@sema-agent/server 7.113.0 → 7.114.0

package/dist/hooks/hook-runner.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
 import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
@@ -57,7 +58,9 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
-const NAME_ALTERNATION = /^[A-Za-z0-9_-]+(?:\|[A-Za-z0-9_-]+)*$/;
+export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
+export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 100;
+const MATCHER_UNJUDGED_TAG = "server.hooks.matcher-unjudged";
 function matcherReadsWireToolName(event) {
     return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
 }
@@ -77,25 +80,85 @@ function engineToolAliases() {
     engineToolAliasTable = table;
     return table;
 }
-function deadAliasInMatcher(event, matcher) {
-    if (matcher === undefined || !matcherReadsWireToolName(event) || !NAME_ALTERNATION.test(matcher))
+let matcherEvalBox;
+function matcherPatternMatchesWithin(matcher, name, budget) {
+    const remaining = budget.deadlineMs - budget.now();
+    if (remaining <= 0)
+        return "over_budget";
+    matcherEvalBox ??= {
+        script: new vm.Script("matcherPatternMatches(matcher, name)"),
+        context: vm.createContext({ matcherPatternMatches, matcher: "", name: "" }),
+    };
+    matcherEvalBox.context.matcher = matcher;
+    matcherEvalBox.context.name = name;
+    try {
+        const verdict = matcherEvalBox.script.runInContext(matcherEvalBox.context, { timeout: Math.max(1, Math.ceil(remaining)) });
+        return verdict === true ? true : verdict === false ? false : "invalid";
+    }
+    catch (err) {
+        if (typeof err === "object" && err !== null && "code" in err && err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return "over_budget";
+        throw err;
+    }
+}
+function deadAliasInMatcher(matcher, depth, budget) {
+    if (matcher.length > MAX_MATCHER_EVAL_CHARS)
+        return { kind: "unjudged", reason: "oversize" };
+    if (matcher === "" || matcher === "*")
+        return undefined;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined) {
+        for (const [alias, canonical] of engineToolAliases()) {
+            if (names.includes(alias) && !names.includes(canonical))
+                return { kind: "dead", alias, canonical };
+        }
         return undefined;
-    const branches = matcher.split("|");
-    const aliases = engineToolAliases();
-    for (const branch of branches) {
-        const canonical = aliases.get(branch);
-        if (canonical !== undefined && !branches.includes(canonical))
-            return { alias: branch, canonical };
+    }
+    switch (depth) {
+        case "literal":
+            return undefined;
+        case "regex":
+            break;
+        default: {
+            const unreachable = depth;
+            return unreachable;
+        }
+    }
+    const selects = (name) => {
+        const verdict = matcherPatternMatchesWithin(matcher, name, budget);
+        return verdict === "invalid" ? "invalid_regex" : verdict;
+    };
+    for (const [alias, canonical] of engineToolAliases()) {
+        const selectsAlias = selects(alias);
+        if (typeof selectsAlias === "string")
+            return { kind: "unjudged", reason: selectsAlias };
+        if (!selectsAlias)
+            continue;
+        const selectsCanonical = selects(canonical);
+        if (typeof selectsCanonical === "string")
+            return { kind: "unjudged", reason: selectsCanonical };
+        if (!selectsCanonical)
+            return { kind: "dead", alias, canonical };
     }
     return undefined;
 }
-export function deadToolMatcherIssue(config) {
+export function deadToolMatcherIssue(config, depth, budget = {}) {
+    const now = budget.now ?? (() => performance.now());
+    const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
     for (const [event, groups] of Object.entries(config)) {
+        if (!matcherReadsWireToolName(event))
+            continue;
         for (const group of groups ?? []) {
-            const dead = deadAliasInMatcher(event, group.matcher);
-            if (dead) {
-                return `settings.hooks.${event}: matcher "${dead.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${dead.canonical}"`;
+            if (group.matcher === undefined)
+                continue;
+            const verdict = deadAliasInMatcher(group.matcher, depth, deadline);
+            if (verdict === undefined)
+                continue;
+            if (verdict.kind === "unjudged") {
+                recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
+                continue;
             }
+            return `settings.hooks.${event}: matcher "${verdict.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${verdict.canonical}"`;
         }
     }
     return undefined;
@@ -144,9 +207,31 @@ export function parseHooksConfig(raw) {
     }
     return { config };
 }
-export function hookMatcherMatches(matcher, value) {
-    if (matcher === undefined || matcher === "" || matcher === "*")
-        return true;
+export function matcherLiteralNames(matcher) {
+    const names = [];
+    let first = -1;
+    let last = -1;
+    for (let i = 0; i <= matcher.length; i++) {
+        const c = i < matcher.length ? matcher.charCodeAt(i) : 0x7c;
+        if (c === 0x7c || c === 0x2c) {
+            if (first !== -1)
+                names.push(matcher.slice(first, last + 1));
+            first = -1;
+            last = -1;
+            continue;
+        }
+        if (c === 0x20)
+            continue;
+        const nameChar = (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
+        if (!nameChar)
+            return undefined;
+        if (first === -1)
+            first = i;
+        last = i;
+    }
+    return names;
+}
+function matcherPatternMatches(matcher, value) {
     if (matcher === value)
         return true;
     try {
@@ -156,6 +241,14 @@ export function hookMatcherMatches(matcher, value) {
         return "invalid";
     }
 }
+export function hookMatcherMatches(matcher, value) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return true;
+    const names = matcherLiteralNames(matcher);
+    if (names !== undefined)
+        return names.includes(value);
+    return matcherPatternMatches(matcher, value);
+}
 export function hookIfMatches(cond, payload) {
     if (cond.length > 500 || (cond.match(/\*/g)?.length ?? 0) > 16)
         return "unevaluable";

package/dist/hosted-posture.d.ts

@@ -13,8 +13,8 @@
  *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
  *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
  *    (异源复核实测,别照「它们都一样」写):
- *     · `settings.hooks` —— `boot/resolve-spec.ts` 的 hooks 臂,判据**只有** `config.requirePrincipal === true`
- *       ⇒ 忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调),判据**只有**
+ *       `requirePrincipal !== true` ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
  *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
  *       (= `provider === "host" ∧ requirePrincipal !== true`);
  *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而

package/dist/http/admission.js

@@ -2,7 +2,7 @@ import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -200,7 +200,7 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
-                const deadMatcher = deadToolMatcherIssue(hooksParsed.config);
+                const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (deadMatcher !== undefined) {
                     sendError(res, 400, "request.field_invalid", deadMatcher);
                     return null;

package/dist/http/routes/capabilities.js

@@ -24,7 +24,7 @@ import { projectApprovalsStreamLiveCapability } from "../../capabilities/approva
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../../task-settings.js";
+import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { sessionBackgroundFacesAvailable } from "./background.js";
 function routePairingOf(deps, name, m) {
@@ -121,7 +121,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: deps.config.requirePrincipal !== true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,

package/dist/observability/corrupt-read-seat.d.ts

@@ -43,9 +43,9 @@ export declare function createCorruptReadFailOpenSeat(tag: FailOpenTag, leg?: (i
  *
  * ## 逐命中响亮不降级
  * 这一座里有安全轴的脸(session-policy),所以每命中一行 warn 保留(降成「每进程一次」是降级,S-990 的裁定);**在此之上**,认出的脸另记账:
- *  · session-policy 脸 ⇒ `P-DEBT` tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。该脸的方向是 fail-open
- *    (core 原装店读不出规则文件 ⇒ 披露后答「没有会话规则」放行,而会话规则只许收紧 ⇒ 被丢掉的恰是调用方加的收紧;SQL 孪生同形则响亮抛)。
- *    放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只登债、不改放行**;
+ *  · session-policy 脸 ⇒ `P-DEBT` tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒,
+ *    但枚举 / 别的会话抹除 / 数据根重绑三张脸仍按「无规则」(会话规则只许收紧 ⇒ 丢的恰是收紧);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的按键读)。
+ *    别的会话抹除的常见形 core **不披露** ⇒ 这一形座上数不到,只能在 CENSUS / CHANGELOG 披露。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只登债、不改放行**;
  *  · 其余脸 ⇒ 不计(见 {@link DurableAbsenceFace})。
  * 记账**先于** warn:记账是总函数,warn 可能抛(core 的 guard 会吞掉那个抛),一次日志故障不许吃掉计数。
  *

package/dist/observability/corrupt-read-seat.js

@@ -85,10 +85,11 @@ export function createDurableAbsenceSeat(warn, root, thirdFace) {
     };
 }
 function buildDurableAbsenceNote(thirdFace) {
-    return ("a durable read was treated as ABSENT because the bytes were unreadable (never a plain ENOENT). " +
-        "Consequence depends on which store read it: session-policy = that run lost its SUBTRACTIVE session-rule " +
-        "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
-        `rows; ${thirdFace}. Inspect the named path before deciding.`);
+    return ("a durable read hit unreadable bytes (never a plain ENOENT). " +
+        "Consequence depends on which store read it: session-policy = a keyed read (a task's session rules, GET/PUT .../policy) was REFUSED " +
+        "(the run fails with code \"corrupt\"), but enumeration (session sync export), another session's erase sweep and a data-root rebind still " +
+        "read that row as NO RULES — fix or delete the named file (deleting it means no session rules); session repo = a listing silently " +
+        `omitted rows; ${thirdFace}. Inspect the named path before deciding.`);
 }
 const RULE_LANE_REMEDY = "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";
 export const JSONL_REPLAY_SEATS = {

package/dist/observability/fail-open.d.ts

@@ -209,6 +209,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "#310:`engine_notice` 分流器把一条白名单通告投给某条 run 腿的登记口时,那只口抛了(live 口写向已断/已撕裂的 SSE socket,或 durable 口的账本写同步抛)。放行的最坏后果 = **这一条通告的这一个终点**缺席:①日志终点在分流之前已经逐字打过(事实一条不丢);②两个终点注册成两只独立 sink ⇒ live 抛不牵连 durable(断连后仍看得见的那半保住);③同会话其余口照投。故 F 类。不放行的代价是把异常回抛给 core 的 `deliverEngineNotice` —— 它会吞掉,于是同一次失败**既没有留痕也没有第二只口**,正是本 tag 要根除的形。留痕是承重的:静默吞掉之后「wire 腿为什么总有几条通告不到」在遥测里与「core 本来就没发」同形。";
     };
+    readonly "server.hooks.matcher-unjudged": {
+        readonly cls: "F";
+        readonly note: "S-995(`hooks/hook-runner.ts` 的 `deadToolMatcherIssue`,fresh 受理面「工具事件 matcher 选中别名而选不中正名 ⇒ 400」判据的**未判**臂;detail = `event=… reason=… matcherChars=…`,不带 matcher 原字节):一只 matcher 没能被判 ⇒ 照旧受理。判据一条顺序、两档共用(7.114.0 修复轮):长度上限 → 空 / `*` → 字面读法(两档都先走、不占预算)→ 正则形。三种 reason 同一个 tag —— `oversize`(两档:超 8 192 字符不读;多租户车道上 hooks 不装配,这一笔只为让超长输入显形)/ `over_budget`(regex 档正则形:一次受理共享的 100 ms 墙钟预算用尽,`node:vm` 的 timeout 打断正则回溯)/ `invalid_regex`(regex 档正则形编不过;确定性的坏配置,运行期另记 `hook_matcher_invalid`,拒它是新检测臂、不在本规则)。**不记**的:literal 档(多租户车道)遇正则形 = 不适用 —— 该车道 hooks 整只不装配,没有被守的对象,不是未判。放行的最坏后果 = **那一只 matcher 没被这条判据守住**:它若真写了别名,照旧永不命中(7.112.0 对正则形一律不判,同一后果);**不是安全闸**(受理面的有效性判 = S-924 的「响亮」,决定不了任何放行 / 拒绝 / 权限;hook 的 deny 语义在运行期 hook-runner)。反方向(越界即拒)会把负载抖动 / 病态但合法的 matcher 变成对合法请求的 400。拒放集合相对 7.113.0 的一处放宽:超过上限的字面别名 matcher 7.113.0 拒、7.114.0 两档未判受理(已披露)。计数让「受理面一直判不了」(攻击者喂灾难正则 / 超长 matcher)显形。";
+    };
     readonly "server.hooks.notice-sink-threw": {
         readonly cls: "F";
         readonly note: "#281:hook 观测回调(`onHookNotice`,部署把它接到 fleet 流)自己抛了。放行的最坏后果 = **这一条观测帧**缺席;补偿是结构性的:①日志终点在投递之前就已逐字落定(`hook_command_failed` / `hook_command_timeout` / `hook_command_spawn_failed` 一族),运维面零回退;②观测帧不参与任何门/裁决(纯 observe,#281 全族判据里「裁决面一个字节不动」是承重条款),故 F 类。不放行的代价严重不对称:异常会掀回 core 的 hook 回调栈,把一次**观察动作**变成一次**工具调用失败** —— 「观察一件事的动作反过来改变了那件事」正是本 tag 要根除的形,而它伤的恰恰是 hook 已经坏掉、用户最需要任务照跑的那一刻。留痕承重:静默吞掉之后「这台机器为什么一条 hook 通知都没有」在遥测里与「hook 从来没坏过」同形。";
@@ -367,7 +371,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.session-policy.corrupt-read-fail-open": {
         readonly cls: "P-DEBT";
-        readonly note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)读不出 ⇒ core 原装 `FileSessionPolicyStore.read` 披露后 `return null` ⇒ 引擎按「没有会话规则」放行,而会话规则**只许收紧**(非 operator 写入遇放宽即拒)⇒ 被丢掉的恰是调用方加的那层收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**:SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛、体读不出形走 `SessionPolicyError(\"corrupt\")`(CENSUS 第 81 行 P 终态 fail-closed)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层(请托帖 [8906] 已发,core 认领 #1299([8908],7.39.2 patch) core),所以只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留、放行行为一格不改(🚧 钉 `test/corrupt-read-f-seats-s990.test.ts`)。**出路 = core 把该面改成 fail-closed,届时撤本 tag**。计数非零 = 有会话的收紧规则文件坏了而该会话正按「无规则」运行,运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。";
+        readonly note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;但 core 包内 CHANGELOG 自陈另三张脸仍把坏行读成「无规则」:① `listBySession` 跳过坏行(会话同步导出读它 ⇒ 导出里没有这位 principal 的规则,目标端按无规则跑);② 别的会话的 `deleteBySession` 把撕尾行一并扫掉(常见形**不披露**),此后按键读得 ENOENT = 无规则;③ 数据根重绑把撕尾行留在旧键下。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读(那一发本身是 fail-closed);② 的常见形 core 不披露,座上**数不到**。**出路 = core 把三张脸也改成拒,届时撤本 tag**。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。";
     };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -200,6 +200,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "#310:`engine_notice` 分流器把一条白名单通告投给某条 run 腿的登记口时,那只口抛了(live 口写向已断/已撕裂的 SSE socket,或 durable 口的账本写同步抛)。放行的最坏后果 = **这一条通告的这一个终点**缺席:①日志终点在分流之前已经逐字打过(事实一条不丢);②两个终点注册成两只独立 sink ⇒ live 抛不牵连 durable(断连后仍看得见的那半保住);③同会话其余口照投。故 F 类。不放行的代价是把异常回抛给 core 的 `deliverEngineNotice` —— 它会吞掉,于是同一次失败**既没有留痕也没有第二只口**,正是本 tag 要根除的形。留痕是承重的:静默吞掉之后「wire 腿为什么总有几条通告不到」在遥测里与「core 本来就没发」同形。",
     },
+    "server.hooks.matcher-unjudged": {
+        cls: "F",
+        note: "S-995(`hooks/hook-runner.ts` 的 `deadToolMatcherIssue`,fresh 受理面「工具事件 matcher 选中别名而选不中正名 ⇒ 400」判据的**未判**臂;detail = `event=… reason=… matcherChars=…`,不带 matcher 原字节):一只 matcher 没能被判 ⇒ 照旧受理。判据一条顺序、两档共用(7.114.0 修复轮):长度上限 → 空 / `*` → 字面读法(两档都先走、不占预算)→ 正则形。三种 reason 同一个 tag —— `oversize`(两档:超 8 192 字符不读;多租户车道上 hooks 不装配,这一笔只为让超长输入显形)/ `over_budget`(regex 档正则形:一次受理共享的 100 ms 墙钟预算用尽,`node:vm` 的 timeout 打断正则回溯)/ `invalid_regex`(regex 档正则形编不过;确定性的坏配置,运行期另记 `hook_matcher_invalid`,拒它是新检测臂、不在本规则)。**不记**的:literal 档(多租户车道)遇正则形 = 不适用 —— 该车道 hooks 整只不装配,没有被守的对象,不是未判。放行的最坏后果 = **那一只 matcher 没被这条判据守住**:它若真写了别名,照旧永不命中(7.112.0 对正则形一律不判,同一后果);**不是安全闸**(受理面的有效性判 = S-924 的「响亮」,决定不了任何放行 / 拒绝 / 权限;hook 的 deny 语义在运行期 hook-runner)。反方向(越界即拒)会把负载抖动 / 病态但合法的 matcher 变成对合法请求的 400。拒放集合相对 7.113.0 的一处放宽:超过上限的字面别名 matcher 7.113.0 拒、7.114.0 两档未判受理(已披露)。计数让「受理面一直判不了」(攻击者喂灾难正则 / 超长 matcher)显形。",
+    },
     "server.hooks.notice-sink-threw": {
         cls: "F",
         note: "#281:hook 观测回调(`onHookNotice`,部署把它接到 fleet 流)自己抛了。放行的最坏后果 = **这一条观测帧**缺席;补偿是结构性的:①日志终点在投递之前就已逐字落定(`hook_command_failed` / `hook_command_timeout` / `hook_command_spawn_failed` 一族),运维面零回退;②观测帧不参与任何门/裁决(纯 observe,#281 全族判据里「裁决面一个字节不动」是承重条款),故 F 类。不放行的代价严重不对称:异常会掀回 core 的 hook 回调栈,把一次**观察动作**变成一次**工具调用失败** —— 「观察一件事的动作反过来改变了那件事」正是本 tag 要根除的形,而它伤的恰恰是 hook 已经坏掉、用户最需要任务照跑的那一刻。留痕承重:静默吞掉之后「这台机器为什么一条 hook 通知都没有」在遥测里与「hook 从来没坏过」同形。",
@@ -337,7 +341,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.session-policy.corrupt-read-fail-open": {
         cls: "P-DEBT",
-        note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)读不出 ⇒ core 原装 `FileSessionPolicyStore.read` 披露后 `return null` ⇒ 引擎按「没有会话规则」放行,而会话规则**只许收紧**(非 operator 写入遇放宽即拒)⇒ 被丢掉的恰是调用方加的那层收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**:SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛、体读不出形走 `SessionPolicyError(\"corrupt\")`(CENSUS 第 81 行 P 终态 fail-closed)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层(请托帖 [8906] 已发,core 认领 #1299([8908],7.39.2 patch) core),所以只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留、放行行为一格不改(🚧 钉 `test/corrupt-read-f-seats-s990.test.ts`)。**出路 = core 把该面改成 fail-closed,届时撤本 tag**。计数非零 = 有会话的收紧规则文件坏了而该会话正按「无规则」运行,运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。",
+        note: "S-999(`observability/corrupt-read-seat.ts` 的 `createDurableAbsenceSeat`,`file_store_corrupt_read` 那只多脸座里认出的 **session-policy 脸**;local 车道,HTTP 服务的 local 腿与 run-local 同铸点):会话规则文件(数据根 `session-policy/` 下的行文件)坏了。core 7.39.2(#1299,本仓请托)起**按键读**(任务装规则、`GET` / `PUT /v1/sessions/:id/policy`)拒 —— `SessionPolicyError` 码 `corrupt`;但 core 包内 CHANGELOG 自陈另三张脸仍把坏行读成「无规则」:① `listBySession` 跳过坏行(会话同步导出读它 ⇒ 导出里没有这位 principal 的规则,目标端按无规则跑);② 别的会话的 `deleteBySession` 把撕尾行一并扫掉(常见形**不披露**),此后按键读得 ENOENT = 无规则;③ 数据根重绑把撕尾行留在旧键下。会话规则**只许收紧** ⇒ 丢的恰是调用方加的收紧(部署策略 / hooks / shell 门仍在)。方向 = fail-open,**明知不对**;SQL 孪生(`plugins/session-policy-store-sql.ts`)对同形响亮抛(CENSUS 第 81 行 P 终态)。归 P 类的理由是它决定权限门读到的规则层;归 DEBT 的理由是放行是 **core 的裁定**,源头修复纪律下本仓不包层,只让债在遥测里显形:计数逐次 + 探针行(`kind` / `path` / `sessionId` / `principal` / `reason`)+ 一次性 warn;逐命中 warn(`file_store_corrupt_read`)原样保留。⚠️ **如实全记**:座上分不出是哪一只读法披露的(载荷不带读法),所以这一脸的每一发都计 —— 含已被拒的按键读(那一发本身是 fail-closed);② 的常见形 core 不披露,座上**数不到**。**出路 = core 把三张脸也改成拒,届时撤本 tag**。计数非零 = 有会话的规则文件坏了:运维按探针里的 `sessionId` / `path` 去修(删文件即放弃那层规则,删前先看 `reason`)。认脸判据见 `durableAbsenceFaceOf`(披露路径落在本数据根的 `session-policy/` 之下);认不出的脸不计。7.114.0 合流时车 UY 曾以「core 已修」整只撤掉本 tag,修复轮恢复(那次删除未发版)。",
     },
     "server.outbound.connect-observer-threw": {
         cls: "F",

package/dist/plugins/remote-env-host.d.ts

@@ -419,39 +419,4 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
  */
 export declare function hostExecutionEnvFactory(config?: HostEnvConfig): ExecutionEnvFactory;
 export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, type LocalDockerEnvDeps, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-import { type LocalDockerEnvConfig, type LocalDockerEnvDeps } from "./remote-env-local-docker.js";
-/**
- * Config for the `remote-docker` provider: run each task in a container on a REMOTE docker daemon
- * (DUAL-MODE-DESIGN §5 — "a user-specified REMOTE host's docker"; registry-core `RemoteExecSpec`).
- *
- * It is {@link LocalDockerEnvConfig} with the endpoint made REQUIRED — that is the whole difference, by design:
- * the container adapter is already daemon-agnostic (workspace `mkdir`'d INSIDE the container, never a host
- * bind-mount; bytes over `docker cp` / `docker exec cat`, which stream through the daemon API), and the endpoint
- * rides as `-H <dockerHost>` on every invocation. So every local-docker knob (memory/cpus/pidsLimit/dropAllCaps/
- * network/timeouts/env/dockerPath) applies unchanged to the remote lane.
- */
-export interface RemoteDockerEnvConfig extends Omit<LocalDockerEnvConfig, "dockerHost" | "providerLabel"> {
-    /** Remote docker daemon endpoint (e.g. `tcp://host:2376` or `ssh://user@host`). REQUIRED for remote-docker. */
-    dockerHost: string;
-}
-/**
- * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
- * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
- * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
- *
- * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
- * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
- * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
- * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
- * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
- * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
- * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
- * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
- * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
- * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
- *
- * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
- * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
- */
-export declare function remoteDockerExecutionEnvFactory(config: RemoteDockerEnvConfig, deps?: LocalDockerEnvDeps): ExecutionEnvFactory;
 //# sourceMappingURL=remote-env-host.d.ts.map

package/dist/plugins/remote-env-host.js

@@ -1373,12 +1373,4 @@ export function hostExecutionEnvFactory(config = {}) {
     });
 }
 export { localDockerExecutionEnvFactory, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-import { localDockerExecutionEnvFactory } from "./remote-env-local-docker.js";
-export function remoteDockerExecutionEnvFactory(config, deps = {}) {
-    const dockerHost = config.dockerHost?.trim();
-    if (!dockerHost) {
-        throw new RemoteExecutionError("connect_failed", "remoteExec provider 'remote-docker' requires a non-empty dockerHost (the remote daemon endpoint, e.g. tcp://host:2376 or ssh://user@host) — use provider 'local-docker' for THIS machine's daemon");
-    }
-    return localDockerExecutionEnvFactory({ ...config, dockerHost, providerLabel: "remote-docker" }, deps);
-}
 //# sourceMappingURL=remote-env-host.js.map

package/dist/plugins/remote-env-local-docker.d.ts

@@ -27,19 +27,13 @@ export interface LocalDockerEnvConfig {
      * DOCKER_HOST override for the docker CLI (e.g. a non-default socket). Passed as `-H <value>` on EVERY docker
      * invocation (not the process env) so it can't leak / drift. Absent = the daemon DOCKER_HOST points at.
      *
-     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is exactly the DUAL-MODE-DESIGN §5
-     * **`remote-docker`** provider — see {@link remoteDockerExecutionEnvFactory} (remote-env-host.ts), which is
-     * this adapter with the endpoint required. Nothing else about the class is host-local: the workspace is
-     * `mkdir`'d INSIDE the container (never a bind-mount of a host path) and bytes move by `docker cp` /
-     * `docker exec cat`, which stream over the daemon API.
+     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is how a REMOTE docker daemon is used — the
+     * lane stays `local-docker` (`REMOTE_EXEC=local-docker` + `DOCKER_HOST`; the settings-schema lane table lists
+     * `DOCKER_HOST` as this lane's optional coordinate, and there is no separate `remote-docker` lane since 7.0.0).
+     * Nothing about the class is host-local: the workspace is `mkdir`'d INSIDE the container (never a bind-mount of a
+     * host path) and bytes move by `docker cp` / `docker exec cat`, which stream over the daemon API.
      */
     dockerHost?: string;
-    /**
-     * Provider NAME reported on the {@link WorkspaceHandle}. Default `"local-docker"`; the `remote-docker` arm
-     * passes `"remote-docker"` so a handle never mislabels which lane it is (the CLASS is shared — `remote-docker`
-     * IS this adapter aimed at a remote daemon). Cosmetic/observability only: it selects no behavior.
-     */
-    providerLabel?: string;
     /** Container memory limit (docker `--memory`, e.g. "2g"). Absent = no limit. */
     memory?: string;
     /** Container CPU limit (docker `--cpus`, e.g. 1.5). Absent = no limit. */
@@ -88,8 +82,6 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     private readonly spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     private readonly containerName;
-    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
-    private readonly providerName;
     /** Set once the container is up + the workspace dir created. */
     private containerId?;
     private handle?;

package/dist/plugins/remote-env-local-docker.js

@@ -24,7 +24,6 @@ export class RemoteLocalDockerExecutionEnv {
     cfg;
     spawnFn;
     containerName;
-    providerName;
     containerId;
     handle;
     destroyed = false;
@@ -47,7 +46,6 @@ export class RemoteLocalDockerExecutionEnv {
         const id = config.id ?? randomBytes(6).toString("hex");
         const suffix = randomBytes(4).toString("hex");
         this.containerName = `sema-docker-${sanitizeId(id)}-${suffix}`;
-        this.providerName = config.providerLabel?.trim() || PROVIDER;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
@@ -113,7 +111,7 @@ export class RemoteLocalDockerExecutionEnv {
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env destroyed during connect") };
         }
         this.containerId = run.value.stdout.trim() || this.containerName;
-        this.handle = { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+        this.handle = { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
         if (config?.secrets?.length) {
         }
         return ok(this.handle);
@@ -136,7 +134,7 @@ export class RemoteLocalDockerExecutionEnv {
         const insp = await this.docker(["inspect", "-f", "{{.State.Running}}", this.containerName], { timeoutMs: this.cfg.controlTimeoutMs });
         if (insp.ok && insp.value.exitCode === 0 && insp.value.stdout.trim() === "true") {
             this.containerId = this.containerName;
-            this.handle ??= { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+            this.handle ??= { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
             return ok(this.handle);
         }
         return { ok: false, error: new RemoteExecutionError("connect_failed", `container '${this.containerName}' is not running (gone or stopped) — no managed snapshot to resume`) };

package/dist/store-posture.d.ts

@@ -12,7 +12,7 @@
  * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
  * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
  */
-import { type DbBackendWord } from "./config-types.js";
+import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
@@ -25,23 +25,23 @@ import { type SqlEngineCapability } from "./sql-engine-posture.js";
 export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
 export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
 /** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
-export declare function storeDegradedReasonFor(declared: DbBackendWord): StoreDegradedReason;
+export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
 /** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
 export interface StorePosture {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly degradedReason?: StoreDegradedReason;
 }
 /** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
 export declare function buildStorePosture(a: {
-    readonly declared: DbBackendWord;
+    readonly declared: StoreBackendWord;
     readonly assembled: StoreBackend["kind"] | undefined;
     readonly degradedReason: StoreDegradedReason | undefined;
 }): StorePosture;
 /** caps `store` 的形。 */
 export interface StoreCapability {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly durable: boolean;
     readonly degradedReason?: StoreDegradedReason;
     /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出

package/dist/store-posture.js

@@ -1,4 +1,3 @@
-import {} from "./config-types.js";
 import { projectSqlEngineCapability } from "./sql-engine-posture.js";
 export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
 export function storeDegradedReasonFor(declared) {

package/dist/task-settings.d.ts

@@ -298,6 +298,19 @@ export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["addit
  *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
  */
 export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | null;
+/**
+ * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
+ * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
+ * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
+ *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
+ *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
+ * `test/hooks-alias-matcher-s995.test.ts` R5g 钉「三处都调它、没有内联判据」。
+ */
+export declare function taskHooksHonored(config: {
+    readonly requirePrincipal?: boolean;
+}): boolean;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
  * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE

package/dist/task-settings.js

@@ -158,6 +158,9 @@ export function taskSettingsKeyIssue(raw) {
         unsupportedKeys: unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+export function taskHooksHonored(config) {
+    return config.requirePrincipal !== true;
+}
 export function parseTaskSettings(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.113.0",
+  "version": "7.114.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -62,8 +62,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.39.1",
-    "@sema-agent/settings-schema": "6.4.0",
+    "@sema-agent/core": "7.39.2",
+    "@sema-agent/settings-schema": "7.0.1",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",