@sema-agent/server 7.136.0 → 7.137.0

package/dist/sandbox-git-plane.js

@@ -0,0 +1,105 @@
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { SANDBOX_SECRET_SEAT_VERBS } from "./plugins/k8s-exec-protocol.js";
+export const SANDBOX_GIT_PLANE_OFF_REASONS = [
+    "single_user",
+    "lane_without_boundary",
+    "no_caller_credential",
+    "center_not_https",
+    "secret_seat_unverified",
+    "secret_seat_denied",
+    "pod_patch_reaches_broker",
+    "broker_image_unset",
+    "no_origins",
+];
+export const SANDBOX_GIT_PLANE_OFF_TEXT = {
+    single_user: "this is a single-user deployment (REQUIRE_PRINCIPAL is not true): there are no members to keep apart",
+    lane_without_boundary: "the execution lane is not the k8s pod sandbox (REMOTE_EXEC=k8s): only a k8s sandbox pod can carry the credential broker beside the agent",
+    no_caller_credential: "this worker holds no credential the console's vault admits for credential resolution",
+    center_not_https: `the console address (${WEB_ADMIN_ENV.url}) is not https — credentials are never fetched over plain http`,
+    secret_seat_unverified: `the boot could not confirm the sandbox Role's secrets verbs for the lease Secret (${SANDBOX_SECRET_SEAT_VERBS.lease.join(" / ")}) in the sandbox namespace`,
+    secret_seat_denied: `the sandbox Role does not allow secrets ${SANDBOX_SECRET_SEAT_VERBS.lease.join(" / ")} (the lease Secret) in the sandbox namespace`,
+    pod_patch_reaches_broker: "the deployment's pod-spec patch could reach the broker container (a podSecurityContext, or a field outside the broker white-list)",
+    broker_image_unset: "K8S_SANDBOX_BROKER_IMAGE is not set (the broker container's image; this engine's own image is the recommended value)",
+    no_origins: "the effective configuration routes no git origins to the plane (sandboxGit.origins)",
+};
+const isHttps = (url) => url !== undefined && URL.canParse(url) && new URL(url).protocol === "https:";
+export function judgeSandboxGitPlane(p) {
+    const off = (reason) => ({ state: "off", reason });
+    if (!p.multiTenant)
+        return off("single_user");
+    if (!p.k8sLane)
+        return off("lane_without_boundary");
+    if (!p.callerCredential)
+        return off("no_caller_credential");
+    if (!isHttps(p.centerUrl))
+        return off("center_not_https");
+    const seat = p.secretSeat;
+    if (seat === undefined)
+        return off("secret_seat_unverified");
+    switch (seat.state) {
+        case "unverified":
+            return off("secret_seat_unverified");
+        case "denied":
+            return off("secret_seat_denied");
+        case "granted":
+            break;
+        default: {
+            const unreachable = seat;
+            throw new Error(`unhandled sandbox secret seat reading: ${String(unreachable.state)}`);
+        }
+    }
+    if (p.patchRefusal !== undefined)
+        return off("pod_patch_reaches_broker");
+    if (p.brokerImage === undefined || p.brokerImage === "")
+        return off("broker_image_unset");
+    if (p.origins === null || p.origins.length === 0)
+        return off("no_origins");
+    return {
+        state: "on",
+        origins: p.origins.map((origin) => (origin.startsWith("https://") ? { origin, delivers: true } : { origin, delivers: false, reason: "insecure_transport" })),
+    };
+}
+export function sandboxGitPlaneAsksSecretSeat(p) {
+    return p.multiTenant && p.k8sLane && p.callerCredential && isHttps(p.centerUrl);
+}
+export function sandboxGitPlanePremisesOf(config, readings) {
+    const lane = config.remoteExec;
+    return {
+        multiTenant: DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config),
+        k8sLane: lane?.provider === "k8s",
+        callerCredential: readSandboxGitCallerCredential(config),
+        centerUrl: config.webAdmin?.baseUrl,
+        secretSeat: readings.secretSeat,
+        patchRefusal: readings.patchRefusal,
+        brokerImage: lane?.provider === "k8s" ? lane.brokerImage : undefined,
+        origins: readSandboxGitConfig(config)?.origins ?? null,
+    };
+}
+export function readSandboxGitConfig(_config) {
+    return null;
+}
+export function readSandboxGitCallerCredential(_config) {
+    return false;
+}
+export async function runIdentitySourceOf(runId, runs, logger) {
+    if (runId === undefined || runs === undefined)
+        return undefined;
+    try {
+        return (await runs.getRun(runId))?.identity?.source;
+    }
+    catch (e) {
+        logger?.warn("sandbox_broker_identity_unread", {
+            run: runId,
+            error: e instanceof Error ? e.message : String(e),
+            effect: "this run's sandbox pod carries no member-credential broker (its identity could not be read from the run row)",
+        });
+        return undefined;
+    }
+}
+export function sandboxBrokerSeatOf(plane, brokerImage, identitySource) {
+    if (plane.state !== "on" || brokerImage === undefined || brokerImage === "" || identitySource !== "sso")
+        return undefined;
+    return { image: brokerImage, origins: plane.origins.map((o) => o.origin) };
+}
+//# sourceMappingURL=sandbox-git-plane.js.map

package/dist/security.d.ts

@@ -316,6 +316,13 @@ export declare function createAuthorizer(config: ServiceConfig, sessionStore: Ow
 /** F1/F3 (codex scope-ledger audit 2026-07-14) — the auth-boundary principal SHAPE gate, applied to every
  *  verified identity source (trusted header, SSO-bridge sub, direct-door JWT sub) so no downstream consumer
  *  ever sees an ambiguous or over-wide principal:
+ *   - a string that is NOT A PRINCIPAL NAME is REJECTED (7.137.0): the engine's one judge `principalNameOf` (core 7.56.0 [ref] —
+ *     visible content, no control / line-or-paragraph separator / format character other than the two joiners; kept verbatim, never
+ *     normalized). The session stores' first ownership write and fork and the durable rule buckets read the same judge
+ *     (`plugins/session-ownership.ts`, `permission-rule-store-sql.ts`); before this arm the boundary admitted what the store then refused,
+ *     and the request fell into the generic 500 with its code lost. Typical source: a proxy writing raw UTF-8 bytes into the principal
+ *     header — Node reads header bytes one per character (latin1), and a CJK character's continuation bytes often land on 0x80–0x9F,
+ *     the C1 controls;
  *   - RESERVED internal identifiers are REJECTED (修1, 三路复审 A 组 HIGH — see {@link RESERVED_PRINCIPALS} /
  *     {@link RESERVED_PRINCIPAL_PREFIXES} below): a REAL tenant whose principal string-equals an internal scope
  *     sentinel would pass the plain string-compare owner/scope gates downstream and merge with internal rows —
@@ -328,8 +335,8 @@ export declare function createAuthorizer(config: ServiceConfig, sessionStore: Ow
  *   - length > 190 is REJECTED: every scope/owner column the principal lands in VERBATIM is VARCHAR(190)
  *     (sendfile_link.scope, approval.owner/scope, memory-engine scope, rate-limit keys, …) — an over-long
  *     principal would truncate/500 at the INSERT and split one identity into two.
- *  Throws a typed 400 `HttpError` (the HTTP layer maps it); the message names the rule (a reserved identifier /
- *  the length cap), never a secret and never the internal scope's semantics. */
+ *  Throws a typed 400 `HttpError` (the HTTP layer maps it): `principal_not_a_name` / `principal_reserved` / `principal_too_long`; the message
+ *  names the rule (not a name / a reserved identifier / the length cap), never a secret and never the internal scope's semantics. */
 export declare const PRINCIPAL_MAX_LENGTH = 190;
 /**
  * 一个被受理的主体串最多占多少个 UTF-8 字节 —— 按**字节**计宽的身份列(TiDB `VARBINARY(n)`)的列宽**唯一来源**(派生,不手抄第二个数)。
@@ -354,8 +361,13 @@ export declare const RESERVED_PRINCIPAL_PREFIXES: readonly string[];
 /** The principal-shape rule as a VERDICT (the one judge; {@link assertPrincipalShape} is its throwing reader). `undefined` = a
  *  principal may carry this string; otherwise which rule it breaks. A reader that only needs "can this string be anyone?" (the
  *  organization delivery gate's recipient: a string that breaks the rule is nobody, refused with the same bytes as an unknown
- *  principal) reads the verdict instead of catching the throw. */
-export type PrincipalShapeProblem = "reserved" | "too_long";
+ *  principal) reads the verdict instead of catching the throw.
+ *
+ *  Order: "is it a name at all" first — the other two rules presuppose a name (a reserved identifier / a name too wide for the
+ *  column), and the `reserved` sentence echoes the value while the `not_a_name` sentence never does (a string that names nobody may be a
+ *  pasted credential). An empty string is `not_a_name` here (the engine's judge says so); a header reader that treats a blank header as
+ *  "no principal" decides that before asking. */
+export type PrincipalShapeProblem = "not_a_name" | "reserved" | "too_long";
 export declare function principalShapeProblem(principal: string): PrincipalShapeProblem | undefined;
 export declare function assertPrincipalShape(principal: string): void;
 /** The checkpoint `scope` column's single-user/anonymous sentinel — the same "_" documented above

package/dist/security.js

@@ -1,10 +1,11 @@
-import { uuidv7, PROJECT_ID_REGEX } from "@sema-agent/core";
+import { uuidv7, PROJECT_ID_REGEX, principalNameOf } from "@sema-agent/core";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { headReadOf } from "./session-incarnation.js";
 import { memoryScopeFor } from "./memory-scope.js";
 import { verifyPrincipalJwt } from "./principal-jwt.js";
 import { fieldConflictFacts } from "./field-conflict.js";
 import { ORPHAN_SESSION_OWNER_PREFIX } from "./delegated-session-owner.js";
+import { NOT_A_PRINCIPAL_NAME } from "./plugins/session-ownership.js";
 export function isDestructiveSessionWrite(method, url) {
     if (method === "DELETE")
         return /^\/v1\/sessions\/[^/]+$/.test(url);
@@ -134,6 +135,8 @@ export const PRINCIPAL_MAX_UTF8_BYTES = PRINCIPAL_MAX_LENGTH * 3;
 export const RESERVED_PRINCIPALS = ["_", "__none__", "_leader"];
 export const RESERVED_PRINCIPAL_PREFIXES = ["_leader-", ORPHAN_SESSION_OWNER_PREFIX];
 export function principalShapeProblem(principal) {
+    if (principalNameOf(principal) === undefined)
+        return "not_a_name";
     if (RESERVED_PRINCIPALS.includes(principal) || RESERVED_PRINCIPAL_PREFIXES.some((p) => principal.startsWith(p)))
         return "reserved";
     if (principal.length > PRINCIPAL_MAX_LENGTH)
@@ -145,10 +148,12 @@ export function assertPrincipalShape(principal) {
     switch (problem) {
         case undefined:
             return;
+        case "not_a_name":
+            throw createCodedHttpError(400, "principal_not_a_name", `principal is not a principal name: got ${NOT_A_PRINCIPAL_NAME} — send the identity as visible characters only (a proxy that writes raw UTF-8 bytes into the principal header is read one byte per character, which can produce control characters: encode it upstream as ASCII or another form without them)`);
         case "reserved":
-            throw new HttpError(400, `principal ${JSON.stringify(principal)} is reserved (an internal scope sentinel) — authenticate with a real tenant identifier`, { code: "principal_reserved" });
+            throw createCodedHttpError(400, "principal_reserved", `principal ${JSON.stringify(principal)} is reserved (an internal scope sentinel) — authenticate with a real tenant identifier`);
         case "too_long":
-            throw new HttpError(400, `principal exceeds ${PRINCIPAL_MAX_LENGTH} characters (the scope-column width every store pins, e.g. sendfile_link.scope VARCHAR(190)); got ${principal.length}`, { code: "principal_too_long" });
+            throw createCodedHttpError(400, "principal_too_long", `principal exceeds ${PRINCIPAL_MAX_LENGTH} characters (the scope-column width every store pins, e.g. sendfile_link.scope VARCHAR(190)); got ${principal.length}`);
         default: {
             const unknownProblem = problem;
             throw new Error(`assertPrincipalShape: unknown problem ${String(unknownProblem)}`);

package/dist/server-secret-env.d.ts

@@ -124,6 +124,12 @@ export declare function hostSubprocessEnv(o: HostSubprocessEnvRequest): NodeJS.P
  * 既不另写一份组合(第二份会漂),也不把一次没发生的 spawn 记进剥除计数。`findings` 是组合点自己的收集器(引擎把形状臂与自有凭据臂的每一条扣下都推进去)。
  */
 export declare function composeHostSubprocessEnv(o: Omit<HostSubprocessEnvRequest, "site">, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
+/**
+ * core 7.56.0 [ref] `ExecutionEnv.withheldEnv` 的**宿主子进程**读法:{@link composeHostSubprocessEnv} 那只组合扣下的发现(名 + 规则,从不带值),
+ * 减去适配器显式授予重供的键(`regranted` 的自有键:子进程收得到那个名,不是损失)—— 引擎契约的原句「the findings of that composition less what its
+ * explicit grants re-supply」。同一个名字被两条规则各扣一次 ⇒ 按「名 + 规则」各记一笔(与披露同一去重)。只读组合:不披露、不计数(没有 spawn 发生)。
+ */
+export declare function withheldFromHostSubprocess(o: Omit<HostSubprocessEnvRequest, "site">, regranted: Readonly<Record<string, string>> | undefined): SecretEnvFinding[];
 /** git 子进程腿的现场(闭集里名字带 `.git-` 的那几只 —— 编译期筛;它们都没有点名放行面)。 */
 export type GitSubprocessSite = Extract<SecretEnvScrubSite, `${string}.git-${string}`>;
 /**

package/dist/server-secret-env.js

@@ -86,6 +86,20 @@ export function composeHostSubprocessEnv(o, findings = []) {
     const putBack = o.allow.length > 0 ? inheritedHostEnv([...o.allow], findings) : {};
     return { ...inheritedHostEnv(o.policy ?? "scrub", findings), ...putBack };
 }
+export function withheldFromHostSubprocess(o, regranted) {
+    const findings = [];
+    composeHostSubprocessEnv(o, findings);
+    const withheld = [];
+    const seen = new Set();
+    for (const f of findings) {
+        const k = `${f.key}=${f.kind}`;
+        if (seen.has(k) || (regranted !== undefined && Object.hasOwn(regranted, f.key)))
+            continue;
+        seen.add(k);
+        withheld.push(f);
+    }
+    return withheld;
+}
 export function gitSubprocessEnv(o) {
     return {
         ...hostSubprocessEnv({ site: o.site, allow: [] }),

package/dist/session-error-wire.d.ts

@@ -10,11 +10,10 @@
  *
  * ## 为什么多一个 `face` 参数(而不是单参)
  * core 的 `invalid_session` 是**同词两义**(亲读 dist:`engine/session/import-validate.js` 的导入门拒调用方交来的
- * 日志,`engine/session/storage-base.js` 的建树 / 走根拒**已存**日志里指向缺席条目的叶子或祖先 —— 后者即 core [ref])。
- * 本仓对它的成文义是前者(调用方的日志没过校验 ⇒ 422),而后者今天在打开会话的各口上答的是通用 500 / 同步口
- * 200 + failed([ref] 的 3b 负控格钉住这一形,[ref] 落地后按 core 的新码再对一次)。单参签名装不下这件事:要么
- * 打开面的每个消费点都写一句 `code === "corrupt_session"` 特判,要么把 [ref] 形从今天的应答改成「你交的日志坏了」。
- * ⇒ 面是映射的一维,写进属主,不散在消费点。
+ * 日志,`engine/session/storage-base.js` / `parent-chain-guard.js` 的建树 / 走根拒**已存**日志的结构 —— 叶子或父不在日志里、
+ * 条目是自己的祖先〔自指 / 成环〕)。前者是调用方的日志没过校验(import 面 422),后者是这只会话**存着的**日志坏了(open 面 500,
+ * 调用方没做错任何事)。单参签名装不下这件事:要么打开面的每个消费点都写一句 `code === "invalid_session"` 特判,要么把已存日志坏了
+ * 说成「你交的日志坏了」。⇒ 面是映射的一维,写进属主,不散在消费点。
  *  · `"open"`   —— 为某只会话**打开它已存的日志**(提交各腿的引擎 prepare、鉴权门的归属探针、直接读会话的口);
  *  · `"import"` —— 校验 / 写入**调用方交来的**日志(2c session-sync 的暂存导入)。
  *
@@ -24,7 +23,16 @@
  *    原样上 wire,契约既有立场:不为上游码铸孪生码)。三种会话后端同词:文件店由 core 铸,两只 SQL 店由
  *    `plugins/session-event-payload.ts` 铸(坏的 `session_event.payload` 行)。
  *  · `invalid_session` —— `import` 面 **422 `invalid_entries`**(修前 session-sync 的那一行,码位 / 状态逐字不变);
- *    `open` 面留白([ref] 形,见上)。
+ *    `open` 面 **500 `invalid_session`**:这只会话已存的日志结构坏了(悬空父 / 自指 / 成环 / 叶子缺席),打得开存档、走不通分支。
+ *    句子发 core 的原句(点名条目 id,不含盘上路径),过既有脱敏。
+ *    · **为什么是 500、不是 4xx / 503**:坏的是存着的数据,调用方没做错任何事;重试改不了判(修复在运维手里)—— 与 `corrupt_session` 同一档同一理由。
+ *    · **为什么码是 `invalid_session`、不是 `corrupt_session`**:码不另铸、也不把一个 core 词改名成另一个 core 词。两个词说的是两件事
+ *      (`corrupt_session` = 存档读不出;`invalid_session` = 读得出、结构走不通),而 run 终局上它本来就是引擎词(`terminal.code`,同步口 4xx / 5xx 体的
+ *      `errorCode` 取终局码原样):读口答 `corrupt_session`、提交口答 `invalid_session` 就是同一件事两个名字。所以映射只有一格,
+ *      读口与提交口的 run 终局分诊({@link sessionErrorHttp} 的 open 面,`resumeAtHttpStatus` 读它)同一只、同码同状态。
+ *    · **没有 `reason` 机读位**:core 的 `SessionError` 只带 `code` 与句子;悬空父与叶子缺席是同一句 `Entry <id> not found`,自指与成环是同一句
+ *      `is its own ancestor` —— 本仓分出 {parent_missing, parent_self, parent_cycle} 只有解析句子或再写一只判官两条路(会话视图自己的走链器已在 core 7.54.0 提货时退役:
+ *      视图读的就是引擎读的那条分支,见 `plugins/local-session-window.ts` 头注)。要分,请求 core 把种类放进错误(同 `placement_kind` 的先例),不在这里猜。
  *  · `not_found` —— 留白:每一面各有自己的「不存在」答法(404 `not_found.session` / 同步口的 `resume.session_not_found` /
  *    列表里的缺席),码位各不相同,不由本表统一。
  *  · `placement_refused` —— `import` 面 **409 `conflict.session_placed`**(机读位 `detail.placement_kind`,固定句);`open` 面留白。

package/dist/session-error-wire.js

@@ -3,6 +3,7 @@ export const PLACED_SESSION_SENTENCE = "this session holds a delegated agent's t
 const PLACEMENT_KIND = "subagent";
 export const STAGED_IMPORT_OWNER_CHANGED_SENTENCE = "session owner changed while the import streamed; nothing was imported — start the sync again";
 const CORRUPT_SESSION = { status: 500, errorCode: "corrupt_session" };
+const STORED_LOG_INVALID = { status: 500, errorCode: "invalid_session" };
 const INVALID_ENTRIES = { status: 422, errorCode: "invalid_entries", sentence: STAGED_IMPORT_INVALID_SENTENCE };
 const SESSION_PLACED = { status: 409, errorCode: "conflict.session_placed", sentence: PLACED_SESSION_SENTENCE, detail: { placement_kind: PLACEMENT_KIND } };
 const STAGED_IMPORT_OWNER_CHANGED = { status: 409, errorCode: "conflict", sentence: STAGED_IMPORT_OWNER_CHANGED_SENTENCE };
@@ -11,7 +12,7 @@ export function sessionErrorHttp(code, face) {
         case "corrupt_session":
             return CORRUPT_SESSION;
         case "invalid_session":
-            return face === "import" ? INVALID_ENTRIES : undefined;
+            return face === "import" ? INVALID_ENTRIES : STORED_LOG_INVALID;
         case "placement_refused":
             return face === "import" ? SESSION_PLACED : undefined;
         case "conflict":

package/dist/session-policy-wire.d.ts

@@ -52,7 +52,7 @@ export declare function namespaceCoveringForms(): readonly {
 }[];
 /**
  * 能力位 `sessionRulesNamespaceForms` 的**唯一**判据:会话规则记录里协议命名空间的覆盖形,引擎认成「一组工具」**且**写口收。
- * 对 `PROTOCOL_TABLE` 的每一员:① 它的三只覆盖形,引擎的匹配器(`namespacedRuleNameCovers`,会话层与其余规则面同一只)都判得出覆盖那一员的真工具名
+ * 对 `PROTOCOL_TABLE` 的每一员:① 它的三只覆盖形,引擎的匹配器(`ruleNameCovers`,会话层与其余规则面同一只)都判得出覆盖那一员的真工具名
  * (只当精确名收的写口不算 ——「收」与「认成一组」是两问);② 三形放进 `toolAllow` 与 `toolDeny` 两桶,两条写入腿共用的写口读者
  * {@link readWritableSessionPermissionRules}(= 引擎写口判官)不拒。表非空 ∧ 每员都过 ⇒ `true`。
  *

package/dist/session-policy-wire.js

@@ -1,4 +1,4 @@
-import { PROTOCOL_TABLE, SessionPolicyError, judgeSessionRulesWrite, namespacedRuleNameCovers } from "@sema-agent/core";
+import { PROTOCOL_TABLE, SessionPolicyError, judgeSessionRulesWrite, ruleNameCovers } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
 function isSessionRulesRefusal(e) {
     return e instanceof SessionPolicyError && (e.code === "invalid_shape" || e.code === "inert_entry");
@@ -25,7 +25,7 @@ export function namespaceCoveringForms() {
 export function sessionRulesNamespaceFormsHonored() {
     const probes = namespaceCoveringForms();
     return (probes.length > 0 &&
-        probes.every(({ forms, tool }) => forms.every((form) => namespacedRuleNameCovers(form, tool)) && readWritableSessionPermissionRules({ toolAllow: [...forms], toolDeny: [...forms] }).refusal === undefined));
+        probes.every(({ forms, tool }) => forms.every((form) => ruleNameCovers(form, tool)) && readWritableSessionPermissionRules({ toolAllow: [...forms], toolDeny: [...forms] }).refusal === undefined));
 }
 export function readSessionRulesRecords(raw) {
     if (!Array.isArray(raw))

package/dist/session-sync.d.ts

@@ -50,7 +50,7 @@ import type { ServiceFileHistoryStore, ServiceSessionPolicyStore, ResumeAnchorSt
 /**
  * core 7.55.0 [ref] T2([ref]):一只会话的文件历史**读不全**(撕裂 / 读不出的边界、读不出的跟踪集 —— 店的 `exportHistory` 答 `{ ok: false }`,`adopt_failed`
  * 带店判的 `permanence`)。它**不是**「没有历史」:读成 `null` 的同步会把这只会话的全部 rewind 历史丢在路上、还答成功。会话同步的两只拉取口
- * (manifest、history blob)对它答同一句 503 `state.file_history_unreadable`(路由 `sendPullUnreadable`;连接类故障在拉取口同码同体键答 `permanence: "transient"`)。
+ * (manifest、history blob)对它答同一句 503 `state.file_history_unreadable`(路由 `sendPullUnreadable`;连接类故障在拉取口同码同体键答 `permanence: "transient"`,部署错配类故障〔缺表 / 权限拒〕答 `permanence: "terminal"`)。
  */
 export declare class FileHistoryUnreadableError extends Error {
     readonly sessionId: string;

package/dist/spec-fields.d.ts

@@ -21,6 +21,32 @@ export declare function normalizeSuggestNextPrompts(v: unknown): TaskSpec["sugge
  * undefined (never an empty object — keeps the spec byte-identical for non-users).
  */
 export declare function normalizeResilience(v: unknown, operator: boolean): TaskSpec["resilience"];
+/**
+ * 请求体 `attachments` 的子键**只有这一张表**(键 → 受理类别)。三处读它,不再各抄一份键名:
+ *  · 导出类型 `TaskRequestAttachments`(`http/wire-types.ts`)—— 与本表互为差集门(下面两只 `_GuardAttachmentKeys*`:类型加 / 删一个键而本表没跟 ⇒ tsc 红);
+ *  · 受理门(`http/admission.ts`)—— 非对象那一句列的键、布尔类键的逐键 `must be a boolean` 检查都从这里取;
+ *  · 重放翻译口 {@link normalizeAttachments} —— 入参形与逐键赋值的键集都是本表(`parts` 记录对 {@link AttachmentKey} 穷举,少一个键 ⇒ tsc 红)。
+ * 类别只回答受理门一个问题:`boolean` = 值必须是布尔(literal-true 键与布尔透传键的差别在翻译口,不在门);`mode` = `todoReminderMode` 的枚举;
+ * `changedFiles` = 布尔或 `{ maxFiles }`。后两类各有自己的门。键的**顺序**就是受理门那一句里的顺序(句子字面另由错误文案冻结钉守)。
+ */
+export type AttachmentKeyKind = "boolean" | "mode" | "changedFiles";
+export declare const ATTACHMENT_KEY_KINDS: {
+    readonly todoReminder: "boolean";
+    readonly todoReminderMode: "mode";
+    readonly changedFiles: "changedFiles";
+    readonly budgetUsd: "boolean";
+    readonly backgroundTasks: "boolean";
+    readonly toolsDelta: "boolean";
+    readonly agentListing: "boolean";
+    readonly skillsListing: "boolean";
+    readonly mcpInstructions: "boolean";
+    readonly mcpUnavailable: "boolean";
+};
+export type AttachmentKey = keyof typeof ATTACHMENT_KEY_KINDS;
+/** 表的键,原序。 */
+export declare const ATTACHMENT_KEYS: readonly AttachmentKey[];
+/** 受理门要验「值必须是布尔」的键(= 类别 `boolean`),原序。 */
+export declare const ATTACHMENT_BOOLEAN_KEYS: readonly AttachmentKey[];
 /**
  * [ref] (core 1.251) — normalize `body.attachments` → `TaskSpec.attachments`. Core's contract is
  * literal-true unions ("关闭=删 key,勿传 false"): only `true` (or, for changedFiles, an object with a sane
@@ -163,21 +189,25 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
 export declare function allowToolsSpecFragment(raw: unknown): {
     allowTools?: string[];
 };
-/** [ref]/[ref] — body.promptProfile → `TaskSpec.promptProfile`(core 1.328 R2 主件,CC LT(model_id)
- *  同构双形轴)。语义:纯呈现轴不碰策略(simple=CC 212 短形面缺省;classic=长形面,可按任务/模型试分)
- *  ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(引擎缺省 simple,byte-compat)。
+/** core 7.56.0 [ref] — body.promptLean → `TaskSpec.promptLean`(提示词形的唯一任务开关:`true` 加 `lean_prompt` 特征、`false` 去掉它、
+ *  缺省 = 模型声明)。纯呈现轴不碰策略 ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(模型目录条目的声明说话)。
  *
- *  ⚠️ **这不是一条 defer 注**([ref] 件⑤ 对表结论,core [ref] 同判):本段说的是 `promptProfile` 这根
- *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
- *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
- *  (`core/types.d.ts`:default "simple"),本批亲验未变。
- *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
- *  只是把候选集拓宽后走同一道阈值门)记在
- *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
- *  DEFENSIVE(resume 重放不过 HTTP 400 门):非法值 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
-export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;
+ *  ⚠️ **这不是一条 defer 注**:本段说的是提示词形这根**呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提
+ *  deferTools 只是在借它的「无租户门」姿势作类比。真正的 defer 轴对表记在 `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
+ *  DEFENSIVE(resume 重放不过 HTTP 400 门):非布尔 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
+export declare function promptLeanFromBody(raw: unknown): boolean | undefined;
+/**
+ * `TaskSpec.promptLean` 的座位片段:体里的 `promptLean`(布尔才算,见 {@link promptLeanFromBody})是唯一读数;缺席 ⇒ 不挂键。两条腿同一读法:
+ * 退役键 `promptProfile` 不读 —— 新提交带它在键闭集门 400;7.136.x 存体里的它由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),
+ * 改写不到的残留行在续跑判据上拒(`http/stored-body-replay.ts` 第四问),到不了这里。
+ */
+export declare function promptLeanSpecFragment(body: {
+    readonly promptLean?: unknown;
+}): {
+    promptLean?: boolean;
+};
 /** [ref]②(core 5.14.0 `TaskSpec.toolMaterializeStrategy`):deferred 工具激活后的 schema 供给策略。
- *  与 {@link promptProfileFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
+ *  与 {@link promptLeanFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
  *  只负责 resume 重放存量 body 时把不认识的值静默 DROP(回落 core 的 env/缺省链),而不是把它带上 spec。 */
 export declare function toolMaterializeStrategyFromBody(raw: unknown): "static" | "swap" | undefined;
 /** [ref]④ — 每键的运营方上限旋钮(env,缺省不设=不封顶)。 */

package/dist/spec-fields.js

@@ -25,6 +25,20 @@ export function normalizeResilience(v, operator) {
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
+export const ATTACHMENT_KEY_KINDS = {
+    todoReminder: "boolean",
+    todoReminderMode: "mode",
+    changedFiles: "changedFiles",
+    budgetUsd: "boolean",
+    backgroundTasks: "boolean",
+    toolsDelta: "boolean",
+    agentListing: "boolean",
+    skillsListing: "boolean",
+    mcpInstructions: "boolean",
+    mcpUnavailable: "boolean",
+};
+export const ATTACHMENT_KEYS = Object.keys(ATTACHMENT_KEY_KINDS);
+export const ATTACHMENT_BOOLEAN_KEYS = ATTACHMENT_KEYS.filter((k) => ATTACHMENT_KEY_KINDS[k] === "boolean");
 export function normalizeAttachments(v) {
     if (v == null || typeof v !== "object" || Array.isArray(v))
         return undefined;
@@ -37,17 +51,19 @@ export function normalizeAttachments(v) {
         changedFiles =
             typeof mf === "number" && Number.isFinite(mf) && mf >= 1 ? { maxFiles: Math.min(100, Math.floor(mf)) } : true;
     }
-    const out = {
-        ...(o.todoReminder === true ? { todoReminder: true } : {}),
-        ...(changedFiles !== undefined ? { changedFiles } : {}),
-        ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
-        ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
-        ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),
-        ...(o.budgetUsd === true ? { budgetUsd: true } : {}),
-        ...(o.mcpInstructions === true ? { mcpInstructions: true } : {}),
-        ...(typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {}),
-        ...(typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {}),
+    const parts = {
+        todoReminder: o.todoReminder === true ? { todoReminder: true } : {},
+        todoReminderMode: o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {},
+        changedFiles: changedFiles !== undefined ? { changedFiles } : {},
+        budgetUsd: o.budgetUsd === true ? { budgetUsd: true } : {},
+        backgroundTasks: typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {},
+        toolsDelta: o.toolsDelta === true ? { toolsDelta: true } : {},
+        agentListing: typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {},
+        skillsListing: typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {},
+        mcpInstructions: o.mcpInstructions === true ? { mcpInstructions: true } : {},
+        mcpUnavailable: typeof o.mcpUnavailable === "boolean" ? { mcpUnavailable: o.mcpUnavailable } : {},
     };
+    const out = Object.assign({}, ...ATTACHMENT_KEYS.map((k) => parts[k]));
     return Object.keys(out).length > 0 ? out : undefined;
 }
 export function normalizeResumeAtMode(v, resumeAtResolved) {
@@ -90,6 +106,7 @@ const SKILL_FIELD_SHAPES = {
     disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
     baseDir: { required: false, ok: isAbsoluteHostPath },
+    mods: { required: false, ok: () => false },
 };
 const skillOk = (s) => {
     if (!plainObject(s))
@@ -301,8 +318,12 @@ export function toolNameListFromBody(raw) {
 export function allowToolsSpecFragment(raw) {
     return raw === undefined ? {} : { allowTools: raw };
 }
-export function promptProfileFromBody(raw) {
-    return raw === "simple" || raw === "classic" ? raw : undefined;
+export function promptLeanFromBody(raw) {
+    return typeof raw === "boolean" ? raw : undefined;
+}
+export function promptLeanSpecFragment(body) {
+    const lean = promptLeanFromBody(body.promptLean);
+    return lean !== undefined ? { promptLean: lean } : {};
 }
 export function toolMaterializeStrategyFromBody(raw) {
     return raw === "static" || raw === "swap" ? raw : undefined;

package/dist/stored-request-prompt-profile-m30.d.ts

@@ -0,0 +1,49 @@
+/**
+ * 一次性迁移 M30 —— 升级之前停驻的行(`checkpoint_ctx`)里请求体的退役键 `promptProfile`,起服**原地改写**成 `promptLean`。
+ * 🔴 M30 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 引擎 7.56.0 把提示词形收成一个布尔(`TaskSpec.promptLean`),双形词 `promptProfile`(`"simple" | "classic"`)整键退役;新提交带它在键闭集门 400。
+ * 7.136.x 及以前停驻的任务,`checkpoint_ctx` 存着的请求体带的是旧键 —— 续跑腿重放它,没有读者 ⇒ `"classic"`(要长形)静默回到模型声明的短形。
+ * 持久数据面 = 一次性迁移把旧表示消灭(不是续跑时按日历再读一遍:那样存体从不改,窗内续跑过一次、再停驻、窗关后再续跑,意图照样静默丢)。
+ *
+ * ## 法(一条映射,与 MIGRATION 写给调用方的同一张)
+ * 窗内每次起服扫一遍 `checkpoint_ctx`(两孪生共有的 ctx 行改写店腿 `rewriteCtxRows`,与 M28 同一只;SQL 按原文 CAS、`updated_at_ms` 不动;local 信封的 `updatedAt` 不动),
+ * 体里带自有键 `promptProfile` 的行:删掉它;`"classic"` 且体里没有布尔 `promptLean` ⇒ 写 `promptLean: false`(长形的意图);`"simple"`(当年的缺省形)/ 词表外的值 ⇒
+ * 只删键;体里已有布尔 `promptLean`(它说了算)⇒ 只删键。体的其余键、行上的读法记号与凭据位原样随行(行改写 = `http/checkpoint-ctx.ts` `rewriteStoredBodyKeys`)。
+ * 已改写 / 不带旧键的行零写;读不出的行计数、不动(留给读口的响亮臂)。读数一行 info `checkpoint_ctx_prompt_profile_rewritten`(行数,不带值),不进
+ * `OneTimeMigrationReport`(登记行 `reportKeys` 空,与 M28 同形)。窗外不扫。
+ *
+ * ## 改写不到的行(响亮拒,不是第二种读法)
+ * 续跑腿不读旧键(`resolveSpec` 只读布尔 `promptLean`)。存体里仍带 `promptProfile` 的行 —— 窗内从没起过本版的部署,或滚动升级里旧副本在本版起服扫描之后才写下的行 ——
+ * 在五个续跑问点的同一只判据上拒(`http/stored-body-replay.ts` 第四问,409 `checkpoint.unsupported_version`);窗内再起一次本版即改写它。
+ *
+ * ## 为什么不在 `one-time-migrations.ts` 的迁移段里
+ * 那一段跑在店层(起服第 3 段),checkpoint 店还没建;本条与 M28 同在起服第 6 段 checkpoint 店建成之后、任何路由装配之前调一次。
+ */
+import { type SealedCheckpointCtx } from "./http/checkpoint-ctx.js";
+import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
+import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-sql.js";
+/** M30 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。`rowsLongFormKept` = 改写成 `promptLean: false` 的行。 */
+export interface PromptProfileRetireM30Report {
+    readonly window: "open" | "closed";
+    readonly rowsScanned: number;
+    readonly rowsRewritten: number;
+    readonly rowsLongFormKept: number;
+    readonly rowsUnreadable: number;
+    readonly rowsTooLarge: number;
+}
+/**
+ * 一行存量 ctx 的 M30 改写(纯函数;店腿逐行调):体里没有自有键 `promptProfile`(或体不是对象)⇒ `undefined`(不写);否则交回改写后的落盘形与改动数
+ * (写了 `promptLean: false` 记 1,只删键记 0)。导出给两孪生的真库钉(`checkpoint-ctx-credential-seal-db-integration.test.ts`)直接喂店腿。
+ */
+export declare function retirePromptProfileRowM30(stored: object): {
+    readonly ctx: SealedCheckpointCtx;
+    readonly values: number;
+} | undefined;
+/** 跑一次 M30(`today` = UTC 日历日 YYYY-MM-DD;`window` 缺省 = 登记表 M30 那一行 —— 只有测试递别的窗)。窗关 ⇒ 不扫。 */
+export declare function retirePromptProfileM30(store: CheckpointCtxRowsRewriter, opts: {
+    readonly today: string;
+    readonly window?: Pick<OneTimeMigrationWindow, "removableAfter">;
+}): Promise<PromptProfileRetireM30Report>;
+//# sourceMappingURL=stored-request-prompt-profile-m30.d.ts.map

package/dist/stored-request-prompt-profile-m30.js

@@ -0,0 +1,25 @@
+import { rewriteStoredBodyKeys } from "./http/checkpoint-ctx.js";
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+const RETIRED_KEY = "promptProfile";
+export function retirePromptProfileRowM30(stored) {
+    const body = stored.body;
+    if (body === null || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, RETIRED_KEY))
+        return undefined;
+    const fields = body;
+    const keepsLongForm = fields[RETIRED_KEY] === "classic" && typeof fields["promptLean"] !== "boolean";
+    return { ctx: rewriteStoredBodyKeys(stored, { drop: [RETIRED_KEY], ...(keepsLongForm ? { set: { promptLean: false } } : {}) }), values: keepsLongForm ? 1 : 0 };
+}
+function m30Window() {
+    const row = ONE_TIME_MIGRATIONS.find((w) => w.id === "M30");
+    if (row === undefined)
+        throw new Error("stored-request-prompt-profile-m30: the one-time migration registry has no M30 row — this migration outlived its registry row; delete it with that row");
+    return row;
+}
+export async function retirePromptProfileM30(store, opts) {
+    if (!migrationWindowOpen(opts.window ?? m30Window(), opts.today)) {
+        return { window: "closed", rowsScanned: 0, rowsRewritten: 0, rowsLongFormKept: 0, rowsUnreadable: 0, rowsTooLarge: 0 };
+    }
+    const r = await store.rewriteCtxRows((_sessionId, ctx) => retirePromptProfileRowM30(ctx));
+    return { window: "open", rowsScanned: r.scanned, rowsRewritten: r.rewritten, rowsLongFormKept: r.valuesRewritten, rowsUnreadable: r.unreadable, rowsTooLarge: r.tooLarge };
+}
+//# sourceMappingURL=stored-request-prompt-profile-m30.js.map

package/dist/task-mcp.d.ts

@@ -190,7 +190,7 @@ export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
  * A caller can ADD servers but can never SHADOW or REFILL a deployment-declared one: a center entry that was skipped
  * (disabled / missing env ref / malformed `toolFaces`) still occupies its name, otherwise "skipped" would silently
  * mean "free for the caller to remount without the operator's `allowTools` / `toolFaces`" (车CF codex r2 [high]).
- * Same posture as `mergeUserSkills`.
+ * Same posture as `buildRunSkills`.
  */
 export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
 /**

package/dist/task-settings.d.ts

@@ -73,7 +73,7 @@ export declare const PERMISSION_MODE_WORDS: string;
  * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
  * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
  * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
- * (admission.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
+ * (admission.ts, sibling of toolMaterializeStrategy) and the wire type is a closed enum. This lenient fold stays for the one
  * population the gate deliberately does not cover: RESUME replay of a persisted pre-gate body (outputStyle/model
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
@@ -477,7 +477,7 @@ export declare const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot
 /**
  * Build the per-request permission ToolPolicy from the parsed settings: the two **rule lists** (`deny` / `ask`) through ONE compiler
  * ({@link createRuleListPolicy} → core `createPermissionRulePolicy`) — a `deny` rule hard-blocks, an `ask` rule forces an approval
- * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `namespacedRuleNameCovers`,本仓不持第二套 glob。
+ * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `ruleNameCovers`,本仓不持第二套 glob。
  * The `allow` bucket is not here: a policy says deny / ask only (core 7.42.0); the list rides into `TaskSpec.allowedTools` at
  * {@link applyTaskSettings}, the one write point.
  *

package/dist/tool-approval.d.ts

@@ -213,11 +213,14 @@ export declare function carriesDeploymentListQuestion(deploymentListAsks: boolea
  * 本仓**策略层自己交出去的一问**的 {@link StandingAnswerFacts}。读者两个:部署名单门(`approval.ts`,`deploymentListQuestion: true`)与 workflow 问句门
  * (`task-settings.ts`,`false`)—— 它们在交出这一问之前先读按工具名记的耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役
  * 继承问),而**能不能读**与审批席 / 回决写侧是同一只判据({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(带授予绑定的问 ……)不代答,
- * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link NO_GATE_FACTS});`requiresRealApproval` /
+ * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link noGateFacts},调用坐标取 `req`);`requiresRealApproval` /
  * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**调用**(`callGrantBindingOf` —— 本层手里还没有引擎铸的卡,core 7.51.0 不在
  * `ToolCallRequest` 上盖绑定词,[ref] 载体问题见 `standing-answer-grant.ts` 头注)。
  */
-export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall, ask: Extract<PermissionResult, {
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall & {
+    readonly toolCallId: string;
+    readonly toolName: string;
+}, ask: Extract<PermissionResult, {
     action: "ask";
 }>, deploymentListQuestion: boolean): StandingAnswerFacts;
 /**
@@ -1027,6 +1030,13 @@ export type UnattendedAskOutcome = Extract<AskOutcome, "unavailable"> | Unattend
 /** [ref] 候裁 16:耐久会话授权店(`src/plugins/approval-exemption-store.ts` 的同一只店):审批席读它(引擎的问),活卡上部署名单那一问的
  *  「本会话放行」写它(名单门在出问之前读同一行)。 */
 export type SessionGrantStore = Pick<ApprovalExemptionStore, "has" | "grant">;
+/** redactDeep + size-bound the UNTRUSTED tool args before they are streamed. Over the cap / unserializable ⇒
+ *  undefined (frame rides argsOmitted — see MAX_APPROVAL_ARGS_BYTES). */
+/**
+ * 给审批人看的一份入参 —— 卡上 `args` 的**同一种读法**({@link boundArgs}:脱敏 + 字节帽;超帽 / 序列化不出 ⇒ `undefined`)。
+ * 读者:卡帧 / 卡面(经 `boundArgs` 本体)与续跑拒体的 `acceptableForm`(core 7.56.0 [ref]:编辑复判只收改写后的那一形,人在决定口看到它、批准它)。
+ */
+export declare function approverFacingArgs(args: unknown): unknown;
 /**
  * [ref] 车3 刀 3b —— 「流内审批协议到底上不上场」的**单一谓词**(设计稿 §2.3 注入 / §2.4 能力面 /
  * §8.4 park 设施自检,三处同一份判据)。