@sema-agent/server 7.132.0 → 7.134.0

package/dist/config-catalog.js

@@ -5,15 +5,17 @@ import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_M
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
 import { modelImageInput, modelReasoningDecl } from "./model-select.js";
@@ -64,6 +66,7 @@ export const CONFIG_CATALOG = [
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
+    r("APPROVAL_ASK_RETENTION_MS", "approval", "number", `审批账本(问账 SQL / local 文件两形 + local 审计账)的保留窗(ms):一问结了且最后一次动静早于 now − 本值 ⇒ 维护 tick 整问删掉(没结的问永不按龄删;留下的记录逐字节不变;删了就打 approval_ask_retention_swept 读数行);0 = 不删(永久保留);正值下限 ${APPROVAL_ASK_RETENTION_FLOOR_MS}(低于即钳 + 告警);负值 / 非整数拒启`, { staticDefault: String(APPROVAL_ASK_RETENTION_DEFAULT_MS), danger: DATA, configKey: "approvalAskRetentionMs" }),
     r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
     r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 表(引擎 allow 层的部署成员 RunnerDeps.allowedTools,每只 Runner 同一席:HTTP 提交 / 续跑 / 停驻赎回 / run-local / leader 一律;规则文法 = 引擎的:工具名 / mcp__<server>__* / a2a__<peer>__* / Bash(<命令>) / Bash(<前缀>:*) / Read(//<dir>/**);命中 = 免问,清普通问与没人表态两类,内置工具也在内;清不掉任何一层的 deny / ask 规则、APPROVAL_NEVER_AUTO、shell 地板、写保护、治理、hook 的问、plan;不是白名单;引擎读成空的条目 / 服务器段铸不出 ⇒ 拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
@@ -103,6 +106,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true", configKey: "configLkgEnabled" }),
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生一条读拒行 = 这条绝对路径:根锚定,只守这一个文件,经符号链接的目录时引擎沿链连目标一起守;大小写不敏感;用户仓里同尾的路径读得到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
+    r("CONFIG_LOCAL_OWNER_UID", "integrations", "number", "本地配置源读之前的目录信任判官多信的那一个属主 uid(本服务用户与 root 之外 —— userns-remap 的 bind-mount、运维用户持有的配置);只放宽属主判据,组 / 他人可写照拒;形错拒启", { configKey: "configLocalOwnerUid", danger: SEC, derivedDefaultNote: "缺席 = config.d 路径上的目录与文档只许属于本服务用户或 root" }),
     r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
     r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
@@ -114,12 +118,12 @@ export const CONFIG_CATALOG = [
     r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ web-admin 声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
-    r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
+    r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", `device 车道等在途槽上限(ms;到期 device.busy;0 = 槽满时只给一个定时器拍、随即 busy;须为 [${DEVICE_DELIVERY_TIMEOUT_BOUNDS.min}, ${DEVICE_DELIVERY_TIMEOUT_BOUNDS.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
     r("DEVICE_ENROLL_TOKEN_TTL_SEC", "orchestration", "number", "enrollment token 有效期(整秒,自 DB now 起算;域 [1,86400],坏值拒启)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 签发点默认 900(15min)" }),
-    r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", "device 车道指令级默认超时(ms;per-command 可收紧)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
-    r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", "per-device 在途上限(超额云侧排队)", { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
+    r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", `device 车道指令级默认超时(ms;命令自带 timeout 时用命令自己的,没自带的用本值;须为 [${DEVICE_EXEC_TIMEOUT_BOUNDS.min}, ${DEVICE_EXEC_TIMEOUT_BOUNDS.max}] 内规范十进制整数,其余拒启 —— 0 会让每条没自带超时的指令在派发时被汇聚端拒)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
+    r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", `per-device 在途上限(超额云侧排队;原值进 helloAck.maxInflight;须为 ≥ ${DEVICE_HELLO_ACK_BOUNDS.maxInflight.min} 的规范十进制整数,其余拒启 —— 0 会让每次派发都 device.busy)`, { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
-    r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", "device 断连后在途不判丢的窗(ms;同 epoch 重连续接)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
@@ -257,12 +261,12 @@ export const CONFIG_CATALOG = [
     r("MEMORY_ORG_UNAVAILABLE_BACKOFF_MS", "memory", "number", "org 目录取数失败退避窗(ms)", { staticDefault: "10000", configKey: "memoryOrgUnavailableBackoffMs" }),
     r("MEMORY_PERSISTENCE_CAPABLE", "memory", "enum", "本部署能否把「记住 X」落到持久处的自我声明(三态;未知词拒启)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 键不上 TaskSpec,core 按 roster 推断", configKey: "memoryPersistenceCapable", booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_PROVENANCE", "memory", "enum", "已暴露会话的记忆写处置(carry=带 origin 标记照写;off=关)", { enumValues: ["off", "carry"], staticDefault: "carry", danger: SEC, configKey: "memoryProvenance" }),
-    r("MEMORY_SCOPE", "memory", "string", "单用户部署的记忆 scope 名", { derivedDefaultNote: "缺席:引擎开 ∧ 单用户 ⇒ local;其余 ⇒ 缺席(记忆暗)", configKey: "memoryScope" }),
+    r("MEMORY_SCOPE", "memory", "string", "单用户部署的记忆 scope 名(全局层;也是项目层 `userrepo:<属主>/…` 的属主 —— `user:<P>` 取 P,其余取名字本身;本服务铸的项目键族拒启)", { derivedDefaultNote: "缺席:引擎开 ∧ 单用户 ⇒ local;其余 ⇒ 缺席(记忆暗)", configKey: "memoryScope" }),
     r("MEMORY_SYNC_MAX_PULL_ENTRIES", "memory", "number", "TOC 同步单轮 pull 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
-    r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
+    r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写(本服务铸的项目键族 `userrepo:` / `repo:` 拒启:项目层由同步腿按属主自己选)", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
     r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
-    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步只覆盖一层 ⇒ 单用户任务不按项目键控、写家落全局层 MEMORY_SCOPE(S-512 让位,启动通知 `memory_project_scope_yields_to_sync`))"),
+    r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步覆盖同步层与同属主的项目层 `userrepo:<属主>/…` ⇒ 同步层与 MEMORY_SCOPE 同属主时单用户任务照常按项目键控并随同步推拉;不同属主 ⇒ 写家落全局层,启动通知 `memory_project_scope_yields_to_sync`)"),
     r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),
     r("MINIO_ACCESS_KEY", "store", "secret", "对象存储 access key(快照 blob/leader 工作区/公链签发共用)", { danger: SEC }),
     r("MINIO_BUCKET", "store", "string", "leader 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
@@ -351,7 +355,8 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(operator lane 全族门;审批队列上空名单=旧行为 token 即 operator,explicitOperatorOk 族空名单=谁都不是)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -368,6 +373,7 @@ export const CONFIG_CATALOG = [
     r("PLUGINS_ALLOW_HOSTS", "integrations", "csv", "plugins 域 clone host 白名单", { staticDefault: "github.com", danger: SEC, configKey: "pluginsAllowHosts" }),
     r("PORT", "limitsHttp", "number", "监听端口(0=随机,测试用)", { staticDefault: "8090", configKey: "port" }),
     r("PRINCIPAL_HEADER", "auth", "string", "principal 头名(跨仓冻结默认)", { staticDefault: "x-agent-principal", danger: SEC, configKey: "principalHeader" }),
+    r("PRINCIPAL_INBOX_ASSISTANT", "approval", "string", "principal 收件箱的消费方声明(独占读它的助理 agent handle)= 跨主体投递车道开关:在场 ⇒ 挂投递门与 POST /v1/principal-inbox/messages(耐久 mailbox / org 成员目录 / 配额店缺一拒启);空白 handle 拒启", { danger: SEC, configKey: "principalInboxAssistant", derivedDefaultNote: "缺席 ⇒ 不铸座、不挂门(跨主体投递整条不存在)", resolve: (c) => c.principalInboxAssistant ?? null }),
     r("PRINCIPAL_JWT_AUD", "auth", "string", "直连 principal JWT 期望 aud", { danger: SEC, configKey: "principalJwtAud" }),
     r("PRINCIPAL_JWT_ISS", "auth", "string", "直连 principal JWT 期望 iss", { danger: SEC, configKey: "principalJwtIss" }),
     r("PRINCIPAL_JWT_MAX_TTL_SEC", "auth", "number", "接受的 principal JWT 最长寿命(秒;0=不设帽;负值拒启 —— 收紧意图不许翻成最松)", { staticDefault: "120", danger: SEC, configKey: "principalJwtMaxTtlSec" }),
@@ -384,7 +390,7 @@ export const CONFIG_CATALOG = [
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
-    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。local-docker / ssh 车道在每只执行环境开起来时与它的 $HOME 对证,不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒;泄内容的递归读全 shell 面真人问、只读面拒;起服 warn execution_lane_home_undeclared)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明优先:不声明时 k8s / local-docker / ssh / adb 车道建环境那一拍实测执行环境自己的 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认声明);k8s / local-docker / ssh 车道的声明会在每只执行环境开起来时与它的 $HOME 对证(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
@@ -449,7 +455,7 @@ export const CONFIG_CATALOG = [
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
     r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
-    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 库报的单行上限与 max_allowed_packet ÷ 2 取小(两堵墙各自读不到时按该库族文档缺省);pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
+    r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 写入那条连接报的单行上限与 max_allowed_packet ÷ 2 取小(两堵墙各自读不到时按该库族文档缺省);pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
     r("SSH_HOST", "orchestration", "string", "ssh 车道目标主机(必需件)"),
     r("SSH_HOST_FINGERPRINT", "orchestration", "string", "主机密钥指纹校验(坏值拒启;仅 ssh 车道被选中时求值)", { danger: SEC }),
     r("SSH_KNOWN_HOSTS", "orchestration", "path", "known_hosts 路径(坏路径拒启)", { danger: SEC }),
@@ -495,7 +501,7 @@ export const CONFIG_CATALOG = [
     r("WORKFLOW_JOURNAL_RETENTION_MS", "orchestration", "number", "workflow_journal GC 保留期(ms)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowJournalRetentionMs" }),
     r("WORKFLOW_ORPHAN_GRACE_MS", "orchestration", "number", "running workflow 判崩溃孤儿的年龄阈(ms)", { staticDefault: String(24 * 60 * 60 * 1000), configKey: "workflowOrphanGraceMs" }),
     r("WORKFLOW_RUN_RETENTION_MS", "orchestration", "number", "TERMINAL workflow_run 行保留期(ms;SQL twins)", { staticDefault: String(30 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "workflowRunRetentionMs" }),
-    r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
+    r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File;SQL 后端上配 file / memory 且开了自编排 ⇒ 起服拒:workflow 子代的审批决定行要与会话认领同库)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
     r("WORKFLOW_SIZE_GUIDELINE", "orchestration", "enum", "Workflow 工具卡的规模建议(advisory;typo 拒启)", { enumValues: ["small", "medium", "large", "unrestricted"], configKey: "workflowSizeGuideline" }),
     r("WORKFLOW_TOTAL_TIMEOUT_MS", "orchestration", "number", "workflow 脚本总时限(ms;0/负不是禁用 —— 无禁用臂)", { staticDefault: "3600000" }),
     r("WORKSPACE_CACHE", "orchestration", "enum", "k8s 按工作区空间的构建缓存卷:volume = 每个空间(会话住客)一只 PVC(ws-cache-<摘要>,标签 sema.space,StorageClass 用集群缺省),挂到 WORKSPACE_CACHE_MOUNT,并在 pod env 注入工具缓存闭表(GRADLE_USER_HOME / MAVEN_OPTS / npm_config_cache / PIP_CACHE_DIR / UV_CACHE_DIR / GOMODCACHE;Rust 依赖缓存不盖 —— Cargo 没有只放下载缓存的 env;K8S_SANDBOX_ENV 同名显式值胜);卷在快照之外、可丢,pod 删卷留;卷拿不到(建不成 / 快照时限内没绑定)⇒ run 照起、无卷无缓存 env,fail-open 计数 + 一行 workspace_cache_unavailable;off = 不建卷。前提:会话店读得出会话住客(内存会话店 × volume ⇒ 拒启);委派子代不挂卷;词表外拒启", { enumValues: WORKSPACE_CACHE_WORDS, staticDefault: WORKSPACE_CACHE_DEFAULT }),
@@ -597,29 +603,40 @@ function primitiveConfigValue(config, key) {
         return v;
     return undefined;
 }
+const INVALID = { value: null, effectiveValueInvalid: true };
 function sanitizeEnumValue(spec, v) {
     const words = spec.echoWords ?? spec.enumValues;
     if (v === null)
         return { value: null };
     if (words === undefined)
-        return { value: null, invalid: true };
+        return INVALID;
     if (typeof v === "boolean") {
         const word = spec.booleanEnum?.[v ? "true" : "false"];
         if (word === null)
             return { value: null };
-        return word !== undefined && words.includes(word) ? { value: word } : { value: null, invalid: true };
+        return word !== undefined && words.includes(word) ? { value: word } : INVALID;
     }
     if (typeof v === "string")
-        return words.includes(v) ? { value: v } : { value: null, invalid: true };
-    return { value: null, invalid: true };
+        return words.includes(v) ? { value: v } : INVALID;
+    return INVALID;
 }
+function displayUrlItems(raws, dropEmpty) {
+    const checked = raws.map((raw) => buildDisplaySafeUrlChecked(raw));
+    const texts = checked.map((c) => c.text);
+    return { value: dropEmpty ? texts.filter((t) => t.length > 0) : texts, ...withheldIf(checked.some((c) => c.failedClosed)) };
+}
+const withheldIf = (withheld) => (withheld ? { effectiveValueWithheld: true } : {});
 function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
-        if (typeof v === "string")
-            return { value: v.includes(",") ? v.split(",").map((s) => buildDisplaySafeUrl(s.trim())).filter((s) => s.length > 0) : buildDisplaySafeUrl(v) };
+        if (typeof v === "string") {
+            if (v.includes(","))
+                return displayUrlItems(v.split(",").map((s) => s.trim()), true);
+            const shown = buildDisplaySafeUrlChecked(v);
+            return { value: shown.text, ...withheldIf(shown.failedClosed) };
+        }
         if (Array.isArray(v))
-            return { value: v.map((s) => buildDisplaySafeUrl(s)) };
+            return displayUrlItems(v, false);
         return { value: v };
     }
     if (type === "csv" && typeof v === "string")
@@ -651,21 +668,19 @@ export function buildConfigCatalog(inputs) {
         const centerRestartSlice = seat?.restartSlice;
         const centerEffective = seat !== undefined && managedNow && centerTiming === "hot" && (seat.precedence === "center-wins" || !envHeld);
         const effectiveLane = centerEffective ? "center" : envHeld ? "env" : "default";
-        let effectiveValue;
-        let effectiveValueInvalid;
+        let cell;
         if (valueClass === "secret") {
-            effectiveValue = { present: envHeld };
+            cell = { value: { present: envHeld } };
         }
         else if (valueClass === "opaque") {
-            effectiveValue = envHeld ? { present: true, length: raw.length } : { present: false };
+            cell = { value: envHeld ? { present: true, length: raw.length } : { present: false } };
         }
         else {
             const resolved = spec.resolve !== undefined ? spec.resolve(config, env, boot) : spec.configKey !== undefined ? primitiveConfigValue(config, spec.configKey) : undefined;
             const picked = resolved !== undefined ? resolved : knob !== undefined ? knob.value : envHeld ? raw : spec.staticDefault ?? null;
-            const sanitized = sanitizeValue(spec, picked);
-            effectiveValue = sanitized.value;
-            effectiveValueInvalid = sanitized.invalid;
+            cell = sanitizeValue(spec, picked);
         }
+        const { value: effectiveValue, ...verdicts } = cell;
         return {
             name: spec.name,
             domain: spec.domain,
@@ -678,7 +693,7 @@ export function buildConfigCatalog(inputs) {
             ...(spec.staticDefault !== undefined ? { staticDefault: spec.staticDefault } : {}),
             ...(spec.derivedDefaultNote !== undefined ? { derivedDefaultNote: spec.derivedDefaultNote } : {}),
             effectiveValue,
-            ...(effectiveValueInvalid === true ? { effectiveValueInvalid } : {}),
+            ...verdicts,
             valueClass,
             danger: spec.danger ?? [],
             ...(seat !== undefined && centerTiming !== undefined

package/dist/config-d-migration.d.ts

@@ -1,4 +1,6 @@
-import { type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+import { type ConfigDirectoryDocument, type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+/** 本地读腿读的那几份(便携域 + 退役域 + remote-exec 文档)= 迁移的覆盖面 = 目录信任判官(`config-dir-trust.ts`)判的文档名单。取契约的表与文档名,不手抄。 */
+export declare const LOCAL_READER_DOCUMENTS: readonly ConfigDirectoryDocument[];
 /** 一次起服迁移的结果:契约的结果闭集,外加本仓入口的两形(目录不在 ⇒ 不调;调用抛 ⇒ 失败)。纯数据。 */
 export type ConfigDirMigration = {
     readonly kind: "no-config-dir";

package/dist/config-d-migration.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { RETIRED_DOMAINS, formatConfigPath, isRetiredDomainName } from "@sema-agent/settings-schema";
 import { PORTABLE_DOMAINS, migrateConfigDirectory, nodeConfigDirectoryIo } from "@sema-agent/settings-schema/node";
 import { REMOTE_EXEC_DOCUMENT } from "@sema-agent/settings-schema/remote-exec";
-const READ_BACK_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
+export const LOCAL_READER_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
 const errnoOf = (err) => (err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : undefined);
 export async function migrateLocalConfigDirectory(root) {
     const dir = join(root, "config.d");
@@ -16,7 +16,7 @@ export async function migrateLocalConfigDirectory(root) {
             return { kind: "no-config-dir", dir };
     }
     try {
-        return { ...(await migrateConfigDirectory(dir, { documents: READ_BACK_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
+        return { ...(await migrateConfigDirectory(dir, { documents: LOCAL_READER_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
     }
     catch (err) {
         return { kind: "threw", dir, reason: `${err instanceof Error ? err.message : String(err)}${errnoOf(err) !== undefined ? ` (${errnoOf(err)})` : ""}` };

package/dist/config-dir-trust.d.ts

@@ -0,0 +1,114 @@
+/** 拒的机器码:起服拒启的 fatal 标题(`[config.dir_untrusted]`)与每拍那一行的句首同用。 */
+export declare const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
+/** 属主声明的 env 名(登记 `config-catalog.ts`)。 */
+export declare const CONFIG_LOCAL_OWNER_UID_ENV = "CONFIG_LOCAL_OWNER_UID";
+/** 一份配置文档的字节上界(只在这里定)。挡的是误放的巨型文件 / 误链到日志;技能正文内联在 `skills.json` 里,所以给得宽。 */
+export declare const CONFIG_DOCUMENT_MAX_BYTES: number;
+/** 走一条路径最多跟几跳符号链接(与 Linux `MAXSYMLINKS` 同数)。 */
+export declare const CONFIG_DIR_LINK_HOPS_MAX = 40;
+/** 一条「别人改得动」的发现(闭集;句子见 {@link buildConfigDirUntrustedSentence})。`path` 是物理路径(链接已跟)。 */
+export type ConfigDirUntrustedFinding = {
+    readonly kind: "owner";
+    readonly path: string;
+    readonly uid: number;
+} | {
+    readonly kind: "writable";
+    readonly path: string;
+    readonly mode: number;
+} | {
+    readonly kind: "not-regular";
+    readonly path: string;
+    readonly type: string;
+} | {
+    readonly kind: "too-large";
+    readonly path: string;
+    readonly bytes: number;
+} | {
+    readonly kind: "link-loop";
+    readonly path: string;
+} | {
+    readonly kind: "unreadable";
+    readonly path: string;
+    readonly errno: string;
+}
+/** 读者会读的这一项不存在,而它所在的目录是开放的粘滞目录 —— 别的用户能在判与读之间把它建出来(缺席没有约束力)。 */
+ | {
+    readonly kind: "creatable";
+    readonly path: string;
+    readonly parent: string;
+    readonly mode: number;
+}
+/** 走路径找不到、读者却打得开:链接读出的不是路径(procfs 的 `pipe:[…]` / `net:[…]` 一类内核对象)—— 判不了它的属主与模式。 */
+ | {
+    readonly kind: "unresolvable";
+    readonly path: string;
+}
+/** 只读挂载的 kubelet ConfigMap 卷 `volume`(卷根模式 `mode`,恒组 / 他人可写)的来源在本命名空间里经可写挂载 `mountPoint` 露在 `path`(见 {@link KubeletVolume.writableExposures}):
+ *  走得到 `path` 的人能在判与读之间换掉 `..data`。 */
+ | {
+    readonly kind: "exposed";
+    readonly path: string;
+    readonly mountPoint: string;
+    readonly volume: string;
+    readonly mode: number;
+};
+/** 判官看的宿主事实(测试注入;生产 = 本进程)。 */
+export interface ConfigDirTrustHost {
+    readonly platform: NodeJS.Platform;
+    readonly euid: number | undefined;
+    /** 本进程的挂载表(`/proc/self/mountinfo` 全文;解读见 {@link kubeletVolumeIn})。缺席 = 本进程实测(Linux 读 procfs;别的平台没有 kubelet 卷,答空表)。只在认 kubelet 卷根时读。 */
+    readonly mountinfo?: () => Promise<string>;
+}
+export interface ConfigDirTrustInput {
+    /** 本地配置根(持有 `config.d`;`configLocalRoot` 的那一个值)。相对路径按进程 cwd 解,与读者打开文件时同一个解法。 */
+    readonly root: string;
+    /** `CONFIG_LOCAL_OWNER_UID`(配置席 `configLocalOwnerUid`);缺席 = 只信本进程 euid 与 root。 */
+    readonly declaredOwnerUid: number | undefined;
+    /** 缺省 = 本进程。 */
+    readonly host?: ConfigDirTrustHost;
+}
+/** 来源在本命名空间里的一处可写露出:`path` = 那条路径,`mountPoint` = 露出它的那只可写挂载的挂载点。 */
+export interface KubeletVolumeExposure {
+    readonly path: string;
+    readonly mountPoint: string;
+}
+/** 一只只读挂载的 kubelet ConfigMap 卷(见 {@link kubeletVolumeIn})。 */
+export interface KubeletVolume {
+    /** 卷在源文件系统里的目录(mountinfo 第 4 格,如 `/var/lib/kubelet/pods/<uid>/volumes/kubernetes.io~configmap/<卷>`)。 */
+    readonly source: string;
+    /**
+     * 本命名空间里经**可写**挂载露出这个来源的每一处:同一文件系统(设备号同)、每挂载选项不含 `ro`、挂载根是来源本身或它的祖先 —— 按挂载点映射成一条路径,
+     * **且走那条路径看见的正是这只挂载**({@link visibleMountOf}):被只读挂载盖住(那条路径上只读)、被别的文件系统或映射别处的挂载盖住(那条路径上看见的不是来源)⇒ 不是露出;
+     * 判不出谁可见(影子挂载)⇒ 算露出(判不出就不认)。
+     */
+    readonly writableExposures: readonly KubeletVolumeExposure[];
+}
+/**
+ * 🔴 **`dir` 是不是一只只读挂载的 kubelet ConfigMap 卷的挂载点**,是则交回它的来源与来源在本命名空间里的可写露出(纯判:读的是 `/proc/self/mountinfo` 的全文)。
+ * 先找**走路径看见的那一只挂载**({@link visibleMountOf}:叠在祖先上的挂载会把卷根整个盖住,codex 验证轮 V1 / 二),它的挂载点必须恰是 `dir`,且两件同时成立:
+ * 每挂载选项含 `ro`;它在源文件系统里的根路径是 kubelet configMap 卷目录的整形({@link KUBELET_VOLUME_ROOT})。
+ * 路径形只认出「这是 kubelet 卷」(任何能写某个目录的人都造得出这个形,修复验证二):来源能不能被人改,看 `writableExposures`(见那一格的可见性律)。
+ * 内存介质的卷(Secret / projected / downwardAPI)在 mountinfo 里根路径是一只 tmpfs 的 `/`,认不出 ⇒ 不认(照拒,出路 `subPath` / 烤进镜像)。
+ */
+export declare function kubeletVolumeIn(mountinfo: string, dir: string): KubeletVolume | undefined;
+/** `<root>/config.d` 的绝对路径(相对根按 cwd 解)。 */
+export declare function localConfigDirOf(root: string): string;
+/** 判一次。`undefined` = 读者可以读(或没有可读的);否则那一条发现。 */
+export declare function judgeLocalConfigDir(input: ConfigDirTrustInput): Promise<ConfigDirUntrustedFinding | undefined>;
+/** 一条发现的句子(纯字符串 ⇒ `build*`)。头半句说为什么要判、谁可以改;后半句点名路径、实测值与改法。 */
+export declare function buildConfigDirUntrustedSentence(f: ConfigDirUntrustedFinding, ctx: {
+    readonly configDir: string;
+    readonly euid: number | undefined;
+    readonly declaredOwnerUid: number | undefined;
+}): string;
+/** 判出一条发现时抛的错:`code` = {@link CONFIG_DIR_UNTRUSTED_CODE},`message` = 那一句,`finding` = 结构。 */
+export declare class ConfigDirUntrustedError extends Error {
+    readonly code = "config.dir_untrusted";
+    readonly finding: ConfigDirUntrustedFinding;
+    constructor(sentence: string, finding: ConfigDirUntrustedFinding);
+}
+/** 两个调用点的口:判,有发现就抛 {@link ConfigDirUntrustedError}。 */
+export declare function assertLocalConfigDirTrusted(input: ConfigDirTrustInput): Promise<void>;
+/** `CONFIG_LOCAL_OWNER_UID` 的解析(`loadConfig` 调;无条件解析 —— 形错的值不许躺在一台今天不读 `config.d` 的机器上等哪天生效)。缺席 ⇒ `undefined`;形错 ⇒ 抛 = 拒启。 */
+export declare function parseConfigLocalOwnerUid(raw: string | undefined): number | undefined;
+//# sourceMappingURL=config-dir-trust.d.ts.map