@sema-agent/server 7.140.0 → 7.142.0

package/dist/config.js

@@ -3,13 +3,14 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { buildRuleListJudgeOptions } from "./permission-rule-list.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
 import { memorySyncPeerOf } from "./memory-sync-client.js";
+import { buildMemorySyncIdentityBootRefusal, declaredMemorySyncIdentityFlaw } from "./memory-sync-identity.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { projectLayerOwnerOf } from "./project-layer-key.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
@@ -36,7 +37,8 @@ import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, laneMissingEnv } from "./execution-lane-caps.js";
+import { sandboxForwardedEnvOf } from "./execution-config-root.js";
+import { SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS, executionLaneOf, executionLaneRequiredRefusal, laneMissingEnv, readDeclaredLaneTable } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
@@ -45,7 +47,7 @@ import { createCenterCredentialSource, readCenterCredentialDeclaration } from ".
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { DEVICE_RELAY_NONE, DEVICE_RELAY_RULE, deviceRelayFlaws, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { anthropicCredentialRefusal, csvOf, declaredCredential, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
@@ -57,6 +59,7 @@ import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
+import { buildDeclaredEngineWithoutCoordinatesRefusal, missingSqlCoordinateKeys } from "./sql-engine-coordinates.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return csvOf(process.env[name]);
@@ -378,17 +381,16 @@ function credentialLawRewriteOf(href) {
     const scanned = redactSecrets(href);
     return scanned === href ? undefined : scanned;
 }
-function parseDeviceRelayUrlEnv() {
-    const raw = process.env.DEVICE_RELAY_URL;
-    if (raw === undefined || raw === "")
-        return undefined;
-    const scheme = /^wss?:\/\//i.exec(raw)?.[0];
-    const asHttp = scheme === undefined ? undefined : `${scheme.length === "wss://".length ? "https" : "http"}://${raw.slice(scheme.length)}`;
-    const flaws = asHttp === undefined ? ["not-ws-url"] : httpUrlFlaws(asHttp, ["userinfo", "query", "fragment"]).map((f) => (f === "not-http-url" ? "not-ws-url" : f));
+function parseDeviceRelayUrlEnv(raw) {
+    if (raw === undefined) {
+        throw new Error("internal: the device lane was assembled without DEVICE_RELAY_URL — the lane's required-env gate must refuse this first (the settings-schema lane table lists DEVICE_RELAY_URL as required for device)");
+    }
+    if (raw === DEVICE_RELAY_NONE)
+        return { kind: "none" };
+    const flaws = deviceRelayFlaws(raw);
     if (flaws.length > 0) {
-        throw new Error(`env DEVICE_RELAY_URL must be an absolute ws:// or wss:// URL with no userinfo, query or fragment (ws(s)://host[:port][/path]) — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
-            `It is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl) as the address devices dial, so it has no room for credentials (devices authenticate by signature). ` +
-            `Leave it unset when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
+        throw new Error(`env DEVICE_RELAY_URL ${DEVICE_RELAY_RULE} — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
+            `A URL has no room for credentials (devices authenticate by signature). Set it to "${DEVICE_RELAY_NONE}" when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
     }
     const href = new URL(raw).href;
     const credentialScan = credentialLawRewriteOf(href);
@@ -396,7 +398,26 @@ function parseDeviceRelayUrlEnv() {
         throw new Error(`env DEVICE_RELAY_URL carries something the credential-redaction law recognizes (${credentialScan}) — it is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl), ` +
             `so it must not carry a token-shaped path segment; keep it to ws(s)://host[:port][/path] (devices authenticate by signature, not by the URL).`);
     }
-    return raw;
+    return { kind: "url", url: raw };
+}
+function declaredExecutionLane(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const table = readDeclaredLaneTable(raw);
+    if ("refusal" in table)
+        throw new Error(table.refusal);
+    const [lane, ...rest] = table.lanes;
+    if (rest.length > 0) {
+        throw new Error(`REMOTE_EXEC="${raw}" declares ${table.lanes.length} execution lanes (${table.lanes.join(", ")}; the first is the default) — this engine wires exactly one execution lane per process, ` +
+            `so ${rest.join(", ")} would never run anything while the deployment declares ${rest.length === 1 ? "it" : "them"}. ` +
+            `Refusing to start rather than serving "${lane}" alone: declare one lane per engine (REMOTE_EXEC=${lane}) and run a separate engine for each further lane.`);
+    }
+    const missing = laneMissingEnv(lane, process.env);
+    if (missing.length > 0) {
+        throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} unset, empty or whitespace-only — it counts as absent: ` +
+            `refusing to start rather than silently downgrading to the host/in-process lane (#157; set ${missing.length === 1 ? "it" : "them"}, or unset REMOTE_EXEC if you meant no sandbox lane).`);
+    }
+    return lane;
 }
 function parseDevicePreAuthPerRemoteEnv() {
     const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
@@ -515,17 +536,16 @@ const OWN_CREDENTIAL_HANDOFF = {
     "sandbox-grant": { where: "a sandbox list puts the named variable, as written, into a sandbox the model can read", whom: "the sandbox" },
 };
 function ownCredentialNameProblem(name, channel) {
-    const engine = inheritEnvPolicyProblem([name]);
-    if (engine === undefined)
+    if (inheritEnvPolicyProblem([name]) === undefined)
         return undefined;
     const { where, whom } = OWN_CREDENTIAL_HANDOFF[channel];
-    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list: ${engine})`;
+    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list)`;
 }
 const NAMES_IN_FORCE = {
     LSP_ENV_ALLOW: (c) => c.lspEnvAllow,
-    E2B_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "e2b" ? Object.keys(c.remoteExec.sandboxEnv ?? {}) : []),
-    K8S_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "k8s" ? Object.keys(c.remoteExec.sandboxEnv ?? {}) : []),
-    DOCKER_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "local-docker" ? Object.keys(c.remoteExec.env ?? {}) : []),
+    E2B_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "e2b" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
+    K8S_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "k8s" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
+    DOCKER_SANDBOX_ENV: (c) => (c.remoteExec?.provider === "local-docker" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
 };
 const SERVER_ENV_NAME_ALLOWLIST_KNOBS = Object.keys(NAMES_IN_FORCE);
 export function sandboxEnvNamesInForce(seats) {
@@ -889,11 +909,14 @@ function parseStoreDomain(ctx) {
             },
         });
     }
-    const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", SESSION_BACKENDS);
+    const declaredSqlEngine = dbBackendSet && (dbBackend === "mysql" || dbBackend === "pg") ? dbBackend : undefined;
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", declaredSqlEngine !== undefined ? "mysql" : "memory", SESSION_BACKENDS);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
     const localDataRoot = resolveLocalDataRoot(process.env, homedir());
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
+    if (declaredSqlEngine !== undefined && !dbHostSet) {
+        throw new Error(buildDeclaredEngineWithoutCoordinatesRefusal(declaredSqlEngine, missingSqlCoordinateKeys(declaredSqlEngine, process.env)));
+    }
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
     const sqlCoordinateKeys = [...(process.env.MYSQL_HOST ? ["MYSQL_HOST"] : []), ...(process.env.PG_HOST ? ["PG_HOST"] : [])];
@@ -1631,7 +1654,7 @@ function parseMemoryEmbedder(ctx) {
         throw new Error(`MEMORY_EMBEDDER_DIM="${dimRaw}" must be a positive integer (the embedding dimension, e.g. 1024). A wrong dimension writes wrong-length vectors into the memory embedding column, which neither the DB nor retrieval reports — the vector plane just silently degrades to the lexical floor (#228).`);
     }
     if (ctx.memoryEngineBackend !== "pg") {
-        throw new Error(`MEMORY_EMBEDDER_* is set but MEMORY_ENGINE_BACKEND=${ctx.memoryEngineBackend} — the vector plane exists only on the pg memory backend (the tidb backend is lexical-only in v1 and refuses an embedder; the file engine has no embedder seam). Set MEMORY_ENGINE_BACKEND=pg, or unset MEMORY_EMBEDDER_*.`);
+        throw new Error(`MEMORY_EMBEDDER_* is set but MEMORY_ENGINE_BACKEND=${ctx.memoryEngineBackend} — the vector plane exists only on the pg memory backend (the mysql backend is lexical-only in v1 and refuses an embedder; the file engine has no embedder seam). Set MEMORY_ENGINE_BACKEND=pg, or unset MEMORY_EMBEDDER_*.`);
     }
     if (!ctx.memoryEngineEnabled) {
         throw new Error("MEMORY_EMBEDDER_* is set but MEMORY_ENGINE=off — the memory engine is not wired at all, so the embedder would never be called; unset one of the two (#228)");
@@ -1734,6 +1757,9 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine with a typed MEMORY_SCOPE (e.g. user:<tenant>) so it provides one");
         }
+        if (carriesCredential(scope)) {
+            throw new Error(`${memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE"} (the memory sync layer's name) holds a credential-shaped part — the layer name travels verbatim in every sync request path and report, so it is refused, never cleaned: rename the layer`);
+        }
         assertProjectLayerOwnable(scope, memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE");
         memorySync = {
             url: memorySyncUrl,
@@ -1771,6 +1797,7 @@ function parseMemoryDomain(ctx) {
         memoryScope,
         ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(parseMemoryPersistenceCapable(process.env.MEMORY_PERSISTENCE_CAPABLE)),
         ...(memorySync ? { memorySync } : {}),
+        ...((v) => (v !== undefined ? { memorySyncServeIdentity: v } : {}))(parseMemorySyncServeIdentity(process.env.MEMORY_SYNC_SERVE_IDENTITY)),
         ...((v) => (v !== undefined ? { memoryEmbedder: v } : {}))(parseMemoryEmbedder({ memoryEngineBackend, memoryEngineEnabled })),
         memoryOrgAdmissionMode,
         ...(process.env.MEMORY_DELEGATION_EVIDENCE !== undefined
@@ -1915,21 +1942,7 @@ function parseOrchestrationDomain(ctx) {
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
     const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
-    {
-        const lane = process.env.REMOTE_EXEC;
-        if (lane !== undefined && lane !== "") {
-            const word = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === lane);
-            if (word === undefined) {
-                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
-                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`);
-            }
-            const missing = laneMissingEnv(word, process.env);
-            if (missing.length > 0) {
-                throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} unset, empty or whitespace-only — it counts as absent: ` +
-                    `refusing to start rather than silently downgrading to the host/in-process lane (#157; set ${missing.length === 1 ? "it" : "them"}, or unset REMOTE_EXEC if you meant no sandbox lane).`);
-            }
-        }
-    }
+    const declaredLane = declaredExecutionLane(process.env.REMOTE_EXEC);
     const readFaceFacts = process.env.READ_FACE !== undefined
         ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
         : { readFaceSource: "engine-default" };
@@ -1945,6 +1958,7 @@ function parseOrchestrationDomain(ctx) {
             return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
         })(),
         readDenyFloorRequired: boolEnv("READ_DENY_FLOOR_REQUIRED", false),
+        sandboxReadFloor: enumEnv("SANDBOX_READ_FLOOR", SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS),
         ...((dir) => (dir !== undefined ? { agentConfigDir: dir } : {}))(declaredSemaConfigDir()),
         ...((p) => (p !== undefined ? { configLkgPath: p } : {}))(lkgPathOverrideOf(process.env.CONFIG_LKG_PATH)),
         configLkgEnabled: boolEnv("CONFIG_LKG_ENABLED", true),
@@ -1960,7 +1974,7 @@ function parseOrchestrationDomain(ctx) {
             }
             return raw;
         })()),
-        remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
+        remoteExec: declaredLane === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
                 apiKey: process.env.E2B_API_KEY,
@@ -1973,7 +1987,7 @@ function parseOrchestrationDomain(ctx) {
                 orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
             :
-                process.env.REMOTE_EXEC === "k8s" && process.env.K8S_SANDBOX_IMAGE && process.env.K8S_NAMESPACE
+                declaredLane === "k8s" && process.env.K8S_SANDBOX_IMAGE && process.env.K8S_NAMESPACE
                     ? {
                         provider: "k8s",
                         image: process.env.K8S_SANDBOX_IMAGE,
@@ -1995,7 +2009,7 @@ function parseOrchestrationDomain(ctx) {
                         ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),
                     }
                     :
-                        process.env.REMOTE_EXEC === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
+                        declaredLane === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
                             ? {
                                 provider: "ssh",
                                 host: process.env.SSH_HOST,
@@ -2006,7 +2020,7 @@ function parseOrchestrationDomain(ctx) {
                                 ...((hk) => (hk !== undefined ? { hostKey: hk } : {}))(parseSshHostKeyEnv()),
                             }
                             :
-                                process.env.REMOTE_EXEC === "adb" && process.env.ADB_SERIAL
+                                declaredLane === "adb" && process.env.ADB_SERIAL
                                     ? {
                                         provider: "adb",
                                         serial: process.env.ADB_SERIAL,
@@ -2014,14 +2028,14 @@ function parseOrchestrationDomain(ctx) {
                                         ...(process.env.ADB_MOUNT_PATH ? { mountPath: process.env.ADB_MOUNT_PATH } : {}),
                                     }
                                     :
-                                        process.env.REMOTE_EXEC === "host"
+                                        declaredLane === "host"
                                             ? {
                                                 provider: "host",
                                                 ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
                                                 ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")),
                                             }
                                             :
-                                                process.env.REMOTE_EXEC === "local-docker" && process.env.DOCKER_IMAGE
+                                                declaredLane === "local-docker" && process.env.DOCKER_IMAGE
                                                     ? {
                                                         provider: "local-docker",
                                                         image: process.env.DOCKER_IMAGE,
@@ -2039,7 +2053,7 @@ function parseOrchestrationDomain(ctx) {
                                                         ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
                                                     }
                                                     :
-                                                        process.env.REMOTE_EXEC === "device"
+                                                        declaredLane === "device"
                                                             ? {
                                                                 provider: "device",
                                                                 ...((n) => (n !== undefined ? { deliveryTimeoutMs: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_DELIVERY_TIMEOUT_MS", process.env.DEVICE_DELIVERY_TIMEOUT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS)),
@@ -2048,7 +2062,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
-                                                                ...((n) => (n !== undefined ? { relayUrl: n } : {}))(parseDeviceRelayUrlEnv()),
+                                                                relay: parseDeviceRelayUrlEnv(process.env.DEVICE_RELAY_URL),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -2296,6 +2310,15 @@ function parseFleetScope(raw) {
     }
     return fleetScopeOf(raw);
 }
+export function parseMemorySyncServeIdentity(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const flaw = declaredMemorySyncIdentityFlaw(raw);
+    if (flaw !== undefined) {
+        throw new Error(buildMemorySyncIdentityBootRefusal("MEMORY_SYNC_SERVE_IDENTITY", raw, flaw, "clients authenticate with MEMORY_SYNC_TOKEN; set MEMORY_SYNC_SERVE_IDENTITY to the bare base address clients reach this center's sync face at"));
+    }
+    return raw;
+}
 function parseFleetAdvertiseAddress(raw) {
     const name = "FLEET_ADVERTISE_ADDRESS";
     if (raw === undefined || raw === "")
@@ -2455,7 +2478,7 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "memoryPersistenceCapable", "memorySync", "memorySyncServeIdentity", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
     "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
@@ -2465,14 +2488,14 @@ const AUTH_GROUP_KEYS = [
     "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "sandboxGit", "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
-    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired",
+    "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired", "sandboxReadFloor",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [

package/dist/delegated-session-owner.d.ts

@@ -2,7 +2,7 @@
  * 🔴 **委派子代会话的属主 —— 一条律;三处写点,各自的来源集;属主 = 判断时见证到的,写只 CAS 子行自己**([ref])。
  *
  * ## 律
- * 一只委派子代会话(引擎为委派铸的 placed 会话,或停驻时从私店拷进宿主店的子代会话)的属主**不是它自己的事实**:它是发起它的那棵委派树的
+ * 一只委派子代会话(引擎为委派铸的 placed 会话;升级前停驻时晋升进宿主店的普通行在停驻挂点也按这条律比对)的属主**不是它自己的事实**:它是发起它的那棵委派树的
  * **根会话的属主**。树根是**铸行那一刻存在的那只根行**(id + 住客化身,`session-incarnation.ts`);此后同 id 另起的会话不是这棵树的根。所以写下的属主 =
  * **判断时见证到的**(读法顺序按写点交来的来源集):
  *  1. 根会话在本店有行 ⇒ 它的属主(根无主 ⇒ 子代也无主 —— 与根同读数,不是另一种读数);
@@ -29,26 +29,28 @@
  * 会话面 / fork / 删除 / 审批豁免 / notify 同读;dev-open 照旧 fleet-wide),具名主体与没有 service 凭据的无身份调用方一律与别人的行同体 404 ——
  * 所以还没定下的行只是暂时只有 fleet 面读得到,不是谁都能读。它们由一次性迁移 M23(窗内每次起服)或这一行的下一次停驻(停驻挂点的认领)
  * 定下;两处都不承诺「一次收敛」。
- * **只有记录委派树的店才认领**:SQL 两店的 placed 行记着委派树(placement 元组);local 店不实现 placement、不记委派树 ⇒ 没有可按的树 ⇒ 不认领
- * (它的无主子代行在停驻挂点照「属主不是律给的那一只 ⇒ 拒」处置;收口是 local 店的 placement 协议)。不按更松的判据认领。
+ * **只有记录委派树的行才认领**:三只持久会话店的 placed 行都记着委派树(placement 元组:SQL 两店在 `session_meta`,local 店在会话存档行头);
+ * 不记委派树的行(普通行,含升级前停驻时晋升进来的行)⇒ 没有可按的树 ⇒ 不认领(在停驻挂点照「属主不是律给的那一只 ⇒ 拒」处置)。不按更松的判据认领。
  *
  * ## 三处写点 —— 律一只,**来源集按写点不同**(都调这里,不各写一份判据)
- *  · **SQL 两店按 placement 建行**(`plugins/tidb-session-store.ts` / `plugins/pg-session-storage.ts` 的 acquire,{@link createPlacedSessionRow}):来源 = placement 上的
- *    根、父两只 id({@link ownerSourcesOf});读来源 → 判 → 一条 INSERT(属主与 placement 同一笔落库,首写律)。读来源之后来源才变有主(滚动升级窗里别的副本的
+ *  · **三只持久会话店按 placement 建行**({@link createPlacedSessionRow}:`plugins/tidb-session-store.ts` / `plugins/pg-session-storage.ts` 的 acquire 一条 INSERT,属主与 placement
+ *    同一笔落库;`plugins/local-session-store.ts` 的 acquire 先建存档(行头带元组)、再写会话元数据那一格(属主 + 化身))。来源 = placement 上的根、父两只 id({@link ownerSourcesOf});
+ *    读来源 → 判 → 写(首写律)。读来源之后来源才变有主(滚动升级窗里别的副本的
  *    M23 回填了无主的父)⇒ 写下的仍是判断时的读数 —— 按律如此;那一行若因此无主,照上一节处置。
- *  · **停驻挂点**(`plugins/session-store.ts` 的 `ensureChildSessionDurableWithPromotion`;快路 + 晋升):来源 = **调用方交出的委派树根,只有这一只**,连同
+ *  · **停驻挂点**(`plugins/session-store.ts` 的 `attestChildSessionDurable`;只验、不搬):来源 = **调用方交出的委派树根,只有这一只**,连同
  *    调用方判断那一刻读到的根行住客({@link DelegationRootWitness};见证值,判断用,不进 CAS):请求腿 = 本请求经鉴权解析的会话,住客 = 受理时那一读
  *    (`boot/resolve-spec.ts`);`/decide` 的赎回腿 = 行上的 `rootSessionId`,住客 = 赎回腿写口放行的那一位(认领之前解析器那一读;`parked-revive-surface.ts`,每一行都交)。
- *    挂点先读一次根行:它在而住客不是见证的那一位 ⇒ 根被删、同 id 换了住客 ⇒ **拒**(不按新住客晋升 / 认领,{@link assertRootStillWitnessed});它不在 ⇒ 律给哨兵
+ *    挂点先读一次根行:它在而住客不是见证的那一位 ⇒ 根被删、同 id 换了住客 ⇒ **拒**(不按新住客认领,{@link assertRootStillWitnessed});它不在 ⇒ 律给哨兵
  *    (根真没了)。不回落父:core 的挂点 `ensureChildSessionDurable(sessionId)` 只交子代 id,父 id 在这一写点拿不到;两条候选读法都读不到东西 ——
- *    ① 读 `session_meta(子代).placement_parent_session_id`:晋升的拷贝分支恰恰只在子代**没有** placed 行时才走(有 placed 行 ⇒ 快路),这一列按构造为空;
+ *    ① 读子代行记下的父:记着委派树的行(placed 行)在下面的定夺里本就按**它记录的**根、父再判一次;不记委派树的行(升级前晋升进来的普通行)没有这一格;
  *    ② 登记簿(后台子代行 / core 注册簿):core 接口没有「按子代 sessionId 查行」的读口,SQL 表 `background_agent.session_id` 无索引,加一条只在一处用的私有读腿
  *       = 多一只读法;`scope` 列还把匿名折成 `"default"`(与真名 `default` 的租户不可分)。行上没有根(没有会话的取用形)⇒ 来源集空 ⇒ 哨兵。
  *    宿主行的属主经 {@link settleDelegatedOwner} 定下:宿主行记着委派树而不是这一棵 ⇒ 拒(两边属主都是 null 也拒);记着这一棵 ⇒ 按**它记录的** placement(根、父)
  *    再判一次(与 M23 对同一行同读数 —— 见证只答「是不是这一棵、根住客换没换」,来源集取行上记的),无主 ⇒ 认领(CAS 子行),认领试了没落下 ⇒ 拒;然后比对 ——
- *    不是律给的那一只 ⇒ 停驻否决(晋升建行前那一道与停驻快路同一只函数、同一句拒因)。
+ *    不是律给的那一只 ⇒ 停驻否决。
  *  · **一次性迁移 M23**(`plugins/one-time-migrations.ts`):存量 placed 行,来源 = 根、父(扫描时同一条语句连读两行);回填 = 认领(同一句,绑扫描读到的子行化身)。
- * local 店不实现 placement(子代住私店、只经停驻挂点进宿主店),没有第一处与第三处,也不认领(上一节)。
+ * local 店没有第三处:它的 placed 行自本律起由第一处写下(属主在建行那一笔);存档在而那一格缺(建行两笔之间崩了,或同一数据根上 run-local 腿写下的 placed 存档)
+ * 读作从没被记下的属主 = 无主,照「无主的子代行」一节处置(停驻挂点的认领)。
  */
 import type { SessionPlacement } from "@sema-agent/core";
 import { type HeadRead, type SessionFace } from "./session-incarnation.js";
@@ -103,8 +105,8 @@ export declare function readDelegatedOwner(childId: string, placement: Placement
 export interface OrphanOwnerLog {
     warn(msg: string, fields?: Record<string, unknown>): void;
 }
-/** 写点的名字(warn 行的 `site` 字段:运维据它知道是哪一笔写下的哨兵)。`promotion` = 停驻挂点(晋升建行,或对宿主无主行的认领)。 */
-export type DelegatedOwnerSite = "placed_create" | "promotion";
+/** 写点的名字(warn 行的 `site` 字段:运维据它知道是哪一笔写下的哨兵)。`placed_create` = 按 placement 建行;`park` = 停驻挂点对宿主无主 placed 行的认领。 */
+export type DelegatedOwnerSite = "placed_create" | "park";
 /** 一笔写**已落下**之后调:写下的是孤行哨兵 ⇒ 一行 warn(写失败的那一笔走不到这里,不留下「已写」的话)。继承来的属主(含继承自孤行祖先的哨兵)不告。 */
 export declare function reportWrittenOwner(log: OrphanOwnerLog, site: DelegatedOwnerSite, childId: string, judged: JudgedOwner): void;
 /**
@@ -116,7 +118,7 @@ export declare function reportWrittenOwner(log: OrphanOwnerLog, site: DelegatedO
 export declare const CLAIM_OWNERLESS_PLACED_SQL: Readonly<Record<SqlDialect, string>>;
 /** 认领句的绑参(两方言同序;店与 M23 都经它,不各排一份):`incarnation` = 判断时读到的子行化身。 */
 export declare function claimOwnerlessParams(sessionId: string, incarnation: string, owner: string): readonly [string, string, string];
-/** 店的认领口(SQL 两店 + 缓存包装层同一个签名):这只会话的那一位住客(`incarnation`)仍是无主的 placed 行 ⇒ 写 `owner`,返回是否写成。 */
+/** 店的认领口(三只持久会话店 + 缓存包装层同一个签名):这只会话的那一位住客(`incarnation`)仍是无主的 placed 行 ⇒ 写 `owner`,返回是否写成。 */
 export type OwnerlessClaim = (sessionId: string, incarnation: string, owner: string) => Promise<boolean>;
 /** 一只 SQL 店建 placed 行要交的 I/O(两店按各自方言交,都是店的既有读写口;读法与顺序只住在 {@link createPlacedSessionRow})。 */
 export interface PlacedRowWriter {
@@ -146,7 +148,7 @@ export interface DelegationRootWitness {
  * 根行此刻不在 ⇒ 不抛(根真没了 ⇒ 律给哨兵,不是「换了住客」)。这是**判断**的一部分;判断之后、写之前根的变化不改变写进去的值(律:属主 = 判断时见证到的)。
  */
 export declare function assertRootStillWitnessed(sessionId: string, witness: DelegationRootWitness | undefined, judged: JudgedOwner): void;
-/** 记录委派树的宿主店多交的两只口(SQL 两店与缓存包装层;local 店两只都没有 ⇒ 没有可按的树 ⇒ 不认领)。 */
+/** 记录委派树的宿主店多交的两只口(三只持久会话店与缓存包装层;无 repo 的内存店两只都没有 ⇒ 没有可按的树 ⇒ 不认领)。 */
 export interface DelegationTreeStore {
     /** 本行落库的 placement 元组(`undefined` = 本行不是 placed 行 ⇒ 不记委派树)。 */
     readonly placementOf: (sessionId: string) => Promise<PlacementSources | undefined>;
@@ -159,7 +161,7 @@ export interface DelegatedOwnerHost {
     readonly trees: DelegationTreeStore | undefined;
 }
 /**
- * 「这只宿主店能不能承载委派子代的属主」—— 只判这一处(停驻快路与晋升建行读同一只):店有按 id 的头读(`headOf`,「有没有」沿用 `headReadOf` 的同一处判法)⇒
+ * 「这只宿主店能不能承载委派子代的属主」—— 只判这一处(停驻挂点读它):店有按 id 的头读(`headOf`,「有没有」沿用 `headReadOf` 的同一处判法)⇒
  * 绑好的 {@link DelegatedOwnerHost};没有 ⇒ `undefined`(调用方响亮拒:读不回属主的宿主店上,停驻出来的就是一只谁都能读的转录)。记录委派树的两只口
  * (`placementOf` + `claimOwnerless`)**同在或同缺**:同在 ⇒ `trees`;同缺 ⇒ 不记委派树;只有一只 ⇒ `undefined`(记着树却认领不了,或认领却读不回树 —— 半只店不猜)。
  */
@@ -174,13 +176,13 @@ export interface SettledOwner {
     readonly judged: JudgedOwner | undefined;
 }
 /**
- * 宿主店里这只会话的行属主**按律定下来**(停驻快路与晋升建行前**同一只函数、同一句拒因**;拒句不带任何一方的属主值 —— 它会进停驻否决的错误面)。
- * `owner` / `tree` = 调用方按见证的根判出的属主与委派树(晋升建行写下的就是它)。
- *  1. 宿主行**记着委派树**(SQL 店的 placed 行):记下的根 ≠ `tree.root` ⇒ 抛(不以属主是否 null 为前提:那是另一棵树的行);是这一棵 ⇒ **按它记录的 placement(根、父)
+ * 宿主店里这只会话的行属主**按律定下来**(停驻挂点的那一道;拒句不带任何一方的属主值 —— 它会进停驻否决的错误面)。
+ * `owner` / `tree` = 调用方按见证的根判出的属主与委派树。
+ *  1. 宿主行**记着委派树**(placed 行):记下的根 ≠ `tree.root` ⇒ 抛(不以属主是否 null 为前提:那是另一棵树的行);是这一棵 ⇒ **按它记录的 placement(根、父)
  *     再判一次**(唯一判据 {@link judgeDelegatedOwner} —— 与 M23 / 建行复核对这一行同读数:根不在取父),调用方那一读之后根住客变了 ⇒ 抛({@link assertRootStillWitnessed},
  *     调用方的读数当见证);行无主而律给出属主 ⇒ 认领(CAS 刚读到的那一位住客;写进去的是这一次判的读数)—— **试了没落下 ⇒ 抛**(这一行在判断之后被写过 /
  *     删过 / 换了住客,不由事后的属主比对放行);
- *  2. 不记委派树的行(local 店的行、SQL 店的普通行)不认领、不再判;
+ *  2. 不记委派树的行(普通行,含升级前晋升进来的行)不认领、不再判;
  *  3. 比对 —— 此刻的属主不是律给的那一只(记着委派树 ⇒ 按记录的树判的那一只;否则 = `owner`)⇒ 抛。
  */
 export declare function settleDelegatedOwner(host: DelegatedOwnerHost, sessionId: string, owner: string | null, tree: DelegationTree): Promise<SettledOwner>;

package/dist/delegated-session-owner.js

@@ -80,7 +80,7 @@ export function delegatedOwnerHostOf(store) {
 }
 export async function settleDelegatedOwner(host, sessionId, owner, tree) {
     const refuse = () => new Error(`session "${sessionId}" cannot be parked as this delegated session: the host session store holds a session with this id that is not this delegation tree's ` +
-        "(a different owner, or a different recorded delegation root), and the transcript is neither copied into it nor attested by it");
+        "(a different owner, or a different recorded delegation root), so it does not attest this delegated transcript");
     const face = sessionFaceOfHead(sessionId, await host.headOf(sessionId));
     const trees = host.trees;
     const recorded = face === undefined || trees === undefined ? undefined : await trees.placementOf(sessionId);

package/dist/device-store.d.ts

@@ -395,6 +395,12 @@ export interface DeviceStore {
     placeDeviceExecution(input: PlaceDeviceExecutionInput): Promise<PlaceDeviceExecutionResult>;
     /** O4 显式换绑(v2 稿 §2 步 2/3/5):目标设备门 + 写事务内锁根行读认领 + 前态 CAS + `session_rebound` 审计行同一事务。 */
     rebindDeviceExecution(input: RebindDeviceExecutionInput): Promise<RebindDeviceExecutionResult>;
+    /**
+     * 绑定数:根会话行上 writer(device, D) 的格数 —— 唯一读法 `boundDeviceOf` 的聚合(SQL 侧只缩小读的行,每行过唯一解码:`execution-placement-sql.ts`
+     * `countDeviceBindingsOn`)。数的是格,不 join 设备行(吊销设备上的格照数:格还在,会话仍放在那台设备上)。只交一个数。读故障与解码器拒的行原样抛(不折成 0)。
+     * 读者:起服门「设备入口 × 已绑设备」(`boot/device-lane.ts`)。
+     */
+    countDeviceBindings(): Promise<number>;
     appendAudit(input: AppendAuditInput): Promise<void>;
     listAudit(filter?: ListAuditFilter): Promise<DeviceAuditRow[]>;
 }
@@ -432,6 +438,7 @@ export declare class InMemoryDeviceStore implements DeviceStore {
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     placeDeviceExecution(input: PlaceDeviceExecutionInput): Promise<PlaceDeviceExecutionResult>;
     rebindDeviceExecution(input: RebindDeviceExecutionInput): Promise<RebindDeviceExecutionResult>;
+    countDeviceBindings(): Promise<number>;
     appendAudit(input: AppendAuditInput): Promise<void>;
     listAudit(filter?: ListAuditFilter): Promise<DeviceAuditRow[]>;
     private isOnline;

package/dist/device-store.js

@@ -386,6 +386,9 @@ export class InMemoryDeviceStore {
             this.pushAudit({ event: "session_rebound", deviceId: input.targetDeviceId, owner: input.owner, detail: { from: out.from, to: input.targetDeviceId, rev: out.device.rev } });
         return out;
     }
+    async countDeviceBindings() {
+        return this.seat.countDeviceBindings();
+    }
     async appendAudit(input) {
         this.pushAudit(input);
     }

package/dist/execution-config-root.d.ts

@@ -0,0 +1,22 @@
+import { type LaneHomeDeployment, type RemoteExecProvider } from "./execution-lane-caps.js";
+/** 选中车道转进沙箱的 env 那一座(`ServiceConfig.remoteExec` 的判别联合每一臂结构上都满足:e2b / k8s 的 `sandboxEnv`、local-docker 的 `env`,别的臂两键都没有)。 */
+export interface SandboxEnvSeat {
+    readonly remoteExec?: {
+        readonly provider: RemoteExecProvider;
+        readonly sandboxEnv?: Readonly<Record<string, string>> | undefined;
+        readonly env?: Readonly<Record<string, string>> | undefined;
+    } | undefined;
+}
+/** 求配置根要读的部署事实(`ServiceConfig` 结构上满足;存体预判的问点传活配置整份)。 */
+export interface ExecutionConfigRootDeployment extends LaneHomeDeployment, SandboxEnvSeat {
+    readonly agentConfigDir?: string;
+    readonly remoteExec?: SandboxEnvSeat["remoteExec"];
+}
+/**
+ * 被选中的沙箱车道上运维点名转进沙箱的 env(e2b / k8s 的 `sandboxEnv`、local-docker 的 `env` —— 名单型旋钮经 `allowlistedEnv` 取的原值);
+ * 车道没有这一座 ⇒ 空。名单此刻交出去的名(`config.ts` 的 `sandboxEnvNamesInForce`)读的也是这一只。
+ */
+export declare function sandboxForwardedEnvOf(deployment: SandboxEnvSeat): Readonly<Record<string, string>>;
+/** 执行环境的配置根(规则见文件头);读不出 ⇒ `undefined`。 */
+export declare function executionConfigRootOf(deployment: ExecutionConfigRootDeployment): string | undefined;
+//# sourceMappingURL=execution-config-root.d.ts.map

package/dist/execution-config-root.js

@@ -0,0 +1,35 @@
+import { posix } from "node:path";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
+import { configRootOf } from "./sema-config-dir.js";
+const CONFIG_DIR_ENV = "SEMA_CONFIG_DIR";
+export function sandboxForwardedEnvOf(deployment) {
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    switch (lane) {
+        case "e2b":
+        case "k8s":
+            return deployment.remoteExec?.sandboxEnv ?? {};
+        case "local-docker":
+            return deployment.remoteExec?.env ?? {};
+        case "in-process":
+        case "host":
+        case "ssh":
+        case "adb":
+        case "device":
+            return {};
+        default: {
+            const unhandled = lane;
+            return unhandled;
+        }
+    }
+}
+export function executionConfigRootOf(deployment) {
+    if (!DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(deployment))
+        return configRootOf(deployment);
+    const forwarded = sandboxForwardedEnvOf(deployment)[CONFIG_DIR_ENV];
+    if (forwarded !== undefined)
+        return forwarded;
+    const home = executionLaneHomeDir(deployment);
+    return home === undefined ? undefined : posix.join(home, ".sema");
+}
+//# sourceMappingURL=execution-config-root.js.map

package/dist/execution-lane-caps.d.ts

@@ -65,12 +65,34 @@ export interface ExecutionLaneCaps {
  *    (不是遗漏:设备侧长驻进程、LSP sidecar、直传腿都是 follow-on,声明了就是谎)。
  */
 export declare function executionLaneCaps(lane: ExecutionLane): ExecutionLaneCaps;
-/** {@link capabilitiesFor} 读的部署配置:已装配的 `remoteExec` 里决定块的两键(`ServiceConfig` 的判别联合每一臂结构上都满足)。 */
+/** 读地板旋钮的 env 名(拒起句与起服行点名它)。 */
+export declare const SANDBOX_READ_FLOOR_ENV = "SANDBOX_READ_FLOOR";
+/** `SANDBOX_READ_FLOOR` 闭集:`keep` = 地板模块服务这条车道时守地板;`off` = 不守(车道块 `keepsReadFloor:false`,起动字节与没有地板模块时同)。 */
+export declare const SANDBOX_READ_FLOOR_WORDS: readonly ["keep", "off"];
+export type SandboxReadFloorKnob = (typeof SANDBOX_READ_FLOOR_WORDS)[number];
+/** 缺省 `keep`:服务集翻进一条车道的那一版,这条车道就守地板(运维不必再开一次)。 */
+export declare const SANDBOX_READ_FLOOR_DEFAULT: SandboxReadFloorKnob;
+/** 地板模块能服务的车道(沙箱三车道;主机 / ssh / adb / device 约束不了进程,恒不守)。 */
+export type SandboxFloorLane = Extract<ExecutionLane, "e2b" | "k8s" | "local-docker">;
+/** 一条沙箱车道此刻的地板状态:`kept` = 守 · `off` = 部署关了 · `unserved` = 地板模块还不服务这条车道。起服行原样报这个词。 */
+export type SandboxReadFloorState = "kept" | "off" | "unserved";
+/** 派生的纯形(旋钮 × 服务与否 → 状态);`off` 先于服务集(部署关掉的车道不论服务与否都报 `off`)。 */
+export declare function readFloorStateOf(knob: SandboxReadFloorKnob, served: boolean): SandboxReadFloorState;
+/**
+ * 一条沙箱车道的地板状态 —— 沙箱块 `keepsReadFloor`(`=== "kept"`)、起服行与适配器手里地板模块的**唯一**判据。旋钮缺席 ⇒ {@link SANDBOX_READ_FLOOR_DEFAULT}。
+ *
+ * **服务集**住在这里,每条车道一臂(穷举 switch、无 default 臂):第二个实参 = 地板模块在这条车道上的起动接缝已经过真沙箱验收(性能闸 + 黑盒复跑)、
+ * 可以如实声明守地板。今天三臂皆 `false` —— 翻某一臂的前提是 core 让每一次起动都带地板、契约写明路径语义,以及那条车道的真跑读数。
+ */
+export declare function sandboxReadFloorState(lane: SandboxFloorLane, knob: SandboxReadFloorKnob | undefined): SandboxReadFloorState;
+/** {@link capabilitiesFor} 读的部署配置:已装配的 `remoteExec` 里决定块的两键(`ServiceConfig` 的判别联合每一臂结构上都满足)+ 部署级读地板旋钮
+ *  (`SANDBOX_READ_FLOOR`;缺席 ⇒ 缺省 `keep`,与 loader 同一只常量)。 */
 export interface CapabilitiesDeployment {
     readonly remoteExec?: {
         readonly provider?: string | undefined;
         readonly s3Snapshot?: unknown;
     } | undefined;
+    readonly sandboxReadFloor?: SandboxReadFloorKnob | undefined;
 }
 /**
  * 「这份部署上 run 所在的执行环境能做什么」—— 引擎能力块(八键)的**唯一作者**。
@@ -87,8 +109,15 @@ export declare function capabilitiesFor(deployment: {
         readonly provider: RemoteExecProvider;
         readonly s3Snapshot?: unknown;
     } | undefined;
+    readonly sandboxReadFloor?: SandboxReadFloorKnob | undefined;
 }): ExecutionEnvCapabilities;
 export declare function capabilitiesFor(deployment: CapabilitiesDeployment): ExecutionEnvCapabilities | undefined;
+/**
+ * 本部署车道的读地板状态(`kept` / `off` / `unserved`;纯数据)—— 只沙箱三车道有这一格,别的车道(与认不出的词)⇒ `undefined`。
+ * 判据与块的 `keepsReadFloor` 同一只({@link sandboxBlock} 读的 `sandboxReadFloorState`):`keepsReadFloor === (本值 === "kept")` 是构造保证。
+ * 读者:起服行 `remote_exec_enabled.sandboxReadFloor`(说清不守的原因:部署关了,还是模块还没服务这条车道)。穷举 switch、无 default 臂。
+ */
+export declare function laneSandboxReadFloorState(deployment: CapabilitiesDeployment): SandboxReadFloorState | undefined;
 /**
  * 车道普查全集 = 本仓内部状态名 `in-process` + 词表正本的可声明车道(次序 = 正本声明序;对账测试按它逐 lane 跑真判别式)。
  * 由正本派生、不手维护(手维护的「全表」已被代码反证漏过行)。
@@ -109,7 +138,8 @@ export declare function executionLaneRow(lane: RemoteExecProvider): ExecutionLan
  * 一条车道**必需**的 env 键名 = 正本表行的 `requiredEnv ∪ requiredSecretEnv`(次序:非密坐标在前、密钥在后 —— 与 7.113.0 本仓手写表逐字同)。
  * 读者:`config.ts` 的 [ref] 拒启门(点了名却缺件 ⇒ 点名缺哪几键)、部署面门(`test/deploy-lanes-contract.test.ts`:`lanes.json` 每行登记
  * 本车道必需键)、`scripts/gen-deploy-lanes.ts`(从同一张正本生成 `lanes.json` 的必需键列,以及根 / review compose 与 sema-up 栈 compose 里的必需键透传)。
- * device 没有必需 env(设备是运行期连进来的;它的 boot 前提是跨键的,在跨域不变量区拒启)。
+ * 每条车道的必需键都在这一张表上、缺席都由下面的 {@link laneMissingEnv} 一只判官判 —— device 行也是(契约包 16.0.0 起 `requiredEnv: ["DEVICE_RELAY_URL"]`):缺席 / 空串 / 只含空白在 `declaredExecutionLane` 的必需 env 门被拒,
+ * 走到 `config.ts` 的设备入口解析器 `parseDeviceRelayUrlEnv` 时值一定在,它只判值的文法与凭据形。没有哪个必需键另有一臂缺席判官。
  */
 export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly string[];
 /**
@@ -126,6 +156,24 @@ export declare function isBlankRequiredEnvValue(value: string | undefined): bool
  * 读者:`config.ts` 的 [ref] 拒启门(非空 ⇒ 拒启并点名缺哪几键);判的是调用方交来的 env 快照,本函数不读 `process.env`。
  */
 export declare function laneMissingEnv(lane: RemoteExecProvider, env: Readonly<Record<string, string | undefined>>): readonly string[];
+/** {@link readDeclaredLaneTable} 的答案:合文法 ⇒ 有序车道表(非空;首项 = 缺省);不合 ⇒ 拒句(点名那一段)。 */
+export type DeclaredLaneTableReading = {
+    readonly lanes: readonly [RemoteExecProvider, ...RemoteExecProvider[]];
+} | {
+    readonly refusal: string;
+};
+/**
+ * `REMOTE_EXEC` 的**唯一读法** —— 部署声明的有序执行车道表。它是契约 `runtime.execution.lanes`(settings-schema 16.0.0 起是车道集)渲成 env 的形:
+ * `lanes.join(",")`,首项 = 缺省;单词 = 一元表,与此前的单值读法逐字同。
+ *
+ * 文法(契约写闸对 `lanes` 的同一组规则,在 env 串上的读法):逗号分段;每段**逐字**是一个可声明车道词({@link REMOTE_EXEC_PROVIDER_WORDS} = 契约词表,
+ * 不 trim、不折大小写 —— 渲染器不写空白,` k8s` 不是车道词);段不空;一条车道至多出现一次。`in-process` 是「没点名」这个状态的名字,不是可写词。
+ * 未设 / 空串**不是表**(没有声明 —— 调用方先判,本函数只收非空串)。
+ * 不合文法 ⇒ `refusal`,拒句点名那一段;只有一段时与单值时代的拒句逐字同。契约的退役车道值(墓碑 `RETIRED_LANE_WORDS`)拒句取契约的
+ * `retiredLaneWordRefusal`(出路在源头给,一句 —— 车道文件 `provider` 读到同一个旧词时契约给的是同一句)。本函数只判文法;本引擎版本能服务几条车道、
+ * 每条车道缺不缺必需键,是调用方的门。
+ */
+export declare function readDeclaredLaneTable(raw: string): DeclaredLaneTableReading;
 /**
  * [ref] 件③ / [ref] —— **「`REQUIRE_EXECUTION_LANE=true` ∧ 没有任何车道被点名 ⇒ 拒启」的判据与拒因句的唯一属主**(`modelProviderRefusal` /
  * `modelRouteEndpointRefusal` 同形:属主在叶模块,执法点各自调它,登记在 `config-invariants.ts`)。