@sema-agent/server 7.130.0 → 7.132.0

package/dist/http/server.d.ts

@@ -10,6 +10,7 @@ import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchor
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
+import type { SqlBlobCapReading } from "../plugins/blob-backend.js";
 import type { LeaderEndpoint } from "../leader/endpoint.js";
 import { type WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import type { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
@@ -34,11 +35,10 @@ export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 import { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
-import { hasServiceAuth } from "./dispatch.js";
 import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath } from "./route-table.js";
 export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, hasServiceAuth };
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
-import { explicitOperatorOk, isOperator } from "./principal-gate.js";
+import { explicitOperatorOk, isOperator, hasServiceAuth } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
 /** Per-request authorization context resolved before building the spec (identity, owned session). */
 export interface RequestAuth {
@@ -58,7 +58,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填三件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填五件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -66,8 +66,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填四件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席。
- *  四者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填五件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席、读口场景门。
+ *  五者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -123,6 +123,18 @@ export interface ServiceCoreDeps {
      * `runnerFor: () => runner` —— 那是一句表态,不是一个回落。
      */
     runnerFor: (spec: TaskSpec) => Runner;
+    /**
+     * 读口的场景名过门 —— `capabilities/scenarios.ts` `createScenarioGate` 铸的**那一只**(与 `resolveSpec` 同一个工厂、同一张场景表、同一份
+     * `principalCaps`、同一份部署缺省):凡回答「此主体在此场景能看见哪些 MCP 服务器 / A2A 对端」的口 —— `GET /v1/capabilities/mcp` 的状态面、
+     * `GET /v1/sessions/:id/mcp` 与 `…/a2a` 两张会话面板 —— 的场景名都由它给,**点名与缺席都问**:点名 ⇒ 判在册 / allowlist,
+     * 拒体(400 `scenario_unknown` 附在册词表 / 400 `scenario_not_allowed` 附 allowlist)与任务提交腿逐字同;缺席 ⇒ 指派链(中心 ruling 胜者,
+     * 否则部署缺省),与这位主体 run 时同一读法(指派悬空 ⇒ 503 `state.scenario_assignment_unknown`,同提交腿)。
+     * 读面上这只门走**只读腿**(`createScenarioGate(…, "peek")`):问中心裁定时 center 抖动的那一拍,不替这个主体的真提交留下 fail-closed 降级项
+     * (提交腿自己是 `"enforce"`)。
+     * 🔴 **必填**:读口的场景名只有这一个来源,没有「缺接缝 ⇒ 读部署缺省 / 点名 404」这类第二种读法 —— 漏接是**编译错**(嵌入方自己装配时,工厂与它的型从包根导出:
+     * `createScenarioGate` / `ScenarioGate` / `ScenarioGateLeg` / `ScenarioGateSources`)。
+     */
+    scenarioGate: import("../capabilities/scenarios.js").ScenarioGate;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -563,14 +575,6 @@ export interface ServiceSeamDeps {
      *  per-principal 查询走 caps client 的 executionRuling 同车(零额外 RTT);absent = 无 center(单用户/
      *  dry-run)⇒ 观测面不接线,零行为差。fail-open:观测失败绝不影响 sync 面本身。 */
     sessionMirrorRuling?: (principal: string | undefined) => Promise<SessionMirrorRuling | undefined>;
-    /** 请求点名的场景名过门 —— `capabilities/scenarios.ts` `createScenarioGate` 铸的**那一只**(与 `resolveSpec` 同一个工厂、同一张场景表、同一份
-     *  `principalCaps`、同一份部署缺省):`GET /v1/capabilities/mcp?scenario=<名>` 的状态面靠它回答「这个场景名在不在册、这位 principal 放不放行」,
-     *  拒体(400 `scenario_unknown` 附在册词表 / 400 `scenario_not_allowed` 附 allowlist)因此与任务提交腿逐字同。
-     *  读面上这只门走**只读腿**(`createScenarioGate(…, "peek")`):问中心裁定时 center 抖动的那一拍,不替这个主体的真提交留下 fail-closed 降级项
-     *  (提交腿自己是 `"enforce"`)。只在请求**点名了**场景时才问(缺席 ⇒ 部署缺省场景,不问门、不多一次中心往返;点名空串也交门答,与提交腿 `scenario: ""` 同码)。
-     *  本接缝缺席 = 嵌入方的 HTTP 面没有场景表可问:状态面点名场景答 404 `scenario_not_found`,与场景详情读面({@link scenarioDetails} 缺席)同一个答复,
-     *  不另造空表门、不静默回缺省集。 */
-    scenarioGate?: import("../capabilities/scenarios.js").ScenarioGate;
     /** Degenerate-output a/b instrument: on errorCode=output.degenerate, inspect the session's turns to
      *  classify where the salvageable answer was (counter + log). Fire-and-forget; no-op otherwise. */
     instrumentDegenerate?: (result: TaskResult) => void;
@@ -773,12 +777,18 @@ export interface ServiceDeploymentDeps {
      *  `GET /v1/capabilities` 的 `memoryEngine` 位(窄投影)。缺席 = 这个进程不是由 composition root 装
      *  起来的(测试夹具形)⇒ 诊断面报 null、能力位取诚实下限 false。 */
     memoryPosture?: import("../memory-posture.js").MemoryPosture;
-    /** S-131:SQL 引擎姿态的 **live getter**(`sql-engine-posture.ts` 的单一推导点 —— boot 期借一条池连接
-     *  触发驱动的连接初始化,读的是 `SET` 之后**回读复核**过的真值)。两个读面共用:
-     *  `GET /v1/diagnostics/wiring` 的 `sqlEngine` 段(operator-only,全量含版本)与 `GET /v1/capabilities`
-     *  的 `store.sql` 位(窄投影;7.106.0 前是顶层 `sql`,S-866 ①)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
-     *  缺席 / 返回 null = 本部署没有 SQL 后端(env-only worker、local 文件后端)—— 诚实缺席,不铸空壳。 */
-    sqlEngineFacts?: () => import("../plugins/sql-driver.js").SqlEngineFacts | null;
+    /** S-131:SQL **引擎读口**(`sql-engine-posture.ts` 的单一推导点 —— boot 期借一条池连接触发驱动的连接初始化,交回本池的驱动:
+     *  `dialect`(SQL 文本轴,恒在)+ 活的 `facts`(`SET` 之后**回读复核**过的真值;池重连后驱动会重新初始化并刷新,快照会说谎)。
+     *  读者:`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段(operator-only,全量含版本与两堵墙)与 `GET /v1/capabilities` 的 `store.sql` 位(窄投影;
+     *  7.106.0 前是顶层 `sql`,S-866 ①)读 `facts`;提交受理口的 413 把整只读口交给唯一判官 `sql-driver.ts` `sqlWallsOf`(本服务的装配另用同一只读口铸
+     *  `snapshotBlobSqlCap`,`PUT /sync/blobs` 的前置帽)—— 墙的方言只从这里来(与事实同出一只驱动),不另从店后端读。
+     *  两种缺席、两个值:**席缺席** = 本部署没有 SQL 后端(env-only worker、local 文件后端);**`facts` 是 `null`** = 有 SQL 后端、但事实此刻没建立
+     *  (池上最近一次连接初始化被拒,驱动当场作废了事实)。两者在两个读面上都报缺席(诚实缺席,不铸空壳);墙按方言读后者(MySQL 协议 ⇒ 最保守的假定墙)。
+     *  7.132.0 前这一席是 `sqlEngineFacts: () => SqlEngineFacts | null`(只给事实、不给方言);照旧传它 ⇒ `createHttpServer` 起服拒。
+     *  🔴 **SQL 后端在场(`backend` 交出了 `mysqlPool()` / `pgPool()`)⇒ 本席必填**,缺席 ⇒ `createHttpServer` 起服拒(席缺席只表示「没有 SQL 后端」,不能是「忘了给」);
+     *  本服务自己的装配(`boot/stores.ts` → `stage-10`)按同一个谓词(`sqlPoolsOf`)建立它,恒给。值形也在起服时判(同一只判官 `sqlEngineSeatIssue` 的另一臂):
+     *  `{ dialect: "tidb" | "pg", facts }`,`facts` 是 `null` 或带 `maxRowBytes` / `maxPacketBytes` / `wallSources` 的引擎事实;只改了键名的 `() => facts` 之类 ⇒ 起服拒。 */
+    sqlEngine?: import("../plugins/sql-driver.js").SqlEngineReading;
     /** S-138:**写保护名表**的姿态(`write-protection.ts` 的 boot 期单一推导点 —— 与递给每只 Runner 的
      *  `writeProtectedPaths` 座同一份 config 决定)。两个读面共用:`GET /v1/diagnostics/wiring` 的
      *  `writeProtection` 段(operator-only,**逐行**表 + 来源 + 被丢的缺省行名)与 `GET /v1/capabilities`
@@ -817,10 +827,14 @@ export interface ServiceDeploymentDeps {
 /** **数值旋钮**:部署可调的上限/拍距。缺省值写在消费点(`?? 256` 之类),此处只承载覆写。 */
 export interface ServiceKnobDeps {
     /** (a)(clay 拍 a+c,2026-07-27)当快照 blob 走 SQL 默认店时(逃生口形/覆写形),该店的 per-blob
-     *  承载帽——PUT /sync/blobs 面据此**前置 413**(typed `blob_too_large_for_sql`)。不设=不前置(MinIO
-     *  形无帽)。为什么在 HTTP 面重复店里的检查:店的 never-throw 结果形把一切写失败折成 502,而 502
+     *  承载帽的**读口**——PUT /sync/blobs 面每个请求调一次、据此**前置 413**(typed `blob_too_large_for_sql`)。
+     *  键缺席=不前置(MinIO 形无帽);读口答 `undefined`=此刻没有墙(pg 形)=不前置。读口而非数字:帽由库报的墙推导,
+     *  库调墙、池连接换代后活事实会变,门限必须跟着变(与店写口 `SqlBlobBackend` 读同一份池级事实、同一只函数
+     *  `sqlBlobCapOf`)。读口答的是**帽 + 它的出处**(`{ capBytes, source }`,`source` ∈ `operator` / `reported` / `assumed`,见 `SqlBlobCapReading`):
+     *  413 的句子与机读位 `wallSource` 按出处分三形(运维旋钮 / 库报的墙 / 假定的墙),不把假定或运维的旋钮说成库的上限。
+     *  为什么在 HTTP 面重复店里的检查:店的 never-throw 结果形把一切写失败折成 502,而 502
      *  语义=可重试,对端会对一个永远过不去的 blob 无限重试——413 才是「别再送了」的诚实形。 */
-    snapshotBlobSqlCapBytes?: number;
+    snapshotBlobSqlCap?: () => SqlBlobCapReading | undefined;
     /** [ref] SSE 连接帽(缺省 256/副本;超限 503+Retry-After=消费方回落 /head 轮询)。 */
     sessionEventsMaxConnections?: number;
     /** [ref] SSE 心跳/owner 复核拍距 ms(缺省 25s;测试注入用)。 */
@@ -838,7 +852,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填三件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填五件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/server.js

@@ -3,6 +3,7 @@ import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
 import { validatePendingSteer } from "@sema-agent/core";
 import {} from "../web-admin-client/facade.js";
+import { describeValueShape } from "@sema-agent/settings-schema";
 import { HttpError } from "../security.js";
 import {} from "../memory-sync.js";
 import {} from "../orchestration/workflow-agent-steer.js";
@@ -17,17 +18,18 @@ import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendError, sendSessionError, httpErrorCode, msg } from "./send.js";
+import { sendError, sendHttpError, sendSessionError, msg } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
+import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
 import * as facts from "../capability-facts.js";
-import { createDispatch, hasServiceAuth } from "./dispatch.js";
+import { createDispatch } from "./dispatch.js";
 import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, isProbePath } from "./route-table.js";
 import { createApprovalSweeps } from "./approval-sweeps.js";
 export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, hasServiceAuth };
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
-import { explicitOperatorOk, isOperator } from "./principal-gate.js";
+import { explicitOperatorOk, isOperator, hasServiceAuth } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
 class DrainYieldingPreemptBook extends Map {
     drainingNow;
@@ -57,6 +59,30 @@ export function createHttpServer(rawDeps) {
     if (typeof deps.runnerFor !== "function") {
         throw new Error("createHttpServer: the runnerFor seat is required (it picks each task's Runner from its execution lane) — pass the hands-lane selector, or `runnerFor: () => runner` for a single-Runner embedding; refusing to start rather than run every task on the widest Runner");
     }
+    if (deps.snapshotBlobSqlCapBytes !== undefined) {
+        throw new Error("createHttpServer: snapshotBlobSqlCapBytes was replaced by snapshotBlobSqlCap in 7.132.0 — pass a reader `() => { capBytes, source } | undefined` (called on every PUT /v1/sessions/:id/sync/blobs/:hash; `source` is \"operator\" for a cap you set yourself, \"reported\" / \"assumed\" for one derived from the database's walls; `undefined` = no cap) — for a fixed cap: `() => ({ capBytes: <bytes>, source: \"operator\" })`; refusing to start rather than run without the blob cap");
+    }
+    if (deps.snapshotBlobSqlCap !== undefined && typeof deps.snapshotBlobSqlCap !== "function") {
+        throw new Error(`createHttpServer: snapshotBlobSqlCap must be a reader \`() => { capBytes, source } | undefined\` (called on every PUT /v1/sessions/:id/sync/blobs/:hash), got ${typeof deps.snapshotBlobSqlCap} — pass the reader (or \`() => undefined\` for no cap), or leave it unset; refusing to start rather than answer every blob upload with a 500`);
+    }
+    if (deps.sqlEngineFacts !== undefined) {
+        throw new Error("createHttpServer: sqlEngineFacts was replaced by sqlEngine in 7.132.0 — pass the SQL pool's engine reading as sqlEngine: `{ dialect: \"tidb\" | \"pg\", facts }` where `facts` is read live (a getter) and is null while the pool's connection setup has not succeeded, or leave both unset when there is no SQL store; refusing to start rather than run the submit admission without the database's walls");
+    }
+    {
+        const issue = sqlEngineSeatIssue(deps.backend, deps.sqlEngine);
+        if (issue !== undefined) {
+            switch (issue) {
+                case "required":
+                    throw new Error("createHttpServer: sqlEngine is required when a SQL store backend is wired (the backend hands out a SQL pool) — pass the pool's engine reading as sqlEngine: `{ dialect: \"tidb\" | \"pg\", facts }` where `facts` is read live (a getter) and is null while the pool's connection setup has not succeeded; refusing to start rather than read the database's row and statement limits as absent and admit task bodies the database cannot store");
+                case "bad_shape":
+                    throw new Error(`createHttpServer: sqlEngine must be the SQL pool's engine reading \`{ dialect: "tidb" | "pg", facts }\` where \`facts\` is read live (a getter) and is null while the pool's connection setup has not succeeded, otherwise the engine facts object (maxRowBytes, maxPacketBytes and wallSources included) — got ${typeof deps.sqlEngine === "function" ? "a function (the 7.131.x reader \`() => facts\` goes in as \`{ dialect, get facts() { return f(); } }\`)" : describeValueShape(deps.sqlEngine)}; refusing to start rather than answer every task submission with a 500`);
+                default: {
+                    const unhandled = issue;
+                    throw new Error(`sqlEngine seat issue without a refusal: ${String(unhandled)}`);
+                }
+            }
+        }
+    }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -121,7 +147,7 @@ export function createHttpServer(rawDeps) {
         void handle(req, res).catch((err) => {
             if (err instanceof HttpError) {
                 if (!res.headersSent)
-                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
+                    sendHttpError(res, err);
                 else
                     res.end();
                 return;

package/dist/http/stored-body-replay.d.ts

@@ -9,6 +9,7 @@
  */
 import type { PermissionMode } from "@sema-agent/core";
 import { type Autonomy } from "../runtime-governance.js";
+import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
 /**
@@ -21,8 +22,14 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
     floor: PermissionMode;
 } | undefined;
 /**
- * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 技能拒侧读成空 → 模式词读法记号(几问同中时答先中的那一问 ——
- * 任一问中都不重放,句子只需一句)。`autonomy` = 本部署**此刻**的 `config.autonomy`(活 config:热改即生效);地板由它的唯一属主算,问点不自己算。
+ * 预判读的部署配置:`autonomy`(第三问的模式词地板)与执行车道的 home 两位(`~/` 形规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
-export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, autonomy: Autonomy | undefined): StoredBodyReplayRefusal | undefined;
+export type StoredReplayDeployment = LaneHomeDeployment & {
+    readonly autonomy?: Autonomy | undefined;
+};
+/**
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
+ */
+export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;
 //# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -1,6 +1,8 @@
-import { storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
-import { skillDenyInertEntryOf } from "../rule-entry-list.js";
+import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { httpErrorCode } from "./send.js";
 import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
@@ -8,14 +10,33 @@ export function permissionModeReadingUnstated(ctx, floor) {
     const stored = storedBodyPermissionMode(ctx.body);
     return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
 }
-export function storedBodyReplayRefusal(ctx, autonomy) {
+const BUCKET_GATE_CODE = "request.field_invalid";
+function storedPermissions(body) {
+    const permissions = body?.settings?.permissions;
+    return permissions !== null && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : undefined;
+}
+function storedPermissionBucketRefusal(body) {
+    const issue = settingsPermissionBucketIssue(storedPermissions(body));
+    if (issue === null)
+        return undefined;
+    return replayInertEntry(issue.fields.field, issue.fields.field === "settings.permissions.allow" ? "allow" : "deny", BUCKET_GATE_CODE, issue.message, { ...issue.fields });
+}
+function storedRulePolicyRefusal(body, deployment) {
+    const permissions = storedPermissions(body);
+    if (permissions === undefined)
+        return undefined;
+    const home = executionLaneHomeDir(deployment);
+    const refused = rulePolicyBucketsRefusal({ ...(Array.isArray(permissions["ask"]) ? { ask: permissions["ask"] } : {}), ...(Array.isArray(permissions["deny"]) ? { deny: permissions["deny"] } : {}) }, home !== undefined ? { home } : {});
+    return refused === undefined ? undefined : replayInertEntry(`settings.permissions.${refused.bucket}`, "deny", httpErrorCode(422), `${REQUEST_SETTINGS_REFUSAL_PREFIX}${refused.message}`);
+}
+export function storedBodyReplayRefusal(ctx, deployment) {
     const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
     if (allowListReadingUnstated(ctx))
         return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
-    const entry = skillDenyInertEntryOf(ctx.body);
+    const entry = storedPermissionBucketRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
     if (entry !== undefined)
-        return { kind: "skill_deny_inert", entry };
-    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(autonomy));
+        return { kind: "inert_tool_list", entry };
+    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
     if (mode !== undefined)
         return { kind: "permission_mode_reading", ...mode, ...writer };
     return undefined;

package/dist/http/submit-ctx.d.ts

@@ -0,0 +1,25 @@
+import type { RunStore } from "../plugins/store-backend.js";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { type RefusalBody } from "./refusal-body.js";
+/** 写不进的那一种可答复的结局(各腿把它交回自己的出口:同步 / durable 腿直接回,活流腿编码成终帧)。 */
+export interface SubmitCtxRefusal {
+    readonly status: 413;
+    readonly body: RefusalBody;
+}
+/**
+ * 写这一笔(行体经续跑输入的唯一构造口 `buildCheckpointCtx` 铸 —— 新的持久化写都经它,读法记号随之盖上);写不进 ⇒ 撤掉
+ * `claim` 指的那条刚认领的 run(无 run 店的部署没有认领 ⇒ `undefined`),再按成因答复(见文件头)。
+ * 返回 `undefined` = 写进了,腿照常起跑。
+ */
+export declare function persistSubmitCtx(store: {
+    putCtx(sessionId: string, ctx: object): Promise<void>;
+}, deps: {
+    readonly logger?: Logger | undefined;
+    readonly metrics?: Metrics | undefined;
+}, claim: {
+    readonly runStore: RunStore;
+    readonly taskId: string;
+} | undefined, sessionId: string, fields: Parameters<typeof buildCheckpointCtx>[0]): Promise<SubmitCtxRefusal | undefined>;
+//# sourceMappingURL=submit-ctx.d.ts.map

package/dist/http/submit-ctx.js

@@ -0,0 +1,39 @@
+import { StoreRowTooLargeError } from "../plugins/sql-errors.js";
+import { releaseClaimedRun } from "./claimed-run.js";
+import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { refusalBody } from "./refusal-body.js";
+function rowTooLargeRefusal(tooLarge) {
+    switch (tooLarge.wall) {
+        case "row":
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)` }) };
+        case "statement":
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet` }) };
+        case "value":
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments` }) };
+        default: {
+            const unhandled = tooLarge.wall;
+            throw new Error(`row-too-large refusal without an HTTP answer: ${String(unhandled)}`);
+        }
+    }
+}
+export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
+    try {
+        await store.putCtx(sessionId, buildCheckpointCtx(fields));
+        return undefined;
+    }
+    catch (err) {
+        const tooLarge = err instanceof StoreRowTooLargeError ? err : undefined;
+        if (claim !== undefined) {
+            const why = tooLarge !== undefined ? tooLarge.message : `the run's resume inputs could not be stored: ${err instanceof Error ? err.message : String(err)}`;
+            await releaseClaimedRun(claim.runStore, claim.taskId, why, (releaseErr, step) => {
+                deps.logger?.warn("submit_ctx_run_release_failed", { taskId: claim.taskId, sessionId, step, err: releaseErr instanceof Error ? releaseErr.message : String(releaseErr) });
+                deps.metrics?.inc("submit_ctx_run_release_failed_total", { step });
+            });
+        }
+        if (tooLarge === undefined)
+            throw err;
+        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });
+        return rowTooLargeRefusal(tooLarge);
+    }
+}
+//# sourceMappingURL=submit-ctx.js.map

package/dist/http/wire-types.d.ts

@@ -33,6 +33,12 @@ export interface TaskRequestBody {
     } | {
         url: string;
     }>;
+    /** 请求层用户附件(引擎 `TaskSpec.userAttachments`,至多 20 条):挂在**这次提交的目标**上,原样交给引擎 —— 每条以引擎铸的消息紧随目标送到模型,
+     *  交付结局在 `human_input{carrier:"objective"}.attachments` 报一次。条目形 = 引擎的 `UserAttachment`(`{ path, lines? }` 读本次 run 的工作区 /
+     *  `{ name, text, startLine? }` / `{ name, image: { data, mimeType } }` 宿主持有的字节)。**形判属主 = 引擎**:本服务不另判,坏形 / 超 Read 上限的
+     *  text / 过不了图片准入 / 无工作区的 path 由引擎在第一次模型调用之前拒 `config.user_attachment_invalid`(同步腿 400)。只随目标走:送话口不收
+     *  (400 `request.body_shape`,键落 `unsupportedKeys`),续跑 / 投递腿的重建不带它(`http/resume-legs.ts` 的一次性键表)。能力位 `userAttachments`。 */
+    userAttachments?: TaskSpec["userAttachments"];
     /** D-1 通用文件上传:预上传附件的句柄数组(POST /v1/attachments 的 `id`)。提交时绑定到会话并在
      *  执行环境工作目录 `attachments/` 下物化;objective 尾部追加告知(名字/mime/尺寸,内容不进流)。
      *  上限 16/task;未知或他人 id → 400(fresh 腿)。⚠️ 名为 `attachmentIds` 而非 `attachments`——
@@ -308,12 +314,15 @@ export interface TaskRequestBody {
      *  坏形不挂键。不投递技能正文(正文照旧由 `Skill` 工具 / 调用方负责)。 */
     userInvokedSkills?: string[];
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
-     *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
+     *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。
+     *  读成空的条目(退役拼法 `bash`、大小写孪生 `BASH`、任何工具名都不可能有的拼法、`*`)7.131.0 起受理口 400 `config.tool_face_control` 并点名现名
+     *  (拒侧读成空 = 放行,不照跑);读得出的名字与真未知名(拼写合法、没有近似也没有退役对应)照收。 */
     excludeTools?: string[];
     /** S-1448(core 7.49.0 #1623,[ref]):引擎的**可用性选择器** —— 这一 run 只用列出的工具(wire 名、别名、`Tool(content)` 整只、
      *  `mcp__srv` / `mcp__srv__*` / 工具段通配;`"*"` = 本层不设名单;`[]` = 什么都不给)。宿主**原样透传**进 `TaskSpec.allowTools`:
-     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
-   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
+     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;真未知名(拼写合法、没有近似也没有退役对应:懒挂载的合法形)照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
+   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400);7.131.0 起受理口另拒近似名(大小写孪生 `BASH`:想放的什么也没放 = 静默收窄,句子点名现名);
+   *  放行侧的内容形(`Agent(Explore)`)、文法读不出与没有后继的退役名(`MultiEdit`)照旧受理、交引擎既有通告;有后继的退役名(`bash` · `Task`)引擎开跑前拒 `config.tool_face_control`(core 7.52.0 起,同步腿 400)。
      *  `excludeTools` 是同一只运算的减项(deny 赢)。值形:字符串数组(受理门 400 `request.field_invalid`,与 `excludeTools` 同一只门);
      *  装着的引擎不认该座 ⇒ 400 `request.field_invalid` 点名所需引擎版本(不静默丢)。无租户门(收窄)。 */
     allowTools?: string[];
@@ -501,15 +510,19 @@ export interface TaskRequestBody {
      *  worker, not the exec env); IGNORED on multi-tenant deployments (can't make the shared worker run an arbitrary
      *  command). Validated + gated downstream; the center/config baseline wins on a name clash.
      *
+     *  每个受理键一条律:新提交(fresh)腿上,条目的任一受理键(`name` / `transport` 及其子键 / `allowTools` / `toolAxes` / `toolFaces` / `contentOrigin` / `elicitation` / `source`)
+     *  在场却判不出形 ⇒ 同步 400 `request.field_invalid`,拒句点名 `mcpServers[i].<键路径>`、server 名与该键判官的原因句(不回显值),整份请求不收;键缺席恒合法。
+     *  耐久 resume 重放存量 body 的腿不拒(会砖死已 park 任务):坏硬键整条 server 不进 + 运维 warn,坏软键丢键、server 照挂。
+     *
      *  [ref](core 5.60.0):条目上可选的 `contentOrigin`(`"local"|"execution"|"external"`)= **内容
      *  出处声明**,只影响记忆写治理(会话污染标记),对审批门/策略/角色表零作用。缺席 = pre-378 逐字节
      *  现行为(判 external)。🔴 **新提交(fresh)腿上,词表外的值 ⇒ 同步 400 `request.field_invalid`** ——
      *  静默丢会把一次信任边界声明变成探针。⚠️ **耐久 resume 腿上不拒**:那条腿重放的是存量 body,4xx 会把
      *  一条 parked 任务永久砖死(折成 `409 resume_blocked_by_policy`),所以坏值在那里**降级**为「键缺席」+
-     *  一条 `mcp_content_class_dropped` warn(本仓三处 `opts.leg` 先例的同款姿势)。两条腿上 server 本体都
+     *  一条 `mcp_content_class_dropped` warn(本仓三处 `opts.leg` 先例的同款姿势)。重放腿上 server 本体
      *  保留 —— 丢的只是声明。core 把这个键定性为**部署面**的键,本仓对它的 reject-or-strip 义务由既有的单用户闸
      *  **结构性**兑现:多租户腿整只 `mcpServers` 被忽略 ⇒ 租户够不着;单用户腿 = core 明文豁免的超管面
-     *  (完整论证见 `task-mcp.ts` 的 `assertRequestMcpContentOrigin` 顶注)。部署面的正门是 center 下发的
+     *  (完整论证见 `task-mcp.ts` 的 `assertRequestMcpEntries` 顶注)。部署面的正门是 center 下发的
      *  `CenterMcpServer.contentOrigin`。
      *
      *  S-1515:`transport.kind:"http"` 的条目可选 `assertionHeader`(托管连接器断言头的**头名**,契约包 settings-schema ≥12.2.0 同键)。

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { composeExecutionLane, assertExecutionLaneInvariants, type ExecutionLane
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
 export { createStoreBackend, type StoreBackend, type SessionCaptureRecordSource } from "./plugins/store-backend.js";
-export { RetiredSchemaPresentError } from "./plugins/one-time-migrations.js";
+export { RetiredSchemaPresentError } from "./plugins/schema-consistency.js";
 export { CachingSessionStore, type CachingOptions } from "./plugins/caching-session-store.js";
 export type { RunRecord, RunEvent } from "./plugins/store-contracts.js";
 export { runInBackground } from "./runs.js";
@@ -17,7 +17,7 @@ export { RateLimiter, type RateDecision } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo, type GitApiKind, type RepoCoords, type RepoReadClient } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioRequest, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS, type TaskListLane, type TaskListLaneBackend, type TaskListLaneOpts } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
@@ -30,5 +30,6 @@ export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type Mode
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
 export { judgeModelRouteGap, type ModelRouteGapReading, type ModelRouteGapOptions } from "./model-route-gap.js";
 export type { ModelRouteGap } from "./model-route-endpoint.js";
+export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRouteOptions, type ModelRouteEndpointVerdict } from "./model-route-endpoint.js";
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -3,7 +3,7 @@ export { composeExecutionLane, assertExecutionLaneInvariants } from "./boot/exec
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
 export { createStoreBackend } from "./plugins/store-backend.js";
-export { RetiredSchemaPresentError } from "./plugins/one-time-migrations.js";
+export { RetiredSchemaPresentError } from "./plugins/schema-consistency.js";
 export { CachingSessionStore } from "./plugins/caching-session-store.js";
 export { runInBackground } from "./runs.js";
 export { createHardenedVmRunner, runInHardenedVm } from "./orchestration/hardened-vm-runner.js";
@@ -15,7 +15,7 @@ export { RateLimiter } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
@@ -26,4 +26,5 @@ export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 export { judgeModelRouteGap } from "./model-route-gap.js";
+export { judgeServedModelRoute } from "./model-route-endpoint.js";
 //# sourceMappingURL=index.js.map

package/dist/lane-home-probe.d.ts

@@ -0,0 +1,43 @@
+/**
+ * 执行环境的家目录:**声明 × 实测**的唯一判官(纯叶:零值依赖)。
+ *
+ * ## 病
+ * `REMOTE_EXEC_HOME_DIR` 是运维对「执行环境以哪个用户的家目录运行」的声明,它是 `~/` 形权限规则的基、引擎家锚拒读行(`~/.ssh` / `~/.npmrc` …)
+ * 的落点(`execution-lane-caps.ts` `executionLaneHomeDir` 一只属主,四个消费面同读)。k8s / local-docker / ssh 三条车道的家目录是镜像 / 目标机
+ * 登录用户的属性,boot 期不可知 —— 声明了就照单全收。声明 `/home/y` 而车道真实家目录是 `/home/x` 时,`Edit(~/.ssh/**)` 守的是 `/home/y`,
+ * `/home/x/.ssh` 照读照写,运维与用户零告警:限制写了不生效且无人知。
+ *
+ * ## 律(一句)
+ * 家目录只有一只真源:声明在场、车道能问的,**开环境那一拍问一次**(与命令同一条 shell、同一份 env:`printf %s "$HOME"`),两者不一致 ⇒
+ * 这只执行环境不开(拒句点名两值与两条改法),环境答了的判定记在环境上(同一镜像 / 同一目标机再问也是同一个答案,不重试成风暴);问不出答案同样不开
+ * (证不了声明 = 不拿一个没证过的目录去守),但不记 —— 与任何一次建连失败同,下一次重问。车道问不了的(adb / device)声明照单全收 —— 那是声明唯一的用处。
+ * 没声明的车道不问:规则基与 422 门在下单那一刻就要家目录,而那一刻执行环境还没开(把实测值接进规则基要引擎的座,见收车档)。
+ */
+/** 探针答案的行首标记:登录脚本 / profile 往 stdout 打的横幅不会被读成家目录 —— 只认带这个标记的那一行(取最后一行)。 */
+export declare const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
+/**
+ * 执行环境里问家目录的那一句 —— 经车道自己的命令通道跑(同一条 shell、同一份 env),答的就是命令看到的 `$HOME`。
+ * 先换一行再打标记行:横幅没以换行收尾时,标记行照样从行首开始。
+ */
+export declare const LANE_HOME_PROBE_COMMAND = "printf '\\nsema-lane-home=%s\\n' \"$HOME\"";
+/** 一次问家目录的读数:问到了(stdout 原文)/ 没问到(原因)。 */
+export type LaneHomeProbe = {
+    readonly ok: true;
+    readonly stdout: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * 判定:`undefined` = 一致,照开;否则这只环境不开 —— `refusal` 是拒句,`answered` = 环境**答了**它的家目录(不一致 / 不是绝对路径;同一镜像 / 同一登录用户
+ * 再问也是同一个答案 ⇒ 调用方记在环境上),`false` = 没答上(探针失败 / 超时 / 非零退出 / 输出里没有标记行 ⇒ 这一次不开、不记、下一次重问)。
+ */
+export type LaneHomeVerdict = {
+    readonly refusal: string;
+    readonly answered: boolean;
+} | undefined;
+/**
+ * 声明 × 实测的唯一判官。`lane` 只进句子。拒句三形:实测与声明不一致 / 实测不是绝对路径(含空)/ 没问到。每一形都点名声明值与改法,不回显任何别的东西。
+ */
+export declare function judgeLaneHome(lane: string, declared: string, probe: LaneHomeProbe): LaneHomeVerdict;
+//# sourceMappingURL=lane-home-probe.d.ts.map

package/dist/lane-home-probe.js

@@ -0,0 +1,35 @@
+export const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
+export const LANE_HOME_PROBE_COMMAND = `printf '\\n${LANE_HOME_PROBE_MARKER}%s\\n' "$HOME"`;
+const SHOWN_MAX = 256;
+const shown = (raw) => JSON.stringify(raw.length > SHOWN_MAX ? `${raw.slice(0, SHOWN_MAX)}…` : raw);
+const comparable = (p) => (p.length > 1 ? p.replace(/\/+$/, "") : p);
+function markedHome(stdout) {
+    const lines = stdout.split("\n").filter((l) => l.startsWith(LANE_HOME_PROBE_MARKER));
+    const last = lines[lines.length - 1];
+    return last === undefined ? undefined : last.slice(LANE_HOME_PROBE_MARKER.length).replace(/\r$/, "");
+}
+export function judgeLaneHome(lane, declared, probe) {
+    const head = `REMOTE_EXEC_HOME_DIR=${shown(declared)} is the home "~/" permission rules and the engine's home-anchored read-deny rows are placed under on the ${lane} execution lane`;
+    const measured = probe.ok ? markedHome(probe.stdout) : undefined;
+    if (measured === undefined) {
+        const reason = probe.ok ? "the probe printed no home line" : probe.reason;
+        return {
+            refusal: `${head}, but the home of this execution environment could not be read (${reason}) — the declaration cannot be confirmed, so this environment is not started. Fix the lane, or unset REMOTE_EXEC_HOME_DIR (home-relative rules are then refused at submission instead).`,
+            answered: false,
+        };
+    }
+    if (!measured.startsWith("/")) {
+        return {
+            refusal: `${head}, but this execution environment reports HOME=${shown(measured)}, not an absolute path — the declaration cannot be confirmed, so this environment is not started. Give the environment's user a home (HOME), or unset REMOTE_EXEC_HOME_DIR.`,
+            answered: true,
+        };
+    }
+    if (comparable(measured) === comparable(declared))
+        return undefined;
+    return {
+        refusal: `${head}, but its commands run with HOME=${shown(measured)} — rules would guard ${shown(declared)} while ${shown(measured)} stays readable and writable, ` +
+            `so this environment is not started. Set REMOTE_EXEC_HOME_DIR to ${shown(measured)}, or run the environment as the user whose home is ${shown(declared)}.`,
+        answered: true,
+    };
+}
+//# sourceMappingURL=lane-home-probe.js.map

package/dist/limit-refusal.d.ts

@@ -0,0 +1,47 @@
+/**
+ * **帽的拒**(一张表条数太多 / 一段文字太长)在本仓受理口的一只写法:句子的头一句 + 机读位,一处铸。
+ *
+ * 律:请求体上任何一处撞了帽,拒体带同一组机读位 ——
+ *  · `field`  = 撞帽的那一处在请求体里的坐标(`skills[1].allowedTools`、`agents[0].denyTools[3]`、`settings.permissions.allow`);
+ *  · `reason` = 帽的量纲,闭集两词:`over_cap`(条数:数组的条目数)/ `too_long`(字符数:一段文字的长度);
+ *  · `count`  = 送来的量(条数或字符数,量纲由 `reason` 定);
+ *  · `cap`    = 帽。
+ * 句子的头一句同一句:`<field> has <count> entries|characters — at most <cap> are accepted`;之后各面可以接自己的出路句(为什么拒而不截、怎么改)。
+ * 帽本身(数字)归各面的属主;本模块只管「撞了帽怎么说、怎么机读」。
+ *
+ * 量纲 → `reason` 是一张闭表({@link LIMIT_REASONS}):加一种量纲 ⇒ 这里加一行,`reason` 的词随之进闭集,读者穷举读。
+ */
+/** 量纲 → 机读 `reason` 词(闭集)。 */
+export declare const LIMIT_REASONS: {
+    readonly entries: "over_cap";
+    readonly characters: "too_long";
+};
+/** 帽的量纲:条数 / 字符数(句子里就是这个词)。 */
+export type LimitMeasure = keyof typeof LIMIT_REASONS;
+/** 机读 `reason`:`over_cap`(条数)/ `too_long`(字符数)。 */
+export type LimitReason = (typeof LIMIT_REASONS)[LimitMeasure];
+/** 一处撞帽的机读位(原样进拒体:`refusalBody` 的 facts / `HttpError.extra`;型别名而不是接口 —— 要能直接当 `Record<string, unknown>` 用)。 */
+export type LimitFacts = {
+    readonly field: string;
+    readonly reason: LimitReason;
+    readonly count: number;
+    readonly cap: number;
+};
+/** 一处撞帽的拒:句子 + 机读位。 */
+export interface LimitRefusal {
+    readonly message: string;
+    readonly facts: LimitFacts;
+}
+/** 撞帽的头一句(全仓同一句;`field` 是句子里点名的那一处)。 */
+export declare function describeLimit(field: string, measure: LimitMeasure, count: number, cap: number): string;
+/** 机读位:`reason` 由量纲定。 */
+export declare function limitFacts(field: string, measure: LimitMeasure, count: number, cap: number): LimitFacts;
+/**
+ * 一处撞帽的拒:句子 = {@link describeLimit}(+ `tail`:该面的出路句,接在头一句之后),机读位 = {@link limitFacts}(`field` 同一个坐标)。
+ * `sentenceField` 只在该面的句子沿用另一种点名写法时给(子代定义的句子写作 `agents[0]: agent.name`,机读位仍是体内坐标 `agents[0].name`)。
+ */
+export declare function limitRefusal(field: string, measure: LimitMeasure, count: number, cap: number, opts?: {
+    readonly tail?: string;
+    readonly sentenceField?: string;
+}): LimitRefusal;
+//# sourceMappingURL=limit-refusal.d.ts.map

package/dist/limit-refusal.js

@@ -0,0 +1,12 @@
+export const LIMIT_REASONS = { entries: "over_cap", characters: "too_long" };
+export function describeLimit(field, measure, count, cap) {
+    return `${field} has ${count} ${measure} — at most ${cap} are accepted`;
+}
+export function limitFacts(field, measure, count, cap) {
+    return { field, reason: LIMIT_REASONS[measure], count, cap };
+}
+export function limitRefusal(field, measure, count, cap, opts = {}) {
+    const head = describeLimit(opts.sentenceField ?? field, measure, count, cap);
+    return { message: opts.tail === undefined ? head : `${head}. ${opts.tail}`, facts: limitFacts(field, measure, count, cap) };
+}
+//# sourceMappingURL=limit-refusal.js.map

package/dist/main.js

@@ -15,7 +15,7 @@ async function main() {
     const s02 = await runStage02(s01);
     const s03 = await runStage03(s02);
     const s04 = await runStage04(s03);
-    const s05 = runStage05(s04);
+    const s05 = await runStage05(s04);
     await settleHostLaneShell(s05.config, s05.logger);
     const s06 = runStage06(s05);
     const s07 = await runStage07(s06);