@sema-agent/server 7.117.0 → 7.119.0

package/dist/http/routes/sessions.js

@@ -1,9 +1,10 @@
-import { materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
+import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
-import { windowMessages, truncateMessageBlobs } from "../../audit.js";
+import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
@@ -13,7 +14,6 @@ import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
 const MCP_STATUS_TTL_MS = 5_000;
-const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
 const A2A_MATERIALIZE_TIMEOUT_MS = 10_000;
 const MEMORY_STATUS_TTL_MS = 5_000;
@@ -154,10 +154,7 @@ export async function handleSessions(req, res, match, ctx) {
                     mcpStatusCache.clear();
                 const panel = (async () => {
                     const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations);
-                    let timer;
-                    const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), MCP_MATERIALIZE_TIMEOUT_MS); })]);
-                    if (timer)
-                        clearTimeout(timer);
+                    const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
                         void matP.then((m) => m?.dispose().catch(() => undefined)).catch(() => undefined);
                         return { servers: [], asOf: new Date().toISOString(), degraded: true };
@@ -530,7 +527,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             catch (err) {
                 const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
-                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }))
+                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }, deps.logger))
                     return;
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
@@ -599,9 +596,13 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "the session audit view requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const audit = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
-            if (audit === undefined)
+            const owned = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
+            if (owned === undefined)
                 return;
+            if (!Array.isArray(owned.messages)) {
+                throw new SessionError("corrupt_session", `session ${match.params.sessionId} is unreadable: its archive projection carries "messages" as ${owned.messages === null ? "null" : typeof owned.messages}, not an array`);
+            }
+            const ownedMessages = owned.messages;
             const q = new URLSearchParams(match.search);
             const qi = (k) => {
                 const v = q.get(k);
@@ -612,12 +613,12 @@ export async function handleSessions(req, res, match, ctx) {
             };
             const msgIndex = qi("message");
             if (msgIndex !== undefined) {
-                const messages = audit.messages;
-                if (msgIndex >= messages.length) {
-                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: messages.length });
+                if (msgIndex >= ownedMessages.length) {
+                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: ownedMessages.length });
                     return;
                 }
-                sendJson(res, 200, { sessionId: audit.sessionId, floorEntryId: audit.floorEntryId, index: msgIndex, message: messages[msgIndex] });
+                const one = redactSessionViewForRead({ ...owned, messages: [ownedMessages[msgIndex]] });
+                sendJson(res, 200, { sessionId: owned.sessionId, floorEntryId: owned.floorEntryId, index: msgIndex, message: one.messages[0] });
                 return;
             }
             const tail = qi("tail");
@@ -634,19 +635,19 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const undrainedKey = undrained !== undefined ? { userInputUndrained: undrained } : {};
             if (tail === undefined && before === undefined && blobCap === undefined) {
-                sendJson(res, 200, { ...audit, ...undrainedKey });
+                sendJson(res, 200, { ...redactSessionViewForRead(owned), ...undrainedKey });
                 return;
             }
-            let messages = audit.messages;
+            let selected = ownedMessages;
             let window;
             if (tail !== undefined || before !== undefined) {
-                const w = windowMessages(messages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
-                messages = w.messages;
+                const w = windowMessages(ownedMessages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
+                selected = w.messages;
                 window = w.window;
             }
-            if (blobCap !== undefined && blobCap > 0)
-                messages = truncateMessageBlobs(messages, blobCap);
-            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}), ...undrainedKey });
+            const view = redactSessionViewForRead({ ...owned, messages: selected });
+            const messages = blobCap !== undefined && blobCap > 0 ? truncateMessageBlobs(view.messages, blobCap) : view.messages;
+            sendJson(res, 200, { ...view, messages, ...(window ? { window } : {}), ...undrainedKey });
             return;
         }
     }
@@ -759,7 +760,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             if (owner === null) {
-                sendError(res, 409, "conflict.session_ownerless", "session policy requires an owned session (set REQUIRE_PRINCIPAL / attach a principal); this session is ownerless");
+                sendError(res, 409, "conflict.session_ownerless", "this session has no recorded owner, so its rules can be neither read nor changed through this route; rules already stored for it keep applying to the runs of the principal they were stored under. Ways out: on the local backend, during the upgrade window, the first task submitted with a principal on a session written by an earlier version claims it for that principal (this route then serves its owner); or delete the session (DELETE /v1/sessions/:id), which removes its rules with it");
                 return;
             }
             const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);

package/dist/http/routes/workflows.js

@@ -254,6 +254,8 @@ function projectParkRow(p) {
         sessionId: p.sessionId,
         originRunId: p.originRunId,
         ...(p.originUnconfirmed === true ? { originUnconfirmed: true } : {}),
+        ...(p.parkedBy !== undefined ? { parkedBy: p.parkedBy } : {}),
+        ...(p.generation !== undefined ? { generation: p.generation } : {}),
     };
 }
 function summarizeWorkflowDetail(run) {

package/dist/http/wire-types.d.ts

@@ -6,8 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
-import type { SettingsPermissionMode } from "../task-settings.js";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -17,7 +16,9 @@ export interface TaskRequestBody {
      *  table — e.g. "default"/"code-review"/"scan"/"discuss"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
      *  `scenario_unknown`, a known-but-not-allowed one a typed 400 `scenario_not_allowed`; absent ⇒ the ruling's
-     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`).
+     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`). A name
+     *  on that default chain this deployment does not have is NEVER folded to `default`: an assigned one is a typed 503
+     *  `state.scenario_assignment_unknown`, a dangling `DEFAULT_SCENARIO` refuses to boot.
      *  ⚠️ scenario-SPECIFIC keys (`repo`/`lenses`/`rounds`, read through `ScenarioRequest`'s index signature) are
      *  deliberately NOT declared here — they belong to one scenario each, not to the shared submit surface. */
     scenario?: string;
@@ -333,18 +334,16 @@ export interface TaskRequestBody {
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
      *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only vs the
-     *  deployment baseline. Post-[ref] all FIVE modes are honored as gate-SHAPE choices (`plan` ⇒ read-only hands +
-     *  `present_plan`; `acceptEdits`/`bypassPermissions`/`auto` select how much the mode-derived fs-write ask gate
-     *  asks — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins; the old "LOOSEN →
-     *  coerced to default" note was pre-[ref] doc-rot). Folds onto the SAME tighten-only governance as
-     *  `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
+     *  deployment baseline. All SIX core modes are honored (`plan` ⇒ read-only hands + `present_plan`;
+     *  `acceptEdits` selects how much the mode-derived fs-write ask gate asks; `bypassPermissions`/`auto`/`dontAsk` ride the
+     *  engine's own mode table verbatim — `dontAsk` refuses every ask by the mode, zero cards, the gate records
+     *  `deniedBy:"mode"`) — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins). Folds onto the SAME
+     *  tighten-only governance as `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
      *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
-     *  (coercePermissionMode). */
-    /**  🔴 型**从值表派生**(S-496 U1 / [ref]):闭集的属主是 `task-settings.ts` 的
-     *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
-     *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
-    permissionMode?: SettingsPermissionMode;
+     *  (coercePermissionMode).
+     *  🔴 型与闭集的属主是 core 的 `PermissionMode` / `PERMISSION_MODES`(受理腿 `isPermissionMode` 与三句 400 文案同读那一份)—— 本仓不持词表。 */
+    permissionMode?: PermissionMode;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries
@@ -466,6 +465,11 @@ export interface TaskRequestBody {
      *  typeof read. Declared per [ref] 件1 ([ref] boundary-must-schema): the submit chain reads this key, and an
      *  undeclared read is a bare cast the exported type cannot audit (embedders could not even write it). */
     interactiveTools?: boolean;
+    /** core 7.43.0 `TaskSpec.approvalReach`: the run declares that NOBODY on it can be asked to approve (the only word: `"none"`; closed set and
+     *  predicate are core's `APPROVAL_REACH` / `isApprovalReach`). Passed to the spec untranslated (boot/resolve-spec.ts) and to the per-leg
+     *  interactive-posture judgment (an interactive posture beside it is refused by the engine); absent ⇒ key omitted (byte-identical); an
+     *  unreadable value is a 400 on submit (admission.ts). Not checkpointed by the engine ⇒ resume legs re-supply it from the persisted body. */
+    approvalReach?: ApprovalReach;
     /** The caller's per-request settings stamp (the client-side `SemaSettings` shape). The KEY SET is deliberately
      *  NOT mirrored here — a hand-written second shape on this interface would be the classic mirror-drift form.
      *  Per-key ownership is split, not single: `parseTaskSettings` (src/task-settings.ts) defensively owns the

package/dist/images/manifest.d.ts

@@ -6,7 +6,13 @@
  * one-time seed and the P3 atomic-publish pipeline — kept side-effect-free so it is unit-tested without a DB.
  */
 import type { ImageIndexUpsert, ImageNestedBuildMode, ImageStatus } from "../plugins/store-contracts.js";
-/** Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract). */
+/**
+ * Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract).
+ *
+ * 声明型 = 闭集词 | `true`(老写法的裸布尔,含义 = `rootless-buildkit`)| `false` / 缺席(= `none`)。**其余一律抛** —— 修前「未知的非空词」
+ * 被上调成 `rootless-buildkit`(一条没人声明过的 nested-build 能力写进 index),运行期的非声明型真值(数字 / 对象 …)走 `v ? … : …` 同样被上调。
+ * 抛出的句子沿用该面既有的拒法:`done` 帧的 auto-register 把它收成「built-but-unregistered」终局 FAILED,错误句带这一句(见 `http/routes/images.ts`)。
+ */
 export declare function nestedBuildModeOf(v: string | boolean | undefined): ImageNestedBuildMode;
 /** The fields of build.sh's `sandbox-manifest.json` this projection reads (a superset is fine; extras ignored). */
 export interface BuildManifest {

package/dist/images/manifest.js

@@ -1,18 +1,19 @@
-const NESTED_BUILD_MODES = [
-    "none",
-    "docker-cli-only",
-    "rootless-buildkit",
-    "privileged-dind",
-];
+const NESTED_BUILD_MODE_WORDS = {
+    none: true,
+    "docker-cli-only": true,
+    "rootless-buildkit": true,
+    "privileged-dind": true,
+};
+const isNestedBuildMode = (v) => Object.prototype.hasOwnProperty.call(NESTED_BUILD_MODE_WORDS, v);
 export function nestedBuildModeOf(v) {
-    if (typeof v === "string") {
-        return NESTED_BUILD_MODES.includes(v)
-            ? v
-            : v
-                ? "rootless-buildkit"
-                : "none";
-    }
-    return v ? "rootless-buildkit" : "none";
+    if (v === undefined || v === false)
+        return "none";
+    if (v === true)
+        return "rootless-buildkit";
+    if (typeof v === "string" && isNestedBuildMode(v))
+        return v;
+    const got = typeof v === "string" ? `the string ${JSON.stringify(v.slice(0, 64))}` : v === null ? "null" : Array.isArray(v) ? "an array" : `type ${typeof v}`;
+    throw new Error(`manifest capabilities.nestedBuild must be one of ${Object.keys(NESTED_BUILD_MODE_WORDS).join(" | ")} (or a bare boolean); got ${got}`);
 }
 export function shmToMB(v) {
     if (!v)
@@ -32,11 +33,12 @@ export function profileFromManifest(m) {
 export function manifestToIndexEntry(m, opts) {
     const profile = profileFromManifest(m);
     const tag = (m.tag ?? "").includes(":") ? (m.tag ?? "").split(":")[1] : (m.tag ?? "");
+    const nestedBuildMode = nestedBuildModeOf(m.capabilities?.nestedBuild);
     const capabilities = {
         browser: !!m.capabilities?.browser,
         db: !!m.capabilities?.db,
-        nestedBuild: !!m.capabilities?.nestedBuild,
-        nestedBuildMode: nestedBuildModeOf(m.capabilities?.nestedBuild),
+        nestedBuild: nestedBuildMode !== "none",
+        nestedBuildMode,
     };
     const pc = m.capabilities?.podContract;
     const devShmMB = shmToMB(pc?.devShm);

package/dist/memory-store-refusal.d.ts

@@ -1,18 +1,21 @@
 /**
- * core 7.31.1 #1094 —— **`memory.target_outside_store`** 在本仓的唯一读法属主(纯叶:零 http / 零 boot 依赖)。
- *
- * ## 这个码说的是什么(core `docs/wire-consumption/7.31.1.md` 逐 face 表,tag v7.31.1 亲读)
- * 记忆 store 里的一个目录经软链通到了 store **外**(或 store 根在 backend 打开 / 引擎首次挂载之后被改指)⇒ 引擎对落点在外的
- * 删 / 写 / 重放 / 自身写一律**不做**,抛普通 `Error` + `.code`(文案以码领头,点名动作、路径、解析到哪)。core 的读法原话:
- * operator 要处置的拒(去掉那只目录链),**不是**可重试的 IO 故障,也**不是**对调用方的裁决;链去掉之前重发恒拒。
+ * **店形拒**(store-form refusal)在本仓的唯一读法属主(纯叶:零 http / 零 boot 依赖)—— core 一只铸点(`layout.ts` `storeFormRefusal`)的**两码一族**:
+ *  · `memory.target_outside_store`(core 7.31.1 #1094):记忆 store 里的一个目录经软链通到了 store **外**(或 store 根在 backend 打开 / 引擎首次
+ *    挂载之后被改指)⇒ 引擎对落点在外的删 / 写 / 重放 / 自身写一律**不做**;
+ *  · `memory.scope_home_not_directory`(core 7.44.0 #1368):一只 scope home(`<memoryDir>/<label>`)不是真目录 —— 被换成软链 / 普通文件 / 特殊文件
+ *    (`detail.form` ∈ `symlink` | `file` | `other`,`lstat` 判、不跟链)。修前 core 对这一形抛不带码的 `ControlPlaneCorruptError`(与真控制面损坏同类同形),
+ *    平铺布局(条目直接住在 home 里)于是答 500,而同一换法在嵌套布局下一层答 409 —— 现在两布局同答这一码。
+ * 两码的形相同:普通 `Error` + `.code` + `.detail`(`{ path }`;home 那一码多 `form`),**句子以码领头、不含任何宿主路径**(core 7.44.0 起,
+ * 路径只在 `detail.path`)。core 的读法:operator 要处置的盘形(去掉那只链 / 放回真目录),**不是**可重试的 IO 故障,也**不是**对调用方的裁决;
+ * 盘形修好之前重发恒拒。本仓据此一条规则:两码同族、409、码原样;路径只进运维行(HTTP 映射一处,见 `http/memory-store-refusal-reply.ts`)。
  *
  * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
  *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
- *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
+ *     ⇒ {@link storeFormRefusalOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
  *     `http/memory-compliance-failure-reply.ts`(合规面两受众的那一只;会话所有者受众换固定句,S-930)。
  *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
- *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
- *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**
+ *     `memory commit refused: <码>: …` / `memory control plane refused: <码>: …`(core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字;
+ *     7.44.0 安装树 `engine.js` 两处 incident 铸点同形,home 那一码经同一只 `writeFailureText` 到这里)⇒ {@link storeFormRefusalInIncident} 只认**这两个 lead 紧跟码**
  *     的位置:lead 与码都是 core 铸的字面,路径与引用数据全在码之后。🔴 不做全文子串找(codex 一审 C2:一条真控制面损坏若在
  *     它引用的坏数据里恰好带着这串字,子串找会把它标成目录链 —— 两者运维动作相反)。不读散文、不猜语义;结构化码位
  *     (`HarvestReport.incident` / `.warnings` 带码)是向 core 索取的欠账。
@@ -20,19 +23,36 @@
  *     那几行的前缀是**条目路径**(模型可写)—— 本仓今天不读 warnings 车道(既有面,不是本批回归),也不在模型可写的文本上
  *     找码;这一半候 core 的结构化码位(登记在案,codex 一审 C3)。
  *
- * ## 不是这个码的三形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂)
- *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`;
+ * ## 不是这一族的三形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂)
+ *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`
+ *    (core 7.44.0 起 scope home 非目录**不再**走这一类 —— 它有了自己的码,见上;`ControlPlaneCorruptError` 只剩真控制面损坏);
  *  · 引擎原地写撞硬链(nlink>1)⇒ 文本 `has N names (a hard link)`、无码(KL-1094-g / #1105)⇒ 走该写点既有的失败车道(harvest
  *    warnings / 挂载失败),抛出面够不着;
  *  · 解析故障(`EACCES` / `ELOOP` / `ENOTDIR`)⇒ 以 errno 本身抛 ⇒ 路由未分类 500 + 运维 warn(`String(err)` 带 core 补救句)。
+ *
+ * ## 运维行也在这里铸(两受众同一只,{@link logStoreFormRefusal})
+ * 路径不上 wire,只进这一条运维 warn —— 它是**日志行**不是 wire 错误体,所以铸点跟读法属主住在一起(不住 `http/`:`http/` 全树门
+ * `test/error-code-key-gate.test.ts` 咬的是错误体里的 `code:` 键位,日志字段名不该借 wire 层的目录去过它)。
  */
-/** core 的码(`src/core/memory-engine/layout.ts` `TARGET_OUTSIDE_STORE`;core 不在包根导出它,本常量是它在本仓的唯一写点)。 */
-export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-/** 抛出面:`err` 是这一拒 ⇒ 原样交回(已窄化成 `Error`,调用方要它的 `message`);否则 `undefined`。形 = core 的 `Error` + `.code`。 */
-export declare function targetOutsideStoreOf(err: unknown): Error | undefined;
-/** 报告面:harvest `incident` 是这一拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成链)。 */
-export declare function targetOutsideStoreInIncident(incident: {
+import { type ScopeHomeForm, type StoreFormRefusalCode } from "@sema-agent/core";
+import type { Logger } from "./observability/logger.js";
+/** 一次店形拒的读数(纯数据)。`path` / `form` 取自 core 的 `detail`(读不出 ⇒ `undefined`,不猜、不从句子里抠)。 */
+export interface StoreFormRefusalReading {
+    readonly code: StoreFormRefusalCode;
+    /** core 原句(以码领头;7.44.0 起不含宿主路径)。 */
+    readonly message: string;
+    /** `detail.path`:落点 / 被改指的根 / 不是目录的 scope home —— **只给运维行**。 */
+    readonly path: string | undefined;
+    /** `detail.form`(只在 home 那一码上),经 core 闭集读;本仓只把它写进运维行,不按它分支。 */
+    readonly form: ScopeHomeForm | undefined;
+}
+/** 抛出面:`err` 是店形拒(core `StoreFormRefusal` 的形:码在族里)⇒ 读数;否则 `undefined`。`detail` 读不全不改判(码定族,`detail` 只供运维行)。 */
+export declare function storeFormRefusalOf(err: unknown): StoreFormRefusalReading | undefined;
+/** 两受众共用的运维行(一处铸点):码 + core `detail` 里的宿主路径与 home 形。`logger` 缺席(只有不接 logger 的测试装配)⇒ 不落。 */
+export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusalReading): void;
+/** 报告面:harvest `incident` 是这一族拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成店形拒)。 */
+export declare function storeFormRefusalInIncident(incident: {
     readonly kind: string;
     readonly detail: string;
-}): typeof TARGET_OUTSIDE_STORE | undefined;
+}): StoreFormRefusalCode | undefined;
 //# sourceMappingURL=memory-store-refusal.d.ts.map

package/dist/memory-store-refusal.js

@@ -1,14 +1,32 @@
-export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export function targetOutsideStoreOf(err) {
+import { SCOPE_HOME_FORMS, STORE_FORM_REFUSAL_CODES } from "@sema-agent/core";
+const isStoreFormRefusalCode = (code) => STORE_FORM_REFUSAL_CODES.includes(code);
+const isScopeHomeForm = (form) => SCOPE_HOME_FORMS.includes(form);
+export function storeFormRefusalOf(err) {
     if (!(err instanceof Error))
         return undefined;
-    const { code } = err;
-    return code === TARGET_OUTSIDE_STORE ? err : undefined;
+    const { code, detail } = err;
+    if (!isStoreFormRefusalCode(code))
+        return undefined;
+    const d = typeof detail === "object" && detail !== null ? detail : {};
+    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: isScopeHomeForm(d.form) ? d.form : undefined };
+}
+export function logStoreFormRefusal(logger, refusal) {
+    logger?.warn("memory_store_form_refused", {
+        code: refusal.code,
+        ...(refusal.path !== undefined ? { path: refusal.path } : {}),
+        ...(refusal.form !== undefined ? { form: refusal.form } : {}),
+    });
 }
-const INCIDENT_PREFIXES = [`memory commit refused: ${TARGET_OUTSIDE_STORE}: `, `memory control plane refused: ${TARGET_OUTSIDE_STORE}: `];
-export function targetOutsideStoreInIncident(incident) {
+const INCIDENT_LEADS = ["memory commit refused: ", "memory control plane refused: "];
+export function storeFormRefusalInIncident(incident) {
     if (incident.kind !== "sidecar_corrupt")
         return undefined;
-    return INCIDENT_PREFIXES.some((p) => incident.detail.startsWith(p)) ? TARGET_OUTSIDE_STORE : undefined;
+    for (const lead of INCIDENT_LEADS) {
+        if (!incident.detail.startsWith(lead))
+            continue;
+        const rest = incident.detail.slice(lead.length);
+        return STORE_FORM_REFUSAL_CODES.find((code) => rest.startsWith(`${code}: `));
+    }
+    return undefined;
 }
 //# sourceMappingURL=memory-store-refusal.js.map

package/dist/model-unreachable-notice.d.ts

@@ -23,7 +23,7 @@
  * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId }` ——
  * `proxyInUse` 只在这一跳走了代理时在场,且只是**变量名**(代理地址是基础设施细节,不上租户 wire,与 `OutboundProxyError` 的
  * F3 裁定同一条)。`targetHost`(模型端点的 `host:port`)对 user 受众是**新披露的部署事实**(F7 裁定:它是部署自己声明的模型端点,
- * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下 core 终局句展开到代理根因、不含模型主机,
+ * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下终局句只带码与 `via outbound proxy (from <变量>)`、不含任何主机地址,
  * 辅助调用形下 run 可 completed、租户面本无主机句。
  */
 import type { Brain } from "@sema-agent/core";

package/dist/namespaced-rule-name.d.ts

@@ -1,28 +1,28 @@
 /**
- * 协议规则名(`mcp__…` / `a2a__…`)够不够得着一只挂载工具 —— **一只**判官 + **一只**句子。调它的面(点名,不是「每个面」):
- *  · 运维三张名表(`APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`)与中心下发的同名表、请求 `settings.permissions.{ask,deny}`(经 `config.ts` 的
- *    `unmatchableToolNamesRefusal`);
- *  · 会话规则写口两腿与 SQL 会话规则店的写口(经 `session-policy-wire.ts`);
- *  · 引擎 allow 层的三张条目表(core 7.42.0 起):请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT`、技能的两只清单 `allowedTools` /
- *    `disallowedTools`(顶层 `skills[]` 与子代 `agents[].skills[]` 两处受理口)—— 经 `rule-entry-list.ts` 的 `unreachableRuleEntryOf`(同一只函数)。
- * **不调它的面**(如实,未接):`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`)、子代的工具名表 `agents[].allowTools` /
- * `denyTools`(`spec-fields.ts` 只判形与条数)。在这两处写铸不出的服务器段仍被收下、永不命中。
- * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。
+ * 规则里的工具名**够不够得着**一只挂载工具 —— 本仓唯一的一问(判官 + 句子各一只),其余全是引擎判官 `judgeRuleToolName` 的判词。
+ *
+ * 一个名字永远匹配不到工具的成因,判官是谁:
+ *  · 退役名 / 无协议前缀的 `__` 短名 / **协议名的对端段引擎铸不出**(`mcp__github.com__*`、`mcp__*`、`mcp____x`、`mcp__`)—— 引擎判官
+ *    (`retired` / `unprefixed_namespace` / `unmintable_segment`,带 `guidance` 与 1:1 `currentName`)。本仓不再拿 `mintNamespacePrefix` 自比对端段:
+ *    那是同一问的第二个读者(core 7.43.0 #1355 (b) 起引擎自己给这个判词)。
+ *  · **工具段为空的协议名**(`mcp__srv__`)—— 引擎判官答 `current`、规则文法收下、allow 条目读成一条精确名行,而它一只工具都够不着
+ *    (引擎自己的两种拆法 —— 精确名 `ns.parse`、覆盖形 `isNamespacedCoveringRuleName` —— 都不认它)。这是引擎读不到的一形,本仓在下面点名的那些面上
+ *    拒它({@link emptyToolSegmentOf}),句子在这里({@link describeEmptyToolSegment})。翻转条件:引擎判官给这一形一个判词 ⇒ 本文件整只退役。
  *
- * 规则:一条协议规则名够得着挂载工具 ⇔
- *  ① 分得出对端段 —— 三段名(`ns.parse` 认得:首段为对端、余段非空)取 `parse().peer`;两段覆盖形 `<ns>__<peer>`(core `isNamespacedCoveringRuleName`
- *     认、`ns.parse` 不认)取前缀之后的整段;两者都不是(`mcp__` / `mcp__srv__` / `mcp____x`)= **缺段**;
- *  ② 对端段是引擎**自铸**的那一段:`mintNamespacePrefix(ns, peer) === ns.prefix + peer + "__"`。引擎铸注册名时归一对端段(字符表外换 `_`、超长截断加摘要、
- *     折连串下划线、去尾下划线),而规则匹配对对端段逐字比(覆盖形 `namespacedRuleNameCovers`,精确名整串比)—— 铸不出的对端段一只工具都匹配不到。
- *     服务器段里带 `*`(`mcp__*`、`mcp__git*__x`)是同一个「够不着」,但出路不同:那是在写通配,而服务器名不支持通配 —— 给一条铸名写法
- *     (`mcp__<摘要>__*`)没人照做得了 ⇒ 判词单列 `wildcard_peer`,句子说实话(写具体的服务器名)。
- * 判据不看规则是覆盖形还是精确名:两种形的对端段命运相同。精确名的**工具段**归一不在这里判(包根没有导出工具段的铸法,不手抄)。
+ * **调它的面**(点名,不是「每个面」;判官一问与本仓这一问同调):
+ *  · 运维三张名表(`APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`)与中心下发的同名表、请求 `settings.permissions.{ask,deny}`(经 `config.ts` 的 `unmatchableToolNamesRefusal`);
+ *  · 会话规则写口(`session-policy-wire.ts`)与 SQL 会话规则店的写口(`assertSessionRuleNamesReachable`);
+ *  · 引擎 allow 层的条目表:请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT`、技能的两只清单 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代
+ *    `agents[].skills[]` 两处受理口)—— 经 `rule-entry-list.ts` 的 `emptyToolSegmentEntryOf`(本仓这一问;退役名 / 铸不出的判词那一半由引擎 `compileAllowList` 给)。
+ * **不调它的面**:`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)—— 如实未接,
+ * 在那里写铸不出的服务器段、工具段为空的协议名仍被收下、永不命中;把它接上判官 = 另一件事(不在本文件里加特例;`unmatchableRuleNameOf` 就是现成的那一只)。
+ * 子代的工具名表 `agents[].allowTools` / `denyTools` 不是本文件的面:core 7.45.0 #1377 / #1385 起名字归引擎在开跑前一只判(三来源同判,`spec-fields.ts`
+ * 受理口只判形与条数),本仓不对它另做对照。
+ * **精确名的工具段归一不在这里判**:包根没有导出工具段的铸法,不手抄 —— 精确名的工具段按字面收,本仓每张表上都不判它。
  *
- * 翻转条件:core 的规则名判官(`judgeRuleToolName`)自己给出「对端段铸不出」这一判词 —— core 7.42.x 还没有(包根 `RULE_TOOL_NAME_VERDICTS`
- * 只有 current / retired / unprefixed_namespace,亲核),等上游;到货那天本仓这只对照整只退役(连同会话规则写口这一问的码由 `request.field_invalid`
- * 归回 `rules.legacy_tool_name`)。
+ * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。
  */
-import { type ProtocolNamespace } from "@sema-agent/core";
+import { type ProtocolNamespace, type RuleToolNameVerdict } from "@sema-agent/core";
 /**
  * 一条**规则文本**里的工具名那一段(判官与旧名判据的主语)= core 包根 `parsePermissionRule` 的 `toolName`,原样 —— 引擎的技能编译器
  * (`compileSkillGrant`)与规则编译器读条目用的就是这一只:`Bash(npm:*)` ⇒ `Bash`;`mcp__srv(*)` / `mcp__srv()` / 带首尾空格的 `mcp__srv ` ⇒ 光杆名 `mcp__srv`。
@@ -31,26 +31,31 @@ import { type ProtocolNamespace } from "@sema-agent/core";
  * `unsupported.mcp_paren`),拒由引擎的文法那一问说(配置表的判据链里它排在本判官之前),本判官不抢答。
  */
 export declare function ruleEntryToolName(entry: string): string;
-/** 一条协议规则名够不着任何挂载工具的判词(闭集)。 */
-export type UnreachableNamespacedRuleName = 
-/** 分不出对端段:光杆前缀、对端段为空、或分隔符之后工具段为空。 */
-{
-    readonly kind: "incomplete";
-    readonly ns: ProtocolNamespace;
-}
-/** 对端段不是引擎自铸的那一段;`minted` = 引擎为这样一个对端名铸出的注册名前缀(`mintNamespacePrefix` 的返回值,原样)。 */
- | {
-    readonly kind: "unminted_peer";
-    readonly ns: ProtocolNamespace;
-    readonly minted: string;
-}
-/** 对端段里带 `*`:写的是通配,而服务器 / 对端名不支持通配(规则对这一段逐字比)。 */
- | {
-    readonly kind: "wildcard_peer";
+/**
+ * 判官的名册:本仓的配置表 / 请求表 / 会话规则写口都不声明「部署在退役名下挂了自有工具」(本仓没有这样的工具;boot / 请求期也没有哪一跑的名册可看)
+ * ⇒ 恒为空集。引擎判官、`compileAllowList` 的第三参、会话规则店同读这一只。
+ */
+export declare const NO_DECLARED_TOOL_NAMES: ReadonlySet<string>;
+/** 一个规则名永远匹配不到工具的判词(闭集):引擎判官的三种非现行判词 ∪ 引擎读不到的那一形。 */
+export type UnmatchableRuleName = Exclude<RuleToolNameVerdict, {
+    kind: "current";
+}> | {
+    readonly kind: "empty_tool_segment";
     readonly ns: ProtocolNamespace;
 };
-/** 判官:不是协议名、或够得着 ⇒ `undefined`;否则给判词。纯字符串运算,不做 I/O。 */
-export declare function unreachableNamespacedRuleNameOf(name: string): UnreachableNamespacedRuleName | undefined;
-/** 判词 → 句子(「为什么永远匹配不到 + 怎么写」;不复述条目本身 —— 调用方的句子已点名它)。闭集穷尽:判词加一种 ⇒ 编译红。 */
-export declare function describeUnreachableNamespacedRuleName(v: UnreachableNamespacedRuleName): string;
+/** 判:引擎判官先答(非 `current` ⇒ 原样交回),判官放行的再问引擎读不到的那一形;都过 ⇒ `undefined`。 */
+export declare function unmatchableRuleNameOf(name: string): UnmatchableRuleName | undefined;
+/**
+ * 判词 → 「为什么永远匹配不到 + 怎么写」(不复述条目本身 —— 调用方的句子已点名它)。引擎判词的 `guidance` 原样带出,是改法指引的**唯一**一句
+ * (本仓不在后面追加 1:1 现名:通配名上那个现名是摘要名或更窄的写法,照写不生效;现名过境给机器读的位,如会话规则拒体顶层的 `currentName`);
+ * 无前缀短名的出路从 core 的 `PROTOCOL_TABLE` 派生。闭集穷尽:判词加一种 ⇒ 编译红。
+ */
+export declare function describeUnmatchableRuleName(v: UnmatchableRuleName, name: string): string;
+/**
+ * 工具段为空的协议名(`<ns>__<peer>__`)⇒ 交回它的协议;别的名字 ⇒ `undefined`。判据只读引擎:判官答 `current`(对端段为空 / 铸不出的那些 ——
+ * `mcp__`、`mcp____x` —— 是判官自己的判词,不在这里),而引擎自己的两种拆法(精确名 `ns.parse`、覆盖形 `isNamespacedCoveringRuleName`)都不认它。纯字符串运算。
+ */
+export declare function emptyToolSegmentOf(name: string): ProtocolNamespace | undefined;
+/** {@link emptyToolSegmentOf} 的句子(「为什么永远匹配不到 + 怎么写」;不复述条目本身 —— 调用方的句子已点名它)。 */
+export declare function describeEmptyToolSegment(ns: ProtocolNamespace): string;
 //# sourceMappingURL=namespaced-rule-name.d.ts.map

package/dist/namespaced-rule-name.js

@@ -1,33 +1,47 @@
-import { isNamespacedCoveringRuleName, mintNamespacePrefix, parsePermissionRule, protocolOf } from "@sema-agent/core";
+import { PROTOCOL_TABLE, isNamespacedCoveringRuleName, judgeRuleToolName, parsePermissionRule, protocolOf } from "@sema-agent/core";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 export function ruleEntryToolName(entry) {
     return parsePermissionRule(entry).toolName;
 }
-export function unreachableNamespacedRuleNameOf(name) {
-    const ns = protocolOf(name);
-    if (ns === undefined)
-        return undefined;
-    const peer = ns.parse(name)?.peer ?? (isNamespacedCoveringRuleName(name) ? name.slice(ns.prefix.length) : undefined);
-    if (peer === undefined)
-        return { kind: "incomplete", ns };
-    if (peer.includes("*"))
-        return { kind: "wildcard_peer", ns };
-    const minted = mintNamespacePrefix(ns, peer);
-    return minted === `${ns.prefix}${peer}__` ? undefined : { kind: "unminted_peer", ns, minted };
+export const NO_DECLARED_TOOL_NAMES = new Set();
+export function unmatchableRuleNameOf(name) {
+    const verdict = judgeRuleToolName(name, NO_DECLARED_TOOL_NAMES);
+    if (verdict.kind !== "current")
+        return verdict;
+    const ns = emptyToolSegmentOf(name);
+    return ns === undefined ? undefined : { kind: "empty_tool_segment", ns };
 }
-export function describeUnreachableNamespacedRuleName(v) {
+function presentName(name) {
+    const clean = name.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return clean.length <= 160 ? clean : `${clean.slice(0, 160)}…(${name.length} chars)`;
+}
+export function describeUnmatchableRuleName(v, name) {
     switch (v.kind) {
-        case "incomplete":
-            return `incomplete ${v.ns.id} name — the live form is ${v.ns.prefix}<server>__<tool>, or ${v.ns.prefix}<server> / ${v.ns.prefix}<server>__* to cover every tool on that server`;
-        case "wildcard_peer":
-            return `the ${v.ns.id} server segment does not take a wildcard — a rule compares the server segment literally, so the entry matches nothing; write the concrete server name: ${v.ns.prefix}<server>__* to cover every tool on that server, or ${v.ns.prefix}<server>__<tool>`;
-        case "unminted_peer":
-            return (`the engine never mints this server segment as written — a server configured under that name has its tools registered as ${v.minted}<tool>, ` +
-                `and a rule compares the server segment literally (no wildcard, no normalization), so the entry matches nothing; if that is the configured name, ` +
-                `write ${v.minted}* to cover every tool on that server, or ${v.minted}<tool>`);
+        case "retired":
+            return v.guidance;
+        case "unmintable_segment":
+            return v.guidance;
+        case "unprefixed_namespace":
+            return `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentName(name)}`).join(" or ")}`;
+        case "empty_tool_segment":
+            return describeEmptyToolSegment(v.ns);
         default: {
             const unhandled = v;
-            throw new Error(`unhandled namespaced rule name verdict: ${JSON.stringify(unhandled)}`);
+            throw new Error(`unhandled rule name verdict: ${JSON.stringify(unhandled)}`);
         }
     }
 }
+export function emptyToolSegmentOf(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
+        return undefined;
+    if (judgeRuleToolName(name, NO_DECLARED_TOOL_NAMES).kind !== "current")
+        return undefined;
+    if (ns.parse(name) !== undefined || isNamespacedCoveringRuleName(name))
+        return undefined;
+    return ns;
+}
+export function describeEmptyToolSegment(ns) {
+    return `incomplete ${ns.id} name — the live form is ${ns.prefix}<server>__<tool>, or ${ns.prefix}<server> / ${ns.prefix}<server>__* to cover every tool on that server`;
+}
 //# sourceMappingURL=namespaced-rule-name.js.map

package/dist/observability/corrupt-read-seat.d.ts

@@ -148,6 +148,10 @@ export declare const JSONL_REPLAY_SEATS: {
         readonly direction: "fail-open";
         readonly tag: "server.workflow-agent-session-index.corrupt-record-skipped";
     };
+    readonly "workflow-completion-inbox": {
+        readonly direction: "fail-open";
+        readonly tag: "server.workflow-completion-inbox.corrupt-record-skipped";
+    };
     readonly "user-input-ledger": {
         readonly direction: "fail-open";
         readonly tag: "server.user-input-ledger.corrupt-record-skipped";

package/dist/observability/corrupt-read-seat.js

@@ -133,6 +133,7 @@ export const JSONL_REPLAY_SEATS = {
     "approval-ask-audit": { direction: "fail-open", tag: "server.approval-ask-audit.corrupt-record-skipped" },
     "workflow-notify-journal": { direction: "fail-open", tag: "server.workflow-notify-journal.corrupt-record-skipped" },
     "workflow-agent-session-index": { direction: "fail-open", tag: "server.workflow-agent-session-index.corrupt-record-skipped" },
+    "workflow-completion-inbox": { direction: "fail-open", tag: "server.workflow-completion-inbox.corrupt-record-skipped" },
     "user-input-ledger": { direction: "fail-open", tag: "server.user-input-ledger.corrupt-record-skipped" },
 };
 function corruptRefusalSentence(seat, path, reason) {