@sema-agent/server 7.125.0 → 7.126.0

package/dist/router/route-orchestration.d.ts

@@ -1,12 +1,9 @@
 import { type Autonomy } from "../runtime-governance.js";
 import type { GovernanceOverrides } from "../governance-overrides.js";
-export type OrchestrationMode = "single" | "supervisor" | "team";
+export type OrchestrationMode = "single" | "supervisor";
 /** The DETERMINISTIC signals the routing decision reads (extracted by {@link deriveRoutingSignals} from the
  *  task's resolved config — no task-content LLM judgement). */
 export interface RoutingSignals {
-    /** The caller explicitly chose an orchestration (a `council`/`debate`/`team` request). Honored verbatim —
-     *  a deliberate choice outranks automatic routing (back-compat + operator intent). */
-    explicitMode?: OrchestrationMode;
     /** (a) The task can cause harm its sandbox does NOT contain ⇒ route to SUP prevention. */
     dangerousCapability: boolean;
     /** (b) The task delegates / fans out / is long-horizon ⇒ supervisor goal-keeping + ask-aggregation. */
@@ -14,19 +11,16 @@ export interface RoutingSignals {
 }
 export interface RoutingDecision {
     mode: OrchestrationMode;
-    /** A short, audit-friendly machine reason (e.g. `explicit:team` / `danger:prevention-gate` / `default:single`).
+    /** A short, audit-friendly machine reason (e.g. `danger:prevention-gate` / `default:single`).
      *  Emitted on the trace so a routing decision is always explainable (never a silent mode flip). */
     reason: string;
 }
 /**
- * The routing decision (pure). Order matters: explicit caller choice first, then (a) danger, then (b) structural,
- * else the single default. `team` is NEVER produced here — it only ever appears via {@link RoutingSignals.explicitMode}.
+ * The routing decision (pure). Order matters: (a) danger first, then (b) structural, else the single default.
  */
 export declare function routeOrchestration(s: RoutingSignals): RoutingDecision;
 /** The task facts {@link deriveRoutingSignals} reads — all DETERMINISTIC, resolved before the task runs. */
 export interface RoutingContext {
-    /** Caller-explicit orchestration (council/debate/team) — undefined ⇒ the router decides. */
-    explicitMode?: OrchestrationMode;
     /** The resolved autonomy for this task — `read-only` hands cannot mutate/egress ⇒ no danger escalation. */
     autonomy?: Autonomy;
     /** The mounted tools can WRITE the project or run a shell (edit_file / write_file / bash). */
@@ -68,8 +62,6 @@ export declare function routeServiceTask(input: {
     hasExecutionEnv: boolean;
     /** The resolved autonomy for the task. */
     autonomy?: Autonomy;
-    /** The caller explicitly requested a fan-out (council/debate/team). */
-    explicitTeam: boolean;
 }): RoutingDecision;
 /**
  * Resolve whether a task's execution env STRONGLY isolates side effects (a VM/kernel boundary the sandbox tears

package/dist/router/route-orchestration.js

@@ -3,8 +3,6 @@ import { autonomyOverrides } from "../runtime-governance.js";
 import { operatorAlwaysHumanAsk } from "../operator-ask.js";
 import { heldRuleName } from "../tool-rule-names.js";
 export function routeOrchestration(s) {
-    if (s.explicitMode)
-        return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
     if (s.dangerousCapability)
         return { mode: "supervisor", reason: "danger:prevention-gate" };
     if (s.needsGoalKeeping)
@@ -15,7 +13,6 @@ export function deriveRoutingSignals(ctx) {
     const readOnly = ctx.autonomy === "read-only";
     const dangerousCapability = !readOnly && (ctx.canEgress || (ctx.canWriteOrExec && !ctx.isolatedExecEnv));
     return {
-        ...(ctx.explicitMode ? { explicitMode: ctx.explicitMode } : {}),
         dangerousCapability,
         needsGoalKeeping: ctx.delegatedOrLongHorizon,
     };
@@ -23,7 +20,6 @@ export function deriveRoutingSignals(ctx) {
 export function routeServiceTask(input) {
     const readOnlyHands = autonomyOverrides(input.autonomy).handsReadOnly === true;
     return routeOrchestration(deriveRoutingSignals({
-        ...(input.explicitTeam ? { explicitMode: "team" } : {}),
         ...(input.autonomy ? { autonomy: input.autonomy } : {}),
         canWriteOrExec: input.hasExecutionEnv && !readOnlyHands,
         canEgress: false,

package/dist/rule-entry-list.js

@@ -27,10 +27,6 @@ export function inertRuleEntryGuidance(i) {
             return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
         case "namespace_wildcard":
             return "a server segment does not take a wildcard (`mcp__*`) — name the server: mcp__<server> or mcp__<server>__*";
-        case "path_pattern":
-            return "a write-path or file-pattern entry has no reading on this side — name the tool, or use Read(//<dir>/**) for a directory a Read may cover";
-        case "domain":
-            return "a domain entry has no reading on this side — name the tool";
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":

package/dist/rules-consent.js

@@ -96,6 +96,9 @@ function isSupportedRuleMatch(match) {
         case "name":
         case "name_prefix":
             return false;
+        case "host":
+        case "subdomain":
+            return false;
         default: {
             const unknown = match;
             void unknown;

package/dist/run-local.d.ts

@@ -14,8 +14,9 @@ export interface RunLocalArgs {
     json: boolean;
     /** `--scenario <name>` — pick a capability bundle (default: config.defaultScenario). */
     scenario?: string;
-    /** `--session <id>` — REUSE a session across invocations (durable multi-turn). Default: a fresh id (the
-     *  session + its events still persist to disk, just not continued). */
+    /** `--session <uuid>` — REUSE a session across invocations (durable multi-turn). Only a canonical uuid (any version) is
+     *  accepted — the same one shape law as the HTTP submit door (`sessionIdShapeIssue`). Default: a fresh id (the session +
+     *  its events still persist to disk, just not continued). */
     session?: string;
     /** `--workspace <dir>` — the FIXED dir the agent's tool calls operate in (CC-like). Default: the cwd. The
      *  agent's file edits PERSIST there (never deleted) — this is the user's own directory, not a sandbox. */
@@ -96,8 +97,8 @@ export interface LocalGovernanceConfigView extends DeploymentGovernanceConfigVie
  *   test/run-local.test.ts(该钉已由 🟡 特征化翻成 🔴 正控)。
  * · **禁 memoize**:四个旋钮都是热改字段,每次装配现读活 config(与另两条腿同一姿势)。
  */
-/** @param engineDataRoot 本腿已铸的引擎记忆根(`memoryEngineBackendFor(config, root)?.root`,S-133 单一写者);`undefined` = 引擎未接。 */
-export declare function applyLocalGovernance(base: TaskSpec, config: LocalGovernanceConfigView, workspaceDir: string, engineDataRoot: string | undefined): TaskSpec;
+/** 豁免根(引擎数据根)不在这里:core 7.49.0 [ref] 起只从 `RunnerDeps.memoryEngineDir` 来(本腿 Runner 装配处,记忆引擎开不开都给)。 */
+export declare function applyLocalGovernance(base: TaskSpec, config: LocalGovernanceConfigView, workspaceDir: string): TaskSpec;
 /** {@link createLocalApprover} 的 io 面(全部可注入,所以两条臂都测得动)。 */
 export interface LocalApproverIo {
     /** 这次调用是不是接在一个人面前(生产里 = `process.stdin.isTTY`)。 */

package/dist/run-local.js

@@ -38,10 +38,10 @@ import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, gateScenarioRequest, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
-import { pickHandsRunner, withoutExecutionEnv } from "./capabilities/hands-lane.js";
-import { HttpError } from "./security.js";
+import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
+import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
@@ -68,9 +68,9 @@ export function parseArgs(argv) {
     let workspace;
     let user;
     let json = false;
-    const valueFlag = (i, name) => {
+    const valueFlag = (i, name, opts = {}) => {
         const v = argv[i];
-        if (v === undefined || v.trim() === "" || v.startsWith("--"))
+        if (v === undefined || (opts.blankIsValue !== true && v.trim() === "") || v.startsWith("--"))
             throw new UsageError(`${name} needs an argument`);
         return v;
     };
@@ -82,14 +82,18 @@ export function parseArgs(argv) {
             root = valueFlag(++i, "--root");
         else if (a === "--scenario")
             scenario = valueFlag(++i, "--scenario");
-        else if (a === "--session")
-            session = valueFlag(++i, "--session");
+        else if (a === "--session") {
+            session = valueFlag(++i, "--session", { blankIsValue: true });
+            const issue = sessionIdShapeIssue(session);
+            if (issue)
+                throw new UsageError(issue);
+        }
         else if (a === "--workspace")
             workspace = valueFlag(++i, "--workspace");
         else if (a === "--user")
             user = valueFlag(++i, "--user");
         else if (a === "--help" || a === "-h") {
-            throw new UsageError('usage: run-local "<objective>" [--root <dir>] [--json] [--scenario <name>] [--session <id>] [--workspace <dir>] [--user <id>]');
+            throw new UsageError('usage: run-local "<objective>" [--root <dir>] [--json] [--scenario <name>] [--session <uuid>] [--workspace <dir>] [--user <id>]');
         }
         else if (a.startsWith("--")) {
             throw new UsageError(`unknown flag: ${a}`);
@@ -133,8 +137,8 @@ export function missingGatewayRequirements(config) {
     return missing;
 }
 const RUN_LOCAL_APPROVAL_SEAT = { kind: "live" };
-export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot) {
-    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
+export function applyLocalGovernance(base, config, workspaceDir) {
+    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }));
 }
 const NO_TTY_REFUSAL_REASON = "this run-local invocation has no TTY, so there is no one to put this approval to; it is refused fail-closed instead of being asked.";
 const UNDISPLAYABLE_ARGS_REFUSAL_REASON = "the call's arguments cannot be displayed, so there is nothing a person could review; it is refused fail-closed instead of being asked.";
@@ -145,6 +149,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     ancestor: { remedy: "terminal_only", autoBudgetReleases: false },
     dangerous_delete: { remedy: "terminal_only", autoBudgetReleases: false },
     unverifiable_delete: { remedy: "terminal_only", autoBudgetReleases: false },
+    unverifiable_shell_text: { remedy: "terminal_only", autoBudgetReleases: false },
     transcript_write: { remedy: "terminal_only", autoBudgetReleases: false },
     org_rule: { remedy: "terminal_only", autoBudgetReleases: false },
     governance_unavailable: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -154,7 +159,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     classifier_no_ruling: { remedy: "terminal_only", autoBudgetReleases: false },
     operator_forced: { remedy: "deployment_mandate", autoBudgetReleases: false },
     shell_floor: { remedy: "shell_gate", autoBudgetReleases: false },
-    write_protection_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
+    target_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
     probe: { remedy: "terminal_only", autoBudgetReleases: false },
     write_protection: { remedy: "terminal_only", autoBudgetReleases: false },
     tool_marks_mcp: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -441,6 +446,7 @@ export async function runLocal(argv, deps = {}) {
         : undefined;
     const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager(config, (event, fields) => logger.info(event, fields)) : undefined;
     const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
+    const engineDataRoot = fileMemoryEngineRoot(config, root);
     try {
         judgeConsolidationValve({ config, memoryEngine });
     }
@@ -547,6 +553,7 @@ export async function runLocal(argv, deps = {}) {
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
+        engineDataRoot,
         governanceSeams,
         logger,
         hands: { commitCoAuthor: "Sema <noreply@vivi-ai.com>" },
@@ -574,7 +581,7 @@ export async function runLocal(argv, deps = {}) {
     const runnerDeps = {
         ...sharedRunnerDeps,
         sessionStore,
-        ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
+        ...(memoryEngine ? { memoryBackend: memoryEngine.backend } : {}),
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled
@@ -587,15 +594,14 @@ export async function runLocal(argv, deps = {}) {
     const runner = new Runner(runnerDeps);
     const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
     const subRunner = new Runner(subRunnerDeps);
-    const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
-    const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
+    const handslessRunner = new Runner(withoutHands(runnerDeps));
     const skills = loadDeploymentSkills(config);
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const taskListLane = createTaskListLane({ logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, metrics, logger,
+        runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, logger,
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,
@@ -634,7 +640,7 @@ export async function runLocal(argv, deps = {}) {
     }
     const scope = args.user ?? "local";
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
-    const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "discuss");
+    const timeoutSec = taskWallClockSec(taskTimeoutSec, false);
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
     const a2a = a2aForScenario(config.a2aPeers, scenarioName);
     const maxCostUsd = cappedCeiling(undefined, config.maxTaskCostUsd);
@@ -662,7 +668,7 @@ export async function runLocal(argv, deps = {}) {
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
-    }, config, workspaceDir, memoryEngine?.root), onAsk);
+    }, config, workspaceDir), onAsk);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);

package/dist/runs.js

@@ -83,6 +83,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
     "config.image_invalid": 400,
+    "config.tool_face_control": 400,
     "config.memory_capture_unsupported": 409,
 };
 export function resumeAtHttpStatus(result) {

package/dist/security.d.ts

@@ -195,6 +195,13 @@ export type OwnerAwareSessionStore = SessionStore & {
 /** True iff `s` matches the canonical uuidv7 shape core mints (see {@link UUIDV7_RE}). */
 export declare function isUuidV7(s: string): boolean;
 export declare function isUuidShape(s: string): boolean;
+/** The submit door's refusal of a caller-supplied session id that is not a canonical uuid, or `undefined` when the value
+ *  is absent / not a string (the authorizer only ever reads a string `sessionId`; a non-string never enters the session
+ *  slot) / a canonical uuid. The sentence opens with the store verbs' sentence (`invalid session id (must be a canonical
+ *  uuid)`, same `request.id_invalid` code) and then names the remedy — a self-chosen name is not a session id; the caller
+ *  keeps its own name → uuid mapping. HTTP admission answers it as `400 request.id_invalid`; `run-local --session` prints
+ *  it as a usage error: ONE judge, ONE sentence, no second door-specific rule. */
+export declare function sessionIdShapeIssue(sessionId: unknown): string | undefined;
 /** An HTTP error the server maps to a status code (instead of a generic 500). `code` (optional) is a stable
  *  machine-readable identifier the HTTP layer echoes as `{code}` beside the human `{error}` message — the
  *  "typed rejection" posture (structured code on the wire, prose stays with the shell/web).

package/dist/security.js

@@ -25,6 +25,11 @@ const UUID_ANY_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}
 export function isUuidShape(s) {
     return UUID_ANY_RE.test(s);
 }
+export function sessionIdShapeIssue(sessionId) {
+    if (typeof sessionId !== "string" || isUuidShape(sessionId))
+        return undefined;
+    return "invalid session id (must be a canonical uuid); a self-chosen session name is not accepted — use a uuid (any version) and keep your own name-to-uuid mapping";
+}
 export class HttpError extends Error {
     status;
     code;

package/dist/server-secret-env.d.ts

@@ -19,7 +19,7 @@
  * {@link scrubServerSecrets} = core `scrubSecretEnv`(按形)∘ 本仓按名两臂:
  *  · 目录臂 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,不手抄第二份名单;
  *  · 名单型旋钮臂 —— `ENV_NAME_ALLOWLIST_KNOBS` 的每一只(`env-name-allowlist-knobs.ts`,表键派生):名单**原文**可能夹着一枚被错展开进来
- *    的令牌,按凭据类对待。服务侧三只(`LSP_ENV_ALLOW` S-699 / `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` S-713)同时是目录 secret 行,
+ *    的令牌,按凭据类对待。服务侧四只(`LSP_ENV_ALLOW` S-699 / `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` S-713 / `K8S_SANDBOX_ENV`)同时是目录 secret 行,
  *    目录臂先认;本臂接住的是**不在服务目录里**的那一只 —— bake-runner 的 `BAKE_ENV_ALLOW`(它不是服务进程的配置)。
  * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 补 `KEYS|TOKENS|PASSWORDS`(S-616),7.33.7 #1180 按名认 OTLP 头变量一族(7.103.2 车PM 提货;目录臂照旧点名
  * `OTEL_EXPORTER_OTLP_HEADERS` = 双保险,互证钉在 `test/secret-env-scrub-disclosure.test.ts`),目录臂独担的只剩名单型旋钮(值是变量名单,core 本来就不该认它们)。
@@ -32,10 +32,10 @@
  * ## 点名放行(S-699 / S-713,一只谓词各处用)
  * {@link allowlistedEnv} 是本仓「一张名单点到哪些 env 键,就把它们从源 env **原样**交给子进程」的唯一实现。调用:
  * host shell 的 `inheritEnv:[names]`(`plugins/remote-env-host.ts`,hermetic 形)、{@link hostSubprocessEnv}(剥后放回形:本地语言服务器的
- * `LSP_ENV_ALLOW`、bake-runner 的 `BAKE_ENV_ALLOW`)、沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(`config.ts`,S-713 起)。
+ * `LSP_ENV_ALLOW`、bake-runner 的 `BAKE_ENV_ALLOW`)、沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` / `K8S_SANDBOX_ENV`(`config.ts`,S-713 起)。
  * 名单型旋钮的**名单**另由 `config.ts` 的同一只解析器 `parseEnvNameAllowlist` 判形(形错拒启 / 源里没有的名按序号 warn),本函数只管取值。
  * 「点名」在各处同义:点到的键原样带值(空串值照带),密钥形也照过(点名 = 部署方显式承担);源里没有的名不产生条目。
- * 沙箱两腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
+ * 沙箱三腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
  * host shell 与「剥后放回」形**只在没点到的键上**不同,这是有意保留的差别:host shell 的 `string[]` 形是 hermetic 白名单(与 core
  * `NodeExecutionEnv` 同名选项同义,没点到的一律不继承);语言服务器 / bake-runner 在 {@link scrubServerSecrets} 的结果之上放回点名键
  * (没点到的照缺省剥,`PATH` / `HOME` 这类非密钥键照常在 —— hermetic 形会让子进程当场找不到自己的工具链)。
@@ -70,7 +70,7 @@ export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
  * 各腿不直接调它 —— 经 {@link hostSubprocessEnv}(剥 + 放回 + 留痕一只口)。
  *
  * **只为宿主子进程组合**。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env 不经本函数:那些车道不继承本进程 env,只交
- * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
+ * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` / `K8S_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
  * core 7.35.0 #1201 删除 —— git 的 env 配置族成了豁免族,不再有「按子进程平台读记录」这件事,S-877。)
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
@@ -100,6 +100,12 @@ export declare function hostSubprocessEnv(o: {
     site: SecretEnvScrubSite;
     allow: readonly string[];
 }, sourceEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * {@link hostSubprocessEnv} 的**组合本体**(不披露、不计数)—— 同一只组合,两个入口:真要交给子进程的现场经 `hostSubprocessEnv`(组合 + 披露);
+ * 只想知道「子进程**会**拿到什么」的读者(core 7.49.0 #1554:host 车道的 `ExecutionEnv.cdPath` 要报子进程真拿到的 `CDPATH`)读这一只 ——
+ * 既不另写一份组合(第二份会漂),也不把一次没发生的 spawn 记进剥除计数。
+ */
+export declare function composeHostSubprocessEnv(allow: readonly string[], sourceEnv?: NodeJS.ProcessEnv, findings?: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
 /** git 子进程腿的现场(闭集里名字带 `.git-` 的那几只 —— 编译期筛;它们都没有点名放行面)。 */
 export type GitSubprocessSite = Extract<SecretEnvScrubSite, `${string}.git-${string}`>;
 /**

package/dist/server-secret-env.js

@@ -24,10 +24,13 @@ export function scrubServerSecrets(env, findings) {
 }
 export function hostSubprocessEnv(o, sourceEnv = process.env) {
     const scrubFindings = [];
-    const composed = { ...scrubServerSecrets(sourceEnv, scrubFindings), ...allowlistedEnv(o.allow, sourceEnv) };
+    const composed = composeHostSubprocessEnv(o.allow, sourceEnv, scrubFindings);
     recordSecretEnvScrub(o.site, scrubFindings.filter((f) => composed[f.key] !== sourceEnv[f.key]), o.allow);
     return composed;
 }
+export function composeHostSubprocessEnv(allow, sourceEnv = process.env, findings = []) {
+    return { ...scrubServerSecrets(sourceEnv, findings), ...allowlistedEnv(allow, sourceEnv) };
+}
 export function gitSubprocessEnv(o) {
     return {
         ...hostSubprocessEnv({ site: o.site, allow: [] }),

package/dist/session-incarnation.d.ts

@@ -1,3 +1,33 @@
+/**
+ * S-790 / S-506([ref] §2)—— **会话化身**:一个会话 id 是座位,化身是这一位住客。
+ *
+ * 会话 id 由调用方自选,删掉之后同一个 id 可以被别人(或同一个人)重新登记(`boot/session-faces.ts` 的级联删除注自认)。
+ * 本仓大量持久状态只按会话 id 分区,于是「上一位住客留下的东西」会在下一位名下继续起作用。化身令牌给「是不是同一位住客」
+ * 一个可比的答案 —— 今天只能比属主,同一个人删了重建就比不出来。
+ *
+ * ## 规则(全仓唯一处写)
+ *  · **铸点只在新建行**:会话店的 `register` / 无 id 创建 / fork / session-sync 的导入新行。已存在的行一个字节都不动
+ *    (与 `owner` 同一条 first-write 律);session-sync 的整段换装(replace / staged commit)换的是**同一位住客**的日志,
+ *    化身沿用。删除随行消失,同 id 重新登记铸新的。
+ *  · **值是不透明随机串**(`randomUUID()`,v4:没有时间戳、没有机器信息 —— 刻意不用 uuidv7,那一形带铸造时刻)。只拿来比较。
+ *  · **一格、一个解码**:住客令牌是会话**行**上的一格 —— SQL `session_meta.incarnation`(两方言)、local 后端的会话元数据边档那一格
+ *    (`plugins/local-session-store.ts` 的 `session-incarnations.json`)。每只店对它只有**一次读**(`sessionFaceOf`),行上的值只经
+ *    {@link incarnationFromCell} 解码;别的读法都从这一次读派生(下一节),没有第二份。
+ *  · **读口唯一**:会话店的 `sessionFaceOf(sessionId) → { owner, incarnation } | undefined`,一次读同时给两样
+ *    (两次独立读在删除 / 重登记的缝里能拼出混世代组合,与 `getHead` 同一条理由)。`undefined` = 没有这只会话。
+ *  · **读到空化身 ⇒ 响亮拒**({@link SessionIncarnationMissingError}):一次性迁移(`plugins/one-time-migrations.ts` 登记表 M5)
+ *    之后,空值只可能来自没铸化身的写腿或人为改库 —— 把它当「通配」就是让任何人都能和这一行比成同一位住客。
+ *  · **不上 wire、不进模型上下文、不进日志正文**:日志里要点名时只打 {@link incarnationLogPrefix}(前 8 位)。
+ *
+ * ## 谁读它(全部派生自那一格)
+ *  · `/decide` 的 parked 赎回腿(`parked-decide.ts`):claim 前读一次、claim 后再读一次,会话不在或化身变了 ⇒ 回滚 claim、
+ *    答既有的 `409 decide.not_parked`;赎回面(`parked-revive-surface.ts`)只在属主相等**且**两次读是同一位住客时交继承座。
+ *  · core 的记忆引擎:Runner 读**它取到的那只会话**的 `getMetadata().incarnation`(SQL 两店的 wake 带出这一列;local 店交出的会话
+ *    在元数据上答边档那一格),不再有宿主座。
+ *  · 按 id 读的消费方(没取会话的那一侧 —— k8s 工作区空间的分区,`boot/execution-env.ts`):core 的 `SessionStore.incarnationOf`,
+ *    三只店都实装为 `sessionFaceOf` 的化身那一半;缓存包装层原样转发。「店有没有这只读」只判一处:{@link incarnationReadOf}。
+ */
+import type { SessionStore } from "@sema-agent/core";
 /** 会话元数据的一次读:属主 + 化身(同一行、同一次读)。 */
 export interface SessionFace {
     /** `null` = 登记为无主的会话。 */
@@ -31,10 +61,24 @@ export declare class SessionIncarnationMissingError extends Error {
     constructor(sessionId: string);
 }
 /**
- * 店把一行原始列读成 {@link SessionFace} 的唯一口(三只店共用 —— 空值判据只写这一处)。
- * `incarnation` 不是非空字符串 ⇒ {@link SessionIncarnationMissingError}。
+ * 行上化身那一格的**唯一解码**(三只店的 `sessionFaceOf` 与 SQL 两店 wake 带出的会话元数据都经它 —— 空值判据只写这一处)。
+ * 不是非空字符串 ⇒ {@link SessionIncarnationMissingError}。
  */
+export declare function incarnationFromCell(sessionId: string, cell: unknown): string;
+/** 店把一行原始列读成 {@link SessionFace} 的唯一口(三只店共用;化身那一格经 {@link incarnationFromCell})。 */
 export declare function sessionFaceFromRow(sessionId: string, owner: string | null, incarnation: unknown): SessionFace;
+/** 按 id 读住客(core `SessionStore.incarnationOf` 的形):`undefined` = 没有这只会话;读抛 = 读故障,不是答案。 */
+export type IncarnationRead = (sessionId: string) => Promise<string | undefined>;
+/**
+ * 「这只会话店能不能按 id 答住客」—— 全仓**只判这一处**:起服门(`assertWorkspaceSpaceReadable`)与 k8s 工作区空间的每 run 读
+ * (`createK8sRunEnvFactory`)读的是同一只返回值(装配第 5 段判一次)。缺席 = 店没有实装 `incarnationOf`。
+ */
+export declare function incarnationReadOf(store: Pick<SessionStore, "incarnationOf"> | undefined): IncarnationRead | undefined;
+/**
+ * 「这只会话店能不能按 id 答住客脸(属主 + 化身一次读)」—— 与 {@link incarnationReadOf} 同一处判法、同一个「能不能」:
+ * 空间缓存卷的回收用它一次拿两位(属主要与这次删除验过的那位相符,化身是空间键)。店没有这只读口 ⇒ `undefined`(回收不做,不响)。
+ */
+export declare function sessionFaceReadOf(store: object | undefined): SessionFaceReader | undefined;
 /**
  * session-sync **整段换装**(replace)时化身的去留 —— 三只店共用的一句判据:换装删掉再插回的是**同一位住客**的那一行
  * (删除带属主门),所以行在、属主相同、化身非空 ⇒ 沿用;行不在(这是一次新建)或还是空的存量形 ⇒ 铸一只新的。

package/dist/session-incarnation.js

@@ -24,10 +24,21 @@ export class SessionIncarnationMissingError extends Error {
         this.name = "SessionIncarnationMissingError";
     }
 }
-export function sessionFaceFromRow(sessionId, owner, incarnation) {
-    if (typeof incarnation !== "string" || incarnation === "")
+export function incarnationFromCell(sessionId, cell) {
+    if (typeof cell !== "string" || cell === "")
         throw new SessionIncarnationMissingError(sessionId);
-    return { owner, incarnation };
+    return cell;
+}
+export function sessionFaceFromRow(sessionId, owner, incarnation) {
+    return { owner, incarnation: incarnationFromCell(sessionId, incarnation) };
+}
+export function incarnationReadOf(store) {
+    const read = store?.incarnationOf;
+    return typeof read === "function" ? read.bind(store) : undefined;
+}
+export function sessionFaceReadOf(store) {
+    const read = store?.sessionFaceOf;
+    return typeof read === "function" ? read.bind(store) : undefined;
 }
 export function carriedIncarnation(prior, owner) {
     if (prior !== undefined && (prior.owner ?? null) === owner && typeof prior.incarnation === "string" && prior.incarnation !== "") {

package/dist/session-sync-kernel.d.ts

@@ -5,11 +5,12 @@
  * importSession/planSync) so the three DB session adapters (local/pg/tidb) and security.ts can depend on these
  * symbols WITHOUT touching the orchestration module — session-sync.ts value-imports StoreBackend and type-imports
  * security's OwnerAwareSessionStore, so importing it from security.ts formed the repo's only true type cycle
- * (security ↔ session-sync; lens2 §B/§E). This file imports NOTHING from the repo (core types only) — a leaf,
- * same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
+ * (security ↔ session-sync; lens2 §B/§E). This file imports nothing from the repo but TYPES from leaves (core types, and
+ * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
  * keep working unchanged.
  */
 import type { SessionTreeEntry } from "@sema-agent/core";
+import type { SessionFace } from "./session-incarnation.js";
 /**
  * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
  * handle. The whole-bundle `importSession` (session-sync.ts) buffers every entry in one JSON body (server memory ∝ session size);
@@ -39,11 +40,17 @@ export interface StagingHandle {
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
     /** ATOMICALLY swap the staged rows into the real session id (ONE txn): in-txn re-classify (TOCTOU close) → purge dst
      *  → row-key rename staging→real → session_meta LAST (the commit point). `owner` is re-stamped (§9). Throws
-     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation. */
+     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation **and the settled session
+     *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
+     *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
+     *  occupant (the session row's two bits) write on exactly this face — a session deleted and re-created after the commit,
+     *  even by the same owner, is a different occupant and is not written. A row without an incarnation is refused at that read
+     *  (`sessionFaceFromRow`, the same law as every face read). */
     commit(owner: string | null, opts?: {
         resolution?: "overwrite-dst";
     }): Promise<{
         relation: SyncRelation["relation"];
+        face: SessionFace;
     }>;
     /** Drop the staging rows (Phase B aborted before commit) — DELETE the staging-id session_event rows. Idempotent. */
     abort(): Promise<void>;

package/dist/spec-fields.d.ts

@@ -66,12 +66,12 @@ export declare function skillToolListRefusal(skill: Record<string, unknown>): st
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
- *  **名字归引擎一只判**(core 7.45.0 #1377 / #1385,开跑前,三来源同判):没有工具能是的拼法(带空白 / 括号形坏 / 不可见字符)、非字符串条目 ⇒ 整 run 拒
- *  `config.agent.unknown_tool`;无人挂的名 ⇒ 不拒、经 `onError`(phase `"config"`)告一次(本仓汇点 `runner_config_advisory`);大小写孪生 / 退役名(`bash` / `BASH`)
- *  ⇒ 开跑前拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,
- *  `capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。两张表管子代手里的**全部**工具:委派池与 hands 内建(`Read` / `Edit` / `Write` /
- *  `Bash` …,core #1430)—— `denyTools:["Write"]` ⇒ 子代没有 `Write`;`allowTools` 只点了调用方工具 ⇒ 子代一只 hands 工具都没有。hands 行之外的引擎工具
- *  (`Monitor` 等)仍不受这两张表管(引擎已知限制)。`denyTools` 的 `Tool(content)` ⇒ 整只工具对该子代藏起并告。本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
+ *  **名字归引擎一只判**(core 7.49.0 #1623 / #1433 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):没有任何工具答应的名字
+ *  (无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`、坏拼法、非字符串条目)⇒ 整 run 拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处
+ *  声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,`capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。
+ *  两张表管子代可挂载的**全部**工具:委派池、hands 内建、引擎自己的工具(`Monitor` / `Artifact` / `Skill` / 记忆工具 …)与父的 MCP 挂载 ——
+ *  `denyTools:["Monitor"]` ⇒ 子代没有 `Monitor`;`allowTools` 只点了调用方工具 ⇒ 子代只剩那几只与它这条腿的协议工具。`denyTools` 的 `Tool(content)` ⇒ 整只工具。
+ *  本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;
@@ -130,6 +130,22 @@ export declare function retainBackgroundProcessesFromBody(raw: unknown, requireP
  *  DEFENSIVE(resume 重放不过 HTTP 400 门):非数组 ⇒ undefined;项非非空字符串 ⇒ 逐项 DROP;空数组 ⇒
  *  undefined(不挂键=core 缺省,byte-compat)。HTTP 门另有 fail-loud 400(提交面邻居姿势)。 */
 export declare function toolNameListFromBody(raw: unknown): string[] | undefined;
+/** 引擎从哪一版起认 `TaskSpec.allowTools`(core 7.49.0 #1623,[ref])。 */
+export declare const ALLOW_TOOLS_MIN_ENGINE = "7.49.0";
+/**
+ * S-1448(core 7.49.0 #1623 / [ref])—— body.allowTools → `TaskSpec.allowTools`:引擎的**可用性选择器**,原样透传。
+ *
+ * 一条规则:这一 run 能用哪些工具由引擎一只运算答(`universe ∩ ceiling ∩ allow − deny`,prepare 对真实挂载的一切算一次)。
+ * 本仓**零读法** —— 不算补集、不逐项过滤(`[]` = 什么都不给,是合法值,不折成缺席;非串条目与未知名由引擎在 prepare 拒,
+ * `config.tool_face_control`)、不与 allow 层 `allowedTools`(免问)混词。受理门只判 wire 形(与 `excludeTools` / `deferTools` 同一只门)。
+ * 续跑重放同经此处:存量体逐字再投,坏形交引擎拒(收窄键丢了 = 放宽,所以不 DROP)。
+ *
+ * 装着的引擎不认该座(< {@link ALLOW_TOOLS_MIN_ENGINE})⇒ **响亮拒** 400 `request.field_invalid`(点名键、所需版本与装着的版本),
+ * 不静默丢。`engineVersion` 缺省读装着的 core(`CORE_ENGINE_VERSION`);测试传假低版。
+ */
+export declare function allowToolsSpecFragment(raw: unknown, engineVersion?: string): {
+    allowTools?: string[];
+};
 /** [ref]/[ref] — body.promptProfile → `TaskSpec.promptProfile`(core 1.328 R2 主件,CC LT(model_id)
  *  同构双形轴)。语义:纯呈现轴不碰策略(simple=CC 212 短形面缺省;classic=长形面,可按任务/模型试分)
  *  ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(引擎缺省 simple,byte-compat)。
@@ -177,10 +193,10 @@ export declare function normalizeApproachNotice(raw: unknown): false | {
  * [ref]④ — body.limits 与 env 墙钟的合成规则(resolveSpec 的唯一 limits 装配点;run-local 无 body 车道不经此):
  *  - `timeoutSec`:body 给了就用 body(caller 明确配速;已在 normalizeLimits 里被 TASK_TIMEOUT_MAX_SEC 封顶)。
  *    body 缺席保持既有姿势 = tenancy 墙钟 + env `TASK_TIMEOUT_SEC` 只抬不降(taskWallClockSec 内 Math.max,
- *    误配低值不能砍 council 预算)。注意两条纪律不叠加:「只抬不降」是 env 对内建缺省墙的规则,body 是
+ *    误配低值不能砍 tenancy 基值)。注意两条纪律不叠加:「只抬不降」是 env 对内建缺省墙的规则,body 是
  *    caller 的显式意图,直接生效(可低于 env 墙 —— 交互短任务要更紧的配速正是本件诉求)。
  *  - `maxOutputTokens` / `maxTurns`:直透传(各自可选 env 上限已 clamp)。
  * 全空 ⇒ undefined(spec 不挂 limits 键,byte-compat)。
  */
-export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
+export declare function resolveTaskLimits(bodyLimits: unknown, caps: TaskLimitCaps, envTimeoutSec: number, requirePrincipal: boolean | undefined, warn?: (event: string, fields: Record<string, unknown>) => void): TaskSpec["limits"];
 //# sourceMappingURL=spec-fields.d.ts.map

package/dist/spec-fields.js

@@ -1,6 +1,8 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
+import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { createCodedHttpError } from "./security.js";
 import { allowLayerEntryCountIssue, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
@@ -270,6 +272,23 @@ export function toolNameListFromBody(raw) {
     const names = raw.filter((v) => typeof v === "string" && v.length > 0);
     return names.length > 0 ? names : undefined;
 }
+export const ALLOW_TOOLS_MIN_ENGINE = "7.49.0";
+function engineAtLeast(version, floor) {
+    const parse = (v) => v.split(/[-+]/, 1)[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+    const [a, b] = [parse(version), parse(floor)];
+    for (let i = 0; i < 3; i++)
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    return true;
+}
+export function allowToolsSpecFragment(raw, engineVersion = CORE_ENGINE_VERSION) {
+    if (raw === undefined)
+        return {};
+    if (!engineAtLeast(engineVersion, ALLOW_TOOLS_MIN_ENGINE)) {
+        throw createCodedHttpError(400, "request.field_invalid", `allowTools needs engine ${ALLOW_TOOLS_MIN_ENGINE} or later; this server runs engine ${engineVersion}, which would drop the list and leave every tool available — send the request without allowTools, or upgrade the server`);
+    }
+    return { allowTools: raw };
+}
 export function promptProfileFromBody(raw) {
     return raw === "simple" || raw === "classic" ? raw : undefined;
 }
@@ -318,10 +337,10 @@ export function normalizeApproachNotice(raw) {
     const frac = (n) => typeof n === "number" && Number.isFinite(n) && n > 0 && n <= 1;
     return frac(a) && frac(b) && a <= b ? { at: [a, b] } : undefined;
 }
-export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, big, warn) {
+export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, warn) {
     const dropped = retiredLimitKeysPresent(bodyLimits);
     const requested = normalizeLimits(bodyLimits, caps);
-    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal, big);
+    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal);
     const maxWalltimeMs = requested?.maxWalltimeMs ?? (wallSec !== undefined ? wallSec * 1000 : undefined);
     if (dropped.length > 0)
         warn?.("task_limits_legacy_key_dropped", { droppedKeys: dropped, effectiveMaxWalltimeMs: maxWalltimeMs ?? null });

package/dist/task-workflow.d.ts

@@ -113,10 +113,12 @@ export declare function normalizeRetainSubagentSessions(raw: unknown): boolean |
  *  - SINGLE-USER turnkey(`requirePrincipal !== true`)= the user IS the superadmin → **NO wall clock**
  *    (undefined; core arms none — its separate wedge safety-net still catches a stuck tool call, so "no wall"
  *    never means "hangs forever"). CC has no whole-task decapitation either.
- *  - MULTI-TENANT: base 2400s (big tasks — council/debate/discuss — 3600s). (PAIR-REVIEW F-4 附带修:此行
- *    曾写 600s/1500s 与代码漂移——真值以下方 base 为准。)
+ *  - MULTI-TENANT: base 2400s (one base: the 3600s big-task lane existed only for council/debate/discuss, which
+ *    left with the engine's team runtime in 7.49.0).
  *  - Explicit `TASK_TIMEOUT_SEC` wins in ANY tenancy (the operator's deliberate wall) and keeps its documented
- *    raise-only floor (`Math.max` with the base, so a misconfigured low value cannot shrink a council budget).
+ *    raise-only floor (`Math.max` with the base, so a misconfigured low value cannot shrink the tenancy base).
  */
-export declare function taskWallClockSec(envTimeoutSec: number, requirePrincipal: boolean | undefined, big: boolean): number | undefined;
+/** 多租户(requirePrincipal)任务墙钟基值(秒)—— 唯一来源:`taskWallClockSec` 与 resolve-spec 的 `server.limits.wallClockBaseSec` 声明都读它(3600 s 大任务档已随团队编排面退役删除)。 */
+export declare const TENANCY_WALL_CLOCK_BASE_SEC = 2400;
+export declare function taskWallClockSec(envTimeoutSec: number, requirePrincipal: boolean | undefined): number | undefined;
 //# sourceMappingURL=task-workflow.d.ts.map

package/dist/task-workflow.js

@@ -39,8 +39,9 @@ export function normalizeRetainSubagentSessions(raw) {
         return undefined;
     return { ...(ttlMs !== undefined ? { ttlMs } : {}), ...(max !== undefined ? { max } : {}) };
 }
-export function taskWallClockSec(envTimeoutSec, requirePrincipal, big) {
-    const base = big ? 3600 : 2400;
+export const TENANCY_WALL_CLOCK_BASE_SEC = 2400;
+export function taskWallClockSec(envTimeoutSec, requirePrincipal) {
+    const base = TENANCY_WALL_CLOCK_BASE_SEC;
     if (envTimeoutSec > 0)
         return Math.max(envTimeoutSec, base);
     return requirePrincipal === true ? base : undefined;