@sema-agent/server 7.105.0 → 7.107.0

package/dist/runs.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
-import { ROSTER_BOUND_HTTP_STATUS } from "./roster-bound-http-status.js";
+import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
@@ -76,8 +76,8 @@ export function resumeAtHttpStatus(result) {
     if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
         return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
     }
-    if (Object.hasOwn(ROSTER_BOUND_HTTP_STATUS, code)) {
-        return ROSTER_BOUND_HTTP_STATUS[code];
+    if (Object.hasOwn(TOOL_DECLARATION_HTTP_STATUS, code)) {
+        return TOOL_DECLARATION_HTTP_STATUS[code] ?? undefined;
     }
     if (isSessionErrorCode(code)) {
         const wire = sessionErrorHttp(code, "open");
@@ -208,7 +208,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.windowZero
-            ? (askReq) => Promise.resolve(coordinator.unattendedAskOutcome({ taskId, owner: elicitOwner ?? owner, toolName: askReq.toolName }))
+            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}) })
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,

package/dist/runtime-caps-resolver.d.ts

@@ -113,18 +113,12 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`;**[ref] / core [ref] 起三态**,黑板 [ref]/[ref]):
  *  `undefined`(center 缺席/未答)= 不阻;`true` = 不阻;`false` = **org deny**(CC `permissions.disableAutoMode`
- *  镜像)。core 武装式 = `spec.autoModeRequested === true ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`
+ *  镜像)。core 武装式 = `spec.permissionMode === "auto" ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`(core 7.34.0 起;此前意图座是退役的 `autoModeRequested`)
  *  ——「用户开 + org 拒」极性(此前是 `=== true` 的「org 授予」极性,无 center 的本地部署零授予路径 ⇒ auto 永不
  *  武装,真实用户诊断的病根)。
- *  🔴 **上面那条武装式是 [ref] 的目标形,不是「本仓现在装的那版 core 的形」——引用它之前先看装的是哪版**
- *  ([ref]① 随 codex r2-[high] 补:我方在 WIRE 附录 F 照抄这一句,写成了「7.2.0 的行为」,而 npm **7.2.0
- *  不含 [ref]** —— 它的 `dist/core/runner/prepare-task.js` 逐字仍是 `runtimeCaps?.autoMode === true &&
- *  deps.autoMode !== undefined`,即旧「org 授予」极性、**缺键 ⇒ 不武装**)。判「现在是哪套极性」的唯一判据 =
- *  安装包探针 `CORE_ARMS_AUTO_ON_INTENT`(`src/auto-mode-face.ts`;实测本树 7.2.0 ⇒ **false** = 旧式臂),
- *  代码侧已按它分臂,失实的只是散落各处的散文。⚠️ 同形措辞在本文件 :209 / :362-364 / :548 与
- *  `src/boot/runtime-caps.ts:182` 还各有一处(均 [ref] 既有文字,本批未逐条改 —— 登记在 handoff 未闭环项)。
- *  所以**缺键=不写键**在这条轴上是行为承重的(在新式 core 上):补一个 false 就是替 org 说了一句
- *  它没说的 deny;在旧式 core 上两者同为「不武装」,差别不显形。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
+ *  ([ref]① 的历史:npm 7.2.0 不含 [ref]、是旧「org 授予」极性,本仓曾用安装包探针分臂;S-877 / core 7.34.0 起引擎只剩
+ *  上面这一种极性,探针随 7.106.0 退役 —— 本仓精确钉的 core 恒是它。)
+ *  所以**缺键=不写键**在这条轴上是行为承重的:补一个 false 就是替 org 说了一句它没说的 deny。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /**
  * #A5([ref] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。

package/dist/runtime-governance.d.ts

@@ -150,12 +150,12 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  */
 export declare function governanceMandatesShellGateAlways(governance: {
     autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
 }): boolean;
 /** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 {@link governanceMandatesShellGateAlways})。 */
 export interface GovernancePosture {
     autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
 }
 /**
  * [ref]:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
@@ -172,8 +172,9 @@ export interface GovernancePosture {
  * ⚠️ 残留(双向失真的窄在场向 + 根治路径)与「只收窄」的那一个裁决读者,都登记在
  * {@link governanceMandatesShellGateAlways} 的顶注,别在这里复述。
  *
- * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
- * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ * 🔴 **形状档的 ask 刻意不标**(S-877 起它不再是一个档位词:core 7.34.0 把形状档装在**每一种模式**的全权 shell 上,
+ * 行上的 `shellGateDoctrine` 只在运维地板 `"always"` 铸门时出现):形状档的一次 shell ask 出自引擎自己的判断,
+ * 也可能叠着 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
  *
  * 🔴 **单一属主,四个读者**(不在任何读面另写一份判据 —— 这一位恰恰是靠「行上取证 ∧ 部署姿态」的合取才不
  * 谎报的,两份必漂):409 体的待批门材料(`http/active-run-conflict.ts`)、两条 durable 读面
@@ -196,10 +197,6 @@ export declare function governanceOriginOf(gate: {
         shellGateDoctrine?: ShellGateDoctrine;
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
-/** spec 序里的秩(0 起,越大越严)。入参收 `string`(fail-loud 边界:schema `trustRank` 同款姿势)——词表外 ⇒
- *  RangeError,绝不 undefined/NaN 让比较静默成 false。导出只为对表钉(test/safety-merge-spec-consumption.test.ts,
- *  [ref] 件4)——运行时消费仍走上表(键类型闭集)。 */
-export declare function shellGateRank(word: string): number;
 /**
  * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
@@ -212,8 +209,8 @@ export declare function shellGateRank(word: string): number;
  * (task-settings deriveSettingsPolicy 的 default/auto/acceptEdits 三臂)让一个**部署级 tighten-only 旋钮
  * 的生死由客户端表态在场性决定**:body 无 settings/permissionMode(cli print/headless 腿按设计不 stamp)
  * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
- * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
- * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
+ * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。S-877 起地板只有
+ * `"always"` 一个词,合成退化成在场性(两个来源同词),不再有秩比较。
  *
  * [ref]([ref] issue #29,**邻仓 test AI 的 46 格真机矩阵**实证——不是本仓的钉,别到本仓文件里数 46;
  * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
@@ -231,7 +228,7 @@ export declare function shellGateRank(word: string): number;
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
-    manualModeShellGate?: "always" | "classify";
+    manualModeShellGate?: ShellGateDoctrine;
     sensitivePathPolicy?: ToolPolicy;
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */

package/dist/runtime-governance.js

@@ -1,7 +1,7 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-import { GovernanceConfig, SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
+import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
+import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
-import { operatorAsk } from "./operator-ask.js";
+import { operatorAsk, withDeploymentAuthorship } from "./operator-ask.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
 export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
@@ -124,14 +124,12 @@ export function governanceOriginOf(gate, governance) {
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");
-        return d;
-    };
-    return {
-        check(req, signal) {
-            const decision = inner.check(req, signal);
-            return decision instanceof Promise ? decision.then((d) => note(d, req)) : note(decision, req);
-        },
+        return d.action === "ask" ? withDeploymentAuthorship(d) : d;
     };
+    return wrapToolPolicy(inner, (req, signal) => {
+        const decision = inner.check(req, signal);
+        return decision instanceof Promise ? decision.then((d) => note(d, req)) : note(decision, req);
+    });
 }
 function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS) {
     const shellTools = new Set(tools);
@@ -143,28 +141,6 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
         },
     };
 }
-const SHELL_GATE_RANK = (() => {
-    const tighten = SAFETY_MERGE_SPEC.shellGate.tighten;
-    const rule = tighten.rule;
-    if (tighten.rule !== "enumRank")
-        throw new Error(`SAFETY_MERGE_SPEC.shellGate.tighten.rule=${rule} — 不是 enumRank,shellGate 秩无从派生`);
-    const table = { off: -1, classify: -1, always: -1 };
-    for (const [i, w] of tighten.order.entries()) {
-        if (!(w in table))
-            throw new Error(`SAFETY_MERGE_SPEC.shellGate 序里有本仓词表外的词:${w}`);
-        table[w] = i;
-    }
-    for (const [w, r] of Object.entries(table))
-        if (r < 0)
-            throw new Error(`SAFETY_MERGE_SPEC.shellGate 序缺词:${w}`);
-    return table;
-})();
-export function shellGateRank(word) {
-    const r = SHELL_GATE_RANK[word];
-    if (r === undefined)
-        throw new RangeError(`unknown shellGate word: ${word}`);
-    return r;
-}
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
@@ -175,15 +151,8 @@ export function applyRuntimeGovernance(base, governance) {
         : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
-    if (governance.manualModeShellGate !== undefined) {
-        const candidate = overrides.shellGate !== undefined && SHELL_GATE_RANK[overrides.shellGate] >= SHELL_GATE_RANK[governance.manualModeShellGate]
-            ? overrides.shellGate
-            : governance.manualModeShellGate;
-        if (SHELL_GATE_RANK[candidate] >= SHELL_GATE_RANK[base.shellGate ?? "off"])
-            overrides.shellGate = candidate;
-        else
-            delete overrides.shellGate;
-    }
+    if (governance.manualModeShellGate === "always")
+        overrides.shellGate = "always";
     if (overrides.shellGate === "always") {
         const shellObserver = createGovernanceShellGateMarkPolicy(marksOf);
         overrides.toolPolicy = governancePolicy === undefined ? shellObserver : combinePolicies(governancePolicy, shellObserver);

package/dist/sealed-key.d.ts

@@ -50,46 +50,6 @@ export interface SealedKeyCapability {
  *  omits the key entirely (present-iff this process built its custody store — see the route for the two meanings
  *  of absence). */
 export declare function projectSealedKeyCapability(face: SealedKeyPublicFace | undefined): SealedKeyCapability | undefined;
-/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). CUSTODY failures only:
- *  a sealedApiKey that is malformed (alg other than the pinned v1 SEALED_KEY_ALG, non-base64 ciphertext) makes the whole
- *  catalog entry unavailable instead (S-704 `config.model_entry_invalid`, settings-schema `SealedApiKey` is the shape
- *  owner) — the former `unsupported_alg` reason was retired with that move (it could no longer be reached). */
-export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
-/**
- * Poison-pill entry for the per-model key map (`config.modelApiKeys`): planted by applyEffective when
- * a model CARRIES `sealedApiKey` but the ciphertext cannot be unsealed. We deliberately do NOT drop
- * the model from the map — dropping made "sealed key broken" indistinguishable from "no per-model key
- * configured", and when the deployment also has a gateway MODEL_API_KEY the model's tasks silently
- * fell back onto the shared account (the exact hole the no-apiKeyEnv-fallback contract exists to
- * close). createKeyResolver turns this marker into a task-level `SealedKeyPoisonedError` — never
- * `undefined`, because undefined IS the "use the gateway key" semantic. Carries DIAGNOSIS only:
- * never the ciphertext, never any plaintext.
- */
-export interface SealedKeyPoison {
-    readonly sealedKeyPoison: true;
-    readonly publicKeyId: string;
-    readonly reason: SealedKeyPoisonReason;
-    /** Error CLASS of the unseal failure (e.g. "Error") — never the message (message text is logged
-     *  at plant time; keeping the object minimal keeps every serialization face trivially secret-free). */
-    readonly errKind?: string;
-    /** ISO timestamp of the apply that detected the failure. */
-    readonly at: string;
-}
-export declare function sealedKeyPoison(publicKeyId: string, reason: SealedKeyPoisonReason, errKind?: string): SealedKeyPoison;
-export declare function isSealedKeyPoison(v: unknown): v is SealedKeyPoison;
-/**
- * The task-level fail-loud face of a poison pill: thrown by the key resolver on EVERY brain call that
- * would otherwise authenticate this model, so a broken sealed key fails the task visibly (same family
- * as a rotation-leg auth failure) instead of silently burning the gateway account. Message carries the
- * sealed-failure marker (reason + publicKeyId + detection time) plus the operator fix — and nothing
- * secret (no ciphertext, no plaintext, by construction of SealedKeyPoison).
- */
-export declare class SealedKeyPoisonedError extends Error {
-    readonly publicKeyId: string;
-    readonly reason: SealedKeyPoisonReason;
-    readonly at: string;
-    constructor(modelName: string, poison: SealedKeyPoison);
-}
 /** Default id = fingerprint of the RAW public-key bytes: `exec-<sha256(pk)[0..12) hex>`.
  *  Deterministic → regenerating the id from the same key file is stable across boots. */
 export declare function deriveKeyId(publicKeyRaw: Uint8Array): string;

package/dist/sealed-key.js

@@ -17,26 +17,6 @@ export function projectSealedKeyCapability(face) {
         return undefined;
     return { alg: SEALED_KEY_ALG, publicKeyId: face.latest.publicKeyId, publicKey: face.latest.publicKey };
 }
-export function sealedKeyPoison(publicKeyId, reason, errKind) {
-    return { sealedKeyPoison: true, publicKeyId, reason, ...(errKind ? { errKind } : {}), at: new Date().toISOString() };
-}
-export function isSealedKeyPoison(v) {
-    return typeof v === "object" && v !== null && v.sealedKeyPoison === true;
-}
-export class SealedKeyPoisonedError extends Error {
-    publicKeyId;
-    reason;
-    at;
-    constructor(modelName, poison) {
-        super(`sealed api key for model "${modelName}" is unusable (${poison.reason}; publicKeyId "${poison.publicKeyId}"; detected ${poison.at}) — ` +
-            `refusing the gateway-key fallback. Fix custody: re-paste the key in the web UI (it seals against the newest registered public key), ` +
-            `or restore this host's private key for that id / complete the rotation so the ciphertext targets a held key.`);
-        this.name = "SealedKeyPoisonedError";
-        this.publicKeyId = poison.publicKeyId;
-        this.reason = poison.reason;
-        this.at = poison.at;
-    }
-}
 export function deriveKeyId(publicKeyRaw) {
     return `exec-${createHash("sha256").update(publicKeyRaw).digest("hex").slice(0, 12)}`;
 }

package/dist/server-secret-env.d.ts

@@ -69,9 +69,9 @@ export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
  * 目录臂的计数恰好就是 core 形状规则的缺口读数;名单型旋钮臂只记前两臂都漏下的(今天 = 不在服务目录里的 `BAKE_ENV_ALLOW`)。
  * 各腿不直接调它 —— 经 {@link hostSubprocessEnv}(剥 + 放回 + 留痕一只口)。
  *
- * **只为宿主子进程组合**:子进程与本进程同平台 ⇒ core `scrubSecretEnv` 的平台尾参(core 7.33.6 #1159:git 的 env 配置记录按子进程的平台读 ——
- * POSIX 只认大写名,win32 大小写折叠)取缺省 `process.platform` 即对。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env
- * 不经本函数:那些车道不继承本进程 env,只交调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。
+ * **只为宿主子进程组合**。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env 不经本函数:那些车道不继承本进程 env,只交
+ * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
+ * core 7.35.0 #1201 删除 —— git 的 env 配置族成了豁免族,不再有「按子进程平台读记录」这件事,S-877。)
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
 /**
@@ -87,15 +87,14 @@ export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: Ser
  * 返回 `NodeJS.ProcessEnv` 形(值可能是 `undefined` 的键本来就不会进子进程);调用方显式要交的键(`LC_ALL`、`cfg.env` …)叠在它之上。
  * 调用时机 = 每次要交 env 时现算一次(`process.env` 在本仓是 boot 期输入,各次同值;计数因此是「每组合一次」)。
  *
- * 🔴 **git 的 env 配置组(`GIT_CONFIG_COUNT` + `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>`)只有 core 一只写手**(7.103.1:车PG 退役本层,车PK 提 core 7.33.6):
- * 一条配置(KEY + VALUE)一次判定;COUNT 以内被扣的一条**原位**换占位(`GIT_CONFIG_KEY_<i>=sema.withheld` / `GIT_CONFIG_VALUE_<i>=""`,git 读成一条没人用的
- * 配置)、不重排、COUNT 原样(#1160);COUNT 之外 / 没有 COUNT 的被扣条目整条不交;COUNT 按 git 的 `strtoul` 读(#1162);记录按子进程的平台读(#1159,见
- * {@link scrubServerSecrets})。本层 7.103.0 的「整组扣」与 7.103.1 中间态的「按 pair 扣留 + 重编号」(D-7)都已退役,本层不重判(同一语义面上不留第二只写手)。
- * 本仓按名两臂(目录 secret 名 / 名单型旋钮)不含这一族的名字(钉:`test/secret-env-git-config-pair.test.ts`「一只写手」格)。
- * 点名放回按名叠在 scrub 结果之上 ⇒ 放回一条被扣配置要把 KEY 与 VALUE 两只一并点名(只点一只 = 与另一只的占位半条配成一对)。
- * 🔴 **披露谓词 = 「这个名字没有按原样交给子进程」**(输入值 vs 输出值;core 7.33.6 pickup 注:「not handed on as written」)。被扣的记录成员在输出里
- * **仍在**(装着占位半条)⇒「组合结果里有没有这个名字」恒为有;点名放回的名字取回源值 ⇒ 与输入同值 ⇒ 不是剥除;占位半条恰与输入同值的成员(KEY 里
- * 带凭据、VALUE 本就是空串)子进程拿到的正是原值 ⇒ 也不披露。一只谓词盖住「剥掉」「换占位」「点名放回」三形,不按形分臂。
+ * 🔴 **git 的 env 配置族与代理变量一族只有 core 一只写手**:core 7.35.0 #1201(S-877,CC 2.1.280 形)起它们是 core 的**豁免族** ——
+ * `GIT_CONFIG_COUNT` / `GIT_CONFIG_PARAMETERS` / `GIT_CONFIG_KEY_<数字>` / `GIT_CONFIG_VALUE_<数字>`(大写)与 `http(s)_proxy` / `all_proxy` / `no_proxy` /
+ * `npm_config_*proxy` …(任意大小写),名与值都不读、**原样交出,凭据在内**(7.33.2–7.33.8 的逐条扣 / 原位占位 `sema.withheld` / 整只扣全部退役;
+ * 部署面:凭据不放本进程 env —— `docs/DEPLOY-PREREQS.md`)。本层 7.103.0 的「整组扣」与 7.103.1 中间态的「按 pair 扣留 + 重编号」(D-7)更早退役,
+ * 本层不重判(同一语义面上不留第二只写手;在下游把 core 的豁免改回扣 = 源头修复宪法禁止的改写)。本仓按名两臂(目录 secret 名 / 名单型旋钮)不含
+ * `GIT_CONFIG_` 这一族的名字(钉:`test/secret-env-git-config-pair.test.ts`「一只写手」格)。
+ * 🔴 **披露谓词 = 「这个名字没有按原样交给子进程」**(输入值 vs 输出值)。core 对一个变量的动作恒为「整只删」(从不改写值,#1201),点名放回的名字
+ * 取回源值 ⇒ 与输入同值 ⇒ 不是剥除。一只谓词盖住「剥掉」「点名放回」两形,不按形分臂(7.33.6–7.33.8 还有第三形「换占位」,随 #1201 消失)。
  */
 export declare function hostSubprocessEnv(o: {
     site: SecretEnvScrubSite;

package/dist/session-policy-wire.d.ts

@@ -61,15 +61,17 @@ export type ToolNameRuleField = {
  * ⚠️ **比准备阶段严一格**(方向安全,与 client-core 0.83.6 的 KL-157 同向):准备阶段对**本 run 名册里挂着**的
  * 同名工具放行(部署自己挂了一只叫 `Task` 的工具就不审计它),写口看不到将来哪一跑的名册 ⇒ 一律拒。
  * 受伤的是「部署自带与退役名同名的工具、又要在会话规则里点它」的形;出路 = 部署级工具策略(不经会话规则店)。
- * ⚠️ **过渡形**:core 已表态(#1156,7.34.1)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
- * 换成调 core 那只(拒因原样透传),三份判定收成一份。
+ * ⚠️ **过渡形**:core 已表态(#1156)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
+ * 换成调 core 那只(拒因原样透传),三份判定收成一份。**S-877 提货复核(core 7.35.0)**:#1156 **未随版**(发车帖 [ref] 逐字
+ * 「照 #1156 未随本版」);同版新导出的 `rosterToolName` / `ruleNamesOf`(#1194)是**别名归一**(一个名字在名册上落到哪只行的线名 /
+ * 一次调用可被规则拼成的名字集),不回答「这个名字会不会让准备阶段拒启」,不能替本函数 ⇒ 本函数照留,等 #1156。
  *
  * 🔴 **为什么不复用 `config.ts` 的 `findUnmatchableToolNames`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
  * 不是同一个问题。那一只问「部署名单里这条名字会不会**永远匹配不上**活工具」—— 它刻意豁免 `allow`(白名单匹配不上 =
  * fail-closed 且当场可见),并且拒两段 MCP 名 `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条
  * 会话规则会不会**拒启**」:引擎准备阶段的名审计对 `allow` 桶照样抛(豁免它 = 放过一条砖化路径),对 `mcp__srv` 却
  * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
- * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),7.34.1 提货时一并换调 core 的导出函数。
+ * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),#1156 到货的那一批一并换调 core 的导出函数。
  */
 export type LegacyToolName = {
     why: "retired";

package/dist/session-titler.d.ts

@@ -54,6 +54,17 @@ export interface SessionTitler {
 export declare const TITLE_MAX_CHARS = 80;
 /** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */
 export declare function sanitizeTitle(raw: string): string;
+/**
+ * S-236 ②(7.106.0,cli L-687)—— objective 里**用户自己写的**那部分:剥掉全部 `<system-reminder>…</system-reminder>` 块(跨行、
+ * 多块、夹在正文中间都剥;**未闭合**的块剥到末尾 —— 被截断的附件同样不是用户写的)后 trim。
+ *
+ * 为什么:壳把附件(技能清单一类的 `<system-reminder>` 块)拼在正文**之前**提交,标题器取前 {@link OBJECTIVE_SNIPPET_CHARS} 字
+ * 去起名 ⇒ 标题成了技能清单。判据只认这一个**字面标签**(CC 的附件信封),不按内容猜「像不像用户写的」——
+ * 正文里提到这个词的普通文字不是块,原样保留。剥完是空串 ⇒ 调用方走「空 objective 不起名」的既有臂。
+ * ⚠️ 只治这一类:S-236 原件(fresh `/decide` 腿把指路文本当 objective 提交)是另一类非用户文本,没有信封可剥,本函数刻意不加
+ * 按内容猜的第二臂(要么 fresh 腿传席,要么另立一臂 —— 候裁,见车RA 收车档)。
+ */
+export declare function userAuthoredObjectiveText(objective: string): string;
 export declare function buildTitlePrompt(objective: string): string;
 export declare function createSessionTitler(deps: SessionTitlerDeps): SessionTitler;
 //# sourceMappingURL=session-titler.d.ts.map

package/dist/session-titler.js

@@ -12,8 +12,12 @@ export function sanitizeTitle(raw) {
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
     return unquoted.length > TITLE_MAX_CHARS ? `${unquoted.slice(0, TITLE_MAX_CHARS - 1)}…` : unquoted;
 }
+export function userAuthoredObjectiveText(objective) {
+    return objective.replace(/<system-reminder>[\s\S]*?(?:<\/system-reminder>|$)/g, "").trim();
+}
 export function buildTitlePrompt(objective) {
-    const snippet = objective.length > OBJECTIVE_SNIPPET_CHARS ? `${objective.slice(0, OBJECTIVE_SNIPPET_CHARS)}…` : objective;
+    const text = userAuthoredObjectiveText(objective);
+    const snippet = text.length > OBJECTIVE_SNIPPET_CHARS ? `${text.slice(0, OBJECTIVE_SNIPPET_CHARS)}…` : text;
     const fenced = snippet.replace(/<(\/?)request>/gi, "<\u200b$1request>");
     return ("Write a short title (at most 8 words) summarizing the user request below. " +
         "Reply with ONLY the title on a single line — no quotes, no preamble. " +
@@ -34,7 +38,7 @@ export function createSessionTitler(deps) {
         .catch(() => ({ state: continueWord, unreadable: true }));
     return {
         maybeTitle(sessionId, objective, model) {
-            if (!sessionId || !objective.trim())
+            if (!sessionId || !userAuthoredObjectiveText(objective))
                 return;
             if (seen.has(sessionId))
                 return;

package/dist/sql-engine-posture.d.ts

@@ -11,7 +11,7 @@
  *
  * `sql-driver.ts` 的连接初始化在**每条池连接**上钉死这两件事并**回读复核**(`@contract txn.read-semantics`)。
  * 本模块把那份读数拿出来,一次推导两个读面:operator 面(`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段,
- * 全量)与消费端面(`GET /v1/capabilities` 的 `sql` 位,窄投影)。两面同源 —— 「诊断页说悲观、能力位说
+ * 全量)与消费端面(`GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①),窄投影)。两面同源 —— 「诊断页说悲观、能力位说
  * 乐观」在结构上不可能。
  *
  * ## 两条诚实纪律(与 memory-posture 同源)
@@ -27,7 +27,7 @@
 import { type SqlEngineFacts } from "./plugins/sql-driver.js";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-/** 消费端窄投影(`GET /v1/capabilities` 的 `sql` 位)。`null` = 本部署没有 SQL 后端。 */
+/** 消费端窄投影(`GET /v1/capabilities` 的 `store.sql` 位;7.106.0 前是顶层 `sql`,S-866 ①)。`null` = 驱动此刻给不出事实 ⇒ `store.sql` 缺席。 */
 export interface SqlEngineCapability {
     engine: SqlEngineFacts["engine"];
     isolation: string;

package/dist/store-posture.d.ts

@@ -0,0 +1,53 @@
+/**
+ * S-866 ①(设计稿 v1.1 §2①)—— 「这台副本**真的在持久化吗**」的单一推导点:caps `store`、`/health.storeDegraded` / `durable:false`、
+ * gauge `store_backend_degraded` 三面读**同一只装配值**({@link StorePosture},`boot/stores.ts` 铸一次)。
+ *
+ * ## 病
+ * 7.105.0 及以前,店降级的痕迹是 gauge + `/health` 两位 + caps `sql:null` —— 而 `sql:null` 同时是「本来就没配 SQL」「local 文件店」
+ * 「降级到内存」「最近一次连接初始化被拒」四件事;调用方分不清「以为在持久化,其实在内存」这最坏的一形。
+ *
+ * ## 形
+ * `declared` = 运维的声明(`DB_BACKEND` 词,含缺省推导);`backend` = **装配出的**后端 kind(没装出后端 = `memory`);两者不等是合法的
+ * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;auto 降级;缺省推导 local 起不来)—— 两位都上 wire,
+ * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
+ * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
+ */
+import { type DbBackendWord } from "./config-types.js";
+import type { StoreBackend } from "./plugins/store-backend.js";
+import type { SqlEngineFacts } from "./plugins/sql-driver.js";
+import { type SqlEngineCapability } from "./sql-engine-posture.js";
+/**
+ * 降级词闭集(**按后端族**,不按失败发生在哪一步 —— SQL 池懒连,连接失败第一次就出现在 `ensureSchema` 里,与 DDL 失败同一个调用,
+ * 按调用位置分不出「连不上」与「建表失败」):
+ *  · `db_unreachable` —— SQL 族(`mysql` / `pg`)在 `SESSION_BACKEND=auto` 下打不开(连接或建表);
+ *  · `local_unwritable` —— **缺省推导**的 local 文件店构造期失败(mkdir / 数据根锁 / 权限 / 只读挂载 / 磁盘满)。
+ */
+export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
+export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
+/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
+export declare function storeDegradedReasonFor(declared: DbBackendWord): StoreDegradedReason;
+/** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
+export interface StorePosture {
+    readonly declared: DbBackendWord;
+    readonly backend: DbBackendWord;
+    readonly degradedReason?: StoreDegradedReason;
+}
+/** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
+export declare function buildStorePosture(a: {
+    readonly declared: DbBackendWord;
+    readonly assembled: StoreBackend["kind"] | undefined;
+    readonly degradedReason: StoreDegradedReason | undefined;
+}): StorePosture;
+/** caps `store` 的形。 */
+export interface StoreCapability {
+    readonly declared: DbBackendWord;
+    readonly backend: DbBackendWord;
+    readonly durable: boolean;
+    readonly degradedReason?: StoreDegradedReason;
+    /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出
+     *  回读复核过的事实 —— 最近一次连接初始化被拒(S-137 ④)时驱动交 `null`,本键随之缺席(此前是顶层 `sql:null`)。 */
+    readonly sql?: SqlEngineCapability;
+}
+/** 装配值 → caps 投影(纯函数)。 */
+export declare function projectStoreCapability(posture: StorePosture, sqlFacts: SqlEngineFacts | null | undefined): StoreCapability;
+//# sourceMappingURL=store-posture.d.ts.map

package/dist/store-posture.js

@@ -0,0 +1,32 @@
+import {} from "./config-types.js";
+import { projectSqlEngineCapability } from "./sql-engine-posture.js";
+export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
+export function storeDegradedReasonFor(declared) {
+    switch (declared) {
+        case "mysql":
+        case "pg":
+            return "db_unreachable";
+        case "local":
+            return "local_unwritable";
+        case "memory":
+            throw new Error("store posture: DB_BACKEND=memory never opens a backend, so it cannot degrade — this is a wiring defect");
+        default: {
+            const unhandled = declared;
+            throw new Error(`store posture: unknown DB_BACKEND word ${String(unhandled)}`);
+        }
+    }
+}
+export function buildStorePosture(a) {
+    return { declared: a.declared, backend: a.assembled ?? "memory", ...(a.degradedReason !== undefined ? { degradedReason: a.degradedReason } : {}) };
+}
+export function projectStoreCapability(posture, sqlFacts) {
+    const sql = posture.backend === "mysql" || posture.backend === "pg" ? projectSqlEngineCapability(sqlFacts) : null;
+    return {
+        declared: posture.declared,
+        backend: posture.backend,
+        durable: posture.backend !== "memory",
+        ...(posture.degradedReason !== undefined ? { degradedReason: posture.degradedReason } : {}),
+        ...(sql !== null ? { sql } : {}),
+    };
+}
+//# sourceMappingURL=store-posture.js.map