@sema-agent/server 7.131.0 → 7.133.0

package/dist/auth-bridge.js

@@ -8,7 +8,8 @@ export function authBridgeIssuerOf(config) {
         return { issuer: config.webAdmin.baseUrl, source: "fallback" };
     return undefined;
 }
-const DEFAULT_JWKS_TTL_SEC = 15 * 60;
+export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
+export const JWKS_FETCH_TIMEOUT_MS = 10_000;
 const MAX_JWKS_BYTES = 256 * 1024;
 const MAX_TOKEN_CHARS = 16 * 1024;
 const MAX_SEGMENT_BYTES = 64 * 1024;
@@ -39,6 +40,7 @@ export function createWebAdminJwtVerifier(opts) {
     let lastFetchAttemptMs;
     let lastFetchSuccessMs;
     let inflight;
+    const withinGrace = () => lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
     const fail = (error, kid) => {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: error });
         opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: displayIssuer });
@@ -50,7 +52,7 @@ export function createWebAdminJwtVerifier(opts) {
         inflight = (async () => {
             lastFetchAttemptMs = now();
             try {
-                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(10_000) });
+                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS) });
                 if (!res.ok)
                     throw new Error(`jwks HTTP ${res.status}`);
                 const cl = Number(res.headers.get("content-length"));
@@ -112,8 +114,9 @@ export function createWebAdminJwtVerifier(opts) {
             return fail("unknown_issuer", kid);
         if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
             return fail("expired", kid);
-        const snapshot = () => ({ cachedKids: [...keys.keys()], lastFetchAttemptMs, nowMs: now() });
-        if (keys.has(kid)) {
+        const usableKey = () => (withinGrace() ? keys.get(kid) : undefined);
+        const snapshot = () => ({ cachedKids: withinGrace() ? [...keys.keys()] : [], lastFetchAttemptMs, nowMs: now() });
+        if (usableKey()) {
             const ttlStale = lastFetchSuccessMs === undefined || now() - lastFetchSuccessMs > jwksTtlSec * 1000;
             if (ttlStale && !inflight && (lastFetchAttemptMs === undefined || now() - lastFetchAttemptMs >= refreshMin * 1000)) {
                 void refreshJwks();
@@ -122,16 +125,12 @@ export function createWebAdminJwtVerifier(opts) {
         else {
             if (inflight)
                 await inflight;
-            if (!keys.has(kid) && shouldForceJwksRefresh(kid, snapshot(), { jwksRefreshMinIntervalSec: refreshMin }))
+            if (!usableKey() && shouldForceJwksRefresh(kid, snapshot(), { jwksRefreshMinIntervalSec: refreshMin }))
                 await refreshJwks();
         }
-        const key = keys.get(kid);
+        const key = usableKey();
         if (!key) {
-            const graceOk = lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
-            return graceOk ? fail("invalid_signature", kid) : fail("jwks_unavailable", kid);
-        }
-        if (lastFetchSuccessMs !== undefined && !jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec })) {
-            return fail("jwks_unavailable", kid);
+            return withinGrace() ? fail("invalid_signature", kid) : fail("jwks_unavailable", kid);
         }
         let sigOk = false;
         try {

package/dist/bake-runner/main.js

@@ -5,6 +5,7 @@ import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative
 import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
 import { declareServerWithheldEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
+import { echoCallerText } from "../caller-text-echo.js";
 import { BakeRunner, } from "./runner.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
 const BAKE_HEARTBEAT_FETCH_TIMEOUT_MS = 10_000;
@@ -181,9 +182,9 @@ export async function execGroup(cmd, timeoutMs, envAllow) {
     try {
         const { code, signal } = await child.exited;
         if (timedOut)
-            throw new Error(`host exec timed out after ${timeoutMs}ms (group killed): ${cmd.slice(0, 120)}`);
+            throw new Error(`host exec timed out after ${timeoutMs}ms (group killed): ${echoCallerText(cmd, { maxChars: 120 })}`);
         if (code !== 0)
-            throw new Error(`host exec exited ${code ?? signal}: ${cmd.slice(0, 120)}${stderr.trim() ? ` — ${stderr.trim().slice(-400)}` : ""}`);
+            throw new Error(`host exec exited ${code ?? signal}: ${echoCallerText(cmd, { maxChars: 120 })}${stderr.trim() ? ` — ${stderr.trim().slice(-400)}` : ""}`);
         return { stdout };
     }
     finally {

package/dist/boot/deferred-sandbox-path-env.js

@@ -118,7 +118,7 @@ export class DeferredSandboxPathEnv extends StubExecutionEnv {
                 reason: found.reason,
                 face,
                 sessionId: this.sessionId ?? null,
-                note: "the sandbox fs-write gate has no task environment to adjudicate against — every write target fails closed (ask, and deny under the sensitive-path set) until one is bound",
+                note: "the sandbox path adjudication has no task environment to read — the sensitive-path guard fails closed (deny) on every write target until one is bound",
             });
         }
         return {

package/dist/boot/deployment-mods.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 部署座(`RunnerDeps.mods`)的注册:**铸**({@link createDeploymentMods})与**起服自证**({@link assertDeploymentModsAdmitted})都在这一处。
+ *
+ * 起服自证(律三:拒形只有引擎一种读法,本仓只负责「不写」与「启动时自证」):
+ * 部署座上的注册是本仓自己铸的。它们坏了
+ * —— 坏名、坏档、缺 `uses.calls`、`on` 越出 `uses`、只选无站的名字、`register` 抛 —— 引擎在每条腿的 prepare 里拒
+ * (`config.mods_invalid`),那就是每个请求都失败。所以起服时让引擎的 admission 判一次:判官仍是引擎(`admitModChain`),
+ * 本函数不判形,只把它的拒折成一句起服错误、拒启。两个起服入口(server 第五段、本地 CLI)同调这一只。
+ *
+ * 也拒启的两形(同一个理由:部署注册一张都不该缺席,也不该带病挂上):
+ *  · admission 期的报告(引擎对坏 `budgetMs` 只报告、回落缺省,不拒)—— 部署注册不设 `budgetMs`,报告出现就是铸法坏了;
+ *  · 被 `plugin.register` 判拒的注册(本部署没有这种判官;出现即装配错)。
+ * 腿外 admission 只建一只总线并跑一次各注册的 `register`(本仓的 `register` 是纯函数),不碰任何腿。
+ */
+import { type EngineDollar, type ModRegistration } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+/**
+ * 部署座上的注册列表 —— 两个起服入口(server 第五段与本地 CLI)同一只铸法,哪几张、什么顺序只写在这里:
+ *  · 拒绝计量恒挂、在前;工具追踪(`TOOL_TRACE=true`,交 `traceLogger`)在后。两张都是 `prepend` 档的观察者,引擎按「档 → 部署先于任务 → 座内顺序」
+ *    串行跑观察者、且都在链之前 ⇒ 同一次拒绝先计数、后写追踪行;
+ *  · 品牌行(`brandIdentity`:品牌部署 = local / TOC)—— `prompt.compose` 上的一条部署类 overlay(`capabilities/brand-identity.ts`),与两只观察者
+ *    不在同一个事件上,顺序不影响它们。部署开不开品牌只在这一个入参表态。
+ */
+export declare function createDeploymentMods(input: {
+    readonly metrics: Pick<Metrics, "inc">;
+    readonly traceLogger?: Logger | undefined;
+    readonly brandIdentity?: boolean | undefined;
+}): readonly ModRegistration<EngineDollar>[];
+export declare function assertDeploymentModsAdmitted(mods: readonly ModRegistration<EngineDollar>[]): Promise<void>;
+//# sourceMappingURL=deployment-mods.d.ts.map

package/dist/boot/deployment-mods.js

@@ -0,0 +1,26 @@
+import { admitModChain } from "@sema-agent/core";
+import { createBrandIdentityRegistration } from "../capabilities/brand-identity.js";
+import { createPermissionDeniedMeter, createToolTracer } from "../observability/tool-trace.js";
+export function createDeploymentMods(input) {
+    return [
+        createPermissionDeniedMeter(input.metrics),
+        ...(input.traceLogger !== undefined ? [createToolTracer(input.traceLogger)] : []),
+        ...(input.brandIdentity === true ? [createBrandIdentityRegistration()] : []),
+    ];
+}
+const REFUSED = "deployment extension registration refused";
+export async function assertDeploymentModsAdmitted(mods) {
+    const reports = [];
+    let records;
+    try {
+        ({ records } = await admitModChain({ deployment: mods }, (err) => void reports.push(err.message)));
+    }
+    catch (e) {
+        throw new Error(`${REFUSED}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const refused = records.flatMap((r) => ("refusedBy" in r ? [`"${r.name}" refused by ${r.refusedBy}: ${r.reason}`] : []));
+    const problems = [...reports, ...refused];
+    if (problems.length > 0)
+        throw new Error(`${REFUSED}: ${problems.join("; ")}`);
+}
+//# sourceMappingURL=deployment-mods.js.map

package/dist/boot/execution-env.d.ts

@@ -62,7 +62,7 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  *  · **工作区空间的分区 = 会话化身**(`spaceOccupant.incarnation`):建这只 env 时按 id 读一次会话店的 `incarnationOf`(会话行上的那一格,
  *    `session-incarnation.ts`;本工厂不取会话,正是 core 给「没取会话的读者」的那只读)。读数是闭集三臂(`SpaceOccupant`,适配器那边逐臂处置):
  *    答令牌 ⇒ 已知;答 `undefined`(没有这只会话)⇒ `{ unread: "incarnation_unknown" }` —— 没有空间:空间车道不开、缓存卷不挂,各一行;
- *    读抛 / 答出的不是非空串 ⇒ `{ fault: <code> }` —— 读不到空间 ≠ 没有空间:开着的空间车道 / 缓存卷让这只 env 一只 pod 都不建,
+ *    读抛 / 超时(`rpcTimeoutMs`,同一次 connect 里读围栏行与 `latest` 的那一只墙)/ 答出的不是非空串 ⇒ `{ fault: <code> }` —— 读不到空间 ≠ 没有空间:开着的空间车道 / 缓存卷让这只 env 一只 pod 都不建,
  *    connect 与 resumeVM 都答 `connect_failed`(与 `latest` 读失败同一铸点),一行 `workspace_space_unreadable_occupant`;`code` 是店的错误码,
  *    从不带正文、从不带令牌。**绝不**以会话 id 代替;
  *    同时开这只 env 在空间提交围栏上的座(`spaceOccupant.fence`,run 店的 `workspace_space_commit` 行;法见 `workspace-space-commit.ts`);

package/dist/boot/execution-env.js

@@ -10,7 +10,7 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
@@ -20,13 +20,15 @@ import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/sche
 import * as facts from "../capability-facts.js";
 import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js";
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
-import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
+import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
+import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { LANE_HOME_UNDECLARED_EVENT, createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, buildUndeclaredHomeNote, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -54,7 +56,7 @@ function forwardedSandboxEnvKeys(remoteExec) {
     }
 }
 function buildSandboxLaneEnv(config, explicit) {
-    const merged = { ...derivePkgSourceEnv(config.sandboxPkgSource, customPkgSourceFromEnv()), ...(explicit ?? {}) };
+    const merged = { ...derivePkgSourceEnv(config.sandboxPkgSource, config.sandboxPkgSourceCustom), ...(explicit ?? {}) };
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
 const MAX_CWD_SESSIONS = 4096;
@@ -108,15 +110,16 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     };
 }
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
+    const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
         const child = ctx.placementRootSessionId !== ctx.sessionId;
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
-        const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId);
+        const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
-            ...(cache !== undefined && !child ? { cache } : {}),
+            ...(cache !== undefined && !child ? { cache, cacheMisses } : {}),
             ...(s3Snapshot !== undefined ? { s3Snapshot } : {}),
             image: seats.imageOf(ctx.sessionId) ?? k8sCfg.image,
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
@@ -125,10 +128,18 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     };
 }
 const STORE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
-async function occupantOf(seats, sessionId, taskId) {
+const INCARNATION_READ_TIMEOUT = "incarnation_read_timeout";
+async function occupantOf(seats, sessionId, taskId, boundMs) {
     let answer;
     try {
-        answer = await seats.incarnationOf?.(sessionId);
+        const read = seats.incarnationOf;
+        answer =
+            read === undefined
+                ? undefined
+                : await boundedStoreCall(() => read(sessionId), {
+                    ms: boundMs,
+                    onTimeout: () => Object.assign(new Error(`session occupant read did not answer within ${boundMs}ms`), { code: INCARNATION_READ_TIMEOUT }),
+                });
     }
     catch (e) {
         const code = e?.code;
@@ -187,6 +198,7 @@ export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
     const laneHomeDir = executionLaneHomeDir(config);
     const homeDirSeat = laneHomeDir !== undefined ? { homeDir: laneHomeDir } : {};
+    const homeAbsentNotice = { onHomeAbsent: createLaneHomeAbsenceReporter((event, fields) => logger.warn(event, fields)) };
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
     const sessionScoped = createSessionScopedRegistries();
@@ -213,7 +225,7 @@ export function createExecutionEnv(ctx) {
     else if (config.remoteExec?.provider === "k8s") {
         const k8sCfg = {
             image: config.remoteExec.image,
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.apiUrl ? { apiUrl: config.remoteExec.apiUrl } : {}),
             ...(config.remoteExec.token ? { token: config.remoteExec.token } : {}),
             ...(config.remoteExec.caCert ? { caCert: config.remoteExec.caCert } : {}),
@@ -244,7 +256,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = sshExecutionEnvFactory({
             host: config.remoteExec.host,
             username: config.remoteExec.username,
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             privateKey: config.remoteExec.privateKey,
             ...(config.remoteExec.port != null ? { port: config.remoteExec.port } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
@@ -268,7 +280,7 @@ export function createExecutionEnv(ctx) {
     else if (config.remoteExec?.provider === "adb") {
         executionEnvFactory = adbExecutionEnvFactory({
             serial: config.remoteExec.serial,
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.adbPath ? { adbPath: config.remoteExec.adbPath } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
         });
@@ -317,7 +329,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.dockerPath ? { dockerPath: config.remoteExec.dockerPath } : {}),
             ...(config.remoteExec.dockerHost ? { dockerHost: config.remoteExec.dockerHost } : {}),
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
@@ -404,6 +416,9 @@ export function createExecutionEnv(ctx) {
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
+        const homeNote = buildUndeclaredHomeNote(config);
+        if (homeNote !== undefined)
+            logger.warn(LANE_HOME_UNDECLARED_EVENT, { provider: config.remoteExec.provider, note: homeNote });
         if (executionLaneOf(config.remoteExec.provider) === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }

package/dist/boot/execution-lane.js

@@ -1,13 +1,23 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
+import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
 import { executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
 export async function composeExecutionLane(config, ctx) {
     if (ctx.configSource === "local")
         await applyRemoteExecFile(config, ctx);
+    settleReadFaceForFinalLane(config, ctx.logger);
     assertExecutionLaneInvariants(config);
 }
+function settleReadFaceForFinalLane(config, logger) {
+    if (!settleDerivedReadFace(config, config.requirePrincipal !== true))
+        return;
+    const notice = buildReadFacePostureNotice(config);
+    if (notice !== undefined)
+        logger.info(notice.event, notice.fields);
+}
 export async function settleHostLaneShell(config, logger) {
     if (config.remoteExec?.provider !== "host")
         return;
@@ -34,6 +44,7 @@ export function assertExecutionLaneInvariants(config) {
 }
 async function applyRemoteExecFile(config, ctx) {
     const { localRoot, logger } = ctx;
+    await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: config.configLocalOwnerUid });
     let fileRx;
     try {
         fileRx = await loadRemoteExec(localRoot);

package/dist/boot/leader.js

@@ -1,4 +1,5 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
+import { createLeaderRunVisibility } from "../http/owner-access.js";
 import { createLeaderRunner } from "../leader/wire.js";
 import { buildDeploymentPostureSeats } from "./runner-deps.js";
 import { hasApprovalListIntent } from "../approval.js";
@@ -86,6 +87,7 @@ export function createLeaderFace(ctx) {
             logger,
             requiredFields: ["objective", "durableRemote", "testCmd", "seedCmd", "baseSha"],
             ...(leaderRunStore ? { store: leaderRunStore } : {}),
+            ownerVisible: createLeaderRunVisibility(config),
         })
         : undefined;
     if (leaderEndpoint)

package/dist/boot/memory-boundary.d.ts

@@ -75,8 +75,8 @@ import type { MemoryEngineBackend } from "@sema-agent/settings-schema/execution-
  * 而且它断言的是 per-task 事实,不是本键的车道级语义。
  *
  * ## 位置与纪律
- * 单源:resolve-spec 的 spec 直通、`noPersistentMemoryNotice` 判别式、boot 审计的 declared 位
- * 三处都必须读本函数,禁各自重算(operator-knob 律:显式 env 的优先权在这一个函数里执法一次)。
+ * 单源:resolve-spec 的 spec 直通(引擎据它判「本会话没有持久记忆」的披露与四只记忆面臂)、boot 审计的 declared 位
+ * 两处都必须读本函数,禁各自重算(operator-knob 律:显式 env 的优先权在这一个函数里执法一次)。
  * 自动补位在 boot 日志上必须可见(stores.ts 的 info 行),部署方随时可用显式 env 覆盖。
  */
 export declare function effectiveMemoryPersistenceCapable(config: {

package/dist/boot/memory-boundary.js

@@ -1,5 +1,5 @@
 import { resolve } from "node:path";
-import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
+import { executionLaneCaps, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 export function effectiveMemoryPersistenceCapable(config) {
     if (config.memoryPersistenceCapable !== undefined)
         return config.memoryPersistenceCapable;
@@ -11,7 +11,7 @@ export function buildMemoryBoundaryLaneFacts(config, processCwd) {
     return {
         lane,
         hostSemanticsLane: caps.hostFilePlane === "supported",
-        coreRemoteExecutionEnv: caps.coreRemoteExecutionEnv === "supported",
+        coreRemoteExecutionEnv: laneWiresExecutionEnv(lane),
         containmentRoots: lane === "in-process" ? [processCwd] : [],
     };
 }

package/dist/boot/memory-consolidation.d.ts

@@ -298,9 +298,9 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
  *
  * consolidation 要后端自带引擎控制面归属 ⇒ 今天只有 file 记忆后端满足 ⇒ 本仓只在**单用户**形
  * (`REQUIRE_PRINCIPAL !== true`)上装配记忆引擎 —— 而那种部署的 `OPERATOR_PRINCIPALS` 通常是**空的**。
- * 空名单下 `explicitOperatorOk` 对任何身份恒假(那是它与 `isOperator` 刻意分家的地方:空名单绝不等于
- * 「人人都是 operator」),于是:阀门开着、启动成功、两口挂着、**每一次调用 403**,能力位诚实地报
- * `false` —— 唯独运维不知道为什么,而他刚刚显式拧了一根写着 "on" 的旋钮。
+ * 没有运维名册(名单空且没有单用户声明 `OPERATOR_SINGLE_USER`)时 `explicitOperatorOk` 对任何身份恒假(「谁是 operator」的唯一读法:空名单绝不等于
+ * 「人人都是 operator」),于是:阀门开着、启动成功、两口挂着、**每一次调用 501 `capability.operator_principals_required`**(运维面同一只拒发口;403 只留给名单非空而你不在名单上),
+ * 能力位诚实地报 `false` —— 唯独运维不知道为什么,而他刚刚显式拧了一根写着 "on" 的旋钮。
  *
  * ## 为什么是 warn 而不是拒启(与 D1 的三条拒启臂**刻意不同档**)
  *
@@ -322,7 +322,8 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    operatorPrincipals: readonly string[];
+    /** 这台部署有没有运维名册(`operatorRosterPresent`:名单非空 ∨ 单用户声明)—— 判据不在本函数里另写一份。 */
+    operatorRosterPresent: boolean;
     /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
     hasServiceAuth: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */

package/dist/boot/memory-consolidation.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "../trace/redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
 import { memoryMountRootOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
@@ -266,15 +267,15 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (input.operatorPrincipals.length === 0) {
+    if (!input.operatorRosterPresent) {
         warnings.push({
             tag: "memory_consolidation_valve_unreachable",
             detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve and both admin endpoints are mounted, but " +
-                "OPERATOR_PRINCIPALS is EMPTY — an empty operator list means NO ONE is an operator (it deliberately does " +
-                "not mean 'everyone'), so POST /v1/admin/memory/consolidation/run and GET /v1/admin/memory/consolidation " +
-                "answer 403 auth.operator_only to every caller and capabilities.memoryConsolidationDriver reports false. " +
-                "Set OPERATOR_PRINCIPALS to the principal(s) allowed to drive consolidation, and send that principal in " +
-                "the configured principal header. (Not a startup refusal: OPERATOR_PRINCIPALS is shared by every operator " +
+                "this worker has no operator: OPERATOR_PRINCIPALS is EMPTY and OPERATOR_SINGLE_USER is not set — an empty operator list means NO ONE " +
+                "is an operator (it deliberately does not mean 'everyone'), so POST /v1/admin/memory/consolidation/run and GET /v1/admin/memory/consolidation " +
+                "answer 501 capability.operator_principals_required to every caller and capabilities.memoryConsolidationDriver reports false. " +
+                `To fix: ${buildOperatorRosterWayOut()}. With OPERATOR_PRINCIPALS, callers must send a listed principal in the configured principal header; a single-user declaration needs no principal. ` +
+                "(Not a startup refusal: the operator roster is shared by every operator " +
                 "endpoint on this worker, so one valve must not decide whether the whole worker starts.)",
         });
     }

package/dist/boot/org-delivery.d.ts

@@ -0,0 +1,28 @@
+/**
+ * [ref] §10.2 —— 跨主体投递门的**装配点**(门本体与规则在 `src/org-delivery-gate.ts`)。
+ *
+ * 挂载规则(一条):**部署声明了 principal 收件箱的消费方 ⟺ 门在座**。声明 = `RunnerDeps.principalInboxConsumer`
+ * (由 `PRINCIPAL_INBOX_ASSISTANT` 铸,`boot/runner-deps.ts`);门要的四件 —— 消费方、耐久 mailbox、org 成员目录、配额店 ——
+ * 是这条声明的**前提**,不是可选项:声明在而任一件缺 ⇒ **拒启**,拒句点名缺哪件。不存在「声明了但门没挂」的静默半态:
+ * 那一形下收件箱有消费方却没有任何合法的写入方,运维以为跨主体投递开着,wire 上它恒 501。
+ *
+ * 消费方取自**同一个** `RunnerDeps` 对象(`principalInboxConsumerOf(runnerDeps)`),不从 config 再读一遍(core 契约原句:
+ * 「over the same RunnerDeps the deployment runs its legs with」)。
+ */
+import { type MailboxStore, type OrgDeliveryGate, type RunnerDeps } from "@sema-agent/core";
+import type { OrgMemoryDirectory } from "../org-memory-admission.js";
+import type { StoreBackend } from "../plugins/store-backend.js";
+import type { Logger } from "../observability/logger.js";
+export interface OrgDeliveryMountInput {
+    /** 主 Runner 的那一份 `RunnerDeps`(消费方声明从它读)。 */
+    readonly runnerDeps: Pick<RunnerDeps, "principalInboxConsumer">;
+    /** 记忆准入 / memory-policy / 共享记忆读面共用的那一个目录实例(`boot/org-memory.ts`)。 */
+    readonly directory: OrgMemoryDirectory | undefined;
+    /** 与引擎 `RunnerDeps.mailboxStore` 同一只店。 */
+    readonly mailboxStore: MailboxStore | undefined;
+    readonly backend: Pick<StoreBackend, "orgDeliveryQuota"> | undefined;
+    readonly logger: Pick<Logger, "info">;
+}
+/** 门在座 ⇒ 门;部署没声明消费方 ⇒ `undefined`;声明了而前提缺 ⇒ 抛(拒启)。 */
+export declare function mountOrgDeliveryGate(input: OrgDeliveryMountInput): OrgDeliveryGate | undefined;
+//# sourceMappingURL=org-delivery.d.ts.map

package/dist/boot/org-delivery.js

@@ -0,0 +1,20 @@
+import { principalInboxConsumerOf } from "@sema-agent/core";
+import { createOrgDeliveryGate } from "../org-delivery-gate.js";
+export function mountOrgDeliveryGate(input) {
+    const consumer = principalInboxConsumerOf(input.runnerDeps);
+    if (consumer.kind === "none")
+        return undefined;
+    const { mailboxStore, directory, backend } = input;
+    if (mailboxStore === undefined || directory === undefined || backend === undefined) {
+        const missing = [
+            ...(mailboxStore === undefined ? ["a durable mailbox store (DB_BACKEND=mysql|pg|local)"] : []),
+            ...(directory === undefined ? ["an organization membership directory (a web-admin center, or MEMORY_ORG_DIRECTORY_JSON)"] : []),
+            ...(backend === undefined ? ["a store backend for the delivery quota (DB_BACKEND=mysql|pg|local)"] : []),
+        ];
+        throw new Error(`PRINCIPAL_INBOX_ASSISTANT declares a principal-inbox consumer, so this deployment must mount the organization delivery gate — but it lacks ${missing.join("; ")}. ` +
+            `Refusing to boot rather than run with a declared inbox that nothing may legitimately write to; provide the missing pieces or unset PRINCIPAL_INBOX_ASSISTANT.`);
+    }
+    input.logger.info("org_delivery_gate_mounted", { consumer: consumer.kind });
+    return createOrgDeliveryGate({ directory, mailbox: mailboxStore, quota: backend.orgDeliveryQuota(), consumer });
+}
+//# sourceMappingURL=org-delivery.js.map

package/dist/boot/read-deny-anchor-audit.d.ts

@@ -0,0 +1,17 @@
+import type { Logger } from "../observability/logger.js";
+/** 一行 warn 里最多点名的行数(超出只报总数与省略数):一份中心发布可以带很多行,启动日志的一行不随之变长。 */
+export declare const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
+export interface ReadDenyAnchorAuditCtx {
+    /** 部署读拒行(`config.readDenyPatterns`);缺席 / 空 ⇒ 无话可说。 */
+    readonly rows: readonly {
+        readonly pattern: string;
+        readonly caseSensitive: boolean;
+    }[] | undefined;
+    readonly logger: Pick<Logger, "warn">;
+}
+/**
+ * 只由 `announceReadDenyRows` 调(一份值一次)。返回非锚定行的规范形(按配置顺序;无 ⇒ 空),并在有时打**恰一行** warn `read_deny_unanchored_rows`
+ * (`rows` 点名前 {@link READ_DENY_AUDIT_MAX_NAMED_ROWS} 行、`count` 总数、超出时 `omitted`;`note` 引 MIGRATION 第 45 条的改法)。绝不抛。
+ */
+export declare function auditReadDenyAnchoring(ctx: ReadDenyAnchorAuditCtx): readonly string[];
+//# sourceMappingURL=read-deny-anchor-audit.d.ts.map

package/dist/boot/read-deny-anchor-audit.js

@@ -0,0 +1,36 @@
+import { compileReadDeny, readDenyPatternRun } from "@sema-agent/core";
+import { echoCallerText } from "../caller-text-echo.js";
+export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
+const NAMED_ROW_ECHO_CHARS = 200;
+function isAnchoredCanonicalRow(canonical) {
+    return readDenyPatternRun(canonical).homeAnchored || canonical.startsWith("/");
+}
+export function auditReadDenyAnchoring(ctx) {
+    if (ctx.rows === undefined || ctx.rows.length === 0)
+        return [];
+    let canonical;
+    try {
+        canonical = compileReadDeny(ctx.rows, "boot read-deny anchor audit", { tiers: [] }).entries.map((e) => e.pattern);
+    }
+    catch (err) {
+        ctx.logger.warn("read_deny_anchor_audit_failed", {
+            error: echoCallerText(err instanceof Error ? err.message : String(err), { maxChars: 400 }),
+            note: "the boot audit could not read the deployment read-deny rows, so it names none and changes nothing; the engine itself refuses a row it cannot read when the Runner is built",
+        });
+        return [];
+    }
+    const unanchored = canonical.filter((p) => !isAnchoredCanonicalRow(p));
+    if (unanchored.length === 0)
+        return [];
+    const named = unanchored.slice(0, READ_DENY_AUDIT_MAX_NAMED_ROWS).map((p) => echoCallerText(p, { maxChars: NAMED_ROW_ECHO_CHARS }));
+    ctx.logger.warn("read_deny_unanchored_rows", {
+        rows: named,
+        count: unanchored.length,
+        ...(unanchored.length > named.length ? { omitted: unanchored.length - named.length } : {}),
+        note: "recursive shell reads (grep -r and the like) are judged by the root the command names: a read-deny row spelled without a root or home anchor does not protect files below that root " +
+            "(reading from a parent directory returns their content; naming the directory or file itself is still refused). Anchor the row to protect it — `<workspace root>/…` or `~/…` — see MIGRATION 7.132.0 item 45. " +
+            "This notice changes nothing: enforcement is unchanged and the start is not refused",
+    });
+    return unanchored;
+}
+//# sourceMappingURL=read-deny-anchor-audit.js.map

package/dist/boot/reapers.d.ts

@@ -25,6 +25,7 @@ import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type AuditRotationPort } from "../approval-ask-retention.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -108,6 +109,8 @@ export interface ReapersCtx {
      *  受理的最后一刻),所以存量是「到达率 × TTL」而不是历史总量,清扫无需分批。无 backend 的 env-only
      *  部署 ⇒ undefined ⇒ 本腿零调用(那种部署也没有 durable 审批门)。 */
     approvalNonceStore: ApprovalNonceStore | undefined;
+    /** local 车道的审批审计账(装配三合取见 `boot/coordinators.ts`;SQL 车道 / 审批关着 ⇒ undefined)—— 本 tick 只用它的**留存轮转**一手。 */
+    approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
 }

package/dist/boot/reapers.js

@@ -4,6 +4,7 @@ import { CostQuota } from "../observability/cost-quota.js";
 import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
+import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
@@ -56,7 +57,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -101,6 +102,17 @@ export function startReapers(ctx) {
     const leaderRunStaleGuard = createThrottledReaperCatch("leader_run_reap_stale", logger);
     const leaderRunStore = config.leaderEnabled ? backend?.leaderRun?.() : undefined;
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
+    const approvalAskRetentionMs = config.approvalAskRetentionMs;
+    const approvalAskRetentionGuard = createThrottledReaperCatch("approval_ask_retention", logger);
+    let approvalAskRetentionLastRunMs = Number.NEGATIVE_INFINITY;
+    let approvalAskRetentionInFlight = false;
+    logger.info("approval_ask_retention", {
+        windowMs: approvalAskRetentionMs,
+        ledgers: { asks: backend !== undefined, audit: approvalAskAudit !== undefined },
+        note: approvalAskRetentionMs > 0
+            ? "settled approval asks quiet for longer than windowMs are deleted whole from the approval ledgers on the maintenance tick (at most once an hour); unsettled asks, and every ask hanging off something that can still move (a running / parked run or delegated child, by run id or session), are never aged out. APPROVAL_ASK_RETENTION_MS=0 keeps everything."
+            : "APPROVAL_ASK_RETENTION_MS=0 — the approval ledgers are kept forever (nothing is aged out).",
+    });
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
     let approvalSuspendedPollInFlight = false;
@@ -325,6 +337,14 @@ export function startReapers(ctx) {
             if (permissionRuleStores?.reapExpired === undefined)
                 permissionRuleReapInFlight = false;
         }
+        if (approvalAskRetentionMs > 0 && runStore !== undefined && !approvalAskRetentionInFlight && Date.now() - approvalAskRetentionLastRunMs >= APPROVAL_ASK_RETENTION_PASS_MS && (backend !== undefined || approvalAskAudit !== undefined)) {
+            approvalAskRetentionInFlight = true;
+            approvalAskRetentionLastRunMs = Date.now();
+            leg(Promise.resolve()
+                .then(() => runApprovalAskRetentionPass({ askStore: backend?.approvalAsk(), audit: approvalAskAudit, runs: runStore, backgroundAgents: backgroundAgentStore, checkpoints: backend?.checkpointReadView(), cutoffMs: Date.now() - approvalAskRetentionMs, logger, metrics }))
+                .then(() => approvalAskRetentionGuard.onSuccess(), approvalAskRetentionGuard.onError)
+                .finally(() => (approvalAskRetentionInFlight = false)));
+        }
         if (config.scratchpadSweepTtlMs > 0) {
             leg(sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
                 .then((removed) => {