@sema-agent/server 7.131.0 → 7.132.0

package/dist/config-catalog.js

@@ -164,7 +164,7 @@ export const CONFIG_CATALOG = [
     r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
     r("GIT_API_KIND", "integrations", "enum", "Git host API 方言", { enumValues: ["gitea", "github"], staticDefault: "gitea", configKey: "gitApiKind" }),
     r("GIT_API_TOKEN", "integrations", "secret", "repo 工具的 Git host 凭据", { danger: SEC }),
-    r("HOOKS_TIMEOUT_MS", "orchestration", "number", "每只 hook 席位单次调用时限(ms;0=立即到期是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自默认 600s" }),
+    r("HOOKS_TIMEOUT_MS", "orchestration", "number", "请求 settings.hooks 注册每个 handler 的时间预算(ms;0=零预算是合法值)", { derivedDefaultNote: "缺席 ⇒ 不铸键,读法 settingsHooksBudgetMs 取 600000" }),
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
@@ -225,7 +225,7 @@ export const CONFIG_CATALOG = [
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
     r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in —— 本版 e2b / k8s 执行环境不实现绑定读,开了也不挂(起服一行 lsp_not_mounted);host 腿另有 LSP_HOST_ENABLED", { staticDefault: "false", configKey: "lspEnabled" }),
-    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
+    r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)/ 点名本服务自有凭据名(剥后放回会把引擎刚扣下的凭据交回去;判官 = 引擎拒白名单的同一只)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
     r("LSP_HOST_ENABLED", "orchestration", "boolean", "LSP host 腿开关(本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
     r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启;S-877 起 classify 退役 = 拒启指路)", { danger: SEC, enumValues: ["always", "off"], echoWords: ["always"], resolve: (c) => c.manualModeShellGate ?? null, derivedDefaultNote: "off/未设 ⇒ 本键不贡献任何东西(归一成键缺席)⇒ 回显 null;真姿态只有 always 一个(core 7.34.0 起形状档在每一种模式下都装,classify 不再是运维选的档)" }),
     r("MAX_PRINCIPAL_COST_USD", "limitsHttp", "number", "per-principal 窗内成本天花板(0=关)", { staticDefault: "0", danger: BILL, configKey: "maxPrincipalCostUsd", center: cLimits("maxPrincipalCostUsd") }),
@@ -384,7 +384,7 @@ export const CONFIG_CATALOG = [
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
-    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。local-docker / ssh 车道在每只执行环境开起来时与它的 $HOME 对证,不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒;泄内容的递归读全 shell 面真人问、只读面拒;起服 warn execution_lane_home_undeclared)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
@@ -449,7 +449,7 @@ export const CONFIG_CATALOG = [
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
     r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
-    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 内建默认帽;pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
+    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 库报的单行上限与 max_allowed_packet ÷ 2 取小(两堵墙各自读不到时按该库族文档缺省);pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
     r("SSH_HOST", "orchestration", "string", "ssh 车道目标主机(必需件)"),
     r("SSH_HOST_FINGERPRINT", "orchestration", "string", "主机密钥指纹校验(坏值拒启;仅 ssh 车道被选中时求值)", { danger: SEC }),
     r("SSH_KNOWN_HOSTS", "orchestration", "path", "known_hosts 路径(坏路径拒启)", { danger: SEC }),
@@ -499,12 +499,12 @@ export const CONFIG_CATALOG = [
     r("WORKFLOW_SIZE_GUIDELINE", "orchestration", "enum", "Workflow 工具卡的规模建议(advisory;typo 拒启)", { enumValues: ["small", "medium", "large", "unrestricted"], configKey: "workflowSizeGuideline" }),
     r("WORKFLOW_TOTAL_TIMEOUT_MS", "orchestration", "number", "workflow 脚本总时限(ms;0/负不是禁用 —— 无禁用臂)", { staticDefault: "3600000" }),
     r("WORKSPACE_CACHE", "orchestration", "enum", "k8s 按工作区空间的构建缓存卷:volume = 每个空间(会话住客)一只 PVC(ws-cache-<摘要>,标签 sema.space,StorageClass 用集群缺省),挂到 WORKSPACE_CACHE_MOUNT,并在 pod env 注入工具缓存闭表(GRADLE_USER_HOME / MAVEN_OPTS / npm_config_cache / PIP_CACHE_DIR / UV_CACHE_DIR / GOMODCACHE;Rust 依赖缓存不盖 —— Cargo 没有只放下载缓存的 env;K8S_SANDBOX_ENV 同名显式值胜);卷在快照之外、可丢,pod 删卷留;卷拿不到(建不成 / 快照时限内没绑定)⇒ run 照起、无卷无缓存 env,fail-open 计数 + 一行 workspace_cache_unavailable;off = 不建卷。前提:会话店读得出会话住客(内存会话店 × volume ⇒ 拒启);委派子代不挂卷;词表外拒启", { enumValues: WORKSPACE_CACHE_WORDS, staticDefault: WORKSPACE_CACHE_DEFAULT }),
-    r("WORKSPACE_CACHE_MOUNT", "orchestration", "path", "k8s 构建缓存卷在沙箱 pod 里的挂载点(绝对路径;与工作区挂载 K8S_MOUNT_PATH 相同 / 互相嵌套 ⇒ 拒启;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_MOUNT_DEFAULT }),
+    r("WORKSPACE_CACHE_MOUNT", "orchestration", "path", "k8s 构建缓存卷在沙箱 pod 里的挂载点(绝对路径;与工作区挂载 K8S_MOUNT_PATH 相同 / 互相嵌套 ⇒ 拒启;落在保留的镜像目录闭集上 / 之下 / 之上 ⇒ 拒启并点名那一项 —— /bin /boot /dev /etc /home/sandbox /lib /lib64 /opt/sema /proc /root /run /sbin /sys /tmp /usr /var;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_MOUNT_DEFAULT }),
     r("WORKSPACE_CACHE_SIZE", "orchestration", "string", "k8s 构建缓存卷的大小(PVC 申请量,k8s quantity 形如 20Gi / 500Mi;形不合拒启;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_SIZE_DEFAULT }),
     r("WORKSPACE_FILE_MAX_BYTES", "limitsHttp", "number", "已随 workspace 浏览面退役(S-15):值照常校验/落值,应用于空(重启也不生效)", { envTiming: "inert", configKey: "workspaceFileMaxBytes", center: cLimits("workspaceFileMaxBytes", { timing: "inert" }) }),
     r("WORKSPACE_PERSIST", "orchestration", "enum", "k8s 工作区跨轮保留:space(缺省)= 每条 run 结束把 /workspace 快照进本会话住客的空间、下一条 run 开始恢复最近一份(上一条还在保存 ⇒ 下一条等它存完,最多等一个上传时限,见 USAGE §9.3b);off = 每轮新建。space(含缺省)却没配快照存储(MINIO_* 三键)⇒ 不生效,起服一行 workspace_persist_unavailable 点名缺键;前提:会话店读得出会话住客(local / SQL 会话店),内存会话店 × space(含缺省,且配了快照存储)⇒ 拒启(出路 WORKSPACE_PERSIST=off);词表外拒启", { enumValues: WORKSPACE_PERSIST_WORDS, staticDefault: WORKSPACE_PERSIST_DEFAULT, danger: DATA }),
     r("WORKSPACE_SNAPSHOT_BUCKET", "orchestration", "string", "k8s 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
-    r("WORKSPACE_SNAPSHOT_EXCLUDE", "orchestration", "csv", "k8s 工作区快照的排除表(相对工作区根的 tar 排除模式,逗号分隔,如 build,.gradle,node_modules/.cache;每项一个 --exclude=./<项>,run 末快照与停驻挂起同一张表 —— 排除的目录恢复后不在,构建产物本就可再生;项形闭:相对路径段,不含 .. / 前导 / / 空白 / 引号,坏项拒启并点名第几项;不读项目 .gitignore)", { derivedDefaultNote: "缺席 = 不排除(上传命令与旧版逐字同)" }),
+    r("WORKSPACE_SNAPSHOT_EXCLUDE", "orchestration", "csv", "k8s 工作区快照的排除表(相对工作区根的 tar 排除模式,逗号分隔,如 build,.gradle,node_modules/.cache;每项一个 --exclude=./<项>,run 末快照与停驻挂起同一张表 —— 排除的目录恢复后不在,构建产物本就可再生;项形闭:相对路径段,不含 .. / 前导 / / 空白 / 引号,整体通配(只由 * / ? 组成的项,* 会让快照一个顶层项都不剩)也拒,坏项拒启并点名第几项;不读项目 .gitignore)", { derivedDefaultNote: "缺席 = 不排除(上传命令与旧版逐字同)" }),
     r("WORKSPACE_SNAPSHOT_KEEP", "orchestration", "number", `k8s 工作区每个空间(会话住客)保留的快照份数(整数 [${WORKSPACE_SNAPSHOT_KEEP_RANGE.min}, ${WORKSPACE_SNAPSHOT_KEEP_RANGE.max}];写新快照后删最老的;域外拒启)`, { staticDefault: String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), danger: DATA }),
     r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀"),
     r("WORKSPACE_SNAPSHOT_TIMEOUT_MS", "orchestration", "number", `k8s 工作区快照的时限(毫秒,整数 [${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min}, ${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max}];域外拒启):一个数管四处 —— run 末上传与连沙箱时恢复的墙钟上界、空间结束时回收座一次调用的绝对截止(卷与对象都在内)、下一条 run 等上一条存完的最长等待(提交围栏的存活上界);大文件读写的墙钟也是它。大工作区(构建目录 GB 级)撞上界 ⇒ 调大它或配 WORKSPACE_SNAPSHOT_EXCLUDE`, { staticDefault: String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT) }),

package/dist/config-lkg.d.ts

@@ -1,8 +1,8 @@
 import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
-import type { PromptsDomainFaces } from "./prompts-domain-validate.js";
-/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(4 = 载荷是 settings-schema 11 的形)。 */
+import type { PublishedPromptArtifact } from "@sema-agent/core";
+/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
 export interface PersistedLkg {
-    formatVersion: 4;
+    formatVersion: 5;
     savedAt: string;
     worker: string;
     /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
@@ -48,10 +48,10 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
-/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 4 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
- *  (2 → 3 那一步,{@link migrateV2Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 5 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
+ *  (2 → 3 那一步 {@link migrateV2Lkg} / 4 → 5 那一步 {@link migrateV4Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
 export interface LkgReadMigration {
-    readonly fromFormat: 2 | 3 | 4;
+    readonly fromFormat: 2 | 3 | 4 | 5;
     readonly note?: string;
     readonly receipts: readonly MigrationReceipt[];
 }
@@ -59,12 +59,12 @@ export interface LkgReadMigration {
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
  * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移(信封 2 → 3 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 4 写回原位。
- * `prompts`:候选判官对这份载荷 prompts 面交出的已判形值(`undefined` = 载荷不带 prompts 键)—— 调用方采纳 prompts 直接用它。
+ * `migrated`:读回时做过一次性迁移(信封 2 → 3 / 4 → 5 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 5 写回原位。
+ * `prompts`:候选判官对这份载荷 prompts 面交出的中心层(引擎 verify 过的发布形 artifact;`undefined` = 载荷不带 prompts 键)—— 调用方采纳直接用它。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
-    prompts: PromptsDomainFaces | undefined;
+    prompts: PublishedPromptArtifact | undefined;
     migrated?: LkgReadMigration;
 } | {
     lkg?: undefined;

package/dist/config-lkg.js

@@ -27,7 +27,7 @@ export function lkgReadDenyRows(configLkgPath) {
     return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 4, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 5, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -54,7 +54,7 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4)
+    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4 && formatVersion !== 5)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
@@ -71,14 +71,20 @@ export async function loadLkg(path, worker, identity) {
         envelope = v2.lkg;
         note = v2.migrated;
     }
+    if (formatVersion !== 5) {
+        const v4 = migrateV4Lkg(envelope, formatVersion);
+        if (v4.lkg === undefined)
+            return v4;
+        note = note === undefined ? v4.migrated : `${note}; ${v4.migrated}`;
+    }
     const payload = migrateLkgPayload(envelope.effective);
     if ("refused" in payload)
         return { reason: payload.refused };
     const judged = lkgPayloadJudged(payload.effective, envelope.etag);
     if ("problem" in judged)
         return { reason: judged.problem };
-    const lkg = { ...envelope, formatVersion: 4, effective: payload.effective };
-    const migrated = formatVersion !== 4 || payload.receipts.length > 0;
+    const lkg = { ...envelope, formatVersion: 5, effective: payload.effective };
+    const migrated = formatVersion !== 5 || payload.receipts.length > 0;
     return migrated ? { lkg, prompts: judged.prompts, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg, prompts: judged.prompts };
 }
 export function migrateLkgPayload(effective) {
@@ -93,6 +99,16 @@ export function migrateLkgPayload(effective) {
     }
     return { effective: m.effective, receipts: m.receipts };
 }
+function migrateV4Lkg(lkg, fromFormat) {
+    if (Object.hasOwn(lkg.effective, "prompts")) {
+        return {
+            reason: `formatVersion ${fromFormat} LKG carries a prompts face` +
+                " — written before 7.132.0, so it is the retired two-axis wire (declarations / v1 catalog) the engine no longer reads; not read back: " +
+                "the center's next candidate (republished as {schemaVersion: 2, artifact}) rewrites it",
+        };
+    }
+    return { lkg, migrated: `formatVersion ${fromFormat} → 5 (one-time): the payload carries no prompts face, read back unchanged` };
+}
 const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
 function migrateDroppedIdentityRow(row) {
     if (row === null || typeof row !== "object")

package/dist/config-provider.d.ts

@@ -1,4 +1,4 @@
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./web-admin-client/read-warnings.js";
+import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
@@ -28,6 +28,7 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** `retiredDomains`(S-1456):带事实的退役域文档(契约包的墓碑)—— 读腿不抛,交成发现,候选判官以成因 `retired_domain` 整拒这份候选(与域判形失败
  *  同一条回落链、同一行拒判);缺席 = 没有。远端腿:那一键不进 effective、其余域照读;本地腿:契约读腿在读便携域之前就拒,交出的候选只有版本
  *  (这棵树的内容版本,哈希含退役文件 ⇒ 改 / 删它版本即变),内容是空的 effective(被整拒,不会被应用)。 */
+/** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -37,6 +38,7 @@ export type FetchEffectiveResult = {
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
+    unreadKeys?: UnreadConfigKey[];
     retiredDomains?: RetiredDomainFinding[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { danglingRefs, emptyEffective, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
+import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
@@ -120,6 +120,7 @@ export class LocalConfigProvider {
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         this.#servedSkills = eff.skills;
+        const unreadKeys = localUnreadPromptKeys(eff.prompts);
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
             etag: tag,
@@ -127,6 +128,7 @@ export class LocalConfigProvider {
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
             ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
+            ...(unreadKeys.length > 0 ? { unreadKeys } : {}),
             ...(retired !== undefined ? { retiredDomains: [retired] } : {}),
         };
     }
@@ -134,6 +136,14 @@ export class LocalConfigProvider {
         return findSkillContent(this.#servedSkills, contentHash);
     }
 }
+function localUnreadPromptKeys(prompts) {
+    const names = prompts?.workers === undefined ? [] : Object.keys(prompts.workers);
+    return names.length === 0 ? [] : [{ file: "prompts.json", domain: "prompts", key: "workers", names }];
+}
+function localPromptsWire(prompts, version) {
+    const artifact = prompts === undefined ? undefined : promptArtifactFor(prompts, null);
+    return artifact === undefined ? {} : { prompts: { schemaVersion: 2, artifact: { ...artifact, sourceRevision: `local:r${version}` } } };
+}
 export function mapToServiceEffective(eff, version) {
     return {
         version,
@@ -216,9 +226,7 @@ export function mapToServiceEffective(eff, version) {
                 };
             }),
         },
-        ...(eff.prompts?.catalog !== undefined
-            ? { prompts: { schemaVersion: 1, catalog: eff.prompts.catalog } }
-            : {}),
+        ...localPromptsWire(eff.prompts, version),
         scenarios: {
             scenarios: (eff.scenarios.scenarios ?? []).map((sc) => ({
                 name: sc.name,

package/dist/config-types.d.ts

@@ -1107,9 +1107,9 @@ export interface ServiceConfigFlat {
         keyPrefix?: string;
         presignTtlSec?: number;
     };
-    /** (a)(clay 拍 a+c,2026-07-27)SQL 默认店的 per-blob 帽显式覆写(字节)。未设 ⇒ SqlBlobBackend
-     *  的方言默认(tidb=6MiB=TiDB 默认 txn-entry-size-limit 真库实测矮墙,pg=不设帽);设了 ⇒ 两方言
-     *  都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
+    /** (a)(clay 拍 a+c,2026-07-27)SQL 默认店的 per-blob 帽显式覆写(字节)。未设 ⇒ `sqlBlobDefaultCapBytes`
+     *  的方言默认(MySQL 协议 = 库报的单行上限与包墙 `max_allowed_packet` ÷ 2 取小;事实还没建立 6MiB = TiDB 默认 txn-entry-size-limit;
+     *  pg=不设帽);设了 ⇒ 两方言都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
     snapshotBlobSqlMaxBytes?: number;
     /** (c) 的显式逃生口:云形(mysql|pg 后端)缺 MinIO 本应 boot fail-loud(bytes-in-DB 撞包墙已两役
      *  实证,大字节归对象存储);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` 显式接受 SQL 店 + (a) 的帽
@@ -1526,14 +1526,12 @@ export interface ServiceConfigFlat {
      *  tools for a declared `plan` itself, and no plan entry clamps the hands (only `AUTONOMY=read-only` does). */
     planModeEnabled: boolean;
     /**
-     * [ref]⑥(core 5.56 `Hooks.timeoutMs` 座)—— **每一只 hook 席位单次调用的时间上限**(ms)。
-     * `HOOKS_TIMEOUT_MS`;**缺席 = 不铸键**,由 core 自默认(600s = CC 自己的数;server 不复制上游默认)。
+     * `HOOKS_TIMEOUT_MS` —— 请求 `settings.hooks` 那张 mods 注册(`settings.hooks`)每个 handler 的时间预算(ms;一个事件跑一遍本请求的钩子条目)。
+     * **缺席 = 不铸键**;唯一读法 = `hooks/hook-runner.ts` 的 `settingsHooksBudgetMs`(未设 ⇒ 600000,本服务跑钩子子进程的界)。
      *
-     * 🔴 `0` 是有效值(core 契约逐字:写下零的部署说了一件事 —— 每个席位立即到期),不是「未设」;
+     * 🔴 `0` 是有效值(引擎按字面:零预算,下一个定时器拍就到期),不是「未设」;
      * 坏值(非整数 / 负 / 超 `setTimeout` 32 位上限)**拒启**,解析见 config.ts `parseHooksTimeoutEnv`。
-     * 施加点 = `main.ts` 的 `deploymentHooks`(server 车道)与 `run-local.ts` 的同名记录(CLI 本地车道,
-     * merge-rescan 745 补折:该腿今日仅同步计数器席位、折上为防倒退)。server 车道一处施加两条腿同时
-     * 生效:既是 `RunnerDeps.hooks`,又是 `resolve-spec` 折进 task hooks 的部署基线。
+     * 部署座的两张观察注册(拒绝计量 / 工具追踪)不读它(同步返回,用引擎缺省)。
      */
     hooksTimeoutMs?: number;
     /** SVC-2 (adversarial-review): the workflow_journal GC retention — the reaper purges journal rows older than

package/dist/config.js

@@ -3,7 +3,7 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -29,7 +29,7 @@ import { lkgPathOverrideOf } from "./config-lkg.js";
 import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
 import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
-import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
+import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
@@ -467,6 +467,12 @@ function parseNameListEnv(name, raw, opts) {
 }
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
+function ownCredentialPutBackProblem(name) {
+    const engine = inheritEnvPolicyProblem([name]);
+    return engine === undefined
+        ? undefined
+        : `this deployment's own credential — a put-back list hands the named variable back, as written, to the child the engine withheld it from (the engine refuses it on any allow list: ${engine})`;
+}
 export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
     const raw = process.env[knob];
     if (raw === undefined || raw === "")
@@ -480,7 +486,9 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
                 : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
                     ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
-                    : undefined;
+                    : spec.channel === "host-put-back"
+                        ? ownCredentialPutBackProblem(seg)
+                        : undefined;
         if (problem === undefined)
             return;
         throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
@@ -684,7 +692,7 @@ function parseHooksTimeoutEnv() {
         return undefined;
     const n = parseNumOrFail("HOOKS_TIMEOUT_MS", raw);
     if (!Number.isInteger(n) || n < 0 || n > 2147483647) {
-        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = every hook seat expires immediately; unset = core's own default)`);
+        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = a zero budget for every request-hook handler; unset = 600000)`);
     }
     return n;
 }
@@ -2461,6 +2469,11 @@ function k8sWorkspaceCache() {
         throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} overlaps the workspace mount ${workspace} (K8S_MOUNT_PATH) — the cache volume must sit OUTSIDE the workspace ` +
             "(the workspace is snapshotted between runs, the cache is not); pick a separate absolute path such as /cache");
     }
+    const reserved = reservedMountCollision(mount);
+    if (reserved !== undefined) {
+        throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} collides with the reserved image directory ${reserved} (a volume at, under or above it hides what the sandbox image keeps there) — ` +
+            `pick a separate absolute path such as /cache; reserved: ${WORKSPACE_CACHE_MOUNT_RESERVED.join(" ")}`);
+    }
     return { mount, size };
 }
 export function loadConfig() {

package/dist/device-ws-protocol.d.ts

@@ -62,7 +62,7 @@ export declare function asInstructionKind(v: string): DeviceInstructionKind | nu
  * 结果帧的错误码闭集 = core 的 `FileErrorCode ∪ ExecutionErrorCode`(§5.1「error code 全闭集」:
  * 未知值映射为协议错误而非透传 string)。`satisfies` 保证这里没有 core 不认识的词。
  */
-export declare const DEVICE_OUTCOME_ERROR_CODES: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
+export declare const DEVICE_OUTCOME_ERROR_CODES: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "liveness_no_output", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
 export type DeviceOutcomeErrorCode = (typeof DEVICE_OUTCOME_ERROR_CODES)[number];
 /**
  * **编译期**对账的另一半:core 往 `FileErrorCode`/`ExecutionErrorCode` 加一个词而本表没跟 ⇒ `Exclude`

package/dist/device-ws-protocol.js

@@ -49,6 +49,7 @@ export const DEVICE_OUTCOME_ERROR_CODES = [
     "callback_error",
     "invalid",
     "is_directory",
+    "liveness_no_output",
     "not_directory",
     "not_found",
     "not_supported",

package/dist/env-name-allowlist-knobs.d.ts

@@ -10,6 +10,12 @@
  *      带外凭据(e2b / docker / k8s 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
  *  · `BAKE_ENV_ALLOW`(S-684 残余,7.103.0)由 **bake-runner 进程**读(构建宿主守护进程:没有主体、没有租户 ⇒ 没有姿态列,
  *    不进 {@link describeAllowlistPostures} 的姿态句)。它与服务侧四只旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
+ *  · `channel` = 这张名单**交给谁、在谁的减法之上**(闭集两词,解析器按它定「不许点哪些名」):
+ *    - `host-put-back`(`LSP_ENV_ALLOW` / `BAKE_ENV_ALLOW`)—— 剥后放回形:宿主子进程的 env 先经唯一组合(引擎扣掉本服务自有凭据 + 形状剥),
+ *      名单点到的键再从本进程环境**原样**取回叠上去。点到本服务自有凭据名 = 把引擎刚扣下的那枚交回去 ⇒ 起服拒,判官 = 引擎同一只
+ *      (`inheritEnvPolicyProblem`,读起服声明;与引擎拒嵌入方白名单同句)。
+ *    - `sandbox-grant`(三只沙箱名单)—— 沙箱 env 的唯一来源(沙箱不从本进程继承任何东西),部署方显式交出的带外凭据(S-715 照转发);
+ *      本列不在「自有凭据」律的射程里,只拒点名名单型旋钮(原文按凭据类)。
  * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红;行形随读它的进程定(服务进程 ⇒ 必须写姿态列)。
  *
  * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
@@ -28,14 +34,18 @@ export type EnvNameAllowlistPosture = {
     readonly kind: "ignored";
     readonly why: string;
 };
-/** 服务侧旋钮一行:拒句示例 + 多租户姿态。 */
+/** 名单交给谁、在谁的减法之上(闭集;规则见表头注 `channel` 一条)。 */
+export type EnvNameAllowlistChannel = "host-put-back" | "sandbox-grant";
+/** 服务侧旋钮一行:拒句示例 + 交付形 + 多租户姿态。 */
 export interface ServerEnvNameAllowlistKnobRow {
     readonly example: string;
+    readonly channel: EnvNameAllowlistChannel;
     readonly multiTenant: EnvNameAllowlistPosture;
 }
-/** runner 旋钮一行:只有拒句示例(没有姿态可言)。 */
+/** runner 旋钮一行:拒句示例 + 交付形(没有姿态可言)。 */
 export interface RunnerEnvNameAllowlistKnobRow {
     readonly example: string;
+    readonly channel: EnvNameAllowlistChannel;
 }
 export type EnvNameAllowlistKnobTable = {
     readonly [K in EnvNameAllowlistKnob]: K extends ServerEnvNameAllowlistKnob ? ServerEnvNameAllowlistKnobRow : RunnerEnvNameAllowlistKnobRow;

package/dist/env-name-allowlist-knobs.js

@@ -1,12 +1,13 @@
 export const ENV_NAME_ALLOWLIST_KNOBS = {
     LSP_ENV_ALLOW: {
         example: "LSP_ENV_ALLOW=NPM_TOKEN,CARGO_REGISTRIES_MY_REG_TOKEN",
+        channel: "host-put-back",
         multiTenant: { kind: "ignored", why: "the host-lane language server is not started in this posture, and the language-server env keeps the full secret strip" },
     },
-    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    K8S_SANDBOX_ENV: { example: "K8S_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
-    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN" },
+    E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    K8S_SANDBOX_ENV: { example: "K8S_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", channel: "sandbox-grant", multiTenant: { kind: "honored" } },
+    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN", channel: "host-put-back" },
 };
 export const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const POSTURE_PHRASE = {

package/dist/exec-bounds.d.ts

@@ -12,8 +12,10 @@
  * 是它报的那一界。
  *
  * 与 core 远端契约(`ExecStreamOptions.readTimeoutMs`:「缺省也 SHOULD 有活性界,一条命令不得等到环境死」)的对齐:
- * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令,在有活性界的车道(k8s / e2b)上仍由它兜底。切断码沿用 core 的 `timeout`(core 远端码表
- * 把墙钟与活性两种超界都归这一词);两者靠句子区分 —— 独立的活性码属于 core 的码表。
+ * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令,在有活性界的车道(k8s / e2b)上仍由它兜底。**切断码按触发的那一界**(core 7.52.0 #1795:
+ * 两套执行码闭集各有一词):墙钟 ⇒ `timeout`;静默界(调用方的 `readTimeoutMs` 或车道活性界)⇒ `liveness_no_output`,带窗口秒数 `noOutputSec`(车道的界 /
+ * 调用方说的静默界,从不是请求的预算)—— 两者解释自己用的是两个数,消费方(core 的 Bash 工具:「no output for N s」对「timed out after N s」)按码分。
+ * 静默切断的码、句、秒数只在 {@link buildLivenessCut} 一处铸,六车道同读。
  *
  * 不在本律里的界(adapter 自己的上限,不是调用方说的话,不关活性界):k8s 文件读写的数据上限 `dataTimeoutMs`、e2b 交给
  * 供应商的沙箱寿命上限。adapter 自己的整段数据搬运(k8s 快照 tar 上 / 下)天生静默,它们**自己说**一个墙钟(数据上限),
@@ -64,6 +66,16 @@ export declare function firstBoundOf(bounds: CommandBounds): {
     readonly ms: number;
     readonly cut: "wall" | LivenessBound;
 } | undefined;
-/** 活性切断的句子 —— 六条车道(host / e2b / k8s / ssh / adb / local-docker)唯一铸点(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。 */
+/**
+ * 🔴 **一次静默切断 —— 唯一铸点**(六条车道 host / e2b / k8s / ssh / adb / local-docker 同读;纯数据,车道用它构造自己那一型的错误):
+ * 码恒为 `liveness_no_output`(core 7.52.0 #1795;墙钟切断照旧 `timeout`,不经本函数),句子 = {@link livenessCutMessage},`noOutputSec` = 静默窗口的整秒数
+ * (core `ExecutionError` 第五构造参;core 读它时向下取整、不足 1 秒不说 —— 本函数同读:不足 1 秒的窗口不带这一位)。远端流式错误(`RemoteExecutionError`)没有这一位的座,只带码与句。
+ */
+export declare function buildLivenessCut(bound: LivenessBound): {
+    readonly code: "liveness_no_output";
+    readonly message: string;
+    readonly noOutputSec?: number;
+};
+/** 活性切断的句子 —— {@link buildLivenessCut} 的句子半(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。车道不直调它:码与句一处铸。 */
 export declare function livenessCutMessage(bound: LivenessBound): string;
 //# sourceMappingURL=exec-bounds.d.ts.map

package/dist/exec-bounds.js

@@ -26,6 +26,10 @@ function spoken(ms) {
         return `${ms} ms`;
     return ms % 1000 === 0 ? `${ms / 1000} s` : `${(ms / 1000).toFixed(1)} s`;
 }
+export function buildLivenessCut(bound) {
+    const sec = Math.floor(bound.ms / 1000);
+    return { code: "liveness_no_output", message: livenessCutMessage(bound), ...(sec >= 1 ? { noOutputSec: sec } : {}) };
+}
 export function livenessCutMessage(bound) {
     switch (bound.setBy) {
         case "lane":

package/dist/execution-lane-caps.d.ts

@@ -58,8 +58,8 @@ export interface ExecutionLaneCaps {
      *  `lane === undefined || lane === "host"` 的同义形,分叉过就是记忆边界判错盘)。读本位的真装配点:
      *  `boot/deferred-sandbox-path-env.ts` 的 `isSandboxPathAdjudicationLane`(resolve-spec 写门 / parked 赎回腿 /
      *  执行环境装配三处的唯一属主)、`memory-scope.ts` 的 `memoryEngineRemoteLanePosture`、
-     *  `boot/memory-boundary.ts` 的 `buildMemoryBoundaryLaneFacts`(stores)、`capabilities/memory-notice.ts` 的
-     *  `buildNoticeLaneFacts`(resolve-spec)。⚠️ `in-process` 在本位上是 YES(hooks/进程内读确实在本机盘上),
+     *  `boot/memory-boundary.ts` 的 `buildMemoryBoundaryLaneFacts`(stores)。(「本会话没有持久记忆」的披露归引擎判、引擎渲染 ——
+     *  目录条目 `core/memory.no-persistent-store`,本仓只交 spec 上的事实,不再读本位做判别。)⚠️ `in-process` 在本位上是 YES(hooks/进程内读确实在本机盘上),
      *  但它**没有手** —— 问「手在不在本机盘上」要读 {@link handsOnWorkerFilePlane},不是只读本位。 */
     readonly hostFilePlane: LaneCapability;
     /** core 的 `isRemoteExecutionEnv` 对本车道的判决(鸭子类型,**含 host**)= core 拿没拿到执行环境 = 手带挂没挂。
@@ -297,4 +297,11 @@ export interface LaneHomeDeployment {
  * 认不出的车道 ⇒ `undefined`(调用方 fail-closed)。生产链上不可达:`loadConfig` 的 [ref] 拒启门先咬。
  */
 export declare function executionLaneHomeDir(deployment: LaneHomeDeployment): string | undefined;
+/**
+ * 「这条部署的执行车道**有手**、而家目录答不出」时起服那一行的 `note`(纯字符串 ⇒ `build*`);否则 `undefined`(不出这一行)。
+ * 判据只读 {@link executionLaneHomeDir}(家目录的唯一属主)与能力表 `coreRemoteExecutionEnv` 位(有没有手):不另写车道清单。
+ * 代价如实:引擎 7.52.0 起家锚拒读行放不下 ⇒ 每一次泄内容的递归读在全 shell 面强制问人(allow / 模式 / bypass 都放不掉)、只读面拒;`~/` 形规则在下单时
+ * 就被 422 拒。出路只有一条:声明执行环境的家目录(`$HOME` 读出来的那个绝对路径)。这句话陈述的是事实,不是告警 —— 要它消失就声明家目录。
+ */
+export declare function buildUndeclaredHomeNote(deployment: LaneHomeDeployment): string | undefined;
 //# sourceMappingURL=execution-lane-caps.d.ts.map

package/dist/execution-lane-caps.js

@@ -261,4 +261,15 @@ export function executionLaneHomeDir(deployment) {
             return undefined;
     }
 }
+export function buildUndeclaredHomeNote(deployment) {
+    if (executionLaneHomeDir(deployment) !== undefined)
+        return undefined;
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined || executionLaneCaps(lane).coreRemoteExecutionEnv !== "supported")
+        return undefined;
+    return (`the ${lane} lane declares no home for its execution environment (REMOTE_EXEC_HOME_DIR is unset, and on this lane the home belongs to the image / target user): ` +
+        `the engine cannot place its home-anchored read-deny rows, so every contents-disclosing recursive read (grep -r, rg, git grep, tar c, …) asks a person on the full shell — ` +
+        `no allow rule, mode or bypass releases that question — and is refused on the read-only face, so unattended tasks cannot search code; "~/" permission rules are refused at submission. ` +
+        `Declare the home: REMOTE_EXEC_HOME_DIR=<the absolute path the environment's $HOME reads>`);
+}
 //# sourceMappingURL=execution-lane-caps.js.map

package/dist/hooks/classic-stations.d.ts

@@ -0,0 +1,86 @@
+/**
+ * 引擎的 `classic.*` 站 —— 本仓挂 handler 的唯一入口(core 7.52.0 起扩展点 = mods 注册,`Hooks` 记录退役)。
+ *
+ * 两件事只写在这里:
+ *  ① **事件名 → { `e` 型, 答案型 }**:core 逐个导出了每站的 `e` 型与答案型,但没有导出二者的映射(宿主侧配对是今天的唯一读法)。
+ *     这张对位表是那一配对的唯一一份;core 导出映射型的那一版,本表改读它、删掉手写的十一行。
+ *  ② **handler 怎么挂**:链成员「无意见 ⇒ `next(e)`」(链 handler 返回 `undefined` 是站点违约,refuse 站上即 fail-closed 拒),
+ *     观察者「恒返回 `undefined`」(观察者的判词不采纳、被引擎报告)。两条都在 {@link hangClassic} / {@link observeClassic} 里成形,
+ *     调用方只写「这一站我答什么」或「这一站我看什么」,不再各自记得这两条。
+ *
+ * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
+ * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
+ */
+import type { EngineDollar, On, PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "@sema-agent/core";
+/** 每一站的 `e` 型与答案型(答案 `void` = 观察站)。 */
+export interface ClassicStationTypes {
+    "classic.PreToolUse": {
+        e: PreToolUseEvent;
+        answer: PreToolUseResult;
+    };
+    "classic.PostToolUse": {
+        e: PostToolUseEvent;
+        answer: PostToolUseResult;
+    };
+    "classic.PostToolUseFailure": {
+        e: PostToolUseFailureEvent;
+        answer: PostToolUseFailureResult;
+    };
+    "classic.PostToolBatch": {
+        e: PostToolBatchEvent;
+        answer: PostToolBatchResult;
+    };
+    "classic.UserPromptSubmit": {
+        e: UserPromptSubmitEvent;
+        answer: UserPromptSubmitResult;
+    };
+    "classic.Stop": {
+        e: StopEvent;
+        answer: StopHookResult;
+    };
+    "classic.SubagentStop": {
+        e: StopEvent;
+        answer: StopHookResult;
+    };
+    "classic.StopFailure": {
+        e: StopFailureEvent;
+        answer: void;
+    };
+    "classic.PreCompact": {
+        e: PreCompactEvent;
+        answer: PreCompactResult;
+    };
+    "classic.PostCompact": {
+        e: PostCompactEvent;
+        answer: void;
+    };
+    "classic.PermissionDenied": {
+        e: PermissionDeniedPayload;
+        answer: void;
+    };
+}
+export type ClassicStation = keyof ClassicStationTypes;
+/** 每一站能挂什么:`chain` = 链成员(会作答)与观察者都可;`observe` = 只许观察者。 */
+export declare const CLASSIC_STATION_ROLE: {
+    readonly "classic.PreToolUse": "chain";
+    readonly "classic.PostToolUse": "chain";
+    readonly "classic.PostToolUseFailure": "chain";
+    readonly "classic.PostToolBatch": "chain";
+    readonly "classic.UserPromptSubmit": "chain";
+    readonly "classic.Stop": "chain";
+    readonly "classic.SubagentStop": "chain";
+    readonly "classic.StopFailure": "observe";
+    readonly "classic.PreCompact": "chain";
+    readonly "classic.PostCompact": "observe";
+    readonly "classic.PermissionDenied": "observe";
+};
+/** 一站的 handler 体:读 `e`,答这一站的答案;`undefined` = 无意见(链成员由 {@link hangClassic} 交给 `next(e)`)。 */
+export type ClassicAnswer<K extends ClassicStation> = (e: ClassicStationTypes[K]["e"]) => Promise<ClassicStationTypes[K]["answer"] | undefined>;
+/**
+ * 按站的角色挂一只 handler:链站 ⇒ 链成员 `(await answer(e)) ?? next(e)`;观察站 ⇒ 观察者(体照跑、恒返回 `undefined`)。
+ * `e` 的型由 {@link ClassicStationTypes} 给(引擎交来的是本站的 `e`;配对见头注 ①)。
+ */
+export declare function hangClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, answer: ClassicAnswer<K>): void;
+/** 挂一只观察者(任何站都可):拿分离副本、不进链、恒返回 `undefined`。 */
+export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicStationTypes[K]["e"]) => void | Promise<void>): void;
+//# sourceMappingURL=classic-stations.d.ts.map