@sema-agent/server 7.130.0 → 7.132.0

package/dist/config.js

@@ -1,9 +1,9 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
 import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -22,25 +22,25 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER, describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
 import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
-import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
+import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "./url-refusal.js";
-import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
@@ -467,6 +467,12 @@ function parseNameListEnv(name, raw, opts) {
 }
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
+function ownCredentialPutBackProblem(name) {
+    const engine = inheritEnvPolicyProblem([name]);
+    return engine === undefined
+        ? undefined
+        : `this deployment's own credential — a put-back list hands the named variable back, as written, to the child the engine withheld it from (the engine refuses it on any allow list: ${engine})`;
+}
 export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
     const raw = process.env[knob];
     if (raw === undefined || raw === "")
@@ -480,7 +486,9 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
                 : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
                     ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
-                    : undefined;
+                    : spec.channel === "host-put-back"
+                        ? ownCredentialPutBackProblem(seg)
+                        : undefined;
         if (problem === undefined)
             return;
         throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
@@ -684,7 +692,7 @@ function parseHooksTimeoutEnv() {
         return undefined;
     const n = parseNumOrFail("HOOKS_TIMEOUT_MS", raw);
     if (!Number.isInteger(n) || n < 0 || n > 2147483647) {
-        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = every hook seat expires immediately; unset = core's own default)`);
+        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = a zero budget for every request-hook handler; unset = 600000)`);
     }
     return n;
 }
@@ -925,14 +933,14 @@ function parseModelDomain() {
         thinkingFormat: parseThinkingFormat(process.env.MODEL_THINKING_FORMAT),
     });
     const envCompat = provider === "anthropic" ? undefined : envCompatDeclared;
+    const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
     const model = {
         id: modelId,
         name: modelId,
         api: provider === "anthropic" ? "anthropic-messages" : "openai-completions",
         provider,
         baseUrl: "",
-        reasoning: boolEnv("MODEL_REASONING", true),
-        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"],
+        ...mintCapabilityKeys(modelCapability),
         ...buildModelCostKey(buildCostOrAbsent({
             input: costEnv("MODEL_COST_INPUT", "unset"),
             output: costEnv("MODEL_COST_OUTPUT", "unset"),
@@ -983,7 +991,7 @@ function parseModelDomain() {
             ...model,
             id: cheapMintedId,
             name: cheapMintedId,
-            input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
+            ...mintCapabilityKeys({ reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING), vision: parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION) }),
             ...buildModelCostKey(buildCostOrAbsent({
                 input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
                 output: costEnv("MODEL_CHEAP_COST_OUTPUT", "declares-zero"),
@@ -993,7 +1001,6 @@ function parseModelDomain() {
             contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
-            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning,
         }
         : undefined;
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
@@ -1183,8 +1190,15 @@ function findUnmatchableToolNames(names, opts) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        if (verdict !== undefined)
+        if (verdict !== undefined) {
             out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
+            continue;
+        }
+        const nearMiss = compileAllowList([subject], "deny", TOOL_NAME_ROSTER).inert.find((i) => i.reason === "near_miss");
+        if (nearMiss?.currentName !== undefined) {
+            const rest = name.startsWith(subject) ? name.slice(subject.length) : "";
+            out.push({ name, guidance: inertRuleEntryGuidance({ ...nearMiss, currentName: `${nearMiss.currentName}${rest}` }) });
+        }
     }
     return out;
 }
@@ -1192,9 +1206,10 @@ export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
         return undefined;
+    const named = bad.slice(0, MAX_NAMED_INERT_ENTRIES).map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ");
     const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
         `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
-        bad.map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        (bad.length > MAX_NAMED_INERT_ENTRIES ? `${named}; and ${bad.length - MAX_NAMED_INERT_ENTRIES} more` : named)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
     return { message, names: bad.map((b) => b.name) };
 }
 const APPROVAL_GRANT_ENV = "APPROVAL_GRANT";
@@ -2454,6 +2469,11 @@ function k8sWorkspaceCache() {
         throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} overlaps the workspace mount ${workspace} (K8S_MOUNT_PATH) — the cache volume must sit OUTSIDE the workspace ` +
             "(the workspace is snapshotted between runs, the cache is not); pick a separate absolute path such as /cache");
     }
+    const reserved = reservedMountCollision(mount);
+    if (reserved !== undefined) {
+        throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} collides with the reserved image directory ${reserved} (a volume at, under or above it hides what the sandbox image keeps there) — ` +
+            `pick a separate absolute path such as /cache; reserved: ${WORKSPACE_CACHE_MOUNT_RESERVED.join(" ")}`);
+    }
     return { mount, size };
 }
 export function loadConfig() {
@@ -2521,12 +2541,6 @@ export function loadConfig() {
     if (laneRequiredRefusal !== undefined) {
         throw new Error(laneRequiredRefusal);
     }
-    {
-        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
-        if (routeGap.gap !== "none") {
-            throw new Error(routeGap.reason);
-        }
-    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,

package/dist/device-ws-protocol.d.ts

@@ -62,7 +62,7 @@ export declare function asInstructionKind(v: string): DeviceInstructionKind | nu
  * 结果帧的错误码闭集 = core 的 `FileErrorCode ∪ ExecutionErrorCode`(§5.1「error code 全闭集」:
  * 未知值映射为协议错误而非透传 string)。`satisfies` 保证这里没有 core 不认识的词。
  */
-export declare const DEVICE_OUTCOME_ERROR_CODES: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
+export declare const DEVICE_OUTCOME_ERROR_CODES: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "liveness_no_output", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
 export type DeviceOutcomeErrorCode = (typeof DEVICE_OUTCOME_ERROR_CODES)[number];
 /**
  * **编译期**对账的另一半:core 往 `FileErrorCode`/`ExecutionErrorCode` 加一个词而本表没跟 ⇒ `Exclude`

package/dist/device-ws-protocol.js

@@ -49,6 +49,7 @@ export const DEVICE_OUTCOME_ERROR_CODES = [
     "callback_error",
     "invalid",
     "is_directory",
+    "liveness_no_output",
     "not_directory",
     "not_found",
     "not_supported",

package/dist/elicitation.d.ts

@@ -19,6 +19,13 @@ export interface ElicitationFrame {
      *  no core-stream anchor, so no `eventId` (absence is honest, not an omission); this is the frame's own time
      *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
     serverNowMs?: number;
+    /** "elicitation" only (additive; the same window pair `question` carries): the coordinator's OWN answer window —
+     *  at expiry the ask releases as `decline`. Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
+     *  a form replayed from the ledger can be judged still-waiting (no `elicitation_complete` with this id ∧
+     *  `expiresAtMs` not reached) or lapsed even when the close row never landed (a lost write, a crashed replica). */
+    expiresInMs?: number;
+    /** "elicitation" only: `serverNowMs + expiresInMs` — the absolute deadline on the server's clock. */
+    expiresAtMs?: number;
 }
 /** The per-run context `onElicit` recovers via ALS. `emit` delivers a frame to the run's live stream;
  *  `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an elicitation parked awaiting a

package/dist/elicitation.js

@@ -112,18 +112,33 @@ export class ElicitationCoordinator {
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
-        try {
-            await ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: this.now() });
+        const emitted = (async () => {
+            const now = this.now();
+            return ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+        })().then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
             rc.lastByServer.set(req.server, t);
         }
-        catch {
+        else if (delivery === "failed") {
             recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
             settle({ action: "decline" });
         }
         const answer = await answerP;
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() }))
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
+                return undefined;
+            }
+            if (delivery === "stalled") {
+                rc.total += 1;
+                rc.lastByServer.set(req.server, t);
+            }
+            return ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() });
+        })
             .catch(() => recordFailOpen("server.elicitation.complete-breadcrumb-dropped", `elicitation=${id}`));
         return answer;
     };

package/dist/env-name-allowlist-knobs.d.ts

@@ -10,6 +10,12 @@
  *      带外凭据(e2b / docker / k8s 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
  *  · `BAKE_ENV_ALLOW`(S-684 残余,7.103.0)由 **bake-runner 进程**读(构建宿主守护进程:没有主体、没有租户 ⇒ 没有姿态列,
  *    不进 {@link describeAllowlistPostures} 的姿态句)。它与服务侧四只旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
+ *  · `channel` = 这张名单**交给谁、在谁的减法之上**(闭集两词,解析器按它定「不许点哪些名」):
+ *    - `host-put-back`(`LSP_ENV_ALLOW` / `BAKE_ENV_ALLOW`)—— 剥后放回形:宿主子进程的 env 先经唯一组合(引擎扣掉本服务自有凭据 + 形状剥),
+ *      名单点到的键再从本进程环境**原样**取回叠上去。点到本服务自有凭据名 = 把引擎刚扣下的那枚交回去 ⇒ 起服拒,判官 = 引擎同一只
+ *      (`inheritEnvPolicyProblem`,读起服声明;与引擎拒嵌入方白名单同句)。
+ *    - `sandbox-grant`(三只沙箱名单)—— 沙箱 env 的唯一来源(沙箱不从本进程继承任何东西),部署方显式交出的带外凭据(S-715 照转发);
+ *      本列不在「自有凭据」律的射程里,只拒点名名单型旋钮(原文按凭据类)。
  * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红;行形随读它的进程定(服务进程 ⇒ 必须写姿态列)。
  *
  * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
@@ -28,14 +34,18 @@ export type EnvNameAllowlistPosture = {
     readonly kind: "ignored";
     readonly why: string;
 };
-/** 服务侧旋钮一行:拒句示例 + 多租户姿态。 */
+/** 名单交给谁、在谁的减法之上(闭集;规则见表头注 `channel` 一条)。 */
+export type EnvNameAllowlistChannel = "host-put-back" | "sandbox-grant";
+/** 服务侧旋钮一行:拒句示例 + 交付形 + 多租户姿态。 */
 export interface ServerEnvNameAllowlistKnobRow {
     readonly example: string;
+    readonly channel: EnvNameAllowlistChannel;
     readonly multiTenant: EnvNameAllowlistPosture;
 }
-/** runner 旋钮一行:只有拒句示例(没有姿态可言)。 */
+/** runner 旋钮一行:拒句示例 + 交付形(没有姿态可言)。 */
 export interface RunnerEnvNameAllowlistKnobRow {
     readonly example: string;
+    readonly channel: EnvNameAllowlistChannel;
 }
 export type EnvNameAllowlistKnobTable = {
     readonly [K in EnvNameAllowlistKnob]: K extends ServerEnvNameAllowlistKnob ? ServerEnvNameAllowlistKnobRow : RunnerEnvNameAllowlistKnobRow;

package/dist/env-name-allowlist-knobs.js

@@ -1,12 +1,13 @@
 export const ENV_NAME_ALLOWLIST_KNOBS = {
     LSP_ENV_ALLOW: {
         example: "LSP_ENV_ALLOW=NPM_TOKEN,CARGO_REGISTRIES_MY_REG_TOKEN",
+        channel: "host-put-back",
         multiTenant: { kind: "ignored", why: "the host-lane language server is not started in this posture, and the language-server env keeps the full secret strip" },
     },
-    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    K8S_SANDBOX_ENV: { example: "K8S_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN" },
+    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    K8S_SANDBOX_ENV: { example: "K8S_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN", channel: "host-put-back" },
 };
 export const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const POSTURE_PHRASE = {

package/dist/exec-bounds.d.ts

@@ -12,8 +12,10 @@
  * 是它报的那一界。
  *
  * 与 core 远端契约(`ExecStreamOptions.readTimeoutMs`:「缺省也 SHOULD 有活性界,一条命令不得等到环境死」)的对齐:
- * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令,在有活性界的车道(k8s / e2b)上仍由它兜底。切断码沿用 core 的 `timeout`(core 远端码表
- * 把墙钟与活性两种超界都归这一词);两者靠句子区分 —— 独立的活性码属于 core 的码表。
+ * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令,在有活性界的车道(k8s / e2b)上仍由它兜底。**切断码按触发的那一界**(core 7.52.0 #1795:
+ * 两套执行码闭集各有一词):墙钟 ⇒ `timeout`;静默界(调用方的 `readTimeoutMs` 或车道活性界)⇒ `liveness_no_output`,带窗口秒数 `noOutputSec`(车道的界 /
+ * 调用方说的静默界,从不是请求的预算)—— 两者解释自己用的是两个数,消费方(core 的 Bash 工具:「no output for N s」对「timed out after N s」)按码分。
+ * 静默切断的码、句、秒数只在 {@link buildLivenessCut} 一处铸,六车道同读。
  *
  * 不在本律里的界(adapter 自己的上限,不是调用方说的话,不关活性界):k8s 文件读写的数据上限 `dataTimeoutMs`、e2b 交给
  * 供应商的沙箱寿命上限。adapter 自己的整段数据搬运(k8s 快照 tar 上 / 下)天生静默,它们**自己说**一个墙钟(数据上限),
@@ -64,6 +66,16 @@ export declare function firstBoundOf(bounds: CommandBounds): {
     readonly ms: number;
     readonly cut: "wall" | LivenessBound;
 } | undefined;
-/** 活性切断的句子 —— 六条车道(host / e2b / k8s / ssh / adb / local-docker)唯一铸点(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。 */
+/**
+ * 🔴 **一次静默切断 —— 唯一铸点**(六条车道 host / e2b / k8s / ssh / adb / local-docker 同读;纯数据,车道用它构造自己那一型的错误):
+ * 码恒为 `liveness_no_output`(core 7.52.0 #1795;墙钟切断照旧 `timeout`,不经本函数),句子 = {@link livenessCutMessage},`noOutputSec` = 静默窗口的整秒数
+ * (core `ExecutionError` 第五构造参;core 读它时向下取整、不足 1 秒不说 —— 本函数同读:不足 1 秒的窗口不带这一位)。远端流式错误(`RemoteExecutionError`)没有这一位的座,只带码与句。
+ */
+export declare function buildLivenessCut(bound: LivenessBound): {
+    readonly code: "liveness_no_output";
+    readonly message: string;
+    readonly noOutputSec?: number;
+};
+/** 活性切断的句子 —— {@link buildLivenessCut} 的句子半(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。车道不直调它:码与句一处铸。 */
 export declare function livenessCutMessage(bound: LivenessBound): string;
 //# sourceMappingURL=exec-bounds.d.ts.map

package/dist/exec-bounds.js

@@ -26,6 +26,10 @@ function spoken(ms) {
         return `${ms} ms`;
     return ms % 1000 === 0 ? `${ms / 1000} s` : `${(ms / 1000).toFixed(1)} s`;
 }
+export function buildLivenessCut(bound) {
+    const sec = Math.floor(bound.ms / 1000);
+    return { code: "liveness_no_output", message: livenessCutMessage(bound), ...(sec >= 1 ? { noOutputSec: sec } : {}) };
+}
 export function livenessCutMessage(bound) {
     switch (bound.setBy) {
         case "lane":

package/dist/execution-lane-caps.d.ts

@@ -58,8 +58,8 @@ export interface ExecutionLaneCaps {
      *  `lane === undefined || lane === "host"` 的同义形,分叉过就是记忆边界判错盘)。读本位的真装配点:
      *  `boot/deferred-sandbox-path-env.ts` 的 `isSandboxPathAdjudicationLane`(resolve-spec 写门 / parked 赎回腿 /
      *  执行环境装配三处的唯一属主)、`memory-scope.ts` 的 `memoryEngineRemoteLanePosture`、
-     *  `boot/memory-boundary.ts` 的 `buildMemoryBoundaryLaneFacts`(stores)、`capabilities/memory-notice.ts` 的
-     *  `buildNoticeLaneFacts`(resolve-spec)。⚠️ `in-process` 在本位上是 YES(hooks/进程内读确实在本机盘上),
+     *  `boot/memory-boundary.ts` 的 `buildMemoryBoundaryLaneFacts`(stores)。(「本会话没有持久记忆」的披露归引擎判、引擎渲染 ——
+     *  目录条目 `core/memory.no-persistent-store`,本仓只交 spec 上的事实,不再读本位做判别。)⚠️ `in-process` 在本位上是 YES(hooks/进程内读确实在本机盘上),
      *  但它**没有手** —— 问「手在不在本机盘上」要读 {@link handsOnWorkerFilePlane},不是只读本位。 */
     readonly hostFilePlane: LaneCapability;
     /** core 的 `isRemoteExecutionEnv` 对本车道的判决(鸭子类型,**含 host**)= core 拿没拿到执行环境 = 手带挂没挂。
@@ -297,4 +297,11 @@ export interface LaneHomeDeployment {
  * 认不出的车道 ⇒ `undefined`(调用方 fail-closed)。生产链上不可达:`loadConfig` 的 [ref] 拒启门先咬。
  */
 export declare function executionLaneHomeDir(deployment: LaneHomeDeployment): string | undefined;
+/**
+ * 「这条部署的执行车道**有手**、而家目录答不出」时起服那一行的 `note`(纯字符串 ⇒ `build*`);否则 `undefined`(不出这一行)。
+ * 判据只读 {@link executionLaneHomeDir}(家目录的唯一属主)与能力表 `coreRemoteExecutionEnv` 位(有没有手):不另写车道清单。
+ * 代价如实:引擎 7.52.0 起家锚拒读行放不下 ⇒ 每一次泄内容的递归读在全 shell 面强制问人(allow / 模式 / bypass 都放不掉)、只读面拒;`~/` 形规则在下单时
+ * 就被 422 拒。出路只有一条:声明执行环境的家目录(`$HOME` 读出来的那个绝对路径)。这句话陈述的是事实,不是告警 —— 要它消失就声明家目录。
+ */
+export declare function buildUndeclaredHomeNote(deployment: LaneHomeDeployment): string | undefined;
 //# sourceMappingURL=execution-lane-caps.d.ts.map

package/dist/execution-lane-caps.js

@@ -261,4 +261,15 @@ export function executionLaneHomeDir(deployment) {
             return undefined;
     }
 }
+export function buildUndeclaredHomeNote(deployment) {
+    if (executionLaneHomeDir(deployment) !== undefined)
+        return undefined;
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined || executionLaneCaps(lane).coreRemoteExecutionEnv !== "supported")
+        return undefined;
+    return (`the ${lane} lane declares no home for its execution environment (REMOTE_EXEC_HOME_DIR is unset, and on this lane the home belongs to the image / target user): ` +
+        `the engine cannot place its home-anchored read-deny rows, so every contents-disclosing recursive read (grep -r, rg, git grep, tar c, …) asks a person on the full shell — ` +
+        `no allow rule, mode or bypass releases that question — and is refused on the read-only face, so unattended tasks cannot search code; "~/" permission rules are refused at submission. ` +
+        `Declare the home: REMOTE_EXEC_HOME_DIR=<the absolute path the environment's $HOME reads>`);
+}
 //# sourceMappingURL=execution-lane-caps.js.map

package/dist/hooks/classic-stations.d.ts

@@ -0,0 +1,86 @@
+/**
+ * 引擎的 `classic.*` 站 —— 本仓挂 handler 的唯一入口(core 7.52.0 起扩展点 = mods 注册,`Hooks` 记录退役)。
+ *
+ * 两件事只写在这里:
+ *  ① **事件名 → { `e` 型, 答案型 }**:core 逐个导出了每站的 `e` 型与答案型,但没有导出二者的映射(宿主侧配对是今天的唯一读法)。
+ *     这张对位表是那一配对的唯一一份;core 导出映射型的那一版,本表改读它、删掉手写的十一行。
+ *  ② **handler 怎么挂**:链成员「无意见 ⇒ `next(e)`」(链 handler 返回 `undefined` 是站点违约,refuse 站上即 fail-closed 拒),
+ *     观察者「恒返回 `undefined`」(观察者的判词不采纳、被引擎报告)。两条都在 {@link hangClassic} / {@link observeClassic} 里成形,
+ *     调用方只写「这一站我答什么」或「这一站我看什么」,不再各自记得这两条。
+ *
+ * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
+ * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
+ */
+import type { EngineDollar, On, PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "@sema-agent/core";
+/** 每一站的 `e` 型与答案型(答案 `void` = 观察站)。 */
+export interface ClassicStationTypes {
+    "classic.PreToolUse": {
+        e: PreToolUseEvent;
+        answer: PreToolUseResult;
+    };
+    "classic.PostToolUse": {
+        e: PostToolUseEvent;
+        answer: PostToolUseResult;
+    };
+    "classic.PostToolUseFailure": {
+        e: PostToolUseFailureEvent;
+        answer: PostToolUseFailureResult;
+    };
+    "classic.PostToolBatch": {
+        e: PostToolBatchEvent;
+        answer: PostToolBatchResult;
+    };
+    "classic.UserPromptSubmit": {
+        e: UserPromptSubmitEvent;
+        answer: UserPromptSubmitResult;
+    };
+    "classic.Stop": {
+        e: StopEvent;
+        answer: StopHookResult;
+    };
+    "classic.SubagentStop": {
+        e: StopEvent;
+        answer: StopHookResult;
+    };
+    "classic.StopFailure": {
+        e: StopFailureEvent;
+        answer: void;
+    };
+    "classic.PreCompact": {
+        e: PreCompactEvent;
+        answer: PreCompactResult;
+    };
+    "classic.PostCompact": {
+        e: PostCompactEvent;
+        answer: void;
+    };
+    "classic.PermissionDenied": {
+        e: PermissionDeniedPayload;
+        answer: void;
+    };
+}
+export type ClassicStation = keyof ClassicStationTypes;
+/** 每一站能挂什么:`chain` = 链成员(会作答)与观察者都可;`observe` = 只许观察者。 */
+export declare const CLASSIC_STATION_ROLE: {
+    readonly "classic.PreToolUse": "chain";
+    readonly "classic.PostToolUse": "chain";
+    readonly "classic.PostToolUseFailure": "chain";
+    readonly "classic.PostToolBatch": "chain";
+    readonly "classic.UserPromptSubmit": "chain";
+    readonly "classic.Stop": "chain";
+    readonly "classic.SubagentStop": "chain";
+    readonly "classic.StopFailure": "observe";
+    readonly "classic.PreCompact": "chain";
+    readonly "classic.PostCompact": "observe";
+    readonly "classic.PermissionDenied": "observe";
+};
+/** 一站的 handler 体:读 `e`,答这一站的答案;`undefined` = 无意见(链成员由 {@link hangClassic} 交给 `next(e)`)。 */
+export type ClassicAnswer<K extends ClassicStation> = (e: ClassicStationTypes[K]["e"]) => Promise<ClassicStationTypes[K]["answer"] | undefined>;
+/**
+ * 按站的角色挂一只 handler:链站 ⇒ 链成员 `(await answer(e)) ?? next(e)`;观察站 ⇒ 观察者(体照跑、恒返回 `undefined`)。
+ * `e` 的型由 {@link ClassicStationTypes} 给(引擎交来的是本站的 `e`;配对见头注 ①)。
+ */
+export declare function hangClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, answer: ClassicAnswer<K>): void;
+/** 挂一只观察者(任何站都可):拿分离副本、不进链、恒返回 `undefined`。 */
+export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicStationTypes[K]["e"]) => void | Promise<void>): void;
+//# sourceMappingURL=classic-stations.d.ts.map

package/dist/hooks/classic-stations.js

@@ -0,0 +1,27 @@
+export const CLASSIC_STATION_ROLE = {
+    "classic.PreToolUse": "chain",
+    "classic.PostToolUse": "chain",
+    "classic.PostToolUseFailure": "chain",
+    "classic.PostToolBatch": "chain",
+    "classic.UserPromptSubmit": "chain",
+    "classic.Stop": "chain",
+    "classic.SubagentStop": "chain",
+    "classic.StopFailure": "observe",
+    "classic.PreCompact": "chain",
+    "classic.PostCompact": "observe",
+    "classic.PermissionDenied": "observe",
+};
+export function hangClassic(on, station, answer) {
+    if (CLASSIC_STATION_ROLE[station] === "observe") {
+        observeClassic(on, station, async (e) => void (await answer(e)));
+        return;
+    }
+    on(station, async (_$, e, next) => (await answer(e)) ?? next(e));
+}
+export function observeClassic(on, station, watch) {
+    on(station, async (_$, e) => {
+        await watch(e);
+        return undefined;
+    }, { observe: true });
+}
+//# sourceMappingURL=classic-stations.js.map

package/dist/hooks/hook-llm.d.ts

@@ -1,6 +1,6 @@
 import type { ModelKeyRef } from "../key-resolver.js";
 import type { ServiceConfig } from "../config-types.js";
-import type { HookLlmCall } from "./hook-runner.js";
+import type { HookLlmCall, HookLlmFailureCode } from "./hook-runner.js";
 /**
  * hookLlm(prompt 条目/session titler 的模型载体)= 直连一次非流式 completion,从 main.ts 抽出成可注入
  * 单元(fetchImpl/keyResolver 可假),因为这条 wire 在每个默认部署上都活(titler),必须可单测。
@@ -16,13 +16,13 @@ import type { HookLlmCall } from "./hook-runner.js";
  *
  * 🔴 **选线 = 引擎主路由同一只判词**(S-1630):「这只模型走 openai-completions 还是 anthropic-messages」不是本面的事,
  * 是引擎主路由的事 —— `brain.ts` 按 `model.provider` 在「anthropic 路由(仅当 ANTHROPIC 凭据把它装上)/ 网关栈」之间选,
- * 路由没装时整台机器只有网关这一只 brain,**连 `provider:"anthropic"` 的模型也落网关**(`dispatchBrainLane` 的合取,
+ * 路由没装时整台机器只有网关这一只 brain,**连 `provider:"anthropic"` 的模型也落网关**(判词 `brainLaneFor` = 引擎 `brainLaneOf` 对装上的路由表的答案,
  * 端点判官 / 降级腿 / 启动摘要读的是同一只)。本面此前自己按 `provider === "anthropic"` / `api === "anthropic-messages"`
  * 字面判线 ⇒ 在 `MODEL_PROVIDER=anthropic` 而只配了网关的部署上,主请求去网关、标题与 hooks 的 llm 面却要找一条没装的
  * anthropic 路由,整条拒发(零请求,只落 fail-open 标签)。现在本面只问那一只判词,不留第二个读法 —— 含 `api` 词:
  * 引擎不按 `api` 选线(core 的 `createRoutingBrain` 缺省按 `provider` 键),settings-schema 的 `ModelEntry` 又强制两个词同真同假。
- * (core 目前只导出 `createRoutingBrain` 这个组合子,没有「给定模型与已装路由 → 哪条腿 / 哪个根」的判官;它导出之日,
- * `dispatchBrainLane` 连同本调用点一并改为问它。)
+ * (S-1630 的 (a) 路已兑现:core 7.53.0 #1842 根导出了那只判官 `brainLaneOf(model, routes)` —— `createRoutingBrain` 对每个请求问的就是它;
+ * 本仓自写的合取 `dispatchBrainLane` 随之退役,本调用点与另三处一并改问它。)
  */
 export type HookModelPick = {
     ok: true;
@@ -30,9 +30,12 @@ export type HookModelPick = {
     providerModelId: string;
     baseUrl: string;
     api: "openai-completions" | "anthropic-messages";
-} | {
+}
+/** 选不出来的那一臂自带失败码(S-1635):两个载体(prompt 直连 / agent 子代理)共用这一只选模闸,同一只判词同一个码。 */
+ | {
     ok: false;
     error: string;
+    code: Extract<HookLlmFailureCode, "model_unresolved">;
 };
 /**
  * 🔴 **hook 失败展示文本的唯一铸点**(S-494;`build*` = 返回纯数据的一只纯函数)。