@sema-agent/server 7.133.0 → 7.135.0

package/dist/hooks/hook-runner.js

@@ -11,11 +11,13 @@ import { MAX_HOOK_NOTICE_TEXT_CHARS, boundedNoticeText } from "../fleet/fleet-bu
 import { recordFailOpen } from "../observability/fail-open.js";
 import { LIMIT_REASONS } from "../limit-refusal.js";
 import { clipDataText, echoCallerText } from "../caller-text-echo.js";
+import { seatText } from "../trace/exit-seat.js";
 import { redactSecrets, buildDisplaySafeUrl } from "../trace/redact.js";
-import { canonicalJson } from "../canonical-json.js";
+import { canonicalJsonStringify } from "@sema-agent/core";
 import { ccPromptSystemFor, wrapCondition, parseCcVerdict, CC_EVALUATOR_MAX_OUTPUT_TOKENS } from "./cc-stop-prompt.js";
 import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
+import { buildRequestUrlCredentialRefusal, findUrlCredential, urlCredentialHeaderExit } from "../url-credential.js";
 import { HOOK_PHASES, HOOK_SOURCE_VOCABULARY_SENTENCE, hookPhaseOf, readHookGroupSource } from "./hook-source.js";
 import { commandLineChars, composeHookEnvLayer, hookPluginChars, planCommandSpawn, readHookArgs, readHookPlugin } from "./command-spawn.js";
 export const MAX_HOOK_ENTRIES_PER_EVENT = 32;
@@ -102,9 +104,7 @@ export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
 export const ADMISSION_MATCHER_BUDGET = { budgetMs: 1_000, totalMs: 5_000 };
 export const MATCHER_ECHO_CHARS = 200;
 export const IF_ECHO_CHARS = 200;
-const LOG_PREVIEW_ECHO_CHARS = 200;
-const LOG_ERROR_ECHO_CHARS = 300;
-const LOG_MESSAGE_ECHO_CHARS = 500;
+const BLANKED_HEADER_ECHO_CHARS = 200;
 const MATCHER_UNJUDGED_TAG = "server.hooks.matcher-unjudged";
 function matcherReadsWireToolName(event) {
     return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
@@ -331,6 +331,24 @@ export function hooksMatcherIssue(config, depth, budget = {}) {
     }
     return undefined;
 }
+export function hooksUrlCredentialIssue(config) {
+    for (const [event, groups] of Object.entries(config)) {
+        for (const [groupIndex, group] of (groups ?? []).entries()) {
+            for (const [entryIndex, entry] of group.hooks.entries()) {
+                if (entry.type !== "http")
+                    continue;
+                const credential = findUrlCredential(entry.url);
+                if (credential !== undefined)
+                    return { event, groupIndex, entryIndex, credential };
+            }
+        }
+    }
+    return undefined;
+}
+export function buildHooksUrlCredentialRefusal(issue) {
+    const entry = `settings.hooks.${issue.event}[${issue.groupIndex}].hooks[${issue.entryIndex}]`;
+    return buildRequestUrlCredentialRefusal(`${entry}.url`, issue.credential, urlCredentialHeaderExit(`${entry}.headers`));
+}
 const HOOKS_PIECE_MEANING = {
     "hooks-not-object": "`hooks` must be an object keyed by hook event name",
     "unknown-event": "not a hook event name",
@@ -504,10 +522,10 @@ const MAX_LLM_ENTRIES_PER_EVENT = 4;
 const DEFAULT_PROMPT_HOOK_TIMEOUT_SECONDS = 30;
 const DEFAULT_AGENT_HOOK_TIMEOUT_SECONDS = 120;
 function logHookCommandFailed(ctx, event, run) {
-    ctx.logger.warn("hook_command_failed", { event, code: run.code, stderr: echoCallerText(run.stderr, { maxChars: LOG_ERROR_ECHO_CHARS }) });
+    ctx.logger.warn("hook_command_failed", { event, code: run.code, stderr: seatText("operator-log-error", run.stderr) });
 }
 function logHookSystemMessage(ctx, event, message) {
-    ctx.logger.info("hook_system_message", { event, message: echoCallerText(message, { maxChars: LOG_MESSAGE_ECHO_CHARS }) });
+    ctx.logger.info("hook_system_message", { event, message: seatText("operator-log-message", message) });
 }
 function hookDisplayName(entry) {
     if (typeof entry.statusMessage === "string" && entry.statusMessage.length > 0)
@@ -536,7 +554,7 @@ function emitHookNotice(ctx, n) {
     }
     catch (e) {
         recordFailOpen("server.hooks.notice-sink-threw", `kind=${n.kind} event=${n.event}`);
-        ctx.logger.warn("hook_notice_sink_threw", { kind: n.kind, event: n.event, error: echoCallerText(String(e), { maxChars: LOG_PREVIEW_ECHO_CHARS }) });
+        ctx.logger.warn("hook_notice_sink_threw", { kind: n.kind, event: n.event, error: seatText("operator-log-text", String(e)) });
     }
 }
 function noteHookFailure(ctx, args) {
@@ -557,7 +575,7 @@ function noteHookFailure(ctx, args) {
 }
 function noteMatcherOverBudget(ctx, args) {
     const budgetMs = ADMISSION_MATCHER_BUDGET.budgetMs;
-    const shown = (text) => echoCallerText(boundedNoticeText(text), { maxChars: MATCHER_ECHO_CHARS });
+    const shown = (text) => seatText("operator-log-text", text);
     const expression = shown(args.expression);
     const value = shown(args.value);
     ctx.logger.warn("hook_matcher_over_budget", { event: args.event, scope: args.scope, expression, value, budgetMs, selected: true });
@@ -879,7 +897,7 @@ async function fireAsyncCommandHook(entry, payload, ctx, event, halt) {
         }
         child.on("error", (e) => {
             clearTimeout(timer);
-            ctx.logger.warn("hook_async_failed", { event, reason: "spawn_failed", error: echoCallerText(String(e), { maxChars: LOG_ERROR_ECHO_CHARS }) });
+            ctx.logger.warn("hook_async_failed", { event, reason: "spawn_failed", error: seatText("operator-log-error", String(e)) });
             noteHookFailure(ctx, { event, entry, reason: "spawn_failed", stderr: String(e), toolName: toolNameOf(payload) });
         });
         child.on("close", (code) => {
@@ -902,14 +920,14 @@ async function fireAsyncCommandHook(entry, payload, ctx, event, halt) {
                     ctx.logger.info("hook_async_rewake_delivered", { event, chars: text.length });
                 else
                     ctx.logger.warn("hook_async_rewake_dropped", { event, reason: "no_live_stream" });
-            }, (e) => ctx.logger.warn("hook_async_rewake_dropped", { event, reason: "wake_failed", error: echoCallerText(String(e), { maxChars: LOG_PREVIEW_ECHO_CHARS }) }));
+            }, (e) => ctx.logger.warn("hook_async_rewake_dropped", { event, reason: "wake_failed", error: seatText("operator-log-text", String(e)) }));
         });
         child.stdin?.on("error", () => { });
         child.stdin?.end(`${JSON.stringify(boundedToolInputPayload(payload))}\n`);
         child.unref();
     }
     catch (e) {
-        ctx.logger.warn("hook_async_failed", { event, reason: "spawn_failed", error: echoCallerText(String(e), { maxChars: LOG_ERROR_ECHO_CHARS }) });
+        ctx.logger.warn("hook_async_failed", { event, reason: "spawn_failed", error: seatText("operator-log-error", String(e)) });
         noteHookFailure(ctx, { event, entry, reason: "spawn_failed", stderr: String(e), toolName: toolNameOf(payload) });
     }
 }
@@ -996,7 +1014,7 @@ async function runHttpHook(entry, payload, ctx, event) {
             blankedCount: interpolated.blanked.length,
             blanked: interpolated.blanked
                 .slice(0, MAX_BLANKED_REFERENCES_LOGGED)
-                .map(({ header, name, reason }) => ({ header: echoCallerText(header, { maxChars: LOG_PREVIEW_ECHO_CHARS }), name: echoCallerText(name, { maxChars: LOG_PREVIEW_ECHO_CHARS }), reason })),
+                .map(({ header, name, reason }) => ({ header: echoCallerText(header, { maxChars: BLANKED_HEADER_ECHO_CHARS }), name: echoCallerText(name, { maxChars: BLANKED_HEADER_ECHO_CHARS }), reason })),
         });
     }
     const headers = { "content-type": "application/json", ...interpolated.headers };
@@ -1034,7 +1052,7 @@ async function runHttpHook(entry, payload, ctx, event) {
             if (trimmed === "")
                 return { code: 0, stdout: "{}", stderr: "", timedOut: false };
             if (!parseHookStdout(body)) {
-                ctx.logger.warn("hook_http_non_json_response", { url: buildDisplaySafeUrl(entry.url), preview: echoCallerText(trimmed, { maxChars: LOG_PREVIEW_ECHO_CHARS }) });
+                ctx.logger.warn("hook_http_non_json_response", { url: buildDisplaySafeUrl(entry.url), preview: seatText("operator-log-text", trimmed) });
                 noteHookFailure(ctx, {
                     event: eventOfPayload(payload),
                     entry,
@@ -1086,7 +1104,7 @@ function readHookStdout(ran, event, ctx, payload, ledger) {
         return out;
     const t = run.stdout.trim();
     if (t.startsWith("{") || t.startsWith("[")) {
-        ctx.logger.warn("hook_bad_json_output", { event, type: entry.type, preview: echoCallerText(t, { maxChars: LOG_PREVIEW_ECHO_CHARS }) });
+        ctx.logger.warn("hook_bad_json_output", { event, type: entry.type, preview: seatText("operator-log-text", t) });
         noteHookFailure(ctx, { event, entry, reason: "bad_json", exitCode: run.code, stderr: run.stderr, toolName: toolNameOf(payload) });
         ledger.unrun(ran.source, entry, "bad_json");
     }
@@ -1193,7 +1211,7 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
             return { kind: "halted" };
         }
         if (run.spawnError) {
-            ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: echoCallerText(run.spawnError, { maxChars: LOG_ERROR_ECHO_CHARS }) });
+            ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: seatText("operator-log-error", run.spawnError) });
             if (!run.noticed)
                 noteHookFailure(ctx, { event, entry, reason: "spawn_failed", exitCode: run.code, stderr: run.spawnError, ...(toolName !== undefined ? { toolName } : {}) });
             return { kind: "unrun", reason: "spawn_failed" };
@@ -1393,7 +1411,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                             }
                             if (decision === "allow" || decision === undefined) {
                                 const proposed = h.updatedInput !== null && typeof h.updatedInput === "object" ? h.updatedInput : undefined;
-                                const proposesRewrite = proposed !== undefined && canonicalJson(proposed) !== canonicalJson(groupInput);
+                                const proposesRewrite = proposed !== undefined && canonicalJsonStringify(proposed) !== canonicalJsonStringify(groupInput);
                                 if (ran.distrust !== undefined && hookPhaseOf(ran.source) === "unmanaged" && (decision === "allow" || proposesRewrite)) {
                                     noteVerdictUntrusted(ctx, { event: "PreToolUse", reason: ran.distrust, entry, source: ran.source, toolName });
                                 }
@@ -1411,7 +1429,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                                 unknownDecision = true;
                                 ctx.logger.warn("hook_permission_decision_unknown", {
                                     event: "PreToolUse",
-                                    decision: echoCallerText(typeof decision === "string" ? decision : typeof decision, { maxChars: LOG_PREVIEW_ECHO_CHARS }),
+                                    decision: seatText("operator-log-text", typeof decision === "string" ? decision : typeof decision),
                                     tool: toolName,
                                     effect: "hook ruling not honored (closed word set is allow|deny|ask); this call falls back to the engine gate",
                                 });
@@ -1675,7 +1693,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                         branch = await sctx.getBranch?.();
                     }
                     catch (e) {
-                        ctx.logger.warn("hook_stop_branch_failed", { error: echoCallerText(e instanceof Error ? e.message : String(e), { maxChars: LOG_ERROR_ECHO_CHARS }) });
+                        ctx.logger.warn("hook_stop_branch_failed", { error: seatText("operator-log-error", e instanceof Error ? e.message : String(e)) });
                     }
                     const rendered = renderBranchTranscript(branch);
                     if (rendered.sufficient) {
@@ -1718,7 +1736,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                     if (v.ok)
                         continue;
                     if (v.impossible) {
-                        ctx.logger.warn("hook_stop_condition_impossible", { event: "Stop", reason: echoCallerText(v.reason?.trim() ?? "", { maxChars: LOG_MESSAGE_ECHO_CHARS }) });
+                        ctx.logger.warn("hook_stop_condition_impossible", { event: "Stop", reason: seatText("operator-log-message", v.reason?.trim() ?? "") });
                         continue;
                     }
                     if (block === undefined)
@@ -1728,7 +1746,7 @@ export function createSettingsHooksRegistration(config, ctx, budgetMs) {
                 const out = llmExtra && entry.type === "prompt" ? parseHookStdout(run.stdout) : readHookStdout(ran, "Stop", ctx, payload, ledger);
                 if (!out) {
                     if (llmExtra && entry.type === "prompt") {
-                        ctx.logger.warn("hook_llm_unparsed_verdict", { event: "Stop", head: echoCallerText(run.stdout.trim(), { maxChars: LOG_PREVIEW_ECHO_CHARS }) });
+                        ctx.logger.warn("hook_llm_unparsed_verdict", { event: "Stop", head: seatText("operator-log-text", run.stdout.trim()) });
                         emitHookNotice(ctx, { kind: "hook_decision_unavailable", event: "Stop", reason: "unparsed" });
                         ledger.unrun(ran.source, entry, "bad_json", "the prompt hook's answer could not be read as a verdict");
                     }

package/dist/host-decision.d.ts

@@ -44,7 +44,7 @@ import { type AskOutcome, type HostDecider, type PermissionResult, type ResumeOu
  * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
  * 读它的每一处编译期先红。
  *
- * 🔴 **S-558:为什么这一格住在本叶子模块**(此前是 `tool-approval.ts` 的模块私有型):来源位随决议
+ * 🔴 **[ref]:为什么这一格住在本叶子模块**(此前是 `tool-approval.ts` 的模块私有型):来源位随决议
  * **落持久行**之后,店(`src/plugins/approval-ask-store-sql.ts` 的 `AskRow.settledBy` /
  * `DecideAskInput.settledBy`)与协调器都要说同一个型 —— 而店不能反向依赖协调器。本模块只依赖
  * `@sema-agent/core`,与同住的 {@link HostDecision}(耐久腿的同位事实)恰好是一对:一条决议的来源
@@ -54,7 +54,7 @@ export type HostSettledBy = NonNullable<Extract<AskOutcome, {
     allow: boolean;
 }>["settledBy"]>;
 /** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。它的 `decidedBy` 就是 core 的 `HostDecider`
- *  (core 7.45.0 #1387:三个型位读同一只闭集)。**谁结束了这次等待**的闭集只有 core 包根那一只(`HOST_DECIDERS` / `HostDecider` / `isHostDecider`)。 */
+ *  (core 7.45.0 [ref]:三个型位读同一只闭集)。**谁结束了这次等待**的闭集只有 core 包根那一只(`HOST_DECIDERS` / `HostDecider` / `isHostDecider`)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>["hostDecision"];
@@ -72,14 +72,14 @@ export type HostDecision = Extract<ResumeOutcome, {
  *  · `plan_review` 不读这只键:引擎的 plan_review 结局形没有决定者位(core 的结局规整会把别的键整只重建掉),收下它就是
  *    一句「已记」的空话。那一门照兄弟门字段那一族拒(`approvals-assistant.ts` 的回决门族派生),候 core 给座。
  *
- * 词表的来源:core 包根的 `HOST_DECIDERS` / `HostDecider` / `isHostDecider`(core 7.45.0 #1387;此前包根只有型,本仓手写一只闭集常量 + 两道
+ * 词表的来源:core 包根的 `HOST_DECIDERS` / `HostDecider` / `isHostDecider`(core 7.45.0 [ref];此前包根只有型,本仓手写一只闭集常量 + 两道
  * 编译门双向咬它 —— 那份手抄随本版退役)。wire 闭集 = 那只词表去掉扫的那一个词,运行期值与型都从它派生,没有第二份词表。
  */
 /** 只有本服务自己的截止扫说得出的那一个词 —— core 词表里唯一不上 wire 的成员(`satisfies`:core 改名 / 退役它 ⇒ 这里编译红)。 */
 declare const SWEEP_ONLY_DECIDER = "sla_timeout";
 /** wire 上的出处词(决定体 `decidedBy` 的值域)= core 闭集去掉扫的那一个。 */
 export type ApprovalDecidedBy = Exclude<HostDecider, typeof SWEEP_ONLY_DECIDER>;
-/** wire 闭集的运行期值:core `HOST_DECIDERS`(#1387)去掉扫的那一个,顺序随 core。core 加一个词 ⇒ 它在这里自动在场(决定口的门照收;两只座的映射
+/** wire 闭集的运行期值:core `HOST_DECIDERS`([ref])去掉扫的那一个,顺序随 core。core 加一个词 ⇒ 它在这里自动在场(决定口的门照收;两只座的映射
  *  {@link liveSettledBy} 的穷举 `switch` 编译红,由人裁它在同步座上怎么落)。 */
 export declare const APPROVAL_DECIDED_BY: readonly ApprovalDecidedBy[];
 /** 闭集外的拒句(三条决定口同一句;码按各口既有约定,见 {@link readDecidedBy})。成员表派生自 {@link APPROVAL_DECIDED_BY}(词表一个来源;今天字节与 7.118.0 同)。 */
@@ -141,7 +141,7 @@ export declare function readDecidedBy(raw: unknown, directDoorActive: boolean):
  */
 export declare function liveSettledBy(decidedBy: ApprovalDecidedBy): Extract<HostSettledBy, "policy"> | undefined;
 /**
- * 引擎自己的那一条例外:**一张要人的卡不归策略答** —— 判官是 core 的 `policyCannotAnswer(question, decidedBy)`(#1395 包根导出;引擎的续跑入口、
+ * 引擎自己的那一条例外:**一张要人的卡不归策略答** —— 判官是 core 的 `policyCannotAnswer(question, decidedBy)`([ref] 包根导出;引擎的续跑入口、
  * 执行带与同步座读同一条)。本仓**只在自己的副作用先于引擎落地的两条口**上于裁决之前问它(live `/respond`:会话放行 / 常驻规则 / 一条按 approve
  * 回放的 DECIDED 行;耐久 ask 账:一条宣称 approve 的 DECIDED 行),并且只问**放行**那一向(与引擎续跑入口同:拒永远答得了)。耐久 `/decide` 不判:
  * 引擎在 CAS 之前就拒(`checkpoint.invalid_outcome`,卡留 pending),本口的副作用全在引擎受理之后 —— 在那里再问一次就是第二个判官。

package/dist/host-lsp-manager.d.ts

@@ -1,7 +1,7 @@
 /**
- * S-616(core 7.30.1 #1073 提货)—— **宿主车道本地语言服务器**的唯一构造点。
+ * [ref](core 7.30.1 [ref] 提货)—— **宿主车道本地语言服务器**的唯一构造点。
  *
- * ## 病(DEBTS S-684 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
+ * ## 病(DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
  * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的
  * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
  * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
@@ -9,10 +9,10 @@
  * 本仓唯一组合 `hostSubprocessEnv` 的结果 —— 引擎 `inheritedHostEnv("scrub")` ∪ 点名放回)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键([ref],见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
- * 会漏掉形状规则认不出的本仓凭据键(当时是 `OTEL_EXPORTER_OTLP_HEADERS`,core 7.33.7 #1180 起 core 按名剥它;今天只剩名单型旋钮三只),那正是 S-684 当初的病形。
+ * 会漏掉形状规则认不出的本仓凭据键(当时是 `OTEL_EXPORTER_OTLP_HEADERS`,core 7.33.7 [ref] 起 core 按名剥它;今天只剩名单型旋钮三只),那正是 [ref] 当初的病形。
  * 剥掉了什么经既有观测面留痕(site = `server.lsp.spawn-env`,每 site×key 一次披露 + 逐次计数)—— core 那侧
  * 刻意不报(无收集器,KL),本仓这一格补上。
  *
@@ -20,7 +20,7 @@
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
  * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走 web-admin,不改 `process.env`),两者在本仓部署上同值。
  *
- * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
+ * ## 点名放行([ref],`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
  * env = 引擎 `inheritedHostEnv("scrub")` 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与沙箱三腿

package/dist/hosted-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-591 / S-564(车LT,7.95.0)→ S-671 / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ * [ref] / [ref](车LT,7.95.0)→ [ref] / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
  *
  * ## 为什么是一处
  *
@@ -11,14 +11,12 @@
  *    ⚠️ 这句话此前在本仓被抄成「`boot/resolve-spec.ts` 阶段④ 的 `partitions` 字面量」——`src/` 里**没有**
  *    那个字面量(全仓 `partitions` 的 src 命中全是注释;尺子:同目录 `config` 3721 命中)。手抄的**坐标**
  *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
- *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
- *    (异源复核实测,别照「它们都一样」写):
- *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调),判据**只有**
- *       `requirePrincipal !== true` ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
- *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
- *       (= `provider === "host" ∧ requirePrincipal !== true`);
- *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而
- *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
+ *  · 能力授予面的赦免挂在「单主」上 —— 但**三条面读的是部署形表(`deployment-shape.ts`)里三个不同的行**
+ *    (异源复核实测,别照「它们都一样」写;[ref] 起三行并排在一张表里,轴列即差异):
+ *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调)= 表行
+ *       `multiTenant` 的反面 ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `additionalDirectories` / `additionalReadDirectories` —— 表行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主 = 今天只有 host);
+ *     · `settings.env` / `cwd` —— 表行 `callerCwd`(读能力表 `callerCwd` 位:host 单主才开,**device 不读租户**:那条路径落在
  *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
  *
  * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
@@ -36,7 +34,7 @@
  * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
  * (`SEMA_WEB_ADMIN_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
  *
- * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
+ * 随两臂一起删掉的(按类删干净,规则集变小):[ref] 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
  * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
  * `run-local.ts` 为那两臂清 env 的清除口。
  *
@@ -85,7 +83,7 @@ export interface HostedPostureFacts {
     readonly evidence: readonly HostedEvidence[];
 }
 /**
- * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ `requirePrincipal === true`([ref] ①)。
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ 部署形表行 `multiTenant`(= 运维声明 `REQUIRE_PRINCIPAL=true`,[ref] ①)。
  *
  * `evidence` 仍是数组(按词表顺序收**全部**命中):拒因逐字点它们,运维才知道改哪儿;词表是闭集,
  * 形状不随词数变。
@@ -99,7 +97,19 @@ export declare function hostedEvidenceNote(e: HostedEvidence): string;
 export type TaskWriteFaceInput = TaskHostPostureScope & Readonly<Pick<ServiceConfigFlat, "taskWriteFaceEscalation">>;
 /** 任务层宿主姿态声明被拒时的 wire 子码(附录 A 的 `request.` 族)。 */
 export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
-/** 射程判据读的键集(托管证据 + 车道)。 */
+/**
+ * **射程判据** —— 这台部署认不认「任务层替它声明的宿主姿态」?
+ *
+ * 两条腿读它,都是**真的开门**的声明 ⇒ 都响亮拒(同码 {@link HOST_POSTURE_REFUSED_CODE}、同状态 422):
+ *  · 腿② 写容纳面(bypassPermissions 开的写面)—— {@link taskWriteFaceRefusal};
+ *  · 腿④ [ref] host shell 继承整份用户环境(`inheritEnv:"all"`)—— {@link taskInheritEnvRefusal}。
+ * [ref] 前还有腿③(`approverPosture`,忽略 + 留声),随那个请求键一起退役。射程只铸在这一处,同族声明读同一只。
+ *
+ * 🔴 **device 车道不适用(clay 裁定③ 2026-09-22)**:device 车道上 host 闸防的那个跨租户宿主穿越**结构性不存在**
+ * (路径落在**发起者自己的设备**上,归属由 `device_session` 绑定行 + 准入链的 owner 谓词验过),叠加 clay [ref]
+ * 「device 零额外审批」⇒ 在那条车道上拿租户声明当判据就是**用错轴**。与 `settings.env` / `cwd` 两键在那条车道上的既有臂同源同形。
+ * [ref] 起射程判据 = 部署形表行 `taskHostPostureDeclarations`(device 车道 ∨ 单主;轴列 lane + principal);下面是它读的键集(托管证据 + 车道)。
+ */
 export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceConfigFlat, "remoteExec">>;
 /**
  * **腿②** —— 这条请求要掀开写围栏,这台部署给不给?返回拒因;`undefined` = 放行。
@@ -109,7 +119,7 @@ export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceCon
  * governance 的 `overrides.writeFace="roots"` 去压——实测 core 的 `tightenTaskSpec` 在
  * base `open` × override `roots` 上**静默**取 `roots`(该函数零回调形参 ⇒ 没有留痕通道)。
  *
- * 🔴 **射程(含 device 车道那条对位臂)在共用谓词 {@link hostPostureDeclarationsHonored} 上** ——
+ * 🔴 **射程(含 device 车道那条对位臂)在部署形表行 `taskHostPostureDeclarations` 上** ——
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;

package/dist/hosted-posture.js

@@ -1,9 +1,9 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
-import { deviceCwdHonored } from "./task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
-    if (c.requirePrincipal === true)
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(c))
         evidence.push("require-principal");
     return { hosted: evidence.length > 0, evidence };
 }
@@ -17,11 +17,6 @@ function hostedBecause(facts) {
     return facts.evidence.map(hostedEvidenceNote).join("; ");
 }
 export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
-function hostPostureDeclarationsHonored(c) {
-    if (deviceCwdHonored(c))
-        return true;
-    return !buildHostedPosture(c).hosted;
-}
 export function taskWriteFaceRefusal(c) {
     switch (c.taskWriteFaceEscalation) {
         case "allow":
@@ -39,7 +34,7 @@ export function taskWriteFaceRefusal(c) {
                 `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
         }
     }
-    if (hostPostureDeclarationsHonored(c))
+    if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;
     const facts = buildHostedPosture(c);
     return (`permissionMode:"bypassPermissions" opens the WRITE containment face (the engine's bypassPermissions mode writes outside the write roots) — the run could write outside the task root. ` +
@@ -47,7 +42,7 @@ export function taskWriteFaceRefusal(c) {
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
 export function taskInheritEnvRefusal(c) {
-    if (hostPostureDeclarationsHonored(c))
+    if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;
     const facts = buildHostedPosture(c);
     return (`inheritEnv:"all" hands the model-driven host shell this machine's WHOLE environment (credential-shaped variables included — the host lane scrubs them by default). ` +

package/dist/http/admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * 提交准入(S-147 切片:`http/server.ts` 的 `prepareSpec` 与它的模块级校验词表逐字搬家,正文一字未改)。
+ * 提交准入([ref] 切片:`http/server.ts` 的 `prepareSpec` 与它的模块级校验词表逐字搬家,正文一字未改)。
  * 读体 → 验型 → 授权 → 建 spec 的**唯一**一条链;tasks / runs / A2A 三个提交面共用它(抄一份 = 抄一份会漂的 400)。
  * ctx 字段 3 只(`deps` / `readJson` / `runnerFor`),机器算(closure-free-vars)与手抄一致。
  */
@@ -59,7 +59,7 @@ export interface UserSkillsRefusal {
     readonly facts?: LimitFacts;
 }
 /**
- * core 7.41.0 #1303 —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
+ * core 7.41.0 [ref] —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
  * (`allowedTools` / `disallowedTools`)、圈工具 = deny 规则(请求 `settings.permissions.deny` / 运维 `APPROVAL_DENY`)或子代定义的
  * `agents[].allowTools`、圈写路径 = 会话规则 `allowDirs`(`PUT /v1/sessions/:id/policy`)。
  */

package/dist/http/admission.js

@@ -2,15 +2,16 @@ import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
+import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
-import { buildHooksRefusal, parseHooksConfig, hooksMatcherIssue } from "../hooks/hook-runner.js";
-import { judgeRequestWebSearch } from "../plugins/web-search.js";
+import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
+import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
@@ -251,6 +252,13 @@ export function createAdmission(ctx) {
                     return null;
                 }
             }
+            {
+                const familiesIssue = approvalFrameFamiliesIssue(st);
+                if (familiesIssue) {
+                    sendError(res, 400, "request.field_invalid", familiesIssue.message, familiesIssue.fields);
+                    return null;
+                }
+            }
             const envRaw = st.env;
             if (envRaw !== undefined && envRaw !== null) {
                 if (typeof envRaw !== "object" || Array.isArray(envRaw)) {
@@ -292,6 +300,21 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
+                {
+                    const hooksKeys = hooksKeyIssue(st.hooks, hooksParsed.config);
+                    if (hooksKeys) {
+                        sendError(res, 400, "request.body_shape", hooksKeys.message, { unknownKeys: hooksKeys.unknownKeys, unsupportedKeys: hooksKeys.unsupportedKeys });
+                        return null;
+                    }
+                }
+                {
+                    const hookUrl = hooksUrlCredentialIssue(hooksParsed.config);
+                    if (hookUrl !== undefined) {
+                        const refusal = buildHooksUrlCredentialRefusal(hookUrl);
+                        sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
+                        return null;
+                    }
+                }
                 const toolMatcher = hooksMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (toolMatcher !== undefined) {
                     const refusal = buildHooksRefusal(toolMatcher);
@@ -300,9 +323,9 @@ export function createAdmission(ctx) {
                 }
             }
             {
-                const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
+                const webSearchVerdict = judgeFreshRequestWebSearch(st.webSearch);
                 if (webSearchVerdict.kind === "malformed") {
-                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue);
+                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue, webSearchVerdict.facts);
                     return null;
                 }
             }

package/dist/http/approval-sweeps.d.ts

@@ -1,5 +1,5 @@
 /**
- * 审批扫腿(S-147 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
+ * 审批扫腿([ref] 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
  * ①`denyExpiredApprovals`([ref] D-D,SLA 到期的 deny-sweep,main.ts 的 reaper 按拍调);
  * ②`redeemParkedAsk`([ref],live 回决腿的 PARKED 赎回席,装配层接进协调器的晚绑座)。
  * 两者都走 resume 家族的 `resumeCheckpoint`,所以它们的属主是「谁在无 HTTP 请求的情况下替人做决定」这件事,

package/dist/http/approval-sweeps.js

@@ -3,7 +3,8 @@ const errText = (e) => redactHead(e instanceof Error ? e.message : String(e), 20
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
 import { hostDecisionFacts } from "../host-decision.js";
-import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
+import {} from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS } from "../approval-content-kind.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { gatedPrincipal, hasServiceAuth } from "./principal-gate.js";
 import { costQuotaRefusalOf } from "./request-guards.js";
@@ -104,9 +105,11 @@ export function createApprovalSweeps(ctx) {
             }
         };
         const storedBodyUnservable = async (sessionId) => {
-            const read = await readResumeCtx(cs.getCtx(sessionId));
+            const read = await readResumeCtx(cs.getCtx(sessionId), { sessionId, opener: deps.checkpointCtxSealing });
             if (read.kind === "corrupt")
                 return undefined;
+            if (read.kind === "unsealable")
+                return undefined;
             if (read.kind === "absent")
                 return undefined;
             return storedBodyReplayRefusal(read.ctx, deps.config);