@sema-agent/server 7.141.0 → 7.142.0

package/dist/sandbox-git-plane.d.ts

@@ -38,26 +38,36 @@ export interface SandboxGitPlanePremises {
     /** The patch judge's refusal for a pod that carries the broker (`podSpecPatchBrokerRefusal`); `undefined` = the patch may land. */
     readonly patchRefusal: string | undefined;
     readonly brokerImage: string | undefined;
-    /** The routed origins (`readSandboxGitConfig`); `null` = no `sandboxGit` block. */
+    /** The routed origins — the live config's `sandboxGit` block as committed (`config.sandboxGit`); `null` = no block. */
     readonly origins: readonly string[] | null;
 }
+/** The boot's readings the judge needs besides config: the secret seat answer (asked once, by stage 5) and the static patch judge's refusal. */
+export interface SandboxGitPlaneBootReadings {
+    readonly secretSeat?: SandboxSecretSeat;
+    readonly patchRefusal?: string;
+}
 /** THE judge: the first premise that fails, in the written order; all hold ⇒ on with per-origin rows. Pure. */
 export declare function judgeSandboxGitPlane(p: SandboxGitPlanePremises): SandboxGitPlane;
 /** The secret seat is asked for the plane only when every premise before it holds (a deployment the plane is off for asks nothing for it). */
 export declare function sandboxGitPlaneAsksSecretSeat(p: Pick<SandboxGitPlanePremises, "multiTenant" | "k8sLane" | "callerCredential" | "centerUrl">): boolean;
-/** The premises read from config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
-export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: {
-    readonly secretSeat?: SandboxSecretSeat;
-    readonly patchRefusal?: string;
-}): SandboxGitPlanePremises;
+/** The premises read from the live config, plus the two boot readings (seat answer, patch refusal) when the boot has them. */
+export declare function sandboxGitPlanePremisesOf(config: ServiceConfig, readings: SandboxGitPlaneBootReadings): SandboxGitPlanePremises;
+/** The plane's read-time seat (see the file head): {@link SandboxGitPlaneSeat.now} judges on every call; {@link SandboxGitPlaneSeat.settle} asks the boot's IO premise. */
+export interface SandboxGitPlaneSeat {
+    /** The reading now — the judge over the boot readings settled so far and the live config. Synchronous; every reader calls it per read and keeps no copy. */
+    now(): SandboxGitPlane;
+    /** Asks the secret seat once (stage 5 awaits it), only when the four premises before it hold; a later call asks nothing. */
+    settle(): Promise<void>;
+}
 /**
- * Wiring point — the effective `sandboxGit` block (the origins this deployment routes through the broker, canonical form, ≤ 16). Its shape
- * and its canonical-form judge belong to the settings-schema contract package (`SandboxGitConfig`, 14.7.0 — picked up: the block rides the effective
- * wire verbatim); this reader is not wired to it yet ⇒ `null` (the plane stays off, `no_origins`). To be replaced by the package reader — no local copy of the shape.
+ * The plane's ONE seat. `premisesOf` = the premises over the live config (the execution env hands `(r) => sandboxGitPlanePremisesOf(config, r)` — the
+ * config object every commit of the effective configuration mutates); `boot.patchRefusal` = the static patch judge's answer (a boot reading from the start);
+ * `boot.askSecretSeat` = the lane's secret-seat review (only the k8s lane has one; absent ⇒ never asked ⇒ the seat stays unverified).
  */
-export declare function readSandboxGitConfig(_config: ServiceConfig): {
-    readonly origins: readonly string[];
-} | null;
+export declare function createSandboxGitPlaneSeat(premisesOf: (readings: SandboxGitPlaneBootReadings) => SandboxGitPlanePremises, boot: {
+    readonly patchRefusal?: string | undefined;
+    readonly askSecretSeat?: (() => Promise<SandboxSecretSeat>) | undefined;
+}): SandboxGitPlaneSeat;
 /**
  * Wiring point — does this worker hold the credential the console's vault admits on its resolve endpoint (the worker-assertion token)?
  * The server has no reader for it yet ⇒ `false` (the plane stays off, `no_caller_credential`). Replaced by the plane's vault client.
@@ -76,6 +86,15 @@ export interface SandboxGitRunRows {
  * `sandbox_broker_identity_unread` —— every miss reads as "not sso" ⇒ no broker (fail-closed), none of them throws into the pod's connect.
  */
 export declare function runIdentitySourceOf(runId: string | undefined, runs: SandboxGitRunRows | undefined, logger?: Pick<Logger, "warn">): Promise<IdentitySource | undefined>;
+/**
+ * The k8s run binding's broker-seat reader (the adapter asks it once per pod, `K8sRunEnvSeats.brokerSeatOf`): reads the plane ONCE per pod, before the
+ * run-row read — off ⇒ none and no row read at all; on ⇒ {@link sandboxBrokerSeatOf} over that one reading and the row's recorded identity source.
+ * `runs` is the late-bound run store (absent ⇒ no row ⇒ not `sso` ⇒ none).
+ */
+export declare function createSandboxBrokerSeatOf(planeNow: () => SandboxGitPlane, brokerImage: string | undefined, runs: (() => SandboxGitRunRows | undefined) | undefined, logger?: Pick<Logger, "warn">): (runId: string | undefined) => Promise<{
+    readonly image: string;
+    readonly origins: readonly string[];
+} | undefined>;
 /** The broker seat for one run's pod: the plane on ∧ the image set ∧ the run's recorded identity source `sso` ⇒ the image + every origin of the reading (http too); otherwise none. */
 export declare function sandboxBrokerSeatOf(plane: SandboxGitPlane, brokerImage: string | undefined, identitySource: IdentitySource | undefined): {
     readonly image: string;

package/dist/sandbox-git-plane.js

@@ -21,7 +21,7 @@ export const SANDBOX_GIT_PLANE_OFF_TEXT = {
     secret_seat_denied: `the sandbox Role does not allow secrets ${SANDBOX_SECRET_SEAT_VERBS.lease.join(" / ")} (the lease Secret) in the sandbox namespace`,
     pod_patch_reaches_broker: "the deployment's pod-spec patch could reach the broker container (a podSecurityContext, or a field outside the broker white-list)",
     broker_image_unset: "K8S_SANDBOX_BROKER_IMAGE is not set (the broker container's image; this engine's own image is the recommended value)",
-    no_origins: "the effective configuration routes no git origins to the plane (sandboxGit.origins)",
+    no_origins: `the effective configuration routes no git origins to the plane (sandboxGit.origins): the console projects the block only on this worker's own pull (${WEB_ADMIN_ENV.worker}), and a block that fails its contract is read as no origins (log line web_admin_sandbox_git_refused)`,
 };
 const isHttps = (url) => url !== undefined && URL.canParse(url) && new URL(url).protocol === "https:";
 export function judgeSandboxGitPlane(p) {
@@ -73,11 +73,23 @@ export function sandboxGitPlanePremisesOf(config, readings) {
         secretSeat: readings.secretSeat,
         patchRefusal: readings.patchRefusal,
         brokerImage: lane?.provider === "k8s" ? lane.brokerImage : undefined,
-        origins: readSandboxGitConfig(config)?.origins ?? null,
+        origins: config.sandboxGit?.origins.map((e) => e.origin) ?? null,
     };
 }
-export function readSandboxGitConfig(_config) {
-    return null;
+export function createSandboxGitPlaneSeat(premisesOf, boot) {
+    let readings = boot.patchRefusal !== undefined ? { patchRefusal: boot.patchRefusal } : {};
+    let settled = false;
+    return {
+        now: () => judgeSandboxGitPlane(premisesOf(readings)),
+        settle: async () => {
+            if (settled)
+                return;
+            settled = true;
+            if (boot.askSecretSeat === undefined || !sandboxGitPlaneAsksSecretSeat(premisesOf(readings)))
+                return;
+            readings = { ...readings, secretSeat: await boot.askSecretSeat() };
+        },
+    };
 }
 export function readSandboxGitCallerCredential(_config) {
     return false;
@@ -97,6 +109,14 @@ export async function runIdentitySourceOf(runId, runs, logger) {
         return undefined;
     }
 }
+export function createSandboxBrokerSeatOf(planeNow, brokerImage, runs, logger) {
+    return async (runId) => {
+        const plane = planeNow();
+        if (plane.state !== "on")
+            return undefined;
+        return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, runs?.(), logger));
+    };
+}
 export function sandboxBrokerSeatOf(plane, brokerImage, identitySource) {
     if (plane.state !== "on" || brokerImage === undefined || brokerImage === "" || identitySource !== "sso")
         return undefined;

package/dist/security.d.ts

@@ -6,6 +6,7 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
 import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWriteOutcome, SessionRowPatch, SessionRowWriteOutcome } from "./session-row.js";
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
+import type { SessionUnreadable } from "./session-error-wire.js";
 import type { ForkTarget, ForkToOutcome } from "./plugins/session-fork.js";
 import { type OwnerlessClaim } from "./delegated-session-owner.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
@@ -38,6 +39,12 @@ export interface SessionListItem {
      *  primitive ∧ the row has an occupant token); additive key, passed through unprojected (`sessions-list.ts`). Same name and meaning as
      *  `SessionSummary.rowTag` in `plugins/store-contracts.ts`. */
     rowTag?: string;
+    /** The session's archive cannot be read — present-iff the session head's leaf read throws (a list row is a session ROW: its facts live on the
+     *  row and read fine; this says the CONTENT does not). `errorCode` = the code the session's own reads answer for it (`GET /v1/sessions/:id` /
+     *  `…/head` / `…/events` / `PATCH` once admitted) — one table, `openFaceFaultWire` in `session-error-wire.ts`, the only minter `sessionUnreadableOf`.
+     *  A store whose head leaf is a row column (the SQL twins) never carries it. Additive key, passed through unprojected (`sessions-list.ts`).
+     *  Same name and meaning as `SessionSummary.unreadable` in `plugins/store-contracts.ts`. */
+    unreadable?: SessionUnreadable;
 }
 /**
  * 会话店的行格写原语(规则与判序:`session-row.ts` 头注「写原语」)—— 按入口分两只重载:客户端写(PATCH)的结局闭集四员;行重放(2c 导入落定后的那一笔)
@@ -456,6 +463,8 @@ export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function setSsoRole(req: IncomingMessage, role: string): void;
 export declare function ssoVerifiedRole(req: IncomingMessage): string | undefined;
+export declare function setSsoPrincipalInc(req: IncomingMessage, principalInc: string): void;
+export declare function ssoVerifiedPrincipalInc(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 export {};
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -210,6 +210,14 @@ export function ssoVerifiedRole(req) {
     const v = SSO_ROLES.get(req);
     return v !== undefined && v.length > 0 ? v : undefined;
 }
+const SSO_PRINCIPAL_INCS = new WeakMap();
+export function setSsoPrincipalInc(req, principalInc) {
+    SSO_PRINCIPAL_INCS.set(req, principalInc);
+}
+export function ssoVerifiedPrincipalInc(req) {
+    const v = SSO_PRINCIPAL_INCS.get(req);
+    return v !== undefined && v.length > 0 ? v : undefined;
+}
 export function verifiedPrincipal(req, config) {
     const sso = ssoVerifiedPrincipal(req);
     if (sso) {

package/dist/session-error-wire.d.ts

@@ -57,6 +57,12 @@
  *
  * core 给闭集加一个词 ⇒ 下面的 `switch` 编译红,由人裁定它在两面上的答复,而不是让它静默落进某个恰好存在的臂
  * ([ref] 词表纪律;同形先例 `session-policy-wire.ts` 的 `sessionPolicyErrorHttp`)。
+ *
+ * ## 读一只会话的存档时的故障:一张表、两个读者({@link openFaceFaultWire})
+ * open 面映射有臂 ⇒ 那一格;否则(open 面留白的词,与不是 `SessionError` 的读故障 —— I/O 级的 EACCES / EISDIR …,core 的读腿只吞 ENOENT、其余 errno 原样抛)
+ * ⇒ 通用 500 {@link INTERNAL_ERROR_WIRE}。读者:① 全局兜底(`http/server.ts`:路由里逃出来的故障就按它答 —— 会话视图 / 头探针 / 事件流 / 改名门放行之后对坏档答的码
+ * 都出自这里);② 会话列表行的 `unreadable`({@link sessionUnreadableOf}:列表行 = 会话行,头的叶子读不出 ⇒ 行带标记,码 = 打开它时读口答的那一个)。
+ * 两个读者读同一只函数,列表说的码与读口答的码不会分叉。
  */
 import { SessionError } from "@sema-agent/core";
 /** core `SessionError` 的码闭集(core 不从包根导出这个型名 ⇒ 从导出类的 `code` 键派生,不手抄)。 */
@@ -103,6 +109,24 @@ export declare const STAMPED_SESSION_ARCHIVE_SENTENCE = "this session's stored a
  * 按码答复不同),其余按码({@link sessionErrorHttp})。
  */
 export declare function sessionErrorWireOf(e: SessionError, face: SessionErrorFace): SessionErrorWire | undefined;
+/**
+ * 全局兜底的末臂:open 面映射没有臂的故障(登记过的留白词;不是 `SessionError` 的故障)⇒ 通用 500,句子固定(故障的原句只进运维日志 `request_error`,
+ * 不上 wire —— I/O 级的原句带 errno 与盘上路径)。
+ */
+export declare const INTERNAL_ERROR_WIRE: SessionErrorWire & {
+    readonly sentence: string;
+};
+/** 一只读存档的故障在 open 面上的 wire 答复(两个读者见文件头注「一张表、两个读者」):有臂 ⇒ 那一格;否则 {@link INTERNAL_ERROR_WIRE}。 */
+export declare function openFaceFaultWire(fault: unknown): SessionErrorWire;
+/**
+ * 会话列表行的加性键 `unreadable`:这只会话的头的叶子读不出(存档读不出)。present-iff 读不出;`errorCode` = 读口打开这只会话时答的码
+ * (`GET /v1/sessions/:id` / `…/head` / `…/events` / `PATCH` 门放行之后)。今天读得到的值:`corrupt_session`(会话头坏)· `internal.error`(I/O 级)。
+ */
+export interface SessionUnreadable {
+    readonly errorCode: string;
+}
+/** {@link SessionUnreadable} 的唯一铸点(列表行的那只标记;码经 {@link openFaceFaultWire},与全局兜底同表)。 */
+export declare function sessionUnreadableOf(fault: unknown): SessionUnreadable;
 export declare function sessionErrorHttp(code: SessionErrorCode, face: SessionErrorFace): SessionErrorWire | undefined;
 export declare function isSessionErrorCode(code: string): code is SessionErrorCode;
 //# sourceMappingURL=session-error-wire.d.ts.map

package/dist/session-error-wire.js

@@ -23,6 +23,13 @@ const STAMPED_SESSION_ARCHIVE = { status: 409, errorCode: "conflict", sentence:
 export function sessionErrorWireOf(e, face) {
     return e instanceof StampedSessionArchiveError ? STAMPED_SESSION_ARCHIVE : sessionErrorHttp(e.code, face);
 }
+export const INTERNAL_ERROR_WIRE = { status: 500, errorCode: "internal.error", sentence: "internal error" };
+export function openFaceFaultWire(fault) {
+    return (fault instanceof SessionError ? sessionErrorWireOf(fault, "open") : undefined) ?? INTERNAL_ERROR_WIRE;
+}
+export function sessionUnreadableOf(fault) {
+    return { errorCode: openFaceFaultWire(fault).errorCode };
+}
 export function sessionErrorHttp(code, face) {
     switch (code) {
         case "corrupt_session":

package/dist/task-settings.d.ts

@@ -52,6 +52,7 @@ import { type EntryProblem } from "./entry-problems.js";
 import { type RuleListEntry } from "./permission-rule-list.js";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
+import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import type { EntryPermissionMode } from "./runtime-governance.js";
 import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
@@ -242,6 +243,9 @@ export interface ParsedTaskSettings {
      *  wire 位置由座位表说(三座在 `settings` 顶层,`neverAuto` 在 `settings.permissions`),解析后与位置无关。空数组 ≡ 缺席(不铸键)。
      *  去处:三座经 {@link applyTaskSettings} 落 core 任务层席;`neverAuto` 经 {@link deriveSettingsPolicy} 落请求叶策略。 */
     tightenOnly?: TightenOnlySeatValues;
+    /** http hook 两张名单(`settings.allowedHttpHookUrls` / `settings.httpHookAllowedEnvVars`)作为**一个设置层**:源名 {@link REQUEST_SETTINGS_SOURCE} + 两键里在场的那几把,值原样(本服务不读内容)。
+     *  两键都缺席 ⇒ 不铸键。唯一读者 = `hooks/hook-runner.ts` 的 http 腿(经 hooks 注册上下文的 `httpHookAllowlistLayers`)。 */
+    httpHookAllowlist?: HttpHookAllowlistLayer;
 }
 /** The result of parsing an untrusted `body.settings`: the applied subset + the names of present-but-deferred
  *  fields (so the caller can log/advertise them — no silent drop). `null` settings ⇒ `{ settings: undefined }`. */
@@ -313,8 +317,12 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
  *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
- *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+ *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。
+ *
+ *  🔴 `allowedHttpHookUrls` / `httpHookAllowedEnvVars` = **CC settings 同名键**(契约包的 http hook 两张名单,键表属主 = 契约包 `HTTP_HOOK_ALLOWLIST_KEYS`):
+ *  消费点 = {@link parseTaskSettings} 把它们原样收成一层({@link requestHttpHookAllowlistLayer})→ `boot/resolve-spec.ts` 交给 hooks 注册 → `hooks/hook-runner.ts` 的 http 腿
+ *  在拨出之前问契约包判官。受理面只判键名(本门),不判值:名单的读法只有判官那一只(坏形由判官答 `malformed`、拦)。 */
+export declare const TASK_SETTINGS_KEYS: readonly ["allowedHttpHookUrls", "approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
 export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响

package/dist/task-settings.js

@@ -8,7 +8,7 @@ import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
-import { SETTINGS_SOURCES } from "@sema-agent/settings-schema";
+import { HTTP_HOOK_ALLOWLIST_KEYS, SETTINGS_SOURCES } from "@sema-agent/settings-schema";
 import { heldRuleName } from "./tool-rule-names.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 import { createRequestNeverAutoPolicy } from "./approval.js";
@@ -160,7 +160,7 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_KEYS = ["allowedHttpHookUrls", "approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
@@ -228,6 +228,16 @@ export function hooksKeyIssue(raw, config) {
 export function taskHooksHonored(config) {
     return !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config);
 }
+const REQUEST_SETTINGS_SOURCE = "flagSettings";
+function requestHttpHookAllowlistLayer(s) {
+    const present = HTTP_HOOK_ALLOWLIST_KEYS.filter((key) => Object.hasOwn(s, key));
+    if (present.length === 0)
+        return undefined;
+    const layer = { source: REQUEST_SETTINGS_SOURCE };
+    for (const key of present)
+        layer[key] = s[key];
+    return layer;
+}
 function tightenOnlySeatDeferredName(name) {
     return tightenOnlySeatField(name).replace(/^settings\./, "");
 }
@@ -303,6 +313,9 @@ export function parseTaskSettings(raw, seats = {}) {
         deferred.push(tightenOnlySeatDeferredName(name));
     if (Object.keys(tightenSeats.values).length > 0)
         out.tightenOnly = tightenSeats.values;
+    const httpHookAllowlist = requestHttpHookAllowlistLayer(s);
+    if (httpHookAllowlist !== undefined)
+        out.httpHookAllowlist = httpHookAllowlist;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
 export function acceptAppendSystemPrompt(v, warn) {

package/dist/terminal.d.ts

@@ -1,5 +1,6 @@
 /**
- * 终局因由(`TaskResult.terminal`)的 server 侧**读**面 —— 一个叶子模块,只依赖 `@sema-agent/core`。
+ * 终局因由(`TaskResult.terminal`)的 server 侧**读**面 —— 一个叶子模块:依赖 `@sema-agent/core`、进程级记录器(`observability/fail-open.ts`)
+ * 与秘密脱敏器(`trace/redact.ts`,只作码判官 {@link isCodeToken} 的一条合取);本仓的结果汇点 / 出口座反过来依赖本模块,本模块不依赖它们。
  *
  * core 7.6.0([ref] S6 D-8,BREAKING)把 `TaskResult` 上并列的八个平面键
  * (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` / `checkpointId` /
@@ -57,18 +58,30 @@ export declare const STORE_ERROR_CODE = "internal.store_error";
  *
  * ⚠️ **辖域如实**:本臂触发条件是「码出了本仓的词法」,所以任何依赖铸出的域外码都落这里,不只 SQL 驱动。
  * 今天可观察的产出方**只有**耐久店那一层(引擎自己的传输/brain 错误在 core 侧已被分类成小写码),故码名
- * 取 `internal.store_error`;原码逐字进 message 尾注(随结果过汇点脱敏)、是码 token 时进运维 warn 行({@link isCodeToken}),归因从不丢失。
+ * 取 `internal.store_error`;原码逐字进 message 尾注(随结果过汇点脱敏)、是码时进运维线索({@link isCodeToken}),归因从不丢失。
  */
 export declare function outwardFailureCode(code: string): string;
 /**
- * 一个错误的 `code` 只在它**是**码(短 token)时才说出口 —— 码形座里装着文字的,不是码(驱动码 `ER_*` / SQLSTATE / `ECONNRESET`
- * 全在这一形里;带空白、`=`、换行或超过 64 字符的就是一句话)。读者两只,同一条判据:折码的运维 warn 行(本文件 {@link sealResultForExit})
- * 与执行车道占位读的故障词(`boot/execution-env.ts`)。
+ * 一个错误的 `code` 只在它**是**码时才说出口 —— 一只判官,两条合取:
+ *  ① **形**:短 token。驱动码 `ER_*` / SQLSTATE / `ECONNRESET` 全在这一形里;带空白、`=`、换行或超过 64 字符的就是一句话,不是码;
+ *  ② **不是凭据形**:秘密脱敏器({@link redactSecrets})原样放过它。`sk-…` / `AKIA…` / `ghp_…` 这类秘密过得了 ①,而 wire 上同一只脱敏器
+ *     会把它从 message 尾注里遮掉 —— 日志行若照印,就是 wire 遮、日志露;所以「长得像码的秘密」在这里判「不是码」,日志与 wire 同读。
+ *     先判 ①:脱敏器只读 ≤ 64 个 token 字符(扫描代价有界);只问不出门(`observe: false`,与影子重扫同口 —— 不计「已脱」读数)。
+ * 读者两只,同一条判据:折码的运维线索(本文件 {@link sealResultForExit} / {@link sealStoredResult})与执行车道占位读的故障词(`boot/execution-env.ts`)。
  */
 export declare function isCodeToken(code: unknown): code is string;
+/**
+ * 一个错误**说得出口**的机器码,以日志字段 / 指标标签的形交回:`err.code` 是串且 {@link isCodeToken} 判它是码 ⇒ `{ code }`(逐字);其余(没有 / 不是串 / 空串 / 非 `Error` 抛出物 / 读取时抛 / 不是码)⇒ `{}`
+ * —— 键缺席,不补 `null` / `none` 之类的占位。「读口 + 判官 + 字段形」的**唯一**组合:引擎交来的错上的 `code` 是别人写的串,凡把它写进运维日志行或指标标签的汇点
+ * (`onError` 汇点的七条行与 `runner_config_advisory_total` 的标签、记忆引擎事故席)都经这一只,不各写一份读法、也不各设一份形判。读口 {@link errorCodeOf} 不抛。
+ * 显式标注返回类型:推断型 `{ code?: undefined } | { code: string }` 进不了指标标签 `Record<string, string>`。
+ */
+export declare function codeFieldOf(err: unknown): {
+    readonly code?: string;
+};
 /**
  * 存量结果被**再观看**的读座(闭集):`GET /v1/runs/:id → result`(终态行与停驻行同一座)与账本 `done` 行的回放(三条耐久读腿共用)。
- * 封口在读座上折码时,运维行按 (读座, 原码) 只报一次 —— 见 {@link sealResultForExit}。
+ * 读入口 {@link sealStoredResult} 必须点名其一(类型级必填);`exit` 不在这里 —— 它只由写入口 {@link sealResultForExit} 给。
  */
 export type StoredResultReadSeat = "run.result" | "ev.done.result";
 /**
@@ -111,7 +124,7 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
 /**
  * **一条结果离开引擎、进入本仓(可重放账本 / run 行 / wire)的唯一封口** —— 两件事,一个出口:
  *  ①摘掉**耐久恢复能力凭据**(`CheckpointToken`)—— 座表 {@link PAUSE_SEATS} 上的每一座;②把**域外的失败码**折成本仓的
- *  `internal.store_error`({@link outwardFailureCode},[ref])。
+ *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes})。
  *
  * 🔴 为什么两件事合在一只函数里而不是并列两只(7.92.2 改名 `stripResumeToken` → `sealResultForExit`):
  * 它们是**同一个出口上的同一件事** —— 「这条结果可以见人了吗」。并列两只 = 六个结算点各自要记得调两次,
@@ -129,23 +142,30 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
  * `/v1/approvals` 决策端点,凭 `checkpointId` 对账,从来不是拿 token 直连引擎。
  *
  * **出口全集都经这一口**:三家 run 店的行写口与账本店的 `done` 行写口在店入口调它(`observability/run-terminal.ts`),
- * 同步 200 体 / 流 done 帧 / 续跑决定腿在铸体处调它,`GET /v1/runs/:id{,/events}` 等读面在回放前再调一次 ——
- * 升级前落盘、还带着凭据的存量行在读面上同样摘掉。两件事都**幂等**,重复过口是同形。
- *
- * ── 折码的运维线索:一行定形句,两个观看点同一句 ──
- * `[terminal] outward_failure_code_folded original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<exit | 读座>`。
- * 字段只有闭集词、数字与码 token({@link isCodeToken}):失败句只报字节数,**永不**报原文 —— 失败句是自由文本(驱动句里可以有连接串 / 口令),
- * 结果里的那份由结果汇点脱敏,日志行没有汇点,所以日志行压根不带它;码形座里装着文字的同理只报 `<not-a-code>`。`at` 说这是哪一次观看:
- *  · 省略 `readSeat` = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ 每折一次报一次 —— 每次都是一件新的失败;
- *  · 给出读座({@link StoredResultReadSeat})= 存量行的**再观看** ⇒ 同一读座同一原码(按它在行上的样子)只报一次,表有界(先进先出)——
- *    读面每次轮询 / 每个观看者 / 每次重连都重放同一批行,逐读逐报会把一次旧失败放大成读次那么多行,而它们说的是同一件事。
- *    折**本身**照旧逐读做(wire 上永远是对外词),去重的只是日志行。
+ * 同步 200 体 / 流 done 帧 / 续跑决定腿在铸体处调它;`GET /v1/runs/:id{,/events}` 等读面在回放前过同一套封口的**读入口**
+ * {@link sealStoredResult} —— 升级前落盘、还带着凭据的存量行在读面上同样摘掉。两件事都**幂等**,重复过口是同形。
+ *
+ * ── 折码的运维线索:一句定形字段,两只入口各说一只词 ──
+ * 字段 `original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<观看点>`,只有闭集词、数字与码({@link isCodeToken}):
+ * 失败句只报字节数,**永不**报原文 —— 失败句是自由文本(驱动句里可以有连接串 / 口令),结果里的那份由结果汇点脱敏,运维线索没有汇点,
+ * 所以压根不带它;码形座里装着文字的、长得像码的秘密同理只报 `<not-a-code>`。`at` 说这是哪一次观看,**一个入口一只词**(类型给定,不靠记得传):
+ *  · 本函数 = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ `at=exit`,每折一次一行 `[terminal] outward_failure_code_folded <字段>` —— 每次都是一件新的失败;
+ *  · {@link sealStoredResult} = 存量行的**再观看**(读座必填)⇒ 走 fail-open 纪律(登记 tag `server.terminal.stored-result-code-folded`):
+ *    逐读计数 + 逐读探针行 + 每进程一次 warn,detail 即上面那句字段。读面每次轮询 / 每个观看者 / 每次重连都重放同一批行 ——
+ *    计数让「旧失败被读了多少次」看得见,一次 warn 让日志不随读次放大;去重归记录器一只,不另造表。
  *
  * 对任何输入安全(非普通对象 / 无可摘的座 / 码在词法内 ⇒ **同一引用**原样返回,不重塑)。
  */
 export declare function sealResultForExit<T extends {
     readonly terminal?: unknown;
-}>(result: T, readSeat?: StoredResultReadSeat): T;
+}>(result: T): T;
+/**
+ * **存量结果被再观看时的封口** —— 与 {@link sealResultForExit} 同一套封口(摘凭据 + 折码,同判同形),只差运维线索的观看点:
+ * 读座({@link StoredResultReadSeat})**必填**,于是新开一条读腿忘了点名读座是 tsc 红,不是悄悄落成 `at=exit`、按读次放大。
+ */
+export declare function sealStoredResult<T extends {
+    readonly terminal?: unknown;
+}>(result: T, seat: StoredResultReadSeat): T;
 /**
  * **投影出口的唯一属主**([ref])—— core 的 `terminalProjection` + 对外码归一,一次。
  *

package/dist/terminal.js

@@ -1,5 +1,7 @@
 import { terminalProjection } from "@sema-agent/core";
+import { errorCodeOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { redactSecrets } from "./trace/redact.js";
 export function failureCodeOf(terminal) {
     return terminal.kind === "failed" ? terminal.code : undefined;
 }
@@ -9,9 +11,13 @@ export function outwardFailureCode(code) {
     return OUTWARD_CODE_SHAPE.test(code) ? code : STORE_ERROR_CODE;
 }
 export function isCodeToken(code) {
-    return typeof code === "string" && CODE_TOKEN_SHAPE.test(code);
+    return typeof code === "string" && CODE_TOKEN_SHAPE.test(code) && redactSecrets(code, { observe: false }) === code;
 }
 const CODE_TOKEN_SHAPE = /^[A-Za-z0-9_.:-]{1,64}$/;
+export function codeFieldOf(err) {
+    const code = errorCodeOf(err);
+    return isCodeToken(code) ? { code } : {};
+}
 export const PAUSE_SEATS = [
     { path: ["terminal"], token: "token", gate: "gate" },
     { path: ["terminal", "nestedPause"], token: "token", gate: "gate" },
@@ -41,36 +47,73 @@ function dropCapability(seat, keys) {
     const { [keys.token]: _drop, ...rest } = seat;
     return rest;
 }
-export function sealResultForExit(result, readSeat) {
+export function sealResultForExit(result) {
+    return seal(result, "exit");
+}
+export function sealStoredResult(result, seat) {
+    return seal(result, seat);
+}
+function seal(result, at) {
     if (result === null || typeof result !== "object")
         return result;
-    return foldOutwardFailureCode(mapPauseSeats(result, dropCapability), readSeat);
+    return foldOutwardFailureCodes(mapPauseSeats(result, dropCapability), at);
 }
-function foldOutwardFailureCode(result, readSeat) {
-    const t = failedCauseWithCode(result.terminal);
-    if (t === undefined)
+function foldOutwardFailureCodes(result, at) {
+    const terminal = foldCauseCode(result.terminal, at);
+    const priorAttempts = result.attempts;
+    const attempts = foldAttemptCodes(priorAttempts, at);
+    const terminalKept = Object.is(terminal, result.terminal);
+    const attemptsKept = Object.is(attempts, priorAttempts);
+    if (terminalKept && attemptsKept)
         return result;
+    return { ...result, ...(terminalKept ? {} : { terminal }), ...(attemptsKept ? {} : { attempts }) };
+}
+function foldCauseCode(terminal, at) {
+    const t = failedCauseWithCode(terminal);
+    if (t === undefined)
+        return terminal;
     const outward = outwardFailureCode(t.code);
     if (outward === t.code)
-        return result;
-    reportFold(t.code, outward, t.message, readSeat);
+        return terminal;
+    reportFold(t.code, outward, t.message, at);
     const message = typeof t.message === "string" ? t.message : "the durable store failed";
-    return { ...result, terminal: { ...t, code: outward, message: `${message} [original code: ${t.code}]` } };
-}
-const READ_FOLD_LATCH_CAP = 1024;
-const readFoldLatch = new Set();
-function reportFold(code, outward, message, readSeat) {
-    const original = isCodeToken(code) ? code : "<not-a-code>";
-    if (readSeat !== undefined) {
-        const key = `${readSeat} ${original}`;
-        if (readFoldLatch.has(key))
+    return { ...t, code: outward, message: `${message} [original code: ${t.code}]` };
+}
+function foldAttemptCodes(attempts, at) {
+    if (!Array.isArray(attempts))
+        return attempts;
+    let folded;
+    attempts.forEach((attempt, i) => {
+        if (attempt === null || typeof attempt !== "object")
             return;
-        if (readFoldLatch.size >= READ_FOLD_LATCH_CAP)
-            readFoldLatch.delete(readFoldLatch.values().next().value);
-        readFoldLatch.add(key);
-    }
+        const code = attempt.errorCode;
+        if (typeof code !== "string")
+            return;
+        const outward = outwardFailureCode(code);
+        if (outward === code)
+            return;
+        reportFold(code, outward, undefined, at);
+        (folded ??= [...attempts])[i] = { ...attempt, errorCode: outward };
+    });
+    return folded ?? attempts;
+}
+const STORED_RESULT_FOLD_TAG = "server.terminal.stored-result-code-folded";
+function reportFold(code, outward, message, at) {
     const messageBytes = typeof message === "string" ? Buffer.byteLength(message, "utf8") : 0;
-    console.warn(`[terminal] outward_failure_code_folded original=${original} outward=${outward} messageBytes=${messageBytes} at=${readSeat ?? "exit"}`);
+    const fields = `original=${isCodeToken(code) ? code : "<not-a-code>"} outward=${outward} messageBytes=${messageBytes} at=${at}`;
+    switch (at) {
+        case "exit":
+            console.warn(`[terminal] outward_failure_code_folded ${fields}`);
+            return;
+        case "run.result":
+        case "ev.done.result":
+            recordFailOpen(STORED_RESULT_FOLD_TAG, fields);
+            return;
+        default: {
+            const unhandled = at;
+            throw new Error(`unhandled fold sighting: ${String(unhandled)}`);
+        }
+    }
 }
 function failedCauseWithCode(t) {
     if (t === null || typeof t !== "object")

package/dist/tool-approval.d.ts

@@ -34,7 +34,7 @@ export declare function approvalDecidePath(sessionId: string): string;
 /**
  * [ref] 随批小件:`tool_approval.not_pending` 404 的**判别位**([ref] 排障代价实证 —— 三因合并成一句人话,现场分不出「答案没地方兑」与「打错副本了」)。
  * DECIDED/PARKED 已从 404 分流(DECIDED ⇒ 200 回放首决,回执带 `decidedBy`,**不是**成因;PARKED ⇒ 赎回席),残余两类:
- *  · 行 `VOID` / `DENIED`(没有人决过它)—— `cause` = **行上记的那个成因词**(问账 `denied_reason` 列;与决断口 410 `gone.ask` 体的 `cause`、审计 settle 行
+ *  · 行 `VOID` / `DENIED`(没有人决过它)—— `cause` = **行上记的那个成因词**(问账 `ending_cause` 列;与决断口 410 `gone.ask` 体的 `cause`、审计 settle 行
  *    的 `cause` 同一个词,闭集 {@link SettleCause});行上没写归因(存量行)⇒ 缺席,不替没写的行编一个词;
  *  · {@link NOT_PENDING_UNKNOWN_CAUSE} —— 无行 / 行不是调用方的 / 行仍在别处活着:换副本或换端点重试才有意义(这个词只属于 404 面,不是结局成因)。
  * 对齐 [ref] 反枚举语义:cause 只在**已过属主门**的面上出,不扩枚举面(属主门不过 = 与未知 id 同形)。
@@ -1666,7 +1666,8 @@ export declare class ToolApprovalCoordinator {
      *  ② 在 `deadlineMs` 之前等:未决卡结清、在飞腿闭合(闭了的腿照常落 `leg_closed`)、**本次路由到 park 的卡全部结清**
      *     (F1:观察到 core 已处置这次调用 —— 停车行提交或承载它的腿退场 ⇒ 那张卡的审计 settle 行此刻才写,见 {@link settleParksAwaitingCommit})、
      *     店里在飞的 `put` 静默;
-     *  ③ 到期:仍未闭的腿 ⇒ 审计落 `interrupted_by_shutdown` 记号(下一次 boot 收敛照样列出它,decided 臂的 `resumeSafe:false` 提醒不丢);
+     *  ③ 等待结束(全结清或到期)⇒ 审计落**一行**进程级 `interrupted_by_shutdown` 记录([ref]:有序收尾走完是进程的事实,不是腿的 —— 此刻还没结清的卡
+     *     不论在不在协调器的追踪视野里,下一次 boot 都写 `shutdown_before_park`;下一次 boot 收敛照样列出它们,decided 臂的 `resumeSafe:false` 提醒不丢);
      *     仍未提交的 park ⇒ settle 行**不写**(账本上仍是 pending 孤儿 ⇒ 下一次 boot 与崩溃同路收敛,证据不丢),交回调用方
      *     (`uncommittedParks`,运维 warn `approval_park_uncommitted_at_shutdown` 由关停序落 —— 它握 logger)。之后才观察到的照样写 settle 行
      *     (观察到就是结清,迟到也是)。
@@ -1674,7 +1675,7 @@ export declare class ToolApprovalCoordinator {
      * 的 await 里 —— 零活流的后台 / 委派子代也在内)在登记那一刻按同一条路收场(`askBroadcast` 的铸造审计点之后读这一位)。等待条件
      * 因此数「在飞的 ask」({@link asksInFlight},`askBroadcast` 进出计数)而不只是 `pending` —— 尚未登记的卡不在 `pending` 里。
      * `deadlineMs` 是绝对时刻(`Date.now()` 域):关停序对审批面与店 quiesce 读**同一个**到期点(一个宽限窗,不是两个)。
-     * 从不抛错(关停序不许被审计面卡住);再调一次 = 再等一次(记号有去重集,零重写)。
+     * 从不抛错(关停序不许被审计面卡住);再调一次 = 再等一次(关停记录一世一行,零重写)。
      */
     drainForShutdown(deadlineMs: number): Promise<{
         uncommittedParks: Array<{