@sema-agent/server 7.136.0 → 7.137.0

package/dist/broker/main.js

@@ -0,0 +1,20 @@
+import { BROKER_HOST, BROKER_LEASE_PATH, BROKER_LEASE_POLL_MS, BROKER_PORT, BROKER_PROBE_ARG } from "./constants.js";
+import { probeBroker, runBroker } from "./broker.js";
+const PROBE_TIMEOUT_MS = 2_000;
+async function main() {
+    if (process.argv.includes(BROKER_PROBE_ARG)) {
+        process.exit((await probeBroker(BROKER_HOST, BROKER_PORT, PROBE_TIMEOUT_MS)) ? 0 : 1);
+    }
+    await runBroker({
+        leasePath: BROKER_LEASE_PATH,
+        host: BROKER_HOST,
+        port: BROKER_PORT,
+        pollMs: BROKER_LEASE_POLL_MS,
+        log: (e) => void process.stdout.write(`${JSON.stringify(e)}\n`),
+    });
+}
+main().catch((e) => {
+    process.stderr.write(`${JSON.stringify({ event: "broker_failed", error: e instanceof Error ? e.message : String(e) })}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/capabilities/composite-members.d.ts

@@ -38,7 +38,7 @@ import type { NamedKeysOf } from "../request-key-closure.js";
  * B.2b)与 CHANGELOG。present-iff 的位与成员照样登记(在场律写在附录的「在场律」列)。
  */
 export declare const COMPOSITE_CAPABILITY_MEMBERS: {
-    readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"];
+    readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management", "relayUrl"];
     readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"];
     readonly memoryEngine: readonly ["backend", "vectorMode"];
     readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
@@ -55,6 +55,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly sealedKey: readonly ["alg", "publicKeyId", "publicKey"];
     readonly workspaceSync: readonly ["persist", "keep", "timeoutMs", "cache"];
     readonly userAttachments: readonly ["entries", "kinds", "supplies", "limits"];
+    readonly credentialPlane: readonly ["sandboxGit"];
 };
 type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
 /** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */

package/dist/capabilities/composite-members.js

@@ -1,5 +1,5 @@
 export const COMPOSITE_CAPABILITY_MEMBERS = {
-    deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"],
+    deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management", "relayUrl"],
     fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
     store: ["declared", "backend", "durable", "degradedReason", "sql"],
@@ -16,6 +16,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     sealedKey: ["alg", "publicKeyId", "publicKey"],
     workspaceSync: ["persist", "keep", "timeoutMs", "cache"],
     userAttachments: ["entries", "kinds", "supplies", "limits"],
+    credentialPlane: ["sandboxGit"],
 };
 export function gateCompositeMembers(body) {
     return body;

package/dist/capabilities/engine-capabilities.js

@@ -3,6 +3,7 @@ import { ownCredentialsWithheld, ownCredentialValuesWithheld } from "../server-s
 const ENGINE_CAPABILITY_FACTS = {
     "inherit_env.own_credentials_withheld": ownCredentialsWithheld,
     "inherit_env.own_credential_values_withheld": ownCredentialValuesWithheld,
+    "mods.skill_seat": () => false,
 };
 export function engineCapabilityBits() {
     const out = {};

package/dist/capabilities/scenarios.d.ts

@@ -2,7 +2,7 @@ import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, t
 import type { Logger } from "../observability/logger.js";
 import { type SubagentExtraToolSet } from "./builtin-tools.js";
 import { type RepoReadClient } from "./repo-tools.js";
-import { type LoadedSkill, type ScenarioSkillEntry } from "./skills.js";
+import { type LoadedSkill, type RunSkillEntry, type ScenarioSkillEntry, type SkillSource } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
 import type { DelegationRootWitness } from "../delegated-session-owner.js";
 /**
@@ -315,14 +315,29 @@ export declare function centerScenarios(deps: ScenarioDeps, specs: CenterScenari
     shadows: string[];
 };
 /**
- * Personalization seam: merge the caller's own skills AFTER the scenario's, with
- * SCENARIO-WINS on a name clash — the scenario / center skills own the name (they are the deployment's baseline
- * wording, not an enforcement face: permissions / write gates / hooks do not ride on skills, and a caller may
- * unload the whole set with `disableSkills`, [ref]); user content never shadows them. Duplicate names within the user list keep the first. Clashes are logged for audit
- * (silent drops would make "my skill didn't fire" undebuggable). Input is already shape/size-validated
- * by the HTTP layer (validateUserSkills); this stays pure merge policy.
+ * 一条 run 的技能(交给引擎的 `TaskSpec.skills`)与它的名册(`wiring_manifest.skills`)—— **同一次合并的两个投影**,铸点只有 {@link buildRunSkills}。
+ *  · `specs`  —— 交给引擎的那一份(`undefined` = 一只都没有且没被关;`disable` ⇒ 显式 `[]`,引擎对空表零 `<skills>` 块、不挂 `Skill`);
+ *  · `roster` —— 同一组、同一个序,逐条带来处;零技能 ⇒ `[]`(零技能是一句陈述,不是缺席)。
  */
-export declare function mergeUserSkills(scenarioSkills: SkillSpec[] | undefined, userSkills: SkillSpec[] | undefined, logger?: Logger): SkillSpec[] | undefined;
+export interface RunSkills {
+    readonly specs: SkillSpec[] | undefined;
+    readonly roster: RunSkillEntry[];
+}
+/**
+ * Personalization seam + run 名册的**唯一铸点**:调用方自带的技能接在场景的之后,**同名场景赢**(场景 / 中心的技能拥有那个名字 —— 它们是部署的基线措辞,
+ * 不是执法面:权限 / 写门 / hook 都不骑在技能上,调用方要整组卸掉用 `disableSkills`,[ref]);用户内容永不遮住它们。用户表内重名留第一个。
+ * 被丢的名字落审计行(静默丢会让「我的技能没生效」查不出来)。形已由 HTTP 门判过(`validateUserSkills`);本函数只做合并政策与来处。
+ *
+ * 来处(`roster[].source`):场景那一半按**部署装载簿**的来处标(`deploymentSources`:装载腿写下的 `LoadedSkill.source`,名字在装载簿里唯一 ——
+ * 装载器同名即抛、配置源按名覆盖);场景里有、装载簿里没有的技能是嵌入方场景代码自带的 ⇒ `factory`(本部署自带,不是配置源交来的、也不是这次请求带的)。
+ * 请求那一半恒 `request`。`disable` ⇒ 两个投影都空(`specs: []`、`roster: []`)。
+ */
+export declare function buildRunSkills(args: {
+    readonly scenario: SkillSpec[] | undefined;
+    readonly request: readonly SkillSpec[] | undefined;
+    readonly disable: boolean;
+    readonly deploymentSources: ReadonlyMap<string, SkillSource>;
+}, logger?: Logger): RunSkills;
 /** center caps view 的解析结果两键(形状锚定)。`scenario` null = 三层皆未配。 */
 export interface ScenarioRuling {
     scenario: string | null;

package/dist/capabilities/scenarios.js

@@ -262,23 +262,28 @@ const REVIEWER_ROLE_TEXT = "You are a senior code reviewer. Call repo_tree to ma
     "the files in scope, then review them yourself. " +
     "Produce ONE prioritized review: a short summary, then findings grouped by severity " +
     "(blocker / major / minor), each with `path:line`, the problem, and a concrete fix. Cite real code — never invent files or symbols.";
-export function mergeUserSkills(scenarioSkills, userSkills, logger) {
-    if (!userSkills || userSkills.length === 0)
-        return scenarioSkills;
-    const reserved = new Set((scenarioSkills ?? []).map((s) => s.name));
-    const out = [...(scenarioSkills ?? [])];
+export function buildRunSkills(args, logger) {
+    if (args.disable)
+        return { specs: [], roster: [] };
+    const scenario = args.scenario ?? [];
+    const roster = scenario.map((s) => ({ name: s.name, description: s.description, source: args.deploymentSources.get(s.name) ?? "factory" }));
+    if (!args.request || args.request.length === 0)
+        return { specs: args.scenario, roster };
+    const reserved = new Set(scenario.map((s) => s.name));
+    const specs = [...scenario];
     const dropped = [];
-    for (const s of userSkills) {
+    for (const s of args.request) {
         if (reserved.has(s.name)) {
             dropped.push(s.name);
             continue;
         }
         reserved.add(s.name);
-        out.push(s);
+        specs.push(s);
+        roster.push({ name: s.name, description: s.description, source: "request" });
     }
     if (dropped.length > 0)
         logger?.warn("user_skills_dropped", { reason: "name reserved by scenario (or duplicate)", names: dropped });
-    return out;
+    return { specs, roster };
 }
 function registeredScenariosClause(known) {
     return `this deployment's scenarios are: ${known.join(", ")}`;

package/dist/capabilities/skills.d.ts

@@ -1,4 +1,4 @@
-import type { SkillSpec } from "@sema-agent/core";
+import type { SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { RemoteExecProvider } from "../execution-lane-caps.js";
 import { type Logger } from "../observability/logger.js";
 /**
@@ -90,14 +90,37 @@ export declare function loadDeploymentSkills(config: {
 /** 一个技能范围交进 `TaskSpec` 的技能(场景工厂的 `skills`)。范围从哪来见 `scenarios.ts` 的 `BUILTIN_SCENARIO_SKILL_SCOPE`(center 场景 = 它自己的名字)。 */
 export declare function skillsForScenario(loaded: readonly LoadedSkill[], scope: string): SkillSpec[];
 /**
- * [ref] —— 场景卡技能清单的一条(`GET /v1/capabilities/scenarios/:name` 的 `skills[]`):名字 / 描述 / 来处,**不带正文**,也不带技能上的两只工具清单
- * (`allowedTools` / `disallowedTools`)。名字就是提交体 `userInvokedSkills` 点名时用的那个串。
+ * 技能清单的一条 —— **一张形,两个面**:场景卡(`GET /v1/capabilities/scenarios/:name` 的 `skills[]`,[ref])与 run 级名册
+ * (`wiring_manifest.skills[]`)。名字 / 描述 / 来处,**不带正文**,也不带技能上的两只工具清单(`allowedTools` / `disallowedTools`)。
+ * 名字就是提交体 `userInvokedSkills` 点名时用的那个串。两个面只差来处的值域(`S`):场景卡上只有部署两处,run 名册上多一个 `request`。
  */
-export interface ScenarioSkillEntry {
+export interface SkillListEntry<S extends string> {
     readonly name: string;
     readonly description: string;
-    readonly source: SkillSource;
+    readonly source: S;
 }
+/** 场景卡技能清单的一条(来处 = 部署两处)。 */
+export type ScenarioSkillEntry = SkillListEntry<SkillSource>;
+/** run 级技能来处的闭集 = 部署两处({@link SkillSource})∪ 本请求体 `skills`。 */
+export type RunSkillSource = SkillSource | "request";
+/** run 级名册的一条(`wiring_manifest.skills[]`)。铸点唯一:`capabilities/scenarios.ts` 的 `buildRunSkills`。 */
+export type RunSkillEntry = SkillListEntry<RunSkillSource>;
+/**
+ * run 级技能名册在 TaskSpec 上的**显式字段键** —— 与执行车道字段(`hands-lane.ts` 的 `HANDS_LANE_FIELD`,[ref])同一形:symbol 键随
+ * spread / rest 解构走(续跑腿的 `taskConfig` 就是 rest 解构出来的),对上游 core 的键面不可见(JSON / 结构化克隆跳过 symbol 键)。
+ * 铸点唯一 = `boot/resolve-spec.ts` 的 resolveSpec 出口({@link stampRunSkills});读点唯一 = {@link runSkillsOf}(每条投 `wiring_manifest` 的腿)。
+ */
+export declare const RUN_SKILLS_FIELD: unique symbol;
+/**
+ * 铸名册(**单一属主**:只许 resolveSpec 的出口调用)。字段 `enumerable`(复制得走)、`writable:false` + `configurable:false`(同一只 spec 被第二次铸 ⇒
+ * 当场 TypeError,两个写者是漂移的成因)。名册冻结一份拷贝(spec 与腿不共享可变引用)。
+ */
+export declare function stampRunSkills<T extends TaskSpec>(spec: T, roster: readonly RunSkillEntry[]): T;
+/**
+ * 读名册。`undefined` = 这只 spec 不是本仓装配出口产的(嵌入方自写 `resolveSpec` / 测试桩)⇒ 腿上没有关于技能的陈述(段缺席)。
+ * 不是保护型量(缺席只少一段披露,不放宽任何东西)⇒ 缺席照常跑,与车道字段的「缺席即拒」不同。入参收 `object`:续跑腿手里是 rest 解构出来的 taskConfig。
+ */
+export declare function runSkillsOf(spec: object): readonly RunSkillEntry[] | undefined;
 /** 一个技能范围的卡上清单 —— 与 {@link skillsForScenario} 同一只过滤、同一个序,只是投影不同。 */
 export declare function scenarioSkillEntries(loaded: readonly LoadedSkill[], scope: string): ScenarioSkillEntry[];
 /** {@link parseFrontmatter} 的三种读数(闭集):`absent` = 第一行不是围栏,没有 frontmatter(正当的全局技能)· `block` = 围栏收好了的块 · `unclosed` = 第一行是围栏而块没收好(读不了 —— 调用方拒载)。 */

package/dist/capabilities/skills.js

@@ -127,6 +127,14 @@ function skillsInScope(loaded, scope) {
 export function skillsForScenario(loaded, scope) {
     return skillsInScope(loaded, scope).map((k) => k.spec);
 }
+export const RUN_SKILLS_FIELD = Symbol("sema-server.runSkills");
+export function stampRunSkills(spec, roster) {
+    Object.defineProperty(spec, RUN_SKILLS_FIELD, { value: Object.freeze(roster.map((e) => Object.freeze({ ...e }))), enumerable: true, writable: false, configurable: false });
+    return spec;
+}
+export function runSkillsOf(spec) {
+    return spec[RUN_SKILLS_FIELD];
+}
 export function scenarioSkillEntries(loaded, scope) {
     return skillsInScope(loaded, scope).map((k) => ({ name: k.spec.name, description: k.spec.description, source: k.source }));
 }

package/dist/center-credential-renewer.js

@@ -3,7 +3,7 @@ import { closeSync, fchmodSync, fsyncSync, openSync, readdirSync, readFileSync,
 import { basename, dirname, join } from "node:path";
 import { WEB_ADMIN_ENV, WebAdminCredentialEnvelope, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 import { ACCESS_TOKEN_TTL_SECONDS, OAuthErrorResponse, TokenGrantResponse } from "@sema-agent/settings-schema/api/auth";
-import { CENTER_PULL_TIMEOUT_MS, centerTokenRefresh } from "./web-admin-client/center-request.js";
+import { CENTER_PULL_TIMEOUT_MS, CenterRedirectRefusedError, centerTokenRefresh } from "./web-admin-client/center-request.js";
 export const CENTER_CREDENTIAL_RENEW_LEAD_KEY = "CENTER_CREDENTIAL_RENEW_LEAD_MS";
 export const CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS = 5 * 60_000;
 export const CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS = CENTER_PULL_TIMEOUT_MS;
@@ -277,6 +277,10 @@ export function createCenterCredentialRenewer(deps) {
             res = await centerTokenRefresh(envelope.issuer, envelope.refreshToken, { timeoutMs: CENTER_PULL_TIMEOUT_MS, ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}) });
         }
         catch (err) {
+            if (err instanceof CenterRedirectRefusedError) {
+                judgeRefusal(usedDigest, "rejected", { status: err.status });
+                return;
+            }
             settleRetrying("center_unavailable", usedDigest, { error: err instanceof Error ? err.name : "fetch error" });
             return;
         }

package/dist/checkpoint-ctx-seal-m28.d.ts

@@ -12,16 +12,9 @@
  * 本条在起服第 6 段 checkpoint 店建成、封签器的装配判(`CHECKPOINT_CTX_SEALING_REQUIRED`)过了之后调一次,早于任何路由装配(与 M10 / M19 / M25
  * 同为在迁移段之外跑的条目)。读数一行 info `checkpoint_ctx_credentials_sealed`,不进 `OneTimeMigrationReport`(登记行 `reportKeys` 空)。
  */
-import { type CheckpointCtxSealer, type SealedCheckpointCtx } from "./http/checkpoint-ctx.js";
+import { type CheckpointCtxSealer } from "./http/checkpoint-ctx.js";
 import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
-import type { CtxRowsRewriteM28 } from "./plugins/checkpoint-store-sql.js";
-/** 两孪生的店腿(`SqlCheckpointStore` / `LocalCheckpointStore` 的 `rewriteCtxRowsM28`)。 */
-export interface CheckpointCtxRowsRewriterM28 {
-    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
-        readonly ctx: SealedCheckpointCtx;
-        readonly values: number;
-    } | undefined): Promise<CtxRowsRewriteM28>;
-}
+import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-sql.js";
 /** M28 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。 */
 export interface CheckpointCtxSealM28Report {
     readonly window: "open" | "closed";
@@ -35,7 +28,7 @@ export interface CheckpointCtxSealM28Report {
  * 跑一次 M28(`today` = UTC 日历日 YYYY-MM-DD;`window` 缺省 = 登记表 M28 那一行 —— 只有测试递别的窗)。窗关 ⇒ 不扫。
  * 店腿的每一行:`sealStoredCheckpointCtxM28` 交回新体(凭据位上的明文封好)⇒ 回写;交回 `undefined`(没有明文)⇒ 不写。
  */
-export declare function sealCheckpointCtxCredentialsM28(store: CheckpointCtxRowsRewriterM28, sealer: CheckpointCtxSealer, opts: {
+export declare function sealCheckpointCtxCredentialsM28(store: CheckpointCtxRowsRewriter, sealer: CheckpointCtxSealer, opts: {
     readonly today: string;
     readonly window?: Pick<OneTimeMigrationWindow, "removableAfter">;
 }): Promise<CheckpointCtxSealM28Report>;

package/dist/checkpoint-ctx-seal-m28.js

@@ -10,7 +10,7 @@ export async function sealCheckpointCtxCredentialsM28(store, sealer, opts) {
     if (!migrationWindowOpen(opts.window ?? m28Window(), opts.today)) {
         return { window: "closed", rowsScanned: 0, rowsSealed: 0, valuesSealed: 0, rowsUnreadable: 0, rowsTooLarge: 0 };
     }
-    const r = await store.rewriteCtxRowsM28((sessionId, ctx) => {
+    const r = await store.rewriteCtxRows((sessionId, ctx) => {
         const out = sealStoredCheckpointCtxM28(ctx, sealer, sessionId);
         return out === undefined ? undefined : { ctx: out.ctx, values: out.valuesSealed };
     });

package/dist/checkpoint-identity.d.ts

@@ -7,13 +7,13 @@ export declare const MAX_CHECKPOINT_ID_CHARS = 128;
 export declare function withoutCheckpointToken(text: string, token: unknown): string;
 /** 持久层读出的 `checkpointId` 过信任边界:是串、非空、不超长、不含 token(大小写不敏感)⇒ 原值;否则 `undefined`。判据全文见本文件头注。 */
 export declare function trustedCheckpointId(raw: unknown, token: unknown): string | undefined;
-/** 带 `checkpointId` 当 join 键的两类 durable 读面(计数 detail 的 `face`)。 */
-export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox";
+/** 带 `checkpointId` 当 join 键的 durable 面(计数 detail 的 `face`):运维队列行、停驻收件行,与 7.137.0 起的 park 账本行(`GET /v1/runs/:id/events` 的 `suspended` / `needs_review`,写时判一次)。 */
+export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox" | "run-events-park";
 /**
  * durable 读面的一行 → 它的身份片段,**由调用方原样展开进行投影**(`...durableRowIdentity(face, raw, token)`):读得出可信值 ⇒ `{ checkpointId }`;
  * 读不出 ⇒ `{}`(这一行**照列**,键缺席)+ 计一次(见本文件头注「durable 面的 join 键」)。
  * `raw === undefined` = 行上没有这一格(`why=absent`,老行);在场却没过信任边界(非串 / 空串 / 超长 / 含 token / 读不出)= `why=untrusted`。
- * 三处读面(两只店的 `listPending` + 收件 handler)只经这一只 —— 读法、计数、缺席形各只有一份。
+ * 三处读面(两只店的 `listPending` + 收件 handler)与 park 账本行的唯一构造器(`trace/project.ts` 的 `parkEventData`)只经这一只 —— 读法、计数、缺席形各只有一份。
  */
 export declare function durableRowIdentity(face: DurableCheckpointFace, raw: unknown, token: unknown): {
     readonly checkpointId?: string;

package/dist/config-catalog.js

@@ -7,6 +7,7 @@ import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE
 import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
+import { SANDBOX_SECRET_SEAT_VERBS } from "./plugins/k8s-exec-protocol.js";
 import { LIVENESS_MS_DEFAULT } from "./exec-bounds.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
@@ -125,6 +126,7 @@ export const CONFIG_CATALOG = [
     r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", `per-device 在途上限(超额云侧排队;原值进 helloAck.maxInflight;须为 ≥ ${DEVICE_HELLO_ACK_BOUNDS.maxInflight.min} 的规范十进制整数,其余拒启 —— 0 会让每次派发都 device.busy)`, { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
     r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
+    r("DEVICE_RELAY_URL", "orchestration", "url", "设备直达入口:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { derivedDefaultNote: "缺席 ⇒ 能力面不带 relayUrl,设备按引擎地址 + deviceExecutor.wsPath 拨号" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
@@ -163,7 +165,7 @@ export const CONFIG_CATALOG = [
     r("FLEET_GENERATION", "integrations", "string", "fleet 成员的代际(配置渲染器写;引擎回声到心跳与 /health 的 generation)。缺席 ⇔ 非 fleet 成员(不续服务租约、不受围栏);在场必须是规范十进制串(\"0\" / \"7\";空串、前导零、符号、空白拒启)", { danger: SEC, configKey: "fleetGeneration" }),
     r("FLEET_LEASE_FAIL_CLOSED", "integrations", "boolean", "租约连接级失败(中心鉴权拒 / 凭证不可读 / 不可达 / 5xx / 超时 / 坏体)时计费入口拒 503 fleet.lease_unavailable(true)还是放行(false);409 not-lease 与耗尽 429 不受它管;词表外拒启", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 按部署姿态派生:REQUIRE_PRINCIPAL=true ⇒ true(多租:额度是安全轴);单用户 ⇒ false(AP 姿态)。显式值压过派生。生效值见 caps centerWiring.failMode", configKey: "fleetLeaseFailClosed" }),
     r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "一台实例「活着而不服务」的最长时长 T_max(ms),两处读它:① 服务租约中心不可达的容忍上限 —— 租约过期满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻),只在 fleet 成员 ∧ 中心宣告 servingLease 能力位时生效;② 排空口 POST /v1/admin/drain 的期限上界 —— deadlineAt 离此刻超过它 ⇒ 400 request.field_invalid,成员与非成员同读;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
-    r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器为多租引擎写;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
+    r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器对每台受管引擎写,缺省 scope 也写;手接的引擎缺席 = 缺省 scope;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
     r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
     r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,引擎默认当家" }),
     r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
@@ -204,7 +206,8 @@ export const CONFIG_CATALOG = [
     r("K8S_MOUNT_PATH", "orchestration", "path", "k8s 工作区挂载路径"),
     r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod namespace"),
     r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
-    r("K8S_SANDBOX_ENV", "orchestration", "secret", "转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进 pod env —— 不进 spec 的其它位置 / 工作区 / 快照 / center / 事件日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
+    r("K8S_SANDBOX_BROKER_IMAGE", "orchestration", "string", "成员 git 凭据代理容器的镜像(k8s 沙箱 pod 的 containers[1],只挂在成员 run 的 pod 上;建议填本引擎自身镜像 —— 代理是本包里固定路径的一只程序,命令固定);不设 ⇒ 成员 git 凭据平面关(GET /v1/capabilities 的 credentialPlane.sandboxGit = broker_image_unset),任何 pod 都不挂代理,pod 形逐字节同不设时;只在 REMOTE_EXEC=k8s 被选中时求值"),
+    r("K8S_SANDBOX_ENV", "orchestration", "secret", `转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进该 pod 自己的 Secret —— pod spec 的容器 env 只带 secretKeyRef 引用、不带值,Secret 随 pod 由集群回收;不进工作区 / 快照 / center / 事件日志;沙箱命名空间的 Role 要 secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")},起服问不许即拒启;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)`, { danger: SEC }),
     r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
     r("K8S_SANDBOX_IPV6", "orchestration", "enum", "k8s 沙箱 pod 的 IPv6:disabled = pod 级 sysctl 关 IPv6(net.ipv6.conf.all / default.disable_ipv6=1;两只都不在 k8s 的 safe sysctl 表里 ⇒ 每个节点 kubelet 要 --allowed-unsafe-sysctls 点名,否则 pod 起不来;沙箱 ns 不能 enforce PodSecurity baseline / restricted);enabled = 不动 pod(pod 保留平台给的 IPv6,只执行 IPv4 的出网策略管不到它,起服自检每次一行 sandbox_egress_policy_gap{kind: ipv6_enabled});词表外拒启", { enumValues: SANDBOX_IPV6_WORDS, staticDefault: SANDBOX_IPV6_DEFAULT, danger: SEC }),
     r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 沙箱 pod 寿命(activeDeadlineSeconds,ms;整只 pod 的泄漏护栏,后台任务超时也被它钳;各条命令的超时见工具超时)"),
@@ -290,9 +293,9 @@ export const CONFIG_CATALOG = [
     r("MODEL_CHEAP_ID", "modelPlane", "string", "cheap 槽模型 id(subagent/summarize 两 role 走它;未设或与 MODEL_ID 同 id=全落主模型,同 id 不铸 cheap 槽)", { danger: BILL, center: cModels("models[].id") }),
     r("MODEL_CHEAP_MAX_TOKENS", "modelPlane", "number", "cheap 槽输出上限", { derivedDefaultNote: "缺席 ⇒ 继承主模型", center: cModels("models[].maxTokens") }),
     r("MODEL_CHEAP_REASONING", "modelPlane", "boolean", "cheap 槽 reasoning 声明(三态:缺席继承主模型)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
-    r("MODEL_CHEAP_VISION", "modelPlane", "boolean", "cheap 槽 vision 声明(三态:缺席继承主模型;text-only cheap 必设 false 让预检真拦)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
+    r("MODEL_CHEAP_VISION", "modelPlane", "boolean", "cheap 槽 vision 声明(三态:缺席继承主模型;text-only cheap 必设 false,引擎才会在替换图片时于会话流发 `model.capability_downgraded`)", { derivedDefaultNote: "缺席 ⇒ 继承主模型" }),
     r("MODEL_CIRCUIT_BREAKER", "modelPlane", "boolean", "模型腿熔断开关", { staticDefault: String(RESILIENCE_DEFAULTS.circuitBreaker.value) }),
-    r("MODEL_CODE_ROLES", "modelPlane", "csv", "给点名 role 附编码 persona(role 表内名字才生效)"),
+    r("MODEL_CODE_ROLES", "modelPlane", "csv", "给点名 role 按词点名引擎的编码角色基底(`promptRole: \"code\"`;role 表内名字才生效)"),
     r("MODEL_CONTEXT_WINDOW", "modelPlane", "number", "主模型上下文窗声明", { staticDefault: "262144", configKey: "model", resolve: (c) => c.model.contextWindow ?? null, center: cModels("models[].contextWindow") }),
     r("MODEL_COST_CACHE_READ", "modelPlane", "number", "主模型 cache-read 单价(per-1M USD;显式 0=声明免费,不是「没配」)", { derivedDefaultNote: "四键全缺席 ⇒ 未定价(不铸 cost 键,成本读面缺席);任一设 ⇒ 四键在场,未设的按 0 显式", danger: BILL, resolve: (c) => c.model.cost?.cacheRead ?? null, center: cModels("models[].cost.cacheRead") }),
     r("MODEL_COST_CACHE_WRITE", "modelPlane", "number", "主模型 cache-write 单价", { derivedDefaultNote: "四键全缺席 ⇒ 未定价(不铸 cost 键,成本读面缺席);任一设 ⇒ 四键在场,未设的按 0 显式", danger: BILL, resolve: (c) => c.model.cost?.cacheWrite ?? null, center: cModels("models[].cost.cacheWrite") }),
@@ -341,8 +344,8 @@ export const CONFIG_CATALOG = [
         },
     }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
-    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(三态:true / false / 缺席 = 未声明;false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", {
-        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.input`(没有 true 缺省);引擎与带图预检都按「收」读(图原样交给模型,不出信号);`GET /v1/models` 该行不带 `vision` 键。要让预检对纯文本模型出信号写 MODEL_VISION=false",
+    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(三态:true / false / 缺席 = 未声明;false = 明说不收图:带图请求的图被换成占位句交给模型,引擎在替换的那一刻于会话流发 `model.capability_downgraded`,每会话每模型一次)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.input`(没有 true 缺省);引擎按「收」读(图原样交给模型,不发 `model.capability_downgraded`);`GET /v1/models` 该行不带 `vision` 键。要让引擎对纯文本模型发该信号写 MODEL_VISION=false",
         resolve: (c) => {
             const v = modelImageInput(c.model);
             return v === "undeclared" ? null : v === "yes";

package/dist/config-types.d.ts

@@ -944,6 +944,10 @@ export interface ServiceConfigFlat {
         /** `K8S_SANDBOX_IPV6`(闭集与缺省的属主 `sandbox-egress-policy.ts`):`disabled` ⇒ 沙箱 pod 级 sysctl 关 IPv6;`enabled` ⇒ pod spec 不带 sysctl。
          *  loader 恒铸;可选只为手搓配置。 */
         sandboxIpv6?: import("./sandbox-egress-policy.js").SandboxIpv6;
+        /** `K8S_SANDBOX_BROKER_IMAGE` — the member git-credential broker container's image (`containers[1]` of a member's sandbox pod; this
+         *  engine's own image is the recommended value — the broker is a program of this package at a fixed path, `broker/constants.ts`). Absent /
+         *  empty ⇒ the plane is off (`credentialPlane.sandboxGit` = `broker_image_unset`) and no pod carries a broker. */
+        brokerImage?: string;
         /** `K8S_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同名同形、同一只解析器、同一只谓词 `allowlistedEnv`,
          *  空串值照带)。只进 pod 容器 env;装配点与包源派生 env 合并一处,显式名单胜。键缺席 = 旋钮未设 / 空串(零转发)。 */
         sandboxEnv?: Record<string, string>;
@@ -1014,6 +1018,11 @@ export interface ServiceConfigFlat {
          *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
          *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
         enrollTokenTtlSec?: number;
+        /** `DEVICE_RELAY_URL` = 设备的**直达入口**:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,运维声明、**逐字**上能力面
+         *  `deviceExecutor.relayUrl`(唯一消费点 `http/routes/capabilities.ts`)。缺席 ⇒ 键缺席 = 设备按本引擎地址 + `deviceExecutor.wsPath` 拨号(既有形)。
+         *  **不派生**:`FLEET_ADVERTISE_ADDRESS` 是对中心公告的地址(内网 pod IP / 容器别名),受众不是用户机器上的设备;从它拼出来的入口对设备多半不可达。
+         *  形门 = ws / wss 绝对地址,无 userinfo / query / fragment、不带凭据形(值逐字上能力面),坏值**拒启**(解析器 `parseDeviceRelayUrlEnv`)。 */
+        relayUrl?: string;
         /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
         supersede?: "stale_only" | "deny";
     } | {

package/dist/config.d.ts

@@ -274,7 +274,7 @@ export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]):
  * core 的每一只 name-keyed policy(`createAllowDenyPolicy` / `createPermissionRulePolicy` /
  * `createApprovalPolicy`)都解 covering 拼法,而 operator 腿的消费者 `createDurableAskPolicy`
  * (`src/approval.ts`)自 core 5.60.1 的谓词根导出到货后,deny/neverAuto/require 三集合也改成
- * 「精确 ∪ covering」(同一只 `namespacedRuleNameCovers`)。于是本函数放行的
+ * 「精确 ∪ covering」(同一只 `ruleNameCovers`)。于是本函数放行的
  * `<ns>__<server>__*` / `<ns>__<server>__<glob>` 在**每一条**腿上都是**真判**,不再是
  * 「放行进 no-op」—— 而那正是 [ref] 病形(`APPROVAL_DENY=mcp__figma__*` 判 allow)的根。
  *

package/dist/config.js

@@ -3,7 +3,7 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -45,7 +45,7 @@ import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
-import { buildHttpUrlRefusal } from "./url-refusal.js";
+import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { anthropicCredentialRefusal, csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
@@ -372,6 +372,30 @@ function parseDeviceEnrollTokenTtlEnv() {
     }
     return Number(raw);
 }
+function credentialLawRewriteOf(href) {
+    const scanned = redactSecrets(href);
+    return scanned === href ? undefined : scanned;
+}
+function parseDeviceRelayUrlEnv() {
+    const raw = process.env.DEVICE_RELAY_URL;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const scheme = /^wss?:\/\//i.exec(raw)?.[0];
+    const asHttp = scheme === undefined ? undefined : `${scheme.length === "wss://".length ? "https" : "http"}://${raw.slice(scheme.length)}`;
+    const flaws = asHttp === undefined ? ["not-ws-url"] : httpUrlFlaws(asHttp, ["userinfo", "query", "fragment"]).map((f) => (f === "not-http-url" ? "not-ws-url" : f));
+    if (flaws.length > 0) {
+        throw new Error(`env DEVICE_RELAY_URL must be an absolute ws:// or wss:// URL with no userinfo, query or fragment (ws(s)://host[:port][/path]) — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
+            `It is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl) as the address devices dial, so it has no room for credentials (devices authenticate by signature). ` +
+            `Leave it unset when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
+    }
+    const href = new URL(raw).href;
+    const credentialScan = credentialLawRewriteOf(href);
+    if (credentialScan !== undefined) {
+        throw new Error(`env DEVICE_RELAY_URL carries something the credential-redaction law recognizes (${credentialScan}) — it is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl), ` +
+            `so it must not carry a token-shaped path segment; keep it to ws(s)://host[:port][/path] (devices authenticate by signature, not by the URL).`);
+    }
+    return raw;
+}
 function parseDevicePreAuthPerRemoteEnv() {
     const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
     if (raw === undefined || raw === "")
@@ -1090,7 +1114,7 @@ function parseModelDomain() {
     }
     const cheapRef = cheapModel ? cheapModel.id : DEFAULT_MODEL_REF;
     const verifierEnv = process.env.MODEL_VERIFIER;
-    const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : DEFAULT_MODEL_REF;
+    const verifierRef = verifierEnv && Object.hasOwn(models, verifierEnv) ? verifierEnv : DEFAULT_MODEL_REF;
     const roles = {
         verifier: verifierRef,
     };
@@ -1105,8 +1129,8 @@ function parseModelDomain() {
             continue;
         roles[role] =
             typeof cur === "string"
-                ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
-                : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
+                ? { model: cur, promptRole: "code" }
+                : { ...cur, promptRole: "code" };
     }
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
@@ -1942,6 +1966,7 @@ function parseOrchestrationDomain(ctx) {
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
                         sandboxIpv6: enumEnv("K8S_SANDBOX_IPV6", SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS),
+                        ...(process.env.K8S_SANDBOX_BROKER_IMAGE ? { brokerImage: process.env.K8S_SANDBOX_BROKER_IMAGE } : {}),
                         ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("K8S_SANDBOX_ENV", singleUserTurnkey)),
                         ...k8sWorkspaceStore(),
                         ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),
@@ -2000,6 +2025,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
+                                                                ...((n) => (n !== undefined ? { relayUrl: n } : {}))(parseDeviceRelayUrlEnv()),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -2241,7 +2267,7 @@ function parseFleetScope(raw) {
     if (raw !== undefined && !ScopeId.safeParse(raw).success) {
         const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
         throw fleetEnvRefusal("scope_invalid", `env ${name}=${JSON.stringify(shown)} is not a scope id: it must be a lowercase slug of letters, digits and inner dashes, 1–64 characters, ` +
-            `not empty. The config renderer sets it on engines that serve a tenant scope; unset it for the default scope ("${fleetScopeOf(undefined)}"). ` +
+            `not empty. The config renderer sets it on every engine it manages (the default scope included); on a hand-wired engine leave it unset for the default scope ("${fleetScopeOf(undefined)}"). ` +
             `Refusing to boot rather than answering drain requests under the wrong identity.`);
     }
     return fleetScopeOf(raw);
@@ -2330,8 +2356,8 @@ function parseA2aServe() {
             `inbound authentication on this endpoint is header-shaped (a service credential), not URL-embedded.`);
     }
     const parsed = new URL(rawUrl);
-    const a2aCredentialScan = redactSecrets(parsed.href);
-    if (a2aCredentialScan !== parsed.href) {
+    const a2aCredentialScan = credentialLawRewriteOf(parsed.href);
+    if (a2aCredentialScan !== undefined) {
         throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aCredentialScan}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
             `so it must not carry credentials of ANY shape: no userinfo, no credential-named query parameter (api_key/token/…), no token-shaped path segment or parameter value. ` +
             `Keep A2A_SERVE_URL to scheme://host[:port][/path] and move the secret into the caller's headers.`);

package/dist/deployment-governance.d.ts

@@ -103,8 +103,8 @@ export interface AbsentApprovalSeat {
  * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
  * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
  * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 工具名取 `approval-content-kind.ts` 的单一属主(它 re-export core 根导出的 `ASK_USER_QUESTION_TOOL_NAME`);
- * server.ts 的 pre-CAS 守卫读同一枚([ref]①:此处旧注称该常量「core 未根导出」= 失实,曾据此手抄 13 处)。
+ * 「是不是引擎的问题工具」不在本层判:core 7.56.0 [ref] 起本门**组合** core 原形的答(它读调用的脸 —— 引擎挂载点 + 目录契约 id,不读名字;
+ * 它答 `ask` ⇒ 是;本层只在那之上按活流分腿)。决断口的 pre-CAS 守卫(「批准问答必须带答」)仍按保留名读(core 同版「Not changed here」那一条)。
  * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
  * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
  * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)

package/dist/deployment-governance.js

@@ -1,18 +1,16 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
-import { heldRuleName } from "./tool-rule-names.js";
 export function createDurableQuestionGate(live) {
+    const durable = createDurableQuestionPolicy();
     if (live === undefined)
-        return createDurableQuestionPolicy();
+        return durable;
     return {
-        check(req) {
-            if (heldRuleName(req, (n) => n === ASK_USER_QUESTION_TOOL_NAME) === undefined)
-                return { action: "allow" };
-            return live.hasLiveContext()
-                ? { action: "allow" }
-                : { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };
+        async check(req) {
+            const answer = await durable.check(req);
+            if (answer.action !== "ask")
+                return answer;
+            return live.hasLiveContext() ? { action: "allow" } : answer;
         },
     };
 }

package/dist/device-ws-protocol.d.ts

@@ -74,6 +74,7 @@ export declare function asInstructionKind(v: string): DeviceInstructionKind | nu
 export declare const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION: {
     readonly 1: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
     readonly 2: readonly ["liveness_no_output"];
+    readonly 3: readonly ["name_too_long"];
 };
 /** 本包认得的协议修订号(= 增量表的行键)。 */
 export type DeviceProtocolRevision = keyof typeof DEVICE_OUTCOME_ERROR_CODES_BY_REVISION;

package/dist/device-ws-protocol.js

@@ -1,7 +1,7 @@
 import { createPublicKey, randomBytes, randomInt, verify as edVerify } from "node:crypto";
 import { MAX_TIMER_DELAY_MS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
 export const DEVICE_WS_PATH = "/v1/device/ws";
-export const DEVICE_PROTOCOL_VERSION = 2;
+export const DEVICE_PROTOCOL_VERSION = 3;
 export const DEVICE_MIN_PROTOCOL_VERSION = 1;
 export const DEVICE_HELLO_DOMAIN_TAG = "sema.device.hello.v1";
 export const DEVICE_WS_LIMITS = {
@@ -66,6 +66,7 @@ export const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION = {
         "unknown",
     ],
     2: ["liveness_no_output"],
+    3: ["name_too_long"],
 };
 export function deviceOutcomeErrorCodesAt(revision) {
     if (!Number.isInteger(revision) || revision < 1 || revision > DEVICE_PROTOCOL_VERSION) {

package/dist/file-history-disclosure.d.ts

@@ -25,7 +25,8 @@
  * · **判断面**(同一只函数的 `fault`,core 7.55.0 `FileHistoryError.permanence`):永久码表里的 typed 码 ⇒
  *   `{ permanence: "terminal" }`;**连接类故障**(到库的连接坏了 / 库此刻不接 —— 判官是整仓唯一一只
  *   `plugins/store-fault.ts` 的 `storeFaultClassOf`,识别表在 `plugins/sql-errors.ts`,本文件不再抄第二份)⇒
- *   `{ permanence: "transient" }`;其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。`terminal` 只对永久码。
+ *   `{ permanence: "transient" }`;**部署错配类**(缺表 / 权限拒:连接是好的、重试注定失败,修表 / 授权之前什么都不会变 —— 同一只判官的 `deployment` 一词,表在 `plugins/sql-errors.ts`)⇒
+ *   `{ permanence: "terminal" }`;其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。`terminal` 只对永久码与部署错配类。
  *   折点把它摊进店答的 `FileHistoryError`;引擎的拒句引导语、rewind 披露、`terminal.detail` 都读这一格,**不读散文**。
  * · **机器面**(同一只函数的副作用):码取自 typed 错**对象**、对闭集词表判定,**绝不从散文里抠**。
  *   🔴 这一条是 codex R1-[high] 验真后的定形:文本通道**天然可伪造** —— 一个名叫
@@ -54,7 +55,8 @@ export interface CaughtFailure {
  * `text` = 散文形:带 typed `code` 的前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
  * 不带的**逐字**是原 message(transient 失败的文案因此与本批之前一字不差)。
  * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;连接类故障 ⇒ `{ permanence: "transient" }`
- * (什么都不改稍后再试可能成);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。永久码先于连接类判(一只错不会两个都是)。
+ * (什么都不改稍后再试可能成);部署错配类故障 ⇒ `{ permanence: "terminal" }`(修表 / 授权之前重试注定失败);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。
+ * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`,本文件不写码。
  * 副作用 = 机器形:码取自错误对象,逐次计数 + 每进程每码一条 warn。观测绝不抛。
  */
 export declare function foldCaughtFailure(err: unknown): CaughtFailure;