@sema-agent/server 7.140.0 → 7.142.0

package/dist/trace/self-minted-wire.js

@@ -150,6 +150,13 @@ export const SELF_MINTED_WIRE = {
             title: { attr: "-", since: "7.133.0" },
         },
     },
+    mcpTransportKind: {
+        at: "GET /v1/capabilities mcpTransportKinds[]",
+        members: {
+            stdio: { attr: "-", since: "7.141.0" },
+            http: { attr: "-", since: "7.141.0" },
+        },
+    },
     credentialPlaneSandboxGitState: {
         at: "GET /v1/capabilities credentialPlane.sandboxGit.state",
         members: {
@@ -228,6 +235,13 @@ export const SELF_MINTED_WIRE = {
             deploymentPackages: { attr: "present-iff deployment mod packages loaded at boot", since: "7.138.0" },
         },
     },
+    healthEngineLeaseKey: {
+        at: "GET /health engineLease",
+        members: {
+            lingerMs: { attr: "present-iff engine lease leg armed and observing", since: "7.141.0" },
+            tickMs: { attr: "present-iff engine lease leg armed and observing", since: "7.141.0" },
+        },
+    },
     modelsRowKey: {
         at: "GET /v1/models models[] 行键(<键> → 在场律)",
         members: {
@@ -244,6 +258,13 @@ export const SELF_MINTED_WIRE = {
         at: "GET /v1/sessions sessions[] 行键 = PATCH /v1/sessions/:id 200 体 = 409 conflict.session_row_changed currentRow(<键> → 在场律)",
         members: {
             rowTag: { attr: "present-iff the row can be written conditionally (the store has the row write primitive and the row carries an incarnation)", since: "7.139.0" },
+            unreadable: { attr: "present-iff the session head's leaf cannot be read (the file backend: the archive header is corrupt / truncated, or the archive cannot be read); the SQL backends never carry it; PATCH answers 500 for such a session before writing, so its 200 / 409 rows never carry it", since: "7.142.0" },
+        },
+    },
+    sessionsListRowUnreadableKey: {
+        at: "GET /v1/sessions sessions[].unreadable 键(<键> → 在场律)",
+        members: {
+            errorCode: { attr: "always; the errorCode GET /v1/sessions/:id answers for the same session (corrupt_session | internal.error today)", since: "7.142.0" },
         },
     },
     toolEndGateDispositionKey: {
@@ -338,6 +359,18 @@ export const SELF_MINTED_WIRE = {
             no_authorizer_session: { attr: "-", since: "7.137.0" },
         },
     },
+    projectBundleInvalidReason: {
+        at: "400 attachment.bundle_invalid reason(上传项目包 mime 的体过不了项目包的读者;另带 path?)",
+        members: {
+            not_archive: { attr: "-", since: "7.142.0" },
+            unsafe_path: { attr: "-", since: "7.142.0" },
+            entry_type: { attr: "-", since: "7.142.0" },
+            reserved_path: { attr: "-", since: "7.142.0" },
+            duplicate_path: { attr: "-", since: "7.142.0" },
+            expanded_too_large: { attr: "-", since: "7.142.0" },
+            too_many_entries: { attr: "-", since: "7.142.0" },
+        },
+    },
     submitIdempotency: {
         at: "提交幂等(<端点>#<面> → 应答状态)",
         members: {
@@ -346,6 +379,10 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/leader?idempotencyKey": { attr: 200, since: "7.125.0" },
             "POST /v1/runs|/v1/tasks Idempotency-Key#conflict.run_exists": { attr: 409, since: "7.125.0" },
             "POST /v1/runs|/v1/tasks Idempotency-Key#conflict.idempotency_payload_mismatch": { attr: 409, since: "7.126.0" },
+            "POST /v1/tasks|/v1/tasks/stream#replay_first_answer_envelope(同键重放的体 = 首答的信封 + replay: true:终局 = 引擎结果(result 是串),停驻 = 结果 + 回执三键,行还在跑 = 回执三键;流式腿放进 done.result)": { attr: 200, since: "7.142.0" },
+        },
+        retired: {
+            "POST /v1/tasks|/v1/tasks/stream#replay_run_read_face(同键重放的体 = GET /v1/runs/:id 的读面 + replay: true:result 是对象,外加 status / errorCode / heldBy 等读面键)": { attr: 200, since: "7.125.0", until: "7.142.0" },
         },
     },
     builtinScenario: {
@@ -418,6 +455,33 @@ export const SELF_MINTED_WIRE = {
             acceptableForm: { attr: "present-iff", since: "7.137.0" },
         },
     },
+    permissionModeVerbBodyKey: {
+        at: "POST /v1/runs/:id/permission-mode 200 体(<键> → 在场律)",
+        members: {
+            taskId: { attr: "always", since: "7.141.0" },
+            sessionId: { attr: "always", since: "7.141.0" },
+            status: { attr: "always;running", since: "7.141.0" },
+            permissionMode: { attr: "always;engine receipt verbatim { requested?, effective, foldedBy? }", since: "7.141.0" },
+            admission: { attr: "present-iff the admission judge changed the word;{ requested, admitted, foldedBy }", since: "7.141.0" },
+            persisted: { attr: "always", since: "7.141.0" },
+            persistMiss: { attr: "present-iff persisted:false", since: "7.141.0" },
+        },
+    },
+    permissionModeAdmissionFold: {
+        at: "POST /v1/runs/:id/permission-mode 200 体 admission.foldedBy",
+        members: {
+            entry_floor: { attr: "-", since: "7.141.0" },
+            disable_auto_mode: { attr: "-", since: "7.141.0" },
+        },
+    },
+    permissionModePersistMiss: {
+        at: "POST /v1/runs/:id/permission-mode 200 体 persistMiss(persisted:false 时)",
+        members: {
+            claim_released: { attr: "-", since: "7.141.0" },
+            context_absent: { attr: "-", since: "7.141.0" },
+            store_failed: { attr: "-", since: "7.141.0" },
+        },
+    },
     endpointFaceStatus: {
         at: "逐端点应答面 → 状态(<端点>#<面> → 状态;只登记本版改了状态的面)",
         members: {
@@ -437,6 +501,9 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/sessions/:id/sync/import#identical_repush_blob_missing(体 missing_blob)": { attr: 422, since: "7.136.0" },
             "PATCH /v1/sessions/:id#title_no_visible_character(体 request.field_invalid)": { attr: 400, since: "7.136.0" },
             "POST /v1/sessions/:id/sync/import#title_no_visible_character(Phase A 体的 title;体 request.field_invalid)": { attr: 400, since: "7.136.0" },
+            "POST /v1/sessions/:id/sync/import#anchor_outside_declared_entries(Phase A 体的 anchors[i]:entryId 不在 entryIds 里 / 元素不是带串型 eventId 与 entryId 的对象;体 request.field_invalid)": { attr: 400, since: "7.141.0" },
+            "POST /v1/sessions/:id/fork#stamped_archive(DB_BACKEND=local;源存档仍带更早版本写下的属主戳;零写;体 conflict + 带戳存档的固定句)": { attr: 409, since: "7.141.0" },
+            "POST /v1/sessions/:id/sync/import/:stagingId/entries#stamped_archive(DB_BACKEND=local;提交落在仍带属主戳的存档上;行净零写;体 conflict + 带戳存档的固定句)": { attr: 409, since: "7.141.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#images_url_credential(新提交;体 request.field_invalid + field images[i].url + reason url_userinfo|url_credential_param)": { attr: 400, since: "7.136.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_malformed(新提交;列表不是数组 / 条目不是对象 / 键值判不出形;体 request.field_invalid)": { attr: 400, since: "7.136.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#a2aPeers_unknown_key(新提交;词表外的键;体 request.body_shape + unknownKeys)": { attr: 400, since: "7.136.0" },
@@ -450,6 +517,8 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#skills[i].mods|agents[i].skills[j].mods(新提交;体 request.field_invalid)": { attr: 400, since: "7.137.0" },
             "PUT /v1/sessions/:id/policy|POST /v1/sessions/:id/sync/import#toolDeny 名内带 *(`*` / `mcp__git*` / `Bas*`)": { attr: 200, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#限制侧名内带 *(settings.permissions.deny|ask)": { attr: 200, since: "7.137.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#settings.permissions.deny|ask 带层条目 { rule, layer }(新提交;layer = 设置来源词)": { attr: 200, since: "7.141.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#user 层 / 形路径规则而执行环境的配置根读不出(沙箱车道没转 SEMA_CONFIG_DIR 且 home 未知;体 request.unprocessable + problems[].reason home_unresolvable;续跑 409 同句)": { attr: 422, since: "7.141.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#限制侧名内带 *(excludeTools)": { attr: 200, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#限制侧名内带 *(skills[i].disallowedTools|agents[i].skills[j].disallowedTools)": { attr: 200, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#限制侧名内带 *(agents[i].denyTools)": { attr: 200, since: "7.137.0" },
@@ -457,6 +526,7 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/assistant/tasks/:id/plan_review#checkpointId_current(体带当前门的身份;受理形与不带键同)": { attr: 200, since: "7.137.0" },
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#rewindFiles(新提交;体 request.body_shape + unknownKeys [rewindFiles])": { attr: 400, since: "7.139.0" },
             "POST /v1/side-query#uncoded_error_with_preflight_prefix(没有引擎码、英文开头与前缀表同形的错误;体 internal.error)": { attr: 500, since: "7.139.0" },
+            "POST /v1/approvals/:sessionId/decide#parked_principal_lane_not_permitted(停驻赎回;卡的主体此刻不被许可本部署的执行车道;approve 与 deny 同答;认领之前,停驻行不动、卡仍待决;体 resume_blocked_by_policy + blockedBy execution_lane_not_allowed + allowedLanes + lane + retriable)": { attr: 409, since: "7.139.0" },
             "PATCH /v1/sessions/:id#mirror_row(只读镜像行上的写,带不带 expectedRowTag;体 conflict.session_mirror + forkPath)": { attr: 409, since: "7.139.0" },
             "PATCH /v1/sessions/:id#owner_changed_after_gate(门那一读之后同一会话的属主被改;体 not_found.session)": { attr: 404, since: "7.139.0" },
             "PATCH /v1/sessions/:id#expectedRowTag_stale(行已不在那只标签上;体 conflict.session_row_changed + currentRow)": { attr: 409, since: "7.139.0" },
@@ -465,6 +535,9 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/memory/erase|POST /v1/sessions/:id/memory/erase#erasure_store_unjudged(抹除落到部署的店之外的那只店:点名的层住在个人挂载上,或按会话抹除而这只会话在另一只店有贡献 / 那只店的账读不出;体 memory.erasure_store_unjudged,什么都没删)": { attr: 409, since: "7.140.0" },
             "POST /v1/memory/export|POST /v1/memory/import|GET /v1/memory/origin/external|POST /v1/memory/erase#layers_span_two_stores(请求点名的层分住两只店;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
             "记忆诸口 + POST /v1/admin/memory/consolidation/run|GET /v1/admin/memory/consolidation|GET /v1/memory/export|POST /v1/memory/sync/:scope#layer_unreadable(请求点名的层引擎读不出;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+            "POST /v1/memory/sync/:scope#identity_undeclared(DB 记忆平面没声明 MEMORY_SYNC_SERVE_IDENTITY;鉴权之后;体 feature.memory_sync_serve_disabled)": { attr: 501, since: "7.142.0" },
+            "POST /v1/memory/sync/:scope#peer_not_declared_identity(peer 不是同步身份的规范形 / 带凭据 / 非 http(s) / 超宽 / 空串;体 request.field_invalid + field peer + reason)": { attr: 400, since: "7.142.0" },
+            "POST /v1/memory/sync/:scope#peer_not_this_center(peer 是规范形但不等于本中心声明的身份;零读零写;体 config.memory_sync_target_mismatch)": { attr: 409, since: "7.142.0" },
         },
     },
     memoryLayerSeatKey: {
@@ -477,6 +550,42 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/sessions/:id/memory/erase#body.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ the deployment's store;selector still minted from the path", since: "7.140.0" },
         },
     },
+    sessionMemoryStatusKey: {
+        at: "GET /v1/sessions/:id/memory-status 200 体顶层键(<键> → 在场律)",
+        members: {
+            memorySync: { attr: "present-iff this deployment runs a memory sync leg;{parked:[{scope,wayOut}]} in sync order;parked:[] ⇔ no layer parked;deployment fact (same for every session, ?scope= not applied)", since: "7.141.0" },
+        },
+    },
+    memorySyncWayOut: {
+        at: "GET /v1/sessions/:id/memory-status memorySync.parked[].wayOut",
+        members: {
+            delete_cursor: { attr: "-", since: "7.141.0" },
+        },
+    },
+    memorySyncIdentityFlaw: {
+        at: "400 request.field_invalid reason(POST /v1/sessions/:id/memory/sync 的 target · POST /v1/memory/sync/:scope 的 peer;另带 field)",
+        members: {
+            "not-http-url": { attr: "-", since: "7.142.0" },
+            userinfo: { attr: "-", since: "7.142.0" },
+            query: { attr: "-", since: "7.142.0" },
+            fragment: { attr: "-", since: "7.142.0" },
+            credential: { attr: "-", since: "7.142.0" },
+            "too-long": { attr: "-", since: "7.142.0" },
+            "not-canonical": { attr: "-", since: "7.142.0" },
+        },
+    },
+    sessionMemorySyncWire: {
+        at: "POST /v1/sessions/:id/memory/sync(<面>#<键> → 读法 / 在场律)",
+        members: {
+            "body#target": { attr: "required;the only key;the target engine's GET /v1/capabilities memorySyncServe.identity verbatim;not a declared sync identity ⇒ 400 request.field_invalid", since: "7.142.0" },
+            "200#target": { attr: "always;engine report verbatim", since: "7.142.0" },
+            "200#sourceRevision": { attr: "always;the session leafId read in the same head read as the owner gate", since: "7.142.0" },
+            "200#scopes": { attr: "always;the read set: latest settled run's effectiveMemoryScopes (mounted ⇒ scope keys in serving order; memoryless / none ⇒ [])", since: "7.142.0" },
+            "200#layers": { attr: "present-iff no whole-round refusal;one entry per read-set layer the round ran (engine outcome synced | incomplete | refused | failed)", since: "7.142.0" },
+            "200#refused": { attr: "present-iff whole-round refusal;{code: config.memory_sync_target_mismatch | session_active, message}", since: "7.142.0" },
+            "409 conflict.session_memory_unobserved#activeTaskId": { attr: "present-iff the session has a run in flight", since: "7.142.0" },
+        },
+    },
     refusalSentenceForm: {
         at: "拒体 message 的句型(<码>#<座> → 句型骨架;码 / 状态 / 机读位不变)",
         members: {
@@ -489,6 +598,8 @@ export const SELF_MINTED_WIRE = {
             "503 state.file_history_unreadable#store_deployment_fault(会话同步三条拉取口)": { attr: "this session's stored state cannot be read: the store does not match what this deployment requires (a table is missing or the database account lacks a privilege), so nothing was exported — retrying will not help until an operator repairs the store", since: "7.137.0" },
             "connect_failed(run 失败终局)#snapshot_bucket_missing(k8s 车道读 latest 得 404 NoSuchBucket;连沙箱失败,一只 pod 都不建)": { attr: "workspace space pointer read failed (snapshot_bucket_missing): the workspace snapshot bucket <name> (WORKSPACE_SNAPSHOT_BUCKET; default workspaces) does not exist in the object store — refusing to start this run … Ways out: create the bucket, or set WORKSPACE_SNAPSHOT_BUCKET to one that exists, or set WORKSPACE_PERSIST=off …", since: "7.136.0" },
             "400 request.field_invalid#images[i].url.credential": { attr: "<field> <规则句> — the URL is kept as written (a parked task's resume context, logs), while images[i] can carry the image bytes inline: send { data, mimeType } instead of a URL that holds the credential", since: "7.136.0" },
+            "400 request.field_invalid#settings.permissions.deny|ask.bad_entry": { attr: "<field>[<index>] is neither a non-empty rule string nor a { \"rule\", \"layer\" } entry (…) — every entry must be one. …", since: "7.141.0" },
+            "400 request.field_invalid#settings.permissions.allow.bad_entry": { attr: "<field>[<index>] is not a string — every entry must be a permission-rule string (a settings layer's { \"rule\", \"layer\" } entry is read in deny / ask only). …", since: "7.141.0" },
             "400 request.field_invalid#a2aPeers.not_array": { attr: "head: a2aPeers is <shape>, not an array of A2A peer declarations", since: "7.136.0" },
             "400 request.field_invalid#a2aPeers[i].not_object": { attr: "head: a2aPeers[i] is <shape>, not an A2A peer declaration (an object)", since: "7.136.0" },
             "400 request.field_invalid#a2aPeers[i].<key>.unusable(url / cardUrl 凭据拒之外的键值坏形)": { attr: "<field> (peer <name>) is not a usable declaration — <rule> …", since: "7.136.0" },
@@ -566,6 +677,7 @@ export const SELF_MINTED_WIRE = {
         at: "GET /v1/config/catalog rows[](<行名> → 域;只登本版新增的行)",
         members: {
             SEALED_KEY_DIR: { attr: "store", since: "7.136.0" },
+            MEMORY_SYNC_SERVE_IDENTITY: { attr: "memory", since: "7.142.0" },
         },
     },
     deviceProtocolRevision: {
@@ -576,6 +688,36 @@ export const SELF_MINTED_WIRE = {
             3: { attr: "+name_too_long", since: "7.137.0" },
         },
     },
+    hookNonBlockingFailureReason: {
+        at: "fleet stream hook_notice kind:hook_non_blocking_failure reason",
+        members: {
+            exit_nonzero: { attr: "-", since: "7.48.0" },
+            timeout: { attr: "-", since: "7.48.0" },
+            spawn_failed: { attr: "-", since: "7.48.0" },
+            bad_json: { attr: "-", since: "7.48.0" },
+            matcher_over_budget: { attr: "-", since: "7.133.0" },
+            url_not_allowed: { attr: "-", since: "7.142.0" },
+        },
+    },
+    hookManagedUnrunReason: {
+        at: "fleet stream hook_notice kind:hook_managed_unrun reason",
+        members: {
+            matcher_invalid: { attr: "-", since: "7.133.0" },
+            llm_carrier_unavailable: { attr: "-", since: "7.133.0" },
+            llm_cap: { attr: "-", since: "7.133.0" },
+            powershell_unsupported: { attr: "-", since: "7.133.0" },
+            if_unevaluable: { attr: "-", since: "7.133.0" },
+            budget_exhausted: { attr: "-", since: "7.133.0" },
+            spawn_failed: { attr: "-", since: "7.133.0" },
+            timeout: { attr: "-", since: "7.133.0" },
+            exit_nonzero: { attr: "-", since: "7.133.0" },
+            bad_json: { attr: "-", since: "7.133.0" },
+            decision_out_of_set: { attr: "-", since: "7.133.0" },
+            evidence_unavailable: { attr: "-", since: "7.133.0" },
+            rewrite_unsettled: { attr: "-", since: "7.133.0" },
+            url_not_allowed: { attr: "-", since: "7.142.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {
@@ -605,6 +747,9 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/config/catalog#rows[CONFIG_PROVIDER].semantics": { attr: "remote-without-center-url-refuses-boot", since: "7.139.0" },
             "GET /v1/config/catalog#rows[RETENTION_MODE].semantics": { attr: "enforce-without-horizon-or-cadence-refuses-boot", since: "7.139.0" },
             "GET /v1/config/catalog#rows[RETENTION_SWEEP_INTERVAL_SEC].semantics": { attr: "cadence-without-horizon-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[DEVICE_RELAY_URL].semantics": { attr: "required-on-device-lane;ws-url-or-literal-none;none-with-bindings-warns", since: "7.141.0" },
+            "GET /v1/config/catalog#rows[DEVICE_RELAY_URL].derivedDefaultNote": { attr: "no-default;absent-refuses-boot", since: "7.141.0" },
+            "GET /v1/config/catalog#rows[DEVICE_RELAY_URL].enumValues": { attr: "none(echoed-verbatim)", since: "7.141.0" },
             "GET /v1/sessions/:id/mcp#servers[].error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "POST /v1/sessions/:id/mcp/reconnect#reason|status.error|listingIncomplete.error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "GET /v1/config/catalog#rows[MODEL_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },

package/dist/trace/wire-projection-faces.d.ts

@@ -243,7 +243,7 @@ export declare const WIRE_PROJECTION_FACES: {
         readonly projector: "engineNoticeEventData";
         readonly coreType: "EngineNotice";
         readonly excluded: readonly [];
-        readonly minted: readonly ["ts"];
+        readonly minted: readonly ["ts", "eventId"];
     };
     readonly memory_import_report: {
         readonly projector: "buildImportReportWire";

package/dist/trace/wire-projection-faces.js

@@ -71,7 +71,7 @@ export const WIRE_PROJECTION_FACES = {
             return WIRE_PROJECTION_FACES.wiring_manifest_tenant.mintedConditional;
         },
     },
-    engine_notice: { projector: "engineNoticeEventData", coreType: "EngineNotice", excluded: [], minted: ["ts"] },
+    engine_notice: { projector: "engineNoticeEventData", coreType: "EngineNotice", excluded: [], minted: ["ts", "eventId"] },
     memory_import_report: { projector: "buildImportReportWire", coreType: "MemoryImportReport", excluded: [], minted: [] },
     origin_clearance_row: {
         projector: "buildClearanceRowWire",

package/dist/verifier-pause-card.d.ts

@@ -0,0 +1,8 @@
+import { type CardVoidPort } from "./card-void.js";
+/**
+ * 结果上若有验证器自己的停驻(带凭据)⇒ 作废它那张 pending 卡;否则零 I/O。**必须在出口封口之前调**(封口摘掉的正是这里要用的凭据)。
+ * 不抛:作废失败只让卡回到修前的形(由兜底收割),响亮留痕({@link VOID_FAILED});结算照常往下走。
+ * 卡已不 pending / 已不在 ⇒ 什么都不做(CAS 输给了收割,结局相同)。卡的会话与停驻报的验证器会话不一致 ⇒ 不动它(只作废**这一张**)。
+ */
+export declare function voidVerifierPauseCard(result: unknown, cards: CardVoidPort | undefined): Promise<void>;
+//# sourceMappingURL=verifier-pause-card.d.ts.map

package/dist/verifier-pause-card.js

@@ -0,0 +1,19 @@
+import { voidPendingCard } from "./card-void.js";
+const VOID_FAILED = "server.verifier-pause.card-void-failed";
+export async function voidVerifierPauseCard(result, cards) {
+    const pause = verifierPauseCardOf(result);
+    if (pause !== undefined)
+        await voidPendingCard(pause, cards, VOID_FAILED);
+}
+function verifierPauseCardOf(result) {
+    if (result === null || typeof result !== "object")
+        return undefined;
+    const pause = result.verification?.verifierPause;
+    if (pause === null || typeof pause !== "object")
+        return undefined;
+    const { checkpointToken, sessionId } = pause;
+    return typeof checkpointToken === "string" && checkpointToken !== "" && typeof sessionId === "string"
+        ? { token: checkpointToken, sessionId }
+        : undefined;
+}
+//# sourceMappingURL=verifier-pause-card.js.map

package/dist/web-admin-client/apply-effective.d.ts

@@ -107,17 +107,15 @@ export declare const PLANE_REFUSAL_INVARIANT_OF: {
     readonly "config.gateway_fallback_without_primary": "model-route-endpoint";
 };
 /**
- * 契约包出码、执法者是本仓但今天**未执法**的两只组拒码:本地配置腿上「管模型面的目录会顶替已声明的 env 表、决定不是 `replaced`」那道闸,与「每个任务都要解的 summarize 落不到可服务条目」的不变量。
+ * 契约包出码、执法者是本仓但今天**未执法**的组拒码:本地配置腿上「管模型面的目录会顶替已声明的 env 表、决定不是 `replaced`」那道闸。
  *
- * 词义:settings-schema 发布说明里的「engine / 引擎一侧」指**本仓(worker)**,不是 `@sema-agent/core` —— 这两码要的全部输入(本地配置腿、env 表、模型面 stage 与组拒口)只在本仓,core 里没有读
- * `MODEL_ID` / `config.d` 的地方、也没有组拒码。(契约包自己有几处把同一个词写成 core 7.58.0,那是它的叫法错。)所以本仓 stage 现在没有对应的不变量、不铸这两个码,不是因为「归引擎」,而是**还没做**,两码各自候什么:
+ * 词义:settings-schema 发布说明里的「engine / 引擎一侧」指**本仓(worker)**,不是 `@sema-agent/core` —— 这个码要的全部输入(本地配置腿、env 表、模型面 stage 与组拒口)只在本仓,core 里没有读
+ * `MODEL_ID` / `config.d` 的地方、也没有组拒码。所以本仓 stage 现在没有对应的不变量、不铸这个码,不是因为「归引擎」,而是**还没做**:
  *  · `CATALOG_REPLACES_ENV_MODELS_CODE`:执法是一整组跨仓件 —— 开机迁移 SS-M11(铸决定文档)· 本地腿每拍读决定(读数身份进候选的 etag)· 目录信任判官走根级文档 · 命令行 / 桌面 / 客户端核心三个写者先接契约包的计划助手;
  *    候设计票。在那之前,候选目录管着模型面而 env 表也声明了时,仍照旧由目录服务(与升级前逐位同)。
- *  · `SUMMARIZE_MODEL_MISSING_CODE`:码的前提是「summarize 落不到可服务条目 ⇒ 采纳后每个任务都被拒」,而本仓所钉 core 7.59.0 起非严格座位(summarize 在内)点名目录里没有的词时读作未设、沿自己的回落链走
- *    (summarize 的链是 → default,即回落缺省模型)并通告 `model.role_defaulted`;链上没有可解的模型才拒 —— 前提与所钉 core 相抵,候上游(settings-schema / core)重定义或退役这个码;在那之前 summarize 角色绑到不可用条目时仍是角色绑定那一行 warn(`ROLE_BINDING_UNAVAILABLE_HINT`),不是组拒。
- * 两码开始被铸之后,它们进 `/health.modelRefusals.plane` 的座位是**另案设计**(现在没有座:见 `model-plane-face.ts` 对「装配期被引擎整份拒收」的披露),不在这张表里偷铸一个不变量替它占位。
+ * 这个码开始被铸之后,它进 `/health.modelRefusals.plane` 的座位是**另案设计**(现在没有座:见 `model-plane-face.ts` 对「装配期被引擎整份拒收」的披露),不在这张表里偷铸一个不变量替它占位。
  */
-export declare const ENGINE_MINTED_PLANE_REFUSAL_CODES: readonly ["config.catalog_replaces_env_models", "config.summarize_model_missing"];
+export declare const ENGINE_MINTED_PLANE_REFUSAL_CODES: readonly ["config.catalog_replaces_env_models"];
 /**
  * [ref] —— **「无中心配置」档的候选**:中心凭证换人时,server 把在用的中心配置降到这一档({@link applyEffective} 吃它,和吃任何候选走同一条 stage → swap → commit)。
  * 它的意思是「**撤回**中心配置」—— 中心下发的每个热面回 env 底:

package/dist/web-admin-client/apply-effective.js

@@ -1,5 +1,5 @@
 import { expandTiers, modelOriginOf, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { CATALOG_REPLACES_ENV_MODELS_CODE, SUMMARIZE_MODEL_MISSING_CODE, WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
+import { CATALOG_REPLACES_ENV_MODELS_CODE, SandboxGitConfig, WEB_ADMIN_ENV, formatConfigPath, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel, sanitizeZodError } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
 import { buildEnvModelIdNotServedNotice, mintCapabilityKeys, readAtMention, servedModelTableLeg } from "../model-select.js";
 import { applyAutoCompactWindow, buildModelCostKey, ownCredentialHitsInForce, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
@@ -135,6 +135,7 @@ export function applyEffective(config, eff, logger, opts) {
         }
     }
     const servedBefore = servedModelTableLeg(config);
+    const sandboxGitBefore = config.sandboxGit;
     commitStaged(config, staged);
     if (ordered)
         appliedGeneration.set(config, gen);
@@ -169,6 +170,8 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.info("web_admin_runtime_hot", staged.hot.infoLine);
     if (Object.keys(staged.projects).length > 0)
         logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
+    if (JSON.stringify(sandboxGitBefore) !== JSON.stringify(staged.sandboxGit))
+        logger?.info("web_admin_sandbox_git", { version: staged.version, origins: staged.sandboxGit?.origins.map((e) => e.origin) ?? null });
     return true;
 }
 function declareCandidateWithheldEnv(seats, modelApiKeyEnv, version) {
@@ -216,6 +219,10 @@ function commitStaged(config, staged) {
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
     mutateInPlace(config.projects, staged.projects);
+    if (staged.sandboxGit !== undefined)
+        config.sandboxGit = staged.sandboxGit;
+    else
+        delete config.sandboxGit;
 }
 export const MODEL_PLANE_DOMAINS = ["models"];
 const MODEL_PLANE_SURFACES = {
@@ -248,7 +255,7 @@ export const PLANE_REFUSAL_INVARIANT_OF = {
     "config.model_route_endpoint_missing": "model-route-endpoint",
     "config.gateway_fallback_without_primary": "model-route-endpoint",
 };
-export const ENGINE_MINTED_PLANE_REFUSAL_CODES = [CATALOG_REPLACES_ENV_MODELS_CODE, SUMMARIZE_MODEL_MISSING_CODE];
+export const ENGINE_MINTED_PLANE_REFUSAL_CODES = [CATALOG_REPLACES_ENV_MODELS_CODE];
 function modelPlaneGroupReport(group) {
     return {
         applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
@@ -472,6 +479,7 @@ function stageEffective(config, eff, logger, opts) {
             ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
         };
     }
+    const sandboxGit = stageSandboxGit(eff, logger);
     return {
         version: typeof eff.version === "number" && Number.isFinite(eff.version) ? eff.version : 0,
         modelPlaneGroup,
@@ -479,8 +487,20 @@ function stageEffective(config, eff, logger, opts) {
         limits,
         hot,
         projects,
+        sandboxGit,
     };
 }
+const SANDBOX_GIT_REFUSED_EFFECT = "the block is read as routing no git origins (the sandbox git plane reads no_origins; no new sandbox pod carries the credential broker) — the rest of this candidate applies; fix the block at the console (it is judged by the contract's SandboxGitConfig)";
+function stageSandboxGit(eff, logger) {
+    if (eff.sandboxGit === undefined)
+        return undefined;
+    const judged = SandboxGitConfig.safeParse(eff.sandboxGit);
+    if (judged.success)
+        return judged.data;
+    const issues = sanitizeZodError(judged.error).issues.map((i) => `${i.path.length === 0 ? "sandboxGit" : `sandboxGit.${formatConfigPath(i.path.map((seg) => (typeof seg === "number" ? seg : String(seg))))}`}: ${i.message}`);
+    logger?.warn("web_admin_sandbox_git_refused", { version: typeof eff.version === "number" ? eff.version : 0, issues, effect: SANDBOX_GIT_REFUSED_EFFECT });
+    return undefined;
+}
 export function centerManagedConfigKeys(eff) {
     const out = new Set();
     if (!eff)

package/dist/web-admin-client/candidate-gate.d.ts

@@ -37,7 +37,7 @@ export interface CandidateDomainError {
     readonly error: string;
 }
 /** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)`domain_invalid` ∪ 被拒文档自带的词(契约闭集 `CONFIG_DOCUMENT_REFUSAL_REASONS`:
- *  `empty` / `invalid_json` / `not_object` / `io` 文件层,`retired_domain` 墓碑)—— 被拒文档的词表只在契约一处定义,这里派生(契约加词 ⇒ 按词穷举的读者编译红)。 */
+ *  `empty` / `invalid_json` / `not_object` / `io` / `too_deep` 文件层,`retired_domain` 墓碑)—— 被拒文档的词表只在契约一处定义,这里派生(契约加词 ⇒ 按词穷举的读者编译红)。 */
 export type CandidateRejectReason = "domain_invalid" | ConfigDocumentRefusalReason;
 /** 拒判里的一条:哪一域、为什么(读腿 / 契约包的原句)、成因词。`config_candidate_rejected` 行的 `errors` 就是这一列。 */
 export interface CandidateDomainRejection extends CandidateDomainError {

package/dist/web-admin-client/effective-keys.js

@@ -13,6 +13,7 @@ const EFFECTIVE_CONFIG_KEY_TABLE = {
     plugins: true,
     readFace: true,
     prompts: true,
+    sandboxGit: true,
 };
 export const EFFECTIVE_CONFIG_KEYS = Object.keys(EFFECTIVE_CONFIG_KEY_TABLE);
 export const EFFECTIVE_ENVELOPE_KEYS = ["version", "updatedAt"];
@@ -25,6 +26,7 @@ export const GOVERNANCE_DOMAIN_KEYS = Object.keys(GOVERNANCE_DOMAIN_KEY_TABLE);
 export const NON_DOMAIN_EFFECTIVE_KEYS = {
     a2a: "R-15 裁开域([4384]),但 settings-schema 至 1.3.0 未开(DOMAINS 无 a2a)——S-31 件2 BLOCKED on schema:远端腿靠 readEffectiveWire 的 open-world verbatim 透传(DESIGN-269),本地腿不可达(FileConfigStore 只读 PORTABLE_DOMAINS)。schema 开域之日按墓碑流程收线。",
     readFace: "R-15 裁**暂不开域**([4384]:env 逐键恒赢语义下收益薄,⚪ 呈现制过渡)——#A4 的远端腿同靠 open-world 透传;本地腿四键由 env / 引擎默认独占。若来日改裁开域,同上墓碑机制。",
+    sandboxGit: "契约的 wire-only 键(settings-schema 14.7.0 `EffectiveWire.sandboxGit`):web-admin 按部署登记册投影,不是存储域 —— `buildEffective` 从不产它、`readEffectiveWire` 逐字承运;判它的唯一座位 `SandboxGitConfig` 在 stageEffective 调一次。本地腿不可达(`config.d` 只读便携域)⇒ 本地配置源恒缺席(沙箱 git 平面读 `no_origins`)。",
 };
 export const DOMAINS_NOT_CONSUMED_BY_SERVER = {
     rosters: "center 写面域:center 端 resolveEffectiveForWorker 把 roster 解析进 per-worker /effective 的 models 视图——server 消费的是解析产物,不读原始域。",

package/dist/web-admin-client/read-warnings.d.ts

@@ -31,8 +31,8 @@ import { type ConfigDocumentRefusal, type DroppedEntryIdentity, type DroppedEntr
  * 带事实 ⇒ 一份被拒文档(契约的类型 `ConfigDocumentRefusal` 的墓碑臂:`document` = 退役域名,`reason: "retired_domain"`,`error` / `migration` 取
  * `RetiredDomainError` 的同名字段)、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
  * 体不是对象 ⇒ 原样交回、不判(载荷形错,契约读腿抛)。墓碑判据只在契约包,这里只分键。
- * 被拒文档是两条读腿同形的发现(判决只在候选判官 `candidate-gate.ts` 的 `judgeConfigCandidate`,成因词 = 发现自带的 `reason`):本地腿的被拒文档是契约整目录拒单
- * `inspectBundle` 的原样(`config-provider.ts`),wire 上没有文件层,只有这一种墓碑。`error` 本模块不脱敏(与折叠产物同律):各腿在自己的产出边界上过
+ * 被拒文档是两条读腿同形的发现(判决只在候选判官 `candidate-gate.ts` 的 `judgeConfigCandidate`,成因词 = 发现自带的 `reason`):本地腿的被拒文档是契约单读口
+ * `FileConfigStore.read()` 那一读的拒单原样(`config-provider.ts`),wire 上没有文件层,只有这一种墓碑。`error` 本模块不脱敏(与折叠产物同律):各腿在自己的产出边界上过
  * `redactSecrets` 兜底、不过 `redactConfigError`(句子不含配置值;引号段读法会把句中点名的域名换成指纹)。
  */
 export declare function separateRetiredDomains(body: unknown): {

package/dist/web-admin-client/types.d.ts

@@ -392,6 +392,10 @@ export interface EffectiveConfig {
     /** prompts 域(中心层;wire 形只有一种 = 契约包 `EffectivePromptsWire` `{ schemaVersion: 2, artifact }`)—— 判法只在候选判官一处
      *  (`prompts-domain-validate.ts` 的 `judgePromptsWire`,经 `judgeConfigCandidate`),本 interface 只声明键位存在(unknown:判官是唯一解释者,这里不复刻形)。 */
     prompts?: unknown;
+    /** 沙箱 git 平面的有效配置块(契约 `EffectiveWire.sandboxGit`:wire-only 的非域顶层键,web-admin 按部署登记册投影,读腿逐字承运、不判)——
+     *  可选、无默认:缺席 = 这个部署没有投影这一块。本 interface 只声明键位(unknown:与 `prompts` 同形);判它的唯一座位是契约 `SandboxGitConfig`,
+     *  在 `stageEffective` 里调一次(判过 ⇒ `config.sandboxGit`;判不过 ⇒ 当作没有任何 origin + 一行 `web_admin_sandbox_git_refused`,契约 §12.8)。 */
+    sandboxGit?: unknown;
 }
 /** (stage7 P5,registry-core 0.8 `execution` 域): the center-resolved per-principal execution
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -20,9 +20,10 @@ dials the device, so the device needs no inbound port, no public address and no
 (this deployment has no device lane) or an object `{ enabled: true, protocolVersion, maxInflightPerDevice,
 wsPath, management, relayUrl? }`. Read `wsPath` from there rather than hardcoding it: the path is part of the wire
 contract and reading it means a future path change is not a cross-repo break. `relayUrl` (server 7.137.0+) is present
-only when the operator declared one (`DEVICE_RELAY_URL`): the engine sits behind a relay or gateway and the device
+only when the operator declared a relay URL (`DEVICE_RELAY_URL`): the engine sits behind a relay or gateway and the device
 must dial that absolute `ws://` / `wss://` URL verbatim instead of the engine's own address — do not rebuild it from
-the engine address and `wsPath`. Absent ⇒ dial the engine's own address at `wsPath`, as before. `protocolVersion` tells you
+the engine address and `wsPath`. Absent ⇒ dial the engine's own address at `wsPath`, as before (the operator declared
+`DEVICE_RELAY_URL=none`; a device-lane server does not start without one of the two declarations). `protocolVersion` tells you
 which protocol **revision** the server speaks before you spend a handshake finding out (§2.1: the revision decides
 which `errorCode` words the server accepts from you).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.140.0",
+  "version": "7.142.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.60.0",
-    "@sema-agent/settings-schema": "15.2.0",
+    "@sema-agent/settings-schema": "16.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",