@sema-agent/server 7.105.0 → 7.106.0

package/dist/boot/config-center.js

@@ -22,7 +22,7 @@ import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKe
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, bootSnapshotOf, fullyLandedForLkg, fetchPromptArtifact } from "../config-center/facade.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
+import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -38,6 +38,7 @@ export async function createConfigCenterRuntime(ctx) {
     let latestEffective;
     let lastRejectedCandidate;
     const applyLedger = createConfigApplyLedger();
+    let lastPull = "none";
     let generationOrdinal = 0;
     let lastGenerationVersion;
     const generationOf = (version) => {
@@ -531,6 +532,8 @@ export async function createConfigCenterRuntime(ctx) {
                         });
                     }
                 }
+                if (configProvider.kind === "remote")
+                    lastPull = "ok";
             }
         }
         catch (err) {
@@ -605,6 +608,12 @@ export async function createConfigCenterRuntime(ctx) {
         modelRefusalsState: () => modelRefusals,
         planeDeferredState: () => planeDeferredNoHandoff,
         configApplyState: () => (configProvider ? applyLedger.view() : undefined),
+        centerPullState: () => {
+            const view = applyLedger.view();
+            const landed = latestEffective;
+            const sameGeneration = view.configAppliedOrdinal > 0 && landed !== undefined && landed.version === view.configAppliedVersion;
+            return { lastPull, effectiveRevision: sameGeneration && landed !== undefined ? { version: view.configAppliedVersion, updatedAt: landed.updatedAt } : null };
+        },
         centerManagedKeys: () => (configProvider ? centerManagedConfigKeys(latestEffective) : undefined),
         async refreshNow() {
             if (!manualRefresh)
@@ -683,12 +692,83 @@ export async function createConfigCenterRuntime(ctx) {
         },
         startRefreshLoop(a) {
             const { pricing, limitSync, swapRunnerDeps, ceilingVerdict, consolidationSeat, degradeRoute, checkpointStorePresent } = a;
+            const signalRestart = (c) => {
+                const reasons = restartReasons(c.baseline, c.effective, restartCtx(consolidationSeat?.read(), degradeRoute.read()));
+                const skillsChangeDetected = reasons.includes("skills");
+                if (bootSkillStale && !skillsChangeDetected)
+                    reasons.push("skills");
+                const riderUnproven = !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified;
+                const stripRider = () => {
+                    const i = reasons.indexOf("skills");
+                    if (i < 0)
+                        return false;
+                    reasons.splice(i, 1);
+                    logger.warn("config_boot_skill_debt_withheld", { version: c.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
+                    return true;
+                };
+                switch (c.applied) {
+                    case "complete": {
+                        const retain = (blocked) => {
+                            planeDeferredNoHandoff = { version: c.effective.version, since: Date.now(), blocked, candidate: c.effective, ...(c.etag !== undefined ? { candidateEtag: c.etag } : {}) };
+                        };
+                        if (lkgSurvivesRestart && !c.lkgPersisted) {
+                            const blocked = reasons.splice(0, reasons.length);
+                            retain(blocked);
+                            logger.warn("restart_candidate_publication_incomplete", { version: c.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
+                        }
+                        else if (riderUnproven && stripRider()) {
+                            retain(["skills"]);
+                        }
+                        break;
+                    }
+                    case "partial": {
+                        const mayRefuseBoot = c.refused.filter((g) => BOOT_REJUDGE_OF_REFUSED_GROUP[g] === "may-refuse-boot");
+                        if (mayRefuseBoot.length > 0) {
+                            const revoked = pendingRestart;
+                            if (reasons.length > 0 || revoked !== undefined)
+                                logger.warn("restart_signal_withheld_boot_may_refuse", {
+                                    version: c.effective.version,
+                                    groups: mayRefuseBoot,
+                                    reasons: [...reasons],
+                                    ...(revoked !== undefined ? { revoked: { version: revoked.version, reasons: [...revoked.reasons], since: revoked.since } } : {}),
+                                    note: "a partially applied candidate diverged the live config from what this process baked at boot (see reasons), but a restart would re-judge the refused group(s) at boot where this deployment may refuse to start — restart signal withheld, and any signal already published is revoked (see revoked: a restart is unsafe while this candidate is current, whichever tick signed it); fix the refused group or the deployment fact it names, and the next safe tick signals the diff afresh",
+                                });
+                            publishRestart(undefined);
+                            return pendingRestart;
+                        }
+                        if (riderUnproven)
+                            stripRider();
+                        break;
+                    }
+                    default: {
+                        const unknownApplied = c;
+                        throw new Error(`signalRestart: unknown apply outcome ${JSON.stringify(unknownApplied)}`);
+                    }
+                }
+                if (reasons.length === 0) {
+                    publishRestart(undefined);
+                }
+                else if (!pendingRestart || pendingRestart.reasons.join(",") !== reasons.join(",")) {
+                    publishRestart({ reasons, version: c.effective.version, since: Date.now() });
+                }
+                else {
+                    publishRestart({ ...pendingRestart, version: c.effective.version });
+                }
+                return pendingRestart;
+            };
+            const restartLogFields = (signal) => signal ? { restartRequired: true, restartReasons: signal.reasons } : {};
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
                 const refreshTick = async (arrival) => {
                     if (refreshInFlight)
                         return "ok";
+                    const outcome = await refreshTickRan(arrival);
+                    if (configProvider.kind === "remote")
+                        lastPull = outcome;
+                    return outcome;
+                };
+                const refreshTickRan = async (arrival) => {
                     refreshInFlight = true;
                     try {
                         await retryPendingCatalog("refresh-retry");
@@ -788,39 +868,20 @@ export async function createConfigCenterRuntime(ctx) {
                                         groups: refused.map((g) => g.group),
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
+                                    const partialSignal = signalRestart({ applied: "partial", effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
+                                    logger.info("sema_registry_refreshed", {
+                                        version: r.effective.version,
+                                        note: "partially applied — the refused group(s) keep their prior values (see config_candidate_partially_applied); the other groups hot-applied; restart fields as on a complete tick",
+                                        ...restartLogFields(partialSignal),
+                                    });
                                     return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const reasons = restartReasons(effective, r.effective, restartCtx(consolidationSeat?.read(), degradeRoute.read()));
-                                const skillsChangeDetected = reasons.includes("skills");
-                                if (bootSkillStale && !skillsChangeDetected)
-                                    reasons.push("skills");
-                                if (lkgSurvivesRestart && !lkgPersisted) {
-                                    const blocked = reasons.splice(0, reasons.length);
-                                    planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                                    logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
-                                }
-                                else if (!lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
-                                    const i = reasons.indexOf("skills");
-                                    if (i >= 0) {
-                                        reasons.splice(i, 1);
-                                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                                        logger.warn("config_boot_skill_debt_withheld", { version: r.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
-                                    }
-                                }
-                                if (reasons.length === 0) {
-                                    publishRestart(undefined);
-                                }
-                                else if (!pendingRestart || pendingRestart.reasons.join(",") !== reasons.join(",")) {
-                                    publishRestart({ reasons, version: r.effective.version, since: Date.now() });
-                                }
-                                else {
-                                    publishRestart({ ...pendingRestart, version: r.effective.version });
-                                }
+                                const signal = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
                                 logger.info("sema_registry_refreshed", {
                                     version: r.effective.version,
                                     note: "collab + runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
-                                    ...(pendingRestart ? { restartRequired: true, restartReasons: pendingRestart.reasons } : {}),
+                                    ...restartLogFields(signal),
                                 });
                                 latestEffective = r.effective;
                                 ccEtag = r.etag;
@@ -857,6 +918,8 @@ export async function createConfigCenterRuntime(ctx) {
                     refreshInFlight = true;
                     try {
                         await deferredBootApplyInner(r, useArrivalGeneration(r.effective.version, arrivalGen));
+                        if (configProvider.kind === "remote")
+                            lastPull = "ok";
                     }
                     finally {
                         refreshInFlight = false;
@@ -919,21 +982,16 @@ export async function createConfigCenterRuntime(ctx) {
                             groups: refusedLate.map((g) => g.group),
                             note: "late-boot candidate had a refused group — the LKG/ETag stay on the last FULLY applied generation; the refresh cadence re-judges the same tree",
                         });
+                        const partialSignalLate = signalRestart({ applied: "partial", effective: r.effective, baseline: undefined, refused: refusedLate.map((g) => g.group) });
+                        logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(partialSignalLate) });
                         return;
                     }
                     effective = r.effective;
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
-                    const reasons = restartReasons(undefined, r.effective, restartCtx(consolidationSeat?.read(), degradeRoute.read()));
-                    if (lkgSurvivesRestart && !lkgPersistedLate) {
-                        const blocked = reasons.splice(0, reasons.length);
-                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                        logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
-                    }
-                    if (reasons.length > 0)
-                        publishRestart({ reasons, version: r.effective.version, since: Date.now() });
-                    logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
+                    const signalLate = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: undefined, lkgPersisted: lkgPersistedLate });
+                    logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(signalLate) });
                 };
                 if (bootConfigPending) {
                     const arrivalGen = reserveArrivalGeneration();

package/dist/boot/coordinators.d.ts

@@ -40,6 +40,7 @@ export declare function createLiveCoordinators(ctx: LiveCoordinatorsCtx): {
     durableEnabled: boolean;
     streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
     approvalAskAudit: FileApprovalAskAuditStore | undefined;
+    approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     sendUserFileEmitter: SendUserFileEmitter | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("typebox").TSchema> | undefined;

package/dist/boot/coordinators.js

@@ -55,6 +55,7 @@ export function createLiveCoordinators(ctx) {
             });
         }
     }
+    const approvalExemptionStore = backend ? backend.approvalExemption() : undefined;
     const toolApproval = config.toolApprovalEnabled
         ? new ToolApprovalCoordinator({
             ttlMs: config.streamApproval.windowMs,
@@ -69,6 +70,7 @@ export function createLiveCoordinators(ctx) {
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(getParkedRedeem !== undefined ? { parkedRedeem: getParkedRedeem } : {}),
             ...(approvalAskAudit !== undefined ? { askAudit: approvalAskAudit } : {}),
+            ...(approvalExemptionStore !== undefined ? { sessionGrants: approvalExemptionStore } : {}),
         })
         : undefined;
     const sendUserFileEmitter = (() => {
@@ -112,6 +114,6 @@ export function createLiveCoordinators(ctx) {
             : rawSend;
         return sendUserFileTool({ send, emitter: sendUserFileEmitter });
     })();
-    return { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec };
+    return { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, approvalExemptionStore, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec };
 }
 //# sourceMappingURL=coordinators.js.map

package/dist/boot/device-lane.d.ts

@@ -59,7 +59,8 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * `boot/leader.ts` 的 `assertLeaderDurableStore`)。
  *
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
- * 拿到**了店吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`(默认)下,SQL 连不上 /
+ * 拿到**了店吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto` 下(🔴 S-866 注改真:`auto` **不是**缺省 ——
+ * 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
  * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动。那次启动里 device lane 的四表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。

package/dist/boot/execution-env.d.ts

@@ -8,6 +8,7 @@ import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
+import type { TaskInheritEnv } from "../request-value-closure.js";
 /**
  * per-session 的 **cwd / shellEnv 登记簿**(TOC cwd seam + R-survey shellEnv seam)+ 它们的**租户围栏**。
  *
@@ -32,8 +33,17 @@ import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 export interface SessionScopedRegistries {
     readonly perSessionCwd: Map<string, string>;
     readonly perSessionShellEnv: Map<string, Record<string, string>>;
+    /** S-895:host shell 的继承策略(`inheritEnv` 请求键)。只读面给 host 工厂包装;写只经 {@link setSessionInheritEnv}。 */
+    readonly perSessionInheritEnv: ReadonlyMap<string, TaskInheritEnv>;
     setSessionCwd(sid: string, cwd: string): void;
     setSessionShellEnv(sid: string, env: Record<string, string>): void;
+    /**
+     * S-895 —— 第三只 per-session 绑定(与 cwd / shellEnv 同一只 LRU 权威、同一条围栏、同一条删除)。
+     * `undefined` = **清掉**这一格(不是「不动」):`inheritEnv` 是「本条请求要什么」,缺席的请求要的是缺省清洗 ——
+     * 与 cwd / shellEnv 的「缺席 = 留着上一条的值」刻意不同(那两位由壳每条请求重发,粘住无害;这一位粘住 = 替一个没说话的
+     * 请求放宽凭据面)。
+     */
+    setSessionInheritEnv(sid: string, policy: TaskInheritEnv | undefined): void;
     /** 记录/对拍本会话的主人。与上次不同 ⇒ **先清两张表**再记新主(换主即清)。`null` = 匿名会话,
      *  它同样是一个**稳定**的身份值(不是「未知」),所以匿名重入不会被判成换主。 */
     fenceSessionOwner(sid: string, owner: string | null): void;
@@ -70,6 +80,7 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perSessionCwd: Map<string, string>;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    setSessionInheritEnv: (sid: string, policy: TaskInheritEnv | undefined) => void;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     dropSessionScoped: (sid: string) => void;
     noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;

package/dist/boot/execution-env.js

@@ -19,8 +19,9 @@ import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js"
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
+import { taskInheritEnvRefusal } from "../hosted-posture.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneIsolated } from "../execution-lane-caps.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -51,11 +52,13 @@ const MAX_CWD_SESSIONS = 4096;
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
     const perSessionShellEnv = new Map();
+    const perSessionInheritEnv = new Map();
     const perSessionIncarnation = new Map();
     const owners = new Map();
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
+        perSessionInheritEnv.delete(sid);
         perSessionIncarnation.delete(sid);
         owners.delete(sid);
     };
@@ -77,10 +80,20 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
             perSessionShellEnv.set(sid, env);
             touch(sid, undefined);
         },
+        perSessionInheritEnv,
+        setSessionInheritEnv: (sid, policy) => {
+            if (policy === undefined) {
+                perSessionInheritEnv.delete(sid);
+                return;
+            }
+            perSessionInheritEnv.set(sid, policy);
+            touch(sid, undefined);
+        },
         fenceSessionOwner: (sid, owner) => {
             if (owners.has(sid) && owners.get(sid) !== owner) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
+                perSessionInheritEnv.delete(sid);
                 perSessionIncarnation.delete(sid);
             }
             touch(sid, owner);
@@ -97,6 +110,14 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         sessionIncarnationOf: (sid) => perSessionIncarnation.get(sid),
     };
 }
+function buildRealSystemNote(remoteExec) {
+    if (!isSingleMachineDefaultLane(remoteExec))
+        return "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)";
+    const sandboxLanes = REMOTE_EXEC_PROVIDER_WORDS.filter((lane) => laneIsolated(lane)).join("|");
+    return ("hands run on this machine with no OS sandbox (single-machine default: REMOTE_EXEC unset, CONFIG_PROVIDER=local) — actions are permanent, " +
+        "and the Bash read boundary is a text-level friction floor, not a safety boundary; the safety boundary is a sandbox lane: " +
+        `set REMOTE_EXEC=${sandboxLanes} (see docs/DEPLOY-PREREQS.md, section "S-281")`);
+}
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
     const laneHomeDir = executionLaneHomeDir(config);
@@ -106,6 +127,7 @@ export function createExecutionEnv(ctx) {
     const sessionScoped = createSessionScopedRegistries();
     const { perSessionCwd, setSessionCwd } = sessionScoped;
     const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
+    const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
     let executionEnvFactory;
     let worktreeReap;
     if (config.remoteExec?.provider === "e2b") {
@@ -207,10 +229,12 @@ export function createExecutionEnv(ctx) {
             executionEnvFactory = (ctx) => {
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
+                const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
                 const env = hostExecutionEnvFactory({
                     ...hostCfg,
                     ...(cwd ? { workspaceDir: cwd } : {}),
                     ...(shellEnv ? { env: shellEnv } : {}),
+                    ...(inheritEnv !== undefined ? { inheritEnv } : {}),
                 })(ctx);
                 return lspManager && !cwd ? evictLspOnDestroy(env, lspManager) : env;
             };
@@ -300,15 +324,15 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = withSandboxPathEnvSlot(executionEnvFactory, sandboxPathEnvSlots, logger);
     }
     if (executionEnvFactory) {
-        const isolated = config.remoteExec.provider === "e2b" ||
-            config.remoteExec.provider === "k8s" ||
-            config.remoteExec.provider === "local-docker";
+        const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
         const suspendable = config.remoteExec.provider === "e2b" ||
             (config.remoteExec.provider === "k8s" && !!config.remoteExec.s3Snapshot);
         const sandboxEnvKeys = forwardedSandboxEnvKeys(config.remoteExec);
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
-            logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)" });
+            logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
+        if (executionLaneOf(config.remoteExec.provider) === "host")
+            logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
     const lspProvider = config.remoteExec?.provider;
     const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled
@@ -325,7 +349,7 @@ export function createExecutionEnv(ctx) {
     if (lspManager)
         logger.info("lsp_enabled", { provider: lspProvider });
     return {
-        perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv,
+        perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
         noteSessionIncarnation: sessionScoped.noteSessionIncarnation,

package/dist/boot/execution-lane.js

@@ -1,6 +1,6 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { crossInvariant } from "../config-invariants.js";
-import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
 export async function composeExecutionLane(config, ctx) {
     if (ctx.configSource === "local")
@@ -39,11 +39,10 @@ async function applyRemoteExecFile(config, ctx) {
     if (!fileRx)
         return;
     const preemptedLane = executionLaneOf(config.remoteExec?.provider);
-    const isolatedLane = (lane) => executionLaneCaps(lane).isolation === "supported";
     const disclosePreemption = (winner) => {
         if (winner === preemptedLane)
             return;
-        const downgrade = isolatedLane(preemptedLane) && !isolatedLane(winner);
+        const downgrade = laneIsolated(preemptedLane) && !laneIsolated(winner);
         logger.warn("remote_exec_lane_preempted_by_file", {
             preemptedLane,
             effectiveLane: winner,

package/dist/boot/leader.d.ts

@@ -65,7 +65,8 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  *
  * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
  * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`
- * (默认)下,SQL 连不上 / 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
+ * 下(🔴 S-866 注改真:`auto` **不是**缺省 —— 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
+ * 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
  * `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
  * 跨副本 GET 404、重启失忆 —— 而这条腿的产物是**真 git push**。
  *

package/dist/boot/leader.js

@@ -2,6 +2,7 @@ import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { createLeaderRunner } from "../leader/wire.js";
 import { buildDeploymentPostureSeats } from "./runner-deps.js";
 import { hasApprovalListIntent } from "../approval.js";
+import { unattendedPermissionMode } from "../unattended-permission-mode.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -58,6 +59,7 @@ export function createLeaderFace(ctx) {
                 : {}),
             ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
             ...(ctx.onError ? { onError: ctx.onError } : {}),
+            unattendedPermissionMode: unattendedPermissionMode(config),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
                 ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }

package/dist/boot/parked-revive-gate.d.ts

@@ -59,13 +59,14 @@ export interface ParkedReviveGateDeps {
      * 手抄一个等价签名会让 core 改这条 seam 的那天变成静默漂移而不是编译期事件)。
      */
     readonly resolveRuntimeCaps?: RunnerDeps["runtimeCapsResolver"];
-    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 7.2.0 的武装条件是
-     *  `runtimeCaps.autoMode === true` **∧** 这一面在场(prepare-task 原式)。⚠️ [ref] / core [ref] 起武装式换成
-     *  `spec.autoModeRequested === true ∧ 席位 ∧ runtimeCaps?.autoMode !== false`——本文件的镜像
-     *  {@link autoModePostureOf} **未随改**(赎回行无父 run 的 auto 意图可读),见该函数头注的未闭环登记。 */
+    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— 武装式(core 7.34.0 [ref])=
+     *  `permissionMode === "auto"` ∧ 这一面在场 ∧ `runtimeCaps?.autoMode !== false`;本文件的镜像见 {@link autoModePostureOf}
+     *  (赎回行上父 run 的 auto 意图仍无本仓读口,见该函数头注的未闭环登记)。 */
     readonly autoModeSeatMounted?: boolean;
-    /** [ref]:父 run 的 auto 意图(`TaskSpec.autoModeRequested` / 链位)——意图武装式下重建 decider 的第三项。⚠️ 今日
-     *  **无持久源**(core [ref] 链位 live-only;RunRecord 无 body),生产装配不递 ⇒ 恒缺席;座留给 core 持久化到货。 */
+    /** [ref]:父 run 的 auto 意图(core 7.34.0 起 = 父腿的 `permissionMode === "auto"`,旧键 `autoModeRequested` 已退役)——
+     *  意图武装式下重建 decider 的第三项。⚠️ 今日**本仓无读口**(RunRecord 无 body),生产装配不递 ⇒ 恒缺席。
+     *  S-877 登记:core 7.34.0 起子代 checkpoint 的数据半持久 `inheritedGate.permissionMode`(链在 spawn 时的**生效**模式),
+     *  这一座可改读它 —— 接线不在本次提货单内,见 7.106.0 收车档「未闭环」。 */
     readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
         info(event: string, fields?: Record<string, unknown>): void;
@@ -119,7 +120,9 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * (core 对这三个都是 seed 兜底)。
  *
  * 时点语义(成文进 docs/ASSISTANT-WIRE-CONTRACT.md,免运维当 bug 报):
- *  · toolPolicy 轴 = **当前** config(与 resume 重折一致,收紧与放松都被兑现——放松是一次显式运维动作);
+ *  · toolPolicy 轴 = **当前** config(与 resume 重折一致)。S-877(core 7.35.0 #1200)起部署治理层经 `wrapToolPolicy` 携带内层 `projection`
+ *    ⇒ 父链那一层的**内容**进了 `cpv1` 摘要:挂起期间改了治理 config(收紧或放松)⇒ 重建链摘要对不上 ⇒ core pre-CAS 响亮拒、卡留 pending
+ *    (此前那一层 opaque,收紧与放松都按当前 config 兑现;特征化钉 test/parked-revive-e2e.test.ts 已随之翻);
  *  · shellGate 轴 = core 取 max(live, park 时 seed)—— 收紧兑现、放松**不**兑现(fail-safe)。
  *  · `autoModeArmed` 轴([ref])= 按**当前** per-principal entitlement 现解(见 {@link autoModePostureOf});
  *    与 toolPolicy 轴同族:挂起期间权益被撤/被授 ⇒ 摘要对不上 ⇒ core pre-CAS 响亮拒,不静默换姿势跑。

package/dist/boot/parked-revive-gate.js

@@ -1,4 +1,3 @@
-import { coreArmsAutoOnIntent } from "../auto-mode-face.js";
 import { join } from "node:path";
 import { createAutoModeDecider, NodeExecutionEnv } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -74,16 +73,10 @@ async function resolveCapsFor(deps, identity) {
 function autoModePostureOf(deps, row, caps) {
     if (deps.autoModeSeatMounted !== true)
         return {};
-    if (!coreArmsAutoOnIntent()) {
-        if (caps?.autoMode !== true)
-            return {};
-    }
-    else {
-        if (caps?.autoMode === false)
-            return {};
-        if (deps.parentAutoModeIntent?.(row) !== true)
-            return {};
-    }
+    if (caps?.autoMode === false)
+        return {};
+    if (deps.parentAutoModeIntent?.(row) !== true)
+        return {};
     return { autoMode: { decider: createUnreachableAncestorClassifier(deps, row) } };
 }
 function createUnreachableAncestorClassifier(deps, row) {

package/dist/boot/resolve-spec.d.ts

@@ -17,7 +17,7 @@ import type { StoreBackend } from "../plugins/store-backend.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
 import { type OwnerAwareSessionStore } from "../security.js";
-import type { RunnerDepsOnAsk } from "./runner-deps.js";
+import { type RunnerDepsOnAsk } from "./runner-deps.js";
 type PrincipalCaps = ReturnType<typeof createPrincipalEntitlementsClient>;
 /** `resolveSpec` 原先从 `main()` 闭包里拿到的全部 boot 局部量。 */
 export interface ResolveSpecCtx {
@@ -47,9 +47,6 @@ export interface ResolveSpecCtx {
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };
-    /** [ref] 件⑤:per-session「显式 bypassPermissions」登记簿的写腿(`boot/session-shell-gate-registry.ts`);
-     *  阶段④ 算出 effMode 的那一行登记,runner-deps 的 config 忠告汇点按 sessionId 回查定级。缺席(桩)= 不登记。 */
-    noteSessionShellGate?: ((sessionId: string | undefined, explicitOff: boolean) => void) | undefined;
     resumeAnchorStore: ReturnType<StoreBackend["resumeAnchor"]> | undefined;
     ownerAware: OwnerAwareSessionStore;
     taskLimitCaps: {