@sema-agent/server 7.132.0 → 7.133.0

package/dist/config-provider.js

@@ -2,6 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
@@ -75,12 +76,15 @@ export class LocalConfigProvider {
     store;
     root;
     #injectedStore;
-    constructor(root, store) {
+    #declaredOwnerUid;
+    constructor(root, store, trust = { declaredOwnerUid: undefined }) {
         this.root = root;
         this.#injectedStore = store;
         this.store = store ?? new FileConfigStore(root);
+        this.#declaredOwnerUid = trust.declaredOwnerUid;
     }
     async fetchEffective(etag) {
+        await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
         const readWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
@@ -245,7 +249,7 @@ export function mapToServiceEffective(eff, version) {
 export function createConfigProvider(input) {
     return configProviderKind(input) === "remote" && input.webAdmin !== undefined
         ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
-        : new LocalConfigProvider(input.localDir);
+        : new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");

package/dist/config-types.d.ts

@@ -19,6 +19,7 @@ import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
+import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 import type { AtMention } from "@sema-agent/settings-schema";
@@ -148,6 +149,35 @@ export declare const FIRST_BYTE_TIMEOUT_BOUNDS: {
     readonly minMs: 0;
     readonly maxMs: 2147483647;
 };
+/**
+ * 整数合法域(闭区间)的**一种说法**:device 车道的数值旋钮(`DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` /
+ * `DEVICE_DELIVERY_TIMEOUT_MS` / `DEVICE_EXEC_TIMEOUT_MS`)、汇聚端创建时对 helloAck 六个数值位的校验、协议文档与配置目录的合法域句,
+ * 都问这一只判据、读这一句话 —— 判据与说法各只有一处。`max === Number.MAX_SAFE_INTEGER` 读作「无上界」(JSON 数字在 2^53−1 内精确)。
+ */
+export interface WholeNumberBounds {
+    readonly min: number;
+    readonly max: number;
+}
+/** `value` 是落在 `bounds` 内的安全整数(NaN / ±Infinity / 小数 / 非数 / 越界全否)。 */
+export declare function inWholeNumberBounds(bounds: WholeNumberBounds, value: unknown): value is number;
+/** 合法域的一句话:`an integer in [0, 2147483647]` / `an integer ≥ 1`(无上界时)。拒句与协议文档读同一句。 */
+export declare function wholeNumberBoundsRule(bounds: WholeNumberBounds): string;
+/**
+ * device 车道两根**不上 helloAck** 的数值旋钮的合法域(上 helloAck 的另两根 —— `DEVICE_RECONNECT_GRACE_MS` / `DEVICE_MAX_INFLIGHT_PER_DEVICE` ——
+ * 的界属协议,见 `device-ws-protocol.ts` 的 `DEVICE_HELLO_ACK_BOUNDS`)。解析器(`config.ts`)与配置目录行共读这一处。
+ *
+ *  · `DEVICE_DELIVERY_TIMEOUT_MS`(等 per-device 在途槽的上限):下界 `0` = 不排队,槽满即 `device.busy`,是真含义;
+ *  · `DEVICE_EXEC_TIMEOUT_MS`(指令级默认超时,进每条指令帧的 `timeoutMs`):下界 `1` —— `0` 会让每条没自带超时的指令出生即超时;
+ *  · 两者上界 = {@link MAX_TIMER_DELAY_MS}:排队计时与指令级超时都从这两个数起算 `setTimeout` 的 delay,更大的值被 Node 折成 1 ms。
+ */
+export declare const DEVICE_DELIVERY_TIMEOUT_BOUNDS: {
+    readonly min: 0;
+    readonly max: 2147483647;
+};
+export declare const DEVICE_EXEC_TIMEOUT_BOUNDS: {
+    readonly min: 1;
+    readonly max: 2147483647;
+};
 /**
  * S-220 —— **`resilience` 块缺省的唯一属主**(S-202 的单源从一根扩到整族)。
  *
@@ -1108,8 +1138,8 @@ export interface ServiceConfigFlat {
         presignTtlSec?: number;
     };
     /** (a)(clay 拍 a+c,2026-07-27)SQL 默认店的 per-blob 帽显式覆写(字节)。未设 ⇒ `sqlBlobDefaultCapBytes`
-     *  的方言默认(MySQL 协议 = 库报的单行上限与包墙 `max_allowed_packet` ÷ 2 取小;事实还没建立 6MiB = TiDB 默认 txn-entry-size-limit;
-     *  pg=不设帽);设了 ⇒ 两方言都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
+     *  按**将要写入的那条连接**报的两堵墙推导(MySQL 协议 = 单行上限 − 64 KiB 与 ⌊(包墙 `max_allowed_packet` − 1 KiB) ÷ 2⌋ 取小;
+     *  pg 连接两堵都没有 = 不设帽);设了 ⇒ 两方言都生效(调高过 entry/packet 限的部署放宽用)。软旋钮:坏值=undefined 走默认。 */
     snapshotBlobSqlMaxBytes?: number;
     /** (c) 的显式逃生口:云形(mysql|pg 后端)缺 MinIO 本应 boot fail-loud(bytes-in-DB 撞包墙已两役
      *  实证,大字节归对象存储);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` 显式接受 SQL 店 + (a) 的帽
@@ -1273,11 +1303,16 @@ export interface ServiceConfigFlat {
     retentionSweep: RetentionSweepConfig;
     /** Tool names that require operator approval before running (F4). Empty = no approval gate. */
     approvalRequire: string[];
-    /** Principals allowed to act as OPERATORS on the F4 approval queue (`/v1/approvals`): list ANY
-     *  owner's pending + decide (approve/deny). A non-operator principal may only LIST ITS OWN pending and
-     *  CANNOT decide (a requester approving its own high-risk op would defeat the gate). **Empty/unset =
-     *  legacy behavior** (the shared service token IS the operator boundary — back-compat). */
+    /** Principals allowed to act as OPERATORS (`OPERATOR_PRINCIPALS`): every operator face reads it through the one reading
+     *  `explicitOperatorOk` (`http/principal-gate.ts`) — e.g. the F4 approval queue (`/v1/approvals`): list ANY owner's pending +
+     *  decide. A non-operator principal may only LIST ITS OWN pending. **Empty = no one is an operator** (S-1050: the old
+     *  "empty = everyone on the approval queue" reading is gone); a single-user deployment that wants to be its own operator
+     *  declares {@link operatorSingleUser}. */
     operatorPrincipals: string[];
+    /** `OPERATOR_SINGLE_USER=true` —— 单用户形显式声明「这台部署的每个调用方都是运维」(S-1050,[ref] ① 裁 A)。缺席 = 不声明(没人是,除非在名单里)。
+     *  只在单用户形(`REQUIRE_PRINCIPAL` 未开)且名单为空时成立 —— 否则拒启(`config-invariants.ts` 的 `operator-single-user`:一个事实一个来源)。
+     *  env 独有(没有中心写位),起服冻结。读法只有 `explicitOperatorOk` / `operatorRosterPresent` 两只。 */
+    operatorSingleUser?: boolean;
     /**
      * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
      * 默认 **ON**(设计稿 §0.5:合规部署可关)。端点本身已是 operator-only(`explicitOperatorOk`,
@@ -1470,8 +1505,10 @@ export interface ServiceConfigFlat {
     /** SVC-1: the durable WorkflowRunStore backend for BACKGROUND workflow runs.
      *  `auto` (DEFAULT) = the SQL-backed cross-replica store when a SQL backend is configured, else the
      *  crash-safe `FileWorkflowRunStore` ledger under `localDataRoot/workflows` (dispatch: main.ts, keyed off
-     *  `sqlWorkflowRunStore` presence). `file` = force the file ledger even with SQL present (single-replica
-     *  pinning). Either durable form means a background run's record SURVIVES a restart, which is what lets the
+     *  `sqlWorkflowRunStore` presence). `file` = force the file ledger — on the local backend only: with a SQL backend
+     *  and SELF_ORCHESTRATION_ENABLED, `file` / `memory` are refused at start (the workflow park decision store must
+     *  live where the session claims live and be reaped with the records; no store does both off the database —
+     *  `parkDecisionStoreRefusal`). Either durable form means a background run's record SURVIVES a restart, which is what lets the
      *  at-least-once completion notify re-derive a run's terminal state after a crash. `memory` = the ephemeral
      *  `InMemoryWorkflowRunStore` (process-local; no crash recovery, no notify journal) — an explicit opt-out for
      *  a single-instance/ephemeral deployment. ([ref]: the old docblock claimed `file` was the default and
@@ -1527,7 +1564,7 @@ export interface ServiceConfigFlat {
     planModeEnabled: boolean;
     /**
      * `HOOKS_TIMEOUT_MS` —— 请求 `settings.hooks` 那张 mods 注册(`settings.hooks`)每个 handler 的时间预算(ms;一个事件跑一遍本请求的钩子条目)。
-     * **缺席 = 不铸键**;唯一读法 = `hooks/hook-runner.ts` 的 `settingsHooksBudgetMs`(未设 ⇒ 600000,本服务跑钩子子进程的界)。
+     * **缺席 = 不铸键**;唯一读法 = `hooks/hook-runner.ts` 的 `settingsHooksBudgetMs`(未设 ⇒ 600000,单条命令超时的上限;这只数是引擎的钟,不是钩子子进程的墙钟)。
      *
      * 🔴 `0` 是有效值(引擎按字面:零预算,下一个定时器拍就到期),不是「未设」;
      * 坏值(非整数 / 负 / 超 `setTimeout` 32 位上限)**拒启**,解析见 config.ts `parseHooksTimeoutEnv`。
@@ -1602,6 +1639,11 @@ export interface ServiceConfigFlat {
      *  nothing (the pre-2026-07-13 unset behavior — byte-identical sandbox). Operator env `SANDBOX_PKG_SOURCE`;
      *  per-region via the registry effective-config (shell B3) later. */
     sandboxPkgSource?: string;
+    /** The explicit addresses of `SANDBOX_PKG_SOURCE=custom` (`SEMA_APT_MIRROR` / `SEMA_PIP_INDEX` / `SEMA_UV_INDEX` / `SEMA_UV_PY_MIRROR` /
+     *  `SEMA_NPM_REGISTRY` / `SEMA_NODE_MIRROR`), read and judged ONCE at load by `customPkgSourceFromEnv` (a value with userinfo — or a shape
+     *  the URL judge cannot call credential-free — refuses startup) and handed to the sandbox lanes' env composer from here: the lane never
+     *  reads `process.env` for them again. Present iff the profile is `custom` AND at least one address is set. */
+    sandboxPkgSourceCustom?: CustomPkgSource;
     /** Auto-generate a session title at first submit (one cheap-model call per
      *  session; fills a NULL title only — a title the user set via `PATCH /v1/sessions/:id` is never overwritten).
      *  Default ON; `SESSION_AUTO_TITLE=false` opts out. */
@@ -1633,7 +1675,7 @@ export interface ServiceConfigFlat {
      *  `deriveSettingsPolicy` 的 fs-write gate 闭包里,而那个闭包只在 default/auto/acceptEdits 三臂被调用 ⇒
      *  `bypassPermissions` / `permissionMode` 键缺席(headless `-p` 的默认姿势)/ body 连 settings 都没有
      *  这三形整条 DENY 腿不建(邻仓 46 格真机矩阵实证)。裁决 env 仍按 lane 分形(host 真 fs / 沙箱
-     *  `DeferredSandboxPathEnv` 代理),与 fs-write ask 门同一份、单点构造。
+     *  `DeferredSandboxPathEnv` 代理),单点构造(resolve-spec 的 `pathAdjudication`)。
      *  折叠仍是 deny-wins(tightenTaskSpec ⇒ combinePolicies),所以会话豁免 / acceptEdits 自动 allow /
      *  客户端 settings allow 一律越不过它;非守卫目标该 policy 返回 `action:"allow"`(core 的 ToolPolicy
      *  没有「无意见」第三态;这个 allow 在 combinePolicies 的 deny/ask 优先折叠里不构成一票,故在折叠
@@ -1739,6 +1781,11 @@ export interface ServiceConfigFlat {
      *  不静默吞)。`"never"` = 不设期限。**未设 ⇒ 不铸键**,由引擎落它自己的缺省(`"5m"`)——本仓不复制上游
      *  缺省值。词表外 boot 拒启。⚠️ CC 同名键还有第二个消费面(远端审批对话框停靠时长),本旋钮今天不驱动它。 */
     crossSessionDialogExpiry?: CrossSessionDialogExpiry;
+    /** [ref] §10.2 —— principal 收件箱(`principal.inbox`)的消费方声明:独占读它的那只助理的 agent handle
+     *  (`PRINCIPAL_INBOX_ASSISTANT`)→ core `RunnerDeps.principalInboxConsumer: { assistant }`。**它就是跨主体投递车道的开关**:
+     *  在场 ⇒ 装配挂投递门(`org-delivery-gate.ts`)与受理口 `POST /v1/principal-inbox/messages`,前提(耐久 mailbox / org 成员
+     *  目录 / 配额店)缺一拒启;缺席 ⇒ 不铸座、不挂门(收件箱这条车道整条不存在)。判形归 core `principalInboxConsumerOf`。 */
+    principalInboxAssistant?: string;
     /** [ref]④ defer face (EXPERIMENTAL, default OFF): mark the default scenario's LONG-TAIL first-party tools
      *  (today = SelectEnvironment only) `defer:true` (core tool-disclosure: the model sees a placeholder until it
      *  ToolSearch-loads the schema). Assessment says the win is marginal for us (spec.tools total ≈4.2k tokens, of
@@ -2100,6 +2147,12 @@ export interface ServiceConfigFlat {
     };
     /** Expire pending approvals older than this (seconds). 0 disables the reaper. */
     approvalTimeoutSec: number;
+    /**
+     * 审批账本(问账三形 + local 审计账)的保留窗(ms):一问结了且最后一次动静早于 `now − 本值`,它的全部记录由维护 tick 整问删掉;
+     * 没结的问永不按龄删。`0` = 不删(永久保留)。缺省 30 天;正值下限 1 天(低于即钳 + 点名);负值 / 非整数拒启。
+     * 律、节律与下限的理由一处成文在 `approval-ask-retention.ts`。`APPROVAL_ASK_RETENTION_MS`。
+     */
+    approvalAskRetentionMs: number;
     /** Background reaper interval (seconds) for stale runs / expired approvals / rate windows. */
     reapIntervalSec: number;
     /** TTL (seconds) for offloaded tool results in the durable store. Must comfortably exceed a run's
@@ -2196,6 +2249,10 @@ export interface ServiceConfigFlat {
     configProvider?: ConfigProviderWord;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */
     configLocalDir?: string;
+    /** 本地配置源的目录信任判官(`config-dir-trust.ts`)多信的那一个属主 uid —— 本服务用户与 root 之外,`config.d` 及其路径上的目录与文档还可以属于谁
+     *  (userns-remap 的 bind-mount 呈现为未映射 uid、运维用户持有的配置)。只放宽属主判据,模式判据照校。缺席 = 只信本服务用户与 root。
+     *  Env: CONFIG_LOCAL_OWNER_UID(形错拒启;解析口 `parseConfigLocalOwnerUid`)。 */
+    configLocalOwnerUid?: number;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
@@ -2203,7 +2260,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
@@ -2212,15 +2269,15 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config-types.js

@@ -15,6 +15,14 @@ export function fleetScopeOf(raw) {
 export const CENTER_BASE_URL_RULE = "设了就必须是可解析的 http(s) URL,且不带凭据 / query / fragment(基址后面要拼路径);坏形拒启(没接中心也拒),拒句只点名规则,不回显 scheme";
 export const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86_400_000;
 export const FIRST_BYTE_TIMEOUT_BOUNDS = { minMs: 0, maxMs: MAX_TIMER_DELAY_MS };
+export function inWholeNumberBounds(bounds, value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= bounds.min && value <= bounds.max;
+}
+export function wholeNumberBoundsRule(bounds) {
+    return bounds.max === Number.MAX_SAFE_INTEGER ? `an integer ≥ ${bounds.min}` : `an integer in [${bounds.min}, ${bounds.max}]`;
+}
+export const DEVICE_DELIVERY_TIMEOUT_BOUNDS = { min: 0, max: MAX_TIMER_DELAY_MS };
+export const DEVICE_EXEC_TIMEOUT_BOUNDS = { min: 1, max: MAX_TIMER_DELAY_MS };
 export const RESILIENCE_DEFAULTS = {
     firstTokenTimeoutMs: { env: "MODEL_FIRST_TOKEN_TIMEOUT_MS", value: 600_000 },
     idleTimeoutMs: { env: "MODEL_IDLE_TIMEOUT_MS", value: 300_000 },

package/dist/config.d.ts

@@ -288,6 +288,11 @@ export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]):
 export interface UnmatchableToolName {
     name: string;
     guidance: string;
+    /**
+     * 这一条为什么永远不生效 —— 机读位的 `reason`(`entry-problems.ts`):引擎名字判官的判词 `retired` / `unmintable_segment` / `unprefixed_namespace`、引擎规则文法的码原样(`invalid.*` /
+     * `unsupported.*`)、近似名 `near_miss`、名表消费者的 CC 规则形 `cc_rule_form`。句子里的 `guidance` 给人读,本字给机器读;两者在同一处同时铸。
+     */
+    reason: string;
 }
 /**
  * S-177(core 7.9.0 [ref])—— **这条名单条目喂给谁**,决定「永不匹配」这句话怎么判。三个消费者形态:
@@ -327,6 +332,14 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
     readonly message: string;
     readonly names: readonly string[];
 } | undefined;
+/**
+ * {@link unmatchableToolNamesRefusal} 的本体:判一遍,句子(点名有界)与**全部**坏条目(每条带 `reason`)同时交出 —— 需要机读位的调用方(请求的 `settings.permissions.deny` / `ask` 的 422 与存体预判)读 `bad`,
+ * 只要句子与条目名的调用方(env / 中心下发的拒启)读上面那只薄壳。判据与句子只此一份。
+ */
+export declare function judgeUnmatchableToolNames(source: string, names: readonly string[], judgment: UnmatchableToolNameJudgment): {
+    readonly message: string;
+    readonly bad: readonly UnmatchableToolName[];
+} | undefined;
 /**
  * 运维 allow 表 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:返回句子 = 拒,`undefined` = 通过)。
  * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张