@sema-agent/server 7.107.0 → 7.109.0

package/dist/http/routes/sessions.js

@@ -4,7 +4,7 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
-import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
@@ -526,17 +526,9 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
-                const code = err.code;
-                if (code === "config.memory_erasure_request") {
-                    sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
+                const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
+                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }))
                     return;
-                }
-                const outside = targetOutsideStoreOf(err);
-                if (outside !== undefined) {
-                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
-                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
-                    return;
-                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }

package/dist/http/routes/side-query.js

@@ -3,7 +3,7 @@ import { HttpError } from "../../security.js";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { admitProviderEcho } from "../../observability/run-terminal.js";
+import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +35,11 @@ function shapeSideQueryEcho(result) {
     const { responseModel: _outOfShape, ...admitted } = result;
     return admitted;
 }
+function projectSideQueryResult(result) {
+    const shaped = shapeSideQueryEcho(result);
+    const redacted = redactErrorMessage(shaped.errorMessage);
+    return redacted === undefined || redacted === shaped.errorMessage ? shaped : { ...shaped, errorMessage: redacted };
+}
 export async function handleSideQuery(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
@@ -107,7 +112,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     deps.sideQueryAccounting?.(principal, { model: modelId, usage: rr.usage });
                     deps.metrics?.inc?.("side_query_total", { result: "ok" });
                     if (!res.writableEnded)
-                        sendJson(res, 200, shapeSideQueryEcho(result));
+                        sendJson(res, 200, projectSideQueryResult(result));
                 }
                 catch (e) {
                     deps.metrics?.inc?.("side_query_total", { result: "error" });

package/dist/http/routes/tasks.js

@@ -27,6 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
+import { withModelReachScope } from "../../model-reach-scope.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -644,7 +645,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await (deps.sendUserFile
+                    await withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {

package/dist/http/server.d.ts

@@ -105,8 +105,8 @@ export interface ServiceCoreDeps {
      *  ⚠️ 7.69.0(R-1)起 **resume 家族也递这一位** —— 四条 resume 腿收敛到 `resolveResumeSpec` 一只 resolver,
      *  通告口接一次、四腿同得(见 http/server.ts 的 `resolveResumeSpec` 顶注);此处旧注写作「resume 家族缺席」
      *  已过期,按新行为改。
-     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
-     *  装配器在**全部折叠之后**经 `createUnattendedLeg` / `withUnattendedLeg` 重挂那条腿(表 / 根取续跑 Runner 的同名座)。只由续跑腿
+     *  `opts.unattendedLeg`(S-877 候裁 18,codex r3 F1;S-934 ① 改形):续跑家族在 ctx 带无人值守标(`CheckpointCtx.unattendedLeg`)时递 `true` ——
+     *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
      *  按服务端写的 ctx 位递,绝不从请求体读。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";

package/dist/http/wire-types.d.ts

@@ -293,6 +293,14 @@ export interface TaskRequestBody {
      *  探测:本键在不在受理面由**键闭集**自己回答 —— 没接线的 server 版本对它 400 `request.body_shape`
      *  并逐字列名,所以**不加能力位**(一个键一条探测路,不长第二条)。 */
     excludeAllTools?: boolean;
+    /** S-946(cli L-920 请托;CC 2.1.280 `--disable-slash-commands`「Disable all skills」,cli280.js:240760 整张命令表置空):
+     *  **这一发一只技能都不装** —— 场景出厂技能(启动期烤入 + 中心下发)、调用方 `skills`、子代定义的 `agents[].skills`
+     *  一个都不进 `TaskSpec`。`true` ⇒ `TaskSpec.skills = []`(core 对空表:零 `<skills>` 块、`Skill` 工具不挂);
+     *  `false` / 缺席 = 技能照旧。值形门与 {@link excludeAllTools} **同一只**(非 boolean ⇒ 400 `request.field_invalid`);
+     *  与非空 `skills` 或任一非空 `agents[].skills` 同带 ⇒ 400 `request.field_conflict`(体内自相矛盾,拒在受理门)。
+     *  续跑重放逐字重放存量体 ⇒ 同一只写点同判(坏形 defensive:只认 literal `true`)。无租户门(收窄,不跨租户)。
+     *  探测位 `GET /v1/capabilities` 的 `disableSkills`(与本键同一个词)。 */
+    disableSkills?: boolean;
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/leader/diffup.d.ts

@@ -27,6 +27,59 @@ export declare function buildUploadScript(p: {
 }): string;
 /** The objective suffix that makes the upload the worker's last task step (no URL through the model). */
 export declare function uploadStepSuffix(workDir: string): string;
+/**
+ * S-949 —— the INCREMENTAL upload loop's lifetime protocol (single writer; the wire only runs its two verbs).
+ *
+ * While a worker env lives, a background loop re-runs the staged upload script every {@link UPLOAD_LOOP_PERIOD_SEC}
+ * seconds, so the worker's fixed diff key tracks its latest COMMITTED progress and salvage survives an env hard-crash
+ * (#16 tail: run 019eca71's "4 commits vaporized"). The loop must NOT outlive the env: the pre-S-949 form
+ * (`nohup sh -c 'while true; …' &`) relied on "the pod dies, the loop dies", which holds only where the env IS a
+ * pod — on an env whose shell is the host's (`RemoteHostExecutionEnv`, core `NodeExecutionEnv`) teardown does not
+ * reap detached processes (by contract), and the loop became a ppid-1 orphan (254 of them on one box, 2026-10-01).
+ *
+ * ONE mechanism for every lane, carried entirely by the env's ordinary `exec` (no lane branch, no process-group or
+ * `/proc` assumption, never a signal to a pid that might have been reused):
+ *  - **run token** `.leader-upload-loop.gen` — the generation allowed to run. `start` draws the next number from
+ *    the monotonic counter `.leader-upload-loop.seq` (never reset by `stop` — a counter that restarted at 1 after a
+ *    `stop` past its bound would hand a fresh loop the generation of a revoked loop still finishing its upload, and
+ *    that one would carry on), writes it here BEFORE forking and hands it to the loop; the loop runs only while this
+ *    file still names its generation. So a later `start` (a resumed leg re-staging the same workspace) supersedes an
+ *    earlier loop, `stop` (which removes the file) ends every loop, and a workspace deleted out from under it ends it
+ *    too — the token check IS the loop's only exit, there is no second mechanism;
+ *  - **one pid file per generation** `.leader-upload-loop.pid.<gen>` — written by `start` right after the fork (the
+ *    wire awaits `start`, so it is on disk before any `stop` can run) and removed by that loop as it exits. `stop`
+ *    waits until no generation is left, so a superseded loop whose upload was still in flight at the re-stage is
+ *    waited for too (codex r1 F2). It only PROBES a pid (`kill -0`): a loop that died abnormally does not hold it up;
+ *  - **bounded uploads** — the loop runs each upload with a PUT time bound ({@link UPLOAD_LOOP_UPLOAD_MAX_SEC},
+ *    `curl --max-time`), so a hung object store cannot pin a revoked loop alive (codex r1 F1: on a host env that was
+ *    an orphan stuck in curl). `stopWaitSec` must exceed that bound plus one tick (the builder refuses otherwise);
+ *  - **ordering** — the loop checks the token right before every upload and runs it in the foreground, so once
+ *    `stop` returns 0 no loop upload of any generation is running or can start: the teardown belt upload that follows
+ *    is the last write to the diff key. A `stop` past its bound (a hung `git format-patch`, or a pid file whose pid
+ *    now belongs to someone else) exits non-zero — the wire warns and still runs the belt (dropping the belt would
+ *    lose the uncommitted-work capture it exists for).
+ */
+/** Seconds between two loop runs of the upload script. Single writer: the wire passes THIS constant; tests inject a
+ *  short period through {@link buildUploadLoopScript}'s parameter. Deliberately not a deployment knob. */
+export declare const UPLOAD_LOOP_PERIOD_SEC = 90;
+/** Where the loop script is staged — next to the upload script, same `workDir` rule. */
+export declare function uploadLoopScriptPath(workDir: string): string;
+/** The two lifecycle verbs the wire runs through the env's ordinary exec (closed set — `run` is the loop's own,
+ *  internal entry point and is never issued from outside). */
+export type UploadLoopVerb = "start" | "stop";
+/** The shell line for one lifecycle verb. `stop` revokes the run token FIRST and independently of the script (a loop
+ *  whose script file went missing still sees its token gone and exits), then lets the script's `stop` wait for it. */
+export declare function uploadLoopCommand(workDir: string, verb: UploadLoopVerb): string;
+/** The staged loop script (see the protocol note above). The three bounds are interpolated into the shell ⇒
+ *  validated here, fail-closed: positive integers, and `stopWaitSec > uploadMaxSec + 1` (stop outlasts one bounded
+ *  upload plus the loop's one-second tick — otherwise "stop returned ⇒ no upload in flight" would be false by
+ *  construction). */
+export declare function buildUploadLoopScript(p: {
+    workDir: string;
+    periodSec: number;
+    uploadMaxSec?: number;
+    stopWaitSec?: number;
+}): string;
 /**
  * Fetch the worker-uploaded patch over a presigned GET (control plane; creds stay adapter-held). Returns the
  * same result shape as pullDiff so merge consumes either path. 🔴 The presigned URL is a short-lived bearer

package/dist/leader/diffup.js

@@ -8,9 +8,10 @@ export function buildUploadScript(p) {
         "#!/bin/sh",
         "# leader diff-out (design/68 F2(a)) — exports this worker's branch as a patch series. Do not edit.",
         "set -e",
+        'case "$1" in ""|*[!0-9]*) M="" ;; *) M="--max-time $1" ;; esac',
         `cd ${p.repoDir}`,
         `git format-patch --stdout ${p.baseSha}..HEAD > ${p.workDir}/.leader-out.patch`,
-        `curl -fsS -X PUT -T ${p.workDir}/.leader-out.patch '${putUrl}'`,
+        `curl -fsS $M -X PUT -T ${p.workDir}/.leader-out.patch '${putUrl}'`,
         `echo leader-diff-uploaded`,
         "",
     ].join("\n");
@@ -18,6 +19,99 @@ export function buildUploadScript(p) {
 export function uploadStepSuffix(workDir) {
     return `\n\nMANDATORY FINAL STEP: after your final commit, run exactly: sh ${workDir}/.leader-upload.sh — it exports your branch diff for integration. Do not modify, inspect, or skip it; if it fails, fix your git state (commit your work) and run it again.`;
 }
+export const UPLOAD_LOOP_PERIOD_SEC = 90;
+const UPLOAD_LOOP_UPLOAD_MAX_SEC = 25;
+const UPLOAD_LOOP_STOP_WAIT_SEC = 30;
+export function uploadLoopScriptPath(workDir) {
+    return `${workDir}/.leader-upload-loop.sh`;
+}
+const uploadLoopTokenPath = (workDir) => `${workDir}/.leader-upload-loop.gen`;
+export function uploadLoopCommand(workDir, verb) {
+    const script = uploadLoopScriptPath(workDir);
+    switch (verb) {
+        case "start":
+            return `sh ${script} start`;
+        case "stop":
+            return `rm -f ${uploadLoopTokenPath(workDir)}; sh ${script} stop`;
+    }
+}
+export function buildUploadLoopScript(p) {
+    const uploadMaxSec = p.uploadMaxSec ?? UPLOAD_LOOP_UPLOAD_MAX_SEC;
+    const stopWaitSec = p.stopWaitSec ?? UPLOAD_LOOP_STOP_WAIT_SEC;
+    for (const [name, n] of [["periodSec", p.periodSec], ["uploadMaxSec", uploadMaxSec], ["stopWaitSec", stopWaitSec]]) {
+        if (!Number.isInteger(n) || n < 1)
+            throw new Error(`buildUploadLoopScript: ${name} must be a positive integer, got ${JSON.stringify(n)}`);
+    }
+    if (stopWaitSec <= uploadMaxSec + 1) {
+        throw new Error(`buildUploadLoopScript: stopWaitSec (${stopWaitSec}) must exceed uploadMaxSec (${uploadMaxSec}) + 1 — stop has to outlast one bounded upload plus the loop's tick`);
+    }
+    const script = uploadLoopScriptPath(p.workDir);
+    return [
+        "#!/bin/sh",
+        "# leader incremental upload loop (S-949) — re-runs .leader-upload.sh while this env lives. Do not edit.",
+        "# start: launch ONE detached loop (an earlier loop here sees its generation superseded and exits); record its pid.",
+        "# stop:  revoke the run token, then wait until no loop of any generation is left (uploads in flight finish first).",
+        "# run:   the loop itself (internal) — runs only while the token file still names its generation.",
+        `G=${uploadLoopTokenPath(p.workDir)}`,
+        `Q=${p.workDir}/.leader-upload-loop.seq`,
+        `P=${p.workDir}/.leader-upload-loop.pid`,
+        "stop_all() {",
+        '  rm -f "$G"',
+        "  i=0",
+        "  while :; do",
+        "    live=",
+        '    for f in "$P".*; do',
+        '      [ -f "$f" ] || continue',
+        "      p=",
+        '      read -r p 2>/dev/null < "$f"',
+        '      if [ -n "$p" ] && kill -0 "$p" 2>/dev/null; then live="$live $p"; else rm -f "$f"; fi',
+        "    done",
+        '    [ -z "$live" ] && return 0',
+        `    if [ "$i" -ge ${stopWaitSec} ]; then`,
+        `      echo "leader upload loop(s) still running ${stopWaitSec}s after the run token was revoked (pid$live)" >&2`,
+        "      return 1",
+        "    fi",
+        "    sleep 1",
+        "    i=$((i + 1))",
+        "  done",
+        "}",
+        'case "$1" in',
+        "start)",
+        '  command -v nohup >/dev/null 2>&1 || { echo "nohup not found — upload loop not started" >&2; exit 1; }',
+        "  g=0",
+        '  [ -f "$Q" ] && read -r g < "$Q"',
+        "  case $g in ''|*[!0-9]*) g=0 ;; esac",
+        "  g=$((g + 1))",
+        '  echo "$g" > "$Q"',
+        '  echo "$g" > "$G"',
+        `  nohup sh ${script} run "$g" </dev/null >/dev/null 2>&1 &`,
+        '  echo "$!" > "$P.$g"',
+        "  ;;",
+        "run)",
+        "  n=0",
+        '  while read -r g 2>/dev/null < "$G" && [ "$g" = "$2" ]; do',
+        `    if [ "$n" -ge ${p.periodSec} ]; then`,
+        "      n=0",
+        `      sh ${p.workDir}/.leader-upload.sh ${uploadMaxSec} >/dev/null 2>&1 || true`,
+        "    else",
+        "      sleep 1",
+        "      n=$((n + 1))",
+        "    fi",
+        "  done",
+        '  rm -f "$P.$2"',
+        "  exit 0",
+        "  ;;",
+        "stop)",
+        "  stop_all",
+        "  ;;",
+        "*)",
+        '  echo "usage: sh $0 start|stop" >&2',
+        "  exit 2",
+        "  ;;",
+        "esac",
+        "",
+    ].join("\n");
+}
 export async function fetchUploadedDiff(getUrl, opts = {}) {
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_DIFF_BYTES;
     const f = opts.fetchImpl ?? fetch;

package/dist/leader/leader.d.ts

@@ -16,7 +16,6 @@ import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
 import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
-import { type UnattendedLeg } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -68,11 +67,6 @@ export interface ProvisionedWorker {
 export interface LeaderDeps {
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
-    /** S-877 候裁 15 / 18 —— 本车道有手的 run 并进的无人值守腿(模式 = 运维旋钮 `UNATTENDED_PERMISSION_MODE`、写面 roots、模式释放写保护时的
-     *  写保护拒层),由 `wire.ts` 经 `createUnattendedLeg` 铸一次递进来。本文件自己起的有手 run(模块门修复)与 `repair-wire.ts` 的单代理修复环按
-     *  `sub.spec` 起 run、不经 provisionWorker —— 两处都经 `withUnattendedLeg` 并进这一份。**必填**(缺席 = core「Absent = default」⇒ 无人可答的腿上
-     *  写与非只读命令被当场拒,codex F1 的病)。 */
-    unattendedLeg: UnattendedLeg;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */
     provisionWorker: (sub: SubtaskSpec) => Promise<ProvisionedWorker>;
     /** Ephemeral no-creds integration sandbox + the credentialed Coordinator push (merge(b) deps). */

package/dist/leader/leader.js

@@ -201,7 +201,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.unattendedLeg)).result();
+                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` })).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.unattendedLeg);
+            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId });
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,4 +1,4 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type PermissionMode } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -19,14 +19,6 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
-    /**
-     * S-877 候裁 15 → B —— 本车道**有手**的每一条 run(worker 两车道、集成沙箱修复、模块门修复、单代理修复环)的
-     * `TaskSpec.permissionMode`。**必填**:缺席 = core「Absent = `default`」⇒ 写与非只读命令在无人可答的这条腿上被
-     * headless 当场拒(codex F1 的病);必填让每一个构造本配置的地方都得表态,不许静默落回那一形。
-     * 唯一取值点 = `boot/leader.ts` 调 `unattendedPermissionMode(config)`(`src/unattended-permission-mode.ts`,与 run-local 同一只);
-     * 本文件经 `createUnattendedLeg` / `withUnattendedLeg` 铸并(模式 + 写面 roots + 候裁 18 的写保护拒层)。planner 路由无手,不读。
-     */
-    unattendedPermissionMode: PermissionMode;
     /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
      *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
      *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's
@@ -165,7 +157,8 @@ export interface LeaderWireConfig {
 /** The env surface wire needs (both the E2B and k8s adapters implement core's RemoteExecutionEnv). */
 type WireEnv = Pick<RemoteExecutionEnv, "exec" | "writeFile">;
 /**
- * [ref] —— leader 自铸沙盒的**回收闸**(集成沙盒 / repair-loop grader 各一只)。
+ * [ref] —— leader 自铸沙盒的**回收闸**(集成沙盒 / repair-loop grader 各一只;判据本身 S-949 起抽成下方
+ * {@link assertLeaderOwnedEnvReapable},worker 腿同判)。
  *
  * core 契约:`ExecutionEnv` 基面**没有** `destroy`;只有实现了 `RemoteExecutionEnv` 的适配器才有
  * (`core/remote-env.d.ts`),而「这只 env 到底有没有」是**运行期结构事实**,core 自己也只用结构探测

package/dist/leader/wire.js

@@ -5,13 +5,13 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
-import { createUnattendedLeg, withUnattendedLeg } from "../unattended-permission-mode.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
 import { gitSubprocessEnv } from "../server-secret-env.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
-import { buildUploadScript, uploadStepSuffix, fetchUploadedDiff, withStaging } from "./diffup.js";
+import { buildUploadScript, buildUploadLoopScript, uploadLoopCommand, uploadLoopScriptPath, uploadStepSuffix, fetchUploadedDiff, withStaging, UPLOAD_LOOP_PERIOD_SEC } from "./diffup.js";
 import { pullDiff, safeRev } from "./diffout.js";
 import { runLeaderTask } from "./leader.js";
 import { attachRepairLoopDeps } from "./repair-wire.js";
@@ -37,10 +37,13 @@ const asIntegrationEnv = (env) => ({
         throw r.error; },
 });
 export function createEnvReaper(env, what) {
+    assertLeaderOwnedEnvReapable(env, what);
+    return async () => void (await env.destroy());
+}
+function assertLeaderOwnedEnvReapable(env, what) {
     if (!hasDestroy(env)) {
-        throw new Error(`${what}: the execution-env factory returned an env with no destroy() — the leader OWNS this dedicated sandbox and this closure is its only teardown, so it would leak (and keep billing) until the backend's own timeout reaps it. Deploy a factory whose env implements RemoteExecutionEnv.destroy for the leader lane.`);
+        throw new Error(`${what}: the execution-env factory returned an env with no destroy() — the leader OWNS this dedicated sandbox and destroy() is its only teardown (the leader's own reaper for the integration / grader sandboxes; core's run teardown for a worker, where the staged incremental-upload loop and the belt upload ride it), so without it the sandbox and whatever the leader started inside it leak until the backend's own timeout reaps them — and a host-shell env has no such timeout. Deploy a factory whose env implements RemoteExecutionEnv.destroy for the leader lane.`);
     }
-    return async () => void (await env.destroy());
 }
 export async function stageWorkerEnv(env, opts) {
     const { seedCmd, repo, branch, uploadScriptPath, uploadScript } = opts;
@@ -133,13 +136,32 @@ export function createCoordinatorPush(durableRemote, targetRef, ident) {
 export function createLeaderRunner(cfg) {
     const W = cfg.workspace ?? "/home/user";
     const repo = `${W}/repo`;
+    const uploadLoopScript = buildUploadLoopScript({ workDir: W, periodSec: UPLOAD_LOOP_PERIOD_SEC });
+    const startUploadLoop = async (env, workerId) => {
+        try {
+            const wr = await env.writeFile(uploadLoopScriptPath(W), uploadLoopScript);
+            if (!wr.ok)
+                throw wr.error;
+            await sh(env)(uploadLoopCommand(W, "start"));
+        }
+        catch (e) {
+            cfg.logger?.warn?.("leader_upload_loop_start_failed", { workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+        }
+    };
+    const stopUploadLoop = async (env, workerId) => {
+        try {
+            await sh(env)(uploadLoopCommand(W, "stop"));
+        }
+        catch (e) {
+            cfg.logger?.warn?.("leader_upload_loop_stop_failed", { workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+        }
+    };
     const ident = cfg.git ?? { name: "leader", email: "leader@local" };
     const { leaderTimeoutMs, workerLimits, presignTtlSec, resourceSuspend: resourceCfg } = leaderResourceConfig();
     const { repairRounds, repairBudgetUsd, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds });
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
-    const unattendedLeg = () => createUnattendedLeg(cfg.unattendedPermissionMode, deploymentPostureSeat());
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
@@ -176,7 +198,7 @@ export function createLeaderRunner(cfg) {
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    }, unattendedLeg()))
+                    }))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -311,7 +333,7 @@ export function createLeaderRunner(cfg) {
                 const script = buildUploadScript({ repoDir: repo, baseSha, putUrl, workDir: W });
                 const stage = async (env) => {
                     await stageWorkerEnv(env, { seedCmd, repo, branch: sub.branch, uploadScriptPath: `${W}/.leader-upload.sh`, uploadScript: script });
-                    void sh(env)(`nohup sh -c 'while true; do sleep 90; sh ${W}/.leader-upload.sh >/dev/null 2>&1 || true; done' </dev/null >/dev/null 2>&1 &`).catch(() => { });
+                    await startUploadLoop(env, sub.workerId);
                 };
                 return {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
@@ -320,12 +342,17 @@ export function createLeaderRunner(cfg) {
                         brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
-                        executionEnvFactory: async (ctx) => withStaging(await envFactory(ctx), stage, async (e) => {
-                            await sh(e)(`cd ${repo} && git add -A && git -c user.name='leader-belt' -c user.email='belt@leader' commit -qm 'belt: auto-commit uncommitted worker output' || true; sh ${W}/.leader-upload.sh`);
-                        }),
+                        executionEnvFactory: async (ctx) => {
+                            const env = await envFactory(ctx);
+                            assertLeaderOwnedEnvReapable(env, "leader worker sandbox");
+                            return withStaging(env, stage, async (e) => {
+                                await stopUploadLoop(e, sub.workerId);
+                                await sh(e)(`cd ${repo} && git add -A && git -c user.name='leader-belt' -c user.email='belt@leader' commit -qm 'belt: auto-commit uncommitted worker output' || true; sh ${W}/.leader-upload.sh`);
+                            });
+                        },
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, unattendedLeg()),
+                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -340,7 +367,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, unattendedLeg()),
+                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -382,7 +409,6 @@ export function createLeaderRunner(cfg) {
         const deps = {
             plan,
             provisionWorker,
-            unattendedLeg: unattendedLeg(),
             provisionIntegrationSandbox,
             push,
             testCmd: body.testCmd,

package/dist/memory-store-refusal.d.ts

@@ -8,7 +8,8 @@
  *
  * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
  *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
- *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,一处字面量)。
+ *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
+ *     `http/memory-compliance-failure-reply.ts`(合规面两受众的那一只;会话所有者受众换固定句,S-930)。
  *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
  *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
  *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**

package/dist/model-entry-headers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * 白名单 = 名字 → 读它的线路(闭集;**加一个名字 = 加一行并写明哪条线路读它、为什么是部署的事**)。
+ * `anthropic-beta`:Anthropic Messages 的 beta 开关(逗号分隔的 beta 名;core anthropic 腿会把自己的 beta 并进同一个头)。
+ */
+export declare const CATALOG_ENTRY_HEADER_LANES: {
+    readonly "anthropic-beta": readonly ["anthropic-messages"];
+};
+export type CatalogEntryHeaderName = keyof typeof CATALOG_ENTRY_HEADER_LANES;
+export declare const CATALOG_ENTRY_HEADER_NAMES: readonly CatalogEntryHeaderName[];
+/** 判过的袋(只含白名单里的名字,值逐字)。 */
+export type CatalogEntryHeaders = Readonly<Partial<Record<CatalogEntryHeaderName, string>>>;
+/** 值的长度上界(字符)。`anthropic-beta` 的真实值是几枚逗号分隔的 beta 名,远在此下;上界只挡「把别的东西塞进来」。 */
+export declare const MAX_HEADER_VALUE_CHARS = 1024;
+/**
+ * 拒因 / warn 里名字的回显尺:token 形、≤64、且脱敏器不改它 ⇒ 照写;否则固定占位(名字位也可能被塞进秘密,值更是从不回显)。
+ */
+export declare function displayHeaderName(name: string): string;
+/** 判决:`ok` ⇒ 判过的袋(`undefined` = 条目没声明任何头:缺席与 `{}` 同一个读法,都不铸键);否则 ⇒ 坏字段坐标 + 一句不带值的理由。 */
+export type CatalogEntryHeadersVerdict = {
+    readonly ok: true;
+    readonly headers: CatalogEntryHeaders | undefined;
+} | {
+    readonly ok: false;
+    readonly fields: readonly string[];
+    readonly issue: string;
+};
+/**
+ * **唯一判据**:条目的 `headers` 原值(`unknown`:承载形,不信类型)+ 条目的线路词原值(`api`;两条读腿恒补齐它,
+ * 绕过读腿的输入缺它 ⇒ 按「没有线路读它」拒 —— 判据与铸点读同一个原值,不另补一份 schema 缺省)。
+ * 整只判:任一名字 / 值不合 ⇒ 整只不收(留下好的那几个 = 让运维以为整袋生效了)。坏字段逐个列出(`headers.<名>`)。
+ */
+export declare function readCatalogEntryHeaders(raw: unknown, api: unknown): CatalogEntryHeadersVerdict;
+/**
+ * **唯一铸点**(`toModel` 调):判过的袋 → `Model.headers` 的键。缺席 ⇒ 不铸键(一个 `undefined` 值的键也不铸:
+ * 缺席只有一种拼法)。判不过 ⇒ **抛**:到这里的条目已经过 S-704 逐条判据(判不过的进 `modelRefusals`、到不了 `toModel`),
+ * 抛 = 两处判据分叉了,stage 整候选拒、响亮,不静默丢头。
+ */
+export declare function buildModelHeadersKey(entryName: string, raw: unknown, api: unknown): {
+    headers?: Record<string, string>;
+};
+//# sourceMappingURL=model-entry-headers.d.ts.map

package/dist/model-entry-headers.js

@@ -0,0 +1,61 @@
+import { redactSecrets } from "./trace/redact.js";
+export const CATALOG_ENTRY_HEADER_LANES = {
+    "anthropic-beta": ["anthropic-messages"],
+};
+export const CATALOG_ENTRY_HEADER_NAMES = Object.keys(CATALOG_ENTRY_HEADER_LANES);
+export const MAX_HEADER_VALUE_CHARS = 1024;
+const HEADER_VALUE_SHAPE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
+const HEADER_NAME_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
+export function displayHeaderName(name) {
+    return HEADER_NAME_TOKEN.test(name) && redactSecrets(name) === name ? name : "(unprintable header name)";
+}
+function isCatalogEntryHeaderName(name) {
+    return Object.hasOwn(CATALOG_ENTRY_HEADER_LANES, name);
+}
+export function readCatalogEntryHeaders(raw, api) {
+    if (raw === undefined)
+        return { ok: true, headers: undefined };
+    const proto = typeof raw === "object" && raw !== null ? Object.getPrototypeOf(raw) : undefined;
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw) || (proto !== Object.prototype && proto !== null)) {
+        return { ok: false, fields: ["headers"], issue: `headers: expected a plain object of { <header name>: <value> } (allowed names: ${CATALOG_ENTRY_HEADER_NAMES.join(", ")})` };
+    }
+    const fields = [];
+    const issues = [];
+    const bag = {};
+    for (const name of Object.keys(raw)) {
+        const shown = displayHeaderName(name);
+        const field = `headers.${shown}`;
+        const value = Reflect.get(raw, name);
+        if (!isCatalogEntryHeaderName(name)) {
+            const canonical = CATALOG_ENTRY_HEADER_NAMES.find((n) => n === name.toLowerCase());
+            fields.push(field);
+            issues.push(canonical !== undefined
+                ? `${field}: write the header name in its canonical spelling "${canonical}" (one spelling per header)`
+                : `${field}: not in the closed allowlist of catalog request headers (${CATALOG_ENTRY_HEADER_NAMES.join(", ")}); credentials ride sealedApiKey / apiKeyEnv, never a header`);
+            continue;
+        }
+        const lanes = CATALOG_ENTRY_HEADER_LANES[name];
+        if (typeof api !== "string" || !lanes.includes(api)) {
+            fields.push(field);
+            issues.push(`${field}: only read on the ${lanes.join(" / ")} lane — this entry ${typeof api === "string" ? `is api "${api}"` : "declares no api"}, where the header would be sent and do nothing`);
+            continue;
+        }
+        if (typeof value !== "string" || value.length > MAX_HEADER_VALUE_CHARS || !HEADER_VALUE_SHAPE.test(value)) {
+            fields.push(field);
+            issues.push(`${field}: the value must be a non-empty string of visible ASCII (spaces only between words, at most ${MAX_HEADER_VALUE_CHARS} characters)`);
+            continue;
+        }
+        bag[name] = value;
+    }
+    if (fields.length > 0)
+        return { ok: false, fields: [...new Set(fields)], issue: issues.join("; ") };
+    return { ok: true, headers: Object.keys(bag).length > 0 ? bag : undefined };
+}
+export function buildModelHeadersKey(entryName, raw, api) {
+    const verdict = readCatalogEntryHeaders(raw, api);
+    if (!verdict.ok) {
+        throw new Error(`catalog entry "${entryName}" reached the Model mint with unjudged headers (${verdict.fields.join(", ")}) — judgeCatalogEntry must refuse it first; this is a server defect, not a config error`);
+    }
+    return verdict.headers === undefined ? {} : { headers: { ...verdict.headers } };
+}
+//# sourceMappingURL=model-entry-headers.js.map

package/dist/model-entry-refusal.d.ts

@@ -43,9 +43,15 @@ export interface CatalogEntryLike {
     readonly name: string;
     readonly id: string;
     readonly provider: string;
+    /** S-931:线路词(`headers` 的线路判据读它;原值,不信这张型)。 */
+    readonly api?: unknown;
+    /** S-931:供应商附加头的承载形(`unknown`:判据在 `model-entry-headers.ts`,不信这张型)。 */
+    readonly headers?: unknown;
 }
 /**
  * **逐条判据**:`undefined` = 本部署能完整服务它。判序即语义:先形(不合形的条目谈不上走哪条腿),再腿。
+ * 形分两段、同一个码(`config.model_entry_invalid`):settings-schema 的 `ModelEntry`,再是 S-931 的 `headers`(白名单 + 线路 + 值形,
+ * 判据单属主 `model-entry-headers.ts`;settings-schema 6.3.0 的 `ModelEntry` 还没有这个键 —— 候裁加字段,届时词表不另抄)。
  *
  * 形判的属主是 settings-schema 的 `ModelEntry`(两条读腿用的就是它)—— 本仓不手抄任何一条字段规则;这里只是
  * 在第二道边界(绕过读腿的输入)上**再问一次同一个属主**,并把答案变成一条带码的拒因。只取 `success` 与 issue