@sema-agent/server 7.131.0 → 7.132.0

package/dist/web-admin-client/skills-mcp.js

@@ -2,10 +2,13 @@ import { readMcpSourceLabel } from "../mcp-source-label.js";
 import { readMcpToolFaces } from "../mcp-tool-faces.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
 import { readMcpToolAxes } from "@sema-agent/core";
-import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
+import { MCP_CONTENT_ORIGINS, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
+import { describeBadContentOrigin, describeBadWireName } from "../caller-text-echo.js";
 import { noteMcpAssertionHeaderNotSent } from "../mcp-assertion-header.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { describeBadWireName, isUsableWireName } from "../wire-name-bound.js";
+function skillBodyPresent(body) {
+    return body !== undefined && body !== "";
+}
 export async function applySkillsManifest(baseline, manifest, bodies, logger) {
     const diskCacheDir = bodies.skillBodyCacheDir;
     const { promises: fsp } = await import("node:fs");
@@ -19,7 +22,7 @@ export async function applySkillsManifest(baseline, manifest, bodies, logger) {
         try {
             const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
             if (skillContentHash(text) === hash)
-                return text;
+                return skillBodyPresent(text) ? text : undefined;
             logger?.warn("web_admin_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, re-reading from the config source" });
         }
         catch {
@@ -53,8 +56,8 @@ export async function applySkillsManifest(baseline, manifest, bodies, logger) {
                 content = await diskRead(m.contentHash);
             if (content === undefined) {
                 const answered = await bodies.fetchSkillContent(m.contentHash);
-                if (answered === undefined) {
-                    logger?.warn("web_admin_skill_failed", { name: m.name, hash: m.contentHash, reason: "body_absent", note: "the config source holds no body for this hash — this entry is NOT installed; the baseline skill of this name (if any) stays" });
+                if (!skillBodyPresent(answered)) {
+                    logger?.warn("web_admin_skill_failed", { name: m.name, hash: m.contentHash, reason: "body_absent", note: "the config source holds no body for this hash (absent, or an empty string) — this entry is NOT installed; the baseline skill of this name (if any) stays" });
                     continue;
                 }
                 content = answered;
@@ -109,7 +112,7 @@ export function resolveMcpServers(mcp, logger) {
                 logger?.warn("web_admin_mcp_content_class_invalid", {
                     server: s.name,
                     value: describeBadContentOrigin(s.contentOrigin),
-                    allowed: CONTENT_ORIGIN_WORDS,
+                    allowed: MCP_CONTENT_ORIGINS,
                     note: "declaration DROPPED — this server's tools keep the pre-378 default (external content, session gets marked). Fix the center entry; the server itself still mounts.",
                 });
         }

package/dist/web-admin-client/types.d.ts

@@ -371,9 +371,8 @@ export interface EffectiveConfig {
      *  这条腿对本部署不存在,四键仍由 env / 引擎默认独占。restart-to-apply(boot 期被 `createRunnerDeps`
      *  捕获),改动经 `read-face` restart 片通告。 */
     readFace?: CenterReadFace;
-    /** prompts 域(additive key;双轴 wire=registry-core `EffectivePromptsWire` 或 legacy 平铺形——
-     *  server 侧判形/采用全在 capabilities/center-prompts.ts `validatePromptsDomain`,本 interface 只
-     *  声明键位存在(unknown:候选门是唯一解释者,这里不复刻形)。 */
+    /** prompts 域(中心层;wire 形只有一种 = 契约包 `EffectivePromptsWire` `{ schemaVersion: 2, artifact }`)—— 判法只在候选判官一处
+     *  (`prompts-domain-validate.ts` 的 `judgePromptsWire`,经 `judgeConfigCandidate`),本 interface 只声明键位存在(unknown:判官是唯一解释者,这里不复刻形)。 */
     prompts?: unknown;
 }
 /** (stage7 P5,registry-core 0.8 `execution` 域): the center-resolved per-principal execution

package/dist/workspace-cache.d.ts

@@ -39,6 +39,41 @@ export declare function workspaceCacheClaimOf(spaceKey: string): {
     name: string;
     label: string;
 };
+/**
+ * The directories of the sandbox image the cache volume must never hide — a CLOSED set of path prefixes: a mount that is one of them,
+ * sits under one, or is an ancestor of one (a volume mounted there shadows everything the image keeps at that path) refuses boot.
+ *  - the system roots every image has (`/bin` `/boot` `/dev` `/etc` `/lib` `/lib64` `/proc` `/root` `/run` `/sbin` `/sys` `/usr` `/var`);
+ *  - `/tmp` — the adapter's own scratch (the snapshot archive, the background-job directories);
+ *  - `/opt/sema` — the image's package-source hook the pod start runs;
+ *  - `/home/sandbox` — the sandbox user's home in the images this lane ships.
+ * One reading: the workspace mount is the set's one dynamic member (`K8S_MOUNT_PATH`); config reads both through {@link mountsOverlap}.
+ */
+export declare const WORKSPACE_CACHE_MOUNT_RESERVED: readonly ["/bin", "/boot", "/dev", "/etc", "/home/sandbox", "/lib", "/lib64", "/opt/sema", "/proc", "/root", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var"];
+/** The reserved directory a cache mount collides with (at / under / above it), or `undefined`. `mount` is absolute and normalized. */
+export declare function reservedMountCollision(mount: string): (typeof WORKSPACE_CACHE_MOUNT_RESERVED)[number] | undefined;
+/** The most spaces a {@link CacheMissMemory} holds at once (a process serving more spaces than this forgets the oldest first). */
+export declare const CACHE_MISS_MEMORY_CAP = 1024;
+/** A cache volume that could not be had for a pod and cost a wait: its claim did not bind in time, or it bound and the pod carrying it did not become ready. */
+export interface CacheMissRecord {
+    readonly reason: "claim_unbound" | "claim_unmountable";
+    readonly detail: string;
+}
+/**
+ * The process's memory of cache volumes that could not be had — per space, for a window the caller states: a run that waited out a volume the cluster could not
+ * bind says so here, and the next runs of that space inside the window start without it at once (no claim request, no pod waiting on it) instead of each paying the
+ * whole wait again. A cache is regenerable, so "not asked for a while" costs only builds that re-download. Keyed by the claim's one-way digest (never the space key
+ * itself); bounded ({@link CACHE_MISS_MEMORY_CAP}: expired entries go first, then the oldest). One per deployment, held by the per-run binding — never process-global.
+ */
+export interface CacheMissMemory {
+    /** `spaceKey`'s volume could not be had: remembered for `windowMs` from now. */
+    remember(spaceKey: string, miss: CacheMissRecord, windowMs: number): void;
+    /** Inside the window ⇒ the remembered miss; otherwise `undefined` (and the entry is dropped). */
+    recall(spaceKey: string): CacheMissRecord | undefined;
+    /** Entries held (expired ones that were not read again included). */
+    size(): number;
+}
+/** A fresh {@link CacheMissMemory} (`now` = the clock, epoch ms; a test hands its own). */
+export declare function createCacheMissMemory(now?: () => number): CacheMissMemory;
 /** Does the cache mount overlap the workspace mount (equal, or one inside the other)? Both are absolute, normalized paths. */
 export declare function mountsOverlap(a: string, b: string): boolean;
 export {};

package/dist/workspace-cache.js

@@ -23,6 +23,42 @@ export function workspaceCacheClaimOf(spaceKey) {
     const digest = createHash("sha256").update(spaceKey).digest("hex").slice(0, 20);
     return { name: `ws-cache-${digest}`, label: digest };
 }
+export const WORKSPACE_CACHE_MOUNT_RESERVED = ["/bin", "/boot", "/dev", "/etc", "/home/sandbox", "/lib", "/lib64", "/opt/sema", "/proc", "/root", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var"];
+export function reservedMountCollision(mount) {
+    return WORKSPACE_CACHE_MOUNT_RESERVED.find((dir) => mountsOverlap(mount, dir));
+}
+export const CACHE_MISS_MEMORY_CAP = 1024;
+export function createCacheMissMemory(now = Date.now) {
+    const held = new Map();
+    const keyOf = (spaceKey) => workspaceCacheClaimOf(spaceKey).label;
+    return {
+        remember(spaceKey, miss, windowMs) {
+            const at = now();
+            const key = keyOf(spaceKey);
+            held.delete(key);
+            held.set(key, { miss, until: at + windowMs });
+            if (held.size <= CACHE_MISS_MEMORY_CAP)
+                return;
+            for (const [k, e] of held)
+                if (e.until <= at)
+                    held.delete(k);
+            while (held.size > CACHE_MISS_MEMORY_CAP)
+                held.delete(held.keys().next().value);
+        },
+        recall(spaceKey) {
+            const key = keyOf(spaceKey);
+            const e = held.get(key);
+            if (e === undefined)
+                return undefined;
+            if (e.until <= now()) {
+                held.delete(key);
+                return undefined;
+            }
+            return e.miss;
+        },
+        size: () => held.size,
+    };
+}
 export function mountsOverlap(a, b) {
     const inside = (x, y) => x === y || x.startsWith(y.endsWith("/") ? y : `${y}/`);
     return inside(a, b) || inside(b, a);

package/dist/workspace-space.d.ts

@@ -71,8 +71,9 @@ export declare const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snap
  * space snapshot and the park suspend share it). Unset / empty ⇒ no table (the upload command is what it always was).
  *
  * The item form is CLOSED: plain relative path segments — no leading `/`, no `.` / `..` / empty segment (`./x`, `a//b`, a
- * trailing `/`), no whitespace, no quote characters, no control characters. Tar wildcards inside a segment (`*.log`) are items
- * like any other. A project's `.gitignore` is NOT read (a second grammar, per project, not equivalent to tar's). Items are
+ * trailing `/`), no whitespace, no quote characters, no control characters, and no whole wildcard (an item made only of `*` / `?`
+ * names no path: `*` would exclude every top-level entry and the snapshot would be empty). Tar wildcards inside a segment (`*.log`)
+ * are items like any other. A project's `.gitignore` is NOT read (a second grammar, per project, not equivalent to tar's). Items are
  * trimmed (the CSV separator's spacing is not part of an item); a bad item refuses boot naming its position — the value is a
  * path pattern, never a secret, so it is echoed.
  */

package/dist/workspace-space.js

@@ -30,6 +30,8 @@ function snapshotExcludeItemProblem(item) {
         return "not a plain path (it holds whitespace, a quote or a control character)";
     if (item.startsWith("/"))
         return "absolute (a leading /) — items are relative to the workspace root";
+    if (/^[*?]+$/.test(item))
+        return "a whole wildcard (only `*` / `?` — it names no path and would leave the snapshot without any top-level entry)";
     const segments = item.split("/");
     if (segments.includes(".."))
         return "escaping the workspace (a .. segment)";

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -525,6 +525,7 @@ a moment ago. If you omit `created`, the consumer reports the weaker of the two
 | `callback_error` | a callback/hook on the device side failed (exec family) |
 | `invalid` | the arguments do not make sense for this target (e.g. `readLink` on a non-symlink) |
 | `is_directory` | a file operation hit a directory |
+| `liveness_no_output` | **you** killed the command because it produced no output for your own silence window (a hung command); the wall-clock budget `timeoutMs` running out stays `timeout`. The frame has no field for the window length — do not invent one |
 | `not_directory` | a directory operation hit a non-directory |
 | `not_found` | the path does not exist |
 | `not_supported` | you do not implement this face (prefer simply not declaring it) |
@@ -539,10 +540,16 @@ a moment ago. If you omit `created`, the consumer reports the weaker of the two
 | `transport_lost` | a transport the device itself depends on went away |
 | `unknown` | none of the above |
 
-Two codes carry load-bearing semantics upstream and must not be used loosely:
+Three codes carry load-bearing semantics upstream and must not be used loosely:
 
 - `timeout` is treated as **retryable**. Use it only when you actually killed the work and know it is
   dead. If you are not sure the command is dead, use `outcome_unknown`.
+- `liveness_no_output` is the same kind of word — the command ran, you killed it, **retryable** — with a
+  different cause: it names the silence, `timeout` names the wall-clock budget. They are two different
+  numbers and the model is told a different sentence for each, so report the bound that actually fired.
+  The same rule applies: use it only when you actually killed the work and know it is dead; if you are
+  not sure, use `outcome_unknown`. On a file instruction it is a protocol violation (a file operation has
+  no silence window) and the server reads it as `unknown`.
 - `outcome_unknown` is never auto-retried, anywhere. It is the honest answer for "the command may have
   already run and I cannot confirm". Choosing `timeout`/`transport_lost` instead invites a second
   execution of a command that already had side effects.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.131.0",
+  "version": "7.132.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -64,8 +64,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.51.2",
-    "@sema-agent/settings-schema": "13.0.1",
+    "@sema-agent/core": "7.53.0",
+    "@sema-agent/settings-schema": "14.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -80,7 +80,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "23.0.0",
+    "@sema-agent/sdk": "23.1.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",

package/scripts/drain-check-local.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * 换钉前的**排空检查 —— `DB_BACKEND=local`(File 店)车道**,只读。随 npm 包出(`scripts/drain-check-local.mjs`)。
- * 一次跑**六条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
+ * 一次跑**八条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
  * 每条判据一段、段首标记 `-- drain-check:<判据名>:<后端>`,判据名与本表的 `name` 同一个词):
  *  · `skill-grants-rollback`(**回滚**到 7.115.x 前,即引擎从 7.41 退回 7.40):四样任一 ——
  *    ① pending 行带 `state.skillGrants`(本次 run 冻结在行上的技能授予行:模型激活 / 子代捕获写下的放行与禁止);
@@ -30,6 +30,7 @@
  *    账本行的读法是服务里那一只(`src/orchestration/workflow-agent-session-index.ts` 的 `readAgentSessionLedgerLine`),经编译产物
  *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
  *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
+ *  · `parked-tool-lists`(升级到 7.132.0 前)/ `own-tool-lists-rollback`(从 7.132.0 回滚前):停驻行记下的工具名清单 / 7.52 写下的 `ownToolLists`(判据与出路见判据表那两条的注);
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -72,12 +73,15 @@
  *  · 每条命中一行:`SKILL-GRANTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skillGrants|boundGrantDigest|userInvokedSkills|disallowedTools>` / `SKILL-MANIFEST-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `SKILL-DENY-INERT-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `WORKFLOW-PARK-ROW token=<token> sessionId=<id> createdAt=<ms> runId=<点名它的 run,逗号连接>` /
+ *    `PARKED-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<toolCeiling|constraintChain|boundGrantDigest>` / `OWN-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms>` /
  *    `ALLOW-LIST-ROW token=<token> sessionId=<id> createdAt=<ms>` / `RETIRED-ROW token=<token> sessionId=<id> createdAt=<ms> member=<成员>`;
  *  · 每条判据一行末行(表序;`RETIRED-MODE-SEED` 那一行恒在最后,7.113.0 起读「最后一行」的下游不受影响;`PERMISSIONS-ALLOW-LIST` 仍是倒数第二行):
  *    `SKILL-GRANTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-SKILL-MANIFEST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `SKILL-DENY-INERT rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `WORKFLOW-PARK-HOLDER rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `PARKED-TOOL-LISTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `OWN-TOOL-LISTS-ROLLBACK rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PERMISSIONS-ALLOW-LIST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-MODE-SEED rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`;
  *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份;
@@ -427,6 +431,35 @@ export const DRAIN_CRITERIA = [
       return runs === undefined ? undefined : ` runId=${runs.join(",")}`;
     },
   },
+  {
+    // 升级到 7.132.0 之前(引擎 7.52 在认领前按规范拼写读停驻行记下的工具名清单):pending 行带这三座任一 —— 子代的工具天花板 `state.toolCeiling`(键在场且不是空数组)、
+    // 冻结的父约束链 `state.inheritedGate.constraintChain`(非空数组)、Skill 卡的清单绑定 `pendingAction.boundGrantDigest`。7.51 按原拼写记它们,7.52 读到 `Bash(*)` / `Tool()` /
+    // 读不出的名 / deny `*` ⇒ 认领前拒(409 `checkpoint.config_refused`)、名字集的重复条目 ⇒ `resume.parent_constraint_mismatch`、Skill 清单读作空的条目 ⇒ `resume_outcome_invalid`;
+    // 卡都留 pending。引擎的拼写判法没有在包根给出 ⇒ 与随包 SQL 同一个**真超集**(座在不在、非空),不是精确判;命中行点名是哪一座。出路见随包 `MIGRATION.md` 7.132.0 节。
+    // 天花板一座不要求「是数组」:引擎对在场的天花板就读,非列表的值(JSON null / 对象 / 字符串)同样认领前拒(`not_a_list`);空数组读不出条目、引擎不拒。链只认数组(引擎 `Array.isArray(chain)` 才读)。
+    name: "parked-tool-lists",
+    tail: "PARKED-TOOL-LISTS",
+    hit: "PARKED-TOOL-LISTS-ROW",
+    load: () => ({ input: undefined, corrupt: 0, unreadable: [] }),
+    judge: (row) => {
+      const state = isObject(row.state) ? /** @type {Record<string, unknown>} */ (row.state) : {};
+      const nonEmptyList = (/** @type {unknown} */ v) => Array.isArray(v) && v.length > 0;
+      const emptyList = (/** @type {unknown} */ v) => Array.isArray(v) && v.length === 0;
+      if (Object.hasOwn(state, "toolCeiling") && !emptyList(state.toolCeiling)) return " member=toolCeiling";
+      const gate = isObject(state.inheritedGate) ? /** @type {Record<string, unknown>} */ (state.inheritedGate) : {};
+      if (nonEmptyList(gate.constraintChain)) return " member=constraintChain";
+      if (isObject(row.pendingAction) && Object.hasOwn(/** @type {Record<string, unknown>} */ (row.pendingAction), "boundGrantDigest")) return " member=boundGrantDigest";
+      return undefined;
+    },
+  },
+  {
+    // 从 7.132.0 回滚到 7.131.x 之前:7.52 写下 `state.ownToolLists` 的行(读方要求词 `own_tool_lists`,7.51 读不了)。键在不在,精确。
+    name: "own-tool-lists-rollback",
+    tail: "OWN-TOOL-LISTS-ROLLBACK",
+    hit: "OWN-TOOL-LISTS-ROW",
+    load: () => ({ input: undefined, corrupt: 0, unreadable: [] }),
+    judge: (row) => (isObject(row.state) && Object.hasOwn(/** @type {Record<string, unknown>} */ (row.state), "ownToolLists") ? "" : undefined),
+  },
   {
     name: "permissions-allow-list",
     tail: "PERMISSIONS-ALLOW-LIST",

package/scripts/drain-check.mysql.sql

@@ -8,13 +8,15 @@
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。以 hit_rows 为准:这一列被会话变量 group_concat_max_len(缺省 1024 字节)截断时,列出的会话数会少于 hit_rows ——
 --              先处理列出的再跑一次,或先在同一个会话里 SET SESSION group_concat_max_len = 1048576; 再跑本文件(本文件自己只含 SELECT)。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,六条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
 --
--- 六条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 八条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
+--   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
+--   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -87,6 +89,32 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND EXISTS (SELECT 1 FROM workflow_agent_session w WHERE w.session_id = k.session_id);
 
+-- drain-check:parked-tool-lists:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:升级到 7.132.0 后续跑可能在认领前被拒的停驻行。
+-- 在**升级之前**、对 7.131.x 的数据跑。7.131.x 的引擎(7.51)把行上的三样按原拼写记下,7.132.0 的引擎(7.52)在认领前按规范拼写读它们:
+--   子代的工具天花板 state.toolCeiling(`Bash(*)` / `Tool()` / 内容形 / 读不出的名 / deny `*` ⇒ 409 checkpoint.config_refused,blockedBy = config.tool_face_control,field = inheritedGate);
+--   冻结的父约束链 state.inheritedGate.constraintChain(非规范名同上;名字集里的重复条目 ⇒ 409 resume.parent_constraint_mismatch);
+--   Skill 卡绑的两只清单 pendingAction.boundGrantDigest(清单里读作空的条目 ⇒ 409 resume_outcome_invalid,field = boundGrantDigest)。
+-- 卡都留 pending、行留停驻。SQL 读不了引擎的拼写判法 ⇒ 数的是**真超集**:带这三样任一的 pending 行 —— 天花板键在场且不是空数组(引擎对在场的天花板就读:
+-- 非列表的值〔JSON null / 对象 / 字符串〕同样认领前拒,所以不要求「是数组」;空数组读不出条目、不数),链是非空数组(引擎只读数组形的链),或卡带绑定摘要。
+-- 出路(见随包 MIGRATION.md 7.132.0 节):升级前让它们在 7.131.x 上跑完 / 决完;已经升级的,在 7.131.x 的副本上续跑,或取消那条 run 重提。
+SELECT 'parked-tool-lists' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND ((JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.state.toolCeiling')
+        AND NOT (JSON_TYPE(JSON_EXTRACT(k.checkpoint, '$.state.toolCeiling')) = 'ARRAY' AND JSON_LENGTH(JSON_EXTRACT(k.checkpoint, '$.state.toolCeiling')) = 0))
+       OR (JSON_TYPE(JSON_EXTRACT(k.checkpoint, '$.state.inheritedGate.constraintChain')) = 'ARRAY' AND JSON_LENGTH(JSON_EXTRACT(k.checkpoint, '$.state.inheritedGate.constraintChain')) > 0)
+       OR JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.pendingAction.boundGrantDigest'));
+
+-- drain-check:own-tool-lists-rollback:mysql —— 期望 hit_rows = 0;每一行 = 一条从 7.132.0 回滚到 7.131.x 后续跑会被拒的停驻行。
+-- 在**回滚之前**、对 7.132.0 的数据跑:7.132.0 的引擎在子代行上记下这条腿的工具清单是谁写的(state.ownToolLists,行上的读方要求词 own_tool_lists),
+-- 7.131.x 的引擎读不了 ⇒ 409 checkpoint.unsupported_version(writerVersion 比 readerVersion 新)、卡留 pending。判据 = 键在不在(精确)。
+SELECT 'own-tool-lists-rollback' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.state.ownToolLists');
+
 -- drain-check:permissions-allow-list:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是

package/scripts/drain-check.pg.sql

@@ -7,13 +7,15 @@
 --   hit_rows   命中的停驻行数(pending 行里算命中的那些);**全部为 0 才算排空**,非 0 ⇒ 逐条答完或取消(各判据对应的升级 / 回滚说明见随包 MIGRATION.md);
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,六条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
 --
--- 六条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 八条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
+--   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
+--   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -96,6 +98,31 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND EXISTS (SELECT 1 FROM workflow_agent_session w WHERE w.session_id = k.session_id);
 
+-- drain-check:parked-tool-lists:pg —— 期望 hit_rows = 0;每一行 = 一条**候选**:升级到 7.132.0 后续跑可能在认领前被拒的停驻行。
+-- 在**升级之前**、对 7.131.x 的数据跑。7.131.x 的引擎(7.51)把行上的三样按原拼写记下,7.132.0 的引擎(7.52)在认领前按规范拼写读它们:
+--   子代的工具天花板 state.toolCeiling(`Bash(*)` / `Tool()` / 内容形 / 读不出的名 / deny `*` ⇒ 409 checkpoint.config_refused,blockedBy = config.tool_face_control,field = inheritedGate);
+--   冻结的父约束链 state.inheritedGate.constraintChain(非规范名同上;名字集里的重复条目 ⇒ 409 resume.parent_constraint_mismatch);
+--   Skill 卡绑的两只清单 pendingAction.boundGrantDigest(清单里读作空的条目 ⇒ 409 resume_outcome_invalid,field = boundGrantDigest)。
+-- 卡都留 pending、行留停驻。SQL 读不了引擎的拼写判法 ⇒ 数的是**真超集**:带这三样任一的 pending 行 —— 天花板键在场且不是空数组(引擎对在场的天花板就读:
+-- 非列表的值〔JSON null / 对象 / 字符串〕同样认领前拒,所以不要求「是数组」;空数组读不出条目、不数),链是非空数组(引擎只读数组形的链),或卡带绑定摘要。
+-- 出路(见随包 MIGRATION.md 7.132.0 节):升级前让它们在 7.131.x 上跑完 / 决完;已经升级的,在 7.131.x 的副本上续跑,或取消那条 run 重提。
+SELECT 'parked-tool-lists' AS criterion, count(*) AS hit_rows,
+       coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND (((k.checkpoint #> '{state,toolCeiling}') IS NOT NULL AND (k.checkpoint #> '{state,toolCeiling}') <> '[]'::jsonb)
+       OR (jsonb_typeof(k.checkpoint #> '{state,inheritedGate,constraintChain}') = 'array' AND (k.checkpoint #> '{state,inheritedGate,constraintChain}') <> '[]'::jsonb)
+       OR (k.checkpoint -> 'pendingAction') ? 'boundGrantDigest');
+
+-- drain-check:own-tool-lists-rollback:pg —— 期望 hit_rows = 0;每一行 = 一条从 7.132.0 回滚到 7.131.x 后续跑会被拒的停驻行。
+-- 在**回滚之前**、对 7.132.0 的数据跑:7.132.0 的引擎在子代行上记下这条腿的工具清单是谁写的(state.ownToolLists,行上的读方要求词 own_tool_lists),
+-- 7.131.x 的引擎读不了 ⇒ 409 checkpoint.unsupported_version(writerVersion 比 readerVersion 新)、卡留 pending。判据 = 键在不在(精确)。
+SELECT 'own-tool-lists-rollback' AS criterion, count(*) AS hit_rows,
+       coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND (k.checkpoint -> 'state') ? 'ownToolLists';
+
 -- drain-check:permissions-allow-list:pg —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是

package/dist/capabilities/memory-notice.d.ts

@@ -1,138 +0,0 @@
-/**
- * [ref](板 [ref]②/[ref]④ 两次点名的 server 接线半场)—— 零记忆面部署形的**持久记忆披露**。
- *
- * 病(core [ref] 实测,[ref] 立案):一台没有任何持久记忆面的部署,用户说「请记住 X」,模型回一句
- * 「已经记住了」——落盘处并不存在。用户带着「这条事实已入库」的信念离开,下一次会话才发现是空的。
- *
- * core 5.26.0 的分工:引擎**能自证**只读的两态(engine 侧 `writeScope:null` / runner 侧 `handsReadOnly`)
- * 由引擎自动挂 `MEMORY_READONLY_NOTICE`;而「整台部署根本没有记忆面」这一形 core 只导出文本
- * (`NO_PERSISTENT_MEMORY_NOTICE`)、**不注入** —— 逐字原文:「A deployment that composes its own prompt
- * should include this block exactly when no memory face is mounted」。组装归宿主,与 `MEMORY_SAFETY`
- * 同姿势。本模块就是那半场。
- *
- * ⚠️ 两条边界,越界即双重注入/假话:
- *  · **engine 在场就不是我们的座位**。哪怕 `memoryWrite:false`(writeScope null)——那恰恰是引擎自己
- *    挂只读披露的状态,server 再叠一句口径不同的「你没有持久记忆」= 同一件事两种说法同框。
- *  · **推断到「有落盘路」就闭嘴**。判别式与 core 的 `rosterCanPersist` 同口径(已知落盘路 = 这一 run 名册上
- *    真挂着的文件写工具 / 可写 shell)。「名册上还剩什么」**只读引擎的答案**:core 7.49.0(#1623)起一 run 的可用工具是
- *    引擎一只选择器(`allowTools` ∩ … − `excludeTools`,别名 / `Tool(content)` / `mcp__srv…` 都由它读)在 prepare 算出的,
- *    本模块不再读请求的任何一张工具名表 —— 名册臂在装配时刻读 provider 拿到的 `ctx.tools`(选择器之后的名册)。
- *    负控仍然成立:必须**全部**已知落盘路都不在名册上才算断链(摘掉 `Write`,Bash / Edit 还在)。
- */
-import { type PromptProvider, type ToolCatalogEntry } from "@sema-agent/core";
-import type { ScenarioHands } from "./hands-lane.js";
-import { type ExecutionLane } from "../execution-lane-caps.js";
-/**
- * 「已知落盘路」的判据,作用在 core **静态工具目录**的一行上(S-503 / [ref])—— 与 core 自己的
- * `rosterCanPersist` 推断逐条同形,取的是同一批目录属性,不是它结论的抄件:
- *  · `mountedBy` 落在 core 的 `HANDS_BAND_TAGS` 里 —— 手带 band 之外的定义(记忆面工具、调度族)
- *    不在本判别式说得着的面上:本判别式的输入全是**手带事实**(`hands` / `handsReadOnly` / 名册上的手带名),
- *    把一只 band 外的写工具算进来,就是拿一条根本没挂的通道去撤回披露(fail-open);
- *  · `face.effect !== "read"`(缺席读 `write`,与 core 同缺省)—— 只读 shell 壳在这里出局,它与全壳
- *    共用 `Bash` 这个 wire 名,靠的正是这一位分开;
- *  · `face.pathTarget.access !== "read"`(文件写工具)**或** `face.family === "shell"`(可写 shell)。
- *
- * 🔴 这条析取式**不是** effect=write 的全集:core 逐字裁过「a generic write-effect tool does NOT count
- * — a mail sender's side effect is not a memory store」。`TaskStop` 正是那种(effect=write、没有路径
- * 目标、不是 shell),它在这条判据下自己就出局 —— 改前那张手抄名单要靠人记得别把它写进去。
- *
- * 一条都派生不出来 ⇒ **抛**(不是回一个空集):空集会让下面那条判据读成「一条落盘路都不剩」⇒ 每台
- * 有手的机器都开始披露「本部署没有持久记忆」,而那句话在那时是假的。目录换形是提货期事实(静态数据,
- * 与请求/环境无关:要么恒抛要么恒不抛),所以这一抛是**提货门**,不是运行期风险。
- */
-export declare function persistencePathToolNamesOf(entries: readonly ToolCatalogEntry[]): readonly string[];
-/**
- * 「已知落盘路」的工具名闭集 —— **由 core 的静态工具目录派生**,本仓不再存第二份名表
- * (S-503 / [ref];改前是手抄的四名表 Write / Edit / NotebookEdit / Bash,没有任何差集门)。
- *
- * 为什么手抄在这一位上特别危险:core 改名/加一只写工具,手抄表静默失配(fail-open 方向)—— 名册上真正的
- * 落盘路已经全不在了,而我们对着一张旧名单答「还剩」。
- * 判据的属主现在是 {@link persistencePathToolNamesOf},值的属主是 core 的目录行。
- */
-export declare const KNOWN_PERSISTENCE_TOOL_NAMES: readonly string[];
-/** 披露段在 `prompt.assembled` 清单里的段 id(`core/` 命名空间是 core 保留的,部署段一律自家前缀)。 */
-export declare const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
-/** 判别式的全部输入 —— 每一位都是**部署/装配期事实**,没有一位来自请求体的自我表态。 */
-export interface MemoryFaceFacts {
-    /** 这一腿挂不挂记忆面 —— 由唯一属主 `memory-scope.ts` `memoryFaceMounted(spec.memory)` 算出(与 core `prepareMemory`
-     *  同判:`normalizeMemorySpec(...)?.enabled === true`)。`false` = 引擎未接 / 多租户 dark / remote lane fail-closed /
-     *  S-405 `memory:"off"`(键在场但 `enabled:false`)—— 殊途同归:core 不会 prepare 记忆,也就不会挂任何披露。
-     *  🔴 不再收 `TaskSpec.memory` 本体:按「键在不在场」判是 7.84.0 前的病(合并复审 车HF F1)。
-     *  🔴 属主会**抛**(值闭包门没过的手搓 spec —— 单数 `scope` / 非 `"off"` 的 `capture`),理由与两个属主
-     *  的坐标逐字写在 `memory-scope.ts` 的 `memoryFaceMounted` 头注里;本判别式不接这条臂(接了就是在
-     *  披露轴上静默 fail-open)。 */
-    memoryFaceMounted: boolean;
-    /** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。`true` = operator 自证有推断看不见的持久通道
-     *  (自定义 writer / MCP 记忆服务)⇒ 披露会变成假话,撤回;`false` = 强制披露;缺席 ⇒ 走推断。 */
-    declaredCapable: boolean | undefined;
-    /** 本请求命中场景的手带表态([ref] 判别位)。`none` = 该场景跑在不挂 `executionEnvFactory` 的 Runner 上,
-     *  core 的手带 band(Bash/Edit/Write/…)整批不 mount。 */
-    hands: ScenarioHands;
-    /** 折完 governance+settings 后的最终 `handsReadOnly`(`AUTONOMY=read-only` 收窄;plan 模式不点亮它 —— plan 的手带照挂、调用时由引擎问)。手带只剩读腿。 */
-    handsReadOnly: boolean;
-    /**
-     * 本部署的手带**挂没挂**(= core 拿没拿到执行环境;能力表 `coreRemoteExecutionEnv` 位,经
-     * {@link buildNoticeLaneFacts} 取)。`false` = `in-process`:core 落 `StubExecutionEnv`,手带整族不 mount
-     * ⇒ **一条落盘路都没有**,不管名册上写着什么名字。
-     * 🔴 S-602(clay 裁 [ref] A):改前这里只有一位 `remoteExecutionEnv`(判别位 = `REMOTE_EXEC` 设没设),
-     * 于是 in-process 读成「不是 remote ⇒ 手就在本机 fs 上 ⇒ 已知落盘路真的在」—— 而那条 lane 根本没有手,
-     * 用户说「记住 X」拿到的是无处落盘的幻觉回执([ref] 要消灭的原形)。一位拆成两位,各答各的问题。
-     */
-    handsWired: boolean;
-    /**
-     * 手带的文件平面**不在**本 worker(能力表 `hostFilePlane` 答否;经 {@link buildNoticeLaneFacts} 取)——
-     * 沙箱 / 远端 / 设备车道。为什么这一位必须进判别式(codex 复审 round2 [high],已核真):core 的
-     * `rosterCanPersist` 在沙箱盘上把 Write/Edit/NotebookEdit/Bash **全部不算**落盘路(每任务即焚,够不着
-     * host 记忆根)。而 server 在任何 remote 车道上默认让记忆引擎 dark —— 两件事合起来正是**最常见的云部署形**:
-     * 引擎不在、手带在,却一份持久面都没有。
-     * ⚠️ `host` 车道这一位是 `false`(文件平面就是本机);core 自己仍把 host 判 remote,那一面由装配层的
-     * `effectiveMemoryPersistenceCapable`(host 腿自动声明 capable)在臂② 接住,不归本位。
-     */
-    filePlaneRemote: boolean;
-}
-/**
- * S-602 —— 判别式的两位**车道事实**,由能力表派生([ref]:不手抄投影)。resolve-spec 的装配点只调它,
- * 不在调用点手写 `config.remoteExec !== undefined`(门 D R4)。
- */
-export declare function buildNoticeLaneFacts(lane: ExecutionLane): Pick<MemoryFaceFacts, "handsWired" | "filePlaneRemote">;
-/**
- * 披露的三种结局。`"roster"` = 部署事实答不完,剩下的问题(「名册上还剩不剩已知落盘路」)只有引擎在 prepare
- * 之后知道 —— 由 {@link withNoPersistentMemoryNotice} 在装配时刻读 provider 拿到的名册作答,不在 resolveSpec 期猜。
- */
-export type NoPersistentMemoryNotice = "disclose" | "silent" | "roster";
-/**
- * 该不该把 `NO_PERSISTENT_MEMORY_NOTICE` 组进本次任务的 system prompt。
- *
- * 优先序(每一条都有独立理由,不是同一条判据的三种写法):
- *  ① engine 在场 ⇒ `silent`(引擎的座位,见文件头注);
- *  ② 部署显式声明(或 host 腿装配层自动声明)⇒ 声明说了算(`true` ⇒ `silent` / `false` ⇒ `disclose`)—— operator 的部署
- *     事实压过我们的推断,与 core 对 `memoryPersistenceCapable` 的处置同向;
- *  ③ 否则推断:手带没挂 / 场景摘手 / 只读 / 文件平面不在本机 ⇒ `disclose`;都不是 ⇒ `roster`(名册上还剩不剩已知落盘路,
- *     读引擎选择器之后的名册 —— 本模块不读请求的任何工具名表,core 7.49.0 #1623 起那是引擎一只运算的输入)。
- * 🔴 S-602 只改臂③ 里「车道」那一段(`handsWired` / `filePlaneRemote`),①② 的优先序一字不动 —— 「in-process ⇒
- * 披露」只在这两臂**之后**成立(挂了记忆面、或声明了 capable 的 in-process 部署照旧不披露)。
- */
-export declare function noPersistentMemoryNotice(facts: MemoryFaceFacts): NoPersistentMemoryNotice;
-/**
- * 名册臂:引擎选择器之后的名册上还剩不剩已知落盘路(`KNOWN_PERSISTENCE_TOOL_NAMES` 任一名在册)。⚠️ 负控:摘掉**一个**
- * `Write` 不算断链(Bash / Edit 还在)—— 必须**全部**已知落盘路都不在名册上。名册为空(`excludeAllTools`)⇒ 一条都不剩。
- */
-export declare function rosterLeavesPersistencePath(tools: readonly {
-    readonly name: string;
-}[]): boolean;
-/**
- * 把披露段组进一个 prompt provider,**按 provider 自己的钩子形分腿**(换形会改段身份与 append 座位):
- *  · typed(`stableBlocks`)⇒ {@link mountNotice}(普通形追加 behavior 声明;已组装 identity 形接在其文本后)。
- *  · string(`stableSystem`)⇒ 接在 role 层文本之后(落进 `core/role.base` 段)。
- *  · 两个钩子都没有(= core 会用 `defaultPromptProvider`)⇒ **只发一条 typed 声明**,role 层留给 core 自己铸。
- *
- * ⚠️ 最后一腿为什么不是「自铸 role 层」(2026-08-12 复扫 medium,已实测):自铸形
- * `stableSystem: (ctx) => ${ctx.userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT}\n\n${段落}` 把**调用方的**
- * systemPrompt 逐字变成了 provider 的输出。调用方传一份已组装 prompt(集成方/center 的常见形)时,装配器的
- * 迁移卫就在 provider 输出上探到三锚 ⇒ pass-through 臂 ⇒ 保留集无 `core/role.append` ⇒ 已被 append 门放行的
- * `appendSystemPrompt`/`settings.outputStyle` 静默蒸发(门在包装**之前**按未包装的 provider 判,两边分家)。
- * 走 typed 声明腿就没有这条耦合:role 层仍由 core 按 `userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT` 自己铸,
- * 我方只贡献一条 behavior 段,`providerDropsAppend` 的判决包装前后逐格相同。
- */
-export declare function withNoPersistentMemoryNotice(provider: PromptProvider | undefined, when: Exclude<NoPersistentMemoryNotice, "silent">): PromptProvider;
-//# sourceMappingURL=memory-notice.d.ts.map

package/dist/capabilities/memory-notice.js

@@ -1,64 +0,0 @@
-import { describeToolCatalog, HANDS_BAND_TAGS, NO_PERSISTENT_MEMORY_NOTICE } from "@sema-agent/core";
-import { hasConstitutionAnchors } from "../task-settings.js";
-import { executionLaneCaps } from "../execution-lane-caps.js";
-export function persistencePathToolNamesOf(entries) {
-    const names = new Set();
-    for (const e of entries) {
-        if (!e.mountedBy.some((tag) => HANDS_BAND_TAGS.has(tag)))
-            continue;
-        if ((e.face.effect ?? "write") === "read")
-            continue;
-        const pt = e.face.pathTarget;
-        if (!((pt !== undefined && pt.access !== "read") || e.face.family === "shell"))
-            continue;
-        names.add(e.name);
-    }
-    if (names.size === 0) {
-        throw new Error("core tool catalog yields no hand-band persistence path (file-write target or writable shell) — " +
-            "the #148 disclosure would start claiming 'no persistent memory' on every machine that HAS hands. " +
-            "Re-read core's rosterCanPersist inference and re-derive persistencePathToolNamesOf.");
-    }
-    return Object.freeze([...names]);
-}
-export const KNOWN_PERSISTENCE_TOOL_NAMES = persistencePathToolNamesOf(describeToolCatalog());
-export const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
-export function buildNoticeLaneFacts(lane) {
-    const caps = executionLaneCaps(lane);
-    return { handsWired: caps.coreRemoteExecutionEnv === "supported", filePlaneRemote: caps.hostFilePlane !== "supported" };
-}
-export function noPersistentMemoryNotice(facts) {
-    if (facts.memoryFaceMounted)
-        return "silent";
-    if (facts.declaredCapable !== undefined)
-        return facts.declaredCapable ? "silent" : "disclose";
-    if (facts.hands === "none" || facts.handsReadOnly)
-        return "disclose";
-    if (!facts.handsWired)
-        return "disclose";
-    if (facts.filePlaneRemote)
-        return "disclose";
-    return "roster";
-}
-export function rosterLeavesPersistencePath(tools) {
-    return tools.some((t) => KNOWN_PERSISTENCE_TOOL_NAMES.includes(t.name));
-}
-const NOTICE_BLOCK = { id: NO_PERSISTENT_MEMORY_SECTION_ID, slot: "behavior", text: NO_PERSISTENT_MEMORY_NOTICE };
-function mountNotice(decls) {
-    const assembledIdentity = decls.find((d) => d.slot === "identity" && hasConstitutionAnchors(d.text));
-    if (!assembledIdentity)
-        return [...decls, NOTICE_BLOCK];
-    return decls.map((d) => (d === assembledIdentity ? { id: d.id, slot: d.slot, text: `${d.text}\n\n${NO_PERSISTENT_MEMORY_NOTICE}` } : d));
-}
-export function withNoPersistentMemoryNotice(provider, when) {
-    const due = (ctx) => when === "disclose" || !rosterLeavesPersistencePath(ctx.tools);
-    if (provider?.stableBlocks) {
-        const blocks = provider.stableBlocks.bind(provider);
-        return { ...provider, stableBlocks: (ctx) => (due(ctx) ? mountNotice(blocks(ctx)) : blocks(ctx)) };
-    }
-    if (provider?.stableSystem) {
-        const stable = provider.stableSystem.bind(provider);
-        return { ...provider, stableSystem: (ctx) => (due(ctx) ? `${stable(ctx)}\n\n${NO_PERSISTENT_MEMORY_NOTICE}` : stable(ctx)) };
-    }
-    return { stableBlocks: (ctx) => (due(ctx) ? [NOTICE_BLOCK] : []) };
-}
-//# sourceMappingURL=memory-notice.js.map