@sema-agent/server 7.132.0 → 7.133.0

package/dist/project-identity.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
+import { encodeScopeSegment } from "@sema-agent/core";
+import { mintProjectLayerKey, PROJECT_LAYER_KEY_PREFIX, projectLayerOwnerOf } from "./project-layer-key.js";
 const UNREADABLE = { absent: "unreadable" };
 const BARE = { absent: "bare" };
 function isMissing(err) {
@@ -53,7 +55,7 @@ function identityOfGitFile(dir) {
     const gitDir = gitDirFact.ok;
     const commonText = readTextFact(join(gitDir, "commondir"));
     if (commonText === "missing")
-        return { root: dir };
+        return { root: dir, gitConfig: join(gitDir, "config") };
     if (commonText === "unreadable")
         return UNREADABLE;
     const commonFact = realpathFact(resolve(gitDir, commonText.ok));
@@ -68,7 +70,7 @@ function identityOfGitFile(dir) {
     const backFact = realpathFact(resolve(gitDir, back.ok));
     if (typeof backFact !== "object" || backFact.ok !== join(dir, ".git"))
         return UNREADABLE;
-    return { root: basename(common) !== ".git" ? common : dirname(common) };
+    return { root: basename(common) !== ".git" ? common : dirname(common), gitConfig: join(common, "config") };
 }
 function canonicalTaskRoot(taskRoot) {
     const rest = [];
@@ -86,6 +88,10 @@ function canonicalTaskRoot(taskRoot) {
     }
 }
 export function resolveProjectIdentity(taskRoot) {
+    const located = locateProject(taskRoot);
+    return "root" in located ? { root: located.root } : located;
+}
+function locateProject(taskRoot) {
     const root = canonicalTaskRoot(taskRoot);
     if (root === "unreadable")
         return UNREADABLE;
@@ -96,7 +102,7 @@ export function resolveProjectIdentity(taskRoot) {
             return UNREADABLE;
         if (typeof dotGit === "object") {
             if (dotGit.ok === "dir")
-                return { root: dir };
+                return { root: dir, gitConfig: join(dir, ".git", "config") };
             if (dotGit.ok === "file")
                 return identityOfGitFile(dir);
         }
@@ -108,13 +114,161 @@ export function resolveProjectIdentity(taskRoot) {
         dir = parent;
     }
 }
+function digest24(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex").slice(0, 24);
+}
+const RETIRED_PROJECT_KEY_PREFIX = "repo:";
 export function mintRepoScopeKey(projectRoot) {
-    return `repo:${createHash("sha256").update(projectRoot, "utf8").digest("hex").slice(0, 24)}`;
+    return `${RETIRED_PROJECT_KEY_PREFIX}${digest24(projectRoot)}`;
+}
+export function isServerMintedProjectKey(key) {
+    return key.startsWith(PROJECT_LAYER_KEY_PREFIX) || key.startsWith(RETIRED_PROJECT_KEY_PREFIX);
+}
+export function assertProjectLayerOwnable(scope, envName) {
+    if (isServerMintedProjectKey(scope)) {
+        throw new Error(`${envName}=${JSON.stringify(scope)} names a server-minted project-layer key (the "${PROJECT_LAYER_KEY_PREFIX}" family, or the retired "${RETIRED_PROJECT_KEY_PREFIX}" family) — ` +
+            "project layers are derived per task from the project identity and cannot be named as a deployment scope. Use a user key (user:<principal>) or a plain name.");
+    }
+    const owner = ownerSegmentFact(scope);
+    if (!owner.ok) {
+        throw new Error(`${envName}=${JSON.stringify(scope)} cannot own per-project memory layers: ${owner.why} — ` +
+            "the layer owner (the principal of a user: key, otherwise the name itself) must encode to at most 64 scope-segment characters.");
+    }
+}
+function ownerSegmentFact(scope) {
+    try {
+        encodeScopeSegment(projectLayerOwnerOf(scope));
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, why: err instanceof Error ? err.message : String(err) };
+    }
+}
+const GIT_CONFIG_MAX_BYTES = 256 * 1024;
+function readOriginRemoteUrl(configPath) {
+    const st = statFact(configPath);
+    if (st === "missing")
+        return "missing";
+    if (st === "unreadable" || st.ok !== "file")
+        return "unreadable";
+    let size;
+    try {
+        size = statSync(configPath).size;
+    }
+    catch (err) {
+        return isMissing(err) ? "missing" : "unreadable";
+    }
+    if (size > GIT_CONFIG_MAX_BYTES)
+        return "unreadable";
+    const text = readTextFact(configPath);
+    if (typeof text !== "object")
+        return text;
+    let inOrigin = false;
+    for (const raw of gitConfigLogicalLines(text.ok)) {
+        const line = raw.trim();
+        if (line.startsWith("[")) {
+            const header = /^\[\s*([A-Za-z0-9.-]+)(?:\s+"((?:[^"\\]|\\.)*)")?\s*\]/.exec(line);
+            inOrigin = header !== null && header[1].toLowerCase() === "remote" && header[2] !== undefined && header[2].replace(/\\(.)/g, "$1") === "origin";
+            continue;
+        }
+        if (!inOrigin)
+            continue;
+        const kv = /^([A-Za-z][A-Za-z0-9-]*)\s*=\s*(.*)$/.exec(line);
+        if (kv === null || kv[1].toLowerCase() !== "url")
+            continue;
+        const value = gitConfigValue(kv[2]);
+        if (value !== "")
+            return { ok: value };
+    }
+    return { ok: undefined };
+}
+function gitConfigLogicalLines(text) {
+    const out = [];
+    let pending = "";
+    for (const physical of text.split(/\r?\n/)) {
+        const trailing = /\\*$/.exec(physical)[0].length;
+        if (trailing % 2 === 1) {
+            pending += physical.slice(0, -1);
+            continue;
+        }
+        out.push(pending + physical);
+        pending = "";
+    }
+    if (pending !== "")
+        out.push(pending);
+    return out;
+}
+function gitConfigValue(raw) {
+    let out = "";
+    let quoted = false;
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw[i];
+        if (c === "\\" && i + 1 < raw.length) {
+            out += raw[++i];
+            continue;
+        }
+        if (c === '"') {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && (c === "#" || c === ";"))
+            break;
+        out += c;
+    }
+    return out.trim();
+}
+const DEFAULT_REMOTE_PORTS = { ssh: "22", "git+ssh": "22", "ssh+git": "22", https: "443", http: "80", git: "9418" };
+export function normalizeGitRemoteUrl(url) {
+    const u = url.trim();
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/(.*)$/.exec(u);
+    if (scheme !== null) {
+        const name = scheme[1].toLowerCase();
+        if (name === "file")
+            return undefined;
+        const rest = scheme[2];
+        const slash = rest.indexOf("/");
+        const authority = slash < 0 ? rest : rest.slice(0, slash);
+        const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+        const port = /:(\d*)$/.exec(hostPort);
+        const host = (port === null ? hostPort : hostPort.slice(0, port.index)).toLowerCase();
+        if (host === "")
+            return undefined;
+        const keptPort = port !== null && port[1] !== "" && port[1] !== DEFAULT_REMOTE_PORTS[name] ? `:${port[1]}` : "";
+        return `${host}${keptPort}/${cleanRemotePath(slash < 0 ? "" : rest.slice(slash))}`;
+    }
+    const scp = /^(?:[^@/]+@)?([^:/]{2,}):(.*)$/.exec(u);
+    if (scp !== null)
+        return `${scp[1].toLowerCase()}/${cleanRemotePath(scp[2])}`;
+    return undefined;
 }
-export function projectKeyForTaskRoot(taskRoot) {
+function cleanRemotePath(p) {
+    return p.replace(/\/+/g, "/").replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+}
+export function projectLayerIdentityOf(taskRoot) {
+    const located = locateProject(taskRoot);
+    if (!("root" in located))
+        return located;
+    const path = { tier: "p", digest: digest24(located.root) };
+    const origin = located.gitConfig !== undefined ? readOriginRemoteUrl(located.gitConfig) : "missing";
+    if (origin === "unreadable")
+        return UNREADABLE;
+    const remote = origin === "missing" || origin.ok === undefined ? undefined : normalizeGitRemoteUrl(origin.ok);
+    if (remote === undefined)
+        return { root: located.root, identity: path, lowerTiers: [] };
+    return { root: located.root, identity: { tier: "r", digest: digest24(remote) }, lowerTiers: [path] };
+}
+export function projectLayerForTaskRoot(taskRoot, owner) {
     if (taskRoot === undefined)
-        return { absent: "unreadable" };
-    const id = resolveProjectIdentity(taskRoot);
-    return "root" in id ? { scope: mintRepoScopeKey(id.root) } : { absent: id.absent };
+        return { key: UNREADABLE, foldFrom: [] };
+    const id = projectLayerIdentityOf(taskRoot);
+    if (!("identity" in id))
+        return { key: { absent: id.absent }, foldFrom: [] };
+    return {
+        key: { scope: mintProjectLayerKey(owner, id.identity) },
+        foldFrom: [mintRepoScopeKey(id.root), ...id.lowerTiers.map((tier) => mintProjectLayerKey(owner, tier))],
+    };
+}
+export function projectKeyForTaskRoot(taskRoot, owner) {
+    return projectLayerForTaskRoot(taskRoot, owner).key;
 }
 //# sourceMappingURL=project-identity.js.map

package/dist/project-layer-key.d.ts

@@ -0,0 +1,28 @@
+/** 项目层键的前缀(改名链的前缀词表也读它)。 */
+export declare const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
+/** 身份档:`r` = 仓库身份(origin 远端,跨设备),`p` = 项目根路径(本机)。 */
+export type ProjectIdentityTier = "r" | "p";
+/** 一个项目的身份段(档 + 24 位小写十六进制摘要)。 */
+export interface ProjectLayerIdentity {
+    readonly tier: ProjectIdentityTier;
+    readonly digest: string;
+}
+/** 解出的项目层键。 */
+export interface ParsedProjectLayerKey {
+    /** 解码后的属主(主体名,或不透明全局层名本身)。 */
+    readonly owner: string;
+    readonly identity: ProjectLayerIdentity;
+}
+/**
+ * 全局层 → 它的属主(见文件头文法)。`user:` 形用 core 的解析(段解码、规范形校验);坏的 `user:` 形照 core 原样抛
+ * (`config.memory_scope_key`)—— 起服经 `project-identity.ts` `assertProjectLayerOwnable` 在第一刻接住,不留到任务期。
+ */
+export declare function projectLayerOwnerOf(globalScope: string): string;
+/** 铸项目层键。属主编码超长 / 空 ⇒ core 段编码原样抛(起服已由 `assertProjectLayerOwnable` 拦住)。 */
+export declare function mintProjectLayerKey(owner: string, identity: ProjectLayerIdentity): string;
+/**
+ * 解项目层键。**严格**:前缀 + 恰好一个 `/` + 规范形属主段(`%41` 这类第二种拼法不认 —— 一个属主不许有两把键)+ 档文法。
+ * 不合任何一条 ⇒ `undefined`(调用方读作「不是项目层」;属主门据此答与其余拒绝同体的 404)。
+ */
+export declare function parseProjectLayerKey(key: string): ParsedProjectLayerKey | undefined;
+//# sourceMappingURL=project-layer-key.d.ts.map

package/dist/project-layer-key.js

@@ -0,0 +1,29 @@
+import { decodeScopeSegment, encodeScopeSegment, parseScopeKey } from "@sema-agent/core";
+export const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
+const DIGEST = /^[0-9a-f]{24}$/;
+const KEY = /^userrepo:((?:[A-Za-z0-9._-]|%[0-9A-F]{2})+)\/([rp])\.([0-9a-f]{24})$/;
+export function projectLayerOwnerOf(globalScope) {
+    const parsed = parseScopeKey(globalScope);
+    return parsed.kind === "user" ? parsed.principal : globalScope;
+}
+export function mintProjectLayerKey(owner, identity) {
+    if (!DIGEST.test(identity.digest))
+        throw new Error(`project layer identity digest must be 24 lowercase hex characters, got ${JSON.stringify(identity.digest)}`);
+    return `${PROJECT_LAYER_KEY_PREFIX}${encodeScopeSegment(owner)}/${identity.tier}.${identity.digest}`;
+}
+export function parseProjectLayerKey(key) {
+    const m = KEY.exec(key);
+    if (m === null)
+        return undefined;
+    const owner = decodeOwnerSegment(m[1]);
+    return owner.ok ? { owner: owner.owner, identity: { tier: m[2], digest: m[3] } } : undefined;
+}
+function decodeOwnerSegment(segment) {
+    try {
+        return { ok: true, owner: decodeScopeSegment(segment) };
+    }
+    catch (err) {
+        return { ok: false, why: err instanceof Error ? err.message : String(err) };
+    }
+}
+//# sourceMappingURL=project-layer-key.js.map

package/dist/question.js

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { refusalBody } from "./http/refusal-body.js";
 const MAX_QUESTIONS_BYTES = 16384;
 function isFaceReachable(ctx) {
     if (ctx.deliverable === undefined)
@@ -150,10 +151,10 @@ export class QuestionCoordinator {
     respond(id, principal, body) {
         const parsed = parseQuestionResponse(body);
         if (!parsed.ok)
-            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape" } };
+            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: parsed.error }) };
         const entry = this.pending.get(id);
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
-            return { status: 404, body: { error: "no pending question for this id (answered, expired, or not on this replica)", errorCode: "question.not_pending" } };
+            return { status: 404, body: refusalBody({ errorCode: "question.not_pending", message: "no pending question for this id (answered, expired, or not on this replica)" }) };
         }
         entry.settle(parsed.value, "answered");
         return { status: 200, body: { questionId: id, delivery: "applied" } };

package/dist/read-deny-entry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * **读拒模式条目的归一**(全仓唯一一只读法)—— `READ_DENY_PATTERNS` 的 env 腿(`config.ts`)、中心下发 `readFace.denyPatterns` 的腿(`web-admin-client/read-face.ts`)、
+ * 请求 `settings.readDenyPatterns` 的腿(`tighten-only-seats.ts`)三处读同一份元素文法:`"pattern"` 裸串简写 ≡ `{ pattern, caseSensitive: false }`,
+ * 对象形 `{ pattern: string, caseSensitive?: boolean }`(与 core `ReadDenyEntry = string | {…}` 同宽)。三份手抄的元素读法就是三个会各自漂的真源,所以收成这一只。
+ *
+ * 只管**元素形**(串 / 带串 `pattern` 的对象 / 布尔 `caseSensitive`);模式编不编得过由调用方交给 core 的 `compileReadDeny`(引擎同一套规则,宿主不自造第二份校验语义)。
+ * 返回的是**接在坐标后面的原因尾巴**(` must be a string or an object with a string 'pattern'` / `.caseSensitive must be boolean when present`),不带坐标 —— 调用方自己前缀坐标
+ * (`READ_DENY_PATTERNS[2]` / `readFace.denyPatterns[2]` / `settings.readDenyPatterns[2]`),各腿既有的拒句字节不变。叶模块,零 import。
+ */
+/** 归一后的一行(core `compileReadDeny` 收的对象形)。 */
+export interface NormalizedReadDenyEntry {
+    readonly pattern: string;
+    readonly caseSensitive: boolean;
+}
+/** 一个元素的读数:归一后的行,或接在调用方坐标后面成句的原因尾巴(`after` 自带连接符:空格或点)。 */
+export type ReadDenyEntryReading = {
+    readonly ok: true;
+    readonly entry: NormalizedReadDenyEntry;
+} | {
+    readonly ok: false;
+    readonly after: string;
+};
+/** 读一个元素。裸串 ⇒ 大小写默认不敏感(与对象形缺席 `caseSensitive` 一致);坏形 ⇒ 原因子句,不抛、不丢。 */
+export declare function readReadDenyEntry(it: unknown): ReadDenyEntryReading;
+//# sourceMappingURL=read-deny-entry.d.ts.map

package/dist/read-deny-entry.js

@@ -0,0 +1,12 @@
+export function readReadDenyEntry(it) {
+    if (typeof it === "string")
+        return { ok: true, entry: { pattern: it, caseSensitive: false } };
+    if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
+        return { ok: false, after: " must be a string or an object with a string 'pattern'" };
+    }
+    const cs = it.caseSensitive;
+    if (cs !== undefined && typeof cs !== "boolean")
+        return { ok: false, after: ".caseSensitive must be boolean when present" };
+    return { ok: true, entry: { pattern: it.pattern, caseSensitive: cs === true } };
+}
+//# sourceMappingURL=read-deny-entry.js.map

package/dist/read-face-posture.d.ts

@@ -17,9 +17,14 @@
  *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
  *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
  *
- * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
- * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
+ * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `lane 声明` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
+ * 🔴 **`lane` 一臂(S-1492,clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
+ * (`execution-lane-caps.ts` 的 `laneReadFaceDefault`;沙箱内部就是模型的整个世界)。运维没写 `READ_FACE` 时,车道声明比整机 posture 更具体 ⇒ 排在它前面;
+ * 声明 `roots` 的车道(`host` / `ssh` / `adb` / `device` / 未设车道)不替运维声明缺省,回到既有的 posture 派生,**一个字节不变**。
+ * 缺席这一态的派生**只有一只函数**({@link readFaceDefaultFor}),且读的是**最终生效的车道**(`loadConfig` 装配完 `remoteExec` 之后一次;
+ * local 形 `config.d/remote-exec.json` 覆写之后由车道合成步再派一次 —— 同一只 {@link settleDerivedReadFace})。
  *
  * ## 定界
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
@@ -31,13 +36,14 @@
  * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
+import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
  * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
  * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
  */
-export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
-/** 档位的来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
+/** 档位的来源(闭集五词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
 export type ReadFaceSource = PostureSource;
 /** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
 export interface ReadFacePostureFacts {
@@ -45,10 +51,29 @@ export interface ReadFacePostureFacts {
     readonly readFaceSource: ReadFaceSource;
 }
 /**
- * 缺席 `READ_FACE` 时的 posture 派生(`config.ts` 的铸点调用;显式值不经此口)。
- * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
+ * 缺席 `READ_FACE` 时读面缺省的**唯一派生函数**(显式 env 值不经此口):
+ *  · 车道声明 `open`(隔离型车道)⇒ `open`,来源 `lane`(不论单用户还是多租户 —— 更具体的出处胜 posture);
+ *  · 车道声明 `roots` ⇒ 既有 posture 派生,逐字不变。
  */
-export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
+export declare function readFaceDefaultFor(input: {
+    readonly laneDefault: LaneReadFaceDefault;
+    readonly singleUserTurnkey: boolean;
+}): ReadFacePostureFacts;
+/** {@link settleDerivedReadFace} 动的那几格(`ServiceConfig` 结构上满足本形)。 */
+export interface ReadFaceDeploymentSeat {
+    readFace?: "open" | "roots" | undefined;
+    readFaceSource: ReadFaceSource;
+    remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+}
+/**
+ * 把**派生的**读面缺省按这台部署**最终生效的车道**落到配置上(显式 env / center 发布的值与来源原样不动)。返回值 = 这一次有没有改动。
+ * 两个调用点,同一只函数:`loadConfig` 装配完 `remoteExec` 之后(env 三元链定的车道);车道合成步在 local 形文件覆写之后
+ * (`config.d/remote-exec.json` 能把车道换成 `host` / `local-docker`,读面缺省随最终车道重派 —— 否则它停在已作废的车道上)。
+ * 幂等:同一份配置再调一次不改。值与来源**同一处写**(`readFace` 缺席 ⟺ 来源 `engine-default`)。
+ */
+export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, singleUserTurnkey: boolean): boolean;
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
  *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
  *
@@ -67,13 +92,14 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     note: string;
 };
 /**
- * S-176 —— posture 派生的档位在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ * S-176 —— 派生的档位(`posture` 单机 ⇒ open,或 S-1492 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
  *
  * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
- * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。
- * 为什么只在 `posture` 一词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。S-1492 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
+ * 指路句带挂载告诫与钉回出路。
+ * 为什么只在 `posture` / `lane` 两词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
  * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。
- * 为什么是 info 不是 warn:每一台照常配置的单机每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
+ * 为什么是 info 不是 warn:每一台照常配置的部署每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
  *
  * 字段与极性表的 posture 行同名(`knob` / `value` / `source`),另带指路句;三格由 {@link buildReadFaceWiring} 投影出 ——
  * 拉取面与推送面**同一只函数**,不各算一次。`value` 是字符串:只有 `face` 在场的那一形才会走到这里。

package/dist/read-face-posture.js

@@ -1,13 +1,42 @@
+import { LANE_OPEN_READ_FACE_CAUTION, executionLaneOf, laneReadFaceDefault } from "./execution-lane-caps.js";
 import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
 export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
-export function readFaceForPosture(singleUserTurnkey) {
+function readFaceForPosture(singleUserTurnkey) {
     return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
 }
+export function readFaceDefaultFor(input) {
+    return input.laneDefault === "open" ? { readFace: "open", readFaceSource: "lane" } : readFaceForPosture(input.singleUserTurnkey);
+}
+function isDerivedSource(source) {
+    switch (source) {
+        case "env":
+        case "center":
+            return false;
+        case "lane":
+        case "posture":
+        case "engine-default":
+            return true;
+    }
+}
+export function settleDerivedReadFace(seat, singleUserTurnkey) {
+    if (!isDerivedSource(seat.readFaceSource))
+        return false;
+    const next = readFaceDefaultFor({ laneDefault: laneReadFaceDefault(executionLaneOf(seat.remoteExec?.provider)), singleUserTurnkey });
+    if (next.readFace === seat.readFace && next.readFaceSource === seat.readFaceSource)
+        return false;
+    if (next.readFace === undefined)
+        delete seat.readFace;
+    else
+        seat.readFace = next.readFace;
+    seat.readFaceSource = next.readFaceSource;
+    return true;
+}
 export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
         centerMeaning: "published by the web-admin and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
+        laneMeaning: `declared by the isolated execution lane this deployment runs on (REMOTE_EXEC=e2b|k8s|local-docker): the sandbox is the model's whole world, so reads are not fenced to the workspace roots by default; ${LANE_OPEN_READ_FACE_CAUTION}`,
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }
@@ -15,11 +44,11 @@ export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
 }
 export function buildReadFacePostureNotice(facts) {
-    if (facts.readFaceSource !== "posture")
+    if (facts.readFaceSource !== "posture" && facts.readFaceSource !== "lane")
         return undefined;
     const wiring = buildReadFaceWiring(facts);
     if (wiring.face === null) {
-        throw new Error("read-face posture notice: source is `posture` but no face was minted — readFaceForPosture's invariant broke");
+        throw new Error(`read-face derived notice: source is \`${facts.readFaceSource}\` but no face was minted — readFaceDefaultFor's invariant broke`);
     }
     return { event: "config_knob_posture_derived", fields: { knob: "READ_FACE", value: wiring.face, source: wiring.source, note: wiring.note } };
 }

package/dist/request-key-closure.d.ts

@@ -58,5 +58,12 @@ export type InterruptSteerBody = {
 export type SteerBodyForm = "run" | "content" | "interrupt";
 /** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
+declare const PRINCIPAL_INBOX_BODY_KEYS: readonly ["to", "content", "urgent"];
+/** 受理口的体形(键 = 受理集,值形由路由逐键判)。 */
+export type PrincipalInboxBody = {
+    readonly [K in (typeof PRINCIPAL_INBOX_BODY_KEYS)[number]]?: unknown;
+};
+/** 受理口的顶层键裁决(与提交口 / 送话口同一只组句器)。 */
+export declare function principalInboxBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 export {};
 //# sourceMappingURL=request-key-closure.d.ts.map

package/dist/request-key-closure.js

@@ -1,4 +1,5 @@
 import { echoCallerText } from "./caller-text-echo.js";
+import { tightenOnlySeatField } from "./tighten-only-seats.js";
 export const MAX_KEY_ECHO = 20;
 export function echoKeyName(prefix, key) {
     return `${prefix}${echoCallerText(key)}`;
@@ -31,6 +32,7 @@ const TASK_BODY_DECLARED_KEYS = [
 const TASK_BODY_SCENARIO_KEYS = ["repo"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);
 const UNSUPPORTED_BODY_KEYS = ["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "writeFace"];
+const BODY_KEY_SETTINGS_SEAT = { readDenyPatterns: tightenOnlySeatField("readDenyPatterns") };
 const UNSUPPORTED_BODY = {
     keys: new Set(UNSUPPORTED_BODY_KEYS),
     label: "unsupported (an engine seat this door does not read from the request body — set by the deployment)",
@@ -49,9 +51,10 @@ function closedBodyKeyIssue(raw, accepted, unsupported, door) {
         ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, `unknown (not ${door} key — check the spelling)`)] : []),
         ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, unsupported.label)] : []),
     ];
+    const seatHints = buckets.unsupported.flatMap((key) => (Object.hasOwn(BODY_KEY_SETTINGS_SEAT, key) ? [` \`${key}\` rides ${BODY_KEY_SETTINGS_SEAT[key]} instead.`] : []));
     return {
         message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
-            `${parts.join("; ")}. ` +
+            `${parts.join("; ")}.${seatHints.join("")} ` +
             `Accepted: ${[...accepted].sort().join(",")}`,
         unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
@@ -75,4 +78,9 @@ const STEER_UNSUPPORTED = {
 export function steerBodyKeyIssue(raw, form) {
     return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
+const PRINCIPAL_INBOX_BODY_KEYS = ["to", "content", "urgent"];
+const PRINCIPAL_INBOX_UNSUPPORTED = { keys: new Set(), label: "unsupported" };
+export function principalInboxBodyKeyIssue(raw) {
+    return closedBodyKeyIssue(raw, new Set(PRINCIPAL_INBOX_BODY_KEYS), PRINCIPAL_INBOX_UNSUPPORTED, "a principal-inbox message");
+}
 //# sourceMappingURL=request-key-closure.js.map

package/dist/request-value-closure.d.ts

@@ -71,6 +71,11 @@ export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled'
  * 正是这个词关掉的记录 —— 两义都与关断词矛盾)。调用前值形已由上面的单成员表与既有布尔门判过。
  */
 export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFiles" | "rewindFilesTo">): boolean;
+/**
+ * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo` · 退役的 `rewindFiles`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
+ * 判据只有这一份,拒体的 `detail.fields` 点名的也是它(判与点名不会各读各的)。
+ */
+export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo" | "rewindFiles">;
 /**
  * **单成员闭集键表** —— 每键合法值只有它自己那一个关断词(`word`),缺席=照常,没有「开」的拼法。
  *

package/dist/request-value-closure.js

@@ -3,9 +3,17 @@ export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
 export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
-    if (body.fileHistory !== "disabled")
-        return false;
-    return body.restoreFiles === true || body.rewindFiles === true || (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0);
+    return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
+}
+export function fileHistoryRestoreKeysInBody(body) {
+    const out = [];
+    if (body.restoreFiles === true)
+        out.push("restoreFiles");
+    if (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0)
+        out.push("rewindFilesTo");
+    if (body.rewindFiles === true)
+        out.push("rewindFiles");
+    return out;
 }
 const SINGLE_MEMBER_OFF_FIELDS = [
     { field: "memoryCapture", word: "off", message: MEMORY_CAPTURE_SPELLING_MESSAGE },

package/dist/rule-entry-list.d.ts

@@ -27,9 +27,13 @@
  *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
  *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧 `mcp__*` / `a2a__*`(整个协议的拒)合法。
+ *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
+ *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
  */
+import type { TightenOnlySeatField } from "./tighten-only-seats.js";
 import { compileAllowList } from "@sema-agent/core";
 import { type LimitRefusal } from "./limit-refusal.js";
+import { type EntryProblem } from "./entry-problems.js";
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
 export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
 /**
@@ -127,9 +131,9 @@ export type ToolListLayer = keyof typeof TOOL_LIST_FACES;
 /**
  * 请求体 `settings.permissions.deny` / `ask`(规则编译器读的收紧表)所在的层 —— **不在** {@link toolListsOf} 的扫描里:它们的判与句子的唯一铸点在 `config.ts` 的
  * `unmatchableToolNamesRefusal`(经 `task-settings.ts` 的 `rulePolicyBucketsRefusal`,单表桶序;拒点是 `applyTaskSettings`,422),存体预判(`http/stored-body-replay.ts`)调同一只函数(home 同源于部署配置),把命中装成本型。
- * 层名进这个联合只为让命中能带坐标进 409 体与运维日志。
+ * 层名进这个联合只为让命中能带坐标进 409 体与运维日志。S-1351 起「只收紧」座位族的四座(`tighten-only-seats.ts`,坐标由座位表派生)同走这条路:座位门命中(形 / 超帽 / 条目)与 `permissions.neverAuto` 的名字层。
  */
-export type RulePolicyLayer = "settings.permissions.deny" | "settings.permissions.ask";
+export type RulePolicyLayer = "settings.permissions.deny" | "settings.permissions.ask" | TightenOnlySeatField;
 /** 一份提交体里第一处「工具名清单里有引擎读成空的条目」:在哪一层、哪个方向、拒码、拒句(超帽时另带机读字段,同 `settings.permissions.*` 桶超帽的形)。 */
 export interface InertToolListEntry {
     readonly layer: ToolListLayer | RulePolicyLayer;
@@ -183,5 +187,25 @@ export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntr
  * `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。
  */
 export declare function inertToolListEntryOf(body: unknown, sides?: readonly ToolListSide[]): InertToolListEntry | undefined;
+/**
+ * 一个调用方工具的名字面(结构型,`ToolSpec` 满足它):主名、别名、委派工具声明的子代工具池里的行(主名与别名)—— 引擎认这些名字是「这条 run 挂着的工具」。
+ */
+export interface CallerToolNames {
+    readonly name: string;
+    readonly aliases?: readonly string[] | undefined;
+    readonly agentToolPool?: ReadonlyArray<{
+        readonly name: string;
+        readonly aliases?: readonly string[] | undefined;
+    }> | undefined;
+}
+/**
+ * **放行侧选择器清单的受理告知**(根 `allowTools`、子代定义的 `allowTools`)—— 这两张清单没有面向用户的通告通道(规则表与技能的放行清单读成空,引擎有受众 = 用户的通告
+ * `permission.allowed_tool_not_granted`;选择器清单上引擎只告运维一行),壳转投的 `.claude/agents` 文件里的 `tools:` 恰落在这两张表上。受理口**不拒**(引擎是这一面的判官,#1736 起
+ * 没有任何工具答应的名字保留、只告),把「这几条什么也不放」作为 `warnings` 随受理应答交回:每条 `{ code, field, entry, reason }`(形的属主 `entry-problems.ts`),`code` = 这张清单被拒时的码。
+ * 限制侧不告(`denyTools` / `excludeTools` 的近似名 / 退役名 / 文法读不出已是 400)。
+ *
+ * 在 `resolveSpec` **之后**问(近似名那一类已先 400):`tools` 是这一请求装配出的调用方工具(`spec.tools`,名字面见 {@link CallerToolNames})。超帽 / 形不对的清单不读(受理门先拒)。
+ */
+export declare function allowSelectorWarningsOf(body: unknown, tools: readonly CallerToolNames[]): readonly EntryProblem[];
 export {};
 //# sourceMappingURL=rule-entry-list.d.ts.map