@sema-agent/server 7.128.0 → 7.129.1

package/dist/boot/stores.js

@@ -18,7 +18,7 @@ import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterS
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
-import { logOneTimeMigrations } from "../plugins/one-time-migrations.js";
+import { runAndLogOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
@@ -100,7 +100,7 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
     }
     if (backend)
-        logOneTimeMigrations(logger, backend.kind, await backend.runOneTimeMigrations());
+        await runAndLogOneTimeMigrations(logger, backend);
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",

package/dist/boot/web-admin.js

@@ -19,13 +19,14 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
+import { buildDeploymentPostureSeats } from "./runner-deps.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -631,7 +632,7 @@ export async function createWebAdminRuntime(ctx) {
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
     }
-    const readFaceBaseline = { ...(config.readFace !== undefined ? { readFace: config.readFace } : {}), readFaceSource: config.readFaceSource };
+    const readFaceBaseline = buildReadFaceBaseline(config);
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined).envHeld;
     if (!modelReadyState.ready)
         logger.warn("model_roster_pending", {
@@ -648,18 +649,21 @@ export async function createWebAdminRuntime(ctx) {
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
     const applyLiveReadFace = (eff, swap, phase) => {
-        const before = config.readFace;
-        const beforeSource = config.readFaceSource;
-        const { faceChanged } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
-        if (!faceChanged)
+        const before = buildReadFaceBaseline(config);
+        const { changedSeats } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
+        if (changedSeats.length === 0)
             return;
         try {
-            swap({ readFace: config.readFace });
-            logger.info("read_face_swapped", { from: before ?? null, to: config.readFace ?? null, phase, note: "hot seat (core swapDeps) — legs that already prepared keep the face they prepared under" });
+            swap(buildReadFaceSwapCandidate(buildDeploymentPostureSeats(config), changedSeats));
+            logger.info("read_face_swapped", {
+                seats: changedSeats,
+                ...(changedSeats.includes("readFace") ? { from: before.readFace ?? null, to: config.readFace ?? null } : {}),
+                phase,
+                note: "hot seats (core swapDeps) — legs that already prepared keep the read posture they prepared under",
+            });
         }
         catch (err) {
-            config.readFace = before;
-            config.readFaceSource = beforeSource;
+            restoreReadFaceBaseline(config, before);
             throw err;
         }
     };
@@ -976,6 +980,9 @@ export async function createWebAdminRuntime(ctx) {
                         if (configProvider.kind === "remote")
                             lastPull = "ok";
                     }
+                    catch (err) {
+                        logger.warn("web_admin_refresh_failed", { err: String(err), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                    }
                     finally {
                         refreshInFlight = false;
                     }

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -21,13 +21,16 @@
  *
  * ## 修形 = 照 [ref] 的配方接第四面(不是新造语义)
  *
- * brain 换成 `createPerModelKeyBrain(brain, getKeyResolver)`:
- *  · 有 per-model key ⇒ 注入 `options.apiKey`,请求带模型自己的凭据;
- *  · 无 ⇒ 不注入 ⇒ 交回 core 按它自己的 key↔URL 配对法判(core 5.57.0 起:部署根声明了而 entry URL
- *    不在那个根上 ⇒ `route.credential_mismatch` 响亮拒;未声明部署根 = `"unpinned"` 快速起步姿态 ⇒
- *    照旧回落网关 key。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,见 side-query-lane.ts 顶注);
+ * 当年 core 的摘要器没有凭据座,只能在 brain 外面包一层注入 `options.apiKey`(`createPerModelKeyBrain`)。
+ * core 7.51.0 起 `WebFetchSummarizerOptions.getApiKeyAndHeaders` 是与 `TaskSpec` / `SideQuerySpec` 同一签名的座
+ * (每次摘要按摘要器的模型解一次,`{ apiKey, headers }` 两半都收)⇒ 那层包装退役:`RunnerDeps.brain` 原样交给
+ * 摘要器,座位由与 side-query / 记忆整理**同一只**座位工厂(`createPerModelAuthSeat`)填充:
+ *  · 有 per-model key ⇒ 请求带模型自己的凭据;
+ *  · 无 ⇒ 座位回 `undefined` ⇒ 交回 core 按它自己的 key↔URL 配对法判(部署根上的模型带网关 key;
+ *    entry URL 不在部署根上 ⇒ `route.credential_mismatch` 响亮拒 —— core 7.51.0 起没有「未声明部署根」的
+ *    `unpinned` 快速起步姿态了,一份部署凭据只配一个根。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,
+ *    见 side-query-lane.ts 顶注);
  *  · 毒丸 ⇒ **上抛**,一个字节都不发(CLAUDE.md [ref] 安全轴 fail-closed)。
- * wrapper 只包本席这一只引用,`RunnerDeps.brain` 零扰动(与 side-query 席同形)。
  *
  * ## 为什么住在 `boot/` 而不是继续躺在 `main()` 的闭包里
  *
@@ -49,7 +52,7 @@ import { type KeyResolver } from "./side-query-lane.js";
 /** WebFetch 摘要执行席(= `ScenarioDeps.webFetchSummarize`,core 的 `WebFetchConfig.summarize` 逐字同形)。 */
 export type WebFetchSummarizeLane = NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
 export interface WebFetchSummarizeLaneCtx {
-    /** 与 `RunnerDeps.brain` **同一只**实例(wrapper 在外面包,不改这只)。 */
+    /** 与 `RunnerDeps.brain` **同一只**实例,原样交给摘要器(凭据走摘要器的座位,不包 brain)。 */
     brain: Brain;
     /** 活配置引用:目录/角色表被 web-admin 就地热应用(`mutateInPlace`),按调用取值才跟得上。 */
     config: ServiceConfig;

package/dist/boot/webfetch-summarize-lane.js

@@ -1,7 +1,6 @@
 import { createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { createPerModelKeyBrain } from "./side-query-lane.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 export function createWebFetchSummarizeLane(ctx) {
-    const brain = createPerModelKeyBrain(ctx.brain, ctx.getKeyResolver);
     return async (content, prompt, signal) => {
         const model = (() => {
             try {
@@ -14,7 +13,7 @@ export function createWebFetchSummarizeLane(ctx) {
         })();
         if (!model)
             throw new Error("summarize model unresolved for this deployment");
-        return createWebFetchSummarizer(brain, model)(content, prompt, signal);
+        return createWebFetchSummarizer(ctx.brain, model, { getApiKeyAndHeaders: createPerModelAuthSeat(ctx.getKeyResolver) })(content, prompt, signal);
     };
 }
 //# sourceMappingURL=webfetch-summarize-lane.js.map

package/dist/brain.js

@@ -54,11 +54,10 @@ export function createBrainAssembly(config, deps = {}) {
             : {};
     const routes = deploymentGatewayRoots(config);
     const openaiBrains = routes.map((baseUrl, i) => {
+        const gatewayKey = deploymentGatewayKey(config);
         const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
             baseUrl,
-            get apiKey() {
-                return deploymentGatewayKey(config);
-            },
+            ...(gatewayKey !== undefined ? { apiKey: gatewayKey } : {}),
             ...retryCap,
             fetchImpl,
             ...timeouts,
@@ -106,16 +105,14 @@ export function createBrainAssembly(config, deps = {}) {
             const ownSealed = credential.sealed !== undefined ? { [fallbackModel.name]: credential.sealed } : {};
             const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, ownEnvRef, process.env, ownSealed);
             const anthropicLaneHop = dispatchBrainLane(fallbackModel.provider, anthropicBrain !== undefined) === "anthropic";
+            const fbDeclaredRoot = degradeDeclaredRoot(fallbackModel.baseUrl, config);
+            const fbDeploymentKey = deploymentGatewayKey(config);
             const fallback = anthropicLaneHop && anthropicBrain
                 ?
                     anthropicBrain
                 : constructRouteBrain(`degrade target "${degradeTo}"`, [fallbackModel.baseUrl, config.gatewayBaseUrl], () => createOpenAIBrain({
-                    get baseUrl() {
-                        return degradeDeclaredRoot(fallbackModel.baseUrl, config);
-                    },
-                    get apiKey() {
-                        return deploymentGatewayKey(config) || undefined;
-                    },
+                    ...(fbDeclaredRoot !== undefined ? { baseUrl: fbDeclaredRoot } : {}),
+                    ...(fbDeploymentKey ? { apiKey: fbDeploymentKey } : {}),
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,

package/dist/capabilities/builtin-tools.d.ts

@@ -27,8 +27,8 @@ export interface SubagentExtraToolOptions {
  *
  * core 7.46.0 #1432 —— **工厂与名册一个来源**:返回委派工具的两键,`extraTools`(每次 spawn 交出 `forSpawn` 选中的那几只)与
  * `extraToolNames`(全部可能交出的那几只的名字 / 别名 / 内容来源,从同一批 `ToolSpec` 读出)。名册在场 ⇒ 引擎重新能列出子代的工具池:
- * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字(core 7.49.0 #1623 起含无人挂的名;退役拼法与大小写孪生 7.46.0 起)开跑前拒
- * (`config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
+ * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字由引擎按名册判(core 7.51.0 #1736 起不拒 run:条目原样保留、告知一次并带该写的拼法;
+ * 7.46.0–7.50.x 曾开跑前拒 `config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
  * 修前(core 7.32.0–7.45.x)工厂恒在场 ⇒ 池不可静态知 ⇒ 那一族拼法只告不拒、委派结果一律按「外部」读。
  * 工厂**不抛**:各组的 `tools` 是装配期就建好的对象;部署 `forSpawn` 的抛由 core 收成「这一 spawn 什么都不继承 + 模型面披露句」(onExtraToolsError 记 warn)。
  * 一种拼法出现在两只工具上(部署工具与 `Now` 撞名 / 别名撞)⇒ core 在建委派工具处抛 `config.extra_tool_names`(`shape`),不静默取其一。

package/dist/capabilities/engine-capabilities.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 引擎能力词 → `GET /v1/capabilities` 顶层布尔键(core 7.51.1 `ENGINE_CAPABILITIES`;[ref]:词由引擎定,投影形由本仓定)。
+ *
+ * 形:引擎的能力词**原样**作顶层键(`"inherit_env.own_credentials_withheld": true`),值 = 该词在**本进程**为真的事实。键集由 `ENGINE_CAPABILITIES`
+ * 机器派生(一只投影循环,不逐词写键);事实表 {@link ENGINE_CAPABILITY_FACTS} 是 `Record<EngineCapability, …>` 型 —— 引擎加词而本表没跟 = tsc 红,
+ * 本表多一个引擎没有的词 = tsc 红(闭集的双向门),所以「这台引擎说它能,本服务也真接上了」不靠人记得登记。
+ * 壳按词闸(cli 读顶层布尔 `true`),不按版本号猜;契约附录 B.1 与 `test/capabilities-doc-appendix.test.ts` 把这些键与引擎词集对拍。
+ */
+import { type EngineCapability } from "@sema-agent/core";
+/** 投影:引擎词集的每一词 → 本进程的事实(键集恒 = `ENGINE_CAPABILITIES`)。 */
+export declare function engineCapabilityBits(): {
+    readonly [W in EngineCapability]: boolean;
+};
+//# sourceMappingURL=engine-capabilities.d.ts.map

package/dist/capabilities/engine-capabilities.js

@@ -0,0 +1,12 @@
+import { ENGINE_CAPABILITIES } from "@sema-agent/core";
+import { ownCredentialsWithheld } from "../server-secret-env.js";
+const ENGINE_CAPABILITY_FACTS = {
+    "inherit_env.own_credentials_withheld": ownCredentialsWithheld,
+};
+export function engineCapabilityBits() {
+    const out = {};
+    for (const word of ENGINE_CAPABILITIES)
+        out[word] = ENGINE_CAPABILITY_FACTS[word]();
+    return out;
+}
+//# sourceMappingURL=engine-capabilities.js.map

package/dist/capability-facts.d.ts

@@ -328,5 +328,7 @@ export declare function workspaceCache(c: Pick<ServiceConfig, "remoteExec">): Fa
 }>;
 /** 自唤醒调度器挂在宿主 env 上:`SCHEDULER_ENABLED` ∧ 单用户 ∧ host 车道。装配(`boot/execution-env.ts`)与能力位同调。 */
 export declare function hostScheduler(c: Pick<ServiceConfig, "schedulerEnabled" | "requirePrincipal" | "remoteExec">): Fact<"scheduler_disabled" | "multi_tenant_deployment" | "not_host_lane">;
-export {};
+/** 引擎能力词的事实(core `ENGINE_CAPABILITIES` 每词一只谓词,值 = 本进程的事实;`/v1/capabilities` 以顶层布尔键展开它们)—— 住在
+ *  `capabilities/engine-capabilities.ts`,这里只是把它纳入「能力位只投影事实」的同一张读面,静态门认 `facts.engineCapabilityBits()` 这一只展开。 */
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.d.ts.map

package/dist/capability-facts.js

@@ -378,4 +378,5 @@ export function hostScheduler(c) {
         return no("not_host_lane");
     return YES;
 }
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.js.map

package/dist/config-catalog.js

@@ -5,6 +5,7 @@ import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_M
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
@@ -30,6 +31,8 @@ const RESTART_SLICE_SET = {
 };
 export const CATALOG_RESTART_SLICES = Object.keys(RESTART_SLICE_SET);
 const r = (name, domain, type, semantics, opts = {}) => ({ name, domain, type, semantics, ...opts });
+const LIVENESS_KNOB_SEMANTICS = (lane) => `${lane} 命令静默活性上限(ms):无输出满这么久即判挂死切断,只管没有显式超时的命令 —— 带显式超时的命令只受那个超时约束(安静的长构建给命令一个显式超时即可,不必调大本值)`;
+const LIVENESS_KNOB_DEFAULT_NOTE = `缺席 ⇒ adapter 默认 ${LIVENESS_MS_DEFAULT / 1000}s`;
 const cLimits = (path, over = {}) => ({
     domain: "limits",
     path,
@@ -138,7 +141,7 @@ export const CONFIG_CATALOG = [
     r("E2B_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "e2b 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("E2B_BG_MAX_CONCURRENT", "orchestration", "number", "e2b 后台 shell 并发帽", { staticDefault: "8" }),
     r("E2B_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "e2b 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
-    r("E2B_LIVENESS_MS", "orchestration", "number", "e2b 单命令静默活性上限(长静默构建请调大;后台+轮询仍是首选)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("E2B_LIVENESS_MS", "orchestration", "number", LIVENESS_KNOB_SEMANTICS("e2b"), { derivedDefaultNote: LIVENESS_KNOB_DEFAULT_NOTE }),
     r("E2B_MOUNT_PATH", "orchestration", "path", "e2b 工作区根(resume 用当前值,改前先 drain 挂起任务)"),
     r("E2B_ORPHAN_RECLAIM", "orchestration", "boolean", "崩溃遗留沙盒回收腿(boot 一次+周期;判据保守,拿不准恒不杀)", { staticDefault: "true", danger: BILL }),
     r("E2B_SANDBOX_ENV", "orchestration", "secret", "转发进 e2b 沙箱的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/事件日志;与 LSP_ENV_ALLOW / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
@@ -191,6 +194,7 @@ export const CONFIG_CATALOG = [
     r("K8S_CA_CERT_B64", "orchestration", "opaque", "k8s API CA 证书(base64;registry secrets 无换行约束)", { danger: SEC }),
     r("K8S_CPU", "orchestration", "string", "沙箱 pod CPU 限额(profile 数据)"),
     r("K8S_INSECURE_TLS", "orchestration", "boolean", "跳过 k8s API TLS 校验", { staticDefault: "false", danger: SEC }),
+    r("K8S_LIVENESS_MS", "orchestration", "number", LIVENESS_KNOB_SEMANTICS("k8s"), { derivedDefaultNote: LIVENESS_KNOB_DEFAULT_NOTE }),
     r("K8S_MEMORY", "orchestration", "string", "沙箱 pod 内存限额(2Gi 默认曾被真 OOM)"),
     r("K8S_MOUNT_PATH", "orchestration", "path", "k8s 工作区挂载路径"),
     r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod namespace"),

package/dist/config-types.d.ts

@@ -471,8 +471,9 @@ export interface ServiceConfigFlat {
      *  由 boot(config.ts)与热路径(apply-effective)同一只判据保证。 */
     gatewayBaseUrl?: string;
     /** `MODEL_API_KEY` —— **网关的**凭据,只与网关根配对([ref])。S-623:与 `gatewayBaseUrl` 同进同出 ——
-     *  没有网关就不装载(否则 brain 的声明根为空 ⇒ core 判 `unpinned` ⇒ 这把 key 会被送到每条自带 baseUrl 的
-     *  openai 条目),由 `model_gateway_key_unpaired` 启动通知说出来。 */
+     *  没有网关就不装载(否则 brain 的声明根为空:core 7.51.0 起判 `route.credential_mismatch`,每条自带 baseUrl、没有
+     *  per-model 凭据的 openai 条目被拒;7.51.0 前是 `unpinned`,key 随请求发往那些条目),由 `model_gateway_key_unpaired`
+     *  启动通知说出来。S-1561:brain 在构造时读它一次(core 收据律),本仓没有运行期写者 ⇒ 换值 = 重启。 */
     gatewayApiKey?: string;
     /** Secondary openai-compatible gateways for cross-gateway FAILOVER (same protocol + same model id).
      *  Tried in order after the primary when a gateway fails before streaming any content. */
@@ -897,6 +898,9 @@ export interface ServiceConfigFlat {
         runtimeClass?: string;
         mountPath?: string;
         timeoutMs?: number;
+        /** `K8S_LIVENESS_MS` — the lane's liveness bound (ms; the `E2B_LIVENESS_MS` twin, same parser; absent ⇒ the adapter's
+         *  default 120 s): cuts a command silent for this long ONLY when its caller stated no timeout (`exec-bounds.ts`). */
+        livenessMs?: number;
         /** Resource-profile knobs: sandbox pod limits (adapter defaults: 2Gi / 1 cpu). */
         memory?: string;
         cpu?: string;
@@ -1759,7 +1763,7 @@ export interface ServiceConfigFlat {
      *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
     /** S-699 —— host-lane language-server env **named allowlist** (`LSP_ENV_ALLOW=NAME,NAME`). The language server's env is
-     *  `scrubServerSecrets(process.env)`; each name here is put back **verbatim** from the service's own env on top of that
+     *  the engine's `inheritedHostEnv("scrub")` (shape rules + this deployment's declared own credentials); each name here is put back **verbatim** from the service's own env on top of that
      *  (`allowlistedEnv`, the same "named keys pass" predicate as the host shell's `inheritEnv:[names]`) — the deployer
      *  explicitly accepts handing that value to code the language server runs. Unnamed secret-shaped keys stay stripped.
      *  `[]` = nothing put back (the default: unset / empty string). A malformed list (empty segment / not an env-var name /

package/dist/config.js

@@ -27,6 +27,7 @@ import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdent
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
+import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
@@ -333,6 +334,10 @@ function optNumEnvStrict(name) {
         return undefined;
     return parseNumOrFail(name, raw);
 }
+function livenessMsEnv(name) {
+    const n = optNumEnvStrict(name);
+    return n === undefined ? undefined : laneLivenessOf(n, name).ms;
+}
 function parseDeviceEnrollTokenTtlEnv() {
     const raw = process.env.DEVICE_ENROLL_TOKEN_TTL_SEC;
     if (raw === undefined || raw === "")
@@ -1836,7 +1841,7 @@ function parseOrchestrationDomain(ctx) {
                 apiKey: process.env.E2B_API_KEY,
                 ...(process.env.E2B_TEMPLATE ? { template: process.env.E2B_TEMPLATE } : {}),
                 ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")),
-                ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")),
+                ...((n) => (n !== undefined ? { livenessMs: n } : {}))(livenessMsEnv("E2B_LIVENESS_MS")),
                 ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: boolEnv("E2B_ALLOW_NET", true) } : {}),
                 ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("E2B_SANDBOX_ENV", singleUserTurnkey)),
                 ...(process.env.E2B_MOUNT_PATH ? { mountPath: process.env.E2B_MOUNT_PATH } : {}),
@@ -1855,6 +1860,7 @@ function parseOrchestrationDomain(ctx) {
                         ...(process.env.K8S_RUNTIME_CLASS != null ? { runtimeClass: process.env.K8S_RUNTIME_CLASS } : {}),
                         ...(process.env.K8S_MOUNT_PATH ? { mountPath: process.env.K8S_MOUNT_PATH } : {}),
                         ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")),
+                        ...((n) => (n !== undefined ? { livenessMs: n } : {}))(livenessMsEnv("K8S_LIVENESS_MS")),
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
                         sandboxIpv6: enumEnv("K8S_SANDBOX_IPV6", SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS),

package/dist/egress-redirect.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 本服务**自己**发往配置端点的出站请求(hook 直连模型腿 `hooks/hook-llm.ts`、记忆 embedder `plugins/memory-embedder.ts`)的
+ * 重定向律 —— 与 core 7.51.0(#1531)一方 brain 的请求同一条:请求以 `redirect: "manual"` 发出,端点回重定向 ⇒ 拒;
+ * 不跟、不重试、拒句不点名目标。
+ *
+ * 为什么:请求只去被判过的那个根。传输层(undici)跟随 POST 307 / 308 时把请求体(用户内容 / 记忆正文)原样送到
+ * `Location`,跨 origin 只剥 `authorization` —— anthropic 形的 `x-api-key` 随行(`test/hook-llm.test.ts` 的 G1 格在
+ * 7.128.x 上实测送达重定向目标)。判据与拒句与 core 的 brain 请求门同形(`opaqueredirect` 或 3xx)。
+ */
+/** 端点回的是重定向 ⇒ 拒句(调用方在前面冠上自己的面名);否则 `undefined`。命中时丢弃响应体(不读、不留连接)。 */
+export declare function egressRedirectRefusal(res: Response, fix: string): string | undefined;
+//# sourceMappingURL=egress-redirect.d.ts.map

package/dist/egress-redirect.js

@@ -0,0 +1,7 @@
+export function egressRedirectRefusal(res, fix) {
+    if (res.type !== "opaqueredirect" && !(res.status >= 300 && res.status < 400))
+        return undefined;
+    void res.body?.cancel().catch(() => undefined);
+    return `endpoint answered with a redirect${res.status > 0 ? ` (HTTP ${res.status})` : ""}; it was not followed and no credential was sent anywhere else — ${fix}`;
+}
+//# sourceMappingURL=egress-redirect.js.map

package/dist/entry-mode-clamp-notice.d.ts

@@ -0,0 +1,30 @@
+/**
+ * S-1306 —— **入口地板钳制**通告(`engine_notice` 码 `permission.entry_mode_clamped`)的唯一铸点(core 7.51.0 #1527 入册:受众 user、
+ * 铸者 `NOTICE_MINTER` = `"server"`,引擎从不铸它)。
+ *
+ * ## 这件事为什么归本仓
+ * 运维 `AUTONOMY=plan` 的入口地板在**受理门**把调用方请求的模式词折回地板(`task-settings.ts` `stampEntryPermissionMode`,底下是
+ * `runtime-governance.ts` `entryPermissionMode` → core `clampPermissionMode`)—— 折叠发生在 run 到达引擎**之前**,所以引擎自己的
+ * `config.permission_mode_unavailable`(它只说它自己做的折叠)看不见这一折。修前 run 在另一个模式下起步,人一个字都看不到。
+ *
+ * ## 铸点(唯一)
+ * {@link buildEntryModeClampNotice} 是本码**唯一**的铸点;调用点只有一处:`http/admission.ts` 的 `prepareSpec`(提交入口,盖章之后、装配
+ * 之后 —— 那时会话 id 才定)。一次提交一次 ⇒ 一条 run 至多一帧(core 码册的去重单位「once per run」)。读的是盖章那一次求值的读数
+ * (`EntryPermissionMode`),不另判一遍「折没折」。续跑腿不铸:它们重放的是已盖过章的存储体,折叠只发生过一次。
+ * 装配期铸、腿开口那一拍投(`PreparedTaskSubmission.engineNotices` → `registerEngineNoticeLeg` 的 `pending`)—— 与请求腿 MCP 丢弃同一条投递路,
+ * 白名单 / 归属 / 消毒 / 隔离一个不绕。
+ *
+ * ## detail
+ * `{ requested, effective, ceiling, sessionId }` —— `requested` = 被折的那个词(体的生效词:顶层 `permissionMode` 或
+ * `settings.permissions.defaultMode`)、`effective` = run 起步的词、`ceiling` = 折它的地板,三个都是 core 的模式闭集词;`sessionId` = 归属键。
+ * 🔴 **无 `runId`**:钳制发生在受理门,引擎的 run 身份要到 prepare 才铸,这一刻不存在(core 码册那一行写了 `runId`;本仓不编造,
+ * 归属看它落在哪条 run 的流 / 账本上 —— 与 `instructions.source_changed` / `session.records_skipped` 同形)。
+ * 什么时候不铸:没有地板;没声明词(取地板本身不算改词,`clamped` 为假);请求的词不比地板松;会话 id 缺席(无处可投,宁缺不串)。
+ */
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+import type { EntryPermissionMode } from "./runtime-governance.js";
+/** 码常量型 = core 码册(#1527 入册:受众 user、铸者 `"server"`)。 */
+export declare const ENTRY_MODE_CLAMPED: EngineNoticeCode;
+/** 一次受理门盖章的读数 → 至多一条通告(读法见文件头)。 */
+export declare function buildEntryModeClampNotice(entry: EntryPermissionMode, sessionId: string | undefined): EngineNotice | undefined;
+//# sourceMappingURL=entry-mode-clamp-notice.d.ts.map

package/dist/entry-mode-clamp-notice.js

@@ -0,0 +1,13 @@
+export const ENTRY_MODE_CLAMPED = "permission.entry_mode_clamped";
+export function buildEntryModeClampNotice(entry, sessionId) {
+    const { requested, effective, floor, clamped } = entry;
+    if (!clamped || requested === undefined || floor === undefined || effective === undefined || sessionId === undefined || sessionId.length === 0)
+        return undefined;
+    return {
+        code: ENTRY_MODE_CLAMPED,
+        message: `This run starts in permission mode "${effective}", not the requested "${requested}": ` +
+            `the deployment's entry floor ("${floor}") clamps every submitted run's mode to it.`,
+        detail: { requested, effective, ceiling: floor, sessionId },
+    };
+}
+//# sourceMappingURL=entry-mode-clamp-notice.js.map

package/dist/exec-bounds.d.ts

@@ -0,0 +1,69 @@
+/**
+ * 执行车道上「什么约束一条命令」的**唯一一条律**(host / e2b / k8s 三只 adapter 同读这一只;纯叶,零依赖):
+ *
+ *   命令由调用方**说出口**的界约束 —— 墙钟 `timeout`(buffered 与流式两面)与 / 或它自己的静默界 `readTimeoutMs`
+ *   (流式面)。调用方**两样都没说**时,才由车道自己的活性界兜底:无输出满这么久即判挂死(k8s `K8S_LIVENESS_MS` /
+ *   e2b `E2B_LIVENESS_MS`,缺省 {@link LIVENESS_MS_DEFAULT};host 没有这一界)—— 那时它是这条命令唯一的挂死护栏。
+ *   切断时报的是**真正触发的那一界**(活性切断的句子只在 {@link livenessCutMessage} 铸)。
+ *
+ * 为什么「说了墙钟就不再活性切断」:墙钟本身就是挂死护栏(它到点必切),而调用方说出一个墙钟,就是在说「这条命令可以跑
+ * 这么久」—— 安静的长构建(Gradle / R8 一段几分钟不出声)正是这种命令。两界并存时,活性界会先于墙钟切掉一条按约正在跑的
+ * 命令,而调用方(core 的 Bash 工具)只知道自己说过的墙钟,便把这次切断报成「跑满了 N 秒」。两界互斥之后,一次切断只可能
+ * 是它报的那一界。
+ *
+ * 与 core 远端契约(`ExecStreamOptions.readTimeoutMs`:「缺省也 SHOULD 有活性界,一条命令不得等到环境死」)的对齐:
+ * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令仍有车道活性界。切断码沿用 core 的 `timeout`(core 远端码表
+ * 把墙钟与活性两种超界都归这一词);两者靠句子区分 —— 独立的活性码属于 core 的码表。
+ *
+ * 不在本律里的界(adapter 自己的上限,不是调用方说的话,不关活性界):k8s 文件读写的数据上限 `dataTimeoutMs`、e2b 交给
+ * 供应商的沙箱寿命上限。adapter 自己的整段数据搬运(k8s 快照 tar 上 / 下)天生静默,它们**自己说**一个墙钟(数据上限),
+ * 落在本律的第一支。
+ */
+/** 车道活性界的缺省(ms)—— k8s / e2b 两只 adapter 与配置目录的「缺席 ⇒ 默认」说法同读这一只。 */
+export declare const LIVENESS_MS_DEFAULT = 120000;
+/** 有活性界的车道各自的旋钮名(闭集;切断句点名它,运维据此知道调哪一只)。 */
+export type LivenessKnob = "K8S_LIVENESS_MS" | "E2B_LIVENESS_MS";
+/** 一条车道自己的活性界:k8s / e2b 有,host 没有(传 `undefined`)。只经 {@link laneLivenessOf} 铸(值已判过)。 */
+export interface LaneLiveness {
+    readonly ms: number;
+    readonly knob: LivenessKnob;
+}
+/**
+ * 车道活性界的唯一铸点与唯一判据:值必须是有限正数(ms),否则**拒**(抛,句子点名旋钮)。活性界是不说界的命令唯一的挂死护栏 ——
+ * `0` / 负数会把它整个撤掉(那条命令从此无界),非数无从计时。boot 的旋钮解析(`E2B_LIVENESS_MS` / `K8S_LIVENESS_MS`)与 adapter
+ * 构造(嵌入方直接传 `livenessMs`)都经这一只判,一个判据、一句拒词。
+ */
+export declare function laneLivenessOf(ms: number, knob: LivenessKnob): LaneLiveness;
+/** 本条命令的静默界:调用方说的(`readTimeoutMs`),或车道兜底的。 */
+export type LivenessBound = {
+    readonly ms: number;
+    readonly setBy: "caller";
+} | {
+    readonly ms: number;
+    readonly setBy: "lane";
+    readonly knob: LivenessKnob;
+};
+/** 一条命令最终受的界:墙钟(调用方说的)与静默界,各自可缺。 */
+export interface CommandBounds {
+    readonly wallMs: number | undefined;
+    readonly liveness: LivenessBound | undefined;
+}
+/** 调用方说出口的界(ms)。`timeoutMs` = 墙钟;`readTimeoutMs` = 它自己的静默界。 */
+export interface StatedBounds {
+    readonly timeoutMs?: number | undefined;
+    readonly readTimeoutMs?: number | undefined;
+}
+/** 本律的唯一实现(见文件头注)。 */
+export declare function commandBoundsOf(stated: StatedBounds, lane: LaneLiveness | undefined): CommandBounds;
+/**
+ * 一条**还没出过一个字节**的命令最早被哪一界切:墙钟与静默界里较早的那只(都从调用开始算)。供应商建命令那一段(命令还没起跑,
+ * 自然也没有输出)就受它约束 —— 说了墙钟的命令不会被车道活性界在建命令时切掉;没说界的命令建命令卡住按活性界切 —— 但供应商自己的建命令期限
+ * 先到就先切(e2b SDK 的 60 s 握手:到点报的是供应商那一界,不是本模块的任何一只)。两只都缺 ⇒ 无界(只剩供应商自己的界)。
+ */
+export declare function firstBoundOf(bounds: CommandBounds): {
+    readonly ms: number;
+    readonly cut: "wall" | LivenessBound;
+} | undefined;
+/** 活性切断的句子 —— 三车道唯一铸点(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。 */
+export declare function livenessCutMessage(bound: LivenessBound): string;
+//# sourceMappingURL=exec-bounds.d.ts.map

package/dist/exec-bounds.js

@@ -0,0 +1,37 @@
+export const LIVENESS_MS_DEFAULT = 120_000;
+export function laneLivenessOf(ms, knob) {
+    if (!(Number.isFinite(ms) && ms > 0)) {
+        throw new Error(`${knob}=${ms} must be a positive number of milliseconds — it is the only hang guard of a command whose caller states no timeout, and a zero, negative or non-numeric value would remove it`);
+    }
+    return { ms, knob };
+}
+const said = (ms) => (ms !== undefined && Number.isFinite(ms) && ms > 0 ? ms : undefined);
+export function commandBoundsOf(stated, lane) {
+    const wallMs = said(stated.timeoutMs);
+    const idleMs = said(stated.readTimeoutMs);
+    if (idleMs !== undefined)
+        return { wallMs, liveness: { ms: idleMs, setBy: "caller" } };
+    if (wallMs !== undefined || lane === undefined)
+        return { wallMs, liveness: undefined };
+    return { wallMs, liveness: { ms: lane.ms, setBy: "lane", knob: lane.knob } };
+}
+export function firstBoundOf(bounds) {
+    const { wallMs, liveness } = bounds;
+    if (liveness !== undefined && (wallMs === undefined || liveness.ms <= wallMs))
+        return { ms: liveness.ms, cut: liveness };
+    return wallMs === undefined ? undefined : { ms: wallMs, cut: "wall" };
+}
+function spoken(ms) {
+    if (ms < 1000)
+        return `${ms} ms`;
+    return ms % 1000 === 0 ? `${ms / 1000} s` : `${(ms / 1000).toFixed(1)} s`;
+}
+export function livenessCutMessage(bound) {
+    switch (bound.setBy) {
+        case "lane":
+            return `no output for ${spoken(bound.ms)} — cut off by the exec liveness bound (set ${bound.knob} or give the command an explicit timeout)`;
+        case "caller":
+            return `no output for ${spoken(bound.ms)} — cut off by the command's own idle bound (readTimeoutMs)`;
+    }
+}
+//# sourceMappingURL=exec-bounds.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -420,6 +420,13 @@ export interface BgNotification {
     seq?: number;
     status: "completed" | "failed" | "killed";
     summary?: string;
+    /** S-1296(core 7.51.0 #1482 / #1528):the child's REPORT — the same string the completion frame the parent's model reads carries
+     *  (core cuts it once at the frame's bound, redacting first), so a host that wakes an idle conversation reads it here instead of a
+     *  second, differently-cut copy. UNTRUSTED child text ⇒ `redactSecrets` at this wire boundary, exactly like `summary` on this frame
+     *  and `result` on the `task_notification` frame (one reading: the server redacts at its own boundary whatever upstream did).
+     *  Notification-only (the task ROW is state and never carries it). ABSENT when the frame carries none (a killed / failed leg with no
+     *  report, a withheld hand-back). */
+    result?: string;
     /** Background lifetime scope ([ref]), NOT the tenant scope. */
     scope: "task" | "session";
     parentTaskId?: string;

package/dist/fleet/fleet-bus.js

@@ -560,6 +560,7 @@ export function fleetBackgroundChildPublisher(bus, log) {
             ...(typeof e.seq === "number" ? { seq: e.seq } : {}),
             status: e.status ?? "failed",
             ...(e.summary ? { summary: redactSecrets(e.summary) } : {}),
+            ...(e.result !== undefined ? { result: redactSecrets(e.result) } : {}),
             scope: (m.sessionScoped || e.sessionScoped) ? "session" : "task",
             ...(m.parentTaskId ? { parentTaskId: m.parentTaskId } : m.resolvedParentId ? { parentTaskId: m.resolvedParentId } : {}),
             ...(e.completionId ? { completionId: e.completionId } : {}),

package/dist/hooks/hook-llm.js

@@ -2,6 +2,7 @@ import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyO
 import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
@@ -70,7 +71,7 @@ export function createHookLlm(deps) {
                     buildDisplaySafeRefusal(routeRefusalText(verdict), [pick.baseUrl, declaredRoot ?? ""]),
             };
         }
-        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
+        if (verdict.posture === "keyless" && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
             return {
                 ok: false,
                 error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
@@ -131,7 +132,10 @@ export function createHookLlm(deps) {
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });
             }
-            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal });
+            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal, redirect: "manual" });
+            const redirected = egressRedirectRefusal(r, "declare the final endpoint as this route's base URL");
+            if (redirected !== undefined)
+                return { ok: false, error: `hook llm ${redirected}` };
             if (!r.ok)
                 return { ok: false, error: `hook llm HTTP ${r.status}` };
             let text;

package/dist/host-lsp-manager.d.ts

@@ -6,10 +6,10 @@
  * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
  * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
  * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
- * `scrubServerSecrets` 的结果)。
+ * 本仓唯一组合 `hostSubprocessEnv` 的结果 —— 引擎 `inheritedHostEnv("scrub")` ∪ 点名放回)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = `scrubServerSecrets`(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(当时是 `OTEL_EXPORTER_OTLP_HEADERS`,core 7.33.7 #1180 起 core 按名剥它;今天只剩名单型旋钮三只),那正是 S-684 当初的病形。
@@ -23,7 +23,7 @@
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
- * env = `scrubServerSecrets`(process.env) 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与 host shell
+ * env = 引擎 `inheritedHostEnv("scrub")` 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与沙箱三腿
  * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥 —— 7.103.0 起这件组合只有一只:{@link hostSubprocessEnv}
  * (`server-secret-env.ts`,bake-runner 的 `BAKE_ENV_ALLOW` 调同一只)。名单由 `config.ts` 解析(形错拒启;
  * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。