@sema-agent/server 7.132.0 → 7.134.0

package/dist/config-dir-trust.js

@@ -0,0 +1,388 @@
+import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+import { HOST_PLATFORM } from "./plugins/host-platform.js";
+export const CONFIG_DIR_UNTRUSTED_CODE = "config.dir_untrusted";
+export const CONFIG_LOCAL_OWNER_UID_ENV = "CONFIG_LOCAL_OWNER_UID";
+export const CONFIG_DOCUMENT_MAX_BYTES = 16 * 1024 * 1024;
+export const CONFIG_DIR_LINK_HOPS_MAX = 40;
+const UID_MAX = 4294967294;
+const WIN32_UNVERIFIED_TAG = "server.config-dir-trust.win32-owner-mode-unverifiable";
+const errnoOf = (e) => (e instanceof Error && "code" in e && typeof e.code === "string" ? e.code : undefined);
+const KUBELET_VOLUME_ROOT = /\/pods\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/volumes\/kubernetes\.io~configmap\/[^/]+$/;
+const coversPath = (ancestor, p) => ancestor === p || ancestor === "/" || p.startsWith(`${ancestor}/`);
+const unescapeMountinfoPath = (field) => field.replace(/\\([0-7]{3})/g, (_m, oct) => String.fromCharCode(Number.parseInt(oct, 8)));
+function visibleMountOf(rows, dir) {
+    const ids = new Set(rows.map((r) => r.id));
+    let level = rows.filter((r) => !ids.has(r.parent) || r.parent === r.id);
+    let visible;
+    for (let depth = 0; depth <= rows.length; depth++) {
+        const covering = level.filter((r) => coversPath(r.mountPoint, dir));
+        if (covering.length === 0)
+            break;
+        const shortest = Math.min(...covering.map((r) => r.mountPoint.length));
+        const first = covering.filter((r) => r.mountPoint.length === shortest);
+        if (first.length !== 1)
+            return "ambiguous";
+        const next = first[0];
+        visible = next;
+        level = rows.filter((r) => r.parent === next.id && r.id !== next.id);
+    }
+    return visible;
+}
+export function kubeletVolumeIn(mountinfo, dir) {
+    const rows = [];
+    for (const line of mountinfo.split("\n")) {
+        const f = line.split(" ");
+        const [id, parent, dev, root, mountPoint, options] = f;
+        if (f.indexOf("-", 6) === -1 || id === undefined || parent === undefined || dev === undefined || root === undefined || mountPoint === undefined || options === undefined)
+            continue;
+        rows.push({ id, parent, dev, root: unescapeMountinfoPath(root), mountPoint: unescapeMountinfoPath(mountPoint), options: options.split(",") });
+    }
+    const visible = visibleMountOf(rows, dir);
+    if (typeof visible !== "object" || visible.mountPoint !== dir || !visible.options.includes("ro") || !KUBELET_VOLUME_ROOT.test(visible.root))
+        return undefined;
+    const source = visible.root;
+    const writableExposures = [];
+    for (const r of rows) {
+        if (r.dev !== visible.dev || r.options.includes("ro") || !coversPath(r.root, source))
+            continue;
+        const exposed = path.posix.join(r.mountPoint, r.root === "/" ? source : source.slice(r.root.length));
+        const seen = visibleMountOf(rows, exposed);
+        if (typeof seen === "object" && seen !== r)
+            continue;
+        if (!writableExposures.some((e) => e.path === exposed))
+            writableExposures.push({ path: exposed, mountPoint: r.mountPoint });
+    }
+    return { source, writableExposures };
+}
+async function processMountinfo() {
+    return HOST_PLATFORM === "linux" ? readFile("/proc/self/mountinfo", "utf8") : "";
+}
+const processHost = () => ({ platform: HOST_PLATFORM, euid: process.geteuid?.(), mountinfo: processMountinfo });
+const UNREACHABLE = new Set(["ENOENT", "ENOTDIR"]);
+const NOT_REACHED = { reached: false };
+function typeOf(st) {
+    if (st.isDirectory())
+        return "directory";
+    if (st.isFIFO())
+        return "fifo";
+    if (st.isSocket())
+        return "socket";
+    if (st.isCharacterDevice())
+        return "character device";
+    if (st.isBlockDevice())
+        return "block device";
+    return "non-regular file";
+}
+function componentVerdict(p, st, owners) {
+    if (!owners.has(st.uid))
+        return { kind: "owner", path: p, uid: st.uid };
+    if (st.isSymbolicLink() || (st.mode & 0o022) === 0)
+        return "closed";
+    if (st.isDirectory() && (st.mode & 0o1000) !== 0)
+        return "open";
+    return { kind: "writable", path: p, mode: st.mode & 0o7777 };
+}
+const KUBELET_NODE_SIDE_TAG = "server.config-dir-trust.kubelet-volume-node-side-unverifiable";
+const KUBELET_TIMESTAMP_DIR = /^\.\.\d{4}_\d{2}_\d{2}_\d{2}_\d{2}_\d{2}\.\d+$/;
+const KUBELET_DATA_LINKS = new Set(["..data", "..data_tmp"]);
+async function projectedVolumeRoot(dir, mode, ctx) {
+    const listing = await readdir(dir).then((names) => ({ names }), (error) => ({ error }));
+    if ("error" in listing)
+        return false;
+    const names = listing.names;
+    if (!names.includes("..data"))
+        return false;
+    let at = dir;
+    let volume;
+    try {
+        const stampDirs = new Set();
+        const linkTargets = [];
+        for (const name of names) {
+            at = path.posix.join(dir, name);
+            const st = await lstat(at);
+            if (!ctx.owners.has(st.uid))
+                return false;
+            if (KUBELET_DATA_LINKS.has(name)) {
+                if (!st.isSymbolicLink())
+                    return false;
+                linkTargets.push(await readlink(at));
+            }
+            else if (KUBELET_TIMESTAMP_DIR.test(name)) {
+                if (!st.isDirectory() || componentVerdict(at, st, ctx.owners) !== "closed")
+                    return false;
+                stampDirs.add(name);
+            }
+            else if (name.startsWith("..") || !st.isSymbolicLink() || (await readlink(at)) !== `..data/${name}`) {
+                return false;
+            }
+        }
+        if (!linkTargets.every((target) => stampDirs.has(target)))
+            return false;
+        at = "/proc/self/mountinfo";
+        volume = kubeletVolumeIn(await ctx.mountinfo(), dir);
+    }
+    catch (e) {
+        return { kind: "unreadable", path: at, errno: errnoOf(e) ?? String(e) };
+    }
+    if (volume === undefined)
+        return false;
+    const exposure = volume.writableExposures[0];
+    if (exposure !== undefined)
+        return { kind: "exposed", path: exposure.path, mountPoint: exposure.mountPoint, volume: dir, mode };
+    recordFailOpen(KUBELET_NODE_SIDE_TAG, `volume=${dir} source=${volume.source}`);
+    return true;
+}
+async function judgeComponent(p, st, ctx) {
+    const v = componentVerdict(p, st, ctx.owners);
+    if (typeof v === "string" || v.kind !== "writable" || !st.isDirectory())
+        return v;
+    const projected = await projectedVolumeRoot(p, v.mode, ctx);
+    if (projected === true)
+        return "closed";
+    return projected === false ? v : projected;
+}
+const isStats = (x) => "isDirectory" in x;
+async function lstatStep(p) {
+    try {
+        return await lstat(p);
+    }
+    catch (e) {
+        const code = errnoOf(e);
+        if (code !== undefined && UNREACHABLE.has(code))
+            return NOT_REACHED;
+        return { finding: { kind: "unreadable", path: p, errno: code ?? String(e) } };
+    }
+}
+async function walk(from, pending, want, ctx) {
+    let cur = from.start;
+    let st = from.stats;
+    let open = from.open;
+    let hops = from.hops;
+    const queue = [...pending];
+    const enter = async (p) => {
+        const got = await lstatStep(p);
+        if (!isStats(got))
+            return got;
+        const v = await judgeComponent(p, got, ctx);
+        if (typeof v !== "string")
+            return { finding: v };
+        cur = p;
+        st = got;
+        open = v === "open";
+        return undefined;
+    };
+    while (queue.length > 0) {
+        const name = queue.shift();
+        if (name === "" || name === ".")
+            continue;
+        if (name === "..") {
+            const stop = await enter(path.posix.dirname(cur));
+            if (stop !== undefined)
+                return stop;
+            continue;
+        }
+        const next = path.posix.join(cur, name);
+        const got = await lstatStep(next);
+        if (!isStats(got)) {
+            if (!("reached" in got) || !open)
+                return got;
+            return { finding: { kind: "creatable", path: next, parent: cur, mode: st.mode & 0o7777 } };
+        }
+        const v = await judgeComponent(next, got, ctx);
+        if (typeof v !== "string")
+            return { finding: v };
+        if (got.isSymbolicLink()) {
+            if (++hops > CONFIG_DIR_LINK_HOPS_MAX)
+                return { finding: { kind: "link-loop", path: next } };
+            let target;
+            try {
+                target = await readlink(next);
+            }
+            catch (e) {
+                const code = errnoOf(e);
+                if (code !== undefined && UNREACHABLE.has(code))
+                    return NOT_REACHED;
+                return { finding: { kind: "unreadable", path: next, errno: code ?? String(e) } };
+            }
+            queue.unshift(...target.split("/"));
+            if (target.startsWith("/")) {
+                const stop = await enter("/");
+                if (stop !== undefined)
+                    return stop;
+            }
+            continue;
+        }
+        if (queue.some((n) => n !== "" && n !== ".") && !got.isDirectory())
+            return NOT_REACHED;
+        cur = next;
+        st = got;
+        open = v === "open";
+    }
+    if (want === "dir")
+        return st.isDirectory() ? { reached: true, physical: cur, stats: st, open, hops } : NOT_REACHED;
+    if (!st.isFile())
+        return { finding: { kind: "not-regular", path: cur, type: typeOf(st) } };
+    if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
+        return { finding: { kind: "too-large", path: cur, bytes: st.size } };
+    return { reached: true, physical: cur, stats: st, open, hops };
+}
+async function confirmUnreached(lexical) {
+    try {
+        await stat(lexical);
+    }
+    catch (e) {
+        const code = errnoOf(e);
+        if (code !== undefined && UNREACHABLE.has(code))
+            return undefined;
+        if (code === "ELOOP")
+            return { kind: "link-loop", path: lexical };
+        return { kind: "unreadable", path: lexical, errno: code ?? String(e) };
+    }
+    return { kind: "unresolvable", path: lexical };
+}
+const documentFiles = () => LOCAL_READER_DOCUMENTS.map((d) => `${d}.json`);
+async function reachDir(lexical, ctx) {
+    const top = await lstatStep("/");
+    if (!isStats(top))
+        return "finding" in top ? top.finding : undefined;
+    const rootVerdict = await judgeComponent("/", top, ctx);
+    if (typeof rootVerdict !== "string")
+        return rootVerdict;
+    const step = await walk({ start: "/", stats: top, open: rootVerdict === "open", hops: 0 }, lexical.split("/"), "dir", ctx);
+    if ("finding" in step)
+        return step.finding;
+    return step.reached ? step : confirmUnreached(lexical);
+}
+async function judgePosix(configDir, ctx) {
+    const dir = await reachDir(configDir, ctx);
+    if (dir === undefined || "kind" in dir)
+        return dir;
+    for (const file of documentFiles()) {
+        const doc = await walk({ start: dir.physical, stats: dir.stats, open: dir.open, hops: dir.hops }, [file], "file", ctx);
+        if ("finding" in doc)
+            return doc.finding;
+        if (!doc.reached) {
+            const unseen = await confirmUnreached(path.join(configDir, file));
+            if (unseen !== undefined)
+                return unseen;
+        }
+    }
+    return undefined;
+}
+async function judgeWin32(configDir) {
+    const resolveStep = async (p) => {
+        try {
+            return await realpath(p);
+        }
+        catch (e) {
+            const code = errnoOf(e);
+            if (code !== undefined && UNREACHABLE.has(code))
+                return undefined;
+            if (code === "ELOOP")
+                return { kind: "link-loop", path: p };
+            return { kind: "unreadable", path: p, errno: code ?? String(e) };
+        }
+    };
+    const dir = await resolveStep(configDir);
+    if (dir === undefined)
+        return undefined;
+    if (typeof dir !== "string")
+        return dir;
+    if (!(await stat(dir)).isDirectory())
+        return undefined;
+    for (const file of documentFiles()) {
+        const doc = await resolveStep(path.join(dir, file));
+        if (doc === undefined)
+            continue;
+        if (typeof doc !== "string")
+            return doc;
+        const st = await stat(doc);
+        if (!st.isFile())
+            return { kind: "not-regular", path: doc, type: typeOf(st) };
+        if (st.size > CONFIG_DOCUMENT_MAX_BYTES)
+            return { kind: "too-large", path: doc, bytes: st.size };
+    }
+    recordFailOpen(WIN32_UNVERIFIED_TAG, `config.d=${dir}`);
+    return undefined;
+}
+export function localConfigDirOf(root) {
+    return path.join(path.resolve(root), "config.d");
+}
+export async function judgeLocalConfigDir(input) {
+    const host = input.host ?? processHost();
+    const configDir = localConfigDirOf(input.root);
+    if (host.platform === "win32")
+        return judgeWin32(configDir);
+    const owners = new Set([0]);
+    if (host.euid !== undefined)
+        owners.add(host.euid);
+    if (input.declaredOwnerUid !== undefined)
+        owners.add(input.declaredOwnerUid);
+    return judgePosix(configDir, { owners, mountinfo: host.mountinfo ?? processMountinfo });
+}
+const octal = (mode) => `0${(mode & 0o7777).toString(8).padStart(3, "0")}`;
+export function buildConfigDirUntrustedSentence(f, ctx) {
+    const self = ctx.euid === undefined ? "this server's user" : `this server's user (uid ${ctx.euid})`;
+    const declared = ctx.declaredOwnerUid === undefined ? "" : ` or the declared owner ${CONFIG_LOCAL_OWNER_UID_ENV}=${ctx.declaredOwnerUid}`;
+    const head = `${CONFIG_DIR_UNTRUSTED_CODE}: refusing to read the local config source ${ctx.configDir} — its documents decide which commands this server starts (mcp.json) ` +
+        `and where it sends credentials (models.json), so only ${self}, root${declared} may be able to change them, but`;
+    switch (f.kind) {
+        case "owner":
+            return (`${head} ${f.path} is owned by uid ${f.uid}${ctx.declaredOwnerUid === undefined ? ` (${CONFIG_LOCAL_OWNER_UID_ENV} is not set)` : ""}. ` +
+                `Fix: chown ${ctx.euid ?? "<this server's uid>"} ${f.path}, or declare that owner with ${CONFIG_LOCAL_OWNER_UID_ENV}=${f.uid}.`);
+        case "writable": {
+            const who = (f.mode & 0o020) !== 0 && (f.mode & 0o002) !== 0 ? "group- and other" : (f.mode & 0o020) !== 0 ? "group" : "other";
+            return `${head} ${f.path} is ${who}-writable (mode ${octal(f.mode)}). Fix: chmod go-w ${f.path}.`;
+        }
+        case "not-regular":
+            return `${head} ${f.path} is a ${f.type}, not a regular file. Fix: replace it with a regular file, or remove it.`;
+        case "too-large":
+            return `${head} ${f.path} is ${f.bytes} bytes, over the ${CONFIG_DOCUMENT_MAX_BYTES}-byte cap for one config document. Fix: shrink it.`;
+        case "link-loop":
+            return `${head} ${f.path} leads through more than ${CONFIG_DIR_LINK_HOPS_MAX} symbolic links. Fix: point the link at the file directly.`;
+        case "unreadable":
+            return `${head} ${f.path} cannot be inspected (${f.errno}), so its owner and mode cannot be checked. Fix: give this server's user search access to every directory on the path.`;
+        case "creatable":
+            return (`${head} ${f.path} does not exist and ${f.parent} (mode ${octal(f.mode)}) lets other users create it between this check and the read. ` +
+                `Fix: create ${f.path} as this server's user, or move the config root (CONFIG_LOCAL_DIR) under a directory only this server's user or root can write.`);
+        case "unresolvable":
+            return `${head} ${f.path} is a symbolic link that does not resolve to a path (it points at a kernel object such as a /proc descriptor), so its owner and mode cannot be checked. Fix: point it at a regular file.`;
+        case "exposed":
+            return (`${head} ${f.volume} is a read-only Kubernetes ConfigMap volume whose source is also reachable through the writable mount at ${f.mountPoint}, as ${f.path} ` +
+                `(mode ${octal(f.mode)}), so whoever can reach that path can replace these documents between this check and the read. ` +
+                `Fix: remove the writable mount at ${f.mountPoint} — do not mount the node's root, its kubelet directory or any other ancestor of that directory writable into this pod; mount the config with subPath, or do not mount that ancestor at all. Do not relax permissions on the node.`);
+        default: {
+            const unhandled = f;
+            throw new Error(`buildConfigDirUntrustedSentence: unhandled finding ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export class ConfigDirUntrustedError extends Error {
+    code = CONFIG_DIR_UNTRUSTED_CODE;
+    finding;
+    constructor(sentence, finding) {
+        super(sentence);
+        this.name = "ConfigDirUntrustedError";
+        this.finding = finding;
+    }
+}
+export async function assertLocalConfigDirTrusted(input) {
+    const host = input.host ?? processHost();
+    const finding = await judgeLocalConfigDir({ ...input, host });
+    if (finding === undefined)
+        return;
+    throw new ConfigDirUntrustedError(buildConfigDirUntrustedSentence(finding, { configDir: localConfigDirOf(input.root), euid: host.euid, declaredOwnerUid: input.declaredOwnerUid }), finding);
+}
+export function parseConfigLocalOwnerUid(raw) {
+    if (raw === undefined)
+        return undefined;
+    const n = /^(0|[1-9][0-9]{0,9})$/.test(raw) ? Number(raw) : Number.NaN;
+    if (Number.isInteger(n) && n <= UID_MAX)
+        return n;
+    throw new Error(`env ${CONFIG_LOCAL_OWNER_UID_ENV}=${JSON.stringify(raw)} must be a uid — a decimal integer in [0, ${UID_MAX}]: the one extra owner (besides this server's user and root) ` +
+        `the local config source's directories and documents may have (a userns-remapped bind mount, an operator-owned config). Unset it to trust only this server's user and root.`);
+}
+//# sourceMappingURL=config-dir-trust.js.map

package/dist/config-invariants.d.ts

@@ -34,9 +34,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -68,11 +68,17 @@ export interface CrossInvariant {
 /** `direct-door-anchors` 的状态臂:半开的直连门(开着却缺锚点)。转换臂(门姿态翻转)只活在热路径,留在条目里。 */
 export declare function halfOpenDirectDoorRefusal(v: Pick<CrossInvariantView, "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
 /**
- * `operator-principals-required`([ref]-① 普查候选 1/2):BFF 多租户 durable 形(DURABLE_APPROVAL ∧ REQUIRE_PRINCIPAL,直连门关)的空 operator 名单 ——
- * approvals-assistant 四个读面按裸 `isOperator` 划 scope,空名单 true-for-all ⇒ 任一租户 principal 可读他租户的待批队列。单租户 legacy(REQUIRE_PRINCIPAL 未设)刻意保留。
+ * `operator-principals-required`([ref]-① 普查候选 1/2):BFF 多租户 durable 形(DURABLE_APPROVAL ∧ REQUIRE_PRINCIPAL,直连门关)的空 operator 名单。
+ * 这条不变量生于审批四读面读「空名单 = 人人是」那条读法的年代(那时它防的是跨租户读待批队列);S-1050 删了那条读法 —— 空名单在每一面都是「没人是」,
+ * 不再外泄任何东西 —— 剩下的事实是「这台多租 worker 的审批队列没有人能当运维」。本版只把句子改真、不改拒启集;删不删这一条是另一次表态。
  */
 export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariantView, "durableApproval" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
-/** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,空 operator 名单让 isOperator true-for-all = 无限制写入面。 */
+/**
+ * `operator-single-user`(S-1050,[ref] ① 裁 A):「谁是 operator」一个事实一个来源。`OPERATOR_SINGLE_USER=true`(单用户形的每个调用方都是运维)
+ * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
+ */
+export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,要**具名**运维 —— 空名单下要么没人用得了,要么(单用户声明)人人用得了。 */
 export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
 /**
  * `bake-runner-credential`(IMAGE-API-DESIGN §P2.12 / H1):bake-runner 的身份由它的 bearer 凭据**派生**(token-derived `source`),不是自称的头 ——
@@ -84,6 +90,13 @@ export declare function bakeRunnerCredentialRefusal(v: Pick<CrossInvariantView,
  * 「多副本」在 config 层判不了(副本数不是本进程的知识),可判的**代理**就是 durable 前提本身。
  */
 export declare function leaderDurableStoreRefusal(v: Pick<CrossInvariantView, "leaderEnabled" | "dbBackend">): string | undefined;
+/**
+ * `workflow-park-decision-domain`(7.133.0)—— workflow 子代审批决定行的店必须与会话认领同域。决定行在 run 店的会话认领栅栏里写(SQL 后端一个事务、同一只池),
+ * 而库里的决定行随库里的 workflow 记录收割 ⇒ SQL 后端上 workflow 记录也必须在库里(`WORKFLOW_RUN_STORE=auto`)。`file` / `memory` 把记录放在库外,没有一只决定店两头都满足。
+ * 判的是**这份配置会不会装出 SQL 店**(坐标铸出来了没有,与 `device-durable-store` 同读法),不是 `dbBackend` 标签。**配置组合的拒启** —— 判在第 1 段(loadConfig),
+ * 先于第 3 段的一次性迁移:拒的那一次起服没有动过库。`createHttpServer` 里的 `parkDecisionStoreRefusal` 判的是另一件事(嵌入方递进来的决定店绑没绑在这只 run 店上,按身份比)。
+ */
+export declare function workflowParkDecisionDomainRefusal(v: Pick<CrossInvariantView, "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "dbBackend" | "tidb" | "pg">): string | undefined;
 /**
  * `center-one-identity`(7.124.0)—— **中心只有一个身份**。引擎接的 web-admin 由三只旋钮描述:基址(`WEB_ADMIN_ENV.url`,传输地址)、
  * 鉴权桥 issuer(`AUTH_BRIDGE_ISSUER`,缺席 = 基址 —— {@link authBridgeIssuerOf} 一只取值口)、web 基址(`WEB_ADMIN_ENV.webUrl`,上

package/dist/config-invariants.js

@@ -34,19 +34,28 @@ export function halfOpenDirectDoorRefusal(v) {
     if (!v.principalJwtAud)
         missing.push("PRINCIPAL_JWT_AUD");
     if (v.operatorPrincipals.length === 0)
-        missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+        missing.push("OPERATOR_PRINCIPALS (an empty list means no operator, and the direct door's operator faces need named operators)");
     if (!v.requirePrincipal)
         missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
     return missing.length > 0 ? `DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)` : undefined;
 }
 export function operatorPrincipalsRequiredRefusal(v) {
     return v.durableApproval === true && v.requirePrincipal && v.operatorPrincipals.length === 0
-        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
+        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — an empty operator list means no operator, so nobody could operate this multi-tenant worker's approval queue (list any owner's pending via GET /v1/approvals & siblings, decide any approval). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
         : undefined;
 }
+export function operatorSingleUserRefusal(v) {
+    if (v.operatorSingleUser !== true)
+        return undefined;
+    if (v.requirePrincipal)
+        return "OPERATOR_SINGLE_USER=true but REQUIRE_PRINCIPAL=true — the declaration makes every caller an operator, which only fits a single-user deployment; a multi-tenant worker names its operators in OPERATOR_PRINCIPALS. Unset OPERATOR_SINGLE_USER, or unset REQUIRE_PRINCIPAL if this is a single-user deployment";
+    if (v.operatorPrincipals.length > 0)
+        return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+    return undefined;
+}
 export function bakeOperatorPrincipalsRefusal(v) {
     return v.imageBakes.enabled && v.operatorPrincipals.length === 0
-        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
+        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host and needs named operators: with an empty list nobody can use it, and the single-user operator declaration would open it to every caller (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
         : undefined;
 }
 export function bakeRunnerCredentialRefusal(v) {
@@ -64,6 +73,15 @@ export function leaderDurableStoreRefusal(v) {
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
         : undefined;
 }
+export function workflowParkDecisionDomainRefusal(v) {
+    const sqlStore = (v.dbBackend === "mysql" && v.tidb !== undefined) || (v.dbBackend === "pg" && v.pg !== undefined);
+    return sqlStore && v.selfOrchestrationEnabled && v.workflowRunStoreBackend !== "auto"
+        ? `DB_BACKEND=${v.dbBackend} with self-orchestration on and WORKFLOW_RUN_STORE=${v.workflowRunStoreBackend} is refused before any schema migration runs (the database was not touched) ` +
+            "[workflow-park-decision-domain]: a workflow approval decision is written in the same atomic step that checks the delivering run still holds the host session, so on a SQL backend it lives in the database " +
+            "with the session claims and is reaped with the workflow records — which this setting keeps off the database. " +
+            "Leave WORKFLOW_RUN_STORE=auto (unset it: the workflow records go to the same database), or turn self-orchestration off (SELF_ORCHESTRATION_ENABLED=false)"
+        : undefined;
+}
 export function centerIdentityRefusal(v) {
     const webBaseUrl = v.webAdmin?.webBaseUrl;
     if (webBaseUrl === undefined)
@@ -125,6 +143,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-principals-required" },
         check: ({ next }) => operatorPrincipalsRequiredRefusal(next),
     },
+    {
+        id: "operator-single-user",
+        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
+        check: ({ next }) => operatorSingleUserRefusal(next),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
@@ -183,6 +208,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:leader-durable-store" },
         check: ({ next }) => leaderDurableStoreRefusal(next),
     },
+    {
+        id: "workflow-park-decision-domain",
+        keys: ["selfOrchestrationEnabled", "workflowRunStoreBackend", "dbBackend", "tidb", "pg"],
+        restartReason: "workflow-orchestration",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:workflow-park-decision-domain" },
+        check: ({ next }) => workflowParkDecisionDomainRefusal(next),
+    },
     {
         id: "device-durable-store",
         keys: ["remoteExec", "dbBackend", "tidb", "pg"],

package/dist/config-provider.d.ts

@@ -127,6 +127,9 @@ export interface ConfigProviderInput {
      *  `process.cwd()`,而工厂只在 `CONFIG_PROVIDER === "local"` 字面上递它 ⇒ 另一条走到 local 的路上配置源读 cwd、
      *  合成步读 localRoot,两个根分家。一个远程源也收它:`remote` 而无中心 URL 的形照样落回 local。 */
     localDir: string;
+    /** S-163:本地配置源的属主声明(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`)—— 每拍读 `config.d` 之前的目录信任判官与起服那一次判同一个值。
+     *  **必填**(值可以是 `undefined` = 没声明):两个生产构造点都必须递,漏递 = 起服判过、每拍却按「没声明」判 ⇒ 每一拍都拒(tsc 在这里挡)。 */
+    localOwnerUid: number | undefined;
     /** S-1556:远程配置源的技能正文盘缓存目录(见 {@link ConfigProvider.skillBodyCacheDir});本地配置源不认它(正文本就在盘上)。缺席 = 不落盘。 */
     skillBodyCacheDir?: string;
 }
@@ -165,7 +168,9 @@ export declare class LocalConfigProvider implements ConfigProvider {
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     readonly root: string;
-    constructor(root: string, store?: FileConfigStore);
+    constructor(root: string, store?: FileConfigStore, trust?: {
+        readonly declaredOwnerUid: number | undefined;
+    });
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }

package/dist/config-provider.js

@@ -2,6 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
 import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
@@ -75,12 +76,15 @@ export class LocalConfigProvider {
     store;
     root;
     #injectedStore;
-    constructor(root, store) {
+    #declaredOwnerUid;
+    constructor(root, store, trust = { declaredOwnerUid: undefined }) {
         this.root = root;
         this.#injectedStore = store;
         this.store = store ?? new FileConfigStore(root);
+        this.#declaredOwnerUid = trust.declaredOwnerUid;
     }
     async fetchEffective(etag) {
+        await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
         const readWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
@@ -245,7 +249,7 @@ export function mapToServiceEffective(eff, version) {
 export function createConfigProvider(input) {
     return configProviderKind(input) === "remote" && input.webAdmin !== undefined
         ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
-        : new LocalConfigProvider(input.localDir);
+        : new LocalConfigProvider(input.localDir, undefined, { declaredOwnerUid: input.localOwnerUid });
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");