@sema-agent/server 7.135.0 → 7.137.0

package/dist/request-declaration-refusal.js

@@ -0,0 +1,78 @@
+import { describeBadWireName, describeValueShape, isUsableWireName, stripControlAndBidi } from "@sema-agent/settings-schema";
+import { createCodedHttpError } from "./security.js";
+import { limitRefusal } from "./limit-refusal.js";
+import { echoKeyName } from "./request-key-closure.js";
+import { urlCredentialFacts } from "./url-credential-refusal.js";
+export const MALFORMED_NAME = "<malformed>";
+export function declaredName(e) {
+    return e && typeof e === "object" && typeof e.name === "string" && e.name !== ""
+        ? String(e.name)
+        : MALFORMED_NAME;
+}
+export function declarationNameIssue(entry) {
+    return isUsableWireName(entry.name) ? undefined : { path: "name", reason: `must be a non-empty string within the wire-name length bound — got ${describeBadWireName(entry.name)}` };
+}
+export const LIST_REFUSAL_TAIL = "The request is refused rather than acting on part of the list: declarations that silently did not apply would read as in effect to whoever sent them. " +
+    "Fix the list (an empty list declares none).";
+export function declarationListRefusal(head) {
+    return { errorCode: "request.field_invalid", message: `${head}. ${LIST_REFUSAL_TAIL}` };
+}
+function entryRefusalTail(subject) {
+    return (`The request is refused rather than mounting the ${subject} without it: a declaration that silently did not apply would leave the ${subject} running differently from what you declared. ` +
+        "Fix the entry (an optional key may also be omitted).");
+}
+export function declarationIssueFacts(at, issue) {
+    return { field: `${at}.${issue.path}`, reason: stripControlAndBidi(issue.reason) };
+}
+export function declarationOverCapFacts(seat, count) {
+    const capped = limitRefusal(seat.list, "entries", count, seat.cap);
+    return { field: capped.facts.field, reason: capped.message };
+}
+export function declarationEntryNotObject(seat, entry, at) {
+    return entry === null || typeof entry !== "object" || Array.isArray(entry) ? `${at} is ${describeValueShape(entry)}, not ${seat.declaration} (an object)` : undefined;
+}
+export function declarationFieldRefusal(seat, entry, at, issue) {
+    const name = echoKeyName("", declaredName(entry));
+    const { field, reason } = declarationIssueFacts(at, issue);
+    return {
+        errorCode: "request.field_invalid",
+        message: `${field} (${seat.subject} "${name}") is not a usable declaration — ${reason}. ${entryRefusalTail(seat.subject)}`,
+        ...(issue.credential === undefined ? {} : { facts: urlCredentialFacts(`${at}.${issue.path}`, issue.credential) }),
+    };
+}
+export function judgeDeclarationKeys(seat, entry, at, keys, judges) {
+    for (const key of keys) {
+        const issue = judges[key](entry, at);
+        if (issue !== undefined)
+            return declarationFieldRefusal(seat, entry, at, issue);
+    }
+    return undefined;
+}
+export function requestDeclarationRefusal(seat, list, judgeEntry) {
+    if (list === undefined || list === null)
+        return undefined;
+    if (!Array.isArray(list))
+        return declarationListRefusal(`${seat.list} is ${describeValueShape(list)}, not an array of ${seat.declarations}`);
+    if (list.length > seat.cap) {
+        const capped = limitRefusal(seat.list, "entries", list.length, seat.cap, { tail: LIST_REFUSAL_TAIL });
+        return { errorCode: "request.field_invalid", message: capped.message, facts: capped.facts };
+    }
+    for (let i = 0; i < list.length; i++) {
+        const entry = list[i];
+        const at = `${seat.list}[${i}]`;
+        const notObject = declarationEntryNotObject(seat, entry, at);
+        if (notObject !== undefined)
+            return declarationListRefusal(notObject);
+        const refusal = judgeEntry(entry, at);
+        if (refusal !== undefined)
+            return refusal;
+    }
+    return undefined;
+}
+export function throwDeclarationRefusal(refusal) {
+    if (refusal === undefined)
+        return;
+    const extra = { ...(refusal.unknownKeys === undefined ? {} : { unknownKeys: [...refusal.unknownKeys] }), ...(refusal.facts ?? {}) };
+    throw createCodedHttpError(400, refusal.errorCode, refusal.message, Object.keys(extra).length === 0 ? undefined : extra);
+}
+//# sourceMappingURL=request-declaration-refusal.js.map

package/dist/request-image-urls.d.ts

@@ -0,0 +1,6 @@
+import { type UrlCredentialRefusal } from "./url-credential-refusal.js";
+/** 请求体 `images` 的 URL 座:任一条目的串值 `url` 带凭据 ⇒ 拒(整句 + 机读位),列表序第一处即答;没有 ⇒ `undefined`。`images` 不是数组 / 缺席 ⇒ `undefined`(形归受理口别的门)。 */
+export declare function requestImageUrlRefusal(images: unknown): UrlCredentialRefusal | undefined;
+/** fresh 提交腿的 `images` URL 门:{@link requestImageUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
+export declare function assertRequestImageUrls(bodyImages: unknown): void;
+//# sourceMappingURL=request-image-urls.d.ts.map

package/dist/request-image-urls.js

@@ -0,0 +1,27 @@
+import { createCodedHttpError } from "./security.js";
+import { findUrlCredential } from "@sema-agent/settings-schema";
+import { buildRequestUrlCredentialRefusal } from "./url-credential-refusal.js";
+function inlineImageExit(at) {
+    return `${at} can carry the image bytes inline: send { "data": <base64>, "mimeType": "image/png" | "image/jpeg" | "image/gif" | "image/webp" } instead of a URL that holds the credential`;
+}
+export function requestImageUrlRefusal(images) {
+    if (!Array.isArray(images))
+        return undefined;
+    for (const [i, image] of images.entries()) {
+        if (image === null || typeof image !== "object")
+            continue;
+        const url = image.url;
+        const found = typeof url === "string" ? findUrlCredential(url) : undefined;
+        if (found === undefined)
+            continue;
+        const at = `images[${i}]`;
+        return buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+    }
+    return undefined;
+}
+export function assertRequestImageUrls(bodyImages) {
+    const refusal = requestImageUrlRefusal(bodyImages);
+    if (refusal !== undefined)
+        throw createCodedHttpError(400, "request.field_invalid", refusal.message, refusal.facts);
+}
+//# sourceMappingURL=request-image-urls.js.map

package/dist/request-key-closure.d.ts

@@ -17,6 +17,11 @@ export declare function scanKeyClosure(bag: object, prefix: string, accepted: Re
     unknown: string[];
     unsupported: string[];
 }): void;
+/** {@link scanKeyClosure} 的名字形:键名已经由调用方读成一张表(请求入口的快照只带词表外的键**名**,值不读),分拣规则同一条。 */
+export declare function scanKeyNames(names: readonly string[], prefix: string, accepted: ReadonlySet<string>, tolerated: ReadonlySet<string>, into: {
+    unknown: string[];
+    unsupported: string[];
+}): void;
 /** 一张分类表的文案片段(封顶后只报数)。 */
 export declare function keyClosureClause(names: string[], label: string): string;
 /**

package/dist/request-key-closure.js

@@ -5,7 +5,10 @@ export function echoKeyName(prefix, key) {
     return `${prefix}${echoCallerText(key)}`;
 }
 export function scanKeyClosure(bag, prefix, accepted, tolerated, into) {
-    for (const k of Object.keys(bag)) {
+    scanKeyNames(Object.keys(bag), prefix, accepted, tolerated, into);
+}
+export function scanKeyNames(names, prefix, accepted, tolerated, into) {
+    for (const k of names) {
         if (accepted.has(k))
             continue;
         (tolerated.has(k) ? into.unsupported : into.unknown).push(echoKeyName(prefix, k));
@@ -23,7 +26,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
-    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",

package/dist/request-value-closure.d.ts

@@ -118,7 +118,36 @@ export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
 export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
 /** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
 export declare const INHERIT_ENV_VALUE_MESSAGE: string;
-/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
-export declare function inheritEnvFieldIssue(raw: unknown): string | null;
+/**
+ * `inheritEnv` 的 `request.field_invalid` 400 的机读 `reason`([ref];闭集,**一种拒因一个词**,读者穷举读)—— 拒体另带 `field: "inheritEnv"` 与它,
+ * 壳靠这两位认「这条 400 真是 `inheritEnv` 的」,不猜句子。同一个键的**三只** 400 是一类,词表一张:
+ *  · `unknown_word` —— 值形:是字符串,但不在受理词表(`"ALL"` · `"everything"` · `""`);
+ *  · `not_a_string` —— 值形:根本不是字符串(名单形 `string[]` · 布尔 · 数字 · `null` · 对象);
+ *  · `lane_not_host` —— `"all"` 落在非 host 车道(只有 host 工厂消费这一位,别的车道没有消费点);
+ *  · `no_authorizer_session` —— `"all"` 而部署不接 authorizer(绑定按会话键控,没有会话就没有地方兑现)。
+ * 前两词的判官是 {@link inheritEnvFieldIssue}(只看体);后两词的判官在 `boot/resolve-spec.ts`(要读部署事实,两腿同过)。
+ * 不在这组的:`422 request.host_posture_refused`(托管部署不兑现 `"all"`)—— 那不是这个键的值写错,而是部署姿态拒,码与写容纳面那条腿共用,按 `errorCode` 认(契约 §18)。
+ * 加一种拒因 ⇒ 这里加一个词(并在判官处给它一个分支);词与因一一对应,没有一因两词、也没有一词两因。
+ * 词的铸点只有 {@link inheritEnvFacts} 一处:受理门与 resolveSpec 只经它出机读位,不手拼 `field` / `reason`。
+ */
+export declare const INHERIT_ENV_REFUSAL_REASONS: readonly ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export type InheritEnvRefusalReason = (typeof INHERIT_ENV_REFUSAL_REASONS)[number];
+/** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用;型别名而不是接口 —— 要能直接当 `Record<string, unknown>` 用)。 */
+export type InheritEnvFacts = {
+    readonly field: "inheritEnv";
+    readonly reason: InheritEnvRefusalReason;
+};
+/** `inheritEnv` 机读位的**唯一铸点**:`field` 恒为键名,`reason` 是 {@link INHERIT_ENV_REFUSAL_REASONS} 里的词。 */
+export declare function inheritEnvFacts(reason: InheritEnvRefusalReason): InheritEnvFacts;
+/** 一次值形裁决的产物:wire 句 + 机读位。 */
+export interface InheritEnvFieldIssue {
+    readonly message: string;
+    readonly facts: InheritEnvFacts;
+}
+/**
+ * `inheritEnv` 在场且不在词表里 ⇒ 拒(句 + 机读位);缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**,判据与句子在这一处,机读位经 {@link inheritEnvFacts}。
+ * 句子对两种坏值形是同一句(点名两词与「名单不是请求值」);`reason` 区分它们。
+ */
+export declare function inheritEnvFieldIssue(raw: unknown): InheritEnvFieldIssue | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -37,12 +37,18 @@ export const INHERIT_ENV_WORDS = ["all", "scrub"];
 export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
     `("all" = the model-driven host shell inherits this machine's whole environment except this deployment's own credentials (its configuration directory's secret-typed names), honored only on a single-user host-lane deployment; ` +
     `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export const INHERIT_ENV_REFUSAL_REASONS = ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export function inheritEnvFacts(reason) {
+    return { field: "inheritEnv", reason };
+}
 export function inheritEnvFieldIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
         return null;
     const value = raw.inheritEnv;
     if (value === undefined)
         return null;
-    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+    if (INHERIT_ENV_WORDS.includes(value))
+        return null;
+    return { message: INHERIT_ENV_VALUE_MESSAGE, facts: inheritEnvFacts(typeof value === "string" ? "unknown_word" : "not_a_string") };
 }
 //# sourceMappingURL=request-value-closure.js.map

package/dist/rule-entry-list.d.ts

@@ -26,7 +26,7 @@
  *     (拒面按 ③ 的方向分),拒句点名有界({@link MAX_NAMED_INERT_ENTRIES} 条 + 计数),清单先过条数帽({@link inertToolListEntryOf})。
  *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
- *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
+ *     `*` 在放行侧是「本层不设名单」、在限制侧是整名 glob(引擎文法 5,7.137.0 起;此前读成空、受理口拒);限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
  *     `compileAllowList(…, "deny", 名册)` 把它们读成这一协议的每一只工具),本仓不另写豁免。
  *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
  *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
@@ -55,7 +55,8 @@ export declare function allowLayerEntryCountIssue(field: string, list: readonly
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /**
- * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己)。条目名过引擎判官,
+ * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎文法 5,core 7.56.0:allow 表里名内的 `*` 只在协议名的工具段里读,别处的 `*` 只作废它自己、旁边的条目照读;
+ *    deny / ask 表里带 `*` 的名是整名 glob,不读空)。条目名过引擎判官,
  * 名册是本仓**唯一**的一张({@link TOOL_NAME_ROSTER},`namespaced-rule-name.ts`:引擎目录 ∪ 本仓自铸的工具名)—— 两个方向、每一处读条目名的地方(请求体的规则表、技能清单、选择器清单、
  * 运维 / 中心的审批名单)传同一张,没有「这一处空名册、那一处带名册」的两种读法。工具名选择器清单另走 {@link inertToolListEntryOf}。
  */

package/dist/rule-entry-list.js

@@ -27,9 +27,9 @@ export function inertRuleEntryGuidance(i) {
         case "near_miss":
             return `the tool name differs from a mounted tool only by case${write}`;
         case "wildcard_all":
-            return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
+            return "`*` grants nothing on an allow list (the entries beside it still apply) — name the tools instead; on a deny or ask list `*` is every tool";
         case "namespace_wildcard":
-            return "a server segment takes no partial wildcard (`mcp__git*`) — name the server: mcp__<server> or mcp__<server>__*; a deny or ask list may write mcp__* for every MCP tool";
+            return "an allow list reads a `*` only in a protocol name's tool segment — name the server: mcp__<server> or mcp__<server>__*; on a deny or ask list a `*` in a name is a glob over the whole name (mcp__* is every MCP tool, mcp__git* every tool whose name starts with it)";
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":

package/dist/rules-consent.js

@@ -5,7 +5,7 @@ import { createLogger } from "./observability/logger.js";
 import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, readRuleOwner, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -70,16 +70,19 @@ export function sameWireRuleIdentity(row, identity) {
 function storeForBucket(provider, ref) {
     if (typeof ref === "string")
         return provider.forPrincipal(ref);
-    switch (ref.kind) {
+    const owner = readRuleOwner(ref);
+    if (owner === undefined)
+        throw new Error("unrecognised permission-rule bucket reference (not a plain owner record, an unknown kind, or a principal that is no principal name) — refusing to guess which bucket it names");
+    switch (owner.kind) {
         case "principal":
-            return provider.forPrincipal(ref.principal);
+            return provider.forPrincipal(owner.principal);
         case "local-owner":
             if (provider.forLocalOwner === undefined) {
                 throw new Error("this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be listed or removed through it");
             }
             return provider.forLocalOwner();
         default: {
-            const unknown = ref;
+            const unknown = owner;
             throw new Error(`unrecognised permission-rule bucket reference (${JSON.stringify(unknown)}) — refusing to guess which bucket it names`);
         }
     }

package/dist/run-local.d.ts

@@ -174,8 +174,8 @@ type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
  *  · `shell_floor`:shell 地板被抬到 always —— `AUTONOMY=ask`(`autonomyOverrides`)与 `MANUAL_MODE_SHELL_GATE=always`,真 Runner 读数两者的类集都是 `[shell_floor]`(**不是** `operator_forced`):
  *    单独一句,不与 `operator_forced` 的来源混在一起 —— 混说会把 `APPROVAL_NEVER_AUTO` 的问指到一定没设的 `AUTONOMY`;
  *  · 其余:引擎自己的问(写门 / 形状层 / 写保护 / 探针 / 钩子 / 组织规则 / 引擎的守卫 / 工具标记 …)没有一只本部署旋钮能放行 —— 只说去终端答。
- *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」「run with `permissionMode: "bypassPermissions"`」),
- *    而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
+ *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」;core 7.56.0 [ref] 起它不再教模式放行,
+ *    那一条出路只作数据骑在通告的 `detail.remedies` 上),而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
  *
  * `autoBudgetReleases`:`APPROVAL_AUTO_BUDGET` 能放行这类问吗(读 `createDurableAskPolicy` 的预算臂:只放行**没进 `APPROVAL_NEVER_AUTO`、耐久资源没耗尽**的
  * `APPROVAL_REQUIRE` 命中,换成一句带理由的 allow)。按 `classes` **整体**读:集里每一类都放得行才建议预算 —— 折叠了别的类(`operator_forced` 等)说明另一层的问仍在,

package/dist/runs.js

@@ -7,6 +7,7 @@ import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { withModelReachScope } from "./model-reach-scope.js";
+import { runSkillsOf } from "./capabilities/skills.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
@@ -330,7 +331,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         metrics?.inc("tasks_total", { status: "needs_review" });
     };
     const instructionLeg = createInstructionSelectionLeg();
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), instructionsSegment: instructionLeg.segment });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(spec) }) });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);

package/dist/runtime-caps-resolver.js

@@ -95,7 +95,7 @@ export function createPrincipalEntitlementsClient(opts) {
         center: { baseUrl: opts.center.baseUrl, credential },
         cache: new Map(),
         inflight: new Map(),
-    }));
+    })).now;
     const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
     const putCache = (cache, key, entry) => {

package/dist/runtime-governance.d.ts

@@ -65,9 +65,9 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only.
  *
  * 🔴 **[ref]:返回叶,不在这里折**(改名自 `compileCommandPolicy`,修前返回 blocklist 形里 `combinePolicies(coarseDeny, askList)` 的
- * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠带出 `foldedAskClasses`,而治理层随后要给每只
- * ask 盖部署出身 —— 盖在折叠的输出上就是展开一只 core 担保过身份的对象(core [ref] 7.39.0 按名拒)。叶交出去,由
- * {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
+ * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠把落选者的类记进引擎的认证记录(core 7.56.0:
+ * `attestation.foldedClasses`;7.39.0–7.48.x 是对象身份担保的 `foldedAskClasses` 成员,副本被按名拒;7.49.0 [ref] 起带引擎记录的副本照收),而治理层要给每只 ask 盖部署出身。
+ * 叶交出去,由 {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
  *
  * 🔴 **[ref]:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
@@ -271,8 +271,8 @@ export declare function governanceOriginOf(gate: {
  *
  * 🔴 **[ref](core [ref] 7.39.0)—— 治理层只有一个折叠点**:两种输入都交**叶**(`compileCommandPolicyLayers` 的那几只、
  * `sensitivePathLayers` 的那几只),本函数对每一片叶各盖一次部署出身(`createDeploymentAuthoredPolicy`),再交 core
- * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——折叠带出
- * `foldedAskClasses` 时交给 core 的是副本,7.39.0 起按名拒(工具不跑、无卡)。
+ * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——7.39.0–7.48.x 上折叠带出
+ * `foldedAskClasses` 时交给 core 的是副本,被按名拒(工具不跑、无卡);core 7.56.0 起那一成员退役、落选者的类骑在 `attestation` 记录上。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;

package/dist/sandbox-git-lease.d.ts

@@ -0,0 +1,49 @@
+/** Why an entry is withdrawn — the server's own words (closed set; the vault's per-origin and whole-answer words join it with the plane's renewal). */
+export type SandboxLeaseWithdrawReason = "center_unavailable" | "insecure_transport";
+/** The sentence kinds an entry carries: a withdrawal reason, or the `ready` entry's "the git host refused the credential". */
+export type SandboxLeaseSentenceKind = SandboxLeaseWithdrawReason | "credential_rejected";
+/** What git shows for an entry (single line, no credential, names the origin and the way out). */
+export declare function sandboxLeaseSentence(kind: SandboxLeaseSentenceKind, origin: string): string;
+/** One origin's lease as the server decides it (the writer supplies `i`, `origin`, `leaseId` and the sentences). */
+export type SandboxLeaseEntryInput = {
+    readonly state: "ready";
+    readonly username: string;
+    readonly secret: string;
+    readonly credentialId: string;
+    readonly version: number;
+    readonly ttlMs: number;
+} | {
+    readonly state: "withdrawn";
+    readonly reason: SandboxLeaseWithdrawReason;
+};
+/**
+ * The lease file text for a pod whose origin table is `origins` (one input per origin, same order). Refused (never sent) when the broker
+ * would refuse it: an input count that is not the table's, a `ready` input for an http origin, `ttlMs` outside (0, 300 000], a malformed
+ * value. The refusal names the entry and the rule, never a value.
+ */
+export declare function buildSandboxLeaseFile(origins: readonly string[], entries: readonly SandboxLeaseEntryInput[], mintLeaseId?: () => string): {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    problem: string;
+};
+/** The lease a pod starts with, before the first answer from the vault: every entry withdrawn (https ⇒ `center_unavailable`, http ⇒ `insecure_transport`). */
+export declare function placeholderLeaseEntries(origins: readonly string[]): SandboxLeaseEntryInput[];
+/**
+ * The lease time of one vault answer: `min(cacheUntil, expiresAt ?? cacheUntil) − answeredAt − rttMs`, capped at the broker's ceiling,
+ * at least 1; `undefined` when that is ≤ 0 or any reading is not a finite number (the entry is then written `withdrawn`). The three times are
+ * the vault's own clock; `rttMs` is this server's monotonic measure of the request it sent and the answer it got.
+ */
+export declare function sandboxLeaseTtlMs(answer: {
+    readonly answeredAt: number;
+    readonly cacheUntil: number;
+    readonly expiresAt: number | null;
+}, rttMs: number): number | undefined;
+/**
+ * The agent container's git routes (non-secret env): one `url.<broker route>.insteadOf = <origin>/` triplet per origin, in the pod's
+ * origin-table order — git then sends `<origin>/<owner>/<repo>/…` to the broker's loopback route `/o/<i>/…` (http origins too: they are
+ * forwarded without a credential and answered with their sentence).
+ */
+export declare function sandboxGitRouteEnv(origins: readonly string[]): Record<string, string>;
+//# sourceMappingURL=sandbox-git-lease.d.ts.map

package/dist/sandbox-git-lease.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { BROKER_HOST, BROKER_PORT } from "./broker/constants.js";
+import { LEASE_TTL_MAX_MS, parseLeaseFile, serializeLeaseFile } from "./broker/lease-file.js";
+export function sandboxLeaseSentence(kind, origin) {
+    switch (kind) {
+        case "center_unavailable":
+            return `your git credential for ${origin} is not available right now (the console could not be reached); retry shortly, and do not paste a token into the conversation`;
+        case "insecure_transport":
+            return `${origin} is served over plain http, so member credentials are never sent to it; ask the operator to serve it over https`;
+        case "credential_rejected":
+            return `${origin} rejected your git credential; reconnect it in the console, then retry`;
+    }
+}
+export function buildSandboxLeaseFile(origins, entries, mintLeaseId = () => `l_${randomUUID()}`) {
+    if (entries.length !== origins.length)
+        return { ok: false, problem: `the lease has ${entries.length} entries for a pod routed to ${origins.length} origins` };
+    const file = {
+        v: 1,
+        origins: entries.map((e, i) => {
+            const origin = origins[i];
+            return e.state === "ready"
+                ? {
+                    i,
+                    origin,
+                    state: "ready",
+                    leaseId: mintLeaseId(),
+                    ttlMs: e.ttlMs,
+                    username: e.username,
+                    secret: e.secret,
+                    credentialId: e.credentialId,
+                    version: e.version,
+                    unusableMessage: sandboxLeaseSentence("center_unavailable", origin),
+                    rejectedMessage: sandboxLeaseSentence("credential_rejected", origin),
+                }
+                : { i, origin, state: "withdrawn", reason: e.reason, unusableMessage: sandboxLeaseSentence(e.reason, origin) };
+        }),
+    };
+    const text = serializeLeaseFile(file);
+    const judged = parseLeaseFile(text);
+    return judged.ok ? { ok: true, text } : { ok: false, problem: judged.problem };
+}
+export function placeholderLeaseEntries(origins) {
+    return origins.map((o) => ({ state: "withdrawn", reason: o.startsWith("https://") ? "center_unavailable" : "insecure_transport" }));
+}
+export function sandboxLeaseTtlMs(answer, rttMs) {
+    const until = answer.expiresAt === null ? answer.cacheUntil : Math.min(answer.cacheUntil, answer.expiresAt);
+    const ms = until - answer.answeredAt - rttMs;
+    if (!Number.isFinite(ms) || ms <= 0)
+        return undefined;
+    return Math.max(1, Math.min(LEASE_TTL_MAX_MS, Math.floor(ms)));
+}
+export function sandboxGitRouteEnv(origins) {
+    const env = { GIT_CONFIG_COUNT: String(origins.length) };
+    origins.forEach((origin, i) => {
+        env[`GIT_CONFIG_KEY_${i}`] = `url.http://${BROKER_HOST}:${BROKER_PORT}/o/${i}/.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${i}`] = `${origin}/`;
+    });
+    return env;
+}
+//# sourceMappingURL=sandbox-git-lease.js.map

package/dist/sandbox-git-plane.d.ts

@@ -0,0 +1,84 @@
+import type { ServiceConfig } from "./config.js";
+import type { SandboxSecretSeat } from "./plugins/remote-env-k8s.js";
+import type { IdentitySource, RunIdentity } from "./identity-source.js";
+import type { Logger } from "./observability/logger.js";
+/** The off reasons, in judge order (closed set; an added premise is a word here, a row in {@link SANDBOX_GIT_PLANE_OFF_TEXT}, a step in the judge). */
+export declare const SANDBOX_GIT_PLANE_OFF_REASONS: readonly ["single_user", "lane_without_boundary", "no_caller_credential", "center_not_https", "secret_seat_unverified", "secret_seat_denied", "pod_patch_reaches_broker", "broker_image_unset", "no_origins"];
+export type SandboxGitPlaneOffReason = (typeof SANDBOX_GIT_PLANE_OFF_REASONS)[number];
+/** One origin of an on plane. */
+export type SandboxGitPlaneOrigin = {
+    readonly origin: string;
+    readonly delivers: true;
+} | {
+    readonly origin: string;
+    readonly delivers: false;
+    readonly reason: "insecure_transport";
+};
+/** The plane's reading (the wire value of `credentialPlane.sandboxGit`). */
+export type SandboxGitPlane = {
+    readonly state: "on";
+    readonly origins: readonly SandboxGitPlaneOrigin[];
+} | {
+    readonly state: "off";
+    readonly reason: SandboxGitPlaneOffReason;
+};
+/** Operator sentence per off reason (the boot line and the docs read it; the record type makes a missing word a compile error). */
+export declare const SANDBOX_GIT_PLANE_OFF_TEXT: {
+    readonly [R in SandboxGitPlaneOffReason]: string;
+};
+/** The premises, each as the judge reads it. */
+export interface SandboxGitPlanePremises {
+    readonly multiTenant: boolean;
+    readonly k8sLane: boolean;
+    readonly callerCredential: boolean;
+    /** The console base address (`SEMA_WEB_ADMIN_URL`); absent ⇒ not https. */
+    readonly centerUrl: string | undefined;
+    /** The boot's SelfSubjectAccessReview answer for the sandbox Secret seat; `undefined` = not asked (counts as unverified). */
+    readonly secretSeat: SandboxSecretSeat | undefined;
+    /** The patch judge's refusal for a pod that carries the broker (`podSpecPatchBrokerRefusal`); `undefined` = the patch may land. */
+    readonly patchRefusal: string | undefined;
+    readonly brokerImage: string | undefined;
+    /** The routed origins (`readSandboxGitConfig`); `null` = no `sandboxGit` block. */
+    readonly origins: readonly string[] | null;
+}
+/** THE judge: the first premise that fails, in the written order; all hold ⇒ on with per-origin rows. Pure. */
+export declare function judgeSandboxGitPlane(p: SandboxGitPlanePremises): SandboxGitPlane;
+/** The secret seat is asked for the plane only when every premise before it holds (a deployment the plane is off for asks nothing for it). */
+export declare function sandboxGitPlaneAsksSecretSeat(p: Pick<SandboxGitPlanePremises, "multiTenant" | "k8sLane" | "callerCredential" | "centerUrl">): boolean;
+/** The premises read from config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
+export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: {
+    readonly secretSeat?: SandboxSecretSeat;
+    readonly patchRefusal?: string;
+}): SandboxGitPlanePremises;
+/**
+ * Wiring point — the effective `sandboxGit` block (the origins this deployment routes through the broker, canonical form, ≤ 16). Its shape
+ * and its canonical-form judge belong to the settings-schema contract package (14.7.0); until that release is picked up there is no block to
+ * read ⇒ `null` (the plane stays off, `no_origins`). Replaced by the package reader on pickup — no local copy of the shape.
+ */
+export declare function readSandboxGitConfig(_config: ServiceConfig): {
+    readonly origins: readonly string[];
+} | null;
+/**
+ * Wiring point — does this worker hold the credential the console's vault admits on its resolve endpoint (the worker-assertion token)?
+ * The server has no reader for it yet ⇒ `false` (the plane stays off, `no_caller_credential`). Replaced by the plane's vault client.
+ */
+export declare function readSandboxGitCallerCredential(_config: ServiceConfig): boolean;
+/** The run store's by-id read, as far as the plane needs it: the row's identity tuple (`RunRecord.identity`). Every run store's `getRun` is one. */
+export interface SandboxGitRunRows {
+    getRun(taskId: string): Promise<{
+        readonly identity: RunIdentity | null;
+    } | null | undefined>;
+}
+/**
+ * The identity source recorded on the pod's run row (`RunRecord.identity.source`, minted once at admission, never recomputed). `runId` is the
+ * ONE reading of "the run that owns this pod" (the per-run binding's: the top-level run's id; a delegated child / a service run / no task id ⇒
+ * none). No run id / no run store / no row / `identity: null` ⇒ `undefined`; a read that throws ⇒ `undefined` and one warn line
+ * `sandbox_broker_identity_unread` —— every miss reads as "not sso" ⇒ no broker (fail-closed), none of them throws into the pod's connect.
+ */
+export declare function runIdentitySourceOf(runId: string | undefined, runs: SandboxGitRunRows | undefined, logger?: Pick<Logger, "warn">): Promise<IdentitySource | undefined>;
+/** The broker seat for one run's pod: the plane on ∧ the image set ∧ the run's recorded identity source `sso` ⇒ the image + every origin of the reading (http too); otherwise none. */
+export declare function sandboxBrokerSeatOf(plane: SandboxGitPlane, brokerImage: string | undefined, identitySource: IdentitySource | undefined): {
+    readonly image: string;
+    readonly origins: readonly string[];
+} | undefined;
+//# sourceMappingURL=sandbox-git-plane.d.ts.map