE_PROTECTED_TABLE_REPLACE",
@@ -644,6 +678,7 @@ function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
             },
         }
         : {
+            level: "warn",
             event: "write_protection_table_replaced",
             fields: {
                 env: "WRITE_PROTECTED_TABLE_REPLACE",
@@ -795,6 +830,7 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
     if (act === undefined || window <= 0 || act <= window)
         return;
     CONFIG_NOTICES.push({
+        level: "warn",
         event: "auto_compact_tokens_above_context_window",
         fields: {
             slot,
@@ -806,6 +842,18 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
         },
     });
 }
+function buildUnusedCoordinatesRefusal(keys, auto) {
+    const engine = keys.length === 1 ? (keys[0] === "PG_HOST" ? "pg" : "mysql") : "mysql|pg";
+    const probedHostKey = auto?.autoProbes === "pg" ? "PG_HOST" : "MYSQL_HOST";
+    const why = auto !== undefined
+        ? `SESSION_BACKEND=auto probes the ${auto.autoProbes} engine (DB_BACKEND ${process.env.DB_BACKEND ? "names it" : "unset ⇒ mysql"}), whose host key ${probedHostKey} is not set`
+        : "no durable session store is selected (neither DB_BACKEND=mysql|pg nor SESSION_BACKEND=mysql|auto), so the store would run IN MEMORY";
+    return (`${keys.join(" and ")} ${keys.length === 1 ? "is" : "are"} set but the current configuration never uses ${keys.length === 1 ? "it" : "them"}: ${why}. ` +
+        `Refusing to boot rather than running in memory silently. ` +
+        `To persist: DB_BACKEND=${engine} (or SESSION_BACKEND=mysql for the MySQL-protocol engine); ` +
+        `to run in memory: remove the coordinates, or set DB_BACKEND=memory; ` +
+        `for best effort (persist while the store is reachable, memory otherwise): SESSION_BACKEND=auto with the engine pointed right (DB_BACKEND=pg with PG_HOST, DB_BACKEND=mysql with MYSQL_HOST).`);
+}
 function parseStoreDomain(ctx) {
     const { requirePrincipal } = ctx;
     const dbBackendSet = !!process.env.DB_BACKEND;
@@ -813,9 +861,10 @@ function parseStoreDomain(ctx) {
         !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "pg", "local", "memory"]);
+    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", DB_BACKEND_WORDS);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "db_backend_default_memory_multi_tenant",
             fields: {
                 note: "REQUIRE_PRINCIPAL=true with no DB_BACKEND — the single-user default (local file store) is incompatible with multi-tenant (no tenant isolation in the file owner map), so this deployment runs IN-MEMORY (runs/sessions lost on restart, durable runs 501). Configure DB_BACKEND=mysql|pg for a durable multi-tenant deployment.",
@@ -829,6 +878,11 @@ function parseStoreDomain(ctx) {
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
+    const sqlCoordinateKeys = [...(process.env.MYSQL_HOST ? ["MYSQL_HOST"] : []), ...(process.env.PG_HOST ? ["PG_HOST"] : [])];
+    const coordinatesUnusedByDeclaration = process.env.DB_BACKEND === "memory" || process.env.DB_BACKEND === "local" || process.env.SESSION_BACKEND === "memory";
+    if (sqlCoordinateKeys.length > 0 && !needsDb && !coordinatesUnusedByDeclaration) {
+        throw new Error(buildUnusedCoordinatesRefusal(sqlCoordinateKeys, sessionBackend === "auto" ? { autoProbes: dbBackend } : undefined));
+    }
     return {
         sessionBackend,
         sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"),
@@ -922,6 +976,7 @@ function parseModelDomain() {
             return explicitProvider;
         if (inferredAnthropicBaseUrl && inferredAnthropicCred) {
             CONFIG_NOTICES.push({
+                level: "warn",
                 event: "model_provider_inferred",
                 fields: {
                     provider: "anthropic",
@@ -967,6 +1022,7 @@ function parseModelDomain() {
     const cheapId = process.env.MODEL_CHEAP_ID;
     if (cheapId && modelId === "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "model_cheap_slot_without_main",
             fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
         });
@@ -974,6 +1030,7 @@ function parseModelDomain() {
     const cheapIsMain = cheapId !== undefined && cheapId !== "" && modelId !== "" && cheapId === modelId;
     if (cheapIsMain) {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "config_env_entry_cheap_same_as_main",
             fields: {
                 env: "MODEL_CHEAP_ID",
@@ -1007,6 +1064,7 @@ function parseModelDomain() {
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
     if (applyAutoCompactWindow(model, mainAct) === "removed-1m" && modelId !== "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "auto_compact_window_not_derived_1m",
             fields: {
                 slot: "main",
@@ -1022,6 +1080,7 @@ function parseModelDomain() {
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
             const inherited = process.env.MODEL_CHEAP_CONTEXT_WINDOW === undefined || process.env.MODEL_CHEAP_CONTEXT_WINDOW === "";
             CONFIG_NOTICES.push({
+                level: "warn",
                 event: "auto_compact_window_not_derived_1m",
                 fields: {
                     slot: "cheap",
@@ -1038,6 +1097,7 @@ function parseModelDomain() {
     const gatewayApiKey = process.env.MODEL_API_KEY;
     if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "model_gateway_key_unpaired",
             fields: {
                 hint: "MODEL_API_KEY is set but MODEL_GATEWAY_BASEURL is not — MODEL_API_KEY is the gateway's credential and pairs only with the gateway's own root, so with no gateway it is NOT loaded and is sent to no route (a model with its own baseUrl authenticates with its own per-model key). Set MODEL_GATEWAY_BASEURL to use it, or unset MODEL_API_KEY to silence this line.",
@@ -1267,6 +1327,8 @@ function unattendedApprovalPolicyEnv() {
 function parseApprovalDomain(ctx) {
     const { postureOn, singleUserTurnkey, infraReady } = ctx;
     const unattendedPolicy = unattendedApprovalPolicyEnv();
+    const unattendedMode = parseUnattendedPermissionMode(process.env.UNATTENDED_PERMISSION_MODE);
+    CONFIG_NOTICES.push({ level: "info", event: "unattended_permission_mode", fields: { value: unattendedMode.value, source: unattendedMode.source } });
     const streamAskWindowMsSource = postureSourceOfNumEnv(process.env.STREAM_ASK_WINDOW_MS, singleUserTurnkey);
     const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
     let streamAskWindowMsEffectiveSource = streamAskWindowMsSource;
@@ -1312,24 +1374,31 @@ function parseApprovalDomain(ctx) {
         ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
             const trimmed = (raw ?? "").trim();
-            if (trimmed === "always" || trimmed === "classify")
+            if (trimmed === "always")
                 return { manualModeShellGate: trimmed };
             if (trimmed === "" || trimmed === "off") {
                 if (trimmed === "off") {
                     CONFIG_NOTICES.push({
+                        level: "warn",
                         event: "manual_mode_shell_gate_off_is_noop",
                         fields: {
                             env: "MANUAL_MODE_SHELL_GATE",
                             raw: trimmed,
                             effect: "accepted as a no-op (normalized to the knob being absent) — this knob has a TIGHTEN half only, so `off` cannot relax anything; " +
-                                "the effective shell gate still comes from AUTONOMY and the client's permission mode. NOT symmetric with SENSITIVE_WRITE_PATTERNS=off, which really does clear a server-owned default set",
+                                "the effective shell gate still comes from AUTONOMY and the engine's permission-mode arbitration. NOT symmetric with SENSITIVE_WRITE_PATTERNS=off, which really does clear a server-owned default set",
                         },
                     });
                 }
                 return {};
             }
-            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated), "classify" (core's classifier decides per call), or "off"/unset (this knob contributes nothing). ` +
-                `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
+            if (trimmed === "classify") {
+                throw new Error(`env MANUAL_MODE_SHELL_GATE="classify" is retired (server 7.106.0 / @sema-agent/core 7.34.0): the engine now puts every full-shell command it cannot prove read-only to its question under EVERY permission mode — ` +
+                    `that tier is the default and needs no knob. What "classify" added on top was a question under a bypassPermissions request, which the engine now releases by mode. ` +
+                    `Use "always" to keep EVERY shell call behind an approval under every mode (bypassPermissions included), or unset it / "off" to rely on the engine's mode arbitration. ` +
+                    `Refusing to boot rather than accepting it as a no-op: that would silently drop the half the operator configured it for`);
+            }
+            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated) or "off"/unset (this knob contributes nothing). ` +
+                `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Always" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
         permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
@@ -1360,6 +1429,7 @@ function parseApprovalDomain(ctx) {
         streamAskWindowMsSource: streamAskWindowMsEffectiveSource,
         durableApprovalSource: postureSourceOfKnob("DURABLE_APPROVAL"),
         unattendedApprovalPolicy: unattendedPolicy,
+        unattendedPermissionMode: unattendedMode.value,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
@@ -1614,6 +1684,7 @@ function parseMemoryDomain(ctx) {
     const replication = memoryReplicationCoverage(memorySync !== undefined ? { memorySync } : {});
     if (replication.kind === "scopes" && memoryEngineEnabled && !requirePrincipal && memoryScope !== undefined) {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "memory_project_scope_yields_to_sync",
             fields: {
                 replicatedScopes: replication.scopes.join(","),
@@ -1796,11 +1867,15 @@ function parseOrchestrationDomain(ctx) {
             }
         }
     }
+    const readFaceFacts = process.env.READ_FACE !== undefined
+        ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
+        : readFaceForPosture(singleUserTurnkey);
+    const readFaceNotice = buildReadFacePostureNotice(readFaceFacts);
+    if (readFaceNotice !== undefined)
+        CONFIG_NOTICES.push({ level: "info", ...readFaceNotice });
     return {
         requireExecutionLane: boolEnv("REQUIRE_EXECUTION_LANE", false),
-        ...(process.env.READ_FACE !== undefined
-            ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
-            : readFaceForPosture(singleUserTurnkey)),
+        ...readFaceFacts,
         ...optionalEnumKey("taskWriteFaceEscalation", "TASK_WRITE_FACE_ESCALATION", process.env.TASK_WRITE_FACE_ESCALATION, TASK_WRITE_FACE_ESCALATIONS),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         ...(() => {
@@ -1920,7 +1995,7 @@ function parseOrchestrationDomain(ctx) {
                                                             }
                                                             :
                                                                 ctx.configProvider === "local"
-                                                                    ? { provider: "host" }
+                                                                    ? { provider: "host", singleMachineDefault: true }
                                                                     : undefined,
         worktreeIsolation: boolEnv("WORKTREE_ISOLATION_ENABLED", false) && process.env.WORKTREE_REPO_ROOT
             ? {
@@ -2037,7 +2112,13 @@ function parseLimitsHttpDomain() {
         costQuotaWindowSec: numEnv("COST_QUOTA_WINDOW_SEC", "86400"),
         reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
         runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
-        toolResultTtlSec: numEnv("TOOL_RESULT_TTL_SEC", "86400"),
+        toolResultTtlSec: (() => {
+            const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
+            if (ttl <= 0) {
+                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the config center refuses the same value)`);
+            }
+            return ttl;
+        })(),
     };
 }
 function parseObservabilityDomain() {
@@ -2101,11 +2182,18 @@ function parseIntegrationsDomain(ctx) {
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
         configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL"), requirePrincipal) : undefined,
+        fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, requirePrincipal),
         ...(configProvider !== undefined ? { configProvider } : {}),
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
+function parseFleetLeaseFailClosed(raw, requirePrincipal) {
+    const explicit = parseBoolWord("FLEET_LEASE_FAIL_CLOSED", raw);
+    const value = explicit ?? requirePrincipal;
+    registerKnob({ name: "FLEET_LEASE_FAIL_CLOSED", polarity: "posture", value, source: explicit !== undefined ? "env" : requirePrincipal ? "posture" : "default" });
+    return value;
+}
 function parseConfigCenter(baseUrl, requirePrincipal) {
     const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
     const declared = readCenterCredentialDeclaration();
@@ -2211,7 +2299,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
+    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "unattendedPermissionMode", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
@@ -2245,7 +2333,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "fleetLeaseFailClosed", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2370,7 +2458,7 @@ export function loadConfig() {
             throw new Error(refusal);
         }
     }
-    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec, configProvider);
+    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,
         ...modelPlane,

package/dist/cross-session-settings.d.ts

@@ -19,7 +19,7 @@
  * 而 `crossSessionInbound` 在 CC 里是**每会话**的 settings 值。本服务是「一个 Runner × 多会话」的宿主:
  * 把某一次提交的 `body.settings.crossSessionInbound` 塞进部署级座位,等于让 A 会话的设置去治理 B 会话的
  * 排水——比不接线更糟,且是静默的。可选的补法只有两条,都不在本件射程内:
- *   (a) 引擎开一个**每任务**座(形如既有的 `TaskSpec.autoModeRequested` 意图座)——上游诉求,已留档;
+ *   (a) 引擎开一个**每任务**座(形如 `TaskSpec.permissionMode` 那样的每任务座)——上游诉求,已留档;
  *   (b) 本仓用 per-run 异步上下文托住层,并保证**每一条** run 腿都建立该上下文——漏一条腿 =
  *       用户设的 `refuse` 静默失效 = 安全轴 fail-open,不许半接。
  * 在 (a)/(b) 落地之前,提交面对这两个键**明拒**(`TASK_SETTINGS_UNSUPPORTED_KEYS`,400 体 `unsupportedKeys`

package/dist/deployment-governance.d.ts

@@ -179,7 +179,18 @@ export declare function createDurableQuestionGate(live: LiveQuestionFace | undef
  *  无 root/cwd 声明 ⇒ 家族 undefined ⇒ 只认 `/`-rooted,与引擎同一律)。
  */
 type WriteTargetForm = "unstamped-relative" | "absolute-or-stamped";
-/** 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。 */
+/**
+ * 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。
+ *
+ * 🔴 **S-877(core 7.35.0 #1200):本包装不是 `wrapToolPolicy`,它自报成员**。core 的 wrap 契约是「包装至少拒内层所拒」,
+ * 而本包装**放行**内层会拒的另一形写目标 ⇒ 按契约它是一只自己的策略,内层的成员不能照搬(core wire 单点名这一只):
+ *  · `writeTargetGuard`(守卫集策略自带,shell 写站问「这个绝对目标守不守」)—— 只在本层的形**覆盖守卫的入参形**时带上
+ *    ({@link WRITE_TARGET_GUARD_DOMAIN}):真身层带;词法层不带(它的 env 对绝对形报错 ⇒ core 的「判不了就守」会把每一次
+ *    shell 写都判成受守,正与两层射程互补的原设计相反)。这不是给某一形开的特例,是同一条「成员描述它守得住的那部分」的读法;
+ *  · `projection` / `pathDenyRules` / `nameSets` —— 守卫集策略不带,本包装也不报(报了就是替它声称一张它没有的拒表)。
+ * 修前(core 7.33.x)这里是一只 `{ check }` 字面量,7.34.0 起那只字面量把真身层的守卫剥掉了 —— 沙箱 lane 的 shell 写站
+ * 因此看不见部署守卫集(`cp x .env` 在 acceptEdits 下被引擎 place 并答掉)。
+ */
 export declare function scopedToWriteTargetForm(policy: ToolPolicy, form: WriteTargetForm): ToolPolicy;
 export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
     /** 相对形 → `/<词法归一>`;绝对形 / 空串 / 含 NUL 一律报错(fail-closed 守底:`relativeTargetsOnly` 已把这些形挡在外面,

package/dist/deployment-governance.js

@@ -26,6 +26,7 @@ function writeTargetFormOf(req) {
         return "absolute-or-stamped";
     return "unstamped-relative";
 }
+const WRITE_TARGET_GUARD_DOMAIN = "absolute-or-stamped";
 export function scopedToWriteTargetForm(policy, form) {
     return {
         async check(req, signal) {
@@ -34,6 +35,7 @@ export function scopedToWriteTargetForm(policy, form) {
                 return { action: "allow" };
             return policy.check(req, signal);
         },
+        ...(form === WRITE_TARGET_GUARD_DOMAIN && policy.writeTargetGuard !== undefined ? { writeTargetGuard: policy.writeTargetGuard } : {}),
     };
 }
 export class RelativeTargetLexicalEnv extends StubExecutionEnv {

package/dist/execution-lane-caps.d.ts

@@ -31,8 +31,19 @@ export interface ExecutionLaneCaps {
     /** SendUserFile 的**沙箱直传腿**(host/in-process 的本机 fs 源是另一条腿,不是本位)。
      *  判别式:`capabilities/sandbox-file-send.ts` 的 `sandboxSendLaneEnabled`。 */
     readonly sandboxSendUserFile: LaneCapability;
-    /** OS 级隔离边界。判别式:`boot/execution-env.ts` 的 `isolated`(经 `remote_exec_enabled` 日志可观测)。 */
-    readonly isolation: LaneCapability;
+    /**
+     * OS 级隔离边界(手跑在容器 / microVM / Kata pod 里,而不是一台真机上)。
+     * 🔴 S-281 起**本位即判别式**:全仓读它的唯一布尔口是 {@link laneIsolated}(boot `remote_exec_enabled.isolated` 与
+     * `remote_exec_real_system` 那一行、`config.d/remote-exec.json` 抢占披露的「隔离降级」判、wire `executionLane.isolated`
+     * + 诊断面同位、那一行 note 列的沙箱出路 —— 改前 boot 另手写一份 `e2b || k8s || local-docker`,与本表两处各算)。
+     * 本位的**独立作者** = 各 adapter 对 core 的 `capabilities.isolation` 声明:对账测试拿 core 自己的严格读器 `isIsolated`
+     * 问每条车道的**真 adapter 实例**,与本表、与 boot 行三方对拍。
+     * 型上**没有** `single-user-only` 这一档(隔离是车道的结构事实,不随租户面变)⇒ {@link laneIsolated} 的布尔化是穷举、无兜底。
+     * ⚠️ 口径 = **OS 级边界**(容器即算:共享宿主内核的 `local-docker`、runc 上的 k8s pod 都答 supported),**不是**「独立内核」强度。
+     * 另一根轴 `router/route-orchestration.ts` 的 `isIsolatedExecEnv`(A 值路由,只认 e2b 与 kata / gvisor 运行时,runc / local-docker
+     * fail-closed 判否)问的是 VM 级强度 —— 两个不同的问题,不是本位的第二份;收成一只会让其中一边答错(S-281 收车档登记)。
+     */
+    readonly isolation: Exclude<LaneCapability, "single-user-only">;
     /** 可挂起(k8s 以配了 `s3Snapshot` 为前提 —— 「结构上能不能」的口径)。判别式:同上的 `suspendable`。 */
     readonly suspendable: LaneCapability;
     /** `/tmp/scratchpad/<sessionId>` 远端约定。判别式:`plugins/remote-scratchpad.ts` 的 `isRemoteScratchpadLane`。 */
@@ -155,6 +166,23 @@ export declare function executionLaneOf(provider: string | undefined): Execution
  *  ③ `approval.ts` 的 `buildNoResponderBootWarns` —— 写门的 ask 只在「有手写本机盘」时才会发生。
  */
 export declare function handsOnWorkerFilePlane(lane: ExecutionLane): boolean;
+/**
+ * S-281 —— 「这条车道的手在不在 OS 级隔离边界里」。**全仓唯一**的布尔判别式(读表 `isolation` 位,见该位头注的读者清单)。
+ * 穷举 switch、无 default 臂:`isolation` 的型只有两档,加档 = 编译红。
+ *
+ * ⚠️ 本函数对 `in-process` 也答(表上那一行是 unsupported ⇒ false)—— 那一格是「表」的完整性,不是 wire 的说法:
+ * 无手部署**没有执行边界可言**,wire 上 `executionLane.isolated` 按 present-iff 缺席(`capabilities/execution-lane.ts`),
+ * 不是 false。boot 行只在装出了执行环境工厂时才打,够不着那一格。
+ */
+export declare function laneIsolated(lane: ExecutionLane): boolean;
+/**
+ * S-281 —— 这条车道是不是**单机形缺省**落点(`REMOTE_EXEC` 未设 / 空串 ∧ `CONFIG_PROVIDER=local`,没人点名)。
+ * 判据 = 装配出的车道值自己带的记号 `singleMachineDefault`(唯一写者 = `config.ts` 三元链的隐式 host 尾臂;显式 `REMOTE_EXEC=host`
+ * 与 `config.d/remote-exec.json` 覆写都铸不带它的新值)。**唯一读口**,读者两处:`config.ts` 车道落点一行的 `source`
+ * (`exec_lane_selected`,文件覆写之前播)与 `boot/execution-env.ts` 的 `remote_exec_real_system.note`(覆写之后打)——
+ * 同一个记号、两个时刻,不另按 env 原文重判。
+ */
+export declare function isSingleMachineDefaultLane(remoteExec: ServiceConfigFlat["remoteExec"]): boolean;
 /** 把一位能力在**具体部署**上落成布尔:租户面是唯一入参(旋钮由消费点自己再合取)。
  *  穷举 switch,无 default 臂 —— {@link LaneCapability} 加词而此处不加臂 = 编译红。 */
 export declare function laneCapabilityHolds(cap: LaneCapability, deployment: {

package/dist/execution-lane-caps.js

@@ -174,6 +174,18 @@ export function handsOnWorkerFilePlane(lane) {
     const caps = executionLaneCaps(lane);
     return caps.hostFilePlane === "supported" && caps.coreRemoteExecutionEnv === "supported";
 }
+export function laneIsolated(lane) {
+    const isolation = executionLaneCaps(lane).isolation;
+    switch (isolation) {
+        case "supported":
+            return true;
+        case "unsupported":
+            return false;
+    }
+}
+export function isSingleMachineDefaultLane(remoteExec) {
+    return remoteExec?.provider === "host" && remoteExec.singleMachineDefault === true;
+}
 export function laneCapabilityHolds(cap, deployment) {
     switch (cap) {
         case "supported":

package/dist/file-history-disclosure.d.ts

@@ -1,34 +1,3 @@
-/**
- * S-157④ —— SQL file-history 店的 **typed 永久失败**披露座:散文一个铸点 + 机器面一只 sink。
- *
- * ## 病(基线 v7.79.0 逐行亲核 + 亲跑)
- * `plugins/blob-backend.ts:55` 的 `BlobTooLargeError` 带 typed 判别码 `blob_too_large_for_sql`,头注
- * 原话「绝不能与 transient 写失败混在一类(那类是可重试的 502;这类重试永远不会成功)」。可它一旦被
- * `plugins/file-history-store-sql.ts` 的任何一条 `catch` 折进 `FileHistoryResult.error.message`,判别码
- * 就只剩散文,**机器一位都读不到**。两条腿各自的后果:
- *
- * · **snapshot(边界捕获)腿**:引擎把失败包成一句散文交给 `RunnerDeps.onError({phase:"rewind"})`
- *   (core 7.20.0 `dist/core/runner/prepare-file-history.js` 的 `wrapFileHistoryEntry`),服务那条臂从文本里抠**第一个**
- *   括号词当 metric label —— 而第一个括号词恒是引擎自己的闭集码。实测:「这个文件永远存不进这口店」
- *   与「连接被重置」在 `rewind_snapshot_failed_total` 上**同形** `code="snapshot_failed"`。
- * · **trackEdit(首触备份)腿**:本服务用引擎默认的 `onTrackFailure:"refuse"`(`boot/runner-deps.ts` 亲读),
- *   那条路 **完全不走 onError** —— 引擎把 `(track_failed: <本店 message>)` 念给模型,末句是
- *   「Retry when the file-history store is healthy.」(`prepare-file-history.js`)。对这枚码那是永远
- *   不会到来的一天,而**运维面一个计数都没有**:这条腿今天在遥测上完全不可见。
- *
- * ## 修法(源头留痕,不走文本通道)
- * · **散文面**({@link discloseCaughtFailure} 的返回值):把 caught error 的 typed `code` 写成一个括号词
- *   前置到它自己的 message 前 —— **不 `instanceof` 单挑任何一个类**(身上有字符串 `code` 就折),该店
- *   11 处折点全部改走这一只函数。人与模型因此看得到「这是哪一类失败」。
- * · **机器面**(同一只函数的副作用):码取自 typed 错**对象**、对闭集词表判定,**绝不从散文里抠**。
- *   🔴 这一条是 codex R1-[high] 验真后的定形:文本通道**天然可伪造** —— 一个名叫
- *   `(blob_too_large_for_sql).txt` 的文件读不出来时,它的路径就在 `snapshot_failed` 的散文里,任何
- *   「从散文里取在册括号词」的读法都会把它当成一枚永久码(继而抑制掉真故障的告警)。闭集只约束基数,
- *   不能证明来源。所以机读判定搬回**唯一知道真相的那一层**=铸错的地方,`rewind` 臂的读法一字不动。
- * · 留痕三件套与 `observability/fail-open.ts` / `observability/secret-env-scrub.ts` 同律:**计数逐次**
- *   (`file_history_permanent_failure_total{code}`)、**每进程每码一条 warn**(第二条起零新增内容,而
- *   20G 树的用户每 turn 撞一次)、装配前累计的次数在 install 时补进 metrics。
- */
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
 interface Sink {
@@ -49,5 +18,12 @@ export declare function installFileHistoryFailureRecorder(deps: Sink): void;
 export declare function fileHistoryPermanentFailureCounts(): ReadonlyMap<string, number>;
 /** 测试用重置(进程级状态在同一个 vitest worker 里跨用例存活)。 */
 export declare function resetFileHistoryFailureRecorderForTest(deps?: Sink): void;
+/** core `FileHistoryError.code` 闭集的值投影(两道差集钉在下面;`satisfies` 让它进 core 读表的 `literals` 段 ——
+ *  core 退役其中一词时,提货前的求交门就能点名这张表)。 */
+declare const FILE_HISTORY_ERROR_CODE_WORDS: readonly ["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"];
+/** rewind 粗码臂的码词 = core 的闭集。 */
+export type FileHistoryErrorCode = (typeof FILE_HISTORY_ERROR_CODE_WORDS)[number];
+/** rewind 臂一次失败的粗码:文本里**第一个**在册的 `(码)` / `(码:`;没有 ⇒ `unknown`。纯函数、不抛。 */
+export declare function rewindFailureCode(err: unknown): FileHistoryErrorCode | "unknown";
 export {};
 //# sourceMappingURL=file-history-disclosure.d.ts.map

package/dist/file-history-disclosure.js

@@ -86,4 +86,16 @@ export function resetFileHistoryFailureRecorderForTest(deps = {}) {
     sink = { ...deps };
     deps.metrics?.counter(PERMANENT_FAILURE_COUNTER, PERMANENT_FAILURE_HELP);
 }
+const FILE_HISTORY_ERROR_CODE_WORDS = ["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"];
+const FILE_HISTORY_ERROR_CODE_SET = new Set(FILE_HISTORY_ERROR_CODE_WORDS);
+const isFileHistoryErrorCode = (w) => FILE_HISTORY_ERROR_CODE_SET.has(w);
+export function rewindFailureCode(err) {
+    const text = err instanceof Error ? err.message : String(err);
+    for (const m of text.matchAll(/\(([a-z_]+)[):]/g)) {
+        const word = m[1];
+        if (isFileHistoryErrorCode(word))
+            return word;
+    }
+    return "unknown";
+}
 //# sourceMappingURL=file-history-disclosure.js.map