@sema-agent/server 7.136.0 → 7.137.0

package/dist/plugins/sql-errors.d.ts

@@ -145,7 +145,7 @@ export declare const MYSQL_CONNECTION_UNUSABLE_ERRORS: ReadonlyArray<{
 export declare function isConnectionUnusableError(err: unknown): boolean;
 /**
  * **连接类故障**的识别表(闭集;逐行登记「为什么」)—— 「到库的那条连接坏了 / 库此刻不接」:与这一条语句的内容无关、什么都不改稍后再试可能成。
- * 读者(整仓一只判官 `plugins/store-fault.ts` 的 `storeFaultClassOf`,三处同读):审批队列读口、文件历史店的折点(`permanence: "transient"`)、会话同步拉取口(`503`)。
+ * 读者(整仓一只判官 `plugins/store-fault.ts` 的 `storeFaultClassOf`,三处同读):审批队列读口、文件历史店的折点(`permanence: "transient"`)、会话同步拉取口(`503` + `permanence: "transient"`)。
  *
  * 识别集 = 三张表的并集,**没有第四处**:
  *  · 本表(下):套接字层与协议层的断连 / 拒连 / 连接数满 / 库的关停与只读切换,按 `code` 登记(MySQL 协议的数字 errno 在场的并登 —— 同本文件其余谓词的姿势:`errno` 与 `code` 是同一件事的两种写法);
@@ -153,7 +153,7 @@ export declare function isConnectionUnusableError(err: unknown): boolean;
  *  · {@link CONNECTION_FAULT_DRIVER_SENTENCES}:驱动自己抛的**无 `code` 的裸 `Error`**(node-pg 的断连在这一形),按整句相等认。
  *
  * **不在识别集里**(认不出一律不是 —— 错判成连接类的代价是调用方被劝「再试」去撞一个注定失败的语句):
- *  · 语句级的错:唯一键冲突、CHECK 被拒、缺表缺列、语法错、权限错、行 / 包超墙(1153 / 8025 / `54000`);
+ *  · 语句级的错:唯一键冲突、CHECK 被拒、缺列、语法错、行 / 包超墙(1153 / 8025 / `54000`);缺表与权限拒也不是连接类 —— 它们是**部署错配类**(判官的另一个词,识别表 {@link DEPLOYMENT_FAULT_ERRORS},与本表互斥);
  *  · 死锁(引擎的仲裁产物,重试的前提在调用方的整事务重来,见 {@link isDeadlockError})与锁等待 / 语句超时(延迟信号,重试只把长等待乘上次数);
  *  · 认证类拒连(MySQL 1045、PG `28xxx`、`08004`:凭据 / 白名单要人去改)与协议违例(PG `08P01`、mysql2 `PROTOCOL_ERROR`:我方的码病);
  *  · TiDB 自己的忙 / 区域不可用(9001 / 9005 一族)—— 候真库逐码读数再登,今天不在表里(登记在案的未收项);
@@ -180,6 +180,27 @@ export declare const CONNECTION_FAULT_DRIVER_SENTENCES: ReadonlyArray<{
  * 归因键三种:`code`(字符串)、`errno`(数字)、无 `code` 的驱动裸 `Error` 的整句 —— 只读被抛出的这一只对象身上的结构化字段 / 整句,**不读散文里的在册词**。
  */
 export declare function isConnectionFaultError(err: unknown): boolean;
+/**
+ * **部署错配类故障**的识别表(闭集;逐行登记「为什么」)—— 到库的连接是好的、语句也是对的,是这套库的形与本部署的要求不符:**重试注定失败**,修表 / 授权之前什么都不会变
+ * (与连接类互为反面:那一类是「什么都不改稍后再试可能成」)。读者:整仓一只判官 `plugins/store-fault.ts` 的 `storeFaultClassOf` 的 `deployment` 一词 ——
+ * 文件历史店的折点与会话同步拉取口(`503 state.file_history_unreadable`)据它判 `permanence: "terminal"`;审批队列读口并入「此刻读不出」的 503;各读者各自表态,**不在自己那里写码**。
+ *
+ * 识别集 = 本表一张,按归因键登记:`code`(字符串)与 MySQL 协议的数字 `errno`(两键是同一件事的两种写法,代理 / 序列化往返可能只留一个;同本文件其余谓词的姿势)。
+ * **与连接类互斥**:本表的任何一码都不在 {@link CONNECTION_FAULT_ERRORS} / {@link MYSQL_CONNECTION_UNUSABLE_ERRORS} 的识别集里,反之亦然(`test/store-fault-judge.test.ts` 钉两个方向)—— 同一只错只落一个词。
+ *
+ * **不在表里**(认不出一律不是;本批只收缺表与权限拒两形,其余是登记在案的未收项,不是「已裁定不判」):缺列(1054 / `42703`:升级前置断言 `assert*Schema` 族有自己的判据与出路)、
+ * 认证类拒连(MySQL 1045、PG `28xxx`:凭据 / 白名单)、库级与列级的权限拒(MySQL 1044 / 1143)、TiDB 自己的忙 / 区域不可用一族(同连接类表的登记)。
+ */
+export declare const DEPLOYMENT_FAULT_ERRORS: ReadonlyArray<{
+    readonly code: string;
+    readonly errno?: number;
+    readonly why: string;
+}>;
+/**
+ * 「这个错误**是**部署错配类故障吗」—— {@link DEPLOYMENT_FAULT_ERRORS} 的唯一判据(识别集与排除项见该表头注)。纯谓词、不抛;认不出的一律不是。
+ * 只读被抛出的**这一只**对象身上的结构化字段(`code` 字符串 / `errno` 数字),不沿 `cause` 链找、不读散文里的在册词。
+ */
+export declare function isDeploymentFaultError(err: unknown): boolean;
 /**
  * 检查点店的两笔写(续跑输入 `putCtx` / 停驻行 `put`)被引擎以「一行装不下」拒 ⇒ **这一只**带码错误(码 `store.row_too_large`),不以裸驱动错上抛
  * (其余店写今天仍是各自的驱动错 —— 未收,登记在案)。

package/dist/plugins/sql-errors.js

@@ -130,6 +130,21 @@ export function isConnectionFaultError(err) {
         return true;
     return err instanceof Error && code === undefined && CONNECTION_FAULT_SENTENCES.has(err.message);
 }
+export const DEPLOYMENT_FAULT_ERRORS = [
+    { code: "42P01", why: "PG undefined_table(缺表:库没按本版的表结构建好 / 迁移没跑 —— 重试不会让表长出来)" },
+    { code: "42501", why: "PG insufficient_privilege(权限拒:库账号缺这张表 / 这类语句的授权 —— 授权之前重试注定失败)" },
+    { code: "ER_NO_SUCH_TABLE", errno: 1146, why: "MySQL 协议(MySQL / MariaDB / TiDB)缺表:同 PG `42P01`" },
+    { code: "ER_TABLEACCESS_DENIED_ERROR", errno: 1142, why: "MySQL 协议表级权限拒:库账号对这张表缺这类语句的授权,同 PG `42501`" },
+];
+const DEPLOYMENT_FAULT_CODES = new Set(DEPLOYMENT_FAULT_ERRORS.map((r) => r.code));
+const DEPLOYMENT_FAULT_ERRNOS = new Set(DEPLOYMENT_FAULT_ERRORS.flatMap((r) => (r.errno === undefined ? [] : [r.errno])));
+export function isDeploymentFaultError(err) {
+    if (err === null || typeof err !== "object")
+        return false;
+    const code = keyOf(err, "code");
+    const errno = keyOf(err, "errno");
+    return (typeof code === "string" && DEPLOYMENT_FAULT_CODES.has(code)) || (typeof errno === "number" && DEPLOYMENT_FAULT_ERRNOS.has(errno));
+}
 export class StoreRowTooLargeError extends Error {
     row;
     wall;

package/dist/plugins/store-contracts.d.ts

@@ -19,6 +19,7 @@
  *    code should import from this file.
  */
 import type { PeerSessionTempo, TaskResult, TaskStatus } from "@sema-agent/core";
+import type { RunIdentity } from "../identity-source.js";
 /**
  * **File 店族的 boot 期拒启基类**([ref];把 `RunStoreStrictHydrateError` 的那条论证升成一条族规)。
  *
@@ -212,8 +213,13 @@ export interface RunRecord {
      *  (MCP façade / portal). null when the caller didn't supply one. */
     jobId: string | null;
     /** Which SYSTEM's credential submitted the run (oa/cc-mcp/portal…), derived at the auth gate — never
-     *  self-declared. null = legacy single-token deployment (authenticated, no system identity). */
+     *  self-declared. null = legacy single-token deployment (authenticated, no system identity).
+     *  **归因用,不是认证来源**:任何凭据判都不读它(认证来源 = {@link RunRecord.identity});系统名是运维写的任意串,`"sso"` 也只是归因值。 */
     source: string | null;
+    /** 🔴 **run 行身份元组**(三列 `identity_source` / `identity_scope` / `identity_principal_inc`):受理时在凭据门上铸、建行时写入、之后只读 ——
+     *  续跑认领 / 挂起 / 终局 / 重启都不改它,没有按当前状态重算的读者。`null` = 这一行没有「属主在受理时验过的凭据」的记录(三列之前的行 /
+     *  无鉴权写面的受理 / 别人替属主按下的那一跑),一律不合格。律与形的唯一属主 = `identity-source.ts`。不上 wire(run 读面是显式投影,不带它)。 */
+    identity: RunIdentity | null;
     /** The replica currently HOLDING this run — written at createRun and TAKEN OVER by markResuming ([ref]: a
      *  cross-replica resume moves the seat, so a reader comparing it with its own instanceId is asking "is the
      *  live leg here NOW", not "who minted the row"). Lets a preempt/cancel/steer handler tell "this run is on
@@ -263,6 +269,9 @@ export interface RunIdemBinding {
 export interface NewRunMeta {
     jobId?: string | null;
     source?: string | null;
+    /** 这一行的身份元组(`RunRecord.identity` 的写口)。缺席 = `null`(没有记录;不合格)。`src/http/**` 的每个建行点都显式写它(机器门
+     *  `test/run-identity-tuple.test.ts`),取值只经凭据门铸下的那一份(`principal-gate.ts` 的 `runIdentityOf`)。 */
+    identity?: RunIdentity | null;
     objectivePreview?: string | null;
     idem?: RunIdemBinding | null;
 }

package/dist/plugins/store-fault.d.ts

@@ -1,4 +1,4 @@
-export type StoreFaultClass = "corrupt" | "connection" | "unclassified";
-/** 判官本体。纯函数、不抛;只看被抛出的这一只对象(不沿 `cause` 链找)。 */
+export type StoreFaultClass = "corrupt" | "connection" | "deployment" | "unclassified";
+/** 判官本体。纯函数、不抛;只看被抛出的这一只对象(不沿 `cause` 链找)。两张识别表互斥,判序不影响结果(`test/store-fault-judge.test.ts` 钉互斥)。 */
 export declare function storeFaultClassOf(err: unknown): StoreFaultClass;
 //# sourceMappingURL=store-fault.d.ts.map

package/dist/plugins/store-fault.js

@@ -1,8 +1,10 @@
-import { isConnectionFaultError } from "./sql-errors.js";
+import { isConnectionFaultError, isDeploymentFaultError } from "./sql-errors.js";
 import { StoreCorruptError } from "./sql-json-column.js";
 export function storeFaultClassOf(err) {
     if (err instanceof StoreCorruptError)
         return "corrupt";
-    return isConnectionFaultError(err) ? "connection" : "unclassified";
+    if (isConnectionFaultError(err))
+        return "connection";
+    return isDeploymentFaultError(err) ? "deployment" : "unclassified";
 }
 //# sourceMappingURL=store-fault.js.map

package/dist/plugins/tidb-pool.js

@@ -7,6 +7,7 @@ import { TIDB_ADOPTION_LOG_STATEMENTS } from "./adoption-log-sql.js";
 import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js";
 import { TIDB_RETENTION_STATEMENTS } from "./retention-store-sql.js";
 import { SESSION_META_INCARNATION_COLUMN } from "../session-incarnation.js";
+import { RUN_IDENTITY_COLUMNS } from "../identity-source.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { SESSION_TITLE_MAX_CHARS } from "../session-row.js";
 import { PRINCIPAL_MAX_UTF8_BYTES } from "../security.js";
@@ -155,6 +156,12 @@ export const SCHEMA_STATEMENTS = [
      -- source (credential-derived system identity, clay 2026-06-12): which door submitted the run
      -- (oa / cc-mcp / portal).
      source      VARCHAR(64)  NULL,
+     -- identity_source / identity_scope / identity_principal_inc: the run's identity tuple, minted ONCE at the credential gate when the
+     -- run is accepted and never rewritten (no UPDATE touches them). NULL = no record of a credential the owner presented at acceptance
+     -- (rows from before these columns, unauthenticated-write acceptance, a run someone else accepted on the owner's behalf) ⇒ not
+     -- qualified. Column definitions' single owner = src/identity-source.ts RUN_IDENTITY_COLUMNS (the boot column probe derives its
+     -- ALTER suggestion from this statement). \`source\` above is attribution only, never an authentication source.
+     ${RUN_IDENTITY_COLUMNS.tidb},
      -- objective_preview: the list's "what is this task" glance — redacted + truncated at write.
      objective_preview VARCHAR(160) NULL,
      -- cancel_requested: durable cross-replica CANCEL flag. The running instance's heartbeat tick honors it

package/dist/plugins/tidb-session-store.js

@@ -11,7 +11,7 @@ import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, createPlacedSessionRo
 import { createLogger } from "../observability/logger.js";
 import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
 import { classifySyncRelationshipByIds, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
-import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
+import { assertFirstOwnerWritable, forkOwnerOf, isSessionOwnerValue } from "./session-ownership.js";
 import { forkCopyOf, forkPointOf } from "./session-fork.js";
 export class TiDBSessionStore {
     pool;
@@ -58,7 +58,7 @@ export class TiDBSessionStore {
         return { session: new StoredSession(storage), sessionId };
     }
     async register(sessionId, owner) {
-        if (typeof owner !== "string" && owner !== null) {
+        if (!isSessionOwnerValue(owner)) {
             if ((await this.headOf(sessionId)) !== undefined)
                 return;
             assertFirstOwnerWritable(sessionId, owner);

package/dist/request-key-closure.js

@@ -26,7 +26,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
-    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",

package/dist/request-value-closure.d.ts

@@ -118,7 +118,36 @@ export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
 export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
 /** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
 export declare const INHERIT_ENV_VALUE_MESSAGE: string;
-/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
-export declare function inheritEnvFieldIssue(raw: unknown): string | null;
+/**
+ * `inheritEnv` 的 `request.field_invalid` 400 的机读 `reason`([ref];闭集,**一种拒因一个词**,读者穷举读)—— 拒体另带 `field: "inheritEnv"` 与它,
+ * 壳靠这两位认「这条 400 真是 `inheritEnv` 的」,不猜句子。同一个键的**三只** 400 是一类,词表一张:
+ *  · `unknown_word` —— 值形:是字符串,但不在受理词表(`"ALL"` · `"everything"` · `""`);
+ *  · `not_a_string` —— 值形:根本不是字符串(名单形 `string[]` · 布尔 · 数字 · `null` · 对象);
+ *  · `lane_not_host` —— `"all"` 落在非 host 车道(只有 host 工厂消费这一位,别的车道没有消费点);
+ *  · `no_authorizer_session` —— `"all"` 而部署不接 authorizer(绑定按会话键控,没有会话就没有地方兑现)。
+ * 前两词的判官是 {@link inheritEnvFieldIssue}(只看体);后两词的判官在 `boot/resolve-spec.ts`(要读部署事实,两腿同过)。
+ * 不在这组的:`422 request.host_posture_refused`(托管部署不兑现 `"all"`)—— 那不是这个键的值写错,而是部署姿态拒,码与写容纳面那条腿共用,按 `errorCode` 认(契约 §18)。
+ * 加一种拒因 ⇒ 这里加一个词(并在判官处给它一个分支);词与因一一对应,没有一因两词、也没有一词两因。
+ * 词的铸点只有 {@link inheritEnvFacts} 一处:受理门与 resolveSpec 只经它出机读位,不手拼 `field` / `reason`。
+ */
+export declare const INHERIT_ENV_REFUSAL_REASONS: readonly ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export type InheritEnvRefusalReason = (typeof INHERIT_ENV_REFUSAL_REASONS)[number];
+/** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用;型别名而不是接口 —— 要能直接当 `Record<string, unknown>` 用)。 */
+export type InheritEnvFacts = {
+    readonly field: "inheritEnv";
+    readonly reason: InheritEnvRefusalReason;
+};
+/** `inheritEnv` 机读位的**唯一铸点**:`field` 恒为键名,`reason` 是 {@link INHERIT_ENV_REFUSAL_REASONS} 里的词。 */
+export declare function inheritEnvFacts(reason: InheritEnvRefusalReason): InheritEnvFacts;
+/** 一次值形裁决的产物:wire 句 + 机读位。 */
+export interface InheritEnvFieldIssue {
+    readonly message: string;
+    readonly facts: InheritEnvFacts;
+}
+/**
+ * `inheritEnv` 在场且不在词表里 ⇒ 拒(句 + 机读位);缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**,判据与句子在这一处,机读位经 {@link inheritEnvFacts}。
+ * 句子对两种坏值形是同一句(点名两词与「名单不是请求值」);`reason` 区分它们。
+ */
+export declare function inheritEnvFieldIssue(raw: unknown): InheritEnvFieldIssue | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -37,12 +37,18 @@ export const INHERIT_ENV_WORDS = ["all", "scrub"];
 export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
     `("all" = the model-driven host shell inherits this machine's whole environment except this deployment's own credentials (its configuration directory's secret-typed names), honored only on a single-user host-lane deployment; ` +
     `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export const INHERIT_ENV_REFUSAL_REASONS = ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export function inheritEnvFacts(reason) {
+    return { field: "inheritEnv", reason };
+}
 export function inheritEnvFieldIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
         return null;
     const value = raw.inheritEnv;
     if (value === undefined)
         return null;
-    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+    if (INHERIT_ENV_WORDS.includes(value))
+        return null;
+    return { message: INHERIT_ENV_VALUE_MESSAGE, facts: inheritEnvFacts(typeof value === "string" ? "unknown_word" : "not_a_string") };
 }
 //# sourceMappingURL=request-value-closure.js.map

package/dist/rule-entry-list.d.ts

@@ -26,7 +26,7 @@
  *     (拒面按 ③ 的方向分),拒句点名有界({@link MAX_NAMED_INERT_ENTRIES} 条 + 计数),清单先过条数帽({@link inertToolListEntryOf})。
  *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
- *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
+ *     `*` 在放行侧是「本层不设名单」、在限制侧是整名 glob(引擎文法 5,7.137.0 起;此前读成空、受理口拒);限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
  *     `compileAllowList(…, "deny", 名册)` 把它们读成这一协议的每一只工具),本仓不另写豁免。
  *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
  *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
@@ -55,7 +55,8 @@ export declare function allowLayerEntryCountIssue(field: string, list: readonly
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /**
- * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己)。条目名过引擎判官,
+ * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎文法 5,core 7.56.0:allow 表里名内的 `*` 只在协议名的工具段里读,别处的 `*` 只作废它自己、旁边的条目照读;
+ *    deny / ask 表里带 `*` 的名是整名 glob,不读空)。条目名过引擎判官,
  * 名册是本仓**唯一**的一张({@link TOOL_NAME_ROSTER},`namespaced-rule-name.ts`:引擎目录 ∪ 本仓自铸的工具名)—— 两个方向、每一处读条目名的地方(请求体的规则表、技能清单、选择器清单、
  * 运维 / 中心的审批名单)传同一张,没有「这一处空名册、那一处带名册」的两种读法。工具名选择器清单另走 {@link inertToolListEntryOf}。
  */

package/dist/rule-entry-list.js

@@ -27,9 +27,9 @@ export function inertRuleEntryGuidance(i) {
         case "near_miss":
             return `the tool name differs from a mounted tool only by case${write}`;
         case "wildcard_all":
-            return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
+            return "`*` grants nothing on an allow list (the entries beside it still apply) — name the tools instead; on a deny or ask list `*` is every tool";
         case "namespace_wildcard":
-            return "a server segment takes no partial wildcard (`mcp__git*`) — name the server: mcp__<server> or mcp__<server>__*; a deny or ask list may write mcp__* for every MCP tool";
+            return "an allow list reads a `*` only in a protocol name's tool segment — name the server: mcp__<server> or mcp__<server>__*; on a deny or ask list a `*` in a name is a glob over the whole name (mcp__* is every MCP tool, mcp__git* every tool whose name starts with it)";
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":

package/dist/rules-consent.js

@@ -5,7 +5,7 @@ import { createLogger } from "./observability/logger.js";
 import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, readRuleOwner, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -70,16 +70,19 @@ export function sameWireRuleIdentity(row, identity) {
 function storeForBucket(provider, ref) {
     if (typeof ref === "string")
         return provider.forPrincipal(ref);
-    switch (ref.kind) {
+    const owner = readRuleOwner(ref);
+    if (owner === undefined)
+        throw new Error("unrecognised permission-rule bucket reference (not a plain owner record, an unknown kind, or a principal that is no principal name) — refusing to guess which bucket it names");
+    switch (owner.kind) {
         case "principal":
-            return provider.forPrincipal(ref.principal);
+            return provider.forPrincipal(owner.principal);
         case "local-owner":
             if (provider.forLocalOwner === undefined) {
                 throw new Error("this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be listed or removed through it");
             }
             return provider.forLocalOwner();
         default: {
-            const unknown = ref;
+            const unknown = owner;
             throw new Error(`unrecognised permission-rule bucket reference (${JSON.stringify(unknown)}) — refusing to guess which bucket it names`);
         }
     }

package/dist/run-local.d.ts

@@ -174,8 +174,8 @@ type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
  *  · `shell_floor`:shell 地板被抬到 always —— `AUTONOMY=ask`(`autonomyOverrides`)与 `MANUAL_MODE_SHELL_GATE=always`,真 Runner 读数两者的类集都是 `[shell_floor]`(**不是** `operator_forced`):
  *    单独一句,不与 `operator_forced` 的来源混在一起 —— 混说会把 `APPROVAL_NEVER_AUTO` 的问指到一定没设的 `AUTONOMY`;
  *  · 其余:引擎自己的问(写门 / 形状层 / 写保护 / 探针 / 钩子 / 组织规则 / 引擎的守卫 / 工具标记 …)没有一只本部署旋钮能放行 —— 只说去终端答。
- *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」「run with `permissionMode: "bypassPermissions"`」),
- *    而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
+ *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」;core 7.56.0 [ref] 起它不再教模式放行,
+ *    那一条出路只作数据骑在通告的 `detail.remedies` 上),而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
  *
  * `autoBudgetReleases`:`APPROVAL_AUTO_BUDGET` 能放行这类问吗(读 `createDurableAskPolicy` 的预算臂:只放行**没进 `APPROVAL_NEVER_AUTO`、耐久资源没耗尽**的
  * `APPROVAL_REQUIRE` 命中,换成一句带理由的 allow)。按 `classes` **整体**读:集里每一类都放得行才建议预算 —— 折叠了别的类(`operator_forced` 等)说明另一层的问仍在,

package/dist/runs.js

@@ -7,6 +7,7 @@ import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { withModelReachScope } from "./model-reach-scope.js";
+import { runSkillsOf } from "./capabilities/skills.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
@@ -330,7 +331,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         metrics?.inc("tasks_total", { status: "needs_review" });
     };
     const instructionLeg = createInstructionSelectionLeg();
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), instructionsSegment: instructionLeg.segment });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(spec) }) });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);

package/dist/runtime-governance.d.ts

@@ -65,9 +65,9 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only.
  *
  * 🔴 **[ref]:返回叶,不在这里折**(改名自 `compileCommandPolicy`,修前返回 blocklist 形里 `combinePolicies(coarseDeny, askList)` 的
- * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠带出 `foldedAskClasses`,而治理层随后要给每只
- * ask 盖部署出身 —— 盖在折叠的输出上就是展开一只 core 担保过身份的对象(core [ref] 7.39.0 按名拒)。叶交出去,由
- * {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
+ * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠把落选者的类记进引擎的认证记录(core 7.56.0:
+ * `attestation.foldedClasses`;7.39.0–7.48.x 是对象身份担保的 `foldedAskClasses` 成员,副本被按名拒;7.49.0 [ref] 起带引擎记录的副本照收),而治理层要给每只 ask 盖部署出身。
+ * 叶交出去,由 {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
  *
  * 🔴 **[ref]:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
@@ -271,8 +271,8 @@ export declare function governanceOriginOf(gate: {
  *
  * 🔴 **[ref](core [ref] 7.39.0)—— 治理层只有一个折叠点**:两种输入都交**叶**(`compileCommandPolicyLayers` 的那几只、
  * `sensitivePathLayers` 的那几只),本函数对每一片叶各盖一次部署出身(`createDeploymentAuthoredPolicy`),再交 core
- * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——折叠带出
- * `foldedAskClasses` 时交给 core 的是副本,7.39.0 起按名拒(工具不跑、无卡)。
+ * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——7.39.0–7.48.x 上折叠带出
+ * `foldedAskClasses` 时交给 core 的是副本,被按名拒(工具不跑、无卡);core 7.56.0 起那一成员退役、落选者的类骑在 `attestation` 记录上。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;

package/dist/sandbox-git-lease.d.ts

@@ -0,0 +1,49 @@
+/** Why an entry is withdrawn — the server's own words (closed set; the vault's per-origin and whole-answer words join it with the plane's renewal). */
+export type SandboxLeaseWithdrawReason = "center_unavailable" | "insecure_transport";
+/** The sentence kinds an entry carries: a withdrawal reason, or the `ready` entry's "the git host refused the credential". */
+export type SandboxLeaseSentenceKind = SandboxLeaseWithdrawReason | "credential_rejected";
+/** What git shows for an entry (single line, no credential, names the origin and the way out). */
+export declare function sandboxLeaseSentence(kind: SandboxLeaseSentenceKind, origin: string): string;
+/** One origin's lease as the server decides it (the writer supplies `i`, `origin`, `leaseId` and the sentences). */
+export type SandboxLeaseEntryInput = {
+    readonly state: "ready";
+    readonly username: string;
+    readonly secret: string;
+    readonly credentialId: string;
+    readonly version: number;
+    readonly ttlMs: number;
+} | {
+    readonly state: "withdrawn";
+    readonly reason: SandboxLeaseWithdrawReason;
+};
+/**
+ * The lease file text for a pod whose origin table is `origins` (one input per origin, same order). Refused (never sent) when the broker
+ * would refuse it: an input count that is not the table's, a `ready` input for an http origin, `ttlMs` outside (0, 300 000], a malformed
+ * value. The refusal names the entry and the rule, never a value.
+ */
+export declare function buildSandboxLeaseFile(origins: readonly string[], entries: readonly SandboxLeaseEntryInput[], mintLeaseId?: () => string): {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    problem: string;
+};
+/** The lease a pod starts with, before the first answer from the vault: every entry withdrawn (https ⇒ `center_unavailable`, http ⇒ `insecure_transport`). */
+export declare function placeholderLeaseEntries(origins: readonly string[]): SandboxLeaseEntryInput[];
+/**
+ * The lease time of one vault answer: `min(cacheUntil, expiresAt ?? cacheUntil) − answeredAt − rttMs`, capped at the broker's ceiling,
+ * at least 1; `undefined` when that is ≤ 0 or any reading is not a finite number (the entry is then written `withdrawn`). The three times are
+ * the vault's own clock; `rttMs` is this server's monotonic measure of the request it sent and the answer it got.
+ */
+export declare function sandboxLeaseTtlMs(answer: {
+    readonly answeredAt: number;
+    readonly cacheUntil: number;
+    readonly expiresAt: number | null;
+}, rttMs: number): number | undefined;
+/**
+ * The agent container's git routes (non-secret env): one `url.<broker route>.insteadOf = <origin>/` triplet per origin, in the pod's
+ * origin-table order — git then sends `<origin>/<owner>/<repo>/…` to the broker's loopback route `/o/<i>/…` (http origins too: they are
+ * forwarded without a credential and answered with their sentence).
+ */
+export declare function sandboxGitRouteEnv(origins: readonly string[]): Record<string, string>;
+//# sourceMappingURL=sandbox-git-lease.d.ts.map

package/dist/sandbox-git-lease.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { BROKER_HOST, BROKER_PORT } from "./broker/constants.js";
+import { LEASE_TTL_MAX_MS, parseLeaseFile, serializeLeaseFile } from "./broker/lease-file.js";
+export function sandboxLeaseSentence(kind, origin) {
+    switch (kind) {
+        case "center_unavailable":
+            return `your git credential for ${origin} is not available right now (the console could not be reached); retry shortly, and do not paste a token into the conversation`;
+        case "insecure_transport":
+            return `${origin} is served over plain http, so member credentials are never sent to it; ask the operator to serve it over https`;
+        case "credential_rejected":
+            return `${origin} rejected your git credential; reconnect it in the console, then retry`;
+    }
+}
+export function buildSandboxLeaseFile(origins, entries, mintLeaseId = () => `l_${randomUUID()}`) {
+    if (entries.length !== origins.length)
+        return { ok: false, problem: `the lease has ${entries.length} entries for a pod routed to ${origins.length} origins` };
+    const file = {
+        v: 1,
+        origins: entries.map((e, i) => {
+            const origin = origins[i];
+            return e.state === "ready"
+                ? {
+                    i,
+                    origin,
+                    state: "ready",
+                    leaseId: mintLeaseId(),
+                    ttlMs: e.ttlMs,
+                    username: e.username,
+                    secret: e.secret,
+                    credentialId: e.credentialId,
+                    version: e.version,
+                    unusableMessage: sandboxLeaseSentence("center_unavailable", origin),
+                    rejectedMessage: sandboxLeaseSentence("credential_rejected", origin),
+                }
+                : { i, origin, state: "withdrawn", reason: e.reason, unusableMessage: sandboxLeaseSentence(e.reason, origin) };
+        }),
+    };
+    const text = serializeLeaseFile(file);
+    const judged = parseLeaseFile(text);
+    return judged.ok ? { ok: true, text } : { ok: false, problem: judged.problem };
+}
+export function placeholderLeaseEntries(origins) {
+    return origins.map((o) => ({ state: "withdrawn", reason: o.startsWith("https://") ? "center_unavailable" : "insecure_transport" }));
+}
+export function sandboxLeaseTtlMs(answer, rttMs) {
+    const until = answer.expiresAt === null ? answer.cacheUntil : Math.min(answer.cacheUntil, answer.expiresAt);
+    const ms = until - answer.answeredAt - rttMs;
+    if (!Number.isFinite(ms) || ms <= 0)
+        return undefined;
+    return Math.max(1, Math.min(LEASE_TTL_MAX_MS, Math.floor(ms)));
+}
+export function sandboxGitRouteEnv(origins) {
+    const env = { GIT_CONFIG_COUNT: String(origins.length) };
+    origins.forEach((origin, i) => {
+        env[`GIT_CONFIG_KEY_${i}`] = `url.http://${BROKER_HOST}:${BROKER_PORT}/o/${i}/.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${i}`] = `${origin}/`;
+    });
+    return env;
+}
+//# sourceMappingURL=sandbox-git-lease.js.map

package/dist/sandbox-git-plane.d.ts

@@ -0,0 +1,84 @@
+import type { ServiceConfig } from "./config.js";
+import type { SandboxSecretSeat } from "./plugins/remote-env-k8s.js";
+import type { IdentitySource, RunIdentity } from "./identity-source.js";
+import type { Logger } from "./observability/logger.js";
+/** The off reasons, in judge order (closed set; an added premise is a word here, a row in {@link SANDBOX_GIT_PLANE_OFF_TEXT}, a step in the judge). */
+export declare const SANDBOX_GIT_PLANE_OFF_REASONS: readonly ["single_user", "lane_without_boundary", "no_caller_credential", "center_not_https", "secret_seat_unverified", "secret_seat_denied", "pod_patch_reaches_broker", "broker_image_unset", "no_origins"];
+export type SandboxGitPlaneOffReason = (typeof SANDBOX_GIT_PLANE_OFF_REASONS)[number];
+/** One origin of an on plane. */
+export type SandboxGitPlaneOrigin = {
+    readonly origin: string;
+    readonly delivers: true;
+} | {
+    readonly origin: string;
+    readonly delivers: false;
+    readonly reason: "insecure_transport";
+};
+/** The plane's reading (the wire value of `credentialPlane.sandboxGit`). */
+export type SandboxGitPlane = {
+    readonly state: "on";
+    readonly origins: readonly SandboxGitPlaneOrigin[];
+} | {
+    readonly state: "off";
+    readonly reason: SandboxGitPlaneOffReason;
+};
+/** Operator sentence per off reason (the boot line and the docs read it; the record type makes a missing word a compile error). */
+export declare const SANDBOX_GIT_PLANE_OFF_TEXT: {
+    readonly [R in SandboxGitPlaneOffReason]: string;
+};
+/** The premises, each as the judge reads it. */
+export interface SandboxGitPlanePremises {
+    readonly multiTenant: boolean;
+    readonly k8sLane: boolean;
+    readonly callerCredential: boolean;
+    /** The console base address (`SEMA_WEB_ADMIN_URL`); absent ⇒ not https. */
+    readonly centerUrl: string | undefined;
+    /** The boot's SelfSubjectAccessReview answer for the sandbox Secret seat; `undefined` = not asked (counts as unverified). */
+    readonly secretSeat: SandboxSecretSeat | undefined;
+    /** The patch judge's refusal for a pod that carries the broker (`podSpecPatchBrokerRefusal`); `undefined` = the patch may land. */
+    readonly patchRefusal: string | undefined;
+    readonly brokerImage: string | undefined;
+    /** The routed origins (`readSandboxGitConfig`); `null` = no `sandboxGit` block. */
+    readonly origins: readonly string[] | null;
+}
+/** THE judge: the first premise that fails, in the written order; all hold ⇒ on with per-origin rows. Pure. */
+export declare function judgeSandboxGitPlane(p: SandboxGitPlanePremises): SandboxGitPlane;
+/** The secret seat is asked for the plane only when every premise before it holds (a deployment the plane is off for asks nothing for it). */
+export declare function sandboxGitPlaneAsksSecretSeat(p: Pick<SandboxGitPlanePremises, "multiTenant" | "k8sLane" | "callerCredential" | "centerUrl">): boolean;
+/** The premises read from config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
+export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: {
+    readonly secretSeat?: SandboxSecretSeat;
+    readonly patchRefusal?: string;
+}): SandboxGitPlanePremises;
+/**
+ * Wiring point — the effective `sandboxGit` block (the origins this deployment routes through the broker, canonical form, ≤ 16). Its shape
+ * and its canonical-form judge belong to the settings-schema contract package (14.7.0); until that release is picked up there is no block to
+ * read ⇒ `null` (the plane stays off, `no_origins`). Replaced by the package reader on pickup — no local copy of the shape.
+ */
+export declare function readSandboxGitConfig(_config: ServiceConfig): {
+    readonly origins: readonly string[];
+} | null;
+/**
+ * Wiring point — does this worker hold the credential the console's vault admits on its resolve endpoint (the worker-assertion token)?
+ * The server has no reader for it yet ⇒ `false` (the plane stays off, `no_caller_credential`). Replaced by the plane's vault client.
+ */
+export declare function readSandboxGitCallerCredential(_config: ServiceConfig): boolean;
+/** The run store's by-id read, as far as the plane needs it: the row's identity tuple (`RunRecord.identity`). Every run store's `getRun` is one. */
+export interface SandboxGitRunRows {
+    getRun(taskId: string): Promise<{
+        readonly identity: RunIdentity | null;
+    } | null | undefined>;
+}
+/**
+ * The identity source recorded on the pod's run row (`RunRecord.identity.source`, minted once at admission, never recomputed). `runId` is the
+ * ONE reading of "the run that owns this pod" (the per-run binding's: the top-level run's id; a delegated child / a service run / no task id ⇒
+ * none). No run id / no run store / no row / `identity: null` ⇒ `undefined`; a read that throws ⇒ `undefined` and one warn line
+ * `sandbox_broker_identity_unread` —— every miss reads as "not sso" ⇒ no broker (fail-closed), none of them throws into the pod's connect.
+ */
+export declare function runIdentitySourceOf(runId: string | undefined, runs: SandboxGitRunRows | undefined, logger?: Pick<Logger, "warn">): Promise<IdentitySource | undefined>;
+/** The broker seat for one run's pod: the plane on ∧ the image set ∧ the run's recorded identity source `sso` ⇒ the image + every origin of the reading (http too); otherwise none. */
+export declare function sandboxBrokerSeatOf(plane: SandboxGitPlane, brokerImage: string | undefined, identitySource: IdentitySource | undefined): {
+    readonly image: string;
+    readonly origins: readonly string[];
+} | undefined;
+//# sourceMappingURL=sandbox-git-plane.d.ts.map