@sema-agent/server 7.141.0 → 7.143.0

package/dist/config-root-migration.js

@@ -0,0 +1,99 @@
+import { formatConfigPath } from "@sema-agent/settings-schema";
+import { migrateEnvModelsDecision } from "@sema-agent/settings-schema/node";
+import { envModelsDocumentPath } from "./env-model-table-gate.js";
+const markerWriteFailureAnnounced = new Set();
+export function runEnvModelsMigration(input) {
+    return migrateEnvModelsDecision({ root: input.root, env: input.env });
+}
+export function logEnvModelsMigration(log, input, m) {
+    const dir = input.root;
+    switch (m.kind) {
+        case "already_ran":
+        case "not_minter":
+            return;
+        case "marker_unreadable":
+            log.warn("config_env_models_marker_unreadable", {
+                dir,
+                reason: m.reason,
+                note: "the SS-M11 run marker on this config root does not read — it counts as run, so no decision is minted for anyone; an absent decision reads as kept",
+            });
+            return;
+        case "marker_write_failed":
+            if (markerWriteFailureAnnounced.has(dir))
+                return;
+            markerWriteFailureAnnounced.add(dir);
+            log.warn("config_dir_migration_failed", {
+                dir,
+                migration: "SS-M11",
+                reason: m.error,
+                ...(m.errno !== undefined ? { errno: m.errno } : {}),
+                wayOut: m.wayOut,
+                note: "the SS-M11 run marker could not be created, so no decision was minted — an absent decision reads as kept (a decision written by hand still applies); said once per process",
+            });
+            return;
+        case "recorded":
+            logMint(log, input, m.mint, m.createdRoot, m.decision.kind);
+            return;
+        default: {
+            const unhandled = m;
+            throw new Error(`SS-M11 migration: unknown result ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+function logMint(log, input, mint, createdRoot, decisionBefore) {
+    const dir = input.root;
+    const decisionFile = envModelsDocumentPath(dir);
+    switch (mint.kind) {
+        case "minted":
+            log.info("config_dir_migrated", {
+                dir,
+                receipts: [{ migration: mint.receipt.migration, document: mint.receipt.document, path: formatConfigPath(mint.receipt.path), appliedAs: mint.receipt.appliedAs }],
+                written: [decisionFile],
+                removed: [],
+                createdRoot,
+                migration: "SS-M11",
+                minted: true,
+                note: "settings-schema one-time migration SS-M11 recorded that a catalog managing the model plane replaces the env model table on this config root (the reading before the decision existed); it runs once per config root",
+            });
+            if (mint.replacedEnvModels.length > 0 && !input.envTableIsPlaceholder) {
+                log.warn("config_env_models_replaced_by_migration", {
+                    dir,
+                    envModels: mint.replacedEnvModels.map((e) => ({ id: e.id, env: e.env })),
+                    decisionFile,
+                    note: `the local catalog keeps replacing these env models (as before this version). To serve the env models instead, delete ${decisionFile} or write it as {"envModels":"kept"}; a running process keeps the catalog it serves until the next start`,
+                });
+            }
+            return;
+        case "exists":
+        case "skipped":
+            log.info("config_dir_migrated", {
+                dir,
+                receipts: [],
+                written: [],
+                removed: [],
+                createdRoot,
+                migration: "SS-M11",
+                minted: false,
+                why: mint.kind === "exists" ? "decision_written_meanwhile" : mint.why,
+                decisionBefore,
+                note: "settings-schema one-time migration SS-M11 ran on this config root and minted nothing; an absent decision reads as kept from now on",
+            });
+            return;
+        case "failed":
+        case "models_unreadable":
+            log.warn("config_env_models_mint_failed", {
+                dir,
+                cause: mint.kind === "failed" ? "decision_write_failed" : "models_unreadable",
+                reason: mint.error,
+                ...(mint.errno !== undefined ? { errno: mint.errno } : {}),
+                wayOut: mint.wayOut,
+                note: "SS-M11 did not mint the decision and will not try again on this config root (its run marker is in place) — an absent decision reads as kept, so a local catalog that manages the model plane is refused while env models are declared",
+            });
+            return;
+        default: {
+            const unhandled = mint;
+            throw new Error(`SS-M11 migration: unknown mint outcome ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=config-root-migration.js.map

package/dist/config-types.d.ts

@@ -22,7 +22,7 @@ import type { GitApiKind } from "./git-api-kind.js";
 import type { CustomPkgSource } from "./sandbox-pkg-source.js";
 import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
-import type { AtMention } from "@sema-agent/settings-schema";
+import type { AtMention, SandboxGitConfig } from "@sema-agent/settings-schema";
 import type { ModsDeclaration } from "./mods-declaration.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -748,7 +748,7 @@ export interface ServiceConfigFlat {
      *  git pull 落下的文件都还认),它只是不 harvest;而 declared-false 的部署连收编都不做。 */
     memoryPersistenceCapable?: boolean;
     /** 142-S2.5-W1: TOC 同步 client 腿 —— file memory 形态把本地记忆盘与中心(DB 权威,
-     *  POST /v1/memory/sync/:scope)做一轮一 RTT 双向同步。env 三键:`MEMORY_SYNC_URL`(设了=开;缺省
+     *  POST /v2/memory/sync/:scope)做一轮一 RTT 双向同步。env 三键:`MEMORY_SYNC_URL`(设了=开;缺省
      *  undefined=纯本地现状零变化)/`MEMORY_SYNC_TOKEN`(Bearer)/`MEMORY_SYNC_SCOPE`(可选,缺省 =
      *  memoryScope 本身**仅当它已是 v2 typed key**;非 typed 键 ⇒ 拒启,[ref] —— 旧 formatUserScope 派生臂铸出的是本部署
      *  从不写的层,见 loadConfig)。半配置 fail-loud
@@ -761,6 +761,10 @@ export interface ServiceConfigFlat {
         maxPushEntries?: number;
         maxPullEntries?: number;
     };
+    /** [ref] R2:中心(DB 记忆平面)声明的**同步身份** —— 客户端用来到达本中心同步口的基址(env `MEMORY_SYNC_SERVE_IDENTITY`)。
+     *  一处声明、三个读者:能力面 `memorySyncServe.identity` 逐字公开;中心入站 `POST /v2/memory/sync/:scope` 的 `peer` 按串与它比(不等 ⇒ 409,零写);
+     *  缺席 ⇒ 本中心不服务同步(501 `feature.memory_sync_serve_disabled`)。必须已是规范形(铸点 `memory-sync-identity.ts`),否则拒启 —— 无条件解析。 */
+    memorySyncServeIdentity?: string;
     /** [ref](黑板 [ref]/[ref] 两裁):记忆检索的**向量面**接线 —— OpenAI 兼容 `/embeddings` 端点。
      *  env 四键(+ 可选 key):`MEMORY_EMBEDDER_ENDPOINT` / `MEMORY_EMBEDDER_MODEL` / `MEMORY_EMBEDDER_DIM`
      *  (+ `MEMORY_EMBEDDER_TIMEOUT_MS` / `MEMORY_EMBEDDER_API_KEY`)。三问:
@@ -928,6 +932,13 @@ export interface ServiceConfigFlat {
      * ([ref] 起诊断面**有了** `executionLane` 段,但它就是能力面那一只投影 `{provider, toolsOnThisHost, isolated?}`,**不带**本键。)
      */
     requireExecutionLane: boolean;
+    /**
+     * 沙箱 git 平面的有效配置块(本部署经凭据代理路由哪些 git origin;契约 `SandboxGitConfig`:规范形 origin ≤ 16、两两不同、`connectUrl` 必 https、空表合法)。
+     * **唯一来源 = 中心有效配置**(`/effective` 的 `sandboxGit`,web-admin 按部署登记册投影;无 env 旋钮,本地配置源没有这一块);唯一判官 = `stageEffective`
+     * 的那一次 `SandboxGitConfig.safeParse`,`commitStaged` 整只重赋值 —— 缺席或判不过 ⇒ 键**删**(不写 undefined;判不过 = 当作没有任何 origin,契约 §12.8)。
+     * 热:读者(平面座 `sandbox-git-plane.ts` 的每一次读)逐次现读这一键,不捕获对象本身。缺席 = 没有这一块(与契约「可选、无默认」同一种缺席读法,不另设 null)。
+     */
+    sandboxGit?: SandboxGitConfig;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1038,7 +1049,7 @@ export interface ServiceConfigFlat {
          *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
          *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
         enrollTokenTtlSec?: number;
-        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 ⇒ 配置期拒起;解析器 `parseDeviceRelayUrlEnv`):
+        /** `DEVICE_RELAY_URL` = 设备入口的运维声明,**必填**(缺席 / 空串 / 只含空白 ⇒ 配置期拒起:契约包车道表 device 行的必需键,同所有车道的必需键判官 `laneMissingEnv`;值的文法与凭据形由解析器 `parseDeviceRelayUrlEnv` 拒):
          *  `{ kind: "url" }` = 设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时该拨的那一个 ws(s) URL,**逐字**上能力面 `deviceExecutor.relayUrl`
          *  (唯一消费点 `http/routes/capabilities.ts`);`{ kind: "none" }`(字面 `none`)= 没有中继,设备按本引擎地址 + `deviceExecutor.wsPath` 拨号,能力面不带 `relayUrl`。
          *  必填的理由:「设备拨哪里」只有运维知道;缺席曾被读成「直拨」,于是撤掉中继声明而根会话行上还有设备绑定时,设备改拨引擎地址(入口已收窄则拨不到)、
@@ -1319,9 +1330,9 @@ export interface ServiceConfigFlat {
      * env `LOCKED_CONFIG_KEYS`(csv;词表 = core 的 `LOCKED_KEY_REGISTRY` 闭集,未知键 boot 拒 =
      * `config.locked_registry`「不解析的安全控件不得半开」)。
      *
-     * ⚠️ 本仓的两条**装配相容性**判据在 boot/governance-seams.ts(`assertLockAssemblable`):
-     * `toolPolicy` 锁与本仓「每条腿自铸 spec.toolPolicy」的装配形结构性冲突,`mcp` 锁与「部署自带 MCP
-     * 基线」冲突 —— 两者都在启动期拒,而不是让每条任务腿在 prepare 期各撞一次 `config.locked_key`。
+     * ⚠️ 本仓的**装配相容性**判据在 boot/governance-seams.ts(`assertGovernanceAssemblable`,部署 MCP / A2A 基线物化之后判一次):
+     * `toolPolicy` 锁与本仓「每条腿自铸 spec.toolPolicy」的装配形结构性冲突,`mcp` / `a2a` 锁与「部署自带 MCP 服务器 /
+     * A2A 对端」冲突 —— 都在启动期拒,而不是让每条任务腿在 prepare 期各撞一次 `config.locked_key`。
      */
     lockedConfigKeys?: readonly LockedKey[];
     /**
@@ -2319,7 +2330,7 @@ export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" |
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memorySyncServeIdentity" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 web-admin 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  [ref] 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
@@ -2328,7 +2339,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.d.ts

@@ -264,10 +264,11 @@ export declare function applyAutoCompactWindow(m: Model, explicit?: number): "ex
 /**
  * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与装配第 2 段的路由端点判官同调这一只)。
  *
- * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
+ * 布防 = 声明了中心(`webAdmin` 在场)∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
- * `/health` ready:false,落地后整张模型表被中心目录换装。dryRun 是 compare-only(名册从不被应用),local / 纯 env
- * 部署没有「中心」可等 ⇒ 都不布防。
+ * `/health` ready:false,落地后整张模型表被中心目录换装。判据**不看配置源形态**:`CONFIG_PROVIDER=local` 而同时声明了中心与
+ * `CONFIG_REQUIRE_ROSTER=true` 的部署同样布防,env 表同样按占位读(路由判官、本地腿的 env 模型表闸都不判它)。没有声明中心的
+ * local / 纯 env 部署没有「中心」可等 ⇒ 不布防;dryRun 是 compare-only(名册从不被应用)⇒ 不布防。
  */
 export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]): boolean;
 /**
@@ -422,6 +423,12 @@ export declare const FLEET_ENV_REFUSAL_CODES: {
     readonly member_unfenced: "config.fleet_member_unfenced";
 };
 export type FleetEnvRefusalCode = (typeof FLEET_ENV_REFUSAL_CODES)[keyof typeof FLEET_ENV_REFUSAL_CODES];
+/**
+ * `MEMORY_SYNC_SERVE_IDENTITY`(中心声明的同步身份)的**唯一**解析口。**无条件解析**(运维旋钮律,同 `FLEET_ADVERTISE_ADDRESS`):未设 / 空串 ⇒ 缺席;
+ * 设了就必须**已是**同步身份的规范形(铸点 `memory-sync-identity.ts` 的「声明的身份」座位)—— 运维写下的就是能力面公开的、中心入站按串比的那一串,
+ * 没有第二种拼法 ⇒ 不是规范形就拒启并给出规范形(不静默规范化);带凭据 / 查询 / 片段 / 非 http(s) / 超宽同样拒启,拒句不引路径与凭据。
+ */
+export declare function parseMemorySyncServeIdentity(raw: string | undefined): string | undefined;
 /** 一只 fleet 成员的围栏车道:续租打的中心端点(车道对象原样,含活性基址)+ 代际。 */
 export interface FleetFenceLane {
     readonly center: CenterEndpoint & {

package/dist/config.js

@@ -3,13 +3,14 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { buildRuleListJudgeOptions } from "./permission-rule-list.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
 import { memorySyncPeerOf } from "./memory-sync-client.js";
+import { buildMemorySyncIdentityBootRefusal, declaredMemorySyncIdentityFlaw } from "./memory-sync-identity.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { projectLayerOwnerOf } from "./project-layer-key.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
@@ -1741,7 +1742,7 @@ function parseMemoryDomain(ctx) {
     }
     else {
         if (memoryEngineBackend !== "file") {
-            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v1/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
+            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v2/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
         }
         if (memorySyncToken === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");
@@ -1756,6 +1757,9 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine with a typed MEMORY_SCOPE (e.g. user:<tenant>) so it provides one");
         }
+        if (carriesCredential(scope)) {
+            throw new Error(`${memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE"} (the memory sync layer's name) holds a credential-shaped part — the layer name travels verbatim in every sync request path and report, so it is refused, never cleaned: rename the layer`);
+        }
         assertProjectLayerOwnable(scope, memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE");
         memorySync = {
             url: memorySyncUrl,
@@ -1793,6 +1797,7 @@ function parseMemoryDomain(ctx) {
         memoryScope,
         ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(parseMemoryPersistenceCapable(process.env.MEMORY_PERSISTENCE_CAPABLE)),
         ...(memorySync ? { memorySync } : {}),
+        ...((v) => (v !== undefined ? { memorySyncServeIdentity: v } : {}))(parseMemorySyncServeIdentity(process.env.MEMORY_SYNC_SERVE_IDENTITY)),
         ...((v) => (v !== undefined ? { memoryEmbedder: v } : {}))(parseMemoryEmbedder({ memoryEngineBackend, memoryEngineEnabled })),
         memoryOrgAdmissionMode,
         ...(process.env.MEMORY_DELEGATION_EVIDENCE !== undefined
@@ -2305,6 +2310,15 @@ function parseFleetScope(raw) {
     }
     return fleetScopeOf(raw);
 }
+export function parseMemorySyncServeIdentity(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const flaw = declaredMemorySyncIdentityFlaw(raw);
+    if (flaw !== undefined) {
+        throw new Error(buildMemorySyncIdentityBootRefusal("MEMORY_SYNC_SERVE_IDENTITY", raw, flaw, "clients authenticate with MEMORY_SYNC_TOKEN; set MEMORY_SYNC_SERVE_IDENTITY to the bare base address clients reach this center's sync face at"));
+    }
+    return raw;
+}
 function parseFleetAdvertiseAddress(raw) {
     const name = "FLEET_ADVERTISE_ADDRESS";
     if (raw === undefined || raw === "")
@@ -2464,7 +2478,7 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "memoryPersistenceCapable", "memorySync", "memorySyncServeIdentity", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
     "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
@@ -2474,7 +2488,7 @@ const AUTH_GROUP_KEYS = [
     "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "sandboxGit", "remoteExec", "remoteExecHomeDir", "requireExecutionLane", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",

package/dist/delegated-session-owner.d.ts

@@ -136,18 +136,20 @@ export interface PlacedRowWriter {
  */
 export declare function createPlacedSessionRow(sessionId: string, placement: PlacementSources, io: PlacedRowWriter, log: OrphanOwnerLog): Promise<void>;
 /**
- * 停驻挂点的**见证**:调用方交出的委派树根 + 调用方判断那一刻读到的根行住客(化身;`null` = 那一读里根行不在)。请求腿 = 鉴权解析的会话与受理时那一读;
- * 赎回腿 = 行上的根与写口放行的那一位住客(认领之前解析器那一读)。
+ * 停驻挂点的**见证**:调用方交出的委派树根 + 调用方判断那一刻读到的根行住客(属主与化身,同一读;化身 `null` = 那一读里根行不在,此时属主恒 `null`)。
+ * 请求腿 = 鉴权解析的会话与受理时那一读;赎回腿 = 行上的根与写口放行的那一位住客(认领之前解析器那一读)。
+ * 读者:停驻挂点({@link assertRootStillWitnessed},只比化身)、会话行记录座(化身)、后台子代完成 relay(属主与化身,会话通知门的目标住客)。
  */
 export interface DelegationRootWitness {
     readonly sessionId: string;
+    readonly owner: string | null;
     readonly incarnation: string | null;
 }
 /**
  * 「根行的化身已换 ⇒ 拒」在停驻挂点的那一道(挂点的见证是更早的一读,不是这一读):此刻根行在、而住客不是见证的那一位(见证那一读里不在,或是另一位)⇒ 抛。
  * 根行此刻不在 ⇒ 不抛(根真没了 ⇒ 律给哨兵,不是「换了住客」)。这是**判断**的一部分;判断之后、写之前根的变化不改变写进去的值(律:属主 = 判断时见证到的)。
  */
-export declare function assertRootStillWitnessed(sessionId: string, witness: DelegationRootWitness | undefined, judged: JudgedOwner): void;
+export declare function assertRootStillWitnessed(sessionId: string, witness: Pick<DelegationRootWitness, "incarnation"> | undefined, judged: JudgedOwner): void;
 /** 记录委派树的宿主店多交的两只口(三只持久会话店与缓存包装层;无 repo 的内存店两只都没有 ⇒ 没有可按的树 ⇒ 不认领)。 */
 export interface DelegationTreeStore {
     /** 本行落库的 placement 元组(`undefined` = 本行不是 placed 行 ⇒ 不记委派树)。 */

package/dist/delegated-session-owner.js

@@ -92,7 +92,7 @@ export async function settleDelegatedOwner(host, sessionId, owner, tree) {
             throw refuse();
         judged = await readDelegatedOwner(sessionId, recorded, sourceFacesVia(host.headOf));
         if (tree.root !== null)
-            assertRootStillWitnessed(sessionId, { sessionId: tree.root, incarnation: tree.rootIncarnation }, judged);
+            assertRootStillWitnessed(sessionId, { incarnation: tree.rootIncarnation }, judged);
         expected = judged.inherited.owner;
         if (face.owner === null && expected !== null) {
             claimed = await trees.claimOwnerless(sessionId, face.incarnation, expected);

package/dist/device-ws-protocol.d.ts

@@ -75,6 +75,7 @@ export declare const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION: {
     readonly 1: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
     readonly 2: readonly ["liveness_no_output"];
     readonly 3: readonly ["name_too_long"];
+    readonly 4: readonly ["symlink_loop"];
 };
 /** 本包认得的协议修订号(= 增量表的行键)。 */
 export type DeviceProtocolRevision = keyof typeof DEVICE_OUTCOME_ERROR_CODES_BY_REVISION;

package/dist/device-ws-protocol.js

@@ -1,7 +1,7 @@
 import { createPublicKey, randomBytes, randomInt, verify as edVerify } from "node:crypto";
 import { MAX_TIMER_DELAY_MS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
 export const DEVICE_WS_PATH = "/v1/device/ws";
-export const DEVICE_PROTOCOL_VERSION = 3;
+export const DEVICE_PROTOCOL_VERSION = 4;
 export const DEVICE_MIN_PROTOCOL_VERSION = 1;
 export const DEVICE_HELLO_DOMAIN_TAG = "sema.device.hello.v1";
 export const DEVICE_WS_LIMITS = {
@@ -67,6 +67,7 @@ export const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION = {
     ],
     2: ["liveness_no_output"],
     3: ["name_too_long"],
+    4: ["symlink_loop"],
 };
 export function deviceOutcomeErrorCodesAt(revision) {
     if (!Number.isInteger(revision) || revision < 1 || revision > DEVICE_PROTOCOL_VERSION) {

package/dist/env-model-table-gate.d.ts

@@ -0,0 +1,53 @@
+/**
+ * 本地配置腿上「一份管模型面的目录能不能顶替已声明的 env 模型表」—— **唯一判官**与它的拒句;以及候选随身带的那一份事实 {@link CatalogSource}。
+ *
+ * ## 律(一条)
+ * 一份候选的模型面被组拒 `config.catalog_replaces_env_models`,当且仅当四件同时成立:
+ *  ① 候选来自**本地配置腿**({@link CatalogSource} 的 `local` 臂;中心腿不守卫 —— 中心发布的目录照旧整表顶替 env 表);
+ *  ② 候选**管**模型面(模型面 stage 已走过「一条启用条目也没有 ⇒ 不管」那条捷径 —— 本判官只在它之后被问);
+ *  ③ env 模型表**已声明**且不是占位(`MODEL_ID` 铸出了条目;严格名册布防时 env 表是占位、不算);
+ *  ④ 配置根上的决定读数**不是** `replaced`(缺席 / `kept` / 读不懂 —— 运行记录在场之后缺席 ≡ `kept`,读不懂的不许读成确认)。
+ * 拒 ⇒ 模型面这一组停在上一代(起服:env 表;刷新拍:在服的那一代),其余组照落;拒句点名被顶替的 env 模型、决定文件的路径与两条出路。
+ *
+ * 执法点:模型面 stage 经登记条 `config-invariants.ts` 的 `env-table-replacement-acknowledged` 调本判官(候选的事实随 `CrossInvariantInput.candidate` 交来)。
+ *
+ * ## 一个读者
+ * 决定文件的字节只有契约的 `readEnvModelsDecision` 打开:`LocalConfigProvider.fetchEffective` 在读候选的**同一拍**调它,读数随候选交出
+ * (`FetchEffectiveResult.catalogSource`;本地 etag 由同一份读数的身份 `envModelsDecisionTag` 并入)。本模块与模型面 stage 只读这份读数,不开文件。
+ * 「env 表已声明」读的是引擎**自己铸的那张** env 表(模型面 stage 的 env 快照),不再读一遍 env。
+ */
+import { CATALOG_REPLACES_ENV_MODELS_CODE, type EnvModelTableEntry, type EnvModelsDecision } from "@sema-agent/settings-schema";
+/**
+ * 一份目录候选**从哪条配置腿来**(以及本地腿上,配置根的 env 模型表决定在**同一拍**读作什么)。必填、没有缺省腿:安全轴上「忘了说是哪条腿」
+ * 不许静默落成某一种语义(与 `ApplyLeg` 同一条纪律)。铸点:`LocalConfigProvider.fetchEffective`(`local` 臂,带 `root` 与那一读的决定)、
+ * `RemoteConfigProvider.fetchEffective` 与盘上 LKG 读回(`remote` 臂 —— LKG 只在中心腿启用)。
+ */
+export type CatalogSource = {
+    readonly kind: "local";
+    readonly root: string;
+    readonly envModels: EnvModelsDecision;
+} | {
+    readonly kind: "remote";
+};
+/** 中心腿的那一份(冻结;中心腿不守卫,没有可带的事实)。 */
+export declare const REMOTE_CATALOG_SOURCE: CatalogSource;
+/** 判官的拒决(码与句出自同一次判决)。 */
+export interface EnvTableReplacementRefusal {
+    readonly code: typeof CATALOG_REPLACES_ENV_MODELS_CODE;
+    readonly reason: string;
+}
+/** 判官的输入(纯数据)。 */
+export interface EnvTableReplacementInput {
+    /** 引擎自己铸的那张 env 表的条目(槽序;空 = env 表没声明)。 */
+    readonly envTable: readonly EnvModelTableEntry[];
+    /** 严格名册布防(`isRosterGateArmed`):env 表是占位、从不被派发 ⇒ 对本闸等于没声明。 */
+    readonly envTableIsPlaceholder: boolean;
+    readonly source: CatalogSource;
+}
+/**
+ * **唯一判官**(见文件头的律;② 由调用方的位置保证)。通过 ⇒ `undefined`。两只闭集都穷举:腿加一臂 / 决定加一词不补 ⇒ 编译红。
+ */
+export declare function judgeEnvTableReplacement(input: EnvTableReplacementInput): EnvTableReplacementRefusal | undefined;
+/** 配置根上决定文件的路径(文件名取契约的文档名,不手抄)。 */
+export declare function envModelsDocumentPath(root: string): string;
+//# sourceMappingURL=env-model-table-gate.d.ts.map

package/dist/env-model-table-gate.js

@@ -0,0 +1,53 @@
+import { CATALOG_REPLACES_ENV_MODELS_CODE, ENV_MODELS_DOCUMENT } from "@sema-agent/settings-schema";
+import path from "node:path";
+export const REMOTE_CATALOG_SOURCE = Object.freeze({ kind: "remote" });
+export function judgeEnvTableReplacement(input) {
+    const { source } = input;
+    switch (source.kind) {
+        case "remote":
+            return undefined;
+        case "local":
+            break;
+        default: {
+            const unhandled = source;
+            throw new Error(`judgeEnvTableReplacement: unknown catalog source ${JSON.stringify(unhandled)}`);
+        }
+    }
+    if (input.envTable.length === 0 || input.envTableIsPlaceholder)
+        return undefined;
+    const decision = source.envModels;
+    switch (decision.kind) {
+        case "replaced":
+            return undefined;
+        case "absent":
+        case "kept":
+        case "unreadable":
+            return { code: CATALOG_REPLACES_ENV_MODELS_CODE, reason: envTableReplacementSentence(input.envTable, decision, envModelsDocumentPath(source.root)) };
+        default: {
+            const unhandled = decision;
+            throw new Error(`judgeEnvTableReplacement: unknown decision ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function envModelsDocumentPath(root) {
+    return path.join(root, `${ENV_MODELS_DOCUMENT}.json`);
+}
+function decisionPhrase(decision) {
+    switch (decision.kind) {
+        case "absent":
+            return "is absent (an absent decision reads as kept)";
+        case "kept":
+            return 'says "kept"';
+        case "unreadable":
+            return decision.reason === "io" ? `cannot be read (${decision.errno}) — an unreadable decision is never read as a confirmation` : `does not read (${decision.reason}) — an unreadable decision is never read as a confirmation`;
+    }
+}
+function envTableReplacementSentence(envTable, decision, documentPath) {
+    const named = envTable.map((e) => `${e.env} "${e.id}"`).join(", ");
+    const keys = envTable.map((e) => e.env).join(" / ");
+    return (`[${CATALOG_REPLACES_ENV_MODELS_CODE}] config.d/models.json manages the model plane, which would replace the env model table (${named}); ` +
+        `the config root's decision ${documentPath} ${decisionPhrase(decision)}, so this catalog's model plane is not adopted and the model plane in force keeps serving ` +
+        `(the env models, unless an earlier catalog generation was adopted). To let local catalogs replace the env models on this config root, write ${documentPath} as {"envModels":"replaced"} ` +
+        `(a supported writer does this after showing what is replaced), or unset ${keys}.`);
+}
+//# sourceMappingURL=env-model-table-gate.js.map

package/dist/execution-lane-caps.d.ts

@@ -138,7 +138,8 @@ export declare function executionLaneRow(lane: RemoteExecProvider): ExecutionLan
  * 一条车道**必需**的 env 键名 = 正本表行的 `requiredEnv ∪ requiredSecretEnv`(次序:非密坐标在前、密钥在后 —— 与 7.113.0 本仓手写表逐字同)。
  * 读者:`config.ts` 的 [ref] 拒启门(点了名却缺件 ⇒ 点名缺哪几键)、部署面门(`test/deploy-lanes-contract.test.ts`:`lanes.json` 每行登记
  * 本车道必需键)、`scripts/gen-deploy-lanes.ts`(从同一张正本生成 `lanes.json` 的必需键列,以及根 / review compose 与 sema-up 栈 compose 里的必需键透传)。
- * device 在正本表(15.2.0)上没有必需 env;它的必填键 `DEVICE_RELAY_URL` 的缺席暂由 `config.ts` `parseDeviceRelayUrlEnv` 拒(过渡:表行收进它即删那一臂)。
+ * 每条车道的必需键都在这一张表上、缺席都由下面的 {@link laneMissingEnv} 一只判官判 —— device 行也是(契约包 16.0.0 起 `requiredEnv: ["DEVICE_RELAY_URL"]`):缺席 / 空串 / 只含空白在 `declaredExecutionLane` 的必需 env 门被拒,
+ * 走到 `config.ts` 的设备入口解析器 `parseDeviceRelayUrlEnv` 时值一定在,它只判值的文法与凭据形。没有哪个必需键另有一臂缺席判官。
  */
 export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly string[];
 /**