@sema-agent/server 7.141.0 → 7.142.0

package/dist/boot/workflow-orchestration.js

@@ -7,6 +7,7 @@ import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, buildWork
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createWorkflowOrchestration(ctx) {
     const { config, logger, metrics, localRoot, backend, getRunStore } = ctx;
     const workflowBootAtMs = Date.now();
@@ -43,12 +44,12 @@ export function createWorkflowOrchestration(ctx) {
             await workflowCompletionInbox.enqueue(buildWorkflowCompleteInboxEntry(route, p, Date.now()));
         }
         catch (err) {
-            logger.warn("workflow_completion_enqueue_failed", { runId: p.runId, err: String(err) });
+            logger.warn("workflow_completion_enqueue_failed", { runId: p.runId, err: seatText("operator-log-text", String(err)) });
         }
     };
     const workflowNotifyGate = baseWorkflowRunStore && workflowNotifyJournal
         ? new WorkflowNotifyGate(workflowNotifyJournal, baseWorkflowRunStore, deliverWorkflowCompletion, {
-            onError: (stage, runId, err) => logger.warn("workflow_notify_failed", { stage, runId, err: String(err) }),
+            onError: (stage, runId, err) => logger.warn("workflow_notify_failed", { stage, runId, err: seatText("operator-log-text", String(err)) }),
         })
         : undefined;
     const fleetBus = new FleetEventBus();

package/dist/capabilities/builtin-tools.d.ts

@@ -37,7 +37,8 @@ export declare function createSubagentExtraTools(deployment?: SubagentExtraToolS
 /**
  * `onExtraToolsError` 收到的错误 → 运维行 `subagent_extra_tools_error` 的字段:句子,加上错误**自带**的码与 `detail.reason`(在场才铸)。
  * core 7.46.0 [ref] 被拒的 spawn(产物不在名册里)带 `config.extra_tool_names` + `undeclared_name` / `undeclared_origin`;部署工厂自己抛的错多半两位都不带。
- * 本仓不按码分支、不重铸 —— 只把错误说的话原样过境到运维面(修前只记句子,码与原因词丢在这一跳)。
+ * 本仓不按码分支、不重铸 —— 只把错误说的话过境到运维面(修前只记句子,码与原因词丢在这一跳)。码是别人写的串(引擎的 `config.extra_tool_names`,或部署工厂自己抛的错):
+ * 与运维日志里其余各处同一只判官 —— 是码才带 `code`,其余键缺席({@link codeFieldOf})。
  */
 export declare function extraToolsErrorFields(err: unknown): Record<string, unknown>;
 //# sourceMappingURL=builtin-tools.d.ts.map

package/dist/capabilities/builtin-tools.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { NOW_TOOL_NAME } from "./host-tool-names.js";
+import { codeFieldOf } from "../terminal.js";
 export function nowTool() {
     return {
         name: NOW_TOOL_NAME,
@@ -21,12 +22,9 @@ export function createSubagentExtraTools(deployment) {
     };
 }
 export function extraToolsErrorFields(err) {
-    const fields = { err: err instanceof Error ? err.message : String(err) };
+    const fields = { err: err instanceof Error ? err.message : String(err), ...codeFieldOf(err) };
     if (err === null || typeof err !== "object")
         return fields;
-    const code = Reflect.get(err, "code");
-    if (typeof code === "string")
-        fields.code = code;
     const detail = Reflect.get(err, "detail");
     const reason = detail !== null && typeof detail === "object" ? Reflect.get(detail, "reason") : undefined;
     if (typeof reason === "string")

package/dist/capabilities/composite-members.d.ts

@@ -45,7 +45,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"];
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
-    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "tightenOnlySeats", "approvalFrameFamilies"];
+    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies"];
     readonly settings: readonly ["permissions"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
@@ -56,6 +56,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly workspaceSync: readonly ["persist", "keep", "timeoutMs", "cache"];
     readonly userAttachments: readonly ["entries", "kinds", "supplies", "limits"];
     readonly credentialPlane: readonly ["sandboxGit"];
+    readonly memorySyncServe: readonly ["identity"];
 };
 type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
 /** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */

package/dist/capabilities/composite-members.js

@@ -6,7 +6,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
-    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "tightenOnlySeats", "approvalFrameFamilies"],
+    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies"],
     settings: ["permissions"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
@@ -17,6 +17,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     workspaceSync: ["persist", "keep", "timeoutMs", "cache"],
     userAttachments: ["entries", "kinds", "supplies", "limits"],
     credentialPlane: ["sandboxGit"],
+    memorySyncServe: ["identity"],
 };
 export function gateCompositeMembers(body) {
     return body;

package/dist/capability-facts.d.ts

@@ -65,6 +65,9 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly memory_origin_faces_absent: "the memory engine's origin marking faces are not wired";
     readonly consolidation_valve_closed: "the memory consolidation valve is closed (MEMORY_CONSOLIDATION_DRIVER)";
     readonly memory_optout_grant_absent: "no memory-capture opt-out grant store is wired (SQL backends only)";
+    readonly memory_db_plane_absent: "this is not a DB memory plane (MEMORY_ENGINE_BACKEND=pg|mysql): the central memory faces are not wired";
+    readonly memory_sync_identity_undeclared: "the DB memory plane declares no sync identity (MEMORY_SYNC_SERVE_IDENTITY), so it serves no sync round";
+    readonly memory_sync_leg_absent: "no memory sync leg runs here (a file memory engine with MEMORY_SYNC_URL)";
     readonly outcome_ledger_unqueryable: "the outcome sink has no query face (File sink)";
     readonly config_catalog_disabled: "the config catalog is switched off (CONFIG_CATALOG_ENABLED=false)";
     readonly rule_store_absent: "no permission-rule store is wired";
@@ -272,6 +275,27 @@ export declare function sharedMemoryRead(d: Pick<Deps, "sharedMemoryStore" | "or
     provider: Store<"sharedMemoryStore">;
     directory: Store<"orgMemoryDirectory">;
 }>;
+/** 中心侧记忆导出读(`GET /v1/memory/export`):DB 记忆平面的导出读面在场(只在 DB 记忆平面装配)。门读本事实,不读 `MEMORY_ENGINE_BACKEND`。 */
+export declare function memoryExport(d: Pick<Deps, "memoryExport">): Fact<"memory_db_plane_absent", {
+    read: Store<"memoryExport">;
+}>;
+/**
+ * 中心侧同步口(`POST /v1/memory/sync/:scope`):DB 记忆平面的同步执行位在场 ∧ 本中心声明了同步身份(`MEMORY_SYNC_SERVE_IDENTITY`)。
+ * 见证 = 执行位 + 那份声明 —— 能力位 `memorySyncServe` 的 `{ identity }` 逐字投影它,入站 `peer` 与它按串比:一处声明,两个读者读同一个值。
+ */
+export declare function memorySyncServe(d: Pick<Deps, "memorySync" | "config">): Fact<"memory_db_plane_absent" | "memory_sync_identity_undeclared", {
+    perform: Store<"memorySync">;
+    identity: string;
+}>;
+/**
+ * 会话记忆同步触发口(`POST /v1/sessions/:id/memory/sync`):本机同步腿在场 ∧ 持久 run 账面(读集 = 会话最近一条已结腿的记忆观测;收割栅栏读会话的 run 认领)
+ * ∧ 会话头读(属主门与 `sourceRevision` = 同一次头读的叶子)。
+ */
+export declare function sessionMemorySync(d: Pick<Deps, "memorySyncLeg" | "runStore" | "sessionStorage">): Fact<"memory_sync_leg_absent" | "run_store_absent" | "session_head_face_absent", {
+    leg: Store<"memorySyncLeg">;
+    runStore: Store<"runStore">;
+    sessionStorage: HeadReadingSessionStore;
+}>;
 /** 跨主体投递门在座(`POST /v1/principal-inbox/messages` 的可用性门与能力位 `principalInboxDelivery` 同读这一只)。门的装配本身是
  *  一道合取(收件箱消费方声明 ∧ 耐久 mailbox ∧ org 成员目录 ∧ 配额店,缺一拒启 —— `boot/stage-06-runners.ts`),
  *  所以这里只判「门在不在」:在 ⟺ 那四件都在。 */

package/dist/capability-facts.js

@@ -45,6 +45,9 @@ export const CAPABILITY_FACT_WHY = {
     memory_origin_faces_absent: "the memory engine's origin marking faces are not wired",
     consolidation_valve_closed: "the memory consolidation valve is closed (MEMORY_CONSOLIDATION_DRIVER)",
     memory_optout_grant_absent: "no memory-capture opt-out grant store is wired (SQL backends only)",
+    memory_db_plane_absent: "this is not a DB memory plane (MEMORY_ENGINE_BACKEND=pg|mysql): the central memory faces are not wired",
+    memory_sync_identity_undeclared: "the DB memory plane declares no sync identity (MEMORY_SYNC_SERVE_IDENTITY), so it serves no sync round",
+    memory_sync_leg_absent: "no memory sync leg runs here (a file memory engine with MEMORY_SYNC_URL)",
     outcome_ledger_unqueryable: "the outcome sink has no query face (File sink)",
     config_catalog_disabled: "the config catalog is switched off (CONFIG_CATALOG_ENABLED=false)",
     rule_store_absent: "no permission-rule store is wired",
@@ -286,6 +289,26 @@ export function sharedMemoryRead(d) {
         return no("org_memory_directory_absent");
     return yes({ provider: d.sharedMemoryStore, directory: d.orgMemoryDirectory });
 }
+export function memoryExport(d) {
+    return d.memoryExport !== undefined ? yes({ read: d.memoryExport }) : no("memory_db_plane_absent");
+}
+export function memorySyncServe(d) {
+    if (d.memorySync === undefined)
+        return no("memory_db_plane_absent");
+    const identity = d.config.memorySyncServeIdentity;
+    return identity !== undefined ? yes({ perform: d.memorySync, identity }) : no("memory_sync_identity_undeclared");
+}
+export function sessionMemorySync(d) {
+    if (d.memorySyncLeg === undefined)
+        return no("memory_sync_leg_absent");
+    const runs = durableRuns(d);
+    if (!runs.available)
+        return runs;
+    const owned = sessionOwnership(d);
+    if (!owned.available)
+        return owned;
+    return yes({ leg: d.memorySyncLeg, runStore: runs.runStore, sessionStorage: owned.sessionStorage });
+}
 export function principalInboxDelivery(d) {
     return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");
 }

package/dist/config-catalog.js

@@ -273,6 +273,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_SYNC_MAX_PULL_ENTRIES", "memory", "number", "TOC 同步单轮 pull 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_MAX_PUSH_ENTRIES", "memory", "number", "TOC 同步单轮 push 条数帽(设了必须 ≥1 整数)", { derivedDefaultNote: "缺席 ⇒ 键缺席,core 默认" }),
     r("MEMORY_SYNC_SCOPE", "memory", "string", "TOC 同步 scope 覆写(本服务铸的项目键族 `userrepo:` / `repo:` 拒启:项目层由同步腿按属主自己选)", { derivedDefaultNote: "缺席 ⇒ = MEMORY_SCOPE,仅当它已是 typed 键;非 typed 键拒启(S-964)" }),
+    r("MEMORY_SYNC_SERVE_IDENTITY", "memory", "url", "记忆同步中心(DB 记忆平面)声明的同步身份 = 客户端用来到达本中心同步口的基址;必须已是规范形(小写协议与主机、无缺省端口、无尾斜杠、无查询串 / 片段 / 凭据),否则拒启并给出规范形;能力位 `memorySyncServe.identity` 逐字公开,入站 `peer` 按串与它比", { derivedDefaultNote: "缺席 ⇒ 本中心不服务同步(501 feature.memory_sync_serve_disabled)", configKey: "memorySyncServeIdentity" }),
     r("MEMORY_SYNC_TOKEN", "memory", "secret", "TOC 同步中心面的 Bearer(URL 设了它必须在,半配拒启)", { danger: SEC }),
     r("MEMORY_SYNC_URL", "memory", "url", "TOC 同步中心地址(设了=开;file 记忆形专用,DB 后端配了拒启;同步覆盖同步层与同属主的项目层 `userrepo:<属主>/…` ⇒ 同步层与 MEMORY_SCOPE 同属主时单用户任务照常按项目键控并随同步推拉;不同属主 ⇒ 写家落全局层,启动通知 `memory_project_scope_yields_to_sync`)"),
     r("METRICS_TOKEN", "observability", "secret", "/metrics 只读令牌", { danger: SEC }),

package/dist/config-types.d.ts

@@ -22,7 +22,7 @@ import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
-import type { AtMention } from "@sema-agent/settings-schema";
+import type { AtMention, SandboxGitConfig } from "@sema-agent/settings-schema";
 import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -761,6 +761,10 @@ export interface ServiceConfigFlat {
         maxPushEntries?: number;
         maxPullEntries?: number;
     };
+    /** [ref] R2:中心(DB 记忆平面)声明的**同步身份** —— 客户端用来到达本中心同步口的基址(env `MEMORY_SYNC_SERVE_IDENTITY`)。
+     *  一处声明、三个读者:能力面 `memorySyncServe.identity` 逐字公开;中心入站 `POST /v1/memory/sync/:scope` 的 `peer` 按串与它比(不等 ⇒ 409,零写);
+     *  缺席 ⇒ 本中心不服务同步(501 `feature.memory_sync_serve_disabled`)。必须已是规范形(铸点 `memory-sync-identity.ts`),否则拒启 —— 无条件解析。 */
+    memorySyncServeIdentity?: string;
     /** [ref](黑板 [ref]/[ref] 两裁):记忆检索的**向量面**接线 —— OpenAI 兼容 `/embeddings` 端点。
      *  env 四键(+ 可选 key):`MEMORY_EMBEDDER_ENDPOINT` / `MEMORY_EMBEDDER_MODEL` / `MEMORY_EMBEDDER_DIM`
      *  (+ `MEMORY_EMBEDDER_TIMEOUT_MS` / `MEMORY_EMBEDDER_API_KEY`)。三问:
@@ -928,6 +932,13 @@ export interface ServiceConfigFlat {
      * ([ref] 起诊断面**有了** `executionLane` 段,但它就是能力面那一只投影 `{provider, toolsOnThisHost, isolated?}`,**不带**本键。)
      */
     requireExecutionLane: boolean;
+    /**
+     * 沙箱 git 平面的有效配置块(本部署经凭据代理路由哪些 git origin;契约 `SandboxGitConfig`:规范形 origin ≤ 16、两两不同、`connectUrl` 必 https、空表合法)。
+     * **唯一来源 = 中心有效配置**(`/effective` 的 `sandboxGit`,web-admin 按部署登记册投影;无 env 旋钮,本地配置源没有这一块);唯一判官 = `stageEffective`
+     * 的那一次 `SandboxGitConfig.safeParse`,`commitStaged` 整只重赋值 —— 缺席或判不过 ⇒ 键**删**(不写 undefined;判不过 = 当作没有任何 origin,契约 §12.8)。
+     * 热:读者(平面座 `sandbox-git-plane.ts` 的每一次读)逐次现读这一键,不捕获对象本身。缺席 = 没有这一块(与契约「可选、无默认」同一种缺席读法,不另设 null)。
+     */
+    sandboxGit?: SandboxGitConfig;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1038,7 +1049,7 @@ export interface ServiceConfigFlat {
          *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
          *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
         enrollTokenTtlSec?: number;
-        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 ⇒ 配置期拒起;解析器 `parseDeviceRelayUrlEnv`):
+        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 / 只含空白 ⇒ 配置期拒起:契约包车道表 device 行的必需键,同所有车道的必需键判官 `laneMissingEnv`;值的文法与凭据形由解析器 `parseDeviceRelayUrlEnv` 拒):
          *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
          *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
          *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
@@ -2319,7 +2330,7 @@ export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" |
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memorySyncServeIdentity" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  [ref] 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
@@ -2328,7 +2339,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.d.ts

@@ -422,6 +422,12 @@ export declare const FLEET_ENV_REFUSAL_CODES: {
     readonly member_unfenced: "config.fleet_member_unfenced";
 };
 export type FleetEnvRefusalCode = (typeof FLEET_ENV_REFUSAL_CODES)[keyof typeof FLEET_ENV_REFUSAL_CODES];
+/**
+ * `MEMORY_SYNC_SERVE_IDENTITY`(中心声明的同步身份)的**唯一**解析口。**无条件解析**(运维旋钮律,同 `FLEET_ADVERTISE_ADDRESS`):未设 / 空串 ⇒ 缺席;
+ * 设了就必须**已是**同步身份的规范形(铸点 `memory-sync-identity.ts` 的「声明的身份」座位)—— 运维写下的就是能力面公开的、中心入站按串比的那一串,
+ * 没有第二种拼法 ⇒ 不是规范形就拒启并给出规范形(不静默规范化);带凭据 / 查询 / 片段 / 非 http(s) / 超宽同样拒启,拒句不引路径与凭据。
+ */
+export declare function parseMemorySyncServeIdentity(raw: string | undefined): string | undefined;
 /** 一只 fleet 成员的围栏车道:续租打的中心端点(车道对象原样,含活性基址)+ 代际。 */
 export interface FleetFenceLane {
     readonly center: CenterEndpoint & {

package/dist/config.js

@@ -3,13 +3,14 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { buildRuleListJudgeOptions } from "./permission-rule-list.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
 import { memorySyncPeerOf } from "./memory-sync-client.js";
+import { buildMemorySyncIdentityBootRefusal, declaredMemorySyncIdentityFlaw } from "./memory-sync-identity.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { projectLayerOwnerOf } from "./project-layer-key.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
@@ -1756,6 +1757,9 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine with a typed MEMORY_SCOPE (e.g. user:<tenant>) so it provides one");
         }
+        if (carriesCredential(scope)) {
+            throw new Error(`${memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE"} (the memory sync layer's name) holds a credential-shaped part — the layer name travels verbatim in every sync request path and report, so it is refused, never cleaned: rename the layer`);
+        }
         assertProjectLayerOwnable(scope, memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE");
         memorySync = {
             url: memorySyncUrl,
@@ -1793,6 +1797,7 @@ function parseMemoryDomain(ctx) {
         memoryScope,
         ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(parseMemoryPersistenceCapable(process.env.MEMORY_PERSISTENCE_CAPABLE)),
         ...(memorySync ? { memorySync } : {}),
+        ...((v) => (v !== undefined ? { memorySyncServeIdentity: v } : {}))(parseMemorySyncServeIdentity(process.env.MEMORY_SYNC_SERVE_IDENTITY)),
         ...((v) => (v !== undefined ? { memoryEmbedder: v } : {}))(parseMemoryEmbedder({ memoryEngineBackend, memoryEngineEnabled })),
         memoryOrgAdmissionMode,
         ...(process.env.MEMORY_DELEGATION_EVIDENCE !== undefined
@@ -2305,6 +2310,15 @@ function parseFleetScope(raw) {
     }
     return fleetScopeOf(raw);
 }
+export function parseMemorySyncServeIdentity(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const flaw = declaredMemorySyncIdentityFlaw(raw);
+    if (flaw !== undefined) {
+        throw new Error(buildMemorySyncIdentityBootRefusal("MEMORY_SYNC_SERVE_IDENTITY", raw, flaw, "clients authenticate with MEMORY_SYNC_TOKEN; set MEMORY_SYNC_SERVE_IDENTITY to the bare base address clients reach this center's sync face at"));
+    }
+    return raw;
+}
 function parseFleetAdvertiseAddress(raw) {
     const name = "FLEET_ADVERTISE_ADDRESS";
     if (raw === undefined || raw === "")
@@ -2464,7 +2478,7 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "memoryPersistenceCapable", "memorySync", "memorySyncServeIdentity", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
     "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
@@ -2474,7 +2488,7 @@ const AUTH_GROUP_KEYS = [
     "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "sandboxGit", "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",

package/dist/execution-lane-caps.d.ts

@@ -138,7 +138,8 @@ export declare function executionLaneRow(lane: RemoteExecProvider): ExecutionLan
  * 一条车道**必需**的 env 键名 = 正本表行的 `requiredEnv ∪ requiredSecretEnv`(次序:非密坐标在前、密钥在后 —— 与 7.113.0 本仓手写表逐字同)。
  * 读者:`config.ts` 的 [ref] 拒启门(点了名却缺件 ⇒ 点名缺哪几键)、部署面门(`test/deploy-lanes-contract.test.ts`:`lanes.json` 每行登记
  * 本车道必需键)、`scripts/gen-deploy-lanes.ts`(从同一张正本生成 `lanes.json` 的必需键列,以及根 / review compose 与 sema-up 栈 compose 里的必需键透传)。
- * device 在正本表(15.2.0)上没有必需 env;它的必填键 `DEVICE_RELAY_URL` 的缺席暂由 `config.ts` `parseDeviceRelayUrlEnv` 拒(过渡:表行收进它即删那一臂)。
+ * 每条车道的必需键都在这一张表上、缺席都由下面的 {@link laneMissingEnv} 一只判官判 —— device 行也是(契约包 16.0.0 起 `requiredEnv: ["DEVICE_RELAY_URL"]`):缺席 / 空串 / 只含空白在 `declaredExecutionLane` 的必需 env 门被拒,
+ * 走到 `config.ts` 的设备入口解析器 `parseDeviceRelayUrlEnv` 时值一定在,它只判值的文法与凭据形。没有哪个必需键另有一臂缺席判官。
  */
 export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly string[];
 /**

package/dist/fleet/fleet-bus.d.ts

@@ -369,8 +369,10 @@ export interface HookNonBlockingFailure {
      *  · `matcher_over_budget` —— 这条 hook 所在组的 `matcher`(或条目自己的 `if` 条件)在这次事件的这个名字上求值没在预算内结束(灾难回溯;[ref])。
      *    **不是 hook 脚本坏了,是它的选中条件不可求值**:server 按「选中」处理(守卫不被跳过,条目照跑),此帧说的是「这只 matcher 在这个名字上跑不完」。
      *    **一组一帧**(`if` 一条目一帧),`hookName` / `entryType` 指认组的第一个条目,`detail` 点名 matcher、名字、额度与组里的条目数;无 `exitCode` / `stderr`。
+     *  · `url_not_allowed` —— http 条目被 http hook 名单拦下(`settings.allowedHttpHookUrls`,契约包判官答拦:没命中 / 空名单 / 名单坏形),**一个字节都没发**(7.142.0 起)。
+     *    不是端点坏了,是配置不许它出门;`detail` 点名 `settings.hooks.<event>`、名单键与规则词(`url` / `empty` / `malformed`)和出路;无 `exitCode` / `stderr`。
      */
-    reason: "exit_nonzero" | "timeout" | "spawn_failed" | "bad_json" | "matcher_over_budget";
+    reason: "exit_nonzero" | "timeout" | "spawn_failed" | "bad_json" | "matcher_over_budget" | "url_not_allowed";
     /** hook 身份(CC `OG`/`AEe` 锚:`statusMessage` 优先,否则 command / url / prompt),已脱敏+有界。
      *  ⚠️ http 条目取 URL 时**剥掉 query 与 fragment**([ref] codex R1-F1:端点凭据最常见的挂法是
      *  `?token=…`,而通用脱敏器只认 `user:pass@` 形)。要更友好的名字,作者有 `statusMessage`。 */
@@ -411,9 +413,10 @@ export interface HookManagedUnrun {
      *  · `spawn_failed` / `timeout` —— 起不来 / 超时被收;
      *  · `exit_nonzero` —— 退出码非 0 非 2;`bad_json` —— 看着是 JSON 却读不成(含 http 条目 2xx 回了非 JSON 体、Stop × prompt 的判词读不出);`decision_out_of_set` —— `permissionDecision` 不在 allow / deny / ask 里;
      *  · `evidence_unavailable` —— Stop × prompt 条目因会话证据面不足(或运维关了 transcript)被滤掉没跑;
-     *  · `rewrite_unsettled` —— 一个托管相(插件相 / 策略相)改写了输入、按新输入把那一相重判一遍后仍交回不同的值(不收敛;「改写」按值判,恒等回显不算)。
+     *  · `rewrite_unsettled` —— 一个托管相(插件相 / 策略相)改写了输入、按新输入把那一相重判一遍后仍交回不同的值(不收敛;「改写」按值判,恒等回显不算);
+     *  · `url_not_allowed` —— http 条目被 http hook 名单拦下、没发出(7.142.0 起;同一次的 `hook_non_blocking_failure{url_not_allowed}` 照发)。
      */
-    reason: "matcher_invalid" | "llm_carrier_unavailable" | "llm_cap" | "powershell_unsupported" | "if_unevaluable" | "budget_exhausted" | "spawn_failed" | "timeout" | "exit_nonzero" | "bad_json" | "decision_out_of_set" | "evidence_unavailable" | "rewrite_unsettled";
+    reason: "matcher_invalid" | "llm_carrier_unavailable" | "llm_cap" | "powershell_unsupported" | "if_unevaluable" | "budget_exhausted" | "spawn_failed" | "timeout" | "exit_nonzero" | "bad_json" | "decision_out_of_set" | "evidence_unavailable" | "rewrite_unsettled" | "url_not_allowed";
     /** 那一组的来源词(`managedPolicy` 或 `managedPlugin:<name>`;名只留痕)。 */
     source: string;
     /** hook 身份(同 `hook_non_blocking_failure`:`statusMessage` 优先,否则 command / url〔剥 query〕/ prompt),已脱敏 + 有界。 */

package/dist/hooks/hook-runner.d.ts

@@ -1,5 +1,6 @@
 import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksDroppedPieceCode, type HooksRejection, type HooksRejectionCode } from "@sema-agent/settings-schema/hooks";
 import { type ConfigPath, type UrlCredential } from "@sema-agent/settings-schema";
+import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import type { EngineDollar, ModRegistration } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
@@ -514,6 +515,11 @@ export interface HookRunnerContext {
      *  的 TaskStream.steer(下个 turn 边界注入);返回 false=没有活流可投(任务已结束/挂起/别副本)——
      *  调用方记账不重试(挂起腿的 pending-steer park 是后续切片)。缺席 ⇒ asyncRewake 降级纯 async(记账)。 */
     wake?: (text: string) => Promise<boolean>;
+    /**
+     * http hook 两张名单(`allowedHttpHookUrls` / `httpHookAllowedEnvVars`)的**设置层**,交契约包判官原样读(见 {@link runHttpHook})。必填:每个装配点都要说这条 run 有哪些层 ——
+     * `[]` = 没有层写名单(不限,与引擎外的参照实现「名单未设 ⇒ 不限」同读)。今天唯一的层来源是请求的 `settings`(`task-settings.ts` 的 `httpHookAllowlist`,源 `flagSettings`)。
+     */
+    httpHookAllowlistLayers: readonly HttpHookAllowlistLayer[];
 }
 /** 阶段三b 模型调用载体契约(prompt=直连一次 completion;agent=runTask 收敛后的 final text)。
  *  返回 ok/text 或 ok:false/error——载体自己兜超时(timeoutMs 是硬顶,载体可更严),绝不 throw。 */

package/dist/hooks/hook-runner.js

@@ -4,6 +4,7 @@ import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild, killTreeSoft, killTreeHard } from "../plugins/host-platform.js";
 import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
 import { findUrlCredential, formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
+import { httpHookEnvVarsAllowed, httpHookUrlVerdict } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog } from "@sema-agent/core";
 import { hangClassic } from "./classic-stations.js";
@@ -511,6 +512,7 @@ export function hookIfMatches(cond, payload) {
         return "unevaluable";
     }
 }
+const SERVER_WORKSPACE_TRUST = "no_trust_step";
 const MAX_LLM_ENTRIES_PER_EVENT = 4;
 const DEFAULT_PROMPT_HOOK_TIMEOUT_SECONDS = 30;
 const DEFAULT_AGENT_HOOK_TIMEOUT_SECONDS = 120;
@@ -996,8 +998,29 @@ async function runLlmHook(entry, payload, ctx, extra) {
             clearTimeout(hardTopTimer);
     }
 }
+function httpHookWithheldSentence(event, block) {
+    const field = `settings.${block.list}`;
+    const [why, exit] = (() => {
+        switch (block.rule) {
+            case "url":
+                return [`its url matches no pattern in ${field}`, `add a pattern that matches the url to ${field}, or point the hook at a url the list allows`];
+            case "empty":
+                return [`${field} is an empty list, so no http hook may run`, `add a pattern that matches the url to ${field}`];
+            case "malformed":
+                return [`${field} is not an array of strings, so it is read as allowing no url`, `write ${field} as an array of url pattern strings`];
+            default: {
+                const unhandled = block.rule;
+                throw new Error(`httpHookWithheldSentence: unhandled rule ${String(unhandled)}`);
+            }
+        }
+    })();
+    return `settings.hooks.${event}: http hook not sent — ${why} (rule: ${block.rule}); ${exit}`;
+}
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
+    const block = httpHookUrlVerdict(entry.url, ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST);
+    if (block !== undefined)
+        return { code: null, stdout: "", stderr: "", timedOut: false, withheld: block };
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
     let hookChildVars;
     try {
@@ -1006,7 +1029,7 @@ async function runHttpHook(entry, payload, ctx, event) {
     catch (e) {
         return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
     }
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, httpHookEnvVarsAllowed(entry.allowedEnvVars ?? [], ctx.httpHookAllowlistLayers, SERVER_WORKSPACE_TRUST), hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,
@@ -1210,6 +1233,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 ctx.logger.warn("hook_command_killed", { event, type: entry.type, killed: true, signal: run.aborted.signal });
             return { kind: "halted" };
         }
+        if (run.withheld !== undefined) {
+            const { list, rule, sources } = run.withheld;
+            ctx.logger.warn("hook_http_withheld", { event, url: entry.type === "http" ? buildDisplaySafeUrl(entry.url) : null, list, rule, sources: [...sources] });
+            noteHookFailure(ctx, { event, entry, reason: "url_not_allowed", detail: httpHookWithheldSentence(event, run.withheld), ...(toolName !== undefined ? { toolName } : {}) });
+            return { kind: "unrun", reason: "url_not_allowed" };
+        }
         if (run.spawnError) {
             ctx.logger.warn(entry.type === "http" ? "hook_http_request_failed" : entry.type === "prompt" || entry.type === "agent" ? "hook_llm_failed" : "hook_command_spawn_failed", { event, type: entry.type, error: seatText("operator-log-error", run.spawnError) });
             if (!run.noticed)

package/dist/http/dispatch.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, setSsoPrincipalInc, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity } from "../auth-bridge.js";
@@ -227,6 +227,8 @@ export function createDispatch(ctx) {
                     setSsoScope(req, identity.scope);
                     if (identity.role)
                         setSsoRole(req, identity.role);
+                    if (identity.principalInc !== undefined)
+                        setSsoPrincipalInc(req, identity.principalInc);
                     deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
@@ -236,7 +238,7 @@ export function createDispatch(ctx) {
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
-        admitRunIdentity(req, identitySource);
+        admitRunIdentity(req, identitySource, deps.logger);
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {

package/dist/http/execution-context.d.ts

@@ -85,8 +85,8 @@ export type ExecutionContext = {
 export type RootedExecutionContext = Extract<ExecutionContext, {
     readonly root: string;
 }>;
-/** 装配器(`resolveSpec`)收的那一半:根与入口形(它不判放置、不选车道)。 */
-export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root">;
+/** 装配器(`resolveSpec`)收的那一半:根、入口形与解析器选定的车道(它不判放置、不选车道 —— `lane` 是解析器那一次的读数,装配器只读:项目包的车道门)。 */
+export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root" | "lane">;
 /** 解析器读的部署件(全部取自同一只 `ServiceDeps`)。 */
 export interface ExecutionContextDeps {
     readonly config: ServiceConfig;

package/dist/http/idempotency.d.ts

@@ -117,7 +117,7 @@ export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFa
  * 再走 `/v1/tasks`,合流到的是前者的那份结局。回执若铸在同步腿的体里,这条**确实产了帧**的 run 在非流式面上
  * 就成了「键缺席」,而 present-iff 的读法会把它读成「这台引擎不给回执」。挂在 outcome 上 = 它是**这条 run 的
  * 属性**(哪条腿跑的都一样),由各腿自己的应答构造器在送出那一刻按自己的 wire 形挂。
- * 落定之后的同键重放不走这里:它读行,体是 run 行读面 + `replay: true`(`http/submit-replay.ts`)—— 回执是起手那一帧
+ * 落定之后的同键重放不走这里:它读行,体是首答的信封 + `replay: true`(`http/submit-replay.ts` → `http/sync-submit-body.ts`)—— 回执是起手那一帧
  * 的活捕获、不落行,所以重放体上**不带** `wiringManifest`(`replay: true` 就是那一形的判别位)。
  *
  * 🔴 **租户面安全(别在复审里当成漏)**:合流的那份回执是按**第一位调用方**的 `explicitOperatorOk` 投的,

package/dist/http/principal-gate.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import { type DurableOwnerKey, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
 import { type IdentitySource, type RunIdentity } from "../identity-source.js";
+import type { Logger } from "../observability/logger.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
 export declare function headerStr(v: string | string[] | undefined): string | undefined;
 export declare function safeEqual(a: string, b: string): boolean;
@@ -28,8 +29,9 @@ export declare function verifiedIdentitySource(req: IncomingMessage, config: Ser
 /**
  * 🔴 **run 行身份元组的唯一铸点**(律见 `identity-source.ts` 头注;唯一调用点 = `dispatch.ts` 的凭据门,机器门钉着)。`source` = 凭据门那一次
  * {@link verifiedIdentitySource} 的答案 —— 这里不再判来源,只把来源连同它的 scope / 化身号定成元组,挂在这个请求上;建 run 行的点经 {@link runIdentityOf} 读它。
+ * `logger` 收律 4 的告警行(令牌声明装不进列;凭据门交 `deps.logger`)。
  */
-export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined): void;
+export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined, logger: Pick<Logger, "warn"> | undefined): void;
 /**
  * 建 run 行时写进行里的身份元组 —— 每个 `createRun` 调用点(或替它建行的腿的调用方)读这一只,原样写入(机器门:`src/http/**` 每处 `createRun` 都写明 `identity`)。
  * 只在**受理请求验过的主体就是这一行的属主**时交出凭据门铸下的元组(提交面恒成立:行的属主就是这个主体);别人替属主按下的那一跑(唤醒、决定投递铸的

package/dist/http/principal-gate.js

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from "node:crypto";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
-import { IDENTITY_SOURCES, RUN_IDENTITY_SCOPE_MAX_CHARS } from "../identity-source.js";
+import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
+import { IDENTITY_SOURCES, runIdentityClaimOverflow } from "../identity-source.js";
 import { sendError } from "./send.js";
 export function headerStr(v) {
     return Array.isArray(v) ? v[0] : v;
@@ -60,19 +60,28 @@ export function verifiedIdentitySource(req, config) {
     return IDENTITY_SOURCES.find((kind) => identitySourceVerified(kind, req, config));
 }
 const ADMITTED_RUN_IDENTITY = new WeakMap();
-export function admitRunIdentity(req, source) {
-    ADMITTED_RUN_IDENTITY.set(req, mintRunIdentity(req, source));
-}
-function mintRunIdentity(req, source) {
+export function admitRunIdentity(req, source, logger) {
+    ADMITTED_RUN_IDENTITY.set(req, mintRunIdentity(req, source, logger));
+}
+function mintRunIdentity(req, source, logger) {
+    const fits = (claim, value) => {
+        const overflow = runIdentityClaimOverflow(claim, value);
+        if (overflow !== undefined)
+            logger?.warn("run_identity_claim_unrecorded", { claim: overflow.claim, chars: overflow.chars, max: overflow.max });
+        return overflow === undefined;
+    };
     switch (source) {
         case "service_token":
         case "direct_door_jwt":
             return { source, scope: null, principalInc: null };
         case "sso": {
             const scope = ssoVerifiedScope(req);
-            if (scope === undefined || [...scope].length > RUN_IDENTITY_SCOPE_MAX_CHARS)
+            if (scope === undefined)
+                return null;
+            if (!fits("scope", scope))
                 return null;
-            return { source, scope, principalInc: null };
+            const principalInc = ssoVerifiedPrincipalInc(req);
+            return { source, scope, principalInc: principalInc !== undefined && fits("principalInc", principalInc) ? principalInc : null };
         }
         case undefined:
             return null;