@sema-agent/server 7.130.0 → 7.132.0

package/dist/approval-card.d.ts

@@ -295,7 +295,9 @@ export declare function readProbeCause(req: unknown): ProbeCauseProjection | und
  *
  * 姿势逐条(与 {@link readProbeCause} / {@link readRuleEvidence} 同款分工):
  *  · `safeParse`,非串 ⇒ 按缺席处置(宪法 [ref]);空串 / 纯空白 ⇒ 缺席(core 自己也只在 `trim() !== ""` 时铸)。
- *  · 长度:超过 {@link MAX_PROBE_REASON_CODEPOINTS} ⇒ **整只丢,不截**(判据与 `probeCause.code` 超限同形);
+ *  · 长度(S-733 信封):core 铸不出的长度 ⇒ **整只丢,不截**(判据与 `probeCause.code` 超限同形;截出来的是**另一句话**)。判官是 core 包根导出的
+ *    `isMintableProbeReason`(core 7.53.0 #1883:上限 = core 的 cap + 它那一枚截断记号的宽度,「+1」只写在 core 一处;修前本仓手抄
+ *    `MAX_PROBE_REASON_CODEPOINTS = 201` —— 数字与「+1」两件事都是抄的)。超过它的值**不是 core 铸的**(第三方 producer / 世代差)。
  *    先判长度再脱敏 ⇒ 喂给脱敏器的永远是个短串(脱敏器的 RangeError 面是超大输入)。
  *  · 内容族(部署自写的探针散文,人眼信任边界上的文本)⇒ `redactSecrets`。脱敏后**不再截**:耐久面同样不截,
  *    两面逐字节同值比「帧上短一截」重要(allow 层披露那一格 R2-[medium] 的反面:那里有卡面要对齐,这里没有)。

package/dist/approval-card.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
@@ -161,14 +161,13 @@ export function readProbeCause(req) {
         ...(raw.further !== undefined ? { further: family(raw.further) } : {}),
     };
 }
-const MAX_PROBE_REASON_CODEPOINTS = 201;
 const ProbeReasonEnvelopeSchema = z.object({ probeReason: z.string().optional() });
 export function readProbeReason(req) {
     const parsed = ProbeReasonEnvelopeSchema.safeParse(req);
     const raw = parsed.success ? parsed.data.probeReason : undefined;
     if (raw === undefined || raw.trim() === "")
         return undefined;
-    if ([...raw].length > MAX_PROBE_REASON_CODEPOINTS)
+    if (!isMintableProbeReason(raw))
         return undefined;
     const redacted = redactSecrets(raw);
     return redacted === "" ? undefined : redacted;

package/dist/audit.d.ts

@@ -1,3 +1,4 @@
+import { type StoredPromptEpoch } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 /**
@@ -21,16 +22,12 @@ export interface SessionAudit {
      *  再回给调用方;直接消费本视图的宿主(`buildSessionAudit` 是包根导出)自己负责同一道脱敏。
      *  唯一一处服务端添键:用户消息行的回退手柄 `taskId`(给了 {@link RewindHandles} 才投,见 {@link buildRewindHandles})。 */
     messages: unknown[];
-    /** [ref]① web 观测切片 B: the session's prompt-epoch pin, core contract verbatim (core 1.304
-     *  `session.getPromptEpoch()` — first-class `prompt_epoch` entry, compaction restatement, [ref] anchor
-     *  all inside core). Additive; a pre-epoch session omits the key entirely (undefined). */
-    promptEpoch?: {
-        epoch: number;
-        artifactDigest: string;
-        packId: string;
-        assemblyApi: number;
-        activatedBy: "session_start" | "compaction" | "legacy_migration";
-    };
+    /** [ref]① web 观测切片 B: the session's prompt-epoch record as the engine reads it, verbatim (`session.getPromptEpoch()` —
+     *  first-class `prompt_epoch` entry, compaction restatement, [ref] anchor, the reading itself all inside the engine):
+     *  `{ kind: "pin", descriptor }` for a current-shape record, `{ kind: "legacy", centerPinned }` for a record an engine
+     *  ≤ 7.51 wrote (recognized by its retired field names). This view adds no reading of its own. A pre-epoch session omits
+     *  the key entirely (undefined). */
+    promptEpoch?: StoredPromptEpoch;
 }
 /**
  * 用户消息行的**回退手柄**表:用户条目 id → 回退时交给 `resumeAt` 的那个 `event_id`(R8 用户消息锚按 run 的 taskId 键入)。

package/dist/audit.js

@@ -5,7 +5,7 @@ import { createLocalSessionRepo } from "./plugins/local-session-store.js";
 import { redactModelText } from "./observability/run-terminal.js";
 import { redactDeepWith } from "./trace/redact.js";
 import { projectToolStructured } from "./trace/tool-output-media.js";
-import { INJECTED_BLOCK_RE } from "./user-authored-text.js";
+import { INJECTED_BLOCK_RE, isAttachmentFrame } from "./user-authored-text.js";
 export function buildRewindHandles(anchors, reader) {
     const byEntry = new Map();
     for (const a of anchors) {
@@ -153,9 +153,12 @@ const MESSAGE_READ_TREATMENT = {
         unsummarizedMessages: "verbatim", tokensAfter: "verbatim", firstKeptEntryId: "verbatim",
     },
 };
+const ATTACHMENT_FRAME_READ_TREATMENT = { ...MESSAGE_READ_TREATMENT.user, content: "parts" };
 function readMessage(m) {
     if (isPlainRecord(m)) {
         const role = m.role;
+        if (role === "user" && isAttachmentFrame(m))
+            return readByTable(m, ATTACHMENT_FRAME_READ_TREATMENT);
         if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
             return readByTable(m, MESSAGE_READ_TREATMENT[role]);
         }

package/dist/auth-bridge.d.ts

@@ -45,6 +45,10 @@ export type VerifyOutcome = {
 export interface WebAdminJwtVerifier {
     verify: (bearer: string) => Promise<VerifyOutcome>;
 }
+/** 缓存键的常规刷新周期缺省(秒):过期后下一发在后台重拉,当前请求不等。 */
+export declare const DEFAULT_JWKS_TTL_SEC: number;
+/** 一次 JWKS 拉取的时限(毫秒):kid 未知、超离线宽限、后台刷新三条路用同一只拉取,同一个时限。 */
+export declare const JWKS_FETCH_TIMEOUT_MS = 10000;
 /**
  * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为
  * AUTH_BRIDGE_ERROR_CODES(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。

package/dist/auth-bridge.js

@@ -8,7 +8,8 @@ export function authBridgeIssuerOf(config) {
         return { issuer: config.webAdmin.baseUrl, source: "fallback" };
     return undefined;
 }
-const DEFAULT_JWKS_TTL_SEC = 15 * 60;
+export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
+export const JWKS_FETCH_TIMEOUT_MS = 10_000;
 const MAX_JWKS_BYTES = 256 * 1024;
 const MAX_TOKEN_CHARS = 16 * 1024;
 const MAX_SEGMENT_BYTES = 64 * 1024;
@@ -39,6 +40,7 @@ export function createWebAdminJwtVerifier(opts) {
     let lastFetchAttemptMs;
     let lastFetchSuccessMs;
     let inflight;
+    const withinGrace = () => lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
     const fail = (error, kid) => {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: error });
         opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: displayIssuer });
@@ -50,7 +52,7 @@ export function createWebAdminJwtVerifier(opts) {
         inflight = (async () => {
             lastFetchAttemptMs = now();
             try {
-                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(10_000) });
+                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS) });
                 if (!res.ok)
                     throw new Error(`jwks HTTP ${res.status}`);
                 const cl = Number(res.headers.get("content-length"));
@@ -112,8 +114,9 @@ export function createWebAdminJwtVerifier(opts) {
             return fail("unknown_issuer", kid);
         if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
             return fail("expired", kid);
-        const snapshot = () => ({ cachedKids: [...keys.keys()], lastFetchAttemptMs, nowMs: now() });
-        if (keys.has(kid)) {
+        const usableKey = () => (withinGrace() ? keys.get(kid) : undefined);
+        const snapshot = () => ({ cachedKids: withinGrace() ? [...keys.keys()] : [], lastFetchAttemptMs, nowMs: now() });
+        if (usableKey()) {
             const ttlStale = lastFetchSuccessMs === undefined || now() - lastFetchSuccessMs > jwksTtlSec * 1000;
             if (ttlStale && !inflight && (lastFetchAttemptMs === undefined || now() - lastFetchAttemptMs >= refreshMin * 1000)) {
                 void refreshJwks();
@@ -122,16 +125,12 @@ export function createWebAdminJwtVerifier(opts) {
         else {
             if (inflight)
                 await inflight;
-            if (!keys.has(kid) && shouldForceJwksRefresh(kid, snapshot(), { jwksRefreshMinIntervalSec: refreshMin }))
+            if (!usableKey() && shouldForceJwksRefresh(kid, snapshot(), { jwksRefreshMinIntervalSec: refreshMin }))
                 await refreshJwks();
         }
-        const key = keys.get(kid);
+        const key = usableKey();
         if (!key) {
-            const graceOk = lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
-            return graceOk ? fail("invalid_signature", kid) : fail("jwks_unavailable", kid);
-        }
-        if (lastFetchSuccessMs !== undefined && !jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec })) {
-            return fail("jwks_unavailable", kid);
+            return withinGrace() ? fail("invalid_signature", kid) : fail("jwks_unavailable", kid);
         }
         let sigOk = false;
         try {

package/dist/bench/s1/live-deps.js

@@ -1,6 +1,7 @@
 import { outwardPlane } from "../../terminal.js";
 import { Runner, runWithVerification, resumeWithVerification, runRepairLoop, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "@sema-agent/core";
 import { loadConfig } from "../../config.js";
+import { assertServedModelRoute } from "../../model-route-endpoint.js";
 import { withUnattendedLeg } from "../../unattended-permission-mode.js";
 import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
@@ -51,6 +52,7 @@ function buildBrainIngredients(rt) {
     if (rt.costCacheWrite != null)
         process.env.MODEL_COST_CACHE_WRITE = String(rt.costCacheWrite);
     const config = loadConfig();
+    assertServedModelRoute(config, { envTableIsPlaceholder: false });
     const brain = createBrain(config, {});
     const pricing = buildPricing(config.models);
     const p = pricing[rt.modelId];

package/dist/boot/deployment-mods.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 部署座(`RunnerDeps.mods`)的注册:**铸**({@link createDeploymentMods})与**起服自证**({@link assertDeploymentModsAdmitted})都在这一处。
+ *
+ * 起服自证(律三:拒形只有引擎一种读法,本仓只负责「不写」与「启动时自证」):
+ * 部署座上的注册是本仓自己铸的。它们坏了
+ * —— 坏名、坏档、缺 `uses.calls`、`on` 越出 `uses`、只选无站的名字、`register` 抛 —— 引擎在每条腿的 prepare 里拒
+ * (`config.mods_invalid`),那就是每个请求都失败。所以起服时让引擎的 admission 判一次:判官仍是引擎(`admitModChain`),
+ * 本函数不判形,只把它的拒折成一句起服错误、拒启。两个起服入口(server 第五段、本地 CLI)同调这一只。
+ *
+ * 也拒启的两形(同一个理由:部署注册一张都不该缺席,也不该带病挂上):
+ *  · admission 期的报告(引擎对坏 `budgetMs` 只报告、回落缺省,不拒)—— 部署注册不设 `budgetMs`,报告出现就是铸法坏了;
+ *  · 被 `plugin.register` 判拒的注册(本部署没有这种判官;出现即装配错)。
+ * 腿外 admission 只建一只总线并跑一次各注册的 `register`(本仓的 `register` 是纯函数),不碰任何腿。
+ */
+import { type EngineDollar, type ModRegistration } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+/**
+ * 部署座上的注册列表 —— 两个起服入口(server 第五段与本地 CLI)同一只铸法,哪几张、什么顺序只写在这里:
+ *  · 拒绝计量恒挂、在前;工具追踪(`TOOL_TRACE=true`,交 `traceLogger`)在后。两张都是 `prepend` 档的观察者,引擎按「档 → 部署先于任务 → 座内顺序」
+ *    串行跑观察者、且都在链之前 ⇒ 同一次拒绝先计数、后写追踪行;
+ *  · 品牌行(`brandIdentity`:品牌部署 = local / TOC)—— `prompt.compose` 上的一条部署类 overlay(`capabilities/brand-identity.ts`),与两只观察者
+ *    不在同一个事件上,顺序不影响它们。部署开不开品牌只在这一个入参表态。
+ */
+export declare function createDeploymentMods(input: {
+    readonly metrics: Pick<Metrics, "inc">;
+    readonly traceLogger?: Logger | undefined;
+    readonly brandIdentity?: boolean | undefined;
+}): readonly ModRegistration<EngineDollar>[];
+export declare function assertDeploymentModsAdmitted(mods: readonly ModRegistration<EngineDollar>[]): Promise<void>;
+//# sourceMappingURL=deployment-mods.d.ts.map

package/dist/boot/deployment-mods.js

@@ -0,0 +1,26 @@
+import { admitModChain } from "@sema-agent/core";
+import { createBrandIdentityRegistration } from "../capabilities/brand-identity.js";
+import { createPermissionDeniedMeter, createToolTracer } from "../observability/tool-trace.js";
+export function createDeploymentMods(input) {
+    return [
+        createPermissionDeniedMeter(input.metrics),
+        ...(input.traceLogger !== undefined ? [createToolTracer(input.traceLogger)] : []),
+        ...(input.brandIdentity === true ? [createBrandIdentityRegistration()] : []),
+    ];
+}
+const REFUSED = "deployment extension registration refused";
+export async function assertDeploymentModsAdmitted(mods) {
+    const reports = [];
+    let records;
+    try {
+        ({ records } = await admitModChain({ deployment: mods }, (err) => void reports.push(err.message)));
+    }
+    catch (e) {
+        throw new Error(`${REFUSED}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const refused = records.flatMap((r) => ("refusedBy" in r ? [`"${r.name}" refused by ${r.refusedBy}: ${r.reason}`] : []));
+    const problems = [...reports, ...refused];
+    if (problems.length > 0)
+        throw new Error(`${REFUSED}: ${problems.join("; ")}`);
+}
+//# sourceMappingURL=deployment-mods.js.map

package/dist/boot/execution-env.d.ts

@@ -62,7 +62,7 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  *  · **工作区空间的分区 = 会话化身**(`spaceOccupant.incarnation`):建这只 env 时按 id 读一次会话店的 `incarnationOf`(会话行上的那一格,
  *    `session-incarnation.ts`;本工厂不取会话,正是 core 给「没取会话的读者」的那只读)。读数是闭集三臂(`SpaceOccupant`,适配器那边逐臂处置):
  *    答令牌 ⇒ 已知;答 `undefined`(没有这只会话)⇒ `{ unread: "incarnation_unknown" }` —— 没有空间:空间车道不开、缓存卷不挂,各一行;
- *    读抛 / 答出的不是非空串 ⇒ `{ fault: <code> }` —— 读不到空间 ≠ 没有空间:开着的空间车道 / 缓存卷让这只 env 一只 pod 都不建,
+ *    读抛 / 超时(`rpcTimeoutMs`,同一次 connect 里读围栏行与 `latest` 的那一只墙)/ 答出的不是非空串 ⇒ `{ fault: <code> }` —— 读不到空间 ≠ 没有空间:开着的空间车道 / 缓存卷让这只 env 一只 pod 都不建,
  *    connect 与 resumeVM 都答 `connect_failed`(与 `latest` 读失败同一铸点),一行 `workspace_space_unreadable_occupant`;`code` 是店的错误码,
  *    从不带正文、从不带令牌。**绝不**以会话 id 代替;
  *    同时开这只 env 在空间提交围栏上的座(`spaceOccupant.fence`,run 店的 `workspace_space_commit` 行;法见 `workspace-space-commit.ts`);

package/dist/boot/execution-env.js

@@ -10,7 +10,7 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
@@ -23,10 +23,11 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
+import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, buildUndeclaredHomeNote, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -108,15 +109,16 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     };
 }
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
+    const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
         const child = ctx.placementRootSessionId !== ctx.sessionId;
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
-        const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId);
+        const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
-            ...(cache !== undefined && !child ? { cache } : {}),
+            ...(cache !== undefined && !child ? { cache, cacheMisses } : {}),
             ...(s3Snapshot !== undefined ? { s3Snapshot } : {}),
             image: seats.imageOf(ctx.sessionId) ?? k8sCfg.image,
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
@@ -125,10 +127,18 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     };
 }
 const STORE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
-async function occupantOf(seats, sessionId, taskId) {
+const INCARNATION_READ_TIMEOUT = "incarnation_read_timeout";
+async function occupantOf(seats, sessionId, taskId, boundMs) {
     let answer;
     try {
-        answer = await seats.incarnationOf?.(sessionId);
+        const read = seats.incarnationOf;
+        answer =
+            read === undefined
+                ? undefined
+                : await boundedStoreCall(() => read(sessionId), {
+                    ms: boundMs,
+                    onTimeout: () => Object.assign(new Error(`session occupant read did not answer within ${boundMs}ms`), { code: INCARNATION_READ_TIMEOUT }),
+                });
     }
     catch (e) {
         const code = e?.code;
@@ -404,6 +414,9 @@ export function createExecutionEnv(ctx) {
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
+        const homeNote = buildUndeclaredHomeNote(config);
+        if (homeNote !== undefined)
+            logger.warn("execution_lane_home_undeclared", { provider: config.remoteExec.provider, note: homeNote });
         if (executionLaneOf(config.remoteExec.provider) === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }

package/dist/boot/memory-boundary.d.ts

@@ -75,8 +75,8 @@ import type { MemoryEngineBackend } from "@sema-agent/settings-schema/execution-
  * 而且它断言的是 per-task 事实,不是本键的车道级语义。
  *
  * ## 位置与纪律
- * 单源:resolve-spec 的 spec 直通、`noPersistentMemoryNotice` 判别式、boot 审计的 declared 位
- * 三处都必须读本函数,禁各自重算(operator-knob 律:显式 env 的优先权在这一个函数里执法一次)。
+ * 单源:resolve-spec 的 spec 直通(引擎据它判「本会话没有持久记忆」的披露与四只记忆面臂)、boot 审计的 declared 位
+ * 两处都必须读本函数,禁各自重算(operator-knob 律:显式 env 的优先权在这一个函数里执法一次)。
  * 自动补位在 boot 日志上必须可见(stores.ts 的 info 行),部署方随时可用显式 env 覆盖。
  */
 export declare function effectiveMemoryPersistenceCapable(config: {

package/dist/boot/read-deny-anchor-audit.d.ts

@@ -0,0 +1,17 @@
+import type { Logger } from "../observability/logger.js";
+/** 一行 warn 里最多点名的行数(超出只报总数与省略数):一份中心发布可以带很多行,启动日志的一行不随之变长。 */
+export declare const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
+export interface ReadDenyAnchorAuditCtx {
+    /** 部署读拒行(`config.readDenyPatterns`);缺席 / 空 ⇒ 无话可说。 */
+    readonly rows: readonly {
+        readonly pattern: string;
+        readonly caseSensitive: boolean;
+    }[] | undefined;
+    readonly logger: Pick<Logger, "warn">;
+}
+/**
+ * 只由 `announceReadDenyRows` 调(一份值一次)。返回非锚定行的规范形(按配置顺序;无 ⇒ 空),并在有时打**恰一行** warn `read_deny_unanchored_rows`
+ * (`rows` 点名前 {@link READ_DENY_AUDIT_MAX_NAMED_ROWS} 行、`count` 总数、超出时 `omitted`;`note` 引 MIGRATION 第 45 条的改法)。绝不抛。
+ */
+export declare function auditReadDenyAnchoring(ctx: ReadDenyAnchorAuditCtx): readonly string[];
+//# sourceMappingURL=read-deny-anchor-audit.d.ts.map

package/dist/boot/read-deny-anchor-audit.js

@@ -0,0 +1,36 @@
+import { compileReadDeny, readDenyPatternRun } from "@sema-agent/core";
+import { echoCallerText } from "../caller-text-echo.js";
+export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
+const NAMED_ROW_ECHO_CHARS = 200;
+function isAnchoredCanonicalRow(canonical) {
+    return readDenyPatternRun(canonical).homeAnchored || canonical.startsWith("/");
+}
+export function auditReadDenyAnchoring(ctx) {
+    if (ctx.rows === undefined || ctx.rows.length === 0)
+        return [];
+    let canonical;
+    try {
+        canonical = compileReadDeny(ctx.rows, "boot read-deny anchor audit", { tiers: [] }).entries.map((e) => e.pattern);
+    }
+    catch (err) {
+        ctx.logger.warn("read_deny_anchor_audit_failed", {
+            error: echoCallerText(err instanceof Error ? err.message : String(err), { maxChars: 400 }),
+            note: "the boot audit could not read the deployment read-deny rows, so it names none and changes nothing; the engine itself refuses a row it cannot read when the Runner is built",
+        });
+        return [];
+    }
+    const unanchored = canonical.filter((p) => !isAnchoredCanonicalRow(p));
+    if (unanchored.length === 0)
+        return [];
+    const named = unanchored.slice(0, READ_DENY_AUDIT_MAX_NAMED_ROWS).map((p) => echoCallerText(p, { maxChars: NAMED_ROW_ECHO_CHARS }));
+    ctx.logger.warn("read_deny_unanchored_rows", {
+        rows: named,
+        count: unanchored.length,
+        ...(unanchored.length > named.length ? { omitted: unanchored.length - named.length } : {}),
+        note: "recursive shell reads (grep -r and the like) are judged by the root the command names: a read-deny row spelled without a root or home anchor does not protect files below that root " +
+            "(reading from a parent directory returns their content; naming the directory or file itself is still refused). Anchor the row to protect it — `<workspace root>/…` or `~/…` — see MIGRATION 7.132.0 item 45. " +
+            "This notice changes nothing: enforcement is unchanged and the start is not refused",
+    });
+    return unanchored;
+}
+//# sourceMappingURL=read-deny-anchor-audit.js.map

package/dist/boot/resolve-spec.d.ts

@@ -1,5 +1,4 @@
-import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
-import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
+import { type MemoryBackend } from "@sema-agent/core";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
@@ -28,8 +27,6 @@ export interface ResolveSpecCtx {
     scenarios: Record<string, ReturnType<typeof selectScenario>>;
     principalCaps: PrincipalCaps | undefined;
     centerRuntimeCapsResolver: PrincipalCaps["resolveRuntimeCaps"] | undefined;
-    /** 活引用(adoptCenterPrompts 每次采用换引用)—— 见文件头「位置即契约」。 */
-    getCenterPrompts: () => PromptsDomainFaces | undefined;
     /** 活引用(registry 热应用换引用)—— 见文件头「位置即契约」。 */
     getKeyResolver: () => ReturnType<typeof createKeyResolver>;
     taskAttachmentStore: TaskAttachmentStore | undefined;
@@ -77,7 +74,6 @@ export interface ResolveSpecCtx {
     approverSeat: RunnerDepsOnAsk | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
-    deploymentHooks: NonNullable<RunnerDeps["hooks"]>;
     imageIndex: ReturnType<NonNullable<StoreBackend["imageIndex"]>> | undefined;
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;