@sema-agent/server 7.136.0 → 7.138.0

package/dist/plugins/tool-result-store-sql.js

@@ -1,7 +1,7 @@
 import { MAX_MINTED_TOOL_RESULT_REF_CHARS, assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance } from "@sema-agent/core";
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { MANAGED_RETENTION } from "./retention-store-sql.js";
+import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "./retention-store-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
@@ -49,9 +49,10 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
 }
 export class SqlToolResultStore {
     db;
-    retention = MANAGED_RETENTION;
-    constructor(db) {
+    retention;
+    constructor(db, opts = {}) {
         this.db = db;
+        this.retention = opts.retention ?? UNMANAGED_RETENTION;
     }
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
@@ -128,13 +129,13 @@ export class SqlToolResultStore {
     }
 }
 export class TiDBToolResultStore extends SqlToolResultStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, opts) {
+        super(mysqlDriver(pool), opts);
     }
 }
 export class PgToolResultStore extends SqlToolResultStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, opts) {
+        super(pgDriver(pool), opts);
     }
 }
 //# sourceMappingURL=tool-result-store-sql.js.map

package/dist/plugins/worktree-isolation.d.ts

@@ -54,8 +54,9 @@ export declare function withWorktreeIsolation(baseFactory: ExecutionEnvFactory,
  * post-kill Runner hook). NEVER throws (a prune failure is logged, never fatal).
  *
  * NOTE: `git worktree prune` only deregisters worktrees whose DIRECTORY is missing. A crashed run that left
- * the dir intact is NOT reaped by prune alone — that is acceptable for v1 (the worktree lives under the known
- * `.sema-worktrees/` parent and is human-/script-reapable; a stricter age-based sweep is a follow-on).
+ * the dir intact is NOT reaped by prune alone — that is acceptable for v1 (the worktree lives under core's known
+ * managed parent `<repoRoot>/<WORKTREE_PARENT>/` on its own `sema/<name>` branch and is human-/script-reapable;
+ * a stricter age-based sweep is a follow-on).
  */
 export declare function reapOrphanWorktrees(baseEnvForGit: ExecutionEnv, repoRoot: string, logger?: WorktreeIsolationLogger): Promise<void>;
 //# sourceMappingURL=worktree-isolation.d.ts.map

package/dist/plugins/worktree-isolation.js

@@ -31,7 +31,7 @@ export function withWorktreeIsolation(baseFactory, opts) {
             return baseFactory(ctx);
         }
         let innerDestroy;
-        const { env, worktreeDir } = await serialize(() => addWorktree(opts.baseEnvForGit, {
+        const { env, worktreeDir, baseSha } = await serialize(() => addWorktree(opts.baseEnvForGit, {
             repoRoot,
             sessionId: ctx.sessionId,
             rootEnvAt: async (dir) => {
@@ -43,12 +43,6 @@ export function withWorktreeIsolation(baseFactory, opts) {
             },
             ...(opts.commit ? { commit: opts.commit } : {}),
         }));
-        let baseSha;
-        {
-            const r = await opts.baseEnvForGit.exec("git rev-parse HEAD", { cwd: worktreeDir });
-            if (r.ok && r.value.exitCode === 0)
-                baseSha = r.value.stdout.trim();
-        }
         const isChanged = async () => {
             const status = await opts.baseEnvForGit.exec("git status --porcelain", { cwd: worktreeDir });
             if (!status.ok || status.value.exitCode !== 0)

package/dist/project-identity.d.ts

@@ -4,19 +4,6 @@ import { type ProjectLayerIdentity } from "./project-layer-key.js";
 export type { MemoryProjectKey };
 /** 本仓会说的缺席词。`not_git` 刻意排除:裁 D 起非 git 目录按目录键控,不是缺席(core 闭集仍收它,本仓不铸)。 */
 export type ProjectIdentityAbsentReason = Exclude<MemoryProjectKeyAbsentReason, "not_git">;
-/** 一个任务根的项目身份:canonical 项目根,或说得出理由的缺席。 */
-export type ProjectIdentity = {
-    readonly root: string;
-} | {
-    readonly absent: ProjectIdentityAbsentReason;
-};
-/**
- * 任务根 → 项目身份([ref] 四例;见文件头)。纯文件系统读,零子进程。
- * `taskRoot` 必须是**本进程读得到**的路径(调用方按车道判:根在沙箱/设备盘上就别调,直接给 `unreadable`)。
- *
- * 一次向上走,规则三条按优先序:最近的 `.git`(① ② ③)> 链上最近的裸仓布局(④ bare)> 非 git 按目录键控(④)。
- */
-export declare function resolveProjectIdentity(taskRoot: string): ProjectIdentity;
 /**
  * 退役 `repo:` 键的**唯一**铸点([ref] ①:`repo:` + sha256 hex 前 24;`root` 为 realpath 字符串,不加尾斜杠、不折大小写)。
  * [ref] 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
@@ -39,7 +26,7 @@ export declare function assertProjectLayerOwnable(scope: string, envName: string
 export declare function normalizeGitRemoteUrl(url: string): string | undefined;
 /**
  * 任务根 → 项目层身份([ref]):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
- * 缺席形与 {@link resolveProjectIdentity} 同;git 配置在而读不了 ⇒ `unreadable`。
+ * 缺席形 = 找根的缺席词(`bare` / `unreadable`);git 配置在而读不了 ⇒ `unreadable`。
  */
 export declare function projectLayerIdentityOf(taskRoot: string): {
     readonly root: string;

package/dist/project-identity.js

@@ -87,10 +87,6 @@ function canonicalTaskRoot(taskRoot) {
         p = parent;
     }
 }
-export function resolveProjectIdentity(taskRoot) {
-    const located = locateProject(taskRoot);
-    return "root" in located ? { root: located.root } : located;
-}
 function locateProject(taskRoot) {
     const root = canonicalTaskRoot(taskRoot);
     if (root === "unreadable")

package/dist/request-key-closure.js

@@ -26,7 +26,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
-    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",

package/dist/request-value-closure.d.ts

@@ -118,7 +118,36 @@ export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
 export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
 /** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
 export declare const INHERIT_ENV_VALUE_MESSAGE: string;
-/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
-export declare function inheritEnvFieldIssue(raw: unknown): string | null;
+/**
+ * `inheritEnv` 的 `request.field_invalid` 400 的机读 `reason`([ref];闭集,**一种拒因一个词**,读者穷举读)—— 拒体另带 `field: "inheritEnv"` 与它,
+ * 壳靠这两位认「这条 400 真是 `inheritEnv` 的」,不猜句子。同一个键的**三只** 400 是一类,词表一张:
+ *  · `unknown_word` —— 值形:是字符串,但不在受理词表(`"ALL"` · `"everything"` · `""`);
+ *  · `not_a_string` —— 值形:根本不是字符串(名单形 `string[]` · 布尔 · 数字 · `null` · 对象);
+ *  · `lane_not_host` —— `"all"` 落在非 host 车道(只有 host 工厂消费这一位,别的车道没有消费点);
+ *  · `no_authorizer_session` —— `"all"` 而部署不接 authorizer(绑定按会话键控,没有会话就没有地方兑现)。
+ * 前两词的判官是 {@link inheritEnvFieldIssue}(只看体);后两词的判官在 `boot/resolve-spec.ts`(要读部署事实,两腿同过)。
+ * 不在这组的:`422 request.host_posture_refused`(托管部署不兑现 `"all"`)—— 那不是这个键的值写错,而是部署姿态拒,码与写容纳面那条腿共用,按 `errorCode` 认(契约 §18)。
+ * 加一种拒因 ⇒ 这里加一个词(并在判官处给它一个分支);词与因一一对应,没有一因两词、也没有一词两因。
+ * 词的铸点只有 {@link inheritEnvFacts} 一处:受理门与 resolveSpec 只经它出机读位,不手拼 `field` / `reason`。
+ */
+export declare const INHERIT_ENV_REFUSAL_REASONS: readonly ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export type InheritEnvRefusalReason = (typeof INHERIT_ENV_REFUSAL_REASONS)[number];
+/** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用;型别名而不是接口 —— 要能直接当 `Record<string, unknown>` 用)。 */
+export type InheritEnvFacts = {
+    readonly field: "inheritEnv";
+    readonly reason: InheritEnvRefusalReason;
+};
+/** `inheritEnv` 机读位的**唯一铸点**:`field` 恒为键名,`reason` 是 {@link INHERIT_ENV_REFUSAL_REASONS} 里的词。 */
+export declare function inheritEnvFacts(reason: InheritEnvRefusalReason): InheritEnvFacts;
+/** 一次值形裁决的产物:wire 句 + 机读位。 */
+export interface InheritEnvFieldIssue {
+    readonly message: string;
+    readonly facts: InheritEnvFacts;
+}
+/**
+ * `inheritEnv` 在场且不在词表里 ⇒ 拒(句 + 机读位);缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**,判据与句子在这一处,机读位经 {@link inheritEnvFacts}。
+ * 句子对两种坏值形是同一句(点名两词与「名单不是请求值」);`reason` 区分它们。
+ */
+export declare function inheritEnvFieldIssue(raw: unknown): InheritEnvFieldIssue | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -37,12 +37,18 @@ export const INHERIT_ENV_WORDS = ["all", "scrub"];
 export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
     `("all" = the model-driven host shell inherits this machine's whole environment except this deployment's own credentials (its configuration directory's secret-typed names), honored only on a single-user host-lane deployment; ` +
     `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export const INHERIT_ENV_REFUSAL_REASONS = ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export function inheritEnvFacts(reason) {
+    return { field: "inheritEnv", reason };
+}
 export function inheritEnvFieldIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
         return null;
     const value = raw.inheritEnv;
     if (value === undefined)
         return null;
-    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+    if (INHERIT_ENV_WORDS.includes(value))
+        return null;
+    return { message: INHERIT_ENV_VALUE_MESSAGE, facts: inheritEnvFacts(typeof value === "string" ? "unknown_word" : "not_a_string") };
 }
 //# sourceMappingURL=request-value-closure.js.map

package/dist/rule-entry-list.d.ts

@@ -26,7 +26,7 @@
  *     (拒面按 ③ 的方向分),拒句点名有界({@link MAX_NAMED_INERT_ENTRIES} 条 + 计数),清单先过条数帽({@link inertToolListEntryOf})。
  *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
- *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
+ *     `*` 在放行侧是「本层不设名单」、在限制侧是整名 glob(引擎文法 5,7.137.0 起;此前读成空、受理口拒);限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
  *     `compileAllowList(…, "deny", 名册)` 把它们读成这一协议的每一只工具),本仓不另写豁免。
  *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
  *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
@@ -55,7 +55,8 @@ export declare function allowLayerEntryCountIssue(field: string, list: readonly
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /**
- * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己)。条目名过引擎判官,
+ * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎文法 5,core 7.56.0:allow 表里名内的 `*` 只在协议名的工具段里读,别处的 `*` 只作废它自己、旁边的条目照读;
+ *    deny / ask 表里带 `*` 的名是整名 glob,不读空)。条目名过引擎判官,
  * 名册是本仓**唯一**的一张({@link TOOL_NAME_ROSTER},`namespaced-rule-name.ts`:引擎目录 ∪ 本仓自铸的工具名)—— 两个方向、每一处读条目名的地方(请求体的规则表、技能清单、选择器清单、
  * 运维 / 中心的审批名单)传同一张,没有「这一处空名册、那一处带名册」的两种读法。工具名选择器清单另走 {@link inertToolListEntryOf}。
  */

package/dist/rule-entry-list.js

@@ -27,9 +27,9 @@ export function inertRuleEntryGuidance(i) {
         case "near_miss":
             return `the tool name differs from a mounted tool only by case${write}`;
         case "wildcard_all":
-            return "`*` names no tool (on an allow list it voids the whole list) — name the tools instead";
+            return "`*` grants nothing on an allow list (the entries beside it still apply) — name the tools instead; on a deny or ask list `*` is every tool";
         case "namespace_wildcard":
-            return "a server segment takes no partial wildcard (`mcp__git*`) — name the server: mcp__<server> or mcp__<server>__*; a deny or ask list may write mcp__* for every MCP tool";
+            return "an allow list reads a `*` only in a protocol name's tool segment — name the server: mcp__<server> or mcp__<server>__*; on a deny or ask list a `*` in a name is a glob over the whole name (mcp__* is every MCP tool, mcp__git* every tool whose name starts with it)";
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":

package/dist/rules-consent.js

@@ -5,7 +5,7 @@ import { createLogger } from "./observability/logger.js";
 import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, readRuleOwner, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -70,21 +70,24 @@ export function sameWireRuleIdentity(row, identity) {
 function storeForBucket(provider, ref) {
     if (typeof ref === "string")
         return provider.forPrincipal(ref);
-    switch (ref.kind) {
+    const owner = readRuleOwner(ref);
+    if (owner === undefined)
+        throw new Error("unrecognised permission-rule bucket reference (not a plain owner record, an unknown kind, or a principal that is no principal name) — refusing to guess which bucket it names");
+    switch (owner.kind) {
         case "principal":
-            return provider.forPrincipal(ref.principal);
+            return provider.forPrincipal(owner.principal);
         case "local-owner":
             if (provider.forLocalOwner === undefined) {
                 throw new Error("this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be listed or removed through it");
             }
             return provider.forLocalOwner();
         default: {
-            const unknown = ref;
+            const unknown = owner;
             throw new Error(`unrecognised permission-rule bucket reference (${JSON.stringify(unknown)}) — refusing to guess which bucket it names`);
         }
     }
 }
-function isSupportedRuleMatch(match) {
+function isCommandRuleMatch(match) {
     switch (match) {
         case "exact":
         case "prefix":
@@ -101,6 +104,8 @@ function isSupportedRuleMatch(match) {
         case "host":
         case "subdomain":
             return false;
+        case "tool":
+            return false;
         default: {
             const unknown = match;
             void unknown;
@@ -202,7 +207,7 @@ function screenLocalImportRow(row) {
     const written = parseRuleText(row.rule, row.behavior);
     if ("reject" in written)
         return { reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
-    if (ruleToolGrammarOf(written.rule.tool) !== "command")
+    if (!isCommandRuleMatch(written.rule.match))
         return consistent(written.rule);
     if (written.rule.behavior !== "allow") {
         if (!ruleReachesProgramRun(written.rule, row.command)) {
@@ -351,7 +356,7 @@ export function createRuleConsentLane(stores, opts) {
                 if ("reject" in canonical) {
                     return { ok: false, reason: "edit-rejected", detail: `the canonical spelling the engine minted does not re-parse: ${canonical.reject.message}` };
                 }
-                if (!isSupportedRuleMatch(canonical.rule.match)) {
+                if (!isCommandRuleMatch(canonical.rule.match)) {
                     return { ok: false, reason: "edit-rejected", detail: `the edited rule resolves to an unsupported match form (${String(canonical.rule.match)})` };
                 }
                 ticket = minted.ticket;

package/dist/run-local.d.ts

@@ -174,8 +174,8 @@ type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
  *  · `shell_floor`:shell 地板被抬到 always —— `AUTONOMY=ask`(`autonomyOverrides`)与 `MANUAL_MODE_SHELL_GATE=always`,真 Runner 读数两者的类集都是 `[shell_floor]`(**不是** `operator_forced`):
  *    单独一句,不与 `operator_forced` 的来源混在一起 —— 混说会把 `APPROVAL_NEVER_AUTO` 的问指到一定没设的 `AUTONOMY`;
  *  · 其余:引擎自己的问(写门 / 形状层 / 写保护 / 探针 / 钩子 / 组织规则 / 引擎的守卫 / 工具标记 …)没有一只本部署旋钮能放行 —— 只说去终端答。
- *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」「run with `permissionMode: "bypassPermissions"`」),
- *    而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
+ *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」;core 7.56.0 [ref] 起它不再教模式放行,
+ *    那一条出路只作数据骑在通告的 `detail.remedies` 上),而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
  *
  * `autoBudgetReleases`:`APPROVAL_AUTO_BUDGET` 能放行这类问吗(读 `createDurableAskPolicy` 的预算臂:只放行**没进 `APPROVAL_NEVER_AUTO`、耐久资源没耗尽**的
  * `APPROVAL_REQUIRE` 命中,换成一句带理由的 allow)。按 `classes` **整体**读:集里每一类都放得行才建议预算 —— 折叠了别的类(`operator_forced` 等)说明另一层的问仍在,

package/dist/run-local.js

@@ -45,14 +45,16 @@ import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
 import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
+import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createPeerDesk } from "./peer-seat.js";
 import { createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
-import { assertDeploymentModsAdmitted, createDeploymentMods } from "./boot/deployment-mods.js";
+import { assembleDeploymentMods } from "./boot/deployment-mods.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { fatalExit } from "./boot/fatal-exit.js";
@@ -121,7 +123,7 @@ export function missingGatewayRequirements(config) {
     if (config.gatewayBaseUrl === undefined)
         return missing;
     const perModelEnvs = Object.values(config.modelApiKeyEnv ?? {});
-    const haveGatewayKey = !!config.gatewayApiKey;
+    const haveGatewayKey = declaredCredential(config.gatewayApiKey) !== undefined;
     const catalogModelNames = new Set(Object.values(config.models ?? {}).map((m) => m.name));
     const allModelsHaveOwnKey = catalogModelNames.size > 0 &&
         [...catalogModelNames].every((n) => {
@@ -164,6 +166,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     shell_floor: { remedy: "shell_gate", autoBudgetReleases: false },
     target_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
     probe: { remedy: "terminal_only", autoBudgetReleases: false },
+    write_protection_on_disk: { remedy: "terminal_only", autoBudgetReleases: false },
     write_protection: { remedy: "terminal_only", autoBudgetReleases: false },
     tool_marks_mcp: { remedy: "terminal_only", autoBudgetReleases: false },
     tool_marks_a2a: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -363,6 +366,8 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const configProvider = createConfigProvider(providerInput);
+    const peerDesk = createPeerDesk({ log: logger });
+    const rosterLease = peerDesk.lease("roster");
     let effective;
     let candidatePrompts;
     let applying = false;
@@ -387,9 +392,9 @@ export async function runLocal(argv, deps = {}) {
                 effective = r.effective;
                 candidatePrompts = verdict.prompts;
                 if (effective?.mcp)
-                    config.mcpServers = resolveMcpServers(effective.mcp, logger);
+                    config.mcpServers = resolveMcpServers(effective.mcp, peerDesk, rosterLease, logger);
                 if (effective?.a2a)
-                    config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
+                    config.a2aPeers = resolveA2aPeers(effective.a2a, peerDesk, rosterLease, logger);
                 applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
                 logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
             }
@@ -576,9 +581,9 @@ export async function runLocal(argv, deps = {}) {
             { name: "checkpointStore", store: fileBackend.checkpointStore },
             { name: "toolResultStore", store: fileBackend.toolResultStore },
         ],
+        retentionExecutor: null,
     });
-    const deploymentMods = createDeploymentMods({ metrics, brandIdentity: true });
-    await assertDeploymentModsAdmitted(deploymentMods);
+    const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
@@ -603,6 +608,7 @@ export async function runLocal(argv, deps = {}) {
         orgMemoryAdmission,
         sharedMemoryStores: undefined,
         mcpRevocations: undefined,
+        peerDesk,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,

package/dist/runs.d.ts

@@ -11,6 +11,7 @@ import { type ApprovalFrameFamily, type ToolApprovalCoordinator } from "./tool-a
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { RunAcceptance } from "./run-acceptance.js";
+import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
@@ -374,7 +375,12 @@ userInputLedger?: UserInputLedger,
  * 这次提交的受理座(`src/run-acceptance.ts`):标题器只在引擎受理之后起。普通流形逐帧喂;只回结果的 verify / cascade 形(以及终局写口的
  * 重试腿)终局落行之后收尾一次。缺席 ⇒ 不起标题(起标题此前由路由层在建行时做)。
  */
-acceptance?: RunAcceptance): Promise<void>;
+acceptance?: RunAcceptance, 
+/**
+ * 会话行的位置与项目那一格的记录座(`session-workspace.ts`;唯一写者):普通流形逐帧喂(这条腿自己的 `workspace_changed` 排一次写),
+ * `done` 时等写落定再落终局。只回结果的 verify / cascade 形宿主手里没有流 ⇒ 不记。缺席 ⇒ 不记行(与本参数存在之前逐字相同)。
+ */
+workspaceRecorder?: SessionWorkspaceRecorder): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -7,6 +7,7 @@ import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { withModelReachScope } from "./model-reach-scope.js";
+import { runSkillsOf } from "./capabilities/skills.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
@@ -83,6 +84,10 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.legacy_tool_name": 400,
     "config.memory_capture_unsupported": 409,
     "prompt.assembled_role_refused": 400,
+    "config.project_id_invalid": 400,
+    "config.project_identity_mismatch": 409,
+    "config.memory_project_marker": 409,
+    "config.memory_project_marker_nested": 409,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -252,7 +257,7 @@ export async function graftParkToolCallId(result, cs) {
     const id = await parkToolCallId(result, cs);
     return id === undefined ? result : { ...result, toolCallId: id };
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger, acceptance) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -330,7 +335,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         metrics?.inc("tasks_total", { status: "needs_review" });
     };
     const instructionLeg = createInstructionSelectionLeg();
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), instructionsSegment: instructionLeg.segment });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(spec) }) });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);
@@ -452,6 +457,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 fleetPublisher?.onEvent(ev);
                 await userInputLedger?.observeLegEvent(stream, ev);
                 acceptance?.observe(ev);
+                await workspaceRecorder?.observe(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
                     case "text_delta":

package/dist/runtime-governance.d.ts

@@ -65,9 +65,9 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only.
  *
  * 🔴 **[ref]:返回叶,不在这里折**(改名自 `compileCommandPolicy`,修前返回 blocklist 形里 `combinePolicies(coarseDeny, askList)` 的
- * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠带出 `foldedAskClasses`,而治理层随后要给每只
- * ask 盖部署出身 —— 盖在折叠的输出上就是展开一只 core 担保过身份的对象(core [ref] 7.39.0 按名拒)。叶交出去,由
- * {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
+ * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠把落选者的类记进引擎的认证记录(core 7.56.0:
+ * `attestation.foldedClasses`;7.39.0–7.48.x 是对象身份担保的 `foldedAskClasses` 成员,副本被按名拒;7.49.0 [ref] 起带引擎记录的副本照收),而治理层要给每只 ask 盖部署出身。
+ * 叶交出去,由 {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
  *
  * 🔴 **[ref]:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
@@ -271,8 +271,8 @@ export declare function governanceOriginOf(gate: {
  *
  * 🔴 **[ref](core [ref] 7.39.0)—— 治理层只有一个折叠点**:两种输入都交**叶**(`compileCommandPolicyLayers` 的那几只、
  * `sensitivePathLayers` 的那几只),本函数对每一片叶各盖一次部署出身(`createDeploymentAuthoredPolicy`),再交 core
- * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——折叠带出
- * `foldedAskClasses` 时交给 core 的是副本,7.39.0 起按名拒(工具不跑、无卡)。
+ * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——7.39.0–7.48.x 上折叠带出
+ * `foldedAskClasses` 时交给 core 的是副本,被按名拒(工具不跑、无卡);core 7.56.0 起那一成员退役、落选者的类骑在 `attestation` 记录上。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;

package/dist/sandbox-git-lease.d.ts

@@ -0,0 +1,49 @@
+/** Why an entry is withdrawn — the server's own words (closed set; the vault's per-origin and whole-answer words join it with the plane's renewal). */
+export type SandboxLeaseWithdrawReason = "center_unavailable" | "insecure_transport";
+/** The sentence kinds an entry carries: a withdrawal reason, or the `ready` entry's "the git host refused the credential". */
+export type SandboxLeaseSentenceKind = SandboxLeaseWithdrawReason | "credential_rejected";
+/** What git shows for an entry (single line, no credential, names the origin and the way out). */
+export declare function sandboxLeaseSentence(kind: SandboxLeaseSentenceKind, origin: string): string;
+/** One origin's lease as the server decides it (the writer supplies `i`, `origin`, `leaseId` and the sentences). */
+export type SandboxLeaseEntryInput = {
+    readonly state: "ready";
+    readonly username: string;
+    readonly secret: string;
+    readonly credentialId: string;
+    readonly version: number;
+    readonly ttlMs: number;
+} | {
+    readonly state: "withdrawn";
+    readonly reason: SandboxLeaseWithdrawReason;
+};
+/**
+ * The lease file text for a pod whose origin table is `origins` (one input per origin, same order). Refused (never sent) when the broker
+ * would refuse it: an input count that is not the table's, a `ready` input for an http origin, `ttlMs` outside (0, 300 000], a malformed
+ * value. The refusal names the entry and the rule, never a value.
+ */
+export declare function buildSandboxLeaseFile(origins: readonly string[], entries: readonly SandboxLeaseEntryInput[], mintLeaseId?: () => string): {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    problem: string;
+};
+/** The lease a pod starts with, before the first answer from the vault: every entry withdrawn (https ⇒ `center_unavailable`, http ⇒ `insecure_transport`). */
+export declare function placeholderLeaseEntries(origins: readonly string[]): SandboxLeaseEntryInput[];
+/**
+ * The lease time of one vault answer: `min(cacheUntil, expiresAt ?? cacheUntil) − answeredAt − rttMs`, capped at the broker's ceiling,
+ * at least 1; `undefined` when that is ≤ 0 or any reading is not a finite number (the entry is then written `withdrawn`). The three times are
+ * the vault's own clock; `rttMs` is this server's monotonic measure of the request it sent and the answer it got.
+ */
+export declare function sandboxLeaseTtlMs(answer: {
+    readonly answeredAt: number;
+    readonly cacheUntil: number;
+    readonly expiresAt: number | null;
+}, rttMs: number): number | undefined;
+/**
+ * The agent container's git routes (non-secret env): one `url.<broker route>.insteadOf = <origin>/` triplet per origin, in the pod's
+ * origin-table order — git then sends `<origin>/<owner>/<repo>/…` to the broker's loopback route `/o/<i>/…` (http origins too: they are
+ * forwarded without a credential and answered with their sentence).
+ */
+export declare function sandboxGitRouteEnv(origins: readonly string[]): Record<string, string>;
+//# sourceMappingURL=sandbox-git-lease.d.ts.map

package/dist/sandbox-git-lease.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { BROKER_HOST, BROKER_PORT } from "./broker/constants.js";
+import { LEASE_TTL_MAX_MS, parseLeaseFile, serializeLeaseFile } from "./broker/lease-file.js";
+export function sandboxLeaseSentence(kind, origin) {
+    switch (kind) {
+        case "center_unavailable":
+            return `your git credential for ${origin} is not available right now (the console could not be reached); retry shortly, and do not paste a token into the conversation`;
+        case "insecure_transport":
+            return `${origin} is served over plain http, so member credentials are never sent to it; ask the operator to serve it over https`;
+        case "credential_rejected":
+            return `${origin} rejected your git credential; reconnect it in the console, then retry`;
+    }
+}
+export function buildSandboxLeaseFile(origins, entries, mintLeaseId = () => `l_${randomUUID()}`) {
+    if (entries.length !== origins.length)
+        return { ok: false, problem: `the lease has ${entries.length} entries for a pod routed to ${origins.length} origins` };
+    const file = {
+        v: 1,
+        origins: entries.map((e, i) => {
+            const origin = origins[i];
+            return e.state === "ready"
+                ? {
+                    i,
+                    origin,
+                    state: "ready",
+                    leaseId: mintLeaseId(),
+                    ttlMs: e.ttlMs,
+                    username: e.username,
+                    secret: e.secret,
+                    credentialId: e.credentialId,
+                    version: e.version,
+                    unusableMessage: sandboxLeaseSentence("center_unavailable", origin),
+                    rejectedMessage: sandboxLeaseSentence("credential_rejected", origin),
+                }
+                : { i, origin, state: "withdrawn", reason: e.reason, unusableMessage: sandboxLeaseSentence(e.reason, origin) };
+        }),
+    };
+    const text = serializeLeaseFile(file);
+    const judged = parseLeaseFile(text);
+    return judged.ok ? { ok: true, text } : { ok: false, problem: judged.problem };
+}
+export function placeholderLeaseEntries(origins) {
+    return origins.map((o) => ({ state: "withdrawn", reason: o.startsWith("https://") ? "center_unavailable" : "insecure_transport" }));
+}
+export function sandboxLeaseTtlMs(answer, rttMs) {
+    const until = answer.expiresAt === null ? answer.cacheUntil : Math.min(answer.cacheUntil, answer.expiresAt);
+    const ms = until - answer.answeredAt - rttMs;
+    if (!Number.isFinite(ms) || ms <= 0)
+        return undefined;
+    return Math.max(1, Math.min(LEASE_TTL_MAX_MS, Math.floor(ms)));
+}
+export function sandboxGitRouteEnv(origins) {
+    const env = { GIT_CONFIG_COUNT: String(origins.length) };
+    origins.forEach((origin, i) => {
+        env[`GIT_CONFIG_KEY_${i}`] = `url.http://${BROKER_HOST}:${BROKER_PORT}/o/${i}/.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${i}`] = `${origin}/`;
+    });
+    return env;
+}
+//# sourceMappingURL=sandbox-git-lease.js.map