@sema-agent/server 7.131.0 → 7.133.0

package/dist/run-acceptance.d.ts

@@ -22,12 +22,26 @@
  * 三条提交腿(同步 / 流式 / durable)各在两处喂同一只:持流的那一形把每一帧交给 {@link RunAcceptance.observe};终局落行之后调一次
  * {@link RunAcceptance.settle}。腿上不再有「什么时候起标题」的判断,标题器的唯一调用点是本文件的闩。座由提交门在 `prepareSpec` 里
  * 随 spec 一起铸(`PreparedTaskSubmission.acceptance`);不经提交门的内部车道铸一只不带标题器的座,也就不起标题。
+ *
+ * ## 标题写成之后(`session_titled` 帧,契约 §4a-ttl)
+ * 标题器写成时把那一帧交回本座({@link RunAcceptanceDeps.sessionTitler} 的 `onTitled`);本座是这条 run 的流与标题器之间**唯一**的接缝:
+ *  · 持**活流**的腿在开流时挂一只写口({@link RunAcceptance.attachStream};今天只有 `POST /v1/tasks/stream` 的 SSE 腿)—— 帧经它写到这条流上;
+ *  · 没有活流的腿(同步 JSON 腿 / durable 后台腿:读者走账本 tail,账本里没有这一帧)不挂 ⇒ 帧丢弃,会话行是真源;
+ *  · 终帧 `done` 已过 ⇒ 丢弃(终帧是流的最后一帧);连接已断 / 已结束(写口自报够不着)⇒ 丢弃。
+ * 丢弃不计失败:帧是「行刚刚变了」的活通知,读者随时可读行;唯一的读者门是「提交这条 run 的人」—— 写口只在本次提交自己的连接上,不广播。
  */
+import type { SessionTitler } from "./session-titler.js";
+import type { SessionTitledFrame } from "./session-titled-frame.js";
 export interface RunAcceptanceDeps {
     /** 标题器(缺席 = 本部署不自动起名)。 */
-    sessionTitler?: {
-        maybeTitle(sessionId: string, objective: string, model?: string): void;
-    };
+    sessionTitler?: SessionTitler;
+}
+/** 一条活流的写口(持活流的腿自己造)。 */
+export interface RunStreamSink {
+    /** 这条连接此刻还收得到帧(没结束、没断、腿没在收摊)。 */
+    reachable(): boolean;
+    /** 把一帧写到这条流上。 */
+    write(frame: SessionTitledFrame): void;
 }
 export interface RunAcceptanceInput {
     sessionId?: string;
@@ -46,6 +60,8 @@ export interface RunAcceptance {
             readonly turns: number;
         };
     }): void;
+    /** 持活流的腿开流时挂上它的写口(一次提交至多一条活流;重挂以最后一次为准)。不挂 = 本次提交没有可写的流,标题写成的帧丢弃。 */
+    attachStream(sink: RunStreamSink): void;
 }
 export declare function createRunAcceptance(deps: RunAcceptanceDeps, input: RunAcceptanceInput): RunAcceptance;
 //# sourceMappingURL=run-acceptance.d.ts.map

package/dist/run-acceptance.js

@@ -6,15 +6,24 @@ function isObjectiveApplied(ev) {
 }
 export function createRunAcceptance(deps, input) {
     let accepted = false;
+    let terminalSeen = false;
+    let stream;
+    const deliver = (frame) => {
+        if (stream === undefined || terminalSeen || !stream.reachable())
+            return;
+        stream.write(frame);
+    };
     const accept = () => {
         if (accepted)
             return;
         accepted = true;
         if (input.sessionId)
-            deps.sessionTitler?.maybeTitle(input.sessionId, input.objective, input.model);
+            deps.sessionTitler?.maybeTitle(input.sessionId, input.objective, input.model, deliver);
     };
     return {
         observe(ev) {
+            if (ev.type === "done")
+                terminalSeen = true;
             if (!accepted && isObjectiveApplied(ev))
                 accept();
         },
@@ -22,6 +31,9 @@ export function createRunAcceptance(deps, input) {
             if (result.stats.turns > 0)
                 accept();
         },
+        attachStream(sink) {
+            stream = sink;
+        },
     };
 }
 //# sourceMappingURL=run-acceptance.js.map

package/dist/run-local.js

@@ -8,7 +8,7 @@ import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { BIDI_CONTROL_CHARS, Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { readAskClassPair } from "./approval-card.js";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
@@ -18,17 +18,17 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, buildAppr
 import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
-import { applyCatalogToSource } from "./capabilities/center-prompts.js";
-import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
-import { buildUnreadConfigFileFields } from "./web-admin-client/read-warnings.js";
+import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
@@ -37,12 +37,14 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildExcludeToolsSeat, buildPromptSeats, buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+import { createMemoryProjectLayers } from "./memory-project-layer.js";
+import { assertProjectLayerOwnable } from "./project-identity.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
@@ -50,7 +52,7 @@ import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
-import { createPermissionDeniedMeter } from "./observability/tool-trace.js";
+import { assertDeploymentModsAdmitted, createDeploymentMods } from "./boot/deployment-mods.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { fatalExit } from "./boot/fatal-exit.js";
@@ -254,8 +256,9 @@ function argsDisplayOf(args) {
 function buildLocalAskPrompt(req, argsShown) {
     return `approve "${terminalSafeText(req.toolName)}"? ${terminalSafeText(req.message)}\n  ${argsShown}\n[y/N] `;
 }
+const TERMINAL_UNSAFE_RE = new RegExp(`[\\u0000-\\u001f\\u007f-\\u009f${BIDI_CONTROL_CHARS}\\u200b-\\u200d\\u2028\\u2029\\u2060-\\u2065\\ufeff]`, "g");
 function terminalSafeText(text) {
-    return text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    return text.replace(TERMINAL_UNSAFE_RE, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
 function inputAlreadyEnded(input) {
     const state = input;
@@ -339,10 +342,18 @@ export async function runLocal(argv, deps = {}) {
     logConfigDiagnostics(logger);
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
-    const providerInput = { provider: config.configProvider ?? "local", localDir: root };
+    const providerInput = { provider: config.configProvider ?? "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
     const configSource = configProviderKind(providerInput);
-    if (configSource === "local")
+    if (configSource === "local") {
+        try {
+            await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
+        }
+        catch (err) {
+            printErr(err instanceof Error ? err.message : String(err));
+            return 2;
+        }
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
+    }
     try {
         await composeExecutionLane(config, { configSource, localRoot: root, logger, drivesFromFile: ["host"] });
     }
@@ -366,6 +377,8 @@ export async function runLocal(argv, deps = {}) {
             else {
                 for (const f of r.unreadFiles ?? [])
                     logger.warn("config_unread_file", buildUnreadConfigFileFields(f, configProvider.kind === "local" ? root : undefined));
+                for (const k of r.unreadKeys ?? [])
+                    logger.warn("config_unread_key", buildUnreadConfigKeyFields(k, configProvider.kind === "local" ? root : undefined));
                 for (const d of r.droppedEntries ?? [])
                     logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
                 applying = true;
@@ -382,6 +395,10 @@ export async function runLocal(argv, deps = {}) {
         }
     }
     catch (err) {
+        if (err instanceof ConfigDirUntrustedError) {
+            printErr(err.message);
+            return 2;
+        }
         if (applying)
             logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the candidate failed to apply at boot — running on env (run-local has no LKG); none of the candidate's domains is adopted; this is not a reachability failure" });
         else
@@ -476,7 +493,7 @@ export async function runLocal(argv, deps = {}) {
             ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
             ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
         });
-        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPath });
+        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPathFor(config.memorySync.scope) });
         memorySync.trigger("boot");
     }
     else if (config.memorySync) {
@@ -488,25 +505,25 @@ export async function runLocal(argv, deps = {}) {
             return new CenterPromptSource({
                 store: new FilePromptArtifactStore(promptEpochDir),
                 stateStore: new FilePromptSourceStateStore(promptEpochDir),
-                engineVersion: CORE_ENGINE_VERSION,
+                onError: centerSourceOnError(logger),
             });
         }
         catch (e) {
             logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback; built-ins unaffected" });
-            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+            return new CenterPromptSource({ store: new MemoryPromptArtifactStore(), stateStore: new MemoryPromptSourceStateStore(), onError: centerSourceOnError(logger) });
         }
     })();
     try {
         await promptSource.restore();
         if (candidatePrompts !== undefined) {
-            await applyCatalogToSource(promptSource, candidatePrompts, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, candidatePrompts, undefined, logger, "run-local");
         }
         else {
-            await applyCatalogToSource(promptSource, undefined, undefined, logger, "run-local");
+            await applyCenterArtifact(promptSource, undefined, undefined, logger, "run-local");
         }
     }
     catch (e) {
-        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "catalog candidate absent — built-ins serve" });
+        logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "center candidate absent — built-ins serve" });
     }
     let refusedWithoutPerson = 0;
     const onAsk = createLocalApprover({
@@ -559,6 +576,8 @@ export async function runLocal(argv, deps = {}) {
             { name: "toolResultStore", store: fileBackend.toolResultStore },
         ],
     });
+    const deploymentMods = createDeploymentMods({ metrics, brandIdentity: true });
+    await assertDeploymentModsAdmitted(deploymentMods);
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
@@ -575,10 +594,7 @@ export async function runLocal(argv, deps = {}) {
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         mailboxStore: fileBackend.mailboxStore,
         rosterStore: fileBackend.rosterStore,
-        deploymentHooks: {
-            ...createPermissionDeniedMeter(metrics),
-            ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
-        },
+        deploymentMods,
         toolResultStore: fileBackend.toolResultStore,
         checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
@@ -604,7 +620,7 @@ export async function runLocal(argv, deps = {}) {
     const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
-    const deploymentSkills = loadDeploymentSkills(config);
+    const deploymentSkills = loadDeploymentSkills(config, logger);
     const skills = effective?.skills ? await applySkillsManifest(deploymentSkills, effective.skills, configProvider, logger) : deploymentSkills;
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     const webSearchCfg = webSearchConfigFromEnv();
@@ -615,7 +631,6 @@ export async function runLocal(argv, deps = {}) {
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,
-        brandIdentity: true,
     };
     const scenarios = buildScenarios(scenarioDeps);
     if (effective?.scenarios) {
@@ -649,6 +664,20 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const scope = args.user ?? "local";
+    if (memoryEngine) {
+        try {
+            assertProjectLayerOwnable(scope, "--user");
+        }
+        catch (err) {
+            printErr(err instanceof Error ? err.message : String(err));
+            void lspManager?.dispose();
+            await fileBackend.dispose();
+            return 2;
+        }
+    }
+    const projectKey = memoryEngine
+        ? await createMemoryProjectLayers({ backend: memoryEngine.backend, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
+        : undefined;
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false);
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
@@ -668,12 +697,13 @@ export async function runLocal(argv, deps = {}) {
         backgroundScope: "session",
         oneShot: true,
         principal: scope,
-        ...(memoryEngine ? { memory: memorySpecForRequest(scope, memoryProjectKeyFor(config, scope, workspaceDir), undefined) } : {}),
+        ...(memoryEngine ? { memory: memorySpecForRequest(scope, projectKey, undefined) } : {}),
         model: mention.model,
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
-        ...(cap.promptProvider ? { promptProvider: cap.promptProvider } : {}),
+        ...buildPromptSeats(scenarioName, cap.prompt, undefined),
+        ...buildExcludeToolsSeat(cap.excludeTools, undefined),
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),

package/dist/runs.d.ts

@@ -1,4 +1,5 @@
 import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { type EntryProblem } from "./entry-problems.js";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -109,6 +110,14 @@ export declare function resumeAtHttpStatus(result: {
  * `resumeAtHttpStatus` 自己(单元测试直接喂码)。
  */
 export declare function syncRefusalHttpStatus(result: Pick<TaskResult, "terminal" | "stats">): number | undefined;
+/**
+ * 同步腿零工作拒体的机读事实(交 `refusalBody` 的 `facts`)—— 唯一一处。入参是**出口封口 + 脱敏后**的终局(调用方递 `redactTerminalResult(sealResultForExit(result)).terminal`,
+ * 与 run 记录读面 / 流式 `done.result` 上的 `terminal` 同一只来源),本函数只按码取它的 `detail.detail`,不另读、不另脱。码不在登记表里、终局不是 `failed`、
+ * 引擎没给 `coded` 因由 ⇒ `{}`(缺席不造键)。
+ * 两张工具名清单的码({@link ENGINE_TOOL_LIST_REFUSAL_CODES})是另一臂:体事实不取引擎的因由,取 `admissionReadings`(受理口对放行侧选择器清单的读数,`PreparedTaskSubmission.warnings`)
+ * 去掉 `not_in_roster`、且 `code` 与终局的码相同(同一族清单)的那些 —— 与受理口 400 同一只机读位形;没有读数 ⇒ `{}`。
+ */
+export declare function zeroWorkRefusalFacts(terminal: unknown, admissionReadings?: readonly EntryProblem[]): Readonly<Record<string, unknown>>;
 /**
  * 一条提交腿把引擎终局落行之后的**唯一**收尾:**零工作的拒不占提交幂等键**。判据就是上面这只 {@link syncRefusalHttpStatus}
  * (零 turn、零 token 且是 prepare 期的拒码)—— 三条提交腿(同步 / 流式 / durable)同调这一只,不另开判据。
@@ -341,17 +350,15 @@ pendingEngineNotices?: readonly {
     sessionId?: unknown;
 }[], 
 /**
- * 🔴 **S-218:部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume`)。
+ * 🔴 **部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume` = 本会话已受理的 workflow 子代决定)。
  *
- * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。铸点只有
- * 一个:`/decide` 的 workflow 第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide`
- * 顶注 + `http/durable-run-leg.ts` 的 `TrustedRunInternals`)。本腿只负责把它摊进**下面那只**共享
- * 供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
+ * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。产自决定进引擎的唯一读者
+ * (`parked-decide.ts` 的 `heldWorkflowParkDecisions`),由本腿唯一的调用方 `mintAndDriveDurableRun` 开跑前读一次传进来。
+ * 本腿只负责把它摊进**下面那只**共享供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
  *
  * 位置在座席对象的**最后**:座席里那几位(onActivity/onForwardEvent/onTaskNotification/onSubagentSpawn)
- * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 真要撞名,撞的也只能是本腿自己新加的位,而那时
- * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
- * 缺席 ⇒ 座席与本位存在之前逐字相同。
+ * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 型只开 `workflowParkedResume` 这一格(`Pick`),新开一格必须在这里显式点名。
+ * 缺席 / 空对象 ⇒ 座席与本位存在之前逐字相同。
  */
 trustedInternals?: Pick<RunInternals, "workflowParkedResume">, 
 /**

package/dist/runs.js

@@ -1,5 +1,6 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
+import { NOT_IN_ROSTER, entryProblemsFacts } from "./entry-problems.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
@@ -78,7 +79,10 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.image_invalid": 400,
     "config.user_attachment_invalid": 400,
     "config.tool_face_control": 400,
+    "config.agent.unknown_tool": 400,
+    "config.legacy_tool_name": 400,
     "config.memory_capture_unsupported": 409,
+    "prompt.assembled_role_refused": 400,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -106,6 +110,37 @@ export function syncRefusalHttpStatus(result) {
         return undefined;
     return resumeAtHttpStatus(result);
 }
+const ZERO_WORK_REFUSAL_DETAIL_CODES = new Set(["config.user_attachment_invalid"]);
+const ENGINE_ENTRY_SPELLING_REASONS = new Set(["near_miss", "unknown_name"]);
+function engineReasonOf(detail) {
+    if (detail === null || typeof detail !== "object")
+        return undefined;
+    const c = detail;
+    if (c.kind !== "coded" || c.detail === null || typeof c.detail !== "object")
+        return undefined;
+    const reason = c.detail.reason;
+    return typeof reason === "string" ? reason : undefined;
+}
+const ENGINE_TOOL_LIST_REFUSAL_CODES = new Set(["config.tool_face_control", "config.agent.unknown_tool"]);
+export function zeroWorkRefusalFacts(terminal, admissionReadings = []) {
+    if (terminal === null || typeof terminal !== "object")
+        return {};
+    const t = terminal;
+    if (t.kind !== "failed" || typeof t.code !== "string")
+        return {};
+    if (ENGINE_TOOL_LIST_REFUSAL_CODES.has(t.code)) {
+        const readings = admissionReadings.filter((p) => p.code === t.code && p.reason !== NOT_IN_ROSTER);
+        const engineReason = engineReasonOf(t.detail);
+        return readings.length > 0 && engineReason !== undefined && ENGINE_ENTRY_SPELLING_REASONS.has(engineReason) ? { ...entryProblemsFacts(readings) } : {};
+    }
+    if (!ZERO_WORK_REFUSAL_DETAIL_CODES.has(t.code))
+        return {};
+    const cause = t.detail;
+    if (cause === null || typeof cause !== "object")
+        return {};
+    const c = cause;
+    return c.kind === "coded" && c.detail !== undefined ? { detail: c.detail } : {};
+}
 export async function releaseKeyIfZeroWorkRefusal(runStore, taskId, result) {
     if (syncRefusalHttpStatus(result) !== undefined)
         await runStore.releaseIdemKey(taskId);
@@ -473,7 +508,6 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 ? approval.coordinator.runWithContext({
                     taskId,
                     owner: elicitOwner ?? owner,
-                    emit: approvalEmit,
                     abortSignal: cancelCtrl.signal,
                     ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
                     emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),

package/dist/runtime-caps-resolver.d.ts

@@ -25,6 +25,9 @@
  *                        ⇒ **无 checkpoint 店的部署上这一面本就不成立**，该键在那里 inert）
  *  · `autoMode`        — prepare-task.js `=== true` **∧** `deps.autoMode !== undefined`（部署需先具备分类器；
  *                        显式 opt-in 极性，且 [ref] 起本侧传的是三态 org deny 位，见 toCoreRuntimeCaps 头注）
+ *  · `bypassPermissions` — `dist/core/mode-policy.js` 的模式折叠（请求 `bypassPermissions` ∧ 本位 `=== false` ⇒ 这条腿跑在
+ *                        `default`、发 `config.permission_mode_unavailable{by:"operator_deny"}`、回执 `foldedBy:"operator_deny"`）；
+ *                        deny 形，缺席 = 不阻。S-900 D2 起由 center 的 `allowBypassPermissions` 写（此前本仓零写点）
  *  · `allowMemoryOptOut` — prepare-memory.js `resolveCaptureEntitlementFresh`（+prepare-task.js
  *                        的 value/faulted 投影）；**极性反转，但只在 `open` 姿态下**——判决全表在
  *                        `dist/core/runner/memory-capture-optout.js` 的 `adjudicateCaptureOptOut`，按
@@ -34,7 +37,8 @@
  *                        · `"governed"`     :14-23 要**显式 `true`** 才准；`false` / 缺席 / fault **一律拒**
  *                          （拒由分「answered false」与「verdict absent / resolver fault」两句）
  *                        · `"capture-required"`:4-12 **完全不看本 verdict**（逐字「resolver-independent」），恒拒
- * 只有 `allowUltracode` 是被 DROP 的那一个（下文）。
+ * center 的键里只有 `allowUltracode` 被 DROP（下文）；center 的其余每一键都在 {@link toCoreRuntimeCaps} 的处置表里，
+ * settings-schema 加一键而这里没处置 ⇒ tsc 红（S-900 D2 之前 `allowBypassPermissions` / `allowAutoMode` 两键就是这样被静默丢掉的）。
  *
  * It pulls the PER-PRINCIPAL entitlement from center's `GET /api/config/effective?principal=` (via
  * {@link fetchPrincipalCaps}). center has ALREADY pre-resolved the tighten-only intersection (fleet defaults ∩
@@ -44,13 +48,16 @@
  *
  * 🔐 FAIL-CLOSED (core security mandate, prepare-task.ts): an entitlement-resolver outage must NEVER silently
  * GRANT a capability center may have denied. On a hard fetch error we mint `{ allowWorkflows: false, allowFork: false,
- * autoMode: false }` — the three OPTIONAL **amplification** caps — and do NOT force the durable gate (that could
+ * autoMode: false, autoModeDenySource: "org", bypassPermissions: false }` — the four OPTIONAL **amplification** caps
+ * (plus the auto bit's plane) — and do NOT force the durable gate (that could
  * strand an autonomous run on an absent operator). We never serve a STALE cached GRANT past its TTL on a
  * fresh-fetch failure (a revoked cap must not linger because center blipped).
  * ⚠️ [ref]① 纠失实：这段曾写作「降级为 `{ allowWorkflows: false }`」，与真码不符 —— 真铸点在本文件
- * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那三键：`allowFork` 自提货批就在，
- * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起）。
- * 🔒 **三键以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
+ * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那几键：`allowFork` 自提货批就在，
+ * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起），`bypassPermissions`
+ * 由 S-900 D2 加入（同一条律：center 可能已经拒了的 bypass 不能因一次抖动放出来；core 自己的 resolver-throw 降级臂
+ * 铸的也是这四位拒，`dist/core/runner/prepare-caps-and-workflow.js`）。
+ * 🔒 **四只放大位以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
  * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
  * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
@@ -62,6 +69,9 @@
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
+ * center's two MODE kill-switches are NOT dropped: `allowBypassPermissions:false` ⇒ `bypassPermissions:false`,
+ * `allowAutoMode:false` ⇒ the same auto deny bit `autoMode:false` writes (S-900 D2 — a mode's every refusal is an engine
+ * deny bit; the engine folds, announces and reports it on `wiring_manifest.permissionMode`).
  */
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
@@ -138,7 +148,7 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "webAdmin">): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
-    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;
+    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode/bypassPermissions;
      *  [ref]① 随批纠：此处是同一句降级声明的第二个写者，漏了 [ref] 加的 `autoMode`。真铸点同上）。 */
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     /**

package/dist/runtime-caps-resolver.js

@@ -27,12 +27,21 @@ function traceExecutionLaneDefault(form, ownLane, logger) {
     catch {
     }
 }
+const CENTER_ENGINE_CAP_KEYS = [
+    "allowWorkflows",
+    "forceDurableGate",
+    "allowFork",
+    "allowObservers",
+    "autoMode",
+    "allowAutoMode",
+    "allowBypassPermissions",
+    "allowMemoryOptOut",
+];
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    const autoMode = ent.autoMode;
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
-    if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode) || badCap(ent.allowMemoryOptOut)) {
+    if (CENTER_ENGINE_CAP_KEYS.some((k) => badCap(ent[k]))) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");
     }
     const caps = {};
@@ -44,10 +53,14 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowFork = ent.allowFork;
     if (typeof ent.allowObservers === "boolean")
         caps.allowObservers = ent.allowObservers;
-    if (typeof autoMode === "boolean")
-        caps.autoMode = autoMode;
+    if (ent.autoMode === false || ent.allowAutoMode === false)
+        caps.autoMode = false;
+    else if (ent.autoMode === true)
+        caps.autoMode = true;
     if (caps.autoMode === false)
         caps.autoModeDenySource = "org";
+    if (ent.allowBypassPermissions === false)
+        caps.bypassPermissions = false;
     if (typeof ent.allowMemoryOptOut === "boolean")
         caps.allowMemoryOptOut = ent.allowMemoryOptOut;
     return Object.keys(caps).length ? caps : undefined;
@@ -146,7 +159,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org", bypassPermissions: false }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(bin.cache, principal, entry);

package/dist/sandbox-pkg-source.d.ts

@@ -14,7 +14,16 @@
  *
  * The marker `SEMA_PKG_SOURCE` always rides along: the image's pkg-source.sh hook (pod-start / profile.d)
  * materializes the file-bound pieces from it; images without the hook simply ignore it.
+ *
+ * ## One law: no URL that rides into the model-visible sandbox env carries userinfo
+ * Everything this module derives lands in the env of every sandbox process — including the ones the model drives
+ * (`env`, `printenv`) — so `https://user:pass@mirror/…` among the `custom` addresses would hand the deployment's
+ * package-source credential to the model. {@link customPkgSourceFromEnv} is the ONE reader of the six addresses and the
+ * one place that judges them: the shared URL-shape judge (`httpUrlFlaws`, the same one MEMORY_EMBEDDER_ENDPOINT /
+ * A2A_SERVE_URL answer to) says no ⇒ it throws, startup refuses. Never stripped, never rewritten, never forwarded
+ * quietly. The request face has no package-source address key at all (deployment face only).
  */
+import { type HttpUrlFlaw } from "@sema-agent/settings-schema";
 /** Explicit URLs for `custom` (RFC B: 极端情况出口). Read from the service process env (operator-trusted). */
 export interface CustomPkgSource {
     aptMirror?: string;
@@ -29,6 +38,15 @@ export interface CustomPkgSource {
  * profile (unset = byte-identical sandbox — the B5 backward-compat contract).
  */
 export declare function derivePkgSourceEnv(profile: string | undefined, custom?: CustomPkgSource): Record<string, string>;
-/** Read the `custom` explicit-URL set from the service process env (operator-trusted deployment config). */
+/**
+ * The refusal sentence for one address (pure data): the shared judge's rule words + the value's origin only
+ * ({@link buildHttpUrlRefusal}), then why it matters here and the two ways out. No byte of the credential can reach it.
+ */
+export declare function buildCustomPkgSourceRefusal(envName: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
+/**
+ * Read the `custom` explicit-URL set from the service process env (operator-trusted deployment config) — the ONE reader and
+ * the ONE judge of those six addresses (see the module header). An address the shared judge refuses (userinfo, or a shape
+ * that is not a parseable http(s) URL) throws {@link buildCustomPkgSourceRefusal}; empty / unset = not set.
+ */
 export declare function customPkgSourceFromEnv(env?: NodeJS.ProcessEnv): CustomPkgSource;
 //# sourceMappingURL=sandbox-pkg-source.d.ts.map

package/dist/sandbox-pkg-source.js

@@ -1,3 +1,5 @@
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
 const GLOBAL_ENV = {
     PIP_INDEX_URL: "https://pypi.org/simple",
     UV_DEFAULT_INDEX: "https://pypi.org/simple",
@@ -43,14 +45,34 @@ export function derivePkgSourceEnv(profile, custom) {
             return { SEMA_PKG_SOURCE: profile };
     }
 }
+export function buildCustomPkgSourceRefusal(envName, raw, flaws) {
+    return (`${buildHttpUrlRefusal(envName, raw, flaws)} — with SANDBOX_PKG_SOURCE=custom this address is written verbatim into the environment of every sandbox ` +
+        `(e2b VM / k8s pod), where any process the model can run reads it back with \`env\`; an address that carries userinfo, or whose shape cannot be judged ` +
+        `credential-free (not http(s)://host[:port][/path], or containing a backslash — the URL standard reads it as "/", package managers do not), would hand ` +
+        `the deployment's package-source credential to the model, so the server refuses to start rather than forward or rewrite it. ` +
+        `Way out: (1) set ${envName} to the credential-free address and give the package manager its credential through its own channel — a token variable ` +
+        `named in the lane's name list (E2B_SANDBOX_ENV / K8S_SANDBOX_ENV; naming it accepts that every process in the sandbox, the model included, can read it) ` +
+        `or a credential file baked into the sandbox image; (2) if the source needs no authentication, drop the userinfo.`);
+}
 export function customPkgSourceFromEnv(env = process.env) {
-    return {
-        ...(env.SEMA_APT_MIRROR ? { aptMirror: env.SEMA_APT_MIRROR } : {}),
-        ...(env.SEMA_PIP_INDEX ? { pipIndex: env.SEMA_PIP_INDEX } : {}),
-        ...(env.SEMA_UV_INDEX ? { uvIndex: env.SEMA_UV_INDEX } : {}),
-        ...(env.SEMA_UV_PY_MIRROR ? { uvPyMirror: env.SEMA_UV_PY_MIRROR } : {}),
-        ...(env.SEMA_NPM_REGISTRY ? { npmRegistry: env.SEMA_NPM_REGISTRY } : {}),
-        ...(env.SEMA_NODE_MIRROR ? { nodeMirror: env.SEMA_NODE_MIRROR } : {}),
+    const addresses = {
+        aptMirror: ["SEMA_APT_MIRROR", env.SEMA_APT_MIRROR],
+        pipIndex: ["SEMA_PIP_INDEX", env.SEMA_PIP_INDEX],
+        uvIndex: ["SEMA_UV_INDEX", env.SEMA_UV_INDEX],
+        uvPyMirror: ["SEMA_UV_PY_MIRROR", env.SEMA_UV_PY_MIRROR],
+        npmRegistry: ["SEMA_NPM_REGISTRY", env.SEMA_NPM_REGISTRY],
+        nodeMirror: ["SEMA_NODE_MIRROR", env.SEMA_NODE_MIRROR],
     };
+    const out = {};
+    for (const field of Object.keys(addresses)) {
+        const [name, raw] = addresses[field];
+        if (!raw)
+            continue;
+        const flaws = raw.includes("\\") ? ["not-http-url"] : httpUrlFlaws(raw, ["userinfo"]);
+        if (flaws.length > 0)
+            throw new Error(buildCustomPkgSourceRefusal(name, raw, flaws));
+        out[field] = raw;
+    }
+    return out;
 }
 //# sourceMappingURL=sandbox-pkg-source.js.map