@sema-agent/server 7.132.0 → 7.134.0

package/dist/project-identity.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
+import { encodeScopeSegment } from "@sema-agent/core";
+import { mintProjectLayerKey, PROJECT_LAYER_KEY_PREFIX, projectLayerOwnerOf } from "./project-layer-key.js";
 const UNREADABLE = { absent: "unreadable" };
 const BARE = { absent: "bare" };
 function isMissing(err) {
@@ -53,7 +55,7 @@ function identityOfGitFile(dir) {
     const gitDir = gitDirFact.ok;
     const commonText = readTextFact(join(gitDir, "commondir"));
     if (commonText === "missing")
-        return { root: dir };
+        return { root: dir, gitConfig: join(gitDir, "config") };
     if (commonText === "unreadable")
         return UNREADABLE;
     const commonFact = realpathFact(resolve(gitDir, commonText.ok));
@@ -68,7 +70,7 @@ function identityOfGitFile(dir) {
     const backFact = realpathFact(resolve(gitDir, back.ok));
     if (typeof backFact !== "object" || backFact.ok !== join(dir, ".git"))
         return UNREADABLE;
-    return { root: basename(common) !== ".git" ? common : dirname(common) };
+    return { root: basename(common) !== ".git" ? common : dirname(common), gitConfig: join(common, "config") };
 }
 function canonicalTaskRoot(taskRoot) {
     const rest = [];
@@ -86,6 +88,10 @@ function canonicalTaskRoot(taskRoot) {
     }
 }
 export function resolveProjectIdentity(taskRoot) {
+    const located = locateProject(taskRoot);
+    return "root" in located ? { root: located.root } : located;
+}
+function locateProject(taskRoot) {
     const root = canonicalTaskRoot(taskRoot);
     if (root === "unreadable")
         return UNREADABLE;
@@ -96,7 +102,7 @@ export function resolveProjectIdentity(taskRoot) {
             return UNREADABLE;
         if (typeof dotGit === "object") {
             if (dotGit.ok === "dir")
-                return { root: dir };
+                return { root: dir, gitConfig: join(dir, ".git", "config") };
             if (dotGit.ok === "file")
                 return identityOfGitFile(dir);
         }
@@ -108,13 +114,161 @@ export function resolveProjectIdentity(taskRoot) {
         dir = parent;
     }
 }
+function digest24(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex").slice(0, 24);
+}
+const RETIRED_PROJECT_KEY_PREFIX = "repo:";
 export function mintRepoScopeKey(projectRoot) {
-    return `repo:${createHash("sha256").update(projectRoot, "utf8").digest("hex").slice(0, 24)}`;
+    return `${RETIRED_PROJECT_KEY_PREFIX}${digest24(projectRoot)}`;
+}
+export function isServerMintedProjectKey(key) {
+    return key.startsWith(PROJECT_LAYER_KEY_PREFIX) || key.startsWith(RETIRED_PROJECT_KEY_PREFIX);
+}
+export function assertProjectLayerOwnable(scope, envName) {
+    if (isServerMintedProjectKey(scope)) {
+        throw new Error(`${envName}=${JSON.stringify(scope)} names a server-minted project-layer key (the "${PROJECT_LAYER_KEY_PREFIX}" family, or the retired "${RETIRED_PROJECT_KEY_PREFIX}" family) — ` +
+            "project layers are derived per task from the project identity and cannot be named as a deployment scope. Use a user key (user:<principal>) or a plain name.");
+    }
+    const owner = ownerSegmentFact(scope);
+    if (!owner.ok) {
+        throw new Error(`${envName}=${JSON.stringify(scope)} cannot own per-project memory layers: ${owner.why} — ` +
+            "the layer owner (the principal of a user: key, otherwise the name itself) must encode to at most 64 scope-segment characters.");
+    }
+}
+function ownerSegmentFact(scope) {
+    try {
+        encodeScopeSegment(projectLayerOwnerOf(scope));
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, why: err instanceof Error ? err.message : String(err) };
+    }
+}
+const GIT_CONFIG_MAX_BYTES = 256 * 1024;
+function readOriginRemoteUrl(configPath) {
+    const st = statFact(configPath);
+    if (st === "missing")
+        return "missing";
+    if (st === "unreadable" || st.ok !== "file")
+        return "unreadable";
+    let size;
+    try {
+        size = statSync(configPath).size;
+    }
+    catch (err) {
+        return isMissing(err) ? "missing" : "unreadable";
+    }
+    if (size > GIT_CONFIG_MAX_BYTES)
+        return "unreadable";
+    const text = readTextFact(configPath);
+    if (typeof text !== "object")
+        return text;
+    let inOrigin = false;
+    for (const raw of gitConfigLogicalLines(text.ok)) {
+        const line = raw.trim();
+        if (line.startsWith("[")) {
+            const header = /^\[\s*([A-Za-z0-9.-]+)(?:\s+"((?:[^"\\]|\\.)*)")?\s*\]/.exec(line);
+            inOrigin = header !== null && header[1].toLowerCase() === "remote" && header[2] !== undefined && header[2].replace(/\\(.)/g, "$1") === "origin";
+            continue;
+        }
+        if (!inOrigin)
+            continue;
+        const kv = /^([A-Za-z][A-Za-z0-9-]*)\s*=\s*(.*)$/.exec(line);
+        if (kv === null || kv[1].toLowerCase() !== "url")
+            continue;
+        const value = gitConfigValue(kv[2]);
+        if (value !== "")
+            return { ok: value };
+    }
+    return { ok: undefined };
+}
+function gitConfigLogicalLines(text) {
+    const out = [];
+    let pending = "";
+    for (const physical of text.split(/\r?\n/)) {
+        const trailing = /\\*$/.exec(physical)[0].length;
+        if (trailing % 2 === 1) {
+            pending += physical.slice(0, -1);
+            continue;
+        }
+        out.push(pending + physical);
+        pending = "";
+    }
+    if (pending !== "")
+        out.push(pending);
+    return out;
+}
+function gitConfigValue(raw) {
+    let out = "";
+    let quoted = false;
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw[i];
+        if (c === "\\" && i + 1 < raw.length) {
+            out += raw[++i];
+            continue;
+        }
+        if (c === '"') {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && (c === "#" || c === ";"))
+            break;
+        out += c;
+    }
+    return out.trim();
+}
+const DEFAULT_REMOTE_PORTS = { ssh: "22", "git+ssh": "22", "ssh+git": "22", https: "443", http: "80", git: "9418" };
+export function normalizeGitRemoteUrl(url) {
+    const u = url.trim();
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/(.*)$/.exec(u);
+    if (scheme !== null) {
+        const name = scheme[1].toLowerCase();
+        if (name === "file")
+            return undefined;
+        const rest = scheme[2];
+        const slash = rest.indexOf("/");
+        const authority = slash < 0 ? rest : rest.slice(0, slash);
+        const hostPort = authority.slice(authority.lastIndexOf("@") + 1);
+        const port = /:(\d*)$/.exec(hostPort);
+        const host = (port === null ? hostPort : hostPort.slice(0, port.index)).toLowerCase();
+        if (host === "")
+            return undefined;
+        const keptPort = port !== null && port[1] !== "" && port[1] !== DEFAULT_REMOTE_PORTS[name] ? `:${port[1]}` : "";
+        return `${host}${keptPort}/${cleanRemotePath(slash < 0 ? "" : rest.slice(slash))}`;
+    }
+    const scp = /^(?:[^@/]+@)?([^:/]{2,}):(.*)$/.exec(u);
+    if (scp !== null)
+        return `${scp[1].toLowerCase()}/${cleanRemotePath(scp[2])}`;
+    return undefined;
 }
-export function projectKeyForTaskRoot(taskRoot) {
+function cleanRemotePath(p) {
+    return p.replace(/\/+/g, "/").replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+}
+export function projectLayerIdentityOf(taskRoot) {
+    const located = locateProject(taskRoot);
+    if (!("root" in located))
+        return located;
+    const path = { tier: "p", digest: digest24(located.root) };
+    const origin = located.gitConfig !== undefined ? readOriginRemoteUrl(located.gitConfig) : "missing";
+    if (origin === "unreadable")
+        return UNREADABLE;
+    const remote = origin === "missing" || origin.ok === undefined ? undefined : normalizeGitRemoteUrl(origin.ok);
+    if (remote === undefined)
+        return { root: located.root, identity: path, lowerTiers: [] };
+    return { root: located.root, identity: { tier: "r", digest: digest24(remote) }, lowerTiers: [path] };
+}
+export function projectLayerForTaskRoot(taskRoot, owner) {
     if (taskRoot === undefined)
-        return { absent: "unreadable" };
-    const id = resolveProjectIdentity(taskRoot);
-    return "root" in id ? { scope: mintRepoScopeKey(id.root) } : { absent: id.absent };
+        return { key: UNREADABLE, foldFrom: [] };
+    const id = projectLayerIdentityOf(taskRoot);
+    if (!("identity" in id))
+        return { key: { absent: id.absent }, foldFrom: [] };
+    return {
+        key: { scope: mintProjectLayerKey(owner, id.identity) },
+        foldFrom: [mintRepoScopeKey(id.root), ...id.lowerTiers.map((tier) => mintProjectLayerKey(owner, tier))],
+    };
+}
+export function projectKeyForTaskRoot(taskRoot, owner) {
+    return projectLayerForTaskRoot(taskRoot, owner).key;
 }
 //# sourceMappingURL=project-identity.js.map

package/dist/project-layer-key.d.ts

@@ -0,0 +1,28 @@
+/** 项目层键的前缀(改名链的前缀词表也读它)。 */
+export declare const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
+/** 身份档:`r` = 仓库身份(origin 远端,跨设备),`p` = 项目根路径(本机)。 */
+export type ProjectIdentityTier = "r" | "p";
+/** 一个项目的身份段(档 + 24 位小写十六进制摘要)。 */
+export interface ProjectLayerIdentity {
+    readonly tier: ProjectIdentityTier;
+    readonly digest: string;
+}
+/** 解出的项目层键。 */
+export interface ParsedProjectLayerKey {
+    /** 解码后的属主(主体名,或不透明全局层名本身)。 */
+    readonly owner: string;
+    readonly identity: ProjectLayerIdentity;
+}
+/**
+ * 全局层 → 它的属主(见文件头文法)。`user:` 形用 core 的解析(段解码、规范形校验);坏的 `user:` 形照 core 原样抛
+ * (`config.memory_scope_key`)—— 起服经 `project-identity.ts` `assertProjectLayerOwnable` 在第一刻接住,不留到任务期。
+ */
+export declare function projectLayerOwnerOf(globalScope: string): string;
+/** 铸项目层键。属主编码超长 / 空 ⇒ core 段编码原样抛(起服已由 `assertProjectLayerOwnable` 拦住)。 */
+export declare function mintProjectLayerKey(owner: string, identity: ProjectLayerIdentity): string;
+/**
+ * 解项目层键。**严格**:前缀 + 恰好一个 `/` + 规范形属主段(`%41` 这类第二种拼法不认 —— 一个属主不许有两把键)+ 档文法。
+ * 不合任何一条 ⇒ `undefined`(调用方读作「不是项目层」;属主门据此答与其余拒绝同体的 404)。
+ */
+export declare function parseProjectLayerKey(key: string): ParsedProjectLayerKey | undefined;
+//# sourceMappingURL=project-layer-key.d.ts.map

package/dist/project-layer-key.js

@@ -0,0 +1,29 @@
+import { decodeScopeSegment, encodeScopeSegment, parseScopeKey } from "@sema-agent/core";
+export const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
+const DIGEST = /^[0-9a-f]{24}$/;
+const KEY = /^userrepo:((?:[A-Za-z0-9._-]|%[0-9A-F]{2})+)\/([rp])\.([0-9a-f]{24})$/;
+export function projectLayerOwnerOf(globalScope) {
+    const parsed = parseScopeKey(globalScope);
+    return parsed.kind === "user" ? parsed.principal : globalScope;
+}
+export function mintProjectLayerKey(owner, identity) {
+    if (!DIGEST.test(identity.digest))
+        throw new Error(`project layer identity digest must be 24 lowercase hex characters, got ${JSON.stringify(identity.digest)}`);
+    return `${PROJECT_LAYER_KEY_PREFIX}${encodeScopeSegment(owner)}/${identity.tier}.${identity.digest}`;
+}
+export function parseProjectLayerKey(key) {
+    const m = KEY.exec(key);
+    if (m === null)
+        return undefined;
+    const owner = decodeOwnerSegment(m[1]);
+    return owner.ok ? { owner: owner.owner, identity: { tier: m[2], digest: m[3] } } : undefined;
+}
+function decodeOwnerSegment(segment) {
+    try {
+        return { ok: true, owner: decodeScopeSegment(segment) };
+    }
+    catch (err) {
+        return { ok: false, why: err instanceof Error ? err.message : String(err) };
+    }
+}
+//# sourceMappingURL=project-layer-key.js.map

package/dist/question.js

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { refusalBody } from "./http/refusal-body.js";
 const MAX_QUESTIONS_BYTES = 16384;
 function isFaceReachable(ctx) {
     if (ctx.deliverable === undefined)
@@ -150,10 +151,10 @@ export class QuestionCoordinator {
     respond(id, principal, body) {
         const parsed = parseQuestionResponse(body);
         if (!parsed.ok)
-            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape" } };
+            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: parsed.error }) };
         const entry = this.pending.get(id);
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
-            return { status: 404, body: { error: "no pending question for this id (answered, expired, or not on this replica)", errorCode: "question.not_pending" } };
+            return { status: 404, body: refusalBody({ errorCode: "question.not_pending", message: "no pending question for this id (answered, expired, or not on this replica)" }) };
         }
         entry.settle(parsed.value, "answered");
         return { status: 200, body: { questionId: id, delivery: "applied" } };

package/dist/read-deny-entry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * **读拒模式条目的归一**(全仓唯一一只读法)—— `READ_DENY_PATTERNS` 的 env 腿(`config.ts`)、中心下发 `readFace.denyPatterns` 的腿(`web-admin-client/read-face.ts`)、
+ * 请求 `settings.readDenyPatterns` 的腿(`tighten-only-seats.ts`)三处读同一份元素文法:`"pattern"` 裸串简写 ≡ `{ pattern, caseSensitive: false }`,
+ * 对象形 `{ pattern: string, caseSensitive?: boolean }`(与 core `ReadDenyEntry = string | {…}` 同宽)。三份手抄的元素读法就是三个会各自漂的真源,所以收成这一只。
+ *
+ * 只管**元素形**(串 / 带串 `pattern` 的对象 / 布尔 `caseSensitive`);模式编不编得过由调用方交给 core 的 `compileReadDeny`(引擎同一套规则,宿主不自造第二份校验语义)。
+ * 返回的是**接在坐标后面的原因尾巴**(` must be a string or an object with a string 'pattern'` / `.caseSensitive must be boolean when present`),不带坐标 —— 调用方自己前缀坐标
+ * (`READ_DENY_PATTERNS[2]` / `readFace.denyPatterns[2]` / `settings.readDenyPatterns[2]`),各腿既有的拒句字节不变。叶模块,零 import。
+ */
+/** 归一后的一行(core `compileReadDeny` 收的对象形)。 */
+export interface NormalizedReadDenyEntry {
+    readonly pattern: string;
+    readonly caseSensitive: boolean;
+}
+/** 一个元素的读数:归一后的行,或接在调用方坐标后面成句的原因尾巴(`after` 自带连接符:空格或点)。 */
+export type ReadDenyEntryReading = {
+    readonly ok: true;
+    readonly entry: NormalizedReadDenyEntry;
+} | {
+    readonly ok: false;
+    readonly after: string;
+};
+/** 读一个元素。裸串 ⇒ 大小写默认不敏感(与对象形缺席 `caseSensitive` 一致);坏形 ⇒ 原因子句,不抛、不丢。 */
+export declare function readReadDenyEntry(it: unknown): ReadDenyEntryReading;
+//# sourceMappingURL=read-deny-entry.d.ts.map

package/dist/read-deny-entry.js

@@ -0,0 +1,12 @@
+export function readReadDenyEntry(it) {
+    if (typeof it === "string")
+        return { ok: true, entry: { pattern: it, caseSensitive: false } };
+    if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
+        return { ok: false, after: " must be a string or an object with a string 'pattern'" };
+    }
+    const cs = it.caseSensitive;
+    if (cs !== undefined && typeof cs !== "boolean")
+        return { ok: false, after: ".caseSensitive must be boolean when present" };
+    return { ok: true, entry: { pattern: it.pattern, caseSensitive: cs === true } };
+}
+//# sourceMappingURL=read-deny-entry.js.map

package/dist/read-face-posture.d.ts

@@ -17,9 +17,14 @@
  *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
  *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
  *
- * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
- * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
+ * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `lane 声明` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
+ * 🔴 **`lane` 一臂(S-1492,clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
+ * (`execution-lane-caps.ts` 的 `laneReadFaceDefault`;沙箱内部就是模型的整个世界)。运维没写 `READ_FACE` 时,车道声明比整机 posture 更具体 ⇒ 排在它前面;
+ * 声明 `roots` 的车道(`host` / `ssh` / `adb` / `device` / 未设车道)不替运维声明缺省,回到既有的 posture 派生,**一个字节不变**。
+ * 缺席这一态的派生**只有一只函数**({@link readFaceDefaultFor}),且读的是**最终生效的车道**(`loadConfig` 装配完 `remoteExec` 之后一次;
+ * local 形 `config.d/remote-exec.json` 覆写之后由车道合成步再派一次 —— 同一只 {@link settleDerivedReadFace})。
  *
  * ## 定界
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
@@ -31,13 +36,14 @@
  * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
+import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
  * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
  * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
  */
-export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
-/** 档位的来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
+/** 档位的来源(闭集五词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
 export type ReadFaceSource = PostureSource;
 /** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
 export interface ReadFacePostureFacts {
@@ -45,10 +51,29 @@ export interface ReadFacePostureFacts {
     readonly readFaceSource: ReadFaceSource;
 }
 /**
- * 缺席 `READ_FACE` 时的 posture 派生(`config.ts` 的铸点调用;显式值不经此口)。
- * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
+ * 缺席 `READ_FACE` 时读面缺省的**唯一派生函数**(显式 env 值不经此口):
+ *  · 车道声明 `open`(隔离型车道)⇒ `open`,来源 `lane`(不论单用户还是多租户 —— 更具体的出处胜 posture);
+ *  · 车道声明 `roots` ⇒ 既有 posture 派生,逐字不变。
  */
-export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
+export declare function readFaceDefaultFor(input: {
+    readonly laneDefault: LaneReadFaceDefault;
+    readonly singleUserTurnkey: boolean;
+}): ReadFacePostureFacts;
+/** {@link settleDerivedReadFace} 动的那几格(`ServiceConfig` 结构上满足本形)。 */
+export interface ReadFaceDeploymentSeat {
+    readFace?: "open" | "roots" | undefined;
+    readFaceSource: ReadFaceSource;
+    remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+}
+/**
+ * 把**派生的**读面缺省按这台部署**最终生效的车道**落到配置上(显式 env / center 发布的值与来源原样不动)。返回值 = 这一次有没有改动。
+ * 两个调用点,同一只函数:`loadConfig` 装配完 `remoteExec` 之后(env 三元链定的车道);车道合成步在 local 形文件覆写之后
+ * (`config.d/remote-exec.json` 能把车道换成 `host` / `local-docker`,读面缺省随最终车道重派 —— 否则它停在已作废的车道上)。
+ * 幂等:同一份配置再调一次不改。值与来源**同一处写**(`readFace` 缺席 ⟺ 来源 `engine-default`)。
+ */
+export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, singleUserTurnkey: boolean): boolean;
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
  *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
  *
@@ -67,13 +92,14 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     note: string;
 };
 /**
- * S-176 —— posture 派生的档位在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ * S-176 —— 派生的档位(`posture` 单机 ⇒ open,或 S-1492 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
  *
  * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
- * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。
- * 为什么只在 `posture` 一词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。S-1492 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
+ * 指路句带挂载告诫与钉回出路。
+ * 为什么只在 `posture` / `lane` 两词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
  * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。
- * 为什么是 info 不是 warn:每一台照常配置的单机每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
+ * 为什么是 info 不是 warn:每一台照常配置的部署每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
  *
  * 字段与极性表的 posture 行同名(`knob` / `value` / `source`),另带指路句;三格由 {@link buildReadFaceWiring} 投影出 ——
  * 拉取面与推送面**同一只函数**,不各算一次。`value` 是字符串:只有 `face` 在场的那一形才会走到这里。

package/dist/read-face-posture.js

@@ -1,13 +1,42 @@
+import { LANE_OPEN_READ_FACE_CAUTION, executionLaneOf, laneReadFaceDefault } from "./execution-lane-caps.js";
 import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
 export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
-export function readFaceForPosture(singleUserTurnkey) {
+function readFaceForPosture(singleUserTurnkey) {
     return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
 }
+export function readFaceDefaultFor(input) {
+    return input.laneDefault === "open" ? { readFace: "open", readFaceSource: "lane" } : readFaceForPosture(input.singleUserTurnkey);
+}
+function isDerivedSource(source) {
+    switch (source) {
+        case "env":
+        case "center":
+            return false;
+        case "lane":
+        case "posture":
+        case "engine-default":
+            return true;
+    }
+}
+export function settleDerivedReadFace(seat, singleUserTurnkey) {
+    if (!isDerivedSource(seat.readFaceSource))
+        return false;
+    const next = readFaceDefaultFor({ laneDefault: laneReadFaceDefault(executionLaneOf(seat.remoteExec?.provider)), singleUserTurnkey });
+    if (next.readFace === seat.readFace && next.readFaceSource === seat.readFaceSource)
+        return false;
+    if (next.readFace === undefined)
+        delete seat.readFace;
+    else
+        seat.readFace = next.readFace;
+    seat.readFaceSource = next.readFaceSource;
+    return true;
+}
 export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
         centerMeaning: "published by the web-admin and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
+        laneMeaning: `declared by the isolated execution lane this deployment runs on (REMOTE_EXEC=e2b|k8s|local-docker): the sandbox is the model's whole world, so reads are not fenced to the workspace roots by default; ${LANE_OPEN_READ_FACE_CAUTION}`,
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }
@@ -15,11 +44,11 @@ export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
 }
 export function buildReadFacePostureNotice(facts) {
-    if (facts.readFaceSource !== "posture")
+    if (facts.readFaceSource !== "posture" && facts.readFaceSource !== "lane")
         return undefined;
     const wiring = buildReadFaceWiring(facts);
     if (wiring.face === null) {
-        throw new Error("read-face posture notice: source is `posture` but no face was minted — readFaceForPosture's invariant broke");
+        throw new Error(`read-face derived notice: source is \`${facts.readFaceSource}\` but no face was minted — readFaceDefaultFor's invariant broke`);
     }
     return { event: "config_knob_posture_derived", fields: { knob: "READ_FACE", value: wiring.face, source: wiring.source, note: wiring.note } };
 }

package/dist/request-key-closure.d.ts

@@ -58,5 +58,12 @@ export type InterruptSteerBody = {
 export type SteerBodyForm = "run" | "content" | "interrupt";
 /** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
+declare const PRINCIPAL_INBOX_BODY_KEYS: readonly ["to", "content", "urgent"];
+/** 受理口的体形(键 = 受理集,值形由路由逐键判)。 */
+export type PrincipalInboxBody = {
+    readonly [K in (typeof PRINCIPAL_INBOX_BODY_KEYS)[number]]?: unknown;
+};
+/** 受理口的顶层键裁决(与提交口 / 送话口同一只组句器)。 */
+export declare function principalInboxBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 export {};
 //# sourceMappingURL=request-key-closure.d.ts.map

package/dist/request-key-closure.js

@@ -1,4 +1,5 @@
 import { echoCallerText } from "./caller-text-echo.js";
+import { tightenOnlySeatField } from "./tighten-only-seats.js";
 export const MAX_KEY_ECHO = 20;
 export function echoKeyName(prefix, key) {
     return `${prefix}${echoCallerText(key)}`;
@@ -31,6 +32,7 @@ const TASK_BODY_DECLARED_KEYS = [
 const TASK_BODY_SCENARIO_KEYS = ["repo"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);
 const UNSUPPORTED_BODY_KEYS = ["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "writeFace"];
+const BODY_KEY_SETTINGS_SEAT = { readDenyPatterns: tightenOnlySeatField("readDenyPatterns") };
 const UNSUPPORTED_BODY = {
     keys: new Set(UNSUPPORTED_BODY_KEYS),
     label: "unsupported (an engine seat this door does not read from the request body — set by the deployment)",
@@ -49,9 +51,10 @@ function closedBodyKeyIssue(raw, accepted, unsupported, door) {
         ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, `unknown (not ${door} key — check the spelling)`)] : []),
         ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, unsupported.label)] : []),
     ];
+    const seatHints = buckets.unsupported.flatMap((key) => (Object.hasOwn(BODY_KEY_SETTINGS_SEAT, key) ? [` \`${key}\` rides ${BODY_KEY_SETTINGS_SEAT[key]} instead.`] : []));
     return {
         message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
-            `${parts.join("; ")}. ` +
+            `${parts.join("; ")}.${seatHints.join("")} ` +
             `Accepted: ${[...accepted].sort().join(",")}`,
         unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
@@ -75,4 +78,9 @@ const STEER_UNSUPPORTED = {
 export function steerBodyKeyIssue(raw, form) {
     return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
+const PRINCIPAL_INBOX_BODY_KEYS = ["to", "content", "urgent"];
+const PRINCIPAL_INBOX_UNSUPPORTED = { keys: new Set(), label: "unsupported" };
+export function principalInboxBodyKeyIssue(raw) {
+    return closedBodyKeyIssue(raw, new Set(PRINCIPAL_INBOX_BODY_KEYS), PRINCIPAL_INBOX_UNSUPPORTED, "a principal-inbox message");
+}
 //# sourceMappingURL=request-key-closure.js.map

package/dist/request-tool-axes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 请求侧 `toolAxes` 声明的读法 —— `mcpServers[].toolAxes`(`task-mcp.ts`)与 `a2aPeers[].toolAxes`(`task-a2a.ts`)同一只。
+ *
+ * 律(一句):判官是引擎包根的 `readToolAxes(declared, at)`;请求侧再多一条 —— **不许写 `boundaryFlow`**。
+ * `boundaryFlow: "engine"`(须同条 `egress: false`)声明一只引擎专用工具:名册行读成零条腿,设备车道的发射闸对它的调用不欠任何东西。
+ * 引擎分不出一条声明来自请求还是部署,所以这个位只许部署声明(`config.d` / 配置中心)写 —— 那两条腿原样交引擎(由引擎判 `egress: false`)。
+ * 读数形与引擎判官同一只(`ToolAxesRead`):请求侧写了这个位 ⇒ `ok: false`,原因句点名工具(或 skill)与出路;各腿按自己既有的「判不过」处置读它
+ * (MCP 新提交 400 点名 / 续跑重放整条 server 不进;A2A 整条对端不挂、warn 点名)。
+ */
+import { type ToolAxesRead, type ToolAxesSurface } from "@sema-agent/core";
+export declare function readRequestToolAxes(declared: unknown, at: ToolAxesSurface): ToolAxesRead;
+//# sourceMappingURL=request-tool-axes.d.ts.map

package/dist/request-tool-axes.js

@@ -0,0 +1,20 @@
+import { readToolAxes } from "@sema-agent/core";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { MAX_KEY_ECHO } from "./request-key-closure.js";
+const KEY_NOUN = { mcp: "tool", a2a: "skill" };
+export function readRequestToolAxes(declared, at) {
+    const read = readToolAxes(declared, at);
+    if (!read.ok || read.toolAxes === undefined)
+        return read;
+    for (const [name, axes] of Object.entries(read.toolAxes)) {
+        if (axes !== undefined && Object.hasOwn(axes, "boundaryFlow")) {
+            return {
+                ok: false,
+                problem: `the axes declared for ${KEY_NOUN[at]} ${JSON.stringify(stripControlAndBidi(name).slice(0, MAX_KEY_ECHO))} carry "boundaryFlow", which only a deployment's declaration may state ` +
+                    `(it declares an engine-only ${KEY_NOUN[at]}, so the device lane's launch gate would owe its calls nothing; the engine cannot tell a request's entry from a deployment's) — drop "boundaryFlow"`,
+            };
+        }
+    }
+    return read;
+}
+//# sourceMappingURL=request-tool-axes.js.map

package/dist/request-value-closure.d.ts

@@ -71,6 +71,11 @@ export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled'
  * 正是这个词关掉的记录 —— 两义都与关断词矛盾)。调用前值形已由上面的单成员表与既有布尔门判过。
  */
 export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFiles" | "rewindFilesTo">): boolean;
+/**
+ * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo` · 退役的 `rewindFiles`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
+ * 判据只有这一份,拒体的 `detail.fields` 点名的也是它(判与点名不会各读各的)。
+ */
+export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo" | "rewindFiles">;
 /**
  * **单成员闭集键表** —— 每键合法值只有它自己那一个关断词(`word`),缺席=照常,没有「开」的拼法。
  *

package/dist/request-value-closure.js

@@ -3,9 +3,17 @@ export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
 export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
-    if (body.fileHistory !== "disabled")
-        return false;
-    return body.restoreFiles === true || body.rewindFiles === true || (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0);
+    return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
+}
+export function fileHistoryRestoreKeysInBody(body) {
+    const out = [];
+    if (body.restoreFiles === true)
+        out.push("restoreFiles");
+    if (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0)
+        out.push("rewindFilesTo");
+    if (body.rewindFiles === true)
+        out.push("rewindFiles");
+    return out;
 }
 const SINGLE_MEMBER_OFF_FIELDS = [
     { field: "memoryCapture", word: "off", message: MEMORY_CAPTURE_SPELLING_MESSAGE },