@sema-agent/server 7.140.0 → 7.142.0

package/dist/execution-lane-caps.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { StubExecutionEnv } from "@sema-agent/core";
-import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES, isBlankCoordinate } from "@sema-agent/settings-schema/execution-lanes";
+import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES, isBlankCoordinate, retiredLaneWordRefusal } from "@sema-agent/settings-schema/execution-lanes";
 import { DECLARE_HOME_REMEDY, LANE_HOME_UNDECLARED_EVENT, LANE_HOME_UNMEASURED_EVENT, buildHomeAbsentNote, buildHomeUnmeasuredNote } from "./lane-home-probe.js";
 const NO = "unsupported";
 const YES = "supported";
@@ -97,27 +97,61 @@ export function executionLaneCaps(lane) {
             };
     }
 }
+export const SANDBOX_READ_FLOOR_ENV = "SANDBOX_READ_FLOOR";
+export const SANDBOX_READ_FLOOR_WORDS = ["keep", "off"];
+export const SANDBOX_READ_FLOOR_DEFAULT = "keep";
+export function readFloorStateOf(knob, served) {
+    switch (knob) {
+        case "off":
+            return "off";
+        case "keep":
+            return served ? "kept" : "unserved";
+    }
+}
+export function sandboxReadFloorState(lane, knob) {
+    const k = knob ?? SANDBOX_READ_FLOOR_DEFAULT;
+    switch (lane) {
+        case "e2b":
+            return readFloorStateOf(k, false);
+        case "k8s":
+            return readFloorStateOf(k, false);
+        case "local-docker":
+            return readFloorStateOf(k, false);
+    }
+}
 const IN_PROCESS_BLOCK = new StubExecutionEnv().capabilities;
 const HOST_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: true, canonicalPathAuthoritative: true, hostLocalPaths: true, externalContentTarget: false, io: true, keepsReadFloor: false });
-const E2B_BLOCK = Object.freeze({ isolation: true, suspendable: true, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
-const K8S_BLOCK = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
-const K8S_SNAPSHOT_BLOCK = Object.freeze({ ...K8S_BLOCK, suspendable: true });
-const LOCAL_DOCKER_BLOCK = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
+const E2B_SHAPE = Object.freeze({ isolation: true, suspendable: true, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SNAPSHOT_SHAPE = Object.freeze({ ...K8S_SHAPE, suspendable: true });
+const LOCAL_DOCKER_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+function sandboxBlock(shape, state) {
+    return Object.freeze({ ...shape, keepsReadFloor: state === "kept" });
+}
+function sandboxShape(lane, snapshotStore) {
+    switch (lane) {
+        case "e2b":
+            return E2B_SHAPE;
+        case "k8s":
+            return snapshotStore ? K8S_SNAPSHOT_SHAPE : K8S_SHAPE;
+        case "local-docker":
+            return LOCAL_DOCKER_SHAPE;
+    }
+}
 const SSH_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
 const ADB_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
 const DEVICE_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: true, io: true, keepsReadFloor: false });
-function laneBlock(lane, snapshotStore) {
+const NO_SUB_KNOBS = Object.freeze({ snapshotStore: false, sandboxReadFloor: undefined });
+function laneBlock(lane, sub) {
     switch (lane) {
         case "in-process":
             return IN_PROCESS_BLOCK;
         case "host":
             return HOST_BLOCK;
         case "e2b":
-            return E2B_BLOCK;
         case "k8s":
-            return snapshotStore ? K8S_SNAPSHOT_BLOCK : K8S_BLOCK;
         case "local-docker":
-            return LOCAL_DOCKER_BLOCK;
+            return sandboxBlock(sandboxShape(lane, sub.snapshotStore), sandboxReadFloorState(lane, sub.sandboxReadFloor));
         case "ssh":
             return SSH_BLOCK;
         case "adb":
@@ -130,7 +164,24 @@ export function capabilitiesFor(deployment) {
     const lane = executionLaneOf(deployment.remoteExec?.provider);
     if (lane === undefined)
         return undefined;
-    return laneBlock(lane, lane === "k8s" && Boolean(deployment.remoteExec?.s3Snapshot));
+    return laneBlock(lane, { snapshotStore: lane === "k8s" && Boolean(deployment.remoteExec?.s3Snapshot), sandboxReadFloor: deployment.sandboxReadFloor });
+}
+export function laneSandboxReadFloorState(deployment) {
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    switch (lane) {
+        case "e2b":
+        case "k8s":
+        case "local-docker":
+            return sandboxReadFloorState(lane, deployment.sandboxReadFloor);
+        case "in-process":
+        case "host":
+        case "ssh":
+        case "adb":
+        case "device":
+            return undefined;
+    }
 }
 export const ALL_EXECUTION_LANES = Object.freeze(["in-process", ...DECLARABLE_LANE_WORDS]);
 const EXECUTION_LANE_SET = new Set(ALL_EXECUTION_LANES);
@@ -166,6 +217,32 @@ export function isBlankRequiredEnvValue(value) {
 export function laneMissingEnv(lane, env) {
     return laneRequiredEnv(lane).filter((name) => isBlankRequiredEnvValue(env[name]));
 }
+export function readDeclaredLaneTable(raw) {
+    const segments = raw.split(",");
+    const lanes = [];
+    for (const [i, segment] of segments.entries()) {
+        if (segment === "") {
+            return { refusal: `REMOTE_EXEC="${raw}" has an empty entry at position ${i + 1} — it is an ordered, comma-separated list of execution lanes (the first is the default) with no blank entries; valid lanes: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}.` };
+        }
+        const lane = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === segment);
+        const retired = lane === undefined ? retiredLaneWordRefusal(segment) : undefined;
+        if (retired !== undefined)
+            return { refusal: `REMOTE_EXEC="${raw}": ${retired}.` };
+        if (lane === undefined) {
+            return {
+                refusal: `REMOTE_EXEC="${raw}"${segments.length > 1 ? ` lists "${segment}", which` : ""} is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
+                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`,
+            };
+        }
+        if (lanes.includes(lane))
+            return { refusal: `REMOTE_EXEC="${raw}" lists "${lane}" twice — each execution lane appears once (the first one is the default).` };
+        lanes.push(lane);
+    }
+    const [first, ...rest] = lanes;
+    if (first === undefined)
+        throw new Error(`readDeclaredLaneTable: "${raw}" split into no segments`);
+    return { lanes: [first, ...rest] };
+}
 export function executionLaneRequiredRefusal(deployment) {
     if (!deployment.requireExecutionLane || executionLaneOf(deployment.remoteExec?.provider) !== "in-process")
         return undefined;
@@ -189,7 +266,7 @@ export function deployedExecutionLanes(config) {
     return [executionLaneOf(config.remoteExec?.provider)];
 }
 export function handsOnWorkerFilePlane(lane) {
-    const block = laneBlock(lane, false);
+    const block = laneBlock(lane, NO_SUB_KNOBS);
     return block.io && block.hostLocalPaths;
 }
 export function laneBindsReads(lane) {
@@ -236,10 +313,10 @@ export function laneReadFaceDefault(lane) {
 }
 export const LANE_OPEN_READ_FACE_CAUTION = "a deployment that mounts host paths or shared volumes into the sandbox (hostPath, bind mount) exposes those host files to reads on an open face — pin READ_FACE=roots or add read-deny rows (READ_DENY_PATTERNS) for them";
 export function laneIsolated(lane) {
-    return laneBlock(lane, false).isolation;
+    return laneBlock(lane, NO_SUB_KNOBS).isolation;
 }
 export function laneWiresExecutionEnv(lane) {
-    return laneBlock(lane, false).io;
+    return laneBlock(lane, NO_SUB_KNOBS).io;
 }
 export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
 export const E2B_SANDBOX_HOME = "/home/user";

package/dist/execution-placement.d.ts

@@ -8,6 +8,7 @@
  *    `execution` 位(`plugins/local-session-store.ts`)。处处 `execution` 限定,与同行 `placement_*`(委派分区)不同义;执行格只在 `placement_kind IS NULL` 的行上 ——
  *    委派分区行读作「不在」。
  *  · **读只有一只**:会话店的执行席 {@link ExecutionPlacementSeat.read}(一次行读:住客 + 格;行不在 / 委派分区行 ⇒ `undefined`;读故障抛,不吞成 `absent`)。
+ *    跨行的聚合也只有一只:设备店的绑定数 `countDeviceBindings`(writer(device, D) 的格数 = {@link boundDeviceOf} 的聚合;只交数,不交根 id)。
  *  · **写只按住客谓词** `(root, incarnation, owner) ∧ placement_kind IS NULL`:住客换了(删后重建,哪怕同一属主;local M10 窗内的认领)= 这一格不在 ⇒ 落空;
  *    0 行一律按住客复读分类({@link settledPlaceOutcome} / {@link settledMirrorOutcome} / {@link settledDeviceBindOutcome}),**永不对现住客重试**。
  *  · **没有的转换**:writer ↔ mirror、writer(L) → writer(L')(device 车道的换绑 writer(device, D) → writer(device, D') 除外,它有自己的语句与门)。
@@ -248,6 +249,8 @@ export declare class InMemoryExecutionPlacementSeat implements ExecutionPlacemen
     read(root: string): Promise<ExecutionPlacementReading | undefined>;
     place(root: string, occupant: SessionFace, cell: ExecutionWriterCell): Promise<PlaceOutcome>;
     markMirror(root: string, occupant: SessionFace): Promise<MarkMirrorOutcome>;
+    /** 绑定数(SQL 孪生 `countDeviceBindingsOn` 的对位,同一只判官):{@link boundDeviceOf} 读得出设备的格数。 */
+    countDeviceBindings(): number;
     /** device 首绑(SQL `placeDeviceStatement` / `bindDeviceStatement` 的对位):absent 或 writer(device, ∅) ⇒ writer(device, D)、rev 0。 */
     bindDevice(root: string, occupant: SessionFace, device: {
         readonly id: string;

package/dist/execution-placement.js

@@ -175,6 +175,13 @@ export class InMemoryExecutionPlacementSeat {
         this.rows.set(root, { occupant, cell: { role: "mirror" } });
         return { outcome: "mirrored" };
     }
+    countDeviceBindings() {
+        let bindings = 0;
+        for (const row of this.rows.values())
+            if (boundDeviceOf(row.cell) !== undefined)
+                bindings += 1;
+        return bindings;
+    }
     bindDevice(root, occupant, device, placedAt) {
         const settled = settledDeviceBindOutcome(root, this.rows.get(root), occupant, device.id);
         if (settled !== WRITABLE)

package/dist/fleet/drain-entry.d.ts

@@ -30,6 +30,7 @@
  * 纯类型 + 纯函数叶(值 import 只有 scope 读法叶与 run 行判词叶)。
  */
 import type { DrainReceipt, DrainRequest, EngineDraining } from "@sema-agent/settings-schema/fleet";
+import type { EngineLeaseFacts } from "../boot/engine-lease.js";
 /**
  * 引擎自铸的动作号 —— **一张表**(排空事实与回执里不来自请求体的全部拼法;请求体的 `actionId` 由调用方自取):
  *  · {@link ENGINE_DRAIN_CAUSES}:没有请求承载的排空成因(停止信号 / SIGHUP 升级 / 附着租约自退);
@@ -89,6 +90,8 @@ export interface DrainState {
     lastActivityAt?: () => number;
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
+    /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */
+    engineLease?: () => EngineLeaseFacts | undefined;
 }
 /** 排空盒子里的排空事实(三键齐才是;入口整组写,所以「缺一」只出现在手搭的夹具上)。 */
 export declare function drainingFactOf(s: Pick<DrainState, "draining" | "since" | "actionId" | "deadlineAt">): EngineDraining | undefined;

package/dist/fleet/fleet-bus.d.ts

@@ -369,8 +369,10 @@ export interface HookNonBlockingFailure {
      *  · `matcher_over_budget` —— 这条 hook 所在组的 `matcher`(或条目自己的 `if` 条件)在这次事件的这个名字上求值没在预算内结束(灾难回溯;[ref])。
      *    **不是 hook 脚本坏了,是它的选中条件不可求值**:server 按「选中」处理(守卫不被跳过,条目照跑),此帧说的是「这只 matcher 在这个名字上跑不完」。
      *    **一组一帧**(`if` 一条目一帧),`hookName` / `entryType` 指认组的第一个条目,`detail` 点名 matcher、名字、额度与组里的条目数;无 `exitCode` / `stderr`。
+     *  · `url_not_allowed` —— http 条目被 http hook 名单拦下(`settings.allowedHttpHookUrls`,契约包判官答拦:没命中 / 空名单 / 名单坏形),**一个字节都没发**(7.142.0 起)。
+     *    不是端点坏了,是配置不许它出门;`detail` 点名 `settings.hooks.<event>`、名单键与规则词(`url` / `empty` / `malformed`)和出路;无 `exitCode` / `stderr`。
      */
-    reason: "exit_nonzero" | "timeout" | "spawn_failed" | "bad_json" | "matcher_over_budget";
+    reason: "exit_nonzero" | "timeout" | "spawn_failed" | "bad_json" | "matcher_over_budget" | "url_not_allowed";
     /** hook 身份(CC `OG`/`AEe` 锚:`statusMessage` 优先,否则 command / url / prompt),已脱敏+有界。
      *  ⚠️ http 条目取 URL 时**剥掉 query 与 fragment**([ref] codex R1-F1:端点凭据最常见的挂法是
      *  `?token=…`,而通用脱敏器只认 `user:pass@` 形)。要更友好的名字,作者有 `statusMessage`。 */
@@ -411,9 +413,10 @@ export interface HookManagedUnrun {
      *  · `spawn_failed` / `timeout` —— 起不来 / 超时被收;
      *  · `exit_nonzero` —— 退出码非 0 非 2;`bad_json` —— 看着是 JSON 却读不成(含 http 条目 2xx 回了非 JSON 体、Stop × prompt 的判词读不出);`decision_out_of_set` —— `permissionDecision` 不在 allow / deny / ask 里;
      *  · `evidence_unavailable` —— Stop × prompt 条目因会话证据面不足(或运维关了 transcript)被滤掉没跑;
-     *  · `rewrite_unsettled` —— 一个托管相(插件相 / 策略相)改写了输入、按新输入把那一相重判一遍后仍交回不同的值(不收敛;「改写」按值判,恒等回显不算)。
+     *  · `rewrite_unsettled` —— 一个托管相(插件相 / 策略相)改写了输入、按新输入把那一相重判一遍后仍交回不同的值(不收敛;「改写」按值判,恒等回显不算);
+     *  · `url_not_allowed` —— http 条目被 http hook 名单拦下、没发出(7.142.0 起;同一次的 `hook_non_blocking_failure{url_not_allowed}` 照发)。
      */
-    reason: "matcher_invalid" | "llm_carrier_unavailable" | "llm_cap" | "powershell_unsupported" | "if_unevaluable" | "budget_exhausted" | "spawn_failed" | "timeout" | "exit_nonzero" | "bad_json" | "decision_out_of_set" | "evidence_unavailable" | "rewrite_unsettled";
+    reason: "matcher_invalid" | "llm_carrier_unavailable" | "llm_cap" | "powershell_unsupported" | "if_unevaluable" | "budget_exhausted" | "spawn_failed" | "timeout" | "exit_nonzero" | "bad_json" | "decision_out_of_set" | "evidence_unavailable" | "rewrite_unsettled" | "url_not_allowed";
     /** 那一组的来源词(`managedPolicy` 或 `managedPlugin:<name>`;名只留痕)。 */
     source: string;
     /** hook 身份(同 `hook_non_blocking_failure`:`statusMessage` 优先,否则 command / url〔剥 query〕/ prompt),已脱敏 + 有界。 */

package/dist/hooks/hook-runner.d.ts

@@ -1,5 +1,6 @@
 import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksDroppedPieceCode, type HooksRejection, type HooksRejectionCode } from "@sema-agent/settings-schema/hooks";
 import { type ConfigPath, type UrlCredential } from "@sema-agent/settings-schema";
+import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import type { EngineDollar, ModRegistration } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
@@ -514,6 +515,11 @@ export interface HookRunnerContext {
      *  的 TaskStream.steer(下个 turn 边界注入);返回 false=没有活流可投(任务已结束/挂起/别副本)——
      *  调用方记账不重试(挂起腿的 pending-steer park 是后续切片)。缺席 ⇒ asyncRewake 降级纯 async(记账)。 */
     wake?: (text: string) => Promise<boolean>;
+    /**
+     * http hook 两张名单(`allowedHttpHookUrls` / `httpHookAllowedEnvVars`)的**设置层**,交契约包判官原样读(见 {@link runHttpHook})。必填:每个装配点都要说这条 run 有哪些层 ——
+     * `[]` = 没有层写名单(不限,与引擎外的参照实现「名单未设 ⇒ 不限」同读)。今天唯一的层来源是请求的 `settings`(`task-settings.ts` 的 `httpHookAllowlist`,源 `flagSettings`)。
+     */
+    httpHookAllowlistLayers: readonly HttpHookAllowlistLayer[];
 }
 /** 阶段三b 模型调用载体契约(prompt=直连一次 completion;agent=runTask 收敛后的 final text)。
  *  返回 ok/text 或 ok:false/error——载体自己兜超时(timeoutMs 是硬顶,载体可更严),绝不 throw。 */

package/dist/hooks/hook-runner.js

@@ -4,6 +4,7 @@ import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild, killTreeSoft, killTreeHard } from "../plugins/host-platform.js";
 import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
 import { findUrlCredential, formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
+import { httpHookEnvVarsAllowed, httpHookUrlVerdict } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog } from "@sema-agent/core";
 import { hangClassic } from "./classic-stations.js";
@@ -511,6 +512,7 @@ export function hookIfMatches(cond, payload) {
         return "unevaluable";
     }
 }
+const SERVER_WORKSPACE_TRUST = "no_trust_step";
 const MAX_LLM_ENTRIES_PER_EVENT = 4;
 const DEFAULT_PROMPT_HOOK_TIMEOUT_SECONDS = 30;
 const DEFAULT_AGENT_HOOK_TIMEOUT_SECONDS = 120;
@@ -996,8 +998,29 @@ async function runLlmHook(entry, payload, ctx, extra) {
             clearTimeout(hardTopTimer);
     }
 }
+function httpHookWithheldSentence(event, block) {
+    const field = `settings.${block.list}`;
+    const [why, exit] = (() => {
+        switch (block.rule) {
+            case "url":
+                return [`its url matches no pattern in ${field}`, `add a pattern that matches the url to ${field}, or point the hook at a url the list allows`];
+            case "empty":
+                return [`${field} is an empty list, so no http hook may run`, `add a pattern that matches the url to ${field}`];
+            case "malformed":
+                return [`${field} is not an array of strings, so it is read as allowing no url`, `write ${field} as an array of url pattern strings`];
+            default: {
+                const unhandled = block.rule;
+                throw new Error(`httpHookWithheldSentence: unhandled rule ${String(unhandled)}`);
+            }
+        }
+    })();
+    return `settings.hooks.${event}: http hook not sent — ${why} (rule: ${block.rule}); ${exit}`;
+}
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
+    const block = httpHookUrlVerdict(entry.url, ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST);
+    if (block !== undefined)
+        return { code: null, stdout: "", stderr: "", timedOut: false, withheld: block };
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
     let hookChildVars;
     try {
@@ -1006,7 +1029,7 @@ async function runHttpHook(entry, payload, ctx, event) {
     catch (e) {
         return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
     }
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, httpHookEnvVarsAllowed(entry.allowedEnvVars ?? [], ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST), hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,
@@ -1210,6 +1233,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 ctx.logger.warn("hook_command_killed", { event, type: entry.type, killed: true, signal: run.aborted.signal });
             return { kind: "halted" };
         }
+        if (run.withheld !== undefined) {
+            const { list, rule, sources } = run.withheld;
+            ctx.logger.warn("hook_http_withheld", { event, url: entry.type === "http" ? buildDisplaySafeUrl(entry.url) : null, list, rule, sources: [...sources] });
+            noteHookFailure(ctx, { event, entry, reason: "url_not_allowed", detail: httpHookWithheldSentence(event, run.withheld), ...(toolName !== undefined ? { toolName } : {}) });
+            return { kind: "unrun", reason: "url_not_allowed" };
+        }
         if (run.spawnError) {
             ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: seatText("operator-log-error", run.spawnError) });
             if (!run.noticed)

package/dist/hosted-posture.d.ts

@@ -65,6 +65,7 @@
  * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
+import { type PermissionMode } from "@sema-agent/core";
 /** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
  *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
 export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
@@ -123,6 +124,13 @@ export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceCon
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+/**
+ * **腿② 的词形入口** —— 一个模式词在这台部署上会不会开出它掀不开的写围栏:词的模式列开写面(引擎模式表本尊,
+ * `modePolicyOf(word).writeFace === "open"`,今天只有 `bypassPermissions`)∧ {@link taskWriteFaceRefusal} 答拒 ⇒ 拒因;否则 `undefined`。
+ * 读者两个,同是受理判官的托管一步(`permission-mode-admission.ts` 顶注「两口的调用形」):在飞 run 的切档口经判官本体;提交口与续跑重放存储体经装配期那一判
+ * (`boot/resolve-spec.ts`,问盖过章的词)。哪天 core 让第二个模式也开写面,两处当场跟上,不是再手抄一个模式词。
+ */
+export declare function permissionModeWriteFaceRefusal(word: PermissionMode | undefined, c: TaskWriteFaceInput): string | undefined;
 /**
  * **腿④** —— 这条请求要让 host shell 继承整份用户环境(`inheritEnv:"all"`),这台部署给不给?返回拒因;`undefined` = 放行。
  * 调用方只在值为 `"all"` 时问(`"scrub"` 就是缺省,任何部署都受理)。

package/dist/hosted-posture.js

@@ -1,5 +1,6 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { modePolicyOf } from "@sema-agent/core";
 export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
@@ -41,6 +42,9 @@ export function taskWriteFaceRefusal(c) {
         `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
+export function permissionModeWriteFaceRefusal(word, c) {
+    return word !== undefined && modePolicyOf(word).writeFace === "open" ? taskWriteFaceRefusal(c) : undefined;
+}
 export function taskInheritEnvRefusal(c) {
     if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;

package/dist/http/admission.js

@@ -2,11 +2,11 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
-import { autonomyModeFloor } from "../runtime-governance.js";
+import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -738,7 +738,7 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const { body: admitted, entry: entryMode } = stampSubmissionEntryMode(body, deps.config);
         const lease = deps.peerDesk.lease("fresh");
         try {
             const auth = await deps.authorize({ req, body: admitted });

package/dist/http/caller-trust.d.ts

@@ -3,8 +3,9 @@
  *
  * ## 律
  * 契约(settings-schema `SAFETY_MERGE_SPEC.permissions` 的成员阶梯)按**层的信任档**准入每个成员:`allow` 放宽免问面(`loosen`),要 `global`;`deny` / `ask` 只收紧,
- * 文件层最低档 `local` 就收。wire 上没有层 —— 提交体是合并后的扁平结果,层只在合并端(cli 本地)存在;自报一个层 / 作者位不可验(引擎侧已拒立这种位)。所以本服务
- * 的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源 + 登录令牌的 scope 角色推,调用方说什么都不改档。
+ * 文件层最低档 `local` 就收。准入不读层:提交体是合并后的结果,层只在合并端(cli 本地)存在;deny / ask 条目可以带出处层(`{ rule, layer }`),但那个层只选这条规则的
+ * `/` 读在哪个根(`permission-rule-list.ts` 的 `layerRuleRoot`),自报的层不可验、**不进本判**。所以本服务准入的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源
+ * + 登录令牌的 scope 角色推,调用方说什么(含条目上的层)都不改档。
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;

package/dist/http/caller-trust.js

@@ -1,6 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
+import { ruleTextOf } from "../permission-rule-list.js";
 import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
@@ -34,7 +35,7 @@ function effectiveRuleTables(t) {
         for (const member of membersOf("permissions")) {
             const entries = t.permissions[member];
             if (entries !== undefined)
-                out.push({ member, field: `settings.permissions.${member}`, entries, source: "settings" });
+                out.push({ member, field: `settings.permissions.${member}`, entries: entries.map(ruleTextOf), source: "settings" });
         }
     }
     if (t.skills !== undefined && t.userInvokedSkills !== undefined) {

package/dist/http/dispatch.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, setSsoPrincipalInc, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity } from "../auth-bridge.js";
@@ -138,6 +138,10 @@ export function createDispatch(ctx) {
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...healthDrainingKeys(signal),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
+                ...(() => {
+                    const lease = deps.drainState?.engineLease?.();
+                    return lease ? { engineLease: { lingerMs: lease.lingerMs, tickMs: lease.tickMs } } : {};
+                })(),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,
@@ -223,6 +227,8 @@ export function createDispatch(ctx) {
                     setSsoScope(req, identity.scope);
                     if (identity.role)
                         setSsoRole(req, identity.role);
+                    if (identity.principalInc !== undefined)
+                        setSsoPrincipalInc(req, identity.principalInc);
                     deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
@@ -232,7 +238,7 @@ export function createDispatch(ctx) {
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
-        admitRunIdentity(req, identitySource);
+        admitRunIdentity(req, identitySource, deps.logger);
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {

package/dist/http/execution-context.d.ts

@@ -85,8 +85,8 @@ export type ExecutionContext = {
 export type RootedExecutionContext = Extract<ExecutionContext, {
     readonly root: string;
 }>;
-/** 装配器(`resolveSpec`)收的那一半:根与入口形(它不判放置、不选车道)。 */
-export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root">;
+/** 装配器(`resolveSpec`)收的那一半:根、入口形与解析器选定的车道(它不判放置、不选车道 —— `lane` 是解析器那一次的读数,装配器只读:项目包的车道门)。 */
+export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root" | "lane">;
 /** 解析器读的部署件(全部取自同一只 `ServiceDeps`)。 */
 export interface ExecutionContextDeps {
     readonly config: ServiceConfig;

package/dist/http/idempotency.d.ts

@@ -117,7 +117,7 @@ export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFa
  * 再走 `/v1/tasks`,合流到的是前者的那份结局。回执若铸在同步腿的体里,这条**确实产了帧**的 run 在非流式面上
  * 就成了「键缺席」,而 present-iff 的读法会把它读成「这台引擎不给回执」。挂在 outcome 上 = 它是**这条 run 的
  * 属性**(哪条腿跑的都一样),由各腿自己的应答构造器在送出那一刻按自己的 wire 形挂。
- * 落定之后的同键重放不走这里:它读行,体是 run 行读面 + `replay: true`(`http/submit-replay.ts`)—— 回执是起手那一帧
+ * 落定之后的同键重放不走这里:它读行,体是首答的信封 + `replay: true`(`http/submit-replay.ts` → `http/sync-submit-body.ts`)—— 回执是起手那一帧
  * 的活捕获、不落行,所以重放体上**不带** `wiringManifest`(`replay: true` 就是那一形的判别位)。
  *
  * 🔴 **租户面安全(别在复审里当成漏)**:合流的那份回执是按**第一位调用方**的 `explicitOperatorOk` 投的,

package/dist/http/live-frame.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `POST /v1/tasks/stream`(活流腿:新提交、同键重放、在飞合流的跟随方)的**唯一**帧写口。
+ *
+ * 律(一条):这条流上的每一帧都是 `[id: <eventId>\n]event: <type>\ndata: <json>\n\n`,事件名 = 载荷的 `type`。
+ * 心跳是同一只写口写的 `event: heartbeat` + `data: {}`。与 durable 尾(`http/sse-log.ts`)、sdk 的 `toSseResponse` 中继同形。
+ *
+ * `id:` 行(契约 §0.6):载荷带非空 string `eventId` 才发,值逐字 = `eventId`;没有就不发,EventSource 沿用上一游标 ——
+ * 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。`id:` 行是**每帧唯一**的续流游标,所以载荷的 `eventId` 必须是**本帧
+ * 自己的**身份(server 自铸帧的唯一铸点:`trace/model-segment.ts` 的 `reasoningSegmentEventId`)。三道门各管一段:
+ * {@link LiveFrame} 管「铸点说得出这两个键的型」;本函数的运行期判据管「真的是」(通体 `Record<string, unknown>` 的
+ * 构造器返回值进得来 —— `null` 读 `.length` 会把整条流摔掉、数组会被强转成一枚编出来的游标);`test/live-sse-cursor.test.ts`
+ * 的规则式全流判据管「同一条流内不重复」。
+ */
+import type { ServerResponse } from "node:http";
+/** 活流帧的载荷型:`type` 是事件名(必填,型说得出口);`eventId` 在场即**本帧自己的**续流游标。其余键由各自铸点白名单。 */
+export type LiveFrame = {
+    readonly type: string;
+    readonly eventId?: string;
+} & Record<string, unknown>;
+/** 写一帧。`type` 不是非空串 = 铸点违约(型门之外漏进来的通体记录),响亮抛 —— 写一行编出来的事件名是撒谎,不写事件名就回到两只形。 */
+export declare function writeLiveFrame(res: ServerResponse, payload: LiveFrame): void;
+/** 心跳:真帧,不是 SSE 注释(逐帧解析的 BFF 会丢注释行,下游看到的是一段零帧的窗)。没有监听心跳的 EventSource 客户端忽略它。 */
+export declare function writeLiveHeartbeat(res: ServerResponse): void;
+//# sourceMappingURL=live-frame.d.ts.map

package/dist/http/live-frame.js

@@ -0,0 +1,16 @@
+import { liveToolEndForBacklog } from "../trace/tool-output-media.js";
+function frameBytes(event, data, anchor) {
+    const idLine = typeof anchor === "string" && anchor.length > 0 ? `id: ${anchor}\n` : "";
+    return `${idLine}event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+}
+export function writeLiveFrame(res, payload) {
+    const name = payload.type;
+    if (typeof name !== "string" || name.length === 0)
+        throw new TypeError(`live SSE frame without a string type: ${JSON.stringify(name)}`);
+    const frame = name === "tool_end" ? liveToolEndForBacklog(payload, res.writableLength) : payload;
+    res.write(frameBytes(name, frame, payload.eventId));
+}
+export function writeLiveHeartbeat(res) {
+    res.write(frameBytes("heartbeat", {}, undefined));
+}
+//# sourceMappingURL=live-frame.js.map

package/dist/http/principal-gate.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import { type DurableOwnerKey, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
 import { type IdentitySource, type RunIdentity } from "../identity-source.js";
+import type { Logger } from "../observability/logger.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
 export declare function headerStr(v: string | string[] | undefined): string | undefined;
 export declare function safeEqual(a: string, b: string): boolean;
@@ -28,8 +29,9 @@ export declare function verifiedIdentitySource(req: IncomingMessage, config: Ser
 /**
  * 🔴 **run 行身份元组的唯一铸点**(律见 `identity-source.ts` 头注;唯一调用点 = `dispatch.ts` 的凭据门,机器门钉着)。`source` = 凭据门那一次
  * {@link verifiedIdentitySource} 的答案 —— 这里不再判来源,只把来源连同它的 scope / 化身号定成元组,挂在这个请求上;建 run 行的点经 {@link runIdentityOf} 读它。
+ * `logger` 收律 4 的告警行(令牌声明装不进列;凭据门交 `deps.logger`)。
  */
-export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined): void;
+export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined, logger: Pick<Logger, "warn"> | undefined): void;
 /**
  * 建 run 行时写进行里的身份元组 —— 每个 `createRun` 调用点(或替它建行的腿的调用方)读这一只,原样写入(机器门:`src/http/**` 每处 `createRun` 都写明 `identity`)。
  * 只在**受理请求验过的主体就是这一行的属主**时交出凭据门铸下的元组(提交面恒成立:行的属主就是这个主体);别人替属主按下的那一跑(唤醒、决定投递铸的

package/dist/http/principal-gate.js

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from "node:crypto";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
-import { IDENTITY_SOURCES, RUN_IDENTITY_SCOPE_MAX_CHARS } from "../identity-source.js";
+import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
+import { IDENTITY_SOURCES, runIdentityClaimOverflow } from "../identity-source.js";
 import { sendError } from "./send.js";
 export function headerStr(v) {
     return Array.isArray(v) ? v[0] : v;
@@ -60,19 +60,28 @@ export function verifiedIdentitySource(req, config) {
     return IDENTITY_SOURCES.find((kind) => identitySourceVerified(kind, req, config));
 }
 const ADMITTED_RUN_IDENTITY = new WeakMap();
-export function admitRunIdentity(req, source) {
-    ADMITTED_RUN_IDENTITY.set(req, mintRunIdentity(req, source));
-}
-function mintRunIdentity(req, source) {
+export function admitRunIdentity(req, source, logger) {
+    ADMITTED_RUN_IDENTITY.set(req, mintRunIdentity(req, source, logger));
+}
+function mintRunIdentity(req, source, logger) {
+    const fits = (claim, value) => {
+        const overflow = runIdentityClaimOverflow(claim, value);
+        if (overflow !== undefined)
+            logger?.warn("run_identity_claim_unrecorded", { claim: overflow.claim, chars: overflow.chars, max: overflow.max });
+        return overflow === undefined;
+    };
     switch (source) {
         case "service_token":
         case "direct_door_jwt":
             return { source, scope: null, principalInc: null };
         case "sso": {
             const scope = ssoVerifiedScope(req);
-            if (scope === undefined || [...scope].length > RUN_IDENTITY_SCOPE_MAX_CHARS)
+            if (scope === undefined)
+                return null;
+            if (!fits("scope", scope))
                 return null;
-            return { source, scope, principalInc: null };
+            const principalInc = ssoVerifiedPrincipalInc(req);
+            return { source, scope, principalInc: principalInc !== undefined && fits("principalInc", principalInc) ? principalInc : null };
         }
         case undefined:
             return null;