@sema-agent/server 7.105.0 → 7.107.0

package/dist/config.d.ts

@@ -32,8 +32,43 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
+/** [ref] 兼容面全清:退役 env 名墓碑——老名**在场即拒启**带新名指引。静默忽略=部署带着失效配置无感跑;双读=兼容层吸收
+ *  下游冒烟。都不要。
+ *
+ *  🪦 **墓碑是永久的响亮拒,不设到期**(S-588)。一行墓碑就是那句拒启句本身,成本一行;删掉它 = 旧名重新被悄悄忽略。
+ *  ⇒ 本表只增不减,**唯一的删除条件是这个名字要被赋予新含义**:那一次提交同时删掉墓碑行,并在 MIGRATION 写明旧名改作何用。
+ *  (与一次性迁移不是一回事:迁移码每次起服都跑、碰真数据,所以有窗、窗关即删码 —— 见 `plugins/one-time-migrations.ts`
+ *  的登记表;墓碑不碰数据,只拒启。)
+ *  A tombstone is a permanent loud refusal with no expiry: deleting a row lets the retired name be silently ignored again,
+ *  so a row goes only when the name is given a new meaning — in that same commit, with a MIGRATION note.
+ *
+ *  **旧名在场即拒,替代名在不在都一样**:判据只问旧名在不在场,不看替代键设没设、设成什么 ——「新旧两个名字都留着」正是
+ *  迁移到一半的部署最常见的形,旧名在那一形里若被静默忽略,运维会以为它还在生效。server 3.0.0 的旧负名(`X_DISABLED` →
+ *  `X_ENABLED`)同在本表(`replaced` 族:极性相反,照抄旧值过去恰好是反义),与其余墓碑走同一只 {@link rejectRetiredEnvs};
+ *  那几个旋钮的读点只读正名(`boolEnv`),不再有第二套「正名缺席才看旧名」的判据(S-588 之前的 `boolEnvWithLegacyNegated`)。
+ *
+ *  墓碑分三族(A4 两族 + S-753 第三族),每族各说各的尾句 —— 族是**闭集**,渲染是穷举表(加一族不写尾句 = 编译红):
+ *   · `renamed`  = 同一能力换了个键名,值语义逐字不变 ⇒ 「照新名改写即可」;
+ *   · `replaced` = 有替代键,但**值语义变了**(缺省 / `0` 义 / 计量段 / 极性不同)⇒ 点名新键 + 说清变了什么,**不许**说「语义不变」
+ *                  —— 照抄旧值过去就是另一个意思(S-753:`MODEL_CONNECT_TIMEOUT_MS` → `MODEL_FIRST_BYTE_TIMEOUT_MS`);
+ *   · `removed`  = 能力本身没了,`why` 是「为什么没了」,**没有可 rename 的目标**。
+ *  拒句带码 `[config.env_key_retired]`(拒启码,拼法随 `config.*` 家族;与中心凭证两码同形,出现在拒句方括号里)。
+ *  空串 = 未设(与 `env()` 同一条约定:compose `${X:-}` 透传的空值不是一次表态),不拒。 */
+export type RetiredEnv = readonly [old: string, to: string, kind: "renamed"] | readonly [old: string, to: string, kind: "replaced", why: string] | readonly [old: string, why: string, kind: "removed"];
+export type RetiredEnvKind = RetiredEnv[2];
 /** 墓碑拒启码(机读;拒句方括号里)。 */
 export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
+export declare const RETIRED_ENVS: readonly RetiredEnv[];
+/** S-885 —— 墓碑表的 wire 投影一行(`GET /v1/config/catalog` 的 `retired[]`):按族定形 —— renamed 只带 `replacement`;replaced 带
+ *  `replacement` + `reason`(值语义怎么变了);removed 只带 `reason`(能力为什么没了)。 */
+export interface RetiredEnvWire {
+    readonly name: string;
+    readonly kind: RetiredEnvKind;
+    readonly replacement?: string;
+    readonly reason?: string;
+}
+/** 墓碑表 → wire 投影(纯数据 ⇒ `build*`)。**同一张表、同序**;族是闭集,穷举 switch(加一族不写这里 ⇒ 编译红)。 */
+export declare function buildRetiredEnvWire(): RetiredEnvWire[];
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;

package/dist/config.js

@@ -10,14 +10,14 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, isSingleMachineDefaultLane } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
@@ -27,6 +27,7 @@ import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { parseUnattendedPermissionMode } from "./unattended-permission-mode.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -105,7 +106,7 @@ function defaultSkillsDir() {
     }
 }
 export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-const RETIRED_ENVS = [
+export const RETIRED_ENVS = [
     ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
     ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
     ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
@@ -135,6 +136,25 @@ const RETIRED_ENVS = [
     ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
     ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
 ];
+for (const row of RETIRED_ENVS)
+    Object.freeze(row);
+Object.freeze(RETIRED_ENVS);
+export function buildRetiredEnvWire() {
+    return RETIRED_ENVS.map((row) => {
+        switch (row[2]) {
+            case "renamed":
+                return { name: row[0], kind: row[2], replacement: row[1] };
+            case "replaced":
+                return { name: row[0], kind: row[2], replacement: row[1], reason: row[3] };
+            case "removed":
+                return { name: row[0], kind: row[2], reason: row[1] };
+            default: {
+                const unhandled = row;
+                throw new Error(`unhandled retired-env kind: ${String(unhandled[2])}`);
+            }
+        }
+    });
+}
 const RETIRED_ENV_SENTENCE = {
     renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
     replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
@@ -205,11 +225,11 @@ export function drainConfigNotices() {
     return CONFIG_NOTICES.splice(0, CONFIG_NOTICES.length);
 }
 let EXEC_LANE_NOTICE;
-function buildExecLaneNotice(remoteExec, configProvider) {
-    const explicit = process.env.REMOTE_EXEC !== undefined && process.env.REMOTE_EXEC !== "";
+function buildExecLaneNotice(remoteExec) {
+    const lane = executionLaneOf(remoteExec?.provider);
     return {
-        lane: executionLaneOf(remoteExec?.provider),
-        source: explicit ? "explicit-env" : configProvider === "local" ? "default-local-provider" : "default-unset",
+        lane,
+        source: lane === "in-process" ? "default-unset" : isSingleMachineDefaultLane(remoteExec) ? "default-local-provider" : "explicit-env",
     };
 }
 function parseConfigProvider() {
@@ -822,6 +842,18 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
         },
     });
 }
+function buildUnusedCoordinatesRefusal(keys, auto) {
+    const engine = keys.length === 1 ? (keys[0] === "PG_HOST" ? "pg" : "mysql") : "mysql|pg";
+    const probedHostKey = auto?.autoProbes === "pg" ? "PG_HOST" : "MYSQL_HOST";
+    const why = auto !== undefined
+        ? `SESSION_BACKEND=auto probes the ${auto.autoProbes} engine (DB_BACKEND ${process.env.DB_BACKEND ? "names it" : "unset ⇒ mysql"}), whose host key ${probedHostKey} is not set`
+        : "no durable session store is selected (neither DB_BACKEND=mysql|pg nor SESSION_BACKEND=mysql|auto), so the store would run IN MEMORY";
+    return (`${keys.join(" and ")} ${keys.length === 1 ? "is" : "are"} set but the current configuration never uses ${keys.length === 1 ? "it" : "them"}: ${why}. ` +
+        `Refusing to boot rather than running in memory silently. ` +
+        `To persist: DB_BACKEND=${engine} (or SESSION_BACKEND=mysql for the MySQL-protocol engine); ` +
+        `to run in memory: remove the coordinates, or set DB_BACKEND=memory; ` +
+        `for best effort (persist while the store is reachable, memory otherwise): SESSION_BACKEND=auto with the engine pointed right (DB_BACKEND=pg with PG_HOST, DB_BACKEND=mysql with MYSQL_HOST).`);
+}
 function parseStoreDomain(ctx) {
     const { requirePrincipal } = ctx;
     const dbBackendSet = !!process.env.DB_BACKEND;
@@ -829,7 +861,7 @@ function parseStoreDomain(ctx) {
         !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "pg", "local", "memory"]);
+    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", DB_BACKEND_WORDS);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
             level: "warn",
@@ -846,6 +878,11 @@ function parseStoreDomain(ctx) {
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
+    const sqlCoordinateKeys = [...(process.env.MYSQL_HOST ? ["MYSQL_HOST"] : []), ...(process.env.PG_HOST ? ["PG_HOST"] : [])];
+    const coordinatesUnusedByDeclaration = process.env.DB_BACKEND === "memory" || process.env.DB_BACKEND === "local" || process.env.SESSION_BACKEND === "memory";
+    if (sqlCoordinateKeys.length > 0 && !needsDb && !coordinatesUnusedByDeclaration) {
+        throw new Error(buildUnusedCoordinatesRefusal(sqlCoordinateKeys, sessionBackend === "auto" ? { autoProbes: dbBackend } : undefined));
+    }
     return {
         sessionBackend,
         sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"),
@@ -1290,6 +1327,8 @@ function unattendedApprovalPolicyEnv() {
 function parseApprovalDomain(ctx) {
     const { postureOn, singleUserTurnkey, infraReady } = ctx;
     const unattendedPolicy = unattendedApprovalPolicyEnv();
+    const unattendedMode = parseUnattendedPermissionMode(process.env.UNATTENDED_PERMISSION_MODE);
+    CONFIG_NOTICES.push({ level: "info", event: "unattended_permission_mode", fields: { value: unattendedMode.value, source: unattendedMode.source } });
     const streamAskWindowMsSource = postureSourceOfNumEnv(process.env.STREAM_ASK_WINDOW_MS, singleUserTurnkey);
     const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
     let streamAskWindowMsEffectiveSource = streamAskWindowMsSource;
@@ -1335,7 +1374,7 @@ function parseApprovalDomain(ctx) {
         ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
             const trimmed = (raw ?? "").trim();
-            if (trimmed === "always" || trimmed === "classify")
+            if (trimmed === "always")
                 return { manualModeShellGate: trimmed };
             if (trimmed === "" || trimmed === "off") {
                 if (trimmed === "off") {
@@ -1346,14 +1385,20 @@ function parseApprovalDomain(ctx) {
                             env: "MANUAL_MODE_SHELL_GATE",
                             raw: trimmed,
                             effect: "accepted as a no-op (normalized to the knob being absent) — this knob has a TIGHTEN half only, so `off` cannot relax anything; " +
-                                "the effective shell gate still comes from AUTONOMY and the client's permission mode. NOT symmetric with SENSITIVE_WRITE_PATTERNS=off, which really does clear a server-owned default set",
+                                "the effective shell gate still comes from AUTONOMY and the engine's permission-mode arbitration. NOT symmetric with SENSITIVE_WRITE_PATTERNS=off, which really does clear a server-owned default set",
                         },
                     });
                 }
                 return {};
             }
-            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated), "classify" (core's classifier decides per call), or "off"/unset (this knob contributes nothing). ` +
-                `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
+            if (trimmed === "classify") {
+                throw new Error(`env MANUAL_MODE_SHELL_GATE="classify" is retired (server 7.106.0 / @sema-agent/core 7.34.0): the engine now puts every full-shell command it cannot prove read-only to its question under EVERY permission mode — ` +
+                    `that tier is the default and needs no knob. What "classify" added on top was a question under a bypassPermissions request, which the engine now releases by mode. ` +
+                    `Use "always" to keep EVERY shell call behind an approval under every mode (bypassPermissions included), or unset it / "off" to rely on the engine's mode arbitration. ` +
+                    `Refusing to boot rather than accepting it as a no-op: that would silently drop the half the operator configured it for`);
+            }
+            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated) or "off"/unset (this knob contributes nothing). ` +
+                `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Always" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
         permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
@@ -1384,6 +1429,7 @@ function parseApprovalDomain(ctx) {
         streamAskWindowMsSource: streamAskWindowMsEffectiveSource,
         durableApprovalSource: postureSourceOfKnob("DURABLE_APPROVAL"),
         unattendedApprovalPolicy: unattendedPolicy,
+        unattendedPermissionMode: unattendedMode.value,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
@@ -1949,7 +1995,7 @@ function parseOrchestrationDomain(ctx) {
                                                             }
                                                             :
                                                                 ctx.configProvider === "local"
-                                                                    ? { provider: "host" }
+                                                                    ? { provider: "host", singleMachineDefault: true }
                                                                     : undefined,
         worktreeIsolation: boolEnv("WORKTREE_ISOLATION_ENABLED", false) && process.env.WORKTREE_REPO_ROOT
             ? {
@@ -2136,11 +2182,18 @@ function parseIntegrationsDomain(ctx) {
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
         configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL"), requirePrincipal) : undefined,
+        fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, requirePrincipal),
         ...(configProvider !== undefined ? { configProvider } : {}),
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
+function parseFleetLeaseFailClosed(raw, requirePrincipal) {
+    const explicit = parseBoolWord("FLEET_LEASE_FAIL_CLOSED", raw);
+    const value = explicit ?? requirePrincipal;
+    registerKnob({ name: "FLEET_LEASE_FAIL_CLOSED", polarity: "posture", value, source: explicit !== undefined ? "env" : requirePrincipal ? "posture" : "default" });
+    return value;
+}
 function parseConfigCenter(baseUrl, requirePrincipal) {
     const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
     const declared = readCenterCredentialDeclaration();
@@ -2246,7 +2299,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
+    "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "unattendedPermissionMode", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
@@ -2280,7 +2333,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "fleetLeaseFailClosed", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2405,7 +2458,7 @@ export function loadConfig() {
             throw new Error(refusal);
         }
     }
-    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec, configProvider);
+    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,
         ...modelPlane,

package/dist/cross-session-settings.d.ts

@@ -19,7 +19,7 @@
  * 而 `crossSessionInbound` 在 CC 里是**每会话**的 settings 值。本服务是「一个 Runner × 多会话」的宿主:
  * 把某一次提交的 `body.settings.crossSessionInbound` 塞进部署级座位,等于让 A 会话的设置去治理 B 会话的
  * 排水——比不接线更糟,且是静默的。可选的补法只有两条,都不在本件射程内:
- *   (a) 引擎开一个**每任务**座(形如既有的 `TaskSpec.autoModeRequested` 意图座)——上游诉求,已留档;
+ *   (a) 引擎开一个**每任务**座(形如 `TaskSpec.permissionMode` 那样的每任务座)——上游诉求,已留档;
  *   (b) 本仓用 per-run 异步上下文托住层,并保证**每一条** run 腿都建立该上下文——漏一条腿 =
  *       用户设的 `refuse` 静默失效 = 安全轴 fail-open,不许半接。
  * 在 (a)/(b) 落地之前,提交面对这两个键**明拒**(`TASK_SETTINGS_UNSUPPORTED_KEYS`,400 体 `unsupportedKeys`

package/dist/deployment-governance.d.ts

@@ -179,7 +179,18 @@ export declare function createDurableQuestionGate(live: LiveQuestionFace | undef
  *  无 root/cwd 声明 ⇒ 家族 undefined ⇒ 只认 `/`-rooted,与引擎同一律)。
  */
 type WriteTargetForm = "unstamped-relative" | "absolute-or-stamped";
-/** 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。 */
+/**
+ * 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。
+ *
+ * 🔴 **S-877(core 7.35.0 #1200):本包装不是 `wrapToolPolicy`,它自报成员**。core 的 wrap 契约是「包装至少拒内层所拒」,
+ * 而本包装**放行**内层会拒的另一形写目标 ⇒ 按契约它是一只自己的策略,内层的成员不能照搬(core wire 单点名这一只):
+ *  · `writeTargetGuard`(守卫集策略自带,shell 写站问「这个绝对目标守不守」)—— 只在本层的形**覆盖守卫的入参形**时带上
+ *    ({@link WRITE_TARGET_GUARD_DOMAIN}):真身层带;词法层不带(它的 env 对绝对形报错 ⇒ core 的「判不了就守」会把每一次
+ *    shell 写都判成受守,正与两层射程互补的原设计相反)。这不是给某一形开的特例,是同一条「成员描述它守得住的那部分」的读法;
+ *  · `projection` / `pathDenyRules` / `nameSets` —— 守卫集策略不带,本包装也不报(报了就是替它声称一张它没有的拒表)。
+ * 修前(core 7.33.x)这里是一只 `{ check }` 字面量,7.34.0 起那只字面量把真身层的守卫剥掉了 —— 沙箱 lane 的 shell 写站
+ * 因此看不见部署守卫集(`cp x .env` 在 acceptEdits 下被引擎 place 并答掉)。
+ */
 export declare function scopedToWriteTargetForm(policy: ToolPolicy, form: WriteTargetForm): ToolPolicy;
 export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
     /** 相对形 → `/<词法归一>`;绝对形 / 空串 / 含 NUL 一律报错(fail-closed 守底:`relativeTargetsOnly` 已把这些形挡在外面,

package/dist/deployment-governance.js

@@ -26,6 +26,7 @@ function writeTargetFormOf(req) {
         return "absolute-or-stamped";
     return "unstamped-relative";
 }
+const WRITE_TARGET_GUARD_DOMAIN = "absolute-or-stamped";
 export function scopedToWriteTargetForm(policy, form) {
     return {
         async check(req, signal) {
@@ -34,6 +35,7 @@ export function scopedToWriteTargetForm(policy, form) {
                 return { action: "allow" };
             return policy.check(req, signal);
         },
+        ...(form === WRITE_TARGET_GUARD_DOMAIN && policy.writeTargetGuard !== undefined ? { writeTargetGuard: policy.writeTargetGuard } : {}),
     };
 }
 export class RelativeTargetLexicalEnv extends StubExecutionEnv {

package/dist/execution-lane-caps.d.ts

@@ -31,8 +31,19 @@ export interface ExecutionLaneCaps {
     /** SendUserFile 的**沙箱直传腿**(host/in-process 的本机 fs 源是另一条腿,不是本位)。
      *  判别式:`capabilities/sandbox-file-send.ts` 的 `sandboxSendLaneEnabled`。 */
     readonly sandboxSendUserFile: LaneCapability;
-    /** OS 级隔离边界。判别式:`boot/execution-env.ts` 的 `isolated`(经 `remote_exec_enabled` 日志可观测)。 */
-    readonly isolation: LaneCapability;
+    /**
+     * OS 级隔离边界(手跑在容器 / microVM / Kata pod 里,而不是一台真机上)。
+     * 🔴 S-281 起**本位即判别式**:全仓读它的唯一布尔口是 {@link laneIsolated}(boot `remote_exec_enabled.isolated` 与
+     * `remote_exec_real_system` 那一行、`config.d/remote-exec.json` 抢占披露的「隔离降级」判、wire `executionLane.isolated`
+     * + 诊断面同位、那一行 note 列的沙箱出路 —— 改前 boot 另手写一份 `e2b || k8s || local-docker`,与本表两处各算)。
+     * 本位的**独立作者** = 各 adapter 对 core 的 `capabilities.isolation` 声明:对账测试拿 core 自己的严格读器 `isIsolated`
+     * 问每条车道的**真 adapter 实例**,与本表、与 boot 行三方对拍。
+     * 型上**没有** `single-user-only` 这一档(隔离是车道的结构事实,不随租户面变)⇒ {@link laneIsolated} 的布尔化是穷举、无兜底。
+     * ⚠️ 口径 = **OS 级边界**(容器即算:共享宿主内核的 `local-docker`、runc 上的 k8s pod 都答 supported),**不是**「独立内核」强度。
+     * 另一根轴 `router/route-orchestration.ts` 的 `isIsolatedExecEnv`(A 值路由,只认 e2b 与 kata / gvisor 运行时,runc / local-docker
+     * fail-closed 判否)问的是 VM 级强度 —— 两个不同的问题,不是本位的第二份;收成一只会让其中一边答错(S-281 收车档登记)。
+     */
+    readonly isolation: Exclude<LaneCapability, "single-user-only">;
     /** 可挂起(k8s 以配了 `s3Snapshot` 为前提 —— 「结构上能不能」的口径)。判别式:同上的 `suspendable`。 */
     readonly suspendable: LaneCapability;
     /** `/tmp/scratchpad/<sessionId>` 远端约定。判别式:`plugins/remote-scratchpad.ts` 的 `isRemoteScratchpadLane`。 */
@@ -155,6 +166,23 @@ export declare function executionLaneOf(provider: string | undefined): Execution
  *  ③ `approval.ts` 的 `buildNoResponderBootWarns` —— 写门的 ask 只在「有手写本机盘」时才会发生。
  */
 export declare function handsOnWorkerFilePlane(lane: ExecutionLane): boolean;
+/**
+ * S-281 —— 「这条车道的手在不在 OS 级隔离边界里」。**全仓唯一**的布尔判别式(读表 `isolation` 位,见该位头注的读者清单)。
+ * 穷举 switch、无 default 臂:`isolation` 的型只有两档,加档 = 编译红。
+ *
+ * ⚠️ 本函数对 `in-process` 也答(表上那一行是 unsupported ⇒ false)—— 那一格是「表」的完整性,不是 wire 的说法:
+ * 无手部署**没有执行边界可言**,wire 上 `executionLane.isolated` 按 present-iff 缺席(`capabilities/execution-lane.ts`),
+ * 不是 false。boot 行只在装出了执行环境工厂时才打,够不着那一格。
+ */
+export declare function laneIsolated(lane: ExecutionLane): boolean;
+/**
+ * S-281 —— 这条车道是不是**单机形缺省**落点(`REMOTE_EXEC` 未设 / 空串 ∧ `CONFIG_PROVIDER=local`,没人点名)。
+ * 判据 = 装配出的车道值自己带的记号 `singleMachineDefault`(唯一写者 = `config.ts` 三元链的隐式 host 尾臂;显式 `REMOTE_EXEC=host`
+ * 与 `config.d/remote-exec.json` 覆写都铸不带它的新值)。**唯一读口**,读者两处:`config.ts` 车道落点一行的 `source`
+ * (`exec_lane_selected`,文件覆写之前播)与 `boot/execution-env.ts` 的 `remote_exec_real_system.note`(覆写之后打)——
+ * 同一个记号、两个时刻,不另按 env 原文重判。
+ */
+export declare function isSingleMachineDefaultLane(remoteExec: ServiceConfigFlat["remoteExec"]): boolean;
 /** 把一位能力在**具体部署**上落成布尔:租户面是唯一入参(旋钮由消费点自己再合取)。
  *  穷举 switch,无 default 臂 —— {@link LaneCapability} 加词而此处不加臂 = 编译红。 */
 export declare function laneCapabilityHolds(cap: LaneCapability, deployment: {

package/dist/execution-lane-caps.js

@@ -174,6 +174,18 @@ export function handsOnWorkerFilePlane(lane) {
     const caps = executionLaneCaps(lane);
     return caps.hostFilePlane === "supported" && caps.coreRemoteExecutionEnv === "supported";
 }
+export function laneIsolated(lane) {
+    const isolation = executionLaneCaps(lane).isolation;
+    switch (isolation) {
+        case "supported":
+            return true;
+        case "unsupported":
+            return false;
+    }
+}
+export function isSingleMachineDefaultLane(remoteExec) {
+    return remoteExec?.provider === "host" && remoteExec.singleMachineDefault === true;
+}
 export function laneCapabilityHolds(cap, deployment) {
     switch (cap) {
         case "supported":

package/dist/fleet-client.d.ts

@@ -1,9 +1,10 @@
 /**
  * Fleet worker-side wiring(announce/heartbeat + usage 批报;契约 = registry-core 0.1.48+
  * `/fleet`,center 端点 = sema-registry `/api/fleet/*`)。设计要点:
- *  - **可选分层(D3)**:仅当 center 已配置(sema-registry lane 的 baseUrl+token+worker)∧ `FLEET_ADVERTISE_ADDRESS`
- *    显式声明时才启动 —— 不配 center 的部署零行为变化。address 不自猜(k8s pod IP / docker alias / 127.0.0.1:port
- *    只有部署环境自己知道,故用显式 env)。
+ *  - **可选分层(D3),两条环各自有门(S-866 ④)**:客户端在中心车道配齐时启动(`centerLaneConfigured` —— baseUrl + 声明了
+ *    凭证 + worker,与租约管理器、用量累加器**同一只**谓词);**用量环**只要这三件;**公告环**(announce / 心跳 / 注销)另要
+ *    `FLEET_ADVERTISE_ADDRESS` 显式声明(可达性是运维的话,不自猜:k8s pod IP / docker alias / 127.0.0.1:port 只有部署环境自己
+ *    知道)。不配中心的部署零行为变化;配了中心而不公告的引擎只报用量、不注册(7.105.0 及以前它连用量都不报)。
  *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
  *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
  *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
@@ -74,8 +75,9 @@ export interface FleetClientOpts {
         worker: string;
     };
     instanceId: string;
-    /** Reachable base URL of THIS instance — the operator's explicit declaration (`FLEET_ADVERTISE_ADDRESS`). */
-    advertiseAddress: string;
+    /** Reachable base URL of THIS instance — the operator's explicit declaration (`FLEET_ADVERTISE_ADDRESS`).
+     *  S-866 ④:**缺席 = 公告环不装**(不注册、不心跳、不注销;`announceNow` 是空操作),用量环照装。 */
+    advertiseAddress?: string | undefined;
     version: string;
     /** S-740:就绪判(装配层接 `readinessOf(deployment)` —— HTTP 面读的同一个 deps 组)。每条公告现读**一次**,
      *  `ready` 与 `draining` 两字段都由这一次读铸(不会撕裂成 `ready:true` + `draining:true`)。 */
@@ -104,22 +106,25 @@ export interface FleetClient {
     stop: () => Promise<void>;
 }
 /**
- * Start the worker-side fleet loops. Caller has already gated on "center configured ∧ advertise address set"
- * (startFleetClientFromEnv below) — this function assumes a complete opts.
+ * Start the worker-side fleet loops. Caller has already gated on the center lane (startFleetClientFromEnv below).
+ * The announce loop runs iff `advertiseAddress` is present; the usage loop iff `usage` is present (S-866 ④: the two
+ * loops no longer share one gate).
  */
 export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
 /**
- * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl + a DECLARED credential
- * + worker — S-651: declared, not "currently readable": a token file that is unreadable right now still starts the
- * client, every request re-reads it)
- * AND the operator explicitly declared this instance's reachable address. Anything missing → undefined (zero
- * behavior change for non-fleet deployments); worker missing is warned when the rest is present (half-configured).
+ * Env/config gate (D3 可选分层;S-866 ④ 两条环各自有门): start when the center lane is configured —
+ * {@link centerLaneConfigured}(baseUrl + a DECLARED credential + worker — S-651: declared, not "currently readable": a token
+ * file that is unreadable right now still starts the client, every request re-reads it), the SAME predicate the lease
+ * manager and the usage accumulator use. The usage loop needs nothing more; the announce loop additionally needs the
+ * operator's explicit reachable address (`FLEET_ADVERTISE_ADDRESS`; a malformed one refuses boot). Lane not configured →
+ * undefined (zero behavior change for non-fleet deployments); an address set while only the worker is missing is warned
+ * (half-configured announce).
  */
 export declare function startFleetClientFromEnv(cfg: {
     configCenter?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
 }, opts: Omit<FleetClientOpts, "center" | "advertiseAddress"> & {
-    advertiseAddress?: string;
+    advertiseAddress?: string | undefined;
 }): FleetClient | undefined;
 //# sourceMappingURL=fleet-client.d.ts.map

package/dist/fleet-client.js

@@ -1,6 +1,6 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
-import { centerFetch } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -81,8 +81,9 @@ export function startFleetClient(opts) {
     const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
+    const address = opts.advertiseAddress;
     const announceOnce = async () => {
-        if (stopped)
+        if (stopped || address === undefined)
             return;
         try {
             const verdict = opts.readiness();
@@ -91,7 +92,7 @@ export function startFleetClient(opts) {
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
-                address: opts.advertiseAddress,
+                address,
                 version: opts.version,
                 ready: verdict.ready,
                 draining: !verdict.ready && verdict.reasons.includes("draining"),
@@ -153,9 +154,11 @@ export function startFleetClient(opts) {
             opts.logger?.warn("fleet_usage_report_failed", { error: err instanceof Error ? err.message : String(err), entries: entries.length });
         }
     };
-    void announceNow();
-    const hb = setInterval(() => void announceNow(), heartbeatMs);
-    hb.unref?.();
+    const announcing = address !== undefined;
+    if (announcing)
+        void announceNow();
+    const hb = announcing ? setInterval(() => void announceNow(), heartbeatMs) : undefined;
+    hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
     let stopping = false;
@@ -163,13 +166,16 @@ export function startFleetClient(opts) {
         if (stopping)
             return;
         stopping = true;
-        clearInterval(hb);
+        if (hb)
+            clearInterval(hb);
         if (uw)
             clearInterval(uw);
         while (inFlight !== undefined)
             await inFlight;
         stopped = true;
         await flushUsage();
+        if (!announcing)
+            return;
         try {
             await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });
         }
@@ -180,23 +186,27 @@ export function startFleetClient(opts) {
 }
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
-    const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    if (!cc?.baseUrl || !cc.credential.declared || !address)
-        return undefined;
-    let parsed;
-    try {
-        parsed = new URL(address);
-    }
-    catch {
-        parsed = undefined;
-    }
-    if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
-        throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
+    const raw = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
+    const address = raw === undefined || raw === "" ? undefined : raw;
+    if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
+        let parsed;
+        try {
+            parsed = new URL(address);
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
+            throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${buildDisplaySafeUrl(address)}" — the fleet center rejects any other shape on every announce`);
+        }
     }
-    if (!cc.worker) {
-        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+    if (!centerLaneConfigured(cfg)) {
+        if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
+            opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+        }
         return undefined;
     }
-    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, advertiseAddress: address });
+    const lane = cfg.configCenter;
+    return startFleetClient({ ...opts, center: { baseUrl: lane.baseUrl, credential: lane.credential, worker: lane.worker }, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map