@sema-agent/server 7.139.0 → 7.141.0

package/dist/approval-card.d.ts

@@ -149,6 +149,15 @@ export interface ReadRuleOffer {
  * 缺席(`undefined`)= 没有提议,答空、不计。展示帽(条数、成员前缀、扫描窗)、脱敏与截长归调用方 —— 它们是各腿的展示纪律,不是读法。
  */
 export declare function readRuleOfferList(raw: unknown): readonly ReadRuleOffer[];
+/**
+ * 一份(已解码的)规则提议列表里,**带着无 `kind` 存量成员**的 batch offer 有几只 —— 判官是 core `readRuleOffers` 给每只读出的 offer 打的 `kindlessForm` 记号
+ * (「这一只 batch 里至少一个成员是经无 `kind` 的存量形读的」;与 {@link readRuleOfferList} 同一只读者,不是本仓自己再写一遍「成员没有 `kind` 键」)。
+ * 起服普查(`approval-batch-census.ts`)用它给存量行记数:读者那条存量臂退役的前提是「零行还靠它读」。
+ *
+ * **只数,不落任何痕迹**:读不出的元素(`dropped`)与整只值不是列表(`problem`)是 {@link readRuleOfferList} 的计数口径(`server.rule-offers.offer-dropped`),这里不重复记,
+ * 它们也不是「靠存量臂读出来」的 —— 一个读不出的无 `kind` 成员(缺文本键)退役前后同样被丢,不改变任何一行的读法,所以不计入。
+ */
+export declare function countKindlessBatchOffers(raw: unknown): number;
 /**
  * 卡面/帧面共用的 offer **投影型**(= {@link RuleOfferSchema} 的输出形)。判别位 `kind` 上闭集,
  * 消费端(SDK/cli 渲染)按 core 契约分臂;`batch.rules` 成员是判别联合(`command` | `directoryRead`),
@@ -441,11 +450,13 @@ export interface AskClassPair {
  * bypass 姿态下按 `ask_rule` / `hook` 照问的那条壳规则无从落地。缺席 = 老行(core 7.5.0 之前 park 的)/ 集外词(计 [ref] tag)。
  * [ref] ②(core 7.37.0 [ref])第六 / 七位 `askClass` / `classes`:这一问的类对(经 {@link readAskClassPair};两位同在同缺,与活卡帧 / 呈卡帧的卡
  * 同名同义同值)—— durable 审批席按类答的依据。缺席 = 老行(core 7.37.0 之前 park 的,续跑不补)/ 读不出(计 [ref] tag)。
- * [ref](core 7.51.0 [ref])第八位 `boundGrantAbsence`:这张卡为什么没有授予绑定摘要(经 {@link readClosedWordSeat};与活卡帧 / inbox 行同名同义同值)——
- * `not_bindable` = 这一问不绑任何授予(「本会话放行」可按工具记)。缺席 = 技能卡(带摘要;摘要与清单、成因词三位走另一只投影 {@link skillCardFacts},见其顶注)/ 7.51.0 之前停驻的行(core inbox 投
- * `unreadable`,队列行如实缺席)/ 集外词(计 [ref] tag)。
+ * [ref](core 7.51.0 [ref])第八位 `boundGrantAbsence` / [ref] 起与 `boundGrantDigest` 合成**一臂**:这张卡的授予绑定 —— `tool_approval` 行**恰带**两者之一,
+ * 经本仓唯一读口 `grantBindingOf` 读停驻行、`grantBindingArm` 投回(`standing-answer-grant.ts`;与 core 投 inbox 行的那一臂逐形同值):摘要是串 ⇒ 摘要;
+ * 否则摘要键不在且行上的词是闭集成员 ⇒ 那个词;否则(7.51.0 之前停驻的行两者都不说 / 集外词 / 摘要在却不是串)⇒ `unreadable`。`not_bindable` = 这一问不绑任何授予
+ * (「本会话放行」可按工具记)。摘要读自停驻行本身 —— 不靠整行的检查点摘要,所以 SQL 腿那一次整行读失败也不丢这一臂;要 core 校验的清单与成因词走
+ * 另一只投影 {@link skillCardFacts}。
  */
-export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "ruleOffersAbsence" | "mandated" | "mandate" | "origin" | "askClass" | "classes" | "boundGrantAbsence">;
+export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "ruleOffersAbsence" | "mandated" | "mandate" | "origin" | "askClass" | "classes" | "boundGrantDigest" | "boundGrantAbsence">;
 /**
  * [ref] —— park 行事实的**唯一投影**(`pendingAction` 是寄存行上 core 铸的那一只,读自持久层 ⇒ `unknown`)。
  *
@@ -465,7 +476,8 @@ export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "rule
  *    park 孪生座与同步座是 core 同一个 factory 铸的同一闭集,不另起第二份词表;
  *  · `mandate` / `origin` —— 经 {@link readClosedWordSeat}(一座一只 core 成员筛 `isPersistedRuleMandate` / `isAskOrigin`,与 core
  *    `summarizeCheckpoint` 投 inbox 行时是同一只筛 ⇒ 两条耐久读面对同一张行同答;集外词读作缺席 + 计同一个集外 tag);
- *  · 缺席 ≠ false:各位都只在「真 / 有词」时在场,消费端读**在场**。
+ *  · 授予绑定([ref])—— 不是「在场才带」的一位,是恰一臂:`grantBindingArm(grantBindingOf(行))`,读法见 {@link ParkRowFacts} 顶注;
+ *  · 缺席 ≠ false:其余各位都只在「真 / 有词」时在场,消费端读**在场**。
  *
  * 🔴 **这是展示/分诊投影,不是权限判据**(core 对两位的定性都是 display metadata:「the resume belts keep reading
  * the gate's own bit」)。本投影对「在场却读不出」的方向是**缺席**(卡上少一行 ≪ 卡上出现生词);一条要从
@@ -474,28 +486,31 @@ export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "rule
  */
 export declare function parkRowFacts(stored: unknown): ParkRowFacts;
 /**
- * 🔴 **技能卡三位的唯一投影**:授予绑定摘要 `boundGrantDigest`、它哈希的清单 `boundGrants`、分类器没给判词的成因 `classifierNoRuling` ——
+ * 🔴 **技能卡两位的唯一投影**:授予绑定摘要哈希的那一份清单 `boundGrants`、分类器没给判词的成因 `classifierNoRuling` ——
  * 助手收件箱行(`GET /v1/assistant/inbox`)、运维队列行(`GET /v1/approvals` 的 `pending[]`)、`/v1/approvals/stream` 的 `pending` 帧三张停驻读面
  * **经这一只函数**投它们。同一张停驻的技能卡于是三面同一份字节:运维从队列决这张卡时,看得到批准它还授予了什么。
+ * (摘要本身 `boundGrantDigest` 不在这里:它是授予绑定那一臂的一半,队列两面经 {@link parkRowFacts} 从停驻行读 —— core 对串摘要也是原样回显,值相同;
+ * [ref] 起这样分,是为了那一臂不依赖整行的检查点摘要读得到读不到。)
  *
- * **输入恒是 core 的检查点摘要**({@link CoreCheckpointSummary},`summarizeCheckpoint` 的产物)—— 三位的校验点单点在 core:摘要是串才回显;清单**只在哈希等于摘要时**才发布
+ * **输入恒是 core 的检查点摘要**({@link CoreCheckpointSummary},`summarizeCheckpoint` 的产物)—— 两位的校验点单点在 core:清单**只在哈希等于摘要时**才发布
  * (「never a list beside a digest that binds another」—— 一份与摘要对不上的清单会让批准人看着一份清单、批的却是另一份绑定);成因词只在闭集成员时回显。
- * 本仓**不重算哈希**(core 的 `boundInputHashOf` 不在公开导出面上,清单校验读口 `readBoundBinding` 同样不导出),所以**不许**拿寄存行 `pendingAction` 上的原值直接投 ——
- * 原值上的清单是未经哈希校验的(这正是三位此前不上队列行的原因,见 `trace/core-keyset-guard.ts` ⑧b 记账的旧注)。两只店各自拿到「这一行的摘要」的办法不同
- * (LOCAL 孪生本来就握着 core 对同一行投的摘要;SQL 孪生对带三位之一的行读一次该行再调 core 的 `summarizeCheckpoint`,见 `plugins/checkpoint-store-sql.ts`),
+ * 本仓**不重算哈希**(core 的 `boundInputHashOf` 不在公开导出面上,清单校验读口 `readBoundBinding` 同样不导出),所以**不许**拿寄存行 `pendingAction` 上的原清单直接投 ——
+ * 原值上的清单是未经哈希校验的(这正是它此前不上队列行的原因,见 `trace/core-keyset-guard.ts` ⑧b 记账的旧注)。两只店各自拿到「这一行的摘要」的办法不同
+ * (LOCAL 孪生本来就握着 core 对同一行投的摘要;SQL 孪生对可能带两位之一的行读一次该行再调 core 的 `summarizeCheckpoint`,见 `plugins/checkpoint-store-sql.ts`),
  * 但投影只有这一只:OMIT 契约 —— 缺席即缺席,恒不铸 `undefined` 值的键。
  *
  * `boundGrants` 是**部署文本**(技能名、清单条目):本函数不脱敏、不转义,与收件箱行逐字同口径 —— 渲染按上下文转义是客户端的事(契约同句)。
- * 三位都不进 `card_json`(同步路铸点,另一条纪律)。
+ * 两位都不进 `card_json`(同步路铸点,另一条纪律)。
  *
- * 🚧 清单校验读口 `readBoundBinding` 若成为 core 的公开导出,SQL 孪生那一次整行读与 {@link parkRowCarriesSkillCardFacts} 一并退役:`parkRowFacts` 直接读寄存行原值经 core 的读口投三位。
+ * 🚧 清单校验读口 `readBoundBinding` 若成为 core 的公开导出,SQL 孪生那一次整行读与 {@link parkRowCarriesSkillCardFacts} 一并退役:`parkRowFacts` 直接读寄存行原值经 core 的读口投两位
+ * (`grantBindingOf` 也改成它的薄包装 —— 那时 core 是绑定读法的唯一属主)。
  */
-export type SkillCardFacts = Pick<CoreCheckpointSummary, "boundGrantDigest" | "boundGrants" | "classifierNoRuling">;
+export type SkillCardFacts = Pick<CoreCheckpointSummary, "boundGrants" | "classifierNoRuling">;
 export declare function skillCardFacts(summary: SkillCardFacts): SkillCardFacts;
 /**
- * 这一行的寄存行(`pendingAction`,读自持久层 ⇒ `unknown`)**有没有可能**让 core 的摘要投出三位里的任何一位 —— 只回答「值不值得为它取一次摘要」,**不投值**:
- * `tool_approval` 臂上摘要字段是串(core 只在这时回显摘要与清单),或成因词键在场(是不是闭集成员由 core 的摘要判)。判错的方向只有一个 —— 多取一次摘要(摘要读数为空),
- * 绝不漏取:摘要字段不是串 ⇒ core 的摘要既无摘要也无清单;成因词键不在 ⇒ 无成因词 —— 两者都不满足的行,摘要里这三位恒空。普通卡(绝大多数行)因此零额外读。
+ * 这一行的寄存行(`pendingAction`,读自持久层 ⇒ `unknown`)**有没有可能**让 core 的摘要投出两位里的任何一位 —— 只回答「值不值得为它取一次摘要」,**不投值**:
+ * `tool_approval` 臂上摘要字段是串(core 只在这时回显清单),或成因词键在场(是不是闭集成员由 core 的摘要判)。判错的方向只有一个 —— 多取一次摘要(摘要读数为空),
+ * 绝不漏取:摘要字段不是串 ⇒ core 的摘要没有清单;成因词键不在 ⇒ 无成因词 —— 两者都不满足的行,摘要里这两位恒空。普通卡(绝大多数行)因此零额外读。
  * 只读键在不在 / 是不是串,不读值的内容,所以不需要 {@link readClosedWordSeat} 那样的计数。
  */
 export declare function parkRowCarriesSkillCardFacts(stored: unknown): boolean;
@@ -556,12 +571,12 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         question: "question";
         plan: "plan";
         skill: "skill";
-        shell: "shell";
         workflow: "workflow";
-        fetch: "fetch";
-        "file-write": "file-write";
         "file-edit": "file-edit";
+        "file-write": "file-write";
         "notebook-edit": "notebook-edit";
+        shell: "shell";
+        fetch: "fetch";
         generic: "generic";
     }>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
@@ -710,12 +725,12 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             question: "question";
             plan: "plan";
             skill: "skill";
-            shell: "shell";
             workflow: "workflow";
-            fetch: "fetch";
-            "file-write": "file-write";
             "file-edit": "file-edit";
+            "file-write": "file-write";
             "notebook-edit": "notebook-edit";
+            shell: "shell";
+            fetch: "fetch";
             generic: "generic";
         }>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;

package/dist/approval-card.js

@@ -4,6 +4,7 @@ import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { readApprovalCard } from "./approval-content-kind.js";
 import { capText } from "./caller-text-echo.js";
+import { grantBindingArm, grantBindingOf } from "./standing-answer-grant.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
@@ -61,6 +62,10 @@ export function readRuleOfferList(raw) {
     reading.dropped.forEach((d) => recordOfferDropped(d.problem, d.index));
     return reading.offers.map(withDetailSeatBounded);
 }
+export function countKindlessBatchOffers(raw) {
+    const reading = readRuleOffers(raw);
+    return "problem" in reading ? 0 : reading.offers.filter((o) => o.kindlessForm === true).length;
+}
 function withoutOverCapDetailSeat(item, index) {
     if (typeof item !== "object" || item === null)
         return item;
@@ -335,7 +340,6 @@ export function parkRowFacts(stored) {
     const mandate = readClosedWordSeat(pendingAction, "mandate");
     const origin = readClosedWordSeat(pendingAction, "origin");
     const askClassPair = readAskClassPair(pendingAction);
-    const boundGrantAbsence = readClosedWordSeat(pendingAction, "boundGrantAbsence");
     return {
         ...(readParkRowTrueSeat(pendingAction, "requiresRealApproval") ? { requiresRealApproval: true } : {}),
         ...(readParkRowTrueSeat(pendingAction, "mandated") ? { mandated: true } : {}),
@@ -343,12 +347,11 @@ export function parkRowFacts(stored) {
         ...(origin !== undefined ? { origin } : {}),
         ...(ruleOffersAbsence !== undefined ? { ruleOffersAbsence } : {}),
         ...(askClassPair ?? {}),
-        ...(boundGrantAbsence !== undefined ? { boundGrantAbsence } : {}),
+        ...grantBindingArm(grantBindingOf(pendingAction)),
     };
 }
 export function skillCardFacts(summary) {
     return {
-        ...(summary.boundGrantDigest !== undefined ? { boundGrantDigest: summary.boundGrantDigest } : {}),
         ...(summary.boundGrants !== undefined ? { boundGrants: summary.boundGrants } : {}),
         ...(summary.classifierNoRuling !== undefined ? { classifierNoRuling: summary.classifierNoRuling } : {}),
     };

package/dist/approval.d.ts

@@ -95,6 +95,21 @@ export declare function buildNoResponderBootWarns(input: {
         hint: string;
     };
 }>;
+/**
+ * 单用户 turnkey 起服行 `tool_policy_single_user_default` 的**载荷**(纯数据 ⇒ `build*`;打不打、用哪只 logger 归 stage-07 的调用点,
+ * 打的判据是 {@link singleUserAutoAcceptBaselineApplies})。文案只此一处。
+ *
+ * 它说的是**部署工具策略层**的姿势:这一层铺的是一条在场的、看效果的 allow-all 基线(`createApprovalBaselinePolicy(config, { kind: "absent" })`),
+ * 好让引擎的「写手无裁决」告警不再响 —— 这一层自己不问也不拒。它**不是逐调用的放行**:每次调用仍由本次运行的权限模式与引擎写门裁(`auto` 下 shell 的写 / 删
+ * 照样出问并交分类器)。修前这一句写成「ALL write/hand/MCP tool surfaces auto-allowed」,读者(含取证)把它读成逐调用放行,与运行期读数相反。
+ */
+export declare function buildSingleUserDefaultPostureNotice(): {
+    event: "tool_policy_single_user_default";
+    fields: {
+        posture: string;
+        tighten: string;
+    };
+};
 /**
  * [ref] 件⑩ —— **center 的 `forceDurableGate` 在无 checkpoint 店的部署上会静默 inert**,补一条 boot 披露。
  *

package/dist/approval.js

@@ -53,6 +53,16 @@ export function buildNoResponderBootWarns(input) {
     }
     return out;
 }
+export function buildSingleUserDefaultPostureNotice() {
+    return {
+        event: "tool_policy_single_user_default",
+        fields: {
+            posture: "deployment tool-policy baseline is allow-all — this layer asks no question and refuses nothing of its own (core's per-surface UNGATED enumeration is suppressed for single-user turnkey). " +
+                "It is not a per-call verdict: each call is still judged by the run's permission mode and the engine's write gate — a shell write or delete can still be asked, or handed to the classifier under auto",
+            tighten: "APPROVAL_REQUIRE / AUTONOMY / commandPolicy (re-surfaces + gates specific surfaces)",
+        },
+    };
+}
 export function buildForceDurableGateInertNotice(input) {
     if (!input.entitlementSourceWired || input.checkpointStorePresent)
         return undefined;

package/dist/audit.d.ts

@@ -1,6 +1,7 @@
 import { type SessionPlacementRecord, type StoredPromptEpoch } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
+import { type LocalSessionRows } from "./plugins/local-session-window.js";
 /**
  * Audit view of a session = its **current context** (the live messages + the last compaction's
  * summary), i.e. the floor-bounded window — never the full raw transcript. This matches the
@@ -76,10 +77,11 @@ export declare function buildSessionAudit(pool: Pool, sessionId: string, handles
  *  audit face was TiDB-only and a PG/local deployment 404'd the whole web session area. */
 export declare function buildSessionAuditPg(pool: PgPool, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
 /** The LOCAL (File) leg — web session area on DB_BACKEND=local: the same view over `LocalSessionWindow.wake`
- *  (`plugins/local-session-window.ts`). All three legs read one way — a bounded window that carries the epoch anchor below its
+ *  (`plugins/local-session-window.ts`), read from the local session store's rows (its row projection and its log export — the view's
+ *  `createdAt` is the row's, as on the SQL twins). All three legs read one way — a bounded window that carries the epoch anchor below its
  *  floor — and on every backend that is what the run reads: the SQL twins' run wakes the same window; the local run wakes the whole
  *  tree, and the local window is cut from that tree's branch, with the anchor walking the branch below the floor. */
-export declare function buildSessionAuditLocal(root: string, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
+export declare function buildSessionAuditLocal(rows: LocalSessionRows, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
 /**
  * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
  * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;

package/dist/audit.js

@@ -34,8 +34,8 @@ export async function buildSessionAudit(pool, sessionId, handles) {
 export async function buildSessionAuditPg(pool, sessionId, handles) {
     return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId, handles);
 }
-export async function buildSessionAuditLocal(root, sessionId, handles) {
-    return auditFromStorage(await LocalSessionWindow.wake(root, sessionId), sessionId, handles);
+export async function buildSessionAuditLocal(rows, sessionId, handles) {
+    return auditFromStorage(await LocalSessionWindow.wake(rows, sessionId), sessionId, handles);
 }
 async function auditFromStorage(storage, sessionId, handles) {
     if (!storage)

package/dist/bench/s1/live-deps.js

@@ -6,7 +6,7 @@ import { withUnattendedLeg } from "../../unattended-permission-mode.js";
 import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
 import { RemoteContainerExecutionEnv } from "../../plugins/remote-env-e2b.js";
-import { E2B_SANDBOX_HOME } from "../../execution-lane-caps.js";
+import { buildLaneHomeClaim } from "../../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../../approval.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
 import { makeRepairOracle } from "./repair-oracle-adapter.js";
@@ -68,9 +68,10 @@ const sh = (env) => async (cmd) => {
     return { code: r.value.exitCode, out: (r.value.stdout + r.value.stderr).trim() };
 };
 async function provisionSandbox(rt, role, cellId) {
+    const homeSeat = rt.e2bTemplate ? {} : buildLaneHomeClaim({ remoteExec: { provider: "e2b" } });
     const env = new RemoteContainerExecutionEnv({
         apiKey: rt.e2bApiKey,
-        homeDir: E2B_SANDBOX_HOME,
+        ...homeSeat,
         ...(rt.e2bTemplate ? { template: rt.e2bTemplate } : {}),
         timeoutMs: rt.sandboxTimeoutMs ?? 600_000,
         metadata: { s1Cell: cellId, s1Role: role },

package/dist/bench/s1/row.d.ts

@@ -34,8 +34,11 @@ export type { RunRecord, OracleVerdicts, DeliveryDecision, CoreStatsSubset, Inte
 /** The schema version stamped into every row — the field-contract handshake with core's metric tool. */
 export declare const S1_SCHEMA_VERSION: "s1.v1";
 export type S1SchemaVersion = typeof S1_SCHEMA_VERSION;
-/** The INSTALLED core version, read from node_modules at load(SPEC §0 provenance-honesty——接入审计 L16:
- *  硬钉 "1.111.0" 在 core 升到 1.258.x 后让 harness 每行 meta.coreVersion 输出错误溯源;动态读=永不再漂)。 */
+/** The INSTALLED core version (SPEC §0 provenance-honesty — a hard-pinned "1.111.0" once drifted past a core upgrade and stamped every row's
+ *  `meta.coreVersion` with the wrong provenance). Read from core's own root export `CONTRACT_KIT_ENGINE_VERSION` — the engine's
+ *  `package.json` version, resolved by the engine itself ("unknown" only under a bundler that severed the module from its package root) —
+ *  not by walking the installed package's directory from here (the dependency-direction gate, `test/dependency-direction-gate.test.ts` R2,
+ *  bans reading core's install tree by file-system path). */
 export declare const S1_CORE_VERSION: string;
 /** The arm tag as emitted on the wire (lowercase — the s1.v1 contract value; the internal `Arm` is uppercase). The
  *  harness emits a SUBSET of core's `RunRecord["arm"]` (which also carries "sup-vf", an S1b ablation S1 does not run). */

package/dist/bench/s1/row.js

@@ -1,27 +1,7 @@
 import { buildReport, trulyCorrect, } from "@sema-agent/core/bench";
-import { createRequire } from "node:module";
-import { readFileSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { CONTRACT_KIT_ENGINE_VERSION } from "@sema-agent/core";
 export const S1_SCHEMA_VERSION = "s1.v1";
-export const S1_CORE_VERSION = (() => {
-    try {
-        const require = createRequire(import.meta.url);
-        let dir = dirname(require.resolve("@sema-agent/core"));
-        for (let i = 0; i < 6; i++) {
-            const pj = join(dir, "package.json");
-            if (existsSync(pj)) {
-                const parsed = JSON.parse(readFileSync(pj, "utf8"));
-                if (parsed.name === "@sema-agent/core" && parsed.version)
-                    return parsed.version;
-            }
-            dir = dirname(dir);
-        }
-        return "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-})();
+export const S1_CORE_VERSION = CONTRACT_KIT_ENGINE_VERSION;
 export function armTag(arm) {
     switch (arm) {
         case "SOLO":

package/dist/boot/adoption.js

@@ -5,7 +5,7 @@ export async function runAdoptionBootScan(ctx) {
         return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [] };
     const runner = createAdoptionRunner({
         store,
-        dialect: ctx.backend?.kind === "pg" ? "pg" : "tidb",
+        dialect: ctx.backend?.kind === "pg" ? "pg" : "mysql",
         now: ctx.now ?? Date.now,
         logger: ctx.logger,
     });

package/dist/boot/device-lane.d.ts

@@ -18,6 +18,7 @@ import type { DeviceStore } from "../device-store.js";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import { type DeviceWsHub } from "../device-ws-hub.js";
 import type { ServiceConfig } from "../config.js";
+import type { DeviceRelayDeclaration } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
@@ -75,4 +76,14 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * 抛而不是 warn:降级的代价由用户承担(他以为命令跑在自己机器上、看到的却是云上一个空目录的结果)。
  */
 export declare function assertDeviceLaneWired(isDeviceLane: boolean, lane: DeviceLane | undefined, hasFactory: boolean): void;
+/**
+ * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填,缺席拒起 —— `config.ts` `parseDeviceRelayUrlEnv`;
+ * 起不起服不随表里有几条绑定变)。
+ *
+ * 字面 `none` = 运维声明「设备拨本引擎自己的地址 + `wsPath`」。此刻根会话行上若有设备绑定(writer(device, D) 的格),这些会话的设备从此只能拨那个入口 ——
+ * 撤中继声明的回滚序是先恢复引擎自己的入口、再写 `none`,本行让运维看见押在那个入口上的绑定有几条:`device_relay_withdrawn_with_bindings { bindings }`
+ * (只交数,不交会话 id)。绑定 0 ⇒ 不响。URL ⇒ 不读表(设备读能力面拨它,与绑定数无关)。
+ * 读数 = 设备店的绑定数(唯一读法 `boundDeviceOf` 的聚合);读故障原样抛 ⇒ 起服失败(不折成 0 —— 折 0 就是在有绑定时不响)。
+ */
+export declare function noteDeviceRelayBindings(relay: DeviceRelayDeclaration, store: Pick<DeviceStore, "countDeviceBindings">, logger: Pick<Logger, "warn">): Promise<void>;
 //# sourceMappingURL=device-lane.d.ts.map

package/dist/boot/device-lane.js

@@ -56,4 +56,20 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
             "an assembly bug, not a configuration one — refusing to start rather than silently execute in-process (#157)");
     }
 }
+export async function noteDeviceRelayBindings(relay, store, logger) {
+    switch (relay.kind) {
+        case "url":
+            return;
+        case "none": {
+            const bindings = await store.countDeviceBindings();
+            if (bindings > 0)
+                logger.warn("device_relay_withdrawn_with_bindings", { bindings });
+            return;
+        }
+        default: {
+            const unknownKind = relay;
+            throw new Error(`noteDeviceRelayBindings: no arm for ${JSON.stringify(unknownKind)}`);
+        }
+    }
+}
 //# sourceMappingURL=device-lane.js.map

package/dist/boot/engine-lease.d.ts

@@ -130,6 +130,29 @@ export interface EngineLeaseExitReport {
     /** 成孤儿到自退之间隔了多久;非孤儿退出时键缺席(不编 0)。 */
     orphanedForMs?: number;
 }
+/**
+ * [ref] —— 租约窗的 wire 读数(`GET /health` 的 `engineLease`;壳持租约的触点节拍据此定,别处起的短窗引擎不再让第二句失败)。
+ *
+ * ## 报的是什么
+ *  · `lingerMs` = 本腿**会执行的最短静默窗**:父还活着的窗({@link EngineLeaseDeps.lingerMs})与孤儿窗({@link EngineLeaseOrphanLane.lingerMs},只在看门狗装了时存在)取小。
+ *    取**最短**而不是「此刻生效」:此刻生效的窗在父死那一拍从 owned 窗掉到孤儿窗,按旧读数定节拍的壳会在下一次读 `/health` 之前被拆台;
+ *    最短窗是配置的性质、不随状态变,壳的触点只要比它密,在任何状态下都留得住引擎。
+ *  · `tickMs` = 自退检查的采样拍。自退发生在**生效窗**满之后、至多再晚一拍(顶注 8);生效窗恒 ≥ `lingerMs`(`lingerMs` 是各窗里最短的一个),所以触点比 `lingerMs` 密 ⇒ 在任何状态下都先于自退。
+ *    读数**不预言**自退时刻:父还活着时生效的是 owned 窗,自退只会更晚。
+ *
+ * ## 一源
+ * 与租约腿自己的行为同一处铸出:`engine_lease_armed` 日志、自退判据用的窗、拍频推导(`tickMs = min(15s, 最短窗)`)和本读数读的是同一组数 ——
+ * 不存在第二处去「算一遍租约窗」。一个永远不到期的窗(owned 窗 = `Infinity` 且没有孤儿车道)不是租约:读数整个缺席,不补 0、不把 `Infinity` 送进 JSON。
+ */
+export interface EngineLeaseFacts {
+    readonly lingerMs: number;
+    readonly tickMs: number;
+}
+/** {@link createEngineLeaseTracker} 的把手:`stop()` 收摊;`facts` 现读 —— **腿还在观察**时才有(收摊 / 自退触发之后缺席,says-yes ⟺ 腿在转)。 */
+export interface EngineLeaseHandle {
+    stop(): void;
+    readonly facts: EngineLeaseFacts | undefined;
+}
 export interface EngineLeaseDeps {
     /** 活附着数 = 本副本当前**打开着的 SSE 流**条数(`drainState.attachedStreams`,由 `createHttpServer` 自赋)。 */
     attachedStreams: () => number;
@@ -167,7 +190,5 @@ export interface EngineLeaseDeps {
     now?: () => number;
 }
 /** 装配并**立刻**起自退检查(装配即 `engine_lease_armed`)。返回停机链用的 `stop()`。 */
-export declare function createEngineLeaseTracker(deps: EngineLeaseDeps): {
-    stop(): void;
-};
+export declare function createEngineLeaseTracker(deps: EngineLeaseDeps): EngineLeaseHandle;
 //# sourceMappingURL=engine-lease.d.ts.map

package/dist/boot/engine-lease.js

@@ -1,7 +1,9 @@
 export const ENGINE_LEASE_TICK_MS = 15_000;
 export function createEngineLeaseTracker(deps) {
     const orphanLane = deps.orphan;
-    const tickMs = deps.tickMs ?? Math.min(ENGINE_LEASE_TICK_MS, deps.lingerMs, orphanLane?.lingerMs ?? Number.POSITIVE_INFINITY);
+    const shortestLingerMs = Math.min(deps.lingerMs, orphanLane?.lingerMs ?? Number.POSITIVE_INFINITY);
+    const tickMs = deps.tickMs ?? Math.min(ENGINE_LEASE_TICK_MS, shortestLingerMs);
+    const leaseFacts = Number.isFinite(shortestLingerMs) ? Object.freeze({ lingerMs: shortestLingerMs, tickMs }) : undefined;
     const now = deps.now ?? (() => performance.now());
     let stopped = false;
     let idleSince = now();
@@ -66,6 +68,11 @@ export function createEngineLeaseTracker(deps) {
         stopped = true;
         clearInterval(timer);
     }
-    return { stop };
+    return {
+        stop,
+        get facts() {
+            return stopped ? undefined : leaseFacts;
+        },
+    };
 }
 //# sourceMappingURL=engine-lease.js.map

package/dist/boot/execution-env.js

@@ -30,12 +30,14 @@ import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
 import { sessionFaceOfHead } from "../session-incarnation.js";
+import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { LANE_HOME_UNDECLARED_EVENT, createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, buildUndeclaredHomeNote, executionLaneHomeDir, executionLaneOf, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
+import { warnReadDenyFloorUnkept } from "./execution-lane.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -125,7 +127,6 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
         }, deps)(ctx);
     };
 }
-const STORE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
 const INCARNATION_READ_TIMEOUT = "incarnation_read_timeout";
 async function occupantOf(seats, sessionId, taskId, boundMs) {
     let answer;
@@ -141,7 +142,7 @@ async function occupantOf(seats, sessionId, taskId, boundMs) {
     }
     catch (e) {
         const code = e?.code;
-        return { fault: typeof code === "string" && STORE_ERROR_CODE.test(code) ? code : "incarnation_read_failed" };
+        return { fault: isCodeToken(code) ? code : "incarnation_read_failed" };
     }
     if (answer === undefined)
         return { unread: "incarnation_unknown" };
@@ -226,8 +227,7 @@ function hostWorktreeUnwrappedRefusal() {
 }
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
-    const laneHomeDir = executionLaneHomeDir(config);
-    const homeDirSeat = laneHomeDir !== undefined ? { homeDir: laneHomeDir } : {};
+    const homeDirSeat = buildLaneHomeClaim(config);
     const homeAbsentNotice = { onHomeAbsent: createLaneHomeAbsenceReporter((event, fields) => logger.warn(event, fields)) };
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
@@ -245,13 +245,14 @@ export function createExecutionEnv(ctx) {
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
-            ...homeDirSeat,
+            ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.template ? { template: config.remoteExec.template } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
             ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
             ...(config.remoteExec.allowInternetAccess != null ? { allowInternetAccess: config.remoteExec.allowInternetAccess } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(sandboxLaneEnvMerged(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv))),
+            sandboxReadFloor: config.sandboxReadFloor,
             logger,
             metrics,
         });
@@ -278,6 +279,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.workspaceSnapshotExclude ? { snapshotExclude: config.remoteExec.workspaceSnapshotExclude } : {}),
             logger,
             ...((lane) => ({ ...(lane.env !== undefined ? { podEnv: lane.env } : {}), ...(lane.secretEnv !== undefined ? { podSecretEnv: lane.secretEnv } : {}) }))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
+            sandboxReadFloor: config.sandboxReadFloor,
         };
         const brokerImage = config.remoteExec.brokerImage;
         executionEnvFactory = createK8sRunEnvFactory(k8sCfg, {
@@ -358,7 +360,7 @@ export function createExecutionEnv(ctx) {
             if (hostScheduler)
                 logger.info(`R7: self-wake scheduler enabled (host lane), store=${schedulerStorePath}`);
             const hostCfg = {
-                ...homeDirSeat,
+                ...homeDirSeat, ...homeAbsentNotice,
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
@@ -394,6 +396,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.network ? { network: config.remoteExec.network } : {}),
             ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
+            sandboxReadFloor: config.sandboxReadFloor,
         });
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
@@ -465,16 +468,19 @@ export function createExecutionEnv(ctx) {
     if (executionEnvFactory) {
         const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
         const suspendable = DEPLOYMENT_SHAPE_PREDICATES.suspendableHands.holds(config);
+        const keepsReadFloor = capabilitiesFor(config).keepsReadFloor;
+        const sandboxReadFloor = laneSandboxReadFloorState(config);
         const sandboxEnvKeys = [...sandboxEnvNamesInForce(config)].sort();
-        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
+        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, keepsReadFloor, ...(sandboxReadFloor !== undefined ? { sandboxReadFloor } : {}), ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
-        const homeNote = buildUndeclaredHomeNote(config);
-        if (homeNote !== undefined)
-            logger.warn(LANE_HOME_UNDECLARED_EVENT, { provider: config.remoteExec.provider, note: homeNote });
+        const homeLine = buildLaneHomeBootNote(config);
+        if (homeLine !== undefined)
+            logger.warn(homeLine.event, { provider: config.remoteExec.provider, note: homeLine.note });
         if (executionLaneOf(config.remoteExec.provider) === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
+    warnReadDenyFloorUnkept(config, logger);
     const lspProvider = config.remoteExec?.provider;
     const lspLane = executionLaneOf(lspProvider);
     const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);

package/dist/boot/execution-lane.d.ts

@@ -1,5 +1,6 @@
 import { type CrossInvariantView } from "../config-invariants.js";
 import type { ServiceConfig } from "../config-types.js";
+import { buildReadDenyFloorUnkeptNote } from "../execution-lane-caps.js";
 import type { Logger } from "../observability/logger.js";
 /** `config.d/remote-exec.json` 能写进来的车道(文件契约里不带密钥名、可 1:1 映射的两条;e2b/k8s/ssh/adb 要 NAME→值解析,尚未接线)。 */
 export declare const FILE_SOURCED_LANES: readonly ["host", "local-docker"];
@@ -28,6 +29,13 @@ export declare function composeExecutionLane(config: ServiceConfig, ctx: Executi
  * 非宿主车道零动作 —— 不解析、不装观察者。
  */
 export declare function settleHostLaneShell(config: Pick<ServiceConfig, "remoteExec">, logger: Pick<Logger, "info" | "warn">): Promise<void>;
+/**
+ * **读地板的起服一行**:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
+ * 起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`)。
+ * 两个入口调同一只(与 {@link settleHostLaneShell} 同形):HTTP 服务在执行环境装配里(`boot/execution-env.ts`,有没有执行环境工厂都调),`run-local` 在宿主车道定下之后 ——
+ * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先说。不要求 / 车道守地板 ⇒ 零动作。
+ */
+export declare function warnReadDenyFloorUnkept(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
 /**
  * 车道合成之后的跨域不变量 —— 表(`config-invariants.ts`)里读 `remoteExec.provider` 的那几条,boot 期 `live === next`。
  * 同步、纯判据:只读 config,不碰文件(测试可以对 `loadConfig()` 的产物直接调它)。

package/dist/boot/execution-lane.js

@@ -1,7 +1,7 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
@@ -23,6 +23,11 @@ export async function settleHostLaneShell(config, logger) {
         return;
     await settleHostShellAtBoot(logger);
 }
+export function warnReadDenyFloorUnkept(config, logger) {
+    const note = buildReadDenyFloorUnkeptNote(config);
+    if (note !== undefined)
+        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec?.provider, note });
+}
 export function assertExecutionLaneInvariants(config) {
     const judge = (id) => crossInvariant(id).check({ live: config, next: config });
     const leader = judge("leader-host-lane");