@sema-agent/server 7.139.0 → 7.141.0

package/dist/execution-lane-caps.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
-import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES } from "@sema-agent/settings-schema/execution-lanes";
-import { isBlankCoordinate } from "@sema-agent/settings-schema";
-import { DECLARE_HOME_REMEDY, buildHomeAbsentNote } from "./lane-home-probe.js";
+import { StubExecutionEnv } from "@sema-agent/core";
+import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES, isBlankCoordinate, retiredLaneWordRefusal } from "@sema-agent/settings-schema/execution-lanes";
+import { DECLARE_HOME_REMEDY, LANE_HOME_UNDECLARED_EVENT, LANE_HOME_UNMEASURED_EVENT, buildHomeAbsentNote, buildHomeUnmeasuredNote } from "./lane-home-probe.js";
 const NO = "unsupported";
 const YES = "supported";
 const SU = "single-user-only";
@@ -14,15 +14,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: NO,
-                isolation: NO,
-                suspendable: NO,
                 remoteScratchpad: NO,
-                sandboxPathAdjudication: NO,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: YES,
-                coreRemoteExecutionEnv: NO,
-                canonicalPathAuthority: NO,
                 tenantSeparation: YES,
             };
         case "host":
@@ -32,15 +25,8 @@ export function executionLaneCaps(lane) {
                 scheduler: SU,
                 lsp: SU,
                 sandboxSendUserFile: NO,
-                isolation: NO,
-                suspendable: NO,
                 remoteScratchpad: NO,
-                sandboxPathAdjudication: NO,
                 worktreeIsolation: YES,
-                memoryPersistenceCapable: YES,
-                hostFilePlane: YES,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "e2b":
@@ -50,15 +36,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: YES,
-                isolation: YES,
-                suspendable: YES,
                 remoteScratchpad: YES,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "k8s":
@@ -68,15 +47,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: YES,
-                isolation: YES,
-                suspendable: YES,
                 remoteScratchpad: YES,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "ssh":
@@ -86,15 +58,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: SU,
-                isolation: NO,
-                suspendable: NO,
                 remoteScratchpad: YES,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "adb":
@@ -104,15 +69,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: NO,
-                isolation: NO,
-                suspendable: NO,
                 remoteScratchpad: NO,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "local-docker":
@@ -122,15 +80,8 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: NO,
-                isolation: YES,
-                suspendable: NO,
                 remoteScratchpad: YES,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "device":
@@ -140,19 +91,98 @@ export function executionLaneCaps(lane) {
                 scheduler: NO,
                 lsp: NO,
                 sandboxSendUserFile: NO,
-                isolation: NO,
-                suspendable: NO,
                 remoteScratchpad: YES,
-                sandboxPathAdjudication: YES,
                 worktreeIsolation: NO,
-                memoryPersistenceCapable: NO,
-                hostFilePlane: NO,
-                coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
     }
 }
+export const SANDBOX_READ_FLOOR_ENV = "SANDBOX_READ_FLOOR";
+export const SANDBOX_READ_FLOOR_WORDS = ["keep", "off"];
+export const SANDBOX_READ_FLOOR_DEFAULT = "keep";
+export function readFloorStateOf(knob, served) {
+    switch (knob) {
+        case "off":
+            return "off";
+        case "keep":
+            return served ? "kept" : "unserved";
+    }
+}
+export function sandboxReadFloorState(lane, knob) {
+    const k = knob ?? SANDBOX_READ_FLOOR_DEFAULT;
+    switch (lane) {
+        case "e2b":
+            return readFloorStateOf(k, false);
+        case "k8s":
+            return readFloorStateOf(k, false);
+        case "local-docker":
+            return readFloorStateOf(k, false);
+    }
+}
+const IN_PROCESS_BLOCK = new StubExecutionEnv().capabilities;
+const HOST_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: true, canonicalPathAuthoritative: true, hostLocalPaths: true, externalContentTarget: false, io: true, keepsReadFloor: false });
+const E2B_SHAPE = Object.freeze({ isolation: true, suspendable: true, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SNAPSHOT_SHAPE = Object.freeze({ ...K8S_SHAPE, suspendable: true });
+const LOCAL_DOCKER_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+function sandboxBlock(shape, state) {
+    return Object.freeze({ ...shape, keepsReadFloor: state === "kept" });
+}
+function sandboxShape(lane, snapshotStore) {
+    switch (lane) {
+        case "e2b":
+            return E2B_SHAPE;
+        case "k8s":
+            return snapshotStore ? K8S_SNAPSHOT_SHAPE : K8S_SHAPE;
+        case "local-docker":
+            return LOCAL_DOCKER_SHAPE;
+    }
+}
+const SSH_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
+const ADB_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
+const DEVICE_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: true, io: true, keepsReadFloor: false });
+const NO_SUB_KNOBS = Object.freeze({ snapshotStore: false, sandboxReadFloor: undefined });
+function laneBlock(lane, sub) {
+    switch (lane) {
+        case "in-process":
+            return IN_PROCESS_BLOCK;
+        case "host":
+            return HOST_BLOCK;
+        case "e2b":
+        case "k8s":
+        case "local-docker":
+            return sandboxBlock(sandboxShape(lane, sub.snapshotStore), sandboxReadFloorState(lane, sub.sandboxReadFloor));
+        case "ssh":
+            return SSH_BLOCK;
+        case "adb":
+            return ADB_BLOCK;
+        case "device":
+            return DEVICE_BLOCK;
+    }
+}
+export function capabilitiesFor(deployment) {
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    return laneBlock(lane, { snapshotStore: lane === "k8s" && Boolean(deployment.remoteExec?.s3Snapshot), sandboxReadFloor: deployment.sandboxReadFloor });
+}
+export function laneSandboxReadFloorState(deployment) {
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    switch (lane) {
+        case "e2b":
+        case "k8s":
+        case "local-docker":
+            return sandboxReadFloorState(lane, deployment.sandboxReadFloor);
+        case "in-process":
+        case "host":
+        case "ssh":
+        case "adb":
+        case "device":
+            return undefined;
+    }
+}
 export const ALL_EXECUTION_LANES = Object.freeze(["in-process", ...DECLARABLE_LANE_WORDS]);
 const EXECUTION_LANE_SET = new Set(ALL_EXECUTION_LANES);
 export function isExecutionLane(word) {
@@ -187,6 +217,32 @@ export function isBlankRequiredEnvValue(value) {
 export function laneMissingEnv(lane, env) {
     return laneRequiredEnv(lane).filter((name) => isBlankRequiredEnvValue(env[name]));
 }
+export function readDeclaredLaneTable(raw) {
+    const segments = raw.split(",");
+    const lanes = [];
+    for (const [i, segment] of segments.entries()) {
+        if (segment === "") {
+            return { refusal: `REMOTE_EXEC="${raw}" has an empty entry at position ${i + 1} — it is an ordered, comma-separated list of execution lanes (the first is the default) with no blank entries; valid lanes: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}.` };
+        }
+        const lane = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === segment);
+        const retired = lane === undefined ? retiredLaneWordRefusal(segment) : undefined;
+        if (retired !== undefined)
+            return { refusal: `REMOTE_EXEC="${raw}": ${retired}.` };
+        if (lane === undefined) {
+            return {
+                refusal: `REMOTE_EXEC="${raw}"${segments.length > 1 ? ` lists "${segment}", which` : ""} is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
+                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`,
+            };
+        }
+        if (lanes.includes(lane))
+            return { refusal: `REMOTE_EXEC="${raw}" lists "${lane}" twice — each execution lane appears once (the first one is the default).` };
+        lanes.push(lane);
+    }
+    const [first, ...rest] = lanes;
+    if (first === undefined)
+        throw new Error(`readDeclaredLaneTable: "${raw}" split into no segments`);
+    return { lanes: [first, ...rest] };
+}
 export function executionLaneRequiredRefusal(deployment) {
     if (!deployment.requireExecutionLane || executionLaneOf(deployment.remoteExec?.provider) !== "in-process")
         return undefined;
@@ -210,8 +266,8 @@ export function deployedExecutionLanes(config) {
     return [executionLaneOf(config.remoteExec?.provider)];
 }
 export function handsOnWorkerFilePlane(lane) {
-    const caps = executionLaneCaps(lane);
-    return caps.hostFilePlane === "supported" && caps.coreRemoteExecutionEnv === "supported";
+    const block = laneBlock(lane, NO_SUB_KNOBS);
+    return block.io && block.hostLocalPaths;
 }
 export function laneBindsReads(lane) {
     switch (lane) {
@@ -233,11 +289,11 @@ export function laneMeasuresHome(lane) {
         case "local-docker":
         case "ssh":
         case "adb":
+        case "e2b":
+        case "host":
             return true;
         case "device":
-        case "host":
         case "in-process":
-        case "e2b":
             return false;
     }
 }
@@ -257,23 +313,10 @@ export function laneReadFaceDefault(lane) {
 }
 export const LANE_OPEN_READ_FACE_CAUTION = "a deployment that mounts host paths or shared volumes into the sandbox (hostPath, bind mount) exposes those host files to reads on an open face — pin READ_FACE=roots or add read-deny rows (READ_DENY_PATTERNS) for them";
 export function laneIsolated(lane) {
-    const isolation = executionLaneCaps(lane).isolation;
-    switch (isolation) {
-        case "supported":
-            return true;
-        case "unsupported":
-            return false;
-    }
+    return laneBlock(lane, NO_SUB_KNOBS).isolation;
 }
 export function laneWiresExecutionEnv(lane) {
-    const wired = executionLaneCaps(lane).coreRemoteExecutionEnv;
-    switch (wired) {
-        case "supported":
-            return true;
-        case "unsupported":
-        case "single-user-only":
-            return false;
-    }
+    return laneBlock(lane, NO_SUB_KNOBS).io;
 }
 export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
 export const E2B_SANDBOX_HOME = "/home/user";
@@ -298,14 +341,32 @@ export function executionLaneHomeDir(deployment) {
             return undefined;
     }
 }
-export function buildUndeclaredHomeNote(deployment) {
-    if (executionLaneHomeDir(deployment) !== undefined)
-        return undefined;
+export function buildLaneHomeClaim(deployment) {
+    const home = executionLaneHomeDir(deployment);
+    if (home === undefined)
+        return {};
+    return { homeDir: home, homeDirSource: deployment.remoteExecHomeDir !== undefined ? "declared" : "lane" };
+}
+export function buildLaneHomeBootNote(deployment) {
     const lane = executionLaneOf(deployment.remoteExec?.provider);
-    if (lane === undefined || executionLaneCaps(lane).coreRemoteExecutionEnv !== "supported")
+    if (lane === undefined || !laneWiresExecutionEnv(lane))
         return undefined;
     if (laneMeasuresHome(lane))
         return undefined;
-    return buildHomeAbsentNote(lane, "REMOTE_EXEC_HOME_DIR is unset, and this lane cannot read its execution environment's home", DECLARE_HOME_REMEDY);
+    const home = executionLaneHomeDir(deployment);
+    if (home === undefined)
+        return { event: LANE_HOME_UNDECLARED_EVENT, note: buildHomeAbsentNote(lane, "REMOTE_EXEC_HOME_DIR is unset, and this lane cannot read its execution environment's home", DECLARE_HOME_REMEDY) };
+    return { event: LANE_HOME_UNMEASURED_EVENT, note: buildHomeUnmeasuredNote(lane, home) };
+}
+export function buildReadDenyFloorUnkeptNote(deployment) {
+    if (!deployment.readDenyFloorRequired)
+        return undefined;
+    if (capabilitiesFor(deployment)?.keepsReadFloor === true)
+        return undefined;
+    const lane = executionLaneOf(deployment.remoteExec?.provider) ?? String(deployment.remoteExec?.provider);
+    return (`READ_DENY_FLOOR_REQUIRED=true, but the "${lane}" execution lane does not keep the read-deny byte floor (a program its commands run can open a path ` +
+        `the read-deny table refuses). Every run whose read-deny table has rows — the shipped default tiers put rows there unless READ_DENY_BUILTIN_TIERS=none — ` +
+        `is refused before any command starts (config.read_deny_floor_unkept; a synchronous submit answers 409). ` +
+        `Either run on a lane that keeps the floor, or unset READ_DENY_FLOOR_REQUIRED to run with one operator notice per run instead.`);
 }
 //# sourceMappingURL=execution-lane-caps.js.map

package/dist/execution-placement.d.ts

@@ -8,6 +8,7 @@
  *    `execution` 位(`plugins/local-session-store.ts`)。处处 `execution` 限定,与同行 `placement_*`(委派分区)不同义;执行格只在 `placement_kind IS NULL` 的行上 ——
  *    委派分区行读作「不在」。
  *  · **读只有一只**:会话店的执行席 {@link ExecutionPlacementSeat.read}(一次行读:住客 + 格;行不在 / 委派分区行 ⇒ `undefined`;读故障抛,不吞成 `absent`)。
+ *    跨行的聚合也只有一只:设备店的绑定数 `countDeviceBindings`(writer(device, D) 的格数 = {@link boundDeviceOf} 的聚合;只交数,不交根 id)。
  *  · **写只按住客谓词** `(root, incarnation, owner) ∧ placement_kind IS NULL`:住客换了(删后重建,哪怕同一属主;local M10 窗内的认领)= 这一格不在 ⇒ 落空;
  *    0 行一律按住客复读分类({@link settledPlaceOutcome} / {@link settledMirrorOutcome} / {@link settledDeviceBindOutcome}),**永不对现住客重试**。
  *  · **没有的转换**:writer ↔ mirror、writer(L) → writer(L')(device 车道的换绑 writer(device, D) → writer(device, D') 除外,它有自己的语句与门)。
@@ -248,6 +249,8 @@ export declare class InMemoryExecutionPlacementSeat implements ExecutionPlacemen
     read(root: string): Promise<ExecutionPlacementReading | undefined>;
     place(root: string, occupant: SessionFace, cell: ExecutionWriterCell): Promise<PlaceOutcome>;
     markMirror(root: string, occupant: SessionFace): Promise<MarkMirrorOutcome>;
+    /** 绑定数(SQL 孪生 `countDeviceBindingsOn` 的对位,同一只判官):{@link boundDeviceOf} 读得出设备的格数。 */
+    countDeviceBindings(): number;
     /** device 首绑(SQL `placeDeviceStatement` / `bindDeviceStatement` 的对位):absent 或 writer(device, ∅) ⇒ writer(device, D)、rev 0。 */
     bindDevice(root: string, occupant: SessionFace, device: {
         readonly id: string;

package/dist/execution-placement.js

@@ -175,6 +175,13 @@ export class InMemoryExecutionPlacementSeat {
         this.rows.set(root, { occupant, cell: { role: "mirror" } });
         return { outcome: "mirrored" };
     }
+    countDeviceBindings() {
+        let bindings = 0;
+        for (const row of this.rows.values())
+            if (boundDeviceOf(row.cell) !== undefined)
+                bindings += 1;
+        return bindings;
+    }
     bindDevice(root, occupant, device, placedAt) {
         const settled = settledDeviceBindOutcome(root, this.rows.get(root), occupant, device.id);
         if (settled !== WRITABLE)

package/dist/fleet/drain-entry.d.ts

@@ -30,6 +30,7 @@
  * 纯类型 + 纯函数叶(值 import 只有 scope 读法叶与 run 行判词叶)。
  */
 import type { DrainReceipt, DrainRequest, EngineDraining } from "@sema-agent/settings-schema/fleet";
+import type { EngineLeaseFacts } from "../boot/engine-lease.js";
 /**
  * 引擎自铸的动作号 —— **一张表**(排空事实与回执里不来自请求体的全部拼法;请求体的 `actionId` 由调用方自取):
  *  · {@link ENGINE_DRAIN_CAUSES}:没有请求承载的排空成因(停止信号 / SIGHUP 升级 / 附着租约自退);
@@ -89,6 +90,8 @@ export interface DrainState {
     lastActivityAt?: () => number;
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
+    /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */
+    engineLease?: () => EngineLeaseFacts | undefined;
 }
 /** 排空盒子里的排空事实(三键齐才是;入口整组写,所以「缺一」只出现在手搭的夹具上)。 */
 export declare function drainingFactOf(s: Pick<DrainState, "draining" | "since" | "actionId" | "deadlineAt">): EngineDraining | undefined;

package/dist/hosted-posture.d.ts

@@ -65,6 +65,7 @@
  * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
+import { type PermissionMode } from "@sema-agent/core";
 /** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
  *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
 export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
@@ -123,6 +124,13 @@ export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceCon
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+/**
+ * **腿② 的词形入口** —— 一个模式词在这台部署上会不会开出它掀不开的写围栏:词的模式列开写面(引擎模式表本尊,
+ * `modePolicyOf(word).writeFace === "open"`,今天只有 `bypassPermissions`)∧ {@link taskWriteFaceRefusal} 答拒 ⇒ 拒因;否则 `undefined`。
+ * 读者两个,同是受理判官的托管一步(`permission-mode-admission.ts` 顶注「两口的调用形」):在飞 run 的切档口经判官本体;提交口与续跑重放存储体经装配期那一判
+ * (`boot/resolve-spec.ts`,问盖过章的词)。哪天 core 让第二个模式也开写面,两处当场跟上,不是再手抄一个模式词。
+ */
+export declare function permissionModeWriteFaceRefusal(word: PermissionMode | undefined, c: TaskWriteFaceInput): string | undefined;
 /**
  * **腿④** —— 这条请求要让 host shell 继承整份用户环境(`inheritEnv:"all"`),这台部署给不给?返回拒因;`undefined` = 放行。
  * 调用方只在值为 `"all"` 时问(`"scrub"` 就是缺省,任何部署都受理)。

package/dist/hosted-posture.js

@@ -1,5 +1,6 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { modePolicyOf } from "@sema-agent/core";
 export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
@@ -41,6 +42,9 @@ export function taskWriteFaceRefusal(c) {
         `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
+export function permissionModeWriteFaceRefusal(word, c) {
+    return word !== undefined && modePolicyOf(word).writeFace === "open" ? taskWriteFaceRefusal(c) : undefined;
+}
 export function taskInheritEnvRefusal(c) {
     if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;

package/dist/http/admission.js

@@ -2,11 +2,11 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
-import { autonomyModeFloor } from "../runtime-governance.js";
+import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -738,7 +738,7 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const { body: admitted, entry: entryMode } = stampSubmissionEntryMode(body, deps.config);
         const lease = deps.peerDesk.lease("fresh");
         try {
             const auth = await deps.authorize({ req, body: admitted });

package/dist/http/caller-trust.d.ts

@@ -3,8 +3,9 @@
  *
  * ## 律
  * 契约(settings-schema `SAFETY_MERGE_SPEC.permissions` 的成员阶梯)按**层的信任档**准入每个成员:`allow` 放宽免问面(`loosen`),要 `global`;`deny` / `ask` 只收紧,
- * 文件层最低档 `local` 就收。wire 上没有层 —— 提交体是合并后的扁平结果,层只在合并端(cli 本地)存在;自报一个层 / 作者位不可验(引擎侧已拒立这种位)。所以本服务
- * 的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源 + 登录令牌的 scope 角色推,调用方说什么都不改档。
+ * 文件层最低档 `local` 就收。准入不读层:提交体是合并后的结果,层只在合并端(cli 本地)存在;deny / ask 条目可以带出处层(`{ rule, layer }`),但那个层只选这条规则的
+ * `/` 读在哪个根(`permission-rule-list.ts` 的 `layerRuleRoot`),自报的层不可验、**不进本判**。所以本服务准入的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源
+ * + 登录令牌的 scope 角色推,调用方说什么(含条目上的层)都不改档。
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;

package/dist/http/caller-trust.js

@@ -1,6 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
+import { ruleTextOf } from "../permission-rule-list.js";
 import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
@@ -34,7 +35,7 @@ function effectiveRuleTables(t) {
         for (const member of membersOf("permissions")) {
             const entries = t.permissions[member];
             if (entries !== undefined)
-                out.push({ member, field: `settings.permissions.${member}`, entries, source: "settings" });
+                out.push({ member, field: `settings.permissions.${member}`, entries: entries.map(ruleTextOf), source: "settings" });
         }
     }
     if (t.skills !== undefined && t.userInvokedSkills !== undefined) {

package/dist/http/dispatch.js

@@ -138,6 +138,10 @@ export function createDispatch(ctx) {
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...healthDrainingKeys(signal),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
+                ...(() => {
+                    const lease = deps.drainState?.engineLease?.();
+                    return lease ? { engineLease: { lingerMs: lease.lingerMs, tickMs: lease.tickMs } } : {};
+                })(),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,

package/dist/http/live-frame.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `POST /v1/tasks/stream`(活流腿:新提交、同键重放、在飞合流的跟随方)的**唯一**帧写口。
+ *
+ * 律(一条):这条流上的每一帧都是 `[id: <eventId>\n]event: <type>\ndata: <json>\n\n`,事件名 = 载荷的 `type`。
+ * 心跳是同一只写口写的 `event: heartbeat` + `data: {}`。与 durable 尾(`http/sse-log.ts`)、sdk 的 `toSseResponse` 中继同形。
+ *
+ * `id:` 行(契约 §0.6):载荷带非空 string `eventId` 才发,值逐字 = `eventId`;没有就不发,EventSource 沿用上一游标 ——
+ * 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。`id:` 行是**每帧唯一**的续流游标,所以载荷的 `eventId` 必须是**本帧
+ * 自己的**身份(server 自铸帧的唯一铸点:`trace/model-segment.ts` 的 `reasoningSegmentEventId`)。三道门各管一段:
+ * {@link LiveFrame} 管「铸点说得出这两个键的型」;本函数的运行期判据管「真的是」(通体 `Record<string, unknown>` 的
+ * 构造器返回值进得来 —— `null` 读 `.length` 会把整条流摔掉、数组会被强转成一枚编出来的游标);`test/live-sse-cursor.test.ts`
+ * 的规则式全流判据管「同一条流内不重复」。
+ */
+import type { ServerResponse } from "node:http";
+/** 活流帧的载荷型:`type` 是事件名(必填,型说得出口);`eventId` 在场即**本帧自己的**续流游标。其余键由各自铸点白名单。 */
+export type LiveFrame = {
+    readonly type: string;
+    readonly eventId?: string;
+} & Record<string, unknown>;
+/** 写一帧。`type` 不是非空串 = 铸点违约(型门之外漏进来的通体记录),响亮抛 —— 写一行编出来的事件名是撒谎,不写事件名就回到两只形。 */
+export declare function writeLiveFrame(res: ServerResponse, payload: LiveFrame): void;
+/** 心跳:真帧,不是 SSE 注释(逐帧解析的 BFF 会丢注释行,下游看到的是一段零帧的窗)。没有监听心跳的 EventSource 客户端忽略它。 */
+export declare function writeLiveHeartbeat(res: ServerResponse): void;
+//# sourceMappingURL=live-frame.d.ts.map

package/dist/http/live-frame.js

@@ -0,0 +1,16 @@
+import { liveToolEndForBacklog } from "../trace/tool-output-media.js";
+function frameBytes(event, data, anchor) {
+    const idLine = typeof anchor === "string" && anchor.length > 0 ? `id: ${anchor}\n` : "";
+    return `${idLine}event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+}
+export function writeLiveFrame(res, payload) {
+    const name = payload.type;
+    if (typeof name !== "string" || name.length === 0)
+        throw new TypeError(`live SSE frame without a string type: ${JSON.stringify(name)}`);
+    const frame = name === "tool_end" ? liveToolEndForBacklog(payload, res.writableLength) : payload;
+    res.write(frameBytes(name, frame, payload.eventId));
+}
+export function writeLiveHeartbeat(res) {
+    res.write(frameBytes("heartbeat", {}, undefined));
+}
+//# sourceMappingURL=live-frame.js.map

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -8,7 +8,9 @@
  * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
  * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
  *
- * ## 规则(三层,与 operator 面既有层序逐字同序)
+ * ## 规则(三层,与 operator 面既有层序逐字同序;另有本服务自铸的一只,先判)
+ *  ⓪ 本服务的抹除店护栏拒 {@link MemoryErasureStoreUnjudged} —— 409 `memory.erasure_store_unjudged`(抹除落到部署的店之外的那只店:本部署此刻判不了
+ *     同一个 `requestId` 跨店的幂等;什么都没删)。文案按受众,同下一节的规则;
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
  *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 [ref])/ `memory.scope_home_not_directory`(core 7.44.0 [ref])—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);

package/dist/http/memory-compliance-failure-reply.js

@@ -3,6 +3,7 @@ import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
+import { MemoryErasureStoreUnjudged } from "../memory-operator-faces.js";
 function sentCoreCode(res, coreCode, coreMessage, audience) {
     switch (coreCode) {
         case "config.memory_erasure_request":
@@ -42,6 +43,10 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 export function sentMemoryComplianceFailure(res, err, audience, logger) {
+    if (err instanceof MemoryErasureStoreUnjudged) {
+        sendError(res, 409, "memory.erasure_store_unjudged", textFor(audience, err.message, "session memory erasure refused — this erasure reaches memory kept in this deployment's second memory store, which this build does not erase from (an erasure requestId is judged on the deployment's main store only); nothing was erased — it becomes available with the next engine update, or ask the operator"));
+        return true;
+    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
         return true;

package/dist/http/memory-layer-reply.d.ts

@@ -0,0 +1,30 @@
+/**
+ * 记忆动词的**层座**与「这次请求落不到一只记忆店」的拒 —— 两件的 HTTP 半场,唯一一处。
+ *
+ * ## 规则(店的那一半在 `src/memory-scope-stores.ts`)
+ * 一次记忆请求只落一只店:请求点名的层住的那一只;不点名层的动词(条目 id / 店级账本)答在本部署点名的层与部署的店共处的那一只上,
+ * 两只店分住时不猜、拒。会话 id 的两口不点名层时不拒:记忆状态读本部署的每一只店再折成一份,按会话抹除落部署的店(`memory-operator-faces.ts`)。
+ * 不点名层的动词因此多一个可选的**层座** `scope`:GET 口在查询串(`?scope=<层键>`),POST 口在体里(`"scope": "<层键>"`);
+ * 点名的层只用来定店,动词本身的语义不变。点名层的动词(导出 / 导入 / 外源列表 / 整理 / operator 抹除的 `select.scope` 与 `expectedScopes`)
+ * 本来就点名,不加座。
+ *
+ * ## 层座的读法({@link readLayerSeat})
+ * 缺席 ⇒ 没点名;在场 ⇒ 必须是非空串,否则 400 `request.field_invalid`、面一次都不调(空串与非串不是「没点名」—— 静默当缺席会把请求答在
+ * 另一只店上)。
+ *
+ * ## 拒的映射({@link sentMemoryLayerRefusal})
+ * `MemoryLayerRefusal` ⇒ 400 `request.memory_layer`:请求可以改对(点名层 / 按店拆成几次),服务器没坏,也不是盘形问题。
+ * 文案按受众分(与 `memory-compliance-failure-reply.ts` 同一条规则):operator ⇒ 原句(点名部署配置的层、哪几层住在哪只店 —— 运维要的就是它);
+ * 会话所有者 ⇒ 固定一句(只说怎么办),原句交 `withheld` 落运维行 —— 部署配置的层键不是这个受众的材料。
+ */
+import type { ServerResponse } from "node:http";
+import type { MemoryLayerSeat } from "../memory-operator-faces.js";
+import type { MemoryComplianceAudience } from "./memory-compliance-failure-reply.js";
+/**
+ * 层座:`present` = 键在不在(查询串 `has` / 体 `in`),`value` = 它的值。缺席 ⇒ `undefined`;非空串 ⇒ `{ layer }`;
+ * 其余 ⇒ 已答 400 `request.field_invalid`,返回 `null`(调用方 `return`)。
+ */
+export declare function readLayerSeat(res: ServerResponse, present: boolean, value: unknown): MemoryLayerSeat | undefined | null;
+/** `err` 是本服务的层拒 ⇒ 400 `request.memory_layer`(文案按受众),返回 true;否则 false,一个字节都不写。 */
+export declare function sentMemoryLayerRefusal(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+//# sourceMappingURL=memory-layer-reply.d.ts.map

package/dist/http/memory-layer-reply.js

@@ -0,0 +1,24 @@
+import { MemoryLayerRefusal } from "../memory-scope-stores.js";
+import { sendError } from "./send.js";
+export function readLayerSeat(res, present, value) {
+    if (!present)
+        return undefined;
+    if (typeof value === "string" && value.length > 0)
+        return { layer: value };
+    sendError(res, 400, "request.field_invalid", "scope must be a non-empty memory layer key when present — it names the layer whose memory store this request is answered on");
+    return null;
+}
+export function sentMemoryLayerRefusal(res, err, audience) {
+    if (!(err instanceof MemoryLayerRefusal))
+        return false;
+    switch (audience.kind) {
+        case "operator":
+            sendError(res, 400, "request.memory_layer", err.message);
+            return true;
+        case "session_owner":
+            audience.withheld(err.message);
+            sendError(res, 400, "request.memory_layer", "the memory store this request reaches cannot be told — the `scope` in the request is not a memory layer this deployment can read, or this deployment's own memory layer configuration cannot be read; resend without `scope` (or with a readable layer), or ask the operator");
+            return true;
+    }
+}
+//# sourceMappingURL=memory-layer-reply.js.map