@sema-agent/server 7.145.0 → 7.147.0

package/dist/task-settings.d.ts

@@ -195,6 +195,13 @@ export declare function skillListingBudgetFractionOk(v: unknown): v is number;
 /** {@link skillListingBudgetFractionOk} 的孪生(`int().positive()`;`isSafeInteger` 而不是 `isInteger` 的
  *  理由见那里)。 */
 export declare function skillListingMaxDescOk(v: unknown): v is number;
+/**
+ * `settings.autoCompactEnabled`(CC 2.1.309 settings 同名键,`cli309.js:252692` 的 settings 声明:布尔,「上下文装满时自动压缩对话」)的值域判据 —— **只收布尔**。
+ * 与上面两只谓词同姿势:FRESH 提交面的 400 门(`http/admission.ts`)问「合不合法」,RESUME 宽容层({@link parseTaskSettings})问「收不收下」,
+ * 这两句话是同一个问题的正反面,只写在这一处(`"false"` / `0` / `null` 这类假值形都不是布尔:不读成「开」也不读成「关」)。
+ * server 侧零加工:`true` / `false` 逐字交给引擎的自动压缩座 `TaskSpec.compaction.autoCompact`(`spec-fields.ts` 的 `compactionSpecFragment`),缺席 ⇒ 整键不写,默认值的属主是引擎。
+ */
+export declare function autoCompactEnabledOk(v: unknown): v is boolean;
 /** The validated, service-trusted subset of `SemaSettings` we project onto the spec. `env` is parsed only to REPORT
  *  it as received-but-deferred when off the host lane (never silently dropped); a MALFORMED `hooks` likewise reports
  *  deferred (submit 路径另有 400 fail-loud),valid `hooks` 进 applied shape(hook-runner 阶段一)。 */
@@ -233,7 +240,7 @@ export interface ParsedTaskSettings {
     ultracode?: boolean;
     /** hooks hook-runner(阶段一):经 `parseHooksConfig`(契约包分类器 + 服务侧上限 + 本仓会跑的条目类型)判过的 hooks 配置。像 shellEnv 一样
      *  这里只 PARSE;应用点(main.ts resolveSpec)按单用户闸(`requirePrincipal !== true`)决定翻不翻成
-     *  任务座 `TaskSpec.mods` 上的一张注册 `settings.hooks`——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
+     *  任务座 `TaskSpec.mods` 上的车道注册(非托管 `settings.hooks`,有托管组时另一张 `settings.hooks.managed`)——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
     hooks?: RunnableHooksConfig;
     /** [ref](7.77.0)—— CC settings 同名键:上下文窗口里**留给技能清单**的比例((0,1];CC 默认 0.01 = 1%)。
      *  超预算时引擎把描述裁短、再不够退成 name-only(`cli259.js` 的清单渲染算法),**从不**拒掉一条技能 ——
@@ -242,6 +249,10 @@ export interface ParsedTaskSettings {
     skillListingBudgetFraction?: number;
     /** 同族第二键:每条技能描述在清单里的字符帽(正整数;CC 默认 1536)。超出由引擎**截断**,不是拒。 */
     skillListingMaxDescChars?: number;
+    /** `settings.autoCompactEnabled`(CC 2.1.309 settings 同名键,布尔):这条 run 的自动压缩开关。逐字交给引擎的自动压缩座 `TaskSpec.compaction.autoCompact`
+     *  (写点 = `boot/resolve-spec.ts` 经 `spec-fields.ts` 的 `compactionSpecFragment`,与顶层 `compaction.clampTolerance` 同一只映射)。
+     *  `false` 是有意义的值(不是「没设」),所以 {@link parseTaskSettings} 把它收下、`settings` 因它在场。缺席 ⇒ 整键不写。 */
+    autoCompactEnabled?: boolean;
     /** [ref] —— 「只收紧」座位族(`tighten-only-seats.ts` 的四座:读拒模式 / 写保护名的加法 / 合规额外禁项 / 永不自动放行名单)的归一值,**一个键**而不是四个散字段:
      *  wire 位置由座位表说(三座在 `settings` 顶层,`neverAuto` 在 `settings.permissions`),解析后与位置无关。空数组 ≡ 缺席(不铸键)。
      *  去处:三座经 {@link applyTaskSettings} 落 core 任务层席;`neverAuto` 经 {@link deriveSettingsPolicy} 落请求叶策略。 */
@@ -263,9 +274,11 @@ export interface ParseTaskSettingsResult {
         readonly stripped: readonly string[];
     };
 }
-/** `parseTaskSettings` 的可选座:续跑重放腿才有的重读座(一次性迁移 M20;新提交腿与不问 hooks 的读者不递)。 */
+/** `parseTaskSettings` 的可选座:续跑重放腿才有的重读座(一次性迁移 M20;新提交腿与不问 hooks 的读者不递)与调用方已读(并已判)的 `settings.env` 那一份。 */
 export interface ParseTaskSettingsSeats {
     readonly storedHooksReread?: StoredHooksRereadM20;
+    /** {@link readSettingsEnv} 的一次读数(`resolveSpec` 两腿恒递:凭据判据判的就是这一份,解析层不再读第二次;续跑腿 M38 剥过键的是剥后那一份)。缺席 ⇒ 解析层自己读一次(不交子进程的读者)。 */
+    readonly settingsEnv?: SettingsEnvLayer;
 }
 /** Cap on `outputStyle` length — it lands in the system prompt, so it shares the `MAX_SYSTEM_PROMPT_CHARS` (16384)
  *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
@@ -275,6 +288,42 @@ export declare const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16384;
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+/** 一条 `settings.env` 条目被判成凭据的根据(闭集;wire 字段 `entries[].match` 的全部词):`name` = 名字是本进程的凭据变量名;`value_shape` = 值是秘密形。两者都中按 `name` 报。 */
+export declare const SETTINGS_ENV_CREDENTIAL_MATCHES: readonly ["name", "value_shape"];
+export type SettingsEnvCredentialMatch = (typeof SETTINGS_ENV_CREDENTIAL_MATCHES)[number];
+/** 拒体的机读位(原样进 wire 错误体 / `HttpError.extra`):`field` 恒为 `settings.env`;`entries` 按体内序列出每一条命中,键名过调用方串的唯一回显口径,值从不进来。 */
+export interface SettingsEnvCredentialFields {
+    readonly field: "settings.env";
+    readonly entries: readonly {
+        readonly key: string;
+        readonly match: SettingsEnvCredentialMatch;
+    }[];
+}
+/** 一次裁决的产物:wire 文案 + 机读位 + 命中条目的**原键**(`keys`:不出门,只给续跑腿的一次性迁移按键剥)。 */
+export interface SettingsEnvCredentialIssue {
+    readonly message: string;
+    readonly fields: SettingsEnvCredentialFields;
+    readonly keys: readonly string[];
+}
+/** `settings.env` 的一次读数:`sent` = 调用方送了这个键(不是缺席 / `null`);`reaching` = 会交到子进程的那几条({@link cleanEnvMap};形不对 / 没有一条够格 ⇒ `undefined`;一次性迁移 M38 剥空的是 `{}`,见 {@link withoutKeys})。 */
+export interface SettingsEnvLayer {
+    readonly sent: boolean;
+    readonly reaching: Readonly<Record<string, string>> | undefined;
+    /** 送来的值里有读者不交出去的东西({@link settingsEnvUnreadable}:不是对象 / 过帽 / 有成员读不出;空记录不算)—— 解析层据它报 `deferred: ["env"]`。 */
+    readonly unreadable: boolean;
+}
+/** `settings.env` 的**唯一**读法:`settings` 不是对象 ⇒ 没送;否则 `env` 只取一次,形判与收取都对这一次的值做。判据、解析层与续跑腿的剥键都吃这一份。 */
+export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
+/**
+ * `settings.env` 里凭据条目的**唯一**判据(纯函数;律见上方段头)。`reaching` = {@link readSettingsEnv} 读出的那一份(会交到子进程的条目;非串值、超帽的键 / 值本来就到不了子进程;
+ * 缺席 / 形不对 ⇒ `undefined` ⇒ 不判,形归受理门的形判)。`credentialNames` = 本进程的凭据变量名(调用方递 `serverCredentialValueSources(config.modelApiKeyEnv)`)。没有命中 ⇒ `null`。
+ */
+export declare function settingsEnvCredentialIssue(reaching: Readonly<Record<string, string>> | undefined, credentialNames: readonly string[]): SettingsEnvCredentialIssue | null;
+/**
+ * 一次性迁移 M38(窗口见 `plugins/one-time-migrations.ts` 登记表):从读到的那一份里去掉判据点名的原键,交回剥后的一份。**剥空 = 空表**(调用方送了这一块,剥完什么都不剩):
+ * 解析层把它当作这次请求的环境层原样交出,`resolveSpec` 登记它 —— 覆盖这条会话上一条登记;若读成「缺席」,会话注册表按「缺席 = 留着上一条」把上一条(可能正是被剥的那个名字)留给 shell。
+ */
+export declare function withoutKeys(layer: SettingsEnvLayer, keys: readonly string[]): SettingsEnvLayer;
 /** 三桶(闭集;判据按此序逐桶判)。 */
 export declare const SETTINGS_PERMISSION_BUCKETS: readonly ["allow", "deny", "ask"];
 export type SettingsPermissionBucket = (typeof SETTINGS_PERMISSION_BUCKETS)[number];
@@ -305,27 +354,35 @@ export interface SettingsPermissionBucketIssue {
  */
 export declare function settingsPermissionBucketIssue(perms: unknown): SettingsPermissionBucketIssue | null;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
- *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
+ *  `autoCompactEnabled`/`env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
  *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,[ref])。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
  *  🔴 `readDenyPatterns` / `writeProtectedExtra` / `complianceAdditionalDenies` 与 `permissions.neverAuto`([ref])= **「只收紧」座位族**:消费点 = `tighten-only-seats.ts`
  *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
- *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
+ *  (sdk 的 `SemaSettings` 已声明这四个键 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 逐键咬 server 与 sdk 两面一致)。
  *
  *  🔴 `approvalFrameFamilies`([ref])= 这条 run 的客户端**声明**渲染得了哪些审批开卡帧族 —— 不进引擎,不是 CC settings 键。消费点 = 三条执行腿的审批装配
  *  (`tool-approval.ts` 的唯一读者 `declaredApprovalFrameFamilies` → `resolveApprovalLeg`),判官 `approvalFrameFamiliesIssue`(fresh 受理 400 与宽容读者同一只)。
- *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面待声明(对账门的「server 先于 sdk」登记表记着)。
+ *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面已声明(同一只对账门咬)。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
  *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
  *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。
  *
+ *  🔴 `autoCompactEnabled` = **CC settings 同名键**(2.1.309 的 settings 声明,布尔):这条 run 的自动压缩开关,值域只收布尔({@link autoCompactEnabledOk},两层同问这一只);
+ *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 经 `spec-fields.ts` 的 `compactionSpecFragment` 逐字交给引擎的自动压缩座 `TaskSpec.compaction.autoCompact`(与顶层 `compaction.clampTolerance` 同一只映射、同一个对象)。
+ *  关掉的是引擎**自起**的三条道(窗阈值那一遍、prompt-too-long 恢复那一遍、任务尾摘要):守卫链先清旧工具结果、再按尾部裁剪 → 仍装不下则服务商的「prompt too long」拒原样成为
+ *  这条 run 的失败终局(不摘要、不重试);怎么终局整个归引擎,本仓不复刻、不夹紧。调用方要的那一遍(`POST /v1/runs/:id/compact`)归引擎的另一只座 `manualCompact`,
+ *  本服务不写它 ⇒ 关了自动压缩,手动 `/compact` 照样能跑(与参照实现的 `autoCompactEnabled` 同读)。壳的环境变量 `DISABLE_AUTO_COMPACT` / `DISABLE_COMPACT`
+ *  不在本服务的读法里:环境变量是壳进程的事 —— 壳把两者都折成 `autoCompactEnabled: false` 再发;`DISABLE_COMPACT` 多出的「手动也关」由壳自己不发 `/compact` 动词实现
+ *  (本服务不另读 `settings.env` 里的同名变量 —— 那是 shell 子进程的环境,不是引擎的开关)。
+ *
  *  🔴 `allowedHttpHookUrls` / `httpHookAllowedEnvVars` = **CC settings 同名键**(契约包的 http hook 两张名单,键表属主 = 契约包 `HTTP_HOOK_ALLOWLIST_KEYS`):
  *  消费点 = {@link parseTaskSettings} 把它们原样收成一层({@link requestHttpHookAllowlistLayer})→ `boot/resolve-spec.ts` 交给 hooks 注册 → `hooks/hook-runner.ts` 的 http 腿
  *  在拨出之前问契约包判官。受理面只判键名(本门),不判值:名单的读法只有判官那一只(坏形由判官答 `malformed`、拦)。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["allowedHttpHookUrls", "approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export declare const TASK_SETTINGS_KEYS: readonly ["allowedHttpHookUrls", "approvalFrameFamilies", "autoCompactEnabled", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
 export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响
@@ -361,11 +418,14 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 一只匹配组 / 一个条目上**读者不携带**的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);全部携带 ⇒ `null`。
  *
  * 词表 = **读者自己的答案**:`config` 是同一份 `raw` 经 {@link parseHooksConfig} 受理的产物,一只组 / 一个条目受理的键 = 可跑形在同一坐标上那只对象的键
- * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin` / `args`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理;
+ * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理
+ * (契约包 19.0.0 承运 command 的 `args` / `onFailure` 与 http 的 `onFailure`、20.0.0 承运 command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、
+ * prompt 的 `continueOnBlock` 时,这里一行未改就受理了它们 —— 受理 = 读者携带;后四键本服务如实带、不执行,能力位与契约附录明写);
  * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksCoordinate}(契约包出门形 + 回显口径;凭据形键段不原样回显)。
  *
  * 判据边界(与另两个实例同):只判**键名**(值形归读者);拒只在 FRESH 提交面 —— 续跑重放走 {@link parseTaskSettings},读者照旧剥掉它不携带的键,存量体按受理时的读法重放(4xx 打在重放腿上会砖死停驻任务)。
- * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— 守卫条目上的 `onFailure: "block"` 被剥掉,守卫起不来时照放行;`plugin` / `args` 写在 http 条目上被剥掉,写的人以为插件上下文在。
+ * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— `plugin` 写在 http 条目上被剥掉,写的人以为插件上下文在;`args` 写在 http 条目上被剥掉,写的人以为不过 shell;
+ * `onFailure: "block"` 写在 prompt 条目上被剥掉(契约只在 command / http 上承运),写的人以为守卫起不来时失效关闭。
  */
 export declare function hooksKeyIssue(raw: unknown, config: RunnableHooksConfig): KeyClosureIssue | null;
 /**

package/dist/task-settings.js

@@ -8,7 +8,8 @@ import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
-import { HTTP_HOOK_ALLOWLIST_KEYS, SETTINGS_SOURCES } from "@sema-agent/settings-schema";
+import { HTTP_HOOK_ALLOWLIST_KEYS, SETTINGS_SOURCES, containsSecretToken } from "@sema-agent/settings-schema";
+import { echoCallerText } from "./caller-text-echo.js";
 import { heldRuleName } from "./tool-rule-names.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 import { createRequestNeverAutoPolicy } from "./approval.js";
@@ -70,10 +71,24 @@ export function skillListingBudgetFractionOk(v) {
 export function skillListingMaxDescOk(v) {
     return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
+export function autoCompactEnabledOk(v) {
+    return typeof v === "boolean";
+}
 export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
 export const MAX_SETTINGS_ENV_VARS = 256;
 export const MAX_SETTINGS_ENV_VALUE_CHARS = 32_768;
 export const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+function settingsEnvMemberReadable(k, val) {
+    return k.length > 0 && k.length <= MAX_SETTINGS_ENV_KEY_CHARS && typeof val === "string" && val.length <= MAX_SETTINGS_ENV_VALUE_CHARS;
+}
+function settingsEnvUnreadable(v) {
+    if (v === undefined || v === null)
+        return false;
+    if (typeof v !== "object" || Array.isArray(v))
+        return true;
+    const entries = Object.entries(v);
+    return entries.length > MAX_SETTINGS_ENV_VARS || entries.some(([k, val]) => !settingsEnvMemberReadable(k, val));
+}
 function cleanEnvMap(v) {
     if (v === null || typeof v !== "object" || Array.isArray(v))
         return undefined;
@@ -84,13 +99,51 @@ function cleanEnvMap(v) {
         if (n >= MAX_SETTINGS_ENV_VARS || seen >= MAX_SETTINGS_ENV_VARS * 8)
             break;
         seen++;
-        if (typeof k === "string" && k.length > 0 && k.length <= MAX_SETTINGS_ENV_KEY_CHARS && typeof val === "string" && val.length <= MAX_SETTINGS_ENV_VALUE_CHARS) {
+        if (settingsEnvMemberReadable(k, val)) {
             out[k] = val;
             n++;
         }
     }
     return n > 0 ? out : undefined;
 }
+export const SETTINGS_ENV_CREDENTIAL_MATCHES = ["name", "value_shape"];
+export function readSettingsEnv(settings) {
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return { sent: false, reaching: undefined, unreadable: false };
+    const env = settings.env;
+    return { sent: env !== undefined && env !== null, reaching: cleanEnvMap(env), unreadable: settingsEnvUnreadable(env) };
+}
+const MAX_CREDENTIAL_KEYS_NAMED = 8;
+const MATCH_PHRASE = { name: "a credential variable of this engine", value_shape: "a value shaped like a secret" };
+export function settingsEnvCredentialIssue(reaching, credentialNames) {
+    if (reaching === undefined)
+        return null;
+    const names = new Set(credentialNames.map((n) => n.toUpperCase()));
+    const hits = [];
+    for (const [key, value] of Object.entries(reaching)) {
+        if (names.has(key.toUpperCase()))
+            hits.push({ key, match: "name" });
+        else if (containsSecretToken(value))
+            hits.push({ key, match: "value_shape" });
+    }
+    if (hits.length === 0)
+        return null;
+    const entries = hits.map((h) => ({ key: echoCallerText(h.key, { maxChars: MAX_SETTINGS_ENV_KEY_CHARS }), match: h.match }));
+    const named = entries.slice(0, MAX_CREDENTIAL_KEYS_NAMED).map((e) => `${e.key} (${MATCH_PHRASE[e.match]})`);
+    const more = entries.length > MAX_CREDENTIAL_KEYS_NAMED ? `, and ${entries.length - MAX_CREDENTIAL_KEYS_NAMED} more` : "";
+    return {
+        message: `settings.env carries credentials: ${named.join(", ")}${more}. A credential reaches the engine only through the environment its process starts from, never through a request's settings.env — ` +
+            "that block comes from a settings file the model can read, and the request hands it to the session's shell and hooks. Move these out of settings.env into the engine's environment " +
+            "(a sema shell that keeps credentials in its credentials.env file does this; upgrade a shell that still writes them into settings.json). " +
+            "If an entry is not a credential: rename a variable that matched by name, or keep a value that matched by shape out of settings.env the same way (the shape scan is deliberately coarse)",
+        fields: { field: "settings.env", entries },
+        keys: hits.map((h) => h.key),
+    };
+}
+export function withoutKeys(layer, keys) {
+    const drop = new Set(keys);
+    return { sent: layer.sent, reaching: Object.fromEntries(Object.entries(layer.reaching ?? {}).filter(([k]) => !drop.has(k))), unreadable: layer.unreadable };
+}
 export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
 export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
 const BUCKET_ENTRY_RULE = { allow: "allow_layer", deny: "rule_policy", ask: "rule_policy" };
@@ -163,7 +216,7 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["allowedHttpHookUrls", "approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_KEYS = ["allowedHttpHookUrls", "approvalFrameFamilies", "autoCompactEnabled", "complianceAdditionalDenies", "env", "hooks", "httpHookAllowedEnvVars", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
@@ -265,8 +318,9 @@ export function parseTaskSettings(raw, seats = {}) {
                 deferred.push("hooks");
         }
     }
-    const shellEnv = cleanEnvMap(s.env);
-    if (s.env !== undefined && s.env !== null && shellEnv === undefined)
+    const envLayer = seats.settingsEnv ?? readSettingsEnv(s);
+    const shellEnv = envLayer.reaching;
+    if (envLayer.unreadable)
         deferred.push("env");
     const out = {};
     const perms = s.permissions;
@@ -311,6 +365,9 @@ export function parseTaskSettings(raw, seats = {}) {
     const maxDesc = s.skillListingMaxDescChars;
     if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
+    const autoCompact = s.autoCompactEnabled;
+    if (autoCompactEnabledOk(autoCompact))
+        out.autoCompactEnabled = autoCompact;
     const tightenSeats = readTightenOnlySeats(raw);
     for (const name of tightenSeats.rejected)
         deferred.push(tightenOnlySeatDeferredName(name));
@@ -401,7 +458,7 @@ export function rulePolicyBucketsRefusal(permissions, bases) {
             if (names.length === 0)
                 continue;
             const declared = declaredFor(root);
-            const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(declared !== undefined ? { pathBases: declared } : {}) });
+            const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, noticeSeat: "engine", ...(declared !== undefined ? { pathBases: declared } : {}) });
             if (judged === undefined)
                 continue;
             first ??= { bucket, message: judged.message };

package/dist/tool-approval.d.ts

@@ -145,6 +145,9 @@ export interface ParkedAskRedeemRequest {
     decider: ApprovalDecider;
     /** [ref] ctrl+g 编辑放行的实参整体替换(approve 才有意义)。 */
     updatedInput?: unknown;
+    /** 卡上点的是 `allow_session` ⇒ `"session"`:与 `/decide` 体上的 `remember:"session"` 是**同一只**「本会话放行」请求,交同一个铸点
+     *  (续跑腿 `resumeCheckpoint`;可记与否从同一条停驻行判、落同一只豁免店、只在结清之后落)。缺席 = 只放行这一次的那两个词。 */
+    remember?: "session";
     /** 发起本次 respond 的**已验证**调用方(live 腿 `gatedPrincipal` 的那一把)。席在赎回之前拿它与
      *  **checkpoint 当下的 scope** 对一次(codex R1-[high] 一:收编改写身份之后,任何缓存的属主判据都
      *  过期;门必须贴在当下的持久事实上)。 */
@@ -153,11 +156,15 @@ export interface ParkedAskRedeemRequest {
      *  缺席 ⇒ 那条腿按「无请求」形处置(它自己的成文语义,本席不替它决定)。 */
     httpReq?: IncomingMessage;
 }
-/** [ref]:赎回席(装配层注入;缺席 ⇒ PARKED 臂逐字回落修前 404)。回的是赎回腿的原始 HTTP 结果面。 */
-export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
+/** [ref]:赎回席的结局 = 赎回腿的原始 HTTP 结果面 + 请求带了 `remember` 时铸点的真答(`rememberApplied`:落没落;不进 `body` —— 首次受理的回执挂它,
+ *  受理回执(幂等回放的那一份)不存它)。 */
+export interface ParkedAskRedeemResult {
     status: number;
     body: Record<string, unknown>;
-}>;
+    rememberApplied?: boolean;
+}
+/** [ref]:赎回席(装配层注入;缺席 ⇒ PARKED 臂逐字回落修前 404)。 */
+export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<ParkedAskRedeemResult>;
 /**
  * 一张门被引擎**重开**过的停驻卡([ref]):决过之后,续跑腿在被批准的动作开跑之前失败,引擎把同一张门(同一把 token)翻回待决。
  * `reason` = core 记在行上的重开因由词原样(闭集 `REOPEN_REASONS`:`env_failed` 同一个决议经耐久回决口(`decidePath`)再交一次即可续跑 —— 本副本还留着首次受理回执时(缺省 1 小时内、未被容量帽逐出)应答口回放那张回执、不驱续跑;`tool_unavailable` / `constraint_rejected` 要重新决;`config_refused` 改好部署配置后再交原决议,或重新决);
@@ -611,8 +618,8 @@ export interface ToolApprovalFrame {
      * `redactSecrets` 后截长一次算定)。形不合 / 空表 ⇒ 不铸键。
      *
      * 耐久路(park 行)的对偶是 `gate.riskDescriptor.allowRuleShadowed`(整体透传,两条 durable 读面在读边界对条目补 `redactSecrets`,
-     * 叶表属主 `observability/run-terminal.ts` 的 `redactRiskDescriptor`)。升级前停驻的行带旧键 `shadowedRule`,起服一次性迁移改写
-     * (`plugins/one-time-migrations.ts` 登记表)。
+     * 叶表属主 `observability/run-terminal.ts` 的 `redactRiskDescriptor`)。引擎 7.41.x 停驻的行带旧键 `shadowedRule`:不在这一位上(那一格只经脱敏叶表
+     * 「认不得的键按内容脱敏」一条原样显示)。
      */
     allowRuleShadowed?: AllowRuleShadowProjection[];
     /**
@@ -1291,8 +1298,9 @@ export declare function approvalPreambleReplays(input: Omit<ApprovalLegInput, "n
 /** 一条 **DECIDED 行**能交还给引擎的全部形(`AskOutcome` 减掉 park 路由那一臂 —— 一条有决议的行
  *  从定义上不是「投递面拿走了它」)。{@link ToolApprovalCoordinator.notifyExternalDecision} 收的就是它。 */
 export type DecidedAskOutcome = Exclude<AskOutcome, "unavailable">;
-/** 铸点的入参形 = 行上与**这条决议本身**有关的三格。整行(`AskRow`)与 claim 败方读数都满足。 */
-type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia"> & {
+/** 铸点的入参形 = 行上与**这条决议本身**有关的四格。整行(`AskRow`)与 claim 败方读数都满足。
+ *  `decisionNote` 与 `settledBy` / `decidedVia` 同律**必填**(可空)—— 可选会让一个漏挑这一列的投影静默编译过,而漏挑的后果正是把带说明的拒交成裸拒。 */
+type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia" | "decisionNote"> & {
     updatedInput?: unknown;
 };
 /**
@@ -1303,12 +1311,17 @@ type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia"> & {
  * 重放 / 兄弟广播 / 歧义提交恢复三条路上全都退化成裸 `false`,而裸 `false` 在 core 那边逐字是
  * 「**一个人**拒绝了」。手抄投影全面下线([ref]):消费点交行,形由这里铸。
  *
- * 三条读法,每条的属主注在别处,这里只落笔:
+ * 四条读法,每条的属主注在别处,这里只落笔:
  *  · **方向** —— `decision !== "approve"` 即拒(列的二值由店的 CAS 保证);
  *  · **编辑载荷**([ref])—— `updatedInput` 键缺席 = 没带编辑 ⇒ 裸 `true`;在场(**含 `null`**)= 编辑的
  *    字面值 ⇒ 对象臂(语义三态的唯一属主 = `AskRow.updatedInput` 顶注);
  *  · **结算来源**([ref])—— 行上非 null 即宿主自报的那个词(`null` = 人决,与「不铸这个键」同义;
- *    语义属主 = `AskRow.settledBy` 顶注)。
+ *    语义属主 = `AskRow.settledBy` 顶注);
+ *  · **拒因**([ref] 的行派生半场)—— 拒行上**非空**的 `decisionNote` 铸成 `reason`(与应答口 `shapeDeny` 同键同形:core 以带说明的人拒句
+ *    把它交给模型,围栏 `delimitUntrusted` 与长度上限 `REVIEWER_NOTE_MAX_BODY` 全在 core,本仓只透传不预判;空串按 core 契约的缺席读,不铸只装了
+ *    空值的对象臂)。**allow 行的说明恒不铸**:core 对 allow 行的 `reason` 恒销毁,说明只走审计面(行的 `decisionNote` 列)。
+ *    此前这一格不在铸点里 ⇒ 耐久决断口 / 重放 / 兄弟广播 / claim 败方 / 歧义提交恢复 / 悬挂轮询六条行派生的路,都把带说明的拒交成裸 `false`
+ *    (core 读作「一个人拒了、没说怎么办」:STOP 句 + 本轮收住),而同一段说明经应答口到达却带着 `reason` 进模型 —— 一扇门两种去向。
  *
  * 🔴 [ref]:来源位**两向都读**。决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny 上都会落列(引擎 7.39.0 起铸
  * `policy_allowed`),所以 approve 行带来源位是一条合法的行,它的每条读回路径交还 `{allow:true, settledBy:"policy", updatedInput?}`
@@ -1421,7 +1434,7 @@ export declare class ToolApprovalCoordinator {
      *  ask 的 `sessionId` 咨询一次——「这次授权是在**哪里**点的」在授权发生时捕获,不在回决时再猜。
      *  回 `undefined` = 该部署形上 run 的 workspace root 不可知(远程沙箱/多租户等)⇒ 不铸 scope,落
      *  core 的 global 缺省(= 现行为,恒不更宽;也绝不错铸一个坐标系不对的 root)。装配见 main.ts:
-     *  registry cwd(host lane 显式注册的 launch dir)?? in-process 单用户形的 `process.cwd()`。 */
+     *  registry cwd(host lane 显式注册的 launch dir)?? 无手(`none`)单用户形的 `process.cwd()`。 */
     private readonly ruleScopeRootFor;
     /** [ref]:停驻行迟到决议的受理回执表(键 = 行的键 `askId`,插入序 = 逐出序)。语义与有界理由见
      *  {@link ParkRedemption} 顶注。 */

package/dist/tool-approval.js

@@ -512,7 +512,8 @@ export function outcomeOfDecidedRow(row) {
     const allow = row.decision === "approve";
     const source = row.settledBy !== null ? { settledBy: row.settledBy, ...(row.decidedVia !== null ? { decidedVia: row.decidedVia } : {}) } : {};
     const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
-    return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
+    const denyReason = !allow && row.decisionNote ? { reason: row.decisionNote } : {};
+    return row.settledBy === null && !("updatedInput" in edit) && !("reason" in denyReason) ? allow : { allow, ...edit, ...denyReason, ...source };
 }
 function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
@@ -521,6 +522,7 @@ function settleArgsOfDecided(outcome) {
         allowed: outcome.allow,
         ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
         ...(outcome.settledBy !== undefined ? { source: { settledBy: outcome.settledBy, ...(outcome.decidedVia !== undefined ? { decidedVia: outcome.decidedVia } : {}) } } : {}),
+        ...(!outcome.allow && outcome.reason !== undefined ? { denyReason: outcome.reason } : {}),
     };
 }
 function verdictOfDecided(args) {
@@ -529,6 +531,7 @@ function verdictOfDecided(args) {
         allowed: args.allowed,
         ...(args.updatedInput !== undefined ? { updatedInput: args.updatedInput } : {}),
         ...(args.source !== undefined ? { hostSource: args.source } : {}),
+        ...(args.denyReason !== undefined ? { denyReason: args.denyReason } : {}),
     };
 }
 function settleArgsOf(outcome) {
@@ -2478,7 +2481,6 @@ export class ToolApprovalCoordinator {
                 askId: row.askId,
                 idempotent: true,
                 ...decided,
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
                 ...noteRecordedReceipt(parsed.note, noteLandedOnRow(parsed.note, row.decisionNote)),
                 ...this.lateRuleRefusal(parsed),
             },
@@ -2519,6 +2521,7 @@ export class ToolApprovalCoordinator {
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
                     decider: parsed.decider,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
+                    ...(parsed.value === "allow_session" ? { remember: "session" } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
                 });
@@ -2555,7 +2558,7 @@ export class ToolApprovalCoordinator {
                 approvalId: id,
                 askId: row.askId,
                 accepted: "parked_redeemed",
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
+                ...(parsed.value === "allow_session" ? { rememberApplied: out.rememberApplied === true } : {}),
                 ...(rule?.body ?? {}),
             },
         };
@@ -2667,7 +2670,6 @@ export class ToolApprovalCoordinator {
                 accepted: "parked_redeemed",
                 idempotent: true,
                 decision: receipt.decision === "approve" ? "allow" : "deny",
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
                 ...(rule ?? {}),
             },
         };
@@ -2840,14 +2842,16 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(judgedOwner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider) };
+        const settleArgs = opts?.settleOutcome !== undefined
+            ? settleArgsOfDecided(opts.settleOutcome)
+            : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider), ...(!allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle({
             by: "human",
             allowed: settleArgs.allowed,
             updatedInput: settleArgs.updatedInput,
             ...(settleArgs.source !== undefined ? { hostSource: settleArgs.source } : {}),
-            ...(!settleArgs.allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}),
+            ...(settleArgs.denyReason !== undefined ? { denyReason: settleArgs.denyReason } : {}),
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         });
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;

package/dist/trace/core-keyset-guard.d.ts

@@ -20,6 +20,7 @@
 import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, DeploymentSessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 import type { TableCoreKeys } from "./projection-table.js";
+import type { ProjectRegistration } from "@sema-agent/settings-schema";
 import type { PauseSeat } from "../terminal.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -27,12 +28,12 @@ import type { PauseSeat } from "../terminal.js";
  *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
  *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
 export type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance" | "spawnName" | "handback" | "compaction" | "resupplied" | "attempt";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance" | "spawnName" | "handback" | "compaction" | "resupplied" | "attempt" | "crossSessionMessage" | "crossSessionNotice" | "inboxNotice";
 type NotificationExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification"]["excluded"][number];
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type _GuardNotificationReverse = AssertAllKeysHandled<Exclude<NotificationProjected | NotificationExcluded, keyof TaskNotificationPayload>>;
-type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType";
-type ProvenanceExcluded = "peerMeta";
+type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType" | "peerMeta";
+type ProvenanceExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification_provenance"]["excluded"][number];
 type _GuardProvenance = AssertAllKeysHandled<Exclude<keyof SemaProvenance, ProvenanceProjected | ProvenanceExcluded>>;
 type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected | ProvenanceExcluded, keyof SemaProvenance>>;
 type AgentMessageProjected = "from" | "body";
@@ -231,7 +232,7 @@ type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjec
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptLean" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "projectId";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell" | "workspace";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds" | "placementRoot";
@@ -434,11 +435,12 @@ type _CoverWordsCheck = AssertAllKeysHandled<Exclude<CoveringWords<{
     note: string;
 }[], _CoverProbeWords>>>;
 type SessionMemoryStatusSourceKey = keyof SessionMemoryStatus | keyof DeploymentSessionMemoryStatus;
-type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt";
-type SessionMemoryStatusExcluded = "writeHome" | "planes";
-type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<SessionMemoryStatusSourceKey, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
-type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, SessionMemoryStatusSourceKey>>;
-type _GuardSessionMemoryStatusDeploymentReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected, keyof DeploymentSessionMemoryStatus>>;
+type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt" | "writeHome" | "planes";
+/** 其中部署对象顶层也答的那些(引擎折好的五键 + 引擎择一的 `writeHome`;`planes` 是逐店明细本身)。 */
+type SessionMemoryStatusDeploymentTop = Exclude<SessionMemoryStatusProjected, "planes">;
+type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<SessionMemoryStatusSourceKey, SessionMemoryStatusProjected>>;
+type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected, SessionMemoryStatusSourceKey>>;
+type _GuardSessionMemoryStatusDeploymentReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusDeploymentTop, keyof DeploymentSessionMemoryStatus>>;
 type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut" | "account";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
@@ -453,7 +455,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes" | "extension";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes" | "extension" | "echoed";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
@@ -521,6 +523,9 @@ type WorkspaceChangedArm = Extract<TaskEvent, {
 }>;
 type _GuardSessionWorkspace = AssertAllKeysHandled<Exclude<keyof WorkspaceChangedArm, TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>>>;
 type _GuardSessionWorkspaceReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>, keyof WorkspaceChangedArm>>;
+type ProjectRegistryTables = typeof import("../http/routes/projects.js");
+type _GuardProjectRow = AssertAllKeysHandled<Exclude<keyof ProjectRegistration, TableCoreKeys<ProjectRegistryTables["PROJECT_ROW_DISPOSITIONS"]>>>;
+type _GuardProjectRowReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<ProjectRegistryTables["PROJECT_ROW_DISPOSITIONS"]>, keyof ProjectRegistration>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardTerminalArm,
@@ -667,6 +672,8 @@ export type CoreKeysetGuards = [
     _GuardLedgerRunnerDepsReverse,
     _GuardSessionWorkspace,
     _GuardSessionWorkspaceReverse,
+    _GuardProjectRow,
+    _GuardProjectRowReverse,
     _GuardTokenSeats,
     _GuardTokenSeatsReverse,
     _GuardGateSeats,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -51,6 +51,9 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "mcp.authorization_required",
     "classifier.seat_rate_limited",
     "context.tool_schema_removed",
+    "memory.harvest_refused",
+    "memory.harvest_conflict",
+    "config.legacy_tool_name",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -114,6 +117,7 @@ export const RULE_TEXT_DETAIL_FIELDS = {
     "permission.allowed_tool_not_granted": { array: "entries", field: "entry" },
     "permission.rule_row_dropped": { array: "rows", field: "rule" },
     "config.session_rules_earlier_grammar": { array: "entries", field: "entry" },
+    "config.legacy_tool_name": { array: "entries", field: "entry" },
 };
 export function redactNoticeMessage(message) {
     return redactSecrets(String(message));