@sema-agent/server 7.137.0 → 7.138.0

package/dist/capabilities/mcp-probe.js

@@ -4,7 +4,8 @@ import { createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { canonicalJsonStringify } from "@sema-agent/core";
 import { keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
 import { requestMcpDeclarationRefusal, validateRequestMcp } from "../task-mcp.js";
-import { specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "../mcp-assertion-header.js";
+import { specWithholdsMcpAssertionHeader, toMcpDraft } from "../mcp-assertion-header.js";
+import { mintDeclaration } from "../peer-seat.js";
 import { projectWiringManifestMcpRows } from "../trace/project.js";
 import { buildBoundedToolNames } from "../panel-tool-names.js";
 export const MCP_PROBE_REFUSAL_CODES = [
@@ -80,13 +81,26 @@ export function readMcpProbeBody(raw) {
                 "Probe the entry without the key to see how the server answers without it"),
         };
     }
-    return { ok: true, specs: validated.ok.map(toCoreMcpServerSpec) };
+    return { ok: true, drafts: validated.ok.map(toMcpDraft) };
 }
 export function buildMcpProbeIdentity(principal) {
     return principal !== undefined && principal.length > 0 ? principal : "local";
 }
-export function buildMcpProbeCacheKey(principal, specs) {
-    return `${buildMcpProbeIdentity(principal)}::${createHash("sha256").update(canonicalJsonStringify(specs), "utf8").digest("hex")}`;
+export function countMcpProbeDeclarations(input) {
+    switch (input.declaredBy) {
+        case "deployment":
+            return input.specs.length;
+        case "caller":
+            return input.drafts.length;
+        default: {
+            const unknownArm = input;
+            void unknownArm;
+            throw new Error("mcp probe: an input arm this module does not know (the arm set is closed: deployment / caller)");
+        }
+    }
+}
+export function buildMcpProbeCacheKey(principal, input) {
+    return `${buildMcpProbeIdentity(principal)}::${createHash("sha256").update(canonicalJsonStringify(input), "utf8").digest("hex")}`;
 }
 export function buildMcpProbeRateKey(principal) {
     return `mcp-probe:${buildMcpProbeIdentity(principal)}`;
@@ -155,7 +169,8 @@ export function buildMcpProbeFaceRows(rows, readings) {
 function isStringList(v) {
     return Array.isArray(v) && Array.from(v).every((t) => typeof t === "string");
 }
-export function createMcpProbeWalk(specs, principal, now = Date.now) {
+export function createMcpProbeWalk(input, principal, desk, now = Date.now) {
+    const { specs, lease } = probeDeclarations(input, desk);
     const bound = buildMcpProbeWalkTimeoutMs(specs.length);
     const controller = new AbortController();
     const dials = probeMcpServers(specs, {
@@ -163,7 +178,10 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
         timeoutMs: MCP_PROBE_VERDICT_TIMEOUT_MS,
         concurrency: MCP_PROBE_CONCURRENCY,
         signal: controller.signal,
+        peerSeat: desk.seat.answer,
     });
+    if (lease !== undefined)
+        void dials.then(() => lease.release(), () => lease.release());
     dials.catch(() => undefined);
     let timer;
     const deadline = new Promise((_resolve, reject) => {
@@ -189,6 +207,27 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
     answer.catch(() => undefined);
     return { answer, dials };
 }
+function probeDeclarations(input, desk) {
+    switch (input.declaredBy) {
+        case "deployment":
+            return { specs: input.specs };
+        case "caller": {
+            const lease = desk.lease("probe");
+            try {
+                return { specs: input.drafts.map((draft) => mintDeclaration(desk, draft, lease)), lease };
+            }
+            catch (err) {
+                lease.release();
+                throw err;
+            }
+        }
+        default: {
+            const unknownArm = input;
+            void unknownArm;
+            throw new Error("mcp probe: an input arm this module does not know (the arm set is closed: deployment / caller)");
+        }
+    }
+}
 export class McpProbeMisaligned extends Error {
     constructor(message) {
         super(message);

package/dist/capability-facts.d.ts

@@ -87,6 +87,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly not_k8s_lane: "the execution lane is not the k8s pod sandbox (REMOTE_EXEC=k8s)";
     readonly workspace_snapshot_store_absent: "no workspace snapshot store is configured (MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY)";
     readonly workspace_cache_off: "the build-cache volume per workspace space is off (WORKSPACE_CACHE=off, the default)";
+    readonly deployment_mod_packages_absent: "no operator-declared mod package was loaded at boot (MODS_ROOT / MODS_PACKAGES)";
 };
 export type CapabilityFactWhy = keyof typeof CAPABILITY_FACT_WHY;
 /** 不可用臂。 */
@@ -355,6 +356,11 @@ export declare function workspaceSpace(c: Pick<ServiceConfig, "remoteExec">): Fa
 export declare function workspaceCache(c: Pick<ServiceConfig, "remoteExec">): Fact<"not_k8s_lane" | "workspace_cache_off", {
     cache: WorkspaceCacheCapability;
 }>;
+/** 运维声明的 mod 包:本进程起服装上了几只(部署座装配口 `assembleDeploymentMods` 的读数;本服务自铸的部署注册不算)。
+ *  `/health.mods.deploymentPackages`(投 `count`)与 caps `modsDeploymentPackages`(投 `.available`,false ⇒ 键缺席)同调这一只。 */
+export declare function deploymentModPackages(d: Pick<Deps, "deploymentModPackages">): Fact<"deployment_mod_packages_absent", {
+    count: number;
+}>;
 /** 自唤醒调度器挂在宿主 env 上:`SCHEDULER_ENABLED` ∧ 单用户 ∧ host 车道。装配(`boot/execution-env.ts`)与能力位同调。 */
 export declare function hostScheduler(c: Pick<ServiceConfig, "schedulerEnabled" | "requirePrincipal" | "remoteExec">): Fact<"scheduler_disabled" | "multi_tenant_deployment" | "not_host_lane">;
 /** 引擎能力词的事实(core `ENGINE_CAPABILITIES` 每词一只谓词,值 = 本进程的事实;`/v1/capabilities` 以顶层布尔键展开它们)—— 住在

package/dist/capability-facts.js

@@ -67,6 +67,7 @@ export const CAPABILITY_FACT_WHY = {
     not_k8s_lane: "the execution lane is not the k8s pod sandbox (REMOTE_EXEC=k8s)",
     workspace_snapshot_store_absent: "no workspace snapshot store is configured (MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY)",
     workspace_cache_off: "the build-cache volume per workspace space is off (WORKSPACE_CACHE=off, the default)",
+    deployment_mod_packages_absent: "no operator-declared mod package was loaded at boot (MODS_ROOT / MODS_PACKAGES)",
 };
 const no = (why) => ({ available: false, why });
 const yes = (w) => ({ available: true, ...w });
@@ -391,6 +392,10 @@ export function workspaceCache(c) {
         return no("workspace_cache_off");
     return yes({ cache: { mount: rx.workspaceCache.mount, size: rx.workspaceCache.size } });
 }
+export function deploymentModPackages(d) {
+    const n = d.deploymentModPackages;
+    return n !== undefined && n > 0 ? yes({ count: n }) : no("deployment_mod_packages_absent");
+}
 export function hostScheduler(c) {
     if (c.schedulerEnabled !== true)
         return no("scheduler_disabled");

package/dist/checkpoint-identity.d.ts

@@ -7,15 +7,22 @@ export declare const MAX_CHECKPOINT_ID_CHARS = 128;
 export declare function withoutCheckpointToken(text: string, token: unknown): string;
 /** 持久层读出的 `checkpointId` 过信任边界:是串、非空、不超长、不含 token(大小写不敏感)⇒ 原值;否则 `undefined`。判据全文见本文件头注。 */
 export declare function trustedCheckpointId(raw: unknown, token: unknown): string | undefined;
-/** 带 `checkpointId` 当 join 键的 durable 面(计数 detail 的 `face`):运维队列行、停驻收件行,与 7.137.0 起的 park 账本行(`GET /v1/runs/:id/events` 的 `suspended` / `needs_review`,写时判一次)。 */
-export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox" | "run-events-park";
+/**
+ * 带 `checkpointId` 当 join 键的面(计数 detail 的 `face`):运维队列行、停驻收件行、park 账本行(`GET /v1/runs/:id/events` 的 `suspended` /
+ * `needs_review`,写时判一次),与回决门族的 200 体(`decision-receipt`:`/decide` / `/resume` / `/plan_review` 执行**前**从选中的那一行捕获一次,
+ * 结清证据带它 —— 语义属主 = `gate-settlement.ts`)。四面同一只读法、同一个计数。
+ */
+export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox" | "run-events-park" | "decision-receipt";
+/** 一行的身份片段:读得出可信值 ⇒ `{ checkpointId }`;读不出 ⇒ `{}`(键缺席)。由调用方原样展开进行投影 / 结清证据。 */
+export type GateIdentity = {
+    readonly checkpointId?: string;
+};
 /**
  * durable 读面的一行 → 它的身份片段,**由调用方原样展开进行投影**(`...durableRowIdentity(face, raw, token)`):读得出可信值 ⇒ `{ checkpointId }`;
  * 读不出 ⇒ `{}`(这一行**照列**,键缺席)+ 计一次(见本文件头注「durable 面的 join 键」)。
  * `raw === undefined` = 行上没有这一格(`why=absent`,老行);在场却没过信任边界(非串 / 空串 / 超长 / 含 token / 读不出)= `why=untrusted`。
- * 三处读面(两只店的 `listPending` + 收件 handler)与 park 账本行的唯一构造器(`trace/project.ts` 的 `parkEventData`)只经这一只 —— 读法、计数、缺席形各只有一份。
+ * 三处读面(两只店的 `listPending` + 收件 handler)、park 账本行的唯一构造器(`trace/project.ts` 的 `parkEventData`)与回决门族三条续跑腿的执行前捕获点
+ * (`http/resume-legs.ts`:`/decide` 在分流之前一次、`/resume`、`/plan_review`)只经这一只 —— 读法、计数、缺席形各只有一份。
  */
-export declare function durableRowIdentity(face: DurableCheckpointFace, raw: unknown, token: unknown): {
-    readonly checkpointId?: string;
-};
+export declare function durableRowIdentity(face: DurableCheckpointFace, raw: unknown, token: unknown): GateIdentity;
 //# sourceMappingURL=checkpoint-identity.d.ts.map

package/dist/config-catalog.js

@@ -167,7 +167,11 @@ export const CONFIG_CATALOG = [
     r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "一台实例「活着而不服务」的最长时长 T_max(ms),两处读它:① 服务租约中心不可达的容忍上限 —— 租约过期满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻),只在 fleet 成员 ∧ 中心宣告 servingLease 能力位时生效;② 排空口 POST /v1/admin/drain 的期限上界 —— deadlineAt 离此刻超过它 ⇒ 400 request.field_invalid,成员与非成员同读;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
     r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器对每台受管引擎写,缺省 scope 也写;手接的引擎缺席 = 缺省 scope;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
     r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
-    r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,引擎默认当家" }),
+    r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", {
+        derivedDefaultNote: "缺席 ⇒ 按外层拓扑分两态(启动日志 `brain` 字段的 `gatewayRetryCap` 回显哪一态):配了备用网关(`MODEL_GATEWAY_FALLBACK_URLS`)/ 开了断路器开关(`MODEL_CIRCUIT_BREAKER`,单路网关上也算)/ 开了反应式降级(配着 `MODEL_DEGRADE_TO` 且 `MODEL_DEGRADE_REACTIVE` 开)" +
+            "⇒ 网关各路 server 传 2(`fast-fail:2`),引擎的 `SEMA_MAX_RETRIES` 被遮蔽(降级兜底腿不吃这条收窄:不设时它不传,引擎默认当家);没有这些快切层 ⇒ 不传(`engine-default`),引擎默认当家(读 `SEMA_MAX_RETRIES`,没设是 10)。" +
+            "设了恒赢(`env:<n>`):原样传给引擎(降级兜底腿也吃显式值)并遮蔽 `SEMA_MAX_RETRIES`",
+    }),
     r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
     r("GIT_API_KIND", "integrations", "enum", "Git host API 方言", { enumValues: ["gitea", "github"], staticDefault: "gitea", configKey: "gitApiKind" }),
     r("GIT_API_TOKEN", "integrations", "secret", "repo 工具的 Git host 凭据", { danger: SEC }),
@@ -352,6 +356,8 @@ export const CONFIG_CATALOG = [
         },
         center: cModels("models[].vision"),
     }),
+    r("MODS_PACKAGES", "integrations", "opaque", "部署座装载的 mod 包声明(JSON 数组,每项闭集 { name, dir, tier, options? }:name = 包自己的名、逐字同;dir 绝对路径、真实路径须在 MODS_ROOT 之下且是目录;tier ∈ prepend / user / append 宿主必填;options 原样交包的 register)。读包只有引擎的读包者,本服务不读包内文件;形错 / 越根 / 读包者拒 / 名不同 / 引擎准入拒 ⇒ 拒启,一行拒句点名哪一席或哪只包(本服务写的句子不回显声明的值;读包者 / 准入交回的话原样透传、凭据形换记号,可能点名包目录);起服装配一次,改声明或换包要重启;本目录只回在场位与长度(不回显声明);options 不是凭据通道(本服务不替包扣凭据:宿主车道 inheritEnv \"all\" 下子进程照样继承这根旋钮与包自己读的变量)", { danger: SEC, derivedDefaultNote: "缺席 / 空串 = 不声明 ⇒ 部署座只有本服务自铸的注册,/health 与 /v1/capabilities 逐字节同没有这根旋钮的版本" }),
+    r("MODS_ROOT", "integrations", "path", "声明的 mod 包允许所在的根(绝对路径;包的真实路径按路径分量严格落在它的真实路径之下 —— 符号链接出根、前缀相似目录、.. 遍历、根本身都拒启;建议只读物料树)。声明了包而没设它 ⇒ 拒启;单设它而不声明包 = 无事(形照判)", { danger: SEC, configKey: "modsDeclaration", derivedDefaultNote: "缺席 ⇒ 不许声明任何包", resolve: (c) => c.modsDeclaration.root ?? null }),
     r("MYSQL_DATABASE", "store", "string", "MySQL 协议库名(选中该引擎时必填)", { danger: DATA }),
     r("MYSQL_HOST", "store", "string", "MySQL 协议主机(在场即算 SQL 信号,参与 DB_BACKEND 默认推导)", { danger: DATA }),
     r("MYSQL_PASSWORD", "store", "secret", "MySQL 协议口令", { danger: SEC }),

package/dist/config-types.d.ts

@@ -23,6 +23,7 @@ import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 import type { AtMention } from "@sema-agent/settings-schema";
+import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
  *  {@link ServiceConfigFlat.memoryEmbedder}。纯数据 —— 端点原文照存(拼 `/embeddings` 是 transport
@@ -130,7 +131,7 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
  * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
  */
 export declare function fleetScopeOf(raw: string | undefined): string;
-/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `httpUrlFlaws`),配置目录四行同读这一句。 */
+/** 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与公告地址的形句 —— 判官 `web-admin-client/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = settings-schema `pathBaseUrlFlaws`,14.7.0 起),配置目录四行同读这一句。 */
 export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2),\u62D2\u53E5\u53EA\u70B9\u540D\u89C4\u5219,\u4E0D\u56DE\u663E scheme";
 /** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
 export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
@@ -266,7 +267,7 @@ export interface MemoryConsolidationDriverConfig {
      *  ①恰好一条时 = 两个 admin 口省略 `scope` 的**唯一**缺省(两条及以上恒不猜——在两个库之间猜一个
      *  去花钱是本设计要消灭的形);②周期腿落地时的 scope 源(设计稿 D2)。
      *  🔴 **不是授权边界**:本仓今天没有任何授权源能对一个 operator 收窄 scope(理由与亲读依据逐字见
-     *  `src/memory-operator-faces.ts` 的 `erasureEnvelopeRefusal` 头注),在本层拿它当白名单就是**发明
+     *  `src/memory-operator-faces.ts` `MemoryComplianceFaces.erase` 的「授权座只有一只」段),在本层拿它当白名单就是**发明
      *  第二套授权语义**。显式传的 scope 照跑,表只管缺省。 */
     scopes: readonly string[];
     /**
@@ -297,7 +298,8 @@ export interface MemoryConsolidationDriverConfig {
      */
     autoRunOnRecommendation?: boolean;
 }
-/** A web-admin MCP server resolved to a core spec (env-NAME refs already → real values) plus the
+/** A web-admin MCP server resolved to a core spec (env-NAME refs already read and registered on the peer desk under the
+ *  roster lease: the spec carries the minted reference, never the values) plus the
  *  scenarios it applies to (empty = all). `resolveSpec` filters by scenario and passes `spec` to core. */
 export interface ScopedMcpServer {
     scenarios: string[];
@@ -312,7 +314,8 @@ export interface CenterMcp {
     servers: ScopedMcpServer[];
     reservedNames: readonly string[];
 }
-/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already → real values) plus
+/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
+ *  under the roster lease: the spec carries the minted reference, never the values) plus
  *  the scenarios it applies to (empty = all). Exact sibling of {@link ScopedMcpServer}: `resolveSpec`
  *  filters by scenario (`a2aForScenario`) and passes `spec` to core as `TaskSpec.a2a`.
  *
@@ -510,8 +513,10 @@ export interface ServiceConfigFlat {
     gatewayFallbackUrls: string[];
     /** `GATEWAY_MAX_RETRIES` —— openai 兼容腿的**每次调用**重试上限。
      *
-     *  🔴 **缺席 = 不传给引擎**(不是"传个默认值"):此前这里是硬编码 `maxRetries: 2`,而显式传参**压过**
-     *  引擎默认 ⇒ core 抬默认对 server 部署一点效果都没有。缺席不传之后,引擎默认当家、core 抬默认自动继承。
+     *  🔴 **配置层缺席 = 本字段 `undefined`**(不是"传个默认值"):此前这里是硬编码 `maxRetries: 2`,而显式传参**压过**
+     *  引擎默认 ⇒ core 抬默认对 server 部署一点效果都没有。缺席之后由 `brain.ts` 按**外层拓扑**分两态(启动日志 `gatewayRetryCap` 回显):
+     *  外层有快切层(备用网关 / 断路器开关 / 反应式降级 —— 后者须配着 `MODEL_DEGRADE_TO`)⇒ 网关各路传 `FAST_FAIL_MAX_RETRIES`(2)并遮蔽引擎的 `SEMA_MAX_RETRIES`;
+     *  没有快切层 ⇒ 不传,引擎默认当家、core 抬默认自动继承。降级兜底腿不吃这条收窄(只吃显式值)。设了恒赢(原样传、同样遮蔽 `SEMA_MAX_RETRIES`)。
      *  (五报清查 R1① 的 server 半场,黑板 [ref]/[ref];anthropic 腿早有 `ANTHROPIC_MAX_RETRIES` 出口,
      *  这条只是把同样的出口补给限流 provider 真正走的那条腿。) */
     gatewayMaxRetries?: number;
@@ -2205,6 +2210,9 @@ export interface ServiceConfigFlat {
     defaultScenario: string;
     /** Directory of baked-in skill Markdown files, loaded once at startup. */
     skillsDir: string;
+    /** 运维声明的 mod 包(`MODS_ROOT` + `MODS_PACKAGES`;`loadConfig` 读一次,唯一读法 `mods-declaration.ts` 的 `parseModsDeclaration`)。两只起服入口的部署座装配
+     *  (`boot/deployment-mods.ts` 的 `assembleDeploymentMods`)都读这一份;没声明 = 没有 `packages` 这一席(`{}` / 单设根时 `{ root }`;部署座只有本仓自铸的注册)。起服装配一次,配置刷新不重载。 */
+    modsDeclaration: ModsDeclaration;
     /** Central web-admin (web-admin). When set, the service pulls the effective config
      *  on boot (and refreshes) and applies it OVER the env defaults — env is the fallback. Logical config
      *  only (model roster/roles/teams); secrets/gateways stay in this service's env.
@@ -2294,7 +2302,7 @@ export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachme
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "modsDeclaration" | "centerCredentialRenewLeadMs" | "webAdmin" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir" | "configLocalOwnerUid">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config.js

@@ -15,7 +15,7 @@ import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
-import { FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
+import { FLEET_ADVERTISE_ADDRESS_ENV, FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
 import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
@@ -47,7 +47,7 @@ import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
-import { anthropicCredentialRefusal, csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { anthropicCredentialRefusal, csvOf, declaredCredential, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { echoCallerText } from "./caller-text-echo.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
@@ -55,6 +55,7 @@ import { parseConfigLocalOwnerUid } from "./config-dir-trust.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
+import { parseModsDeclaration } from "./mods-declaration.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return csvOf(process.env[name]);
@@ -1103,7 +1104,7 @@ function parseModelDomain() {
     }
     const models = envLaneTable(modelId, model, cheapModel);
     const gatewayApiKey = route.gatewayApiKey;
-    if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
+    if (gatewayBaseUrl === undefined && declaredCredential(gatewayApiKey) !== undefined) {
         CONFIG_NOTICES.push({
             level: "warn",
             event: "model_gateway_key_unpaired",
@@ -2228,6 +2229,7 @@ function parseIntegrationsDomain(ctx) {
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
+        modsDeclaration: parseModsDeclaration(process.env.MODS_ROOT, process.env.MODS_PACKAGES),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
         webAdmin,
         fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds({ requirePrincipal })),
@@ -2273,9 +2275,10 @@ function parseFleetScope(raw) {
     return fleetScopeOf(raw);
 }
 function parseFleetAdvertiseAddress(raw) {
+    const name = "FLEET_ADVERTISE_ADDRESS";
     if (raw === undefined || raw === "")
         return {};
-    const refusal = pathBaseUrlRefusal("env FLEET_ADVERTISE_ADDRESS", raw);
+    const refusal = pathBaseUrlRefusal(`env ${name}`, raw);
     if (refusal !== undefined) {
         throw fleetEnvRefusal("advertise_address_invalid", `${refusal} — it must be an http(s) base URL such as "http://10.0.0.5:8090": the fleet center rejects any other shape on every announce. ` +
             `Unset it if this engine does not announce itself.`);
@@ -2460,7 +2463,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir", "configLocalOwnerUid",
+    "skillsDir", "modsDeclaration", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir", "configLocalOwnerUid",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,

package/dist/deployment-shape.d.ts

@@ -93,23 +93,23 @@ export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
      */
     multiTenant: DeploymentShapePredicate<"principal">;
     /** 读能力表 `callerCwd` 位(host = 单主才开;device = 路径落在发起者自己的设备上,归属由 `device_session` 绑定验过,不要求单主)。 */
-    callerCwd: DeploymentShapePredicate<"principal" | "lane">;
+    callerCwd: DeploymentShapePredicate<"lane" | "principal">;
     /** 调用方给的宿主绝对路径(附加目录 / 项目上下文 / 本机 SendUserFile / 指令文件探针)只在「手就在本 worker 的盘上 ∧ 单主」时指向调用方自己的东西。 */
-    callerOwnsWorkerDisk: DeploymentShapePredicate<"principal" | "lane">;
+    callerOwnsWorkerDisk: DeploymentShapePredicate<"lane" | "principal">;
     /** wire `executionLane.toolsOnThisHost` 与出厂 / 中心技能的 `baseDir`:只问文件系统同一性,与租户无关(出厂内容每个租户拿到同一份)。 */
     toolsOnThisHost: DeploymentShapePredicate<"lane">;
     /** `REMOTE_EXEC` 未设的进程内形(没有手)且单主:进程级消费者(hooks 命令、项目上下文本机读、卡批规则 root)看到的就是引擎自己的进程 cwd / env。 */
-    inProcessSingleUser: DeploymentShapePredicate<"principal" | "lane">;
+    inProcessSingleUser: DeploymentShapePredicate<"lane" | "principal">;
     /** 任务层替部署声明宿主姿态(bypassPermissions 开写面 / host shell 继承整份环境)的射程:device 车道上跨租户宿主穿越结构性不存在(clay 裁定③)。 */
-    taskHostPostureDeclarations: DeploymentShapePredicate<"principal" | "lane">;
+    taskHostPostureDeclarations: DeploymentShapePredicate<"lane" | "principal">;
     /** 写门走 [ref] 代理裁决(文件平面不在 worker 本机);认不出的词 ⇒ 走代理(代理 slot 空 ⇒ 写门 fail-closed)。 */
     sandboxPathAdjudication: DeploymentShapePredicate<"lane">;
     /** 读能力表 `sandboxSendUserFile` 位(e2b / k8s 每任务一只沙箱 ⇒ 任何租户;ssh 共享一台真机 ⇒ 只单主)。 */
-    sandboxSendUserFile: DeploymentShapePredicate<"principal" | "lane">;
+    sandboxSendUserFile: DeploymentShapePredicate<"lane" | "principal">;
     /** 读能力表 `remoteScratchpad` 位(`/tmp/scratchpad/<sessionId>` 远端约定)。 */
     remoteScratchpad: DeploymentShapePredicate<"lane">;
     /** 读能力表 `tenantSeparation` 位(值来自 settings-schema 车道词表正本);唯一读者 = 跨域不变量 `multi-tenant-shared-lane`。 */
-    laneSeparatesTenants: DeploymentShapePredicate<"principal" | "lane">;
+    laneSeparatesTenants: DeploymentShapePredicate<"lane" | "principal">;
     /**
      * [ref] —— **VM 级**隔离强度(独立内核:e2b 的 Firecracker microVM;k8s 只在 Kata / gVisor 运行时类上)。与能力表 `isolation` 位
      * (OS 级边界,容器即算;wire `executionLane.isolated` 的属主 `laneIsolated`)是两个问题,所以不叫「isolated」。读者:A 值路由。

package/dist/gate-settlement.d.ts

@@ -0,0 +1,71 @@
+/**
+ * 回决门族 200 体上的**结清证据**(`decisionCommitted` / `checkpointId`)—— 唯一铸点与唯一读法。
+ *
+ * ## 律(一条)
+ * `decisionCommitted: true` = 「本请求点名的那道门,已以本请求的决定被耐久地结清过」的**历史证据**。它只在下面五个执行 / 回放边界之一
+ * 被跨过的那一拍、由 {@link buildSettlementEvidence} 铸(闭集 {@link SettlementCrossing},`switch` 穷尽):
+ *  ① `engine_accepted` —— 引擎续跑腿的受理点(`resumeStream` 解析 = 引擎的 pre-CAS 守卫与 checkpoint resolve CAS 都过了);
+ *  ② `engine_terminal` —— 引擎续跑腿交回结果之后的终局体(同步长调用形 / verify 臂;含「已提交、又重开同一张卡」的 `retriable:true` 那一形);
+ *  ③ `replay_matched`  —— `/decide` 幂等回放比对通过(同一决定早已与 resolve 原子地落在行上;回放不起续跑);
+ *  ④ `agent_revived`   —— 停驻后台子代复活成功(引擎以选中的 token 续跑、attach 之后才交回);
+ *  ⑤ `card_voided`     —— 复活不了的停驻子代被 deny 作废成功(这道门以本 deny **经作废结清**:卡 pending → expired;没有 resolve、没有 deny 结果行)。
+ * 调用方对一条引擎续跑腿的分类({@link GateCommitment})只说「这条腿到边界时能证什么」,**从不单独铸位** —— 位要有边界作证。
+ * 不铸的出口(都在调用点成文):`checkpoint.resume_aborted` 取消(拿不到 resolve 的返回值 ⇒ 证不出)、抛出臂的取消(受理之后也可能走到 ⇒
+ * **刻意不带**证据,fail-closed)、4xx、交给宿主 / 新铸一跑 / 同一决定重投的回执(`delivered`,门由别人结清或仍待决)、停驻子代认领到的
+ * token 不是选中的那一张(⇒ `409 decide.gate_moved`,不复活)。证据只随**同一次决定**的回放走:停驻赎回席的反向重试回放摘掉它
+ * ({@link withoutSettlementEvidence})。
+ *
+ * ## 读法(三句,契约 §4a「结清证据」同句)
+ *  · 位在场 ⇒ 门已以此决定结清过(历史证据;与 `errorCode:"cancelled"` 或 `retriable:true` 并存时同样成立 —— 它不证明卡的**当前**状态、
+ *    不证明批过的动作执行了);
+ *  · 位缺席 ⇒ 证不出或刻意不带,按「没提交」读;
+ *  · `checkpointId` = 执行**前**从选中的那一行捕获、过信任边界(`checkpoint-identity.ts` 的 `durableRowIdentity`,face `decision-receipt`)
+ *    的门身份,只随位出现;缺席 = 身份不可用(老行 / 没过边界)或不适用(回放的投影不带门身份),不推断任何事。
+ *
+ * ## 读者
+ * 本仓两个:`/decide` 的 [ref] 迟到结算留痕与 remember 豁免落店,都经 {@link decisionCommittedOf} 读体上的位(一处读法;不读 `errorCode`)。
+ * 纯数据、零运行时依赖(停驻子代腿与 HTTP 层共用)。
+ */
+import type { GateIdentity } from "./checkpoint-identity.js";
+/**
+ * 一条**引擎续跑腿**到达边界时能证什么(调用方声明;闭集)。`DriveResumeArgs` 的必填位 —— 同一条驱动路径既续本请求点名的门,也替宿主投递。
+ *  · `gate_resolved` —— 这条腿 resolve 的就是本请求点名的那道门(`/decide` 引擎臂、`/resume`、`/plan_review`);`checkpointId` = 执行前捕获的身份片段。
+ *  · `delivered`     —— 这条腿 resolve 的是宿主的门(wake;含 `/decide` workflow 车道的 wake 投递腿):本请求点名的那道门由别人结清或仍待决 ⇒ 到任何边界都不铸。
+ */
+export type GateCommitment = {
+    readonly kind: "gate_resolved";
+    readonly checkpointId?: string;
+} | {
+    readonly kind: "delivered";
+};
+/** 五个边界(铸点穷尽)。引擎两边界按腿的分类铸;回放不带身份;停驻子代两边界的门恒是本请求点名的那道,身份取执行前捕获的那一份。 */
+export type SettlementCrossing = {
+    readonly at: "engine_accepted" | "engine_terminal";
+    readonly commitment: GateCommitment;
+} | {
+    readonly at: "replay_matched";
+} | {
+    readonly at: "agent_revived" | "card_voided";
+    readonly gate: GateIdentity;
+};
+/** 体上的结清证据(两键都可缺席;wire 只加)。由调用方原样展开进它自己的体形(各体形保持各自的键集,不并进一张受理形)。 */
+export interface GateSettlementEvidence {
+    readonly decisionCommitted?: true;
+    readonly checkpointId?: string;
+}
+/** 没有跨过任何边界的回执(`/decide` workflow 车道的宿主新一跑、同一决定重投)带的证据:无。 */
+export declare const NO_SETTLEMENT_EVIDENCE: GateSettlementEvidence;
+/** **唯一铸点**:一次边界跨越 → 体上的证据片段。 */
+export declare function buildSettlementEvidence(crossing: SettlementCrossing): GateSettlementEvidence;
+/**
+ * 一张已带证据的回执被拿去答**另一个**决定(停驻赎回席的反向重试:回放首次受理的那一向、不改判)⇒ 证据两键都摘掉 ——
+ * 证据说的是当初被结清的那次决定,这一次请求的决定从没被结清。同向重试是同一次请求的回放,体原样(证据随它)。
+ * 只摘、不铸:本模块之外没有第二个写这两键的地方。
+ */
+export declare function withoutSettlementEvidence<B extends Record<string, unknown>>(body: B): Omit<B, keyof GateSettlementEvidence>;
+/** **唯一读法**:这张回决应答说「门已以此决定结清过」吗(`200` 且体上的位为真)。两个读者同调这一只。 */
+export declare function decisionCommittedOf(out: {
+    readonly status: number;
+    readonly body: object;
+}): boolean;
+//# sourceMappingURL=gate-settlement.d.ts.map

package/dist/gate-settlement.js

@@ -0,0 +1,40 @@
+export const NO_SETTLEMENT_EVIDENCE = Object.freeze({});
+const settled = (gate) => ({
+    decisionCommitted: true,
+    ...(gate.checkpointId !== undefined ? { checkpointId: gate.checkpointId } : {}),
+});
+export function buildSettlementEvidence(crossing) {
+    switch (crossing.at) {
+        case "engine_accepted":
+        case "engine_terminal": {
+            const c = crossing.commitment;
+            switch (c.kind) {
+                case "gate_resolved":
+                    return settled(c);
+                case "delivered":
+                    return NO_SETTLEMENT_EVIDENCE;
+                default: {
+                    const unhandled = c;
+                    throw new Error(`unhandled gate commitment: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+        case "replay_matched":
+            return settled({});
+        case "agent_revived":
+        case "card_voided":
+            return settled(crossing.gate);
+        default: {
+            const unhandled = crossing;
+            throw new Error(`unhandled settlement crossing: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function withoutSettlementEvidence(body) {
+    const { decisionCommitted: _committed, checkpointId: _identity, ...rest } = body;
+    return rest;
+}
+export function decisionCommittedOf(out) {
+    return out.status === 200 && out.body.decisionCommitted === true;
+}
+//# sourceMappingURL=gate-settlement.js.map

package/dist/hooks/classic-stations.d.ts

@@ -25,6 +25,7 @@ export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.UserPromptSubmit": "chain";
     readonly "classic.Stop": "chain";
     readonly "classic.SubagentStop": "chain";
+    readonly "classic.SubagentStart": "chain";
     readonly "classic.StopFailure": "observe";
     readonly "classic.PreCompact": "chain";
     readonly "classic.PostCompact": "observe";

package/dist/hooks/classic-stations.js

@@ -6,6 +6,7 @@ export const CLASSIC_STATION_ROLE = {
     "classic.UserPromptSubmit": "chain",
     "classic.Stop": "chain",
     "classic.SubagentStop": "chain",
+    "classic.SubagentStart": "chain",
     "classic.StopFailure": "observe",
     "classic.PreCompact": "chain",
     "classic.PostCompact": "observe",

package/dist/hooks/command-spawn.d.ts

@@ -26,7 +26,7 @@ export declare function commandLineChars(entry: {
 export declare function hookPluginEnv(p: HookPluginContext | undefined): Record<string, string>;
 /**
  * 起法:shell 形交回命令串(shell 由调用点落定),exec 形交回可执行名与参数,起不来交回真因(进调用点的 `spawnError`)。
- * `env` = 这条 hook 的**有效环境层**({@link composeHookEnvLayer} 的产物;调用点铺在基础 allowlist 之上,不再自己合并任何一层)。
+ * `env` = 这条 hook 的**有效环境层**({@link composeHookEnvLayer} 的产物;调用点把它作为授予交给宿主子进程的唯一组合,不再自己合并任何一层)。
  */
 export type CommandSpawnPlan = {
     readonly kind: "shell";
@@ -42,7 +42,7 @@ export type CommandSpawnPlan = {
     readonly error: string;
 };
 /**
- * 一条 command hook 的**有效环境层**(基础 allowlist 之上的那一层)—— **唯一铺法**,后铺者赢:`CLAUDE_PROJECT_DIR` 的缺省(`cwd`,hook 的工作目录;请求没写它才取)< 请求 `settings.env`(`requestEnv`;
+ * 一条 command hook 的**有效环境层**(继承之上的那一层授予)—— **唯一铺法**,后铺者赢:`CLAUDE_PROJECT_DIR` 的缺省(`cwd`,hook 的工作目录;请求没写它才取)< 请求 `settings.env`(`requestEnv`;
  * 请求自己写了 `CLAUDE_PROJECT_DIR` 就是它,空串也照用)< 条目自己的插件上下文({@link hookPluginEnv})。键的枚举顺序 = 请求的键在前、`CLAUDE_PROJECT_DIR` 缺省时接后、插件键最后。调用点传**原料**(工作目录与请求 env),不预先取舍 `CLAUDE_PROJECT_DIR`。
  * 「有没有值」的判据、exec 形的占位替换、shell 形子进程的环境都读这一个对象(见文件头);http 条目的 `$NAME` 插值取环境也走这一只(无插件上下文)。
  */

package/dist/hooks/hook-runner.js

@@ -32,20 +32,13 @@ export const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10_000;
 const MIN_HOOK_CONTEXT_PARTIAL_CHARS = 256;
 const MAX_TOOL_RESPONSE_CHARS = 32_768;
 const MAX_TOOL_INPUT_CHARS = 262_144;
-const HOOK_ENV_ALLOWLIST = [
-    "PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ",
-    "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR",
-];
-function hookBaseEnv(spawning) {
-    return spawning
-        ? hostSubprocessEnv({ site: "server.hooks.spawn-env", policy: [...HOOK_ENV_ALLOWLIST], allow: [] })
-        : composeHostSubprocessEnv({ policy: [...HOOK_ENV_ALLOWLIST], allow: [] });
-}
-function hookEnvOverBase(layer, spawning) {
-    return { ...hookBaseEnv(spawning), ...layer };
+const HOOK_ENV_ALLOWLIST = ["PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ", "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR"];
+function hookChildEnv(layer, spawning) {
+    const o = { policy: [...HOOK_ENV_ALLOWLIST], allow: [], grants: [layer] };
+    return spawning ? hostSubprocessEnv({ site: "server.hooks.spawn-env", ...o }) : composeHostSubprocessEnv(o);
 }
 function hookEnv(ctx) {
-    return hookEnvOverBase(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
+    return hookChildEnv(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
 }
 export const SETTINGS_HOOK_STATIONS = {
     PreToolUse: ["classic.PreToolUse"],
@@ -754,7 +747,7 @@ function buildHookContextField(parts) {
     return text === undefined ? {} : { additionalContext: text };
 }
 function spawnPlannedCommand(plan, ctx, stdio) {
-    const env = hookEnvOverBase(plan.env, true);
+    const env = hookChildEnv(plan.env, true);
     if (plan.kind === "exec")
         return spawn(plan.file, [...plan.args], { cwd: ctx.cwd, env, stdio, detached: true });
     const sh = hostShell();
@@ -1006,7 +999,14 @@ async function runLlmHook(entry, payload, ctx, extra) {
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookEnv(ctx));
+    let hookChildVars;
+    try {
+        hookChildVars = hookEnv(ctx);
+    }
+    catch (e) {
+        return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
+    }
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,

package/dist/http/admission.js

@@ -743,10 +743,11 @@ export function createAdmission(ctx) {
             }
         }
         const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const lease = deps.peerDesk.lease("fresh");
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
-            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease });
             const bindingIntent = await resolveDevicePlacementIntent({
                 config: deps.config,
                 req,
@@ -760,9 +761,10 @@ export function createAdmission(ctx) {
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
+            lease.release();
             if (err instanceof HttpError) {
                 if (onTypedFailure) {
                     onTypedFailure(err);

package/dist/http/dispatch.d.ts

@@ -18,6 +18,10 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
+/** `/health` 的 `mods` 段(运维声明的 mod 包装上了几只;present-iff 装上了)—— 段的键集属主,自铸 wire 值登记表 `healthModsKey` 绑它。 */
+export interface HealthDeploymentModsSection {
+    readonly deploymentPackages: number;
+}
 /**
  * 🔴 [ref](test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。