@sema-agent/server 7.146.0 → 7.147.0

package/dist/stores-sql/tool-result-store-sql.js

@@ -1,7 +1,7 @@
 import { MAX_MINTED_TOOL_RESULT_REF_CHARS, assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance } from "@sema-agent/core";
 import { pgSanitizeText } from "../plugins/pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
-import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-store-sql.js";
+import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-declaration.js";
 import { ensureIndexes } from "../plugins/ensure-index.js";
 import { describeProbedTableDrift, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
 import { isMissingColumnError } from "../plugins/sql-errors.js";

package/dist/stores-sql/windowed-session-storage.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 两只 SQL 会话存储(`tidb-session-storage.ts` / `pg-session-storage.ts`)共用的**窗口视图** —— 一次唤醒读出的有界日志 `[floor .. leaf]`。
+ *
+ * ## 组合,不继承
+ * 会话树的读法(按 id 取、按类型找、标签、到根的路径、叶子、日志标记、地板、回放丢失)只有引擎那一份:本类把唤醒读出的窗口交给引擎的
+ * `InMemorySessionStorage`(组合),每个读都转给它;方言孪生只说两件 SQL 的事 —— 一笔写怎么落库({@link persist}),地板之下按 id 回读一条
+ * ({@link readBelowFloor})。不再 `extends` 引擎的存储基类:方言店继承引擎的店基类造第二份店,是依赖方向门 R5′ 拒的形。
+ *
+ * ## 写序
+ * 先落库(方言孪生在自己的事务里按叶子 CAS),落成才记进窗口 —— 与引擎存储「先判后记」同序;落库被拒(CAS 输)时窗口一个字节不动。
+ * 记进窗口走引擎存储的追加口(不带期望叶:CAS 已在库里判过,窗口只是跟上那一笔)。
+ *
+ * ## 叶子是行说的那一格
+ * 叶子 = 库里那一格(`session_meta.leaf_id`,引擎存储契约里「后端说出的头」),不是窗口末条之后的叶子(fork 拷整份日志带着别的分支时两者不同)。
+ * 窗口(引擎的存储)从条目推叶子、不收后端说的头 ⇒ 叶子由本类自己持有:唤醒时取行上那一格(它不在窗口里 ⇒ `corrupt_session`,与引擎存储基类同一判、同一句),
+ * 之后每落一笔前进到「这一笔之后的叶子」(与库里同一事务写下的值同一读法)。窗口里那只按条目推出的叶子不被读。
+ */
+import { InMemorySessionStorage, type SessionLogMark, type SessionMetadata, type SessionStorage, type SessionTreeEntry, type SessionWriteOptions } from "@sema-agent/core";
+export declare abstract class WindowedSessionStorage implements SessionStorage {
+    /** 唤醒读出的窗口(引擎的存储;叶子以外的每个读都是它的读)。 */
+    private readonly view;
+    /** 叶子(头注「叶子是行说的那一格」)。 */
+    private leaf;
+    /**
+     * `entries` = 窗口(按 `seq` 升序);`statedLeafId` = 行上那一格叶子;`floorEntryId` = 窗口的地板(没有压缩 ⇒ `null`,整条日志都在窗口里)。
+     * 地板不在窗口里 ⇒ 引擎存储拒 `corrupt_session`;行上的叶子不在窗口里 ⇒ 本类拒 `corrupt_session`(引擎存储基类的同一判、同一句)。
+     */
+    protected constructor(metadata: SessionMetadata, entries: SessionTreeEntry[], statedLeafId: string | null, floorEntryId: string | null);
+    /** 一笔写落库(方言孪生的事务:叶子 CAS + 追加事件)。抛 ⇒ 窗口不记。 */
+    protected abstract persist(entry: SessionTreeEntry, opts?: SessionWriteOptions): Promise<void>;
+    /** 地板之下按 id 回读一条(窗口里没有的;标签目标等)。没有 ⇒ `undefined`。 */
+    protected abstract readBelowFloor(id: string): Promise<SessionTreeEntry | undefined>;
+    getMetadata(): Promise<SessionMetadata>;
+    getLeafId(): Promise<string | null>;
+    createEntryId(): Promise<string>;
+    findEntries<TType extends SessionTreeEntry["type"]>(type: TType): Promise<Array<Extract<SessionTreeEntry, {
+        type: TType;
+    }>>>;
+    getLabel(id: string): Promise<string | undefined>;
+    getPathToRoot(leafId: string | null): Promise<SessionTreeEntry[]>;
+    getEntries(): Promise<SessionTreeEntry[]>;
+    /** 窗口的地板(没有压缩 ⇒ `null`)。 */
+    getFloorId(): string | null;
+    /** SQL 唤醒没有回放可丢(行是逐条读的):恒 `undefined`,经引擎存储原样答。 */
+    getReplayLoss(): ReturnType<InMemorySessionStorage["getReplayLoss"]>;
+    /** 窗口此刻的日志标记(同步读;引擎存储的读法)。 */
+    logMarkNow(): SessionLogMark;
+    /** 窗口里没有的 id(地板之下)回落到库。 */
+    getEntry(id: string): Promise<SessionTreeEntry | undefined>;
+    appendEntry(entry: SessionTreeEntry, opts?: SessionWriteOptions): Promise<void>;
+    /** 落成的一笔记进窗口,叶子前进到这一笔之后的叶子。 */
+    private record;
+    /** 叶子移动本身是一条落库的 `leaf` 条目,父 = 当前叶子(引擎存储的同一形:目标不在窗口里 ⇒ `not_found`,id 由引擎的铸法给)。 */
+    setLeafId(leafId: string | null, opts?: SessionWriteOptions): Promise<void>;
+}
+//# sourceMappingURL=windowed-session-storage.d.ts.map

package/dist/stores-sql/windowed-session-storage.js

@@ -0,0 +1,61 @@
+import { InMemorySessionStorage, SessionError, leafIdAfterEntry } from "@sema-agent/core";
+export class WindowedSessionStorage {
+    view;
+    leaf;
+    constructor(metadata, entries, statedLeafId, floorEntryId) {
+        this.view = new InMemorySessionStorage({ metadata, entries, floorEntryId });
+        if (statedLeafId !== null && !entries.some((e) => e.id === statedLeafId)) {
+            throw new SessionError("corrupt_session", `Entry ${statedLeafId} not found — the log's leaf names an entry the log does not hold`);
+        }
+        this.leaf = statedLeafId;
+    }
+    getMetadata() {
+        return this.view.getMetadata();
+    }
+    async getLeafId() {
+        return this.leaf;
+    }
+    createEntryId() {
+        return this.view.createEntryId();
+    }
+    findEntries(type) {
+        return this.view.findEntries(type);
+    }
+    getLabel(id) {
+        return this.view.getLabel(id);
+    }
+    getPathToRoot(leafId) {
+        return this.view.getPathToRoot(leafId);
+    }
+    getEntries() {
+        return this.view.getEntries();
+    }
+    getFloorId() {
+        return this.view.getFloorId();
+    }
+    getReplayLoss() {
+        return this.view.getReplayLoss();
+    }
+    logMarkNow() {
+        return this.view.logMarkNow();
+    }
+    async getEntry(id) {
+        return (await this.view.getEntry(id)) ?? (await this.readBelowFloor(id));
+    }
+    async appendEntry(entry, opts) {
+        await this.persist(entry, opts);
+        await this.record(entry);
+    }
+    async record(entry) {
+        await this.view.appendEntry(entry);
+        this.leaf = leafIdAfterEntry(entry);
+    }
+    async setLeafId(leafId, opts) {
+        if (leafId !== null && (await this.view.getEntry(leafId)) === undefined)
+            throw new SessionError("not_found", `Entry ${leafId} not found`);
+        const leafEntry = { type: "leaf", id: await this.view.createEntryId(), parentId: this.leaf, timestamp: new Date().toISOString(), targetId: leafId };
+        await this.persist(leafEntry, opts);
+        await this.record(leafEntry);
+    }
+}
+//# sourceMappingURL=windowed-session-storage.js.map

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "principalHeader" | "toolAxes" | "cardUrl" | "allowSkills")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -80,6 +80,12 @@ export declare function validateRequestA2a(raw: unknown): {
     ok: A2aDraft[];
     dropped: A2aInjectionDrop[];
 } | null;
+/**
+ * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.__proto__`:成员名过回显清洗,只会是读器的保留名,不带值、不带调用方写的对端名)——
+ * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},续跑重放腿的读法;新提交腿上同一形由判官表 400)。
+ * 挂不上的对端不算(整条不进,有自己的留声)。`storedToolAxes` = 续跑重放腿递的 M19 重读座。不是数组 ⇒ 空。
+ */
+export declare function requestA2aHeadersUnread(raw: unknown, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * 请求体 `a2aPeers`「这份声明能不能原样用」的回答者(与 MCP 的 `requestMcpDeclarationRefusal` 同一副骨架、同一个拒形):
  *  ① **列表**:在场却不是数组 / 超过 {@link MAX_REQUEST_A2A_PEERS} 条(撞帽机读位一组键)/ 某一条不是对象 ⇒ `400 request.field_invalid`;

package/dist/task-a2a.js

@@ -244,21 +244,18 @@ export function validateRequestA2a(raw) {
 }
 function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw === undefined || raw === null)
-        return { ok: [], dropped: [], toolAxesReread: [], headersLost: [] };
+        return { ok: [], dropped: [], toolAxesReread: [] };
     if (!Array.isArray(raw))
         return null;
     const ok = [];
     const dropped = [];
     const toolAxesReread = [];
-    const headersLost = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
         if (read.draft !== null) {
             ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
                 toolAxesReread.push({ peer: read.draft.spec.name, sentence: read.toolAxesReread });
-            if (read.headersLost !== undefined)
-                headersLost.push({ peer: read.draft.spec.name, lost: read.headersLost });
         }
         else
             dropped.push({ peer: declaredName(e).slice(0, 128), ...read.because });
@@ -266,7 +263,20 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw.length > MAX_REQUEST_A2A_PEERS) {
         dropped.push({ peer: `(+${raw.length - MAX_REQUEST_A2A_PEERS} over cap of ${MAX_REQUEST_A2A_PEERS})`, ...declarationOverCapFacts(A2A_SEAT, raw.length) });
     }
-    return { ok, dropped, toolAxesReread, headersLost };
+    return { ok, dropped, toolAxesReread };
+}
+export function requestA2aHeadersUnread(raw, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
+        const at = `${A2A_SEAT.list}[${i}]`;
+        const read = normalizeA2aPeer(e, "resume", at, storedToolAxes);
+        if (read.draft !== null)
+            for (const member of read.headersLost ?? [])
+                out.push(`${at}.${member}`);
+    }
+    return out;
 }
 function requestA2aPeerRefusal(entry, at) {
     const snapshot = snapshotPeer(entry, false);
@@ -323,15 +333,6 @@ export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger
             note: "this replayed request was stored before the upgrade and the peer's toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade reader reads it (members that do not fit are dropped) and the peer stays mounted — once the window closes the same request leaves this peer unmounted",
         });
     }
-    for (const h of v.headersLost) {
-        if (baselineNames.has(h.peer))
-            continue;
-        logger?.warn("a2a_peer_headers_members_dropped", {
-            peer: h.peer,
-            lost: h.lost,
-            note: "this replayed request carries a headers member named \"__proto__\" for this peer (the engine refuses that name); the peer stays mounted with every other header as written, the named member left out. A new submission with the same peer leaves it unmounted",
-        });
-    }
     return merged;
 }
 //# sourceMappingURL=task-a2a.js.map

package/dist/task-cwd.d.ts

@@ -32,9 +32,9 @@ export declare function dirCoversPath(dir: string, target: string): boolean;
  *      刻意的单写者惯用法,不是疏漏:在消费端补第二道闸 = 把一条不变量拆给两个属主(同族消费者
  *      {@link effectiveHostWorkspace} 形状完全相同)。机器背书 = test/task-cwd.test.ts 的 [ref] 两格。
  *   2. 🔴 **前瞻/防御臂,本仓当前装配下零命中**([ref],2026-08-19 合并重扫 partial,存活断言):
- *      in-process 单用户 lane(部署形表行 `inProcessSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
- *      服务一个真部署形,其实到不了 —— 该 lane 的 `remoteExec` 未设 ⇒ boot/execution-env.ts 六条工厂臂全
- *      不命中 ⇒ core 落 `StubExecutionEnv` ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
+ *      无手(`none`)单用户 lane(部署形表行 `noHandsSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
+ *      服务一个真部署形,其实到不了 —— 该 lane 声明没有执行环境 ⇒ boot/execution-env.ts 的工厂臂全
+ *      不命中、执行环境座也不给 ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
  *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleOffers` ⇒ 本函数在规则车道上根本不被调用;同 lane
  *      第 1 臂也因写侧闸只在 `callerCwd` 下开而恒空。危害口径按 refuter **降级**:死枝 ≡ 落第 3 臂
  *      `undefined` ≡ core global 缺省 ≡ [ref] 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
@@ -102,4 +102,12 @@ export declare function effectiveHostWorkspace(sessionCwd: string | undefined, c
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/**
+ * run 外回退口问「host 工厂这一次会落在一只**实在的**目录上吗」:根 = {@link effectiveHostWorkspace}(引擎 run 外环境请求的上下文归约成 `{}` ⇒ 就是登记的 cwd),
+ * 且它此刻是盘上的一只目录 ⇒ 交回它;没有根,或那只目录**不在**(`ENOENT` / `ENOTDIR`,或在但不是目录)⇒ `undefined`(调用方答 409:根不可知)。
+ * 「看不到」不是「不在」:其余 errno(`EACCES` / `ELOOP` / `EIO`)原样抛 —— 路由未分类 500 + 运维 warn,与 `memory-store-refusal.ts` 的解析故障同读法;
+ * 把它读成 409 会把一只权限 / 环路故障遮成「用户把目录移走了」。三态读法同 `project-identity.ts` 的 statFact。
+ * 只读不建:工厂对一只消失的 cwd 会 `mkdir -p` 把它建回来(那是 run 的读法),回退不许替用户把移走的目录建回来再往里写。
+ */
+export declare function presentHostWorkspaceOf(sessionCwd: string | undefined): Promise<string | undefined>;
 //# sourceMappingURL=task-cwd.d.ts.map

package/dist/task-cwd.js

@@ -1,4 +1,6 @@
 import path from "node:path";
+import { stat } from "node:fs/promises";
+import { errorCodeOf } from "./observability/err-text.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export function normalizeAbsolutePathLexically(p) {
@@ -11,7 +13,7 @@ export function dirCoversPath(dir, target) {
     return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 export function cardRuleScopeRoot(registeredCwd, config, cwd = process.cwd) {
-    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config) ? cwd() : undefined);
+    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) ? cwd() : undefined);
     return raw === undefined ? undefined : path.resolve(raw);
 }
 export function satisfiedByProcessCwd(requested, realpath, cwd = process.cwd) {
@@ -44,4 +46,18 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export async function presentHostWorkspaceOf(sessionCwd) {
+    const root = effectiveHostWorkspace(sessionCwd, {});
+    if (root === undefined)
+        return undefined;
+    try {
+        return (await stat(root)).isDirectory() ? root : undefined;
+    }
+    catch (err) {
+        const code = errorCodeOf(err);
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw err;
+        return undefined;
+    }
+}
 //# sourceMappingURL=task-cwd.js.map

package/dist/task-mcp.d.ts

@@ -121,6 +121,14 @@ type ValidatedRequestMcp = {
         value: string;
     }>;
 };
+/**
+ * 一份请求的 `mcpServers` 里,读器挂得上、transport 却有几处不交给引擎的那些坐标(`mcpServers[<下标>].transport.headers` / `….env.__proto__` 一类:只有键路径,
+ * 成员名只会是读器的保留名,不带值、不带调用方写的 server 名)—— 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 MCP 一座。
+ * 读器与挂载同一只({@link normalizeServer},契约包 `readRequestMcpTransport` 报的 `lost`);挂不上的条目(硬坏形)不算 —— 它们整条不挂、有自己的通告;
+ * 名字在 `closed`(部署占住的名字,{@link deploymentClosedMcpNames})里的条目也不算 —— 合并时输给部署(`name_reserved_by_deployment`),它的 transport 一处都不会交给引擎。
+ * `storedToolAxes` = 续跑重放腿递的 M19 重读座(同一只条目在挂载时也经它判挂不挂得上)。不是数组 ⇒ 空(整只忽略那一臂,不是本判据的事)。
+ */
+export declare function requestMcpTransportUnread(raw: unknown, closed: ReadonlySet<string>, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -181,8 +189,8 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 重放腿走读器({@link normalizeServer} / {@link classifyRequestMcp}),处置:整只不是数组 ⇒ 整只忽略 + 运维 warn `mcp_injection_ignored`;条目不是对象 / 坏硬键
  * (`name` / `transport` 硬字段 / `allowTools` / `toolAxes` / `toolFaces`)⇒ 这一条 server 整条不进 + 运维 warn `mcp_injection_dropped` + 用户面通告 `mcp.injection_dropped` 点名 `field`
  * (`toolAxes` 在一次性迁移 M19 的窗开着时先按升级前读法重读一次,过了就挂,见读器的注);超上限的尾项 ⇒ `over_cap` 点名;坏软键(`contentOrigin` / `elicitation` / `source`)
- * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段 ⇒ 只不交坏的那几处(`env` / `headers` 对 JSON 存体按 7.131.x 的判据整键交或不交,
- * 交出去的剔掉 `__proto__` 名成员),server 照挂,运维 warn `mcp_transport_members_dropped` 逐处点名 —— 续跑重放腿不静默丢声明。
+ * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫 `__proto__` 的成员、
+ * `args` / `principalHeader` 坏形)⇒ 这份请求不重放(「请求成员读不出」那一只判据,`unread-request-members.ts`,经 {@link requestMcpTransportUnread} 读这一座;续跑腿折 409)。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
 /** 一次发送从一份声明里带出的头:件头(调用方原样写的名 → 值,由对端座按原字节作答)与身份头名(引擎按主体写值)。 */

package/dist/task-mcp.js

@@ -93,22 +93,31 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
     const dropped = [];
     const badContentOrigin = [];
     const toolAxesReread = [];
-    const transportLost = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
                 toolAxesReread.push({ server: v.spec.name, sentence: v.toolAxesReread });
-            if (v.transportLost.length > 0)
-                transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread, transportLost };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
+}
+export function requestMcpTransportUnread(raw, closed, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_MCP_SERVERS).entries()) {
+        const v = normalizeServer(e, () => undefined, storedToolAxes);
+        if (v.ok && !closed.has(v.spec.name))
+            for (const issue of v.transportLost)
+                out.push(`mcpServers[${i}].${issue.path}`);
+    }
+    return out;
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -324,18 +333,6 @@ function classifyHonored(baseline, entries, config, desk, lease, logger, storedT
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
-    for (const t of v.transportLost) {
-        if (!mounted.has(t.server))
-            continue;
-        logger?.warn("mcp_transport_members_dropped", {
-            server: t.server,
-            lost: t.lost.slice(0, MAX_KEY_ECHO),
-            ...(t.lost.length > MAX_KEY_ECHO ? { lostTotal: t.lost.length } : {}),
-            note: "this replayed request carries parts of this server's transport declaration that cannot be handed to the engine — an env / headers record that is not a plain object of string values (left out whole, as the pre-upgrade server read it), " +
-                "a member named \"__proto__\" in env / headers (only that member is left out: the engine refuses the name), args that are not a list of strings, a principalHeader that is not a string; " +
-                "the server mounts with the rest. A new submission with the same entry is refused (400)",
-        });
-    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toMcpDraft), reservedNames, desk, lease),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],

package/dist/task-settings.d.ts

@@ -309,6 +309,8 @@ export interface SettingsEnvCredentialIssue {
 export interface SettingsEnvLayer {
     readonly sent: boolean;
     readonly reaching: Readonly<Record<string, string>> | undefined;
+    /** 送来的值里有读者不交出去的东西({@link settingsEnvUnreadable}:不是对象 / 过帽 / 有成员读不出;空记录不算)—— 解析层据它报 `deferred: ["env"]`。 */
+    readonly unreadable: boolean;
 }
 /** `settings.env` 的**唯一**读法:`settings` 不是对象 ⇒ 没送;否则 `env` 只取一次,形判与收取都对这一次的值做。判据、解析层与续跑腿的剥键都吃这一份。 */
 export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
@@ -358,11 +360,11 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *
  *  🔴 `readDenyPatterns` / `writeProtectedExtra` / `complianceAdditionalDenies` 与 `permissions.neverAuto`([ref])= **「只收紧」座位族**:消费点 = `tighten-only-seats.ts`
  *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
- *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
+ *  (sdk 的 `SemaSettings` 已声明这四个键 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 逐键咬 server 与 sdk 两面一致)。
  *
  *  🔴 `approvalFrameFamilies`([ref])= 这条 run 的客户端**声明**渲染得了哪些审批开卡帧族 —— 不进引擎,不是 CC settings 键。消费点 = 三条执行腿的审批装配
  *  (`tool-approval.ts` 的唯一读者 `declaredApprovalFrameFamilies` → `resolveApprovalLeg`),判官 `approvalFrameFamiliesIssue`(fresh 受理 400 与宽容读者同一只)。
- *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面待声明(对账门的「server 先于 sdk」登记表记着)。
+ *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面已声明(同一只对账门咬)。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
@@ -416,11 +418,14 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 一只匹配组 / 一个条目上**读者不携带**的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);全部携带 ⇒ `null`。
  *
  * 词表 = **读者自己的答案**:`config` 是同一份 `raw` 经 {@link parseHooksConfig} 受理的产物,一只组 / 一个条目受理的键 = 可跑形在同一坐标上那只对象的键
- * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin` / `args`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理;
+ * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理
+ * (契约包 19.0.0 承运 command 的 `args` / `onFailure` 与 http 的 `onFailure`、20.0.0 承运 command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、
+ * prompt 的 `continueOnBlock` 时,这里一行未改就受理了它们 —— 受理 = 读者携带;后四键本服务如实带、不执行,能力位与契约附录明写);
  * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksCoordinate}(契约包出门形 + 回显口径;凭据形键段不原样回显)。
  *
  * 判据边界(与另两个实例同):只判**键名**(值形归读者);拒只在 FRESH 提交面 —— 续跑重放走 {@link parseTaskSettings},读者照旧剥掉它不携带的键,存量体按受理时的读法重放(4xx 打在重放腿上会砖死停驻任务)。
- * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— 守卫条目上的 `onFailure: "block"` 被剥掉,守卫起不来时照放行;`plugin` / `args` 写在 http 条目上被剥掉,写的人以为插件上下文在。
+ * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— `plugin` 写在 http 条目上被剥掉,写的人以为插件上下文在;`args` 写在 http 条目上被剥掉,写的人以为不过 shell;
+ * `onFailure: "block"` 写在 prompt 条目上被剥掉(契约只在 command / http 上承运),写的人以为守卫起不来时失效关闭。
  */
 export declare function hooksKeyIssue(raw: unknown, config: RunnableHooksConfig): KeyClosureIssue | null;
 /**

package/dist/task-settings.js

@@ -78,6 +78,17 @@ export const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16_384;
 export const MAX_SETTINGS_ENV_VARS = 256;
 export const MAX_SETTINGS_ENV_VALUE_CHARS = 32_768;
 export const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+function settingsEnvMemberReadable(k, val) {
+    return k.length > 0 && k.length <= MAX_SETTINGS_ENV_KEY_CHARS && typeof val === "string" && val.length <= MAX_SETTINGS_ENV_VALUE_CHARS;
+}
+function settingsEnvUnreadable(v) {
+    if (v === undefined || v === null)
+        return false;
+    if (typeof v !== "object" || Array.isArray(v))
+        return true;
+    const entries = Object.entries(v);
+    return entries.length > MAX_SETTINGS_ENV_VARS || entries.some(([k, val]) => !settingsEnvMemberReadable(k, val));
+}
 function cleanEnvMap(v) {
     if (v === null || typeof v !== "object" || Array.isArray(v))
         return undefined;
@@ -88,7 +99,7 @@ function cleanEnvMap(v) {
         if (n >= MAX_SETTINGS_ENV_VARS || seen >= MAX_SETTINGS_ENV_VARS * 8)
             break;
         seen++;
-        if (typeof k === "string" && k.length > 0 && k.length <= MAX_SETTINGS_ENV_KEY_CHARS && typeof val === "string" && val.length <= MAX_SETTINGS_ENV_VALUE_CHARS) {
+        if (settingsEnvMemberReadable(k, val)) {
             out[k] = val;
             n++;
         }
@@ -98,9 +109,9 @@ function cleanEnvMap(v) {
 export const SETTINGS_ENV_CREDENTIAL_MATCHES = ["name", "value_shape"];
 export function readSettingsEnv(settings) {
     if (settings === null || typeof settings !== "object" || Array.isArray(settings))
-        return { sent: false, reaching: undefined };
+        return { sent: false, reaching: undefined, unreadable: false };
     const env = settings.env;
-    return { sent: env !== undefined && env !== null, reaching: cleanEnvMap(env) };
+    return { sent: env !== undefined && env !== null, reaching: cleanEnvMap(env), unreadable: settingsEnvUnreadable(env) };
 }
 const MAX_CREDENTIAL_KEYS_NAMED = 8;
 const MATCH_PHRASE = { name: "a credential variable of this engine", value_shape: "a value shaped like a secret" };
@@ -131,7 +142,7 @@ export function settingsEnvCredentialIssue(reaching, credentialNames) {
 }
 export function withoutKeys(layer, keys) {
     const drop = new Set(keys);
-    return { sent: layer.sent, reaching: Object.fromEntries(Object.entries(layer.reaching ?? {}).filter(([k]) => !drop.has(k))) };
+    return { sent: layer.sent, reaching: Object.fromEntries(Object.entries(layer.reaching ?? {}).filter(([k]) => !drop.has(k))), unreadable: layer.unreadable };
 }
 export const SETTINGS_PERMISSION_BUCKETS = ["allow", "deny", "ask"];
 export const SETTINGS_PERMISSION_BUCKET_REFUSALS = ["over_cap", "bad_entry"];
@@ -309,7 +320,7 @@ export function parseTaskSettings(raw, seats = {}) {
     }
     const envLayer = seats.settingsEnv ?? readSettingsEnv(s);
     const shellEnv = envLayer.reaching;
-    if (envLayer.sent && shellEnv === undefined)
+    if (envLayer.unreadable)
         deferred.push("env");
     const out = {};
     const perms = s.permissions;
@@ -447,7 +458,7 @@ export function rulePolicyBucketsRefusal(permissions, bases) {
             if (names.length === 0)
                 continue;
             const declared = declaredFor(root);
-            const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(declared !== undefined ? { pathBases: declared } : {}) });
+            const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, noticeSeat: "engine", ...(declared !== undefined ? { pathBases: declared } : {}) });
             if (judged === undefined)
                 continue;
             first ??= { bucket, message: judged.message };

package/dist/tool-approval.d.ts

@@ -145,6 +145,9 @@ export interface ParkedAskRedeemRequest {
     decider: ApprovalDecider;
     /** [ref] ctrl+g 编辑放行的实参整体替换(approve 才有意义)。 */
     updatedInput?: unknown;
+    /** 卡上点的是 `allow_session` ⇒ `"session"`:与 `/decide` 体上的 `remember:"session"` 是**同一只**「本会话放行」请求,交同一个铸点
+     *  (续跑腿 `resumeCheckpoint`;可记与否从同一条停驻行判、落同一只豁免店、只在结清之后落)。缺席 = 只放行这一次的那两个词。 */
+    remember?: "session";
     /** 发起本次 respond 的**已验证**调用方(live 腿 `gatedPrincipal` 的那一把)。席在赎回之前拿它与
      *  **checkpoint 当下的 scope** 对一次(codex R1-[high] 一:收编改写身份之后,任何缓存的属主判据都
      *  过期;门必须贴在当下的持久事实上)。 */
@@ -153,11 +156,15 @@ export interface ParkedAskRedeemRequest {
      *  缺席 ⇒ 那条腿按「无请求」形处置(它自己的成文语义,本席不替它决定)。 */
     httpReq?: IncomingMessage;
 }
-/** [ref]:赎回席(装配层注入;缺席 ⇒ PARKED 臂逐字回落修前 404)。回的是赎回腿的原始 HTTP 结果面。 */
-export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
+/** [ref]:赎回席的结局 = 赎回腿的原始 HTTP 结果面 + 请求带了 `remember` 时铸点的真答(`rememberApplied`:落没落;不进 `body` —— 首次受理的回执挂它,
+ *  受理回执(幂等回放的那一份)不存它)。 */
+export interface ParkedAskRedeemResult {
     status: number;
     body: Record<string, unknown>;
-}>;
+    rememberApplied?: boolean;
+}
+/** [ref]:赎回席(装配层注入;缺席 ⇒ PARKED 臂逐字回落修前 404)。 */
+export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<ParkedAskRedeemResult>;
 /**
  * 一张门被引擎**重开**过的停驻卡([ref]):决过之后,续跑腿在被批准的动作开跑之前失败,引擎把同一张门(同一把 token)翻回待决。
  * `reason` = core 记在行上的重开因由词原样(闭集 `REOPEN_REASONS`:`env_failed` 同一个决议经耐久回决口(`decidePath`)再交一次即可续跑 —— 本副本还留着首次受理回执时(缺省 1 小时内、未被容量帽逐出)应答口回放那张回执、不驱续跑;`tool_unavailable` / `constraint_rejected` 要重新决;`config_refused` 改好部署配置后再交原决议,或重新决);
@@ -1291,8 +1298,9 @@ export declare function approvalPreambleReplays(input: Omit<ApprovalLegInput, "n
 /** 一条 **DECIDED 行**能交还给引擎的全部形(`AskOutcome` 减掉 park 路由那一臂 —— 一条有决议的行
  *  从定义上不是「投递面拿走了它」)。{@link ToolApprovalCoordinator.notifyExternalDecision} 收的就是它。 */
 export type DecidedAskOutcome = Exclude<AskOutcome, "unavailable">;
-/** 铸点的入参形 = 行上与**这条决议本身**有关的三格。整行(`AskRow`)与 claim 败方读数都满足。 */
-type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia"> & {
+/** 铸点的入参形 = 行上与**这条决议本身**有关的四格。整行(`AskRow`)与 claim 败方读数都满足。
+ *  `decisionNote` 与 `settledBy` / `decidedVia` 同律**必填**(可空)—— 可选会让一个漏挑这一列的投影静默编译过,而漏挑的后果正是把带说明的拒交成裸拒。 */
+type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia" | "decisionNote"> & {
     updatedInput?: unknown;
 };
 /**
@@ -1303,12 +1311,17 @@ type DecidedRowFacts = Pick<AskRow, "decision" | "settledBy" | "decidedVia"> & {
  * 重放 / 兄弟广播 / 歧义提交恢复三条路上全都退化成裸 `false`,而裸 `false` 在 core 那边逐字是
  * 「**一个人**拒绝了」。手抄投影全面下线([ref]):消费点交行,形由这里铸。
  *
- * 三条读法,每条的属主注在别处,这里只落笔:
+ * 四条读法,每条的属主注在别处,这里只落笔:
  *  · **方向** —— `decision !== "approve"` 即拒(列的二值由店的 CAS 保证);
  *  · **编辑载荷**([ref])—— `updatedInput` 键缺席 = 没带编辑 ⇒ 裸 `true`;在场(**含 `null`**)= 编辑的
  *    字面值 ⇒ 对象臂(语义三态的唯一属主 = `AskRow.updatedInput` 顶注);
  *  · **结算来源**([ref])—— 行上非 null 即宿主自报的那个词(`null` = 人决,与「不铸这个键」同义;
- *    语义属主 = `AskRow.settledBy` 顶注)。
+ *    语义属主 = `AskRow.settledBy` 顶注);
+ *  · **拒因**([ref] 的行派生半场)—— 拒行上**非空**的 `decisionNote` 铸成 `reason`(与应答口 `shapeDeny` 同键同形:core 以带说明的人拒句
+ *    把它交给模型,围栏 `delimitUntrusted` 与长度上限 `REVIEWER_NOTE_MAX_BODY` 全在 core,本仓只透传不预判;空串按 core 契约的缺席读,不铸只装了
+ *    空值的对象臂)。**allow 行的说明恒不铸**:core 对 allow 行的 `reason` 恒销毁,说明只走审计面(行的 `decisionNote` 列)。
+ *    此前这一格不在铸点里 ⇒ 耐久决断口 / 重放 / 兄弟广播 / claim 败方 / 歧义提交恢复 / 悬挂轮询六条行派生的路,都把带说明的拒交成裸 `false`
+ *    (core 读作「一个人拒了、没说怎么办」:STOP 句 + 本轮收住),而同一段说明经应答口到达却带着 `reason` 进模型 —— 一扇门两种去向。
  *
  * 🔴 [ref]:来源位**两向都读**。决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny 上都会落列(引擎 7.39.0 起铸
  * `policy_allowed`),所以 approve 行带来源位是一条合法的行,它的每条读回路径交还 `{allow:true, settledBy:"policy", updatedInput?}`
@@ -1421,7 +1434,7 @@ export declare class ToolApprovalCoordinator {
      *  ask 的 `sessionId` 咨询一次——「这次授权是在**哪里**点的」在授权发生时捕获,不在回决时再猜。
      *  回 `undefined` = 该部署形上 run 的 workspace root 不可知(远程沙箱/多租户等)⇒ 不铸 scope,落
      *  core 的 global 缺省(= 现行为,恒不更宽;也绝不错铸一个坐标系不对的 root)。装配见 main.ts:
-     *  registry cwd(host lane 显式注册的 launch dir)?? in-process 单用户形的 `process.cwd()`。 */
+     *  registry cwd(host lane 显式注册的 launch dir)?? 无手(`none`)单用户形的 `process.cwd()`。 */
     private readonly ruleScopeRootFor;
     /** [ref]:停驻行迟到决议的受理回执表(键 = 行的键 `askId`,插入序 = 逐出序)。语义与有界理由见
      *  {@link ParkRedemption} 顶注。 */

package/dist/tool-approval.js

@@ -512,7 +512,8 @@ export function outcomeOfDecidedRow(row) {
     const allow = row.decision === "approve";
     const source = row.settledBy !== null ? { settledBy: row.settledBy, ...(row.decidedVia !== null ? { decidedVia: row.decidedVia } : {}) } : {};
     const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
-    return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
+    const denyReason = !allow && row.decisionNote ? { reason: row.decisionNote } : {};
+    return row.settledBy === null && !("updatedInput" in edit) && !("reason" in denyReason) ? allow : { allow, ...edit, ...denyReason, ...source };
 }
 function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
@@ -521,6 +522,7 @@ function settleArgsOfDecided(outcome) {
         allowed: outcome.allow,
         ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
         ...(outcome.settledBy !== undefined ? { source: { settledBy: outcome.settledBy, ...(outcome.decidedVia !== undefined ? { decidedVia: outcome.decidedVia } : {}) } } : {}),
+        ...(!outcome.allow && outcome.reason !== undefined ? { denyReason: outcome.reason } : {}),
     };
 }
 function verdictOfDecided(args) {
@@ -529,6 +531,7 @@ function verdictOfDecided(args) {
         allowed: args.allowed,
         ...(args.updatedInput !== undefined ? { updatedInput: args.updatedInput } : {}),
         ...(args.source !== undefined ? { hostSource: args.source } : {}),
+        ...(args.denyReason !== undefined ? { denyReason: args.denyReason } : {}),
     };
 }
 function settleArgsOf(outcome) {
@@ -2478,7 +2481,6 @@ export class ToolApprovalCoordinator {
                 askId: row.askId,
                 idempotent: true,
                 ...decided,
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
                 ...noteRecordedReceipt(parsed.note, noteLandedOnRow(parsed.note, row.decisionNote)),
                 ...this.lateRuleRefusal(parsed),
             },
@@ -2519,6 +2521,7 @@ export class ToolApprovalCoordinator {
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
                     decider: parsed.decider,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
+                    ...(parsed.value === "allow_session" ? { remember: "session" } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
                 });
@@ -2555,7 +2558,7 @@ export class ToolApprovalCoordinator {
                 approvalId: id,
                 askId: row.askId,
                 accepted: "parked_redeemed",
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
+                ...(parsed.value === "allow_session" ? { rememberApplied: out.rememberApplied === true } : {}),
                 ...(rule?.body ?? {}),
             },
         };
@@ -2667,7 +2670,6 @@ export class ToolApprovalCoordinator {
                 accepted: "parked_redeemed",
                 idempotent: true,
                 decision: receipt.decision === "approve" ? "allow" : "deny",
-                ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
                 ...(rule ?? {}),
             },
         };
@@ -2840,14 +2842,16 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(judgedOwner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider) };
+        const settleArgs = opts?.settleOutcome !== undefined
+            ? settleArgsOfDecided(opts.settleOutcome)
+            : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider), ...(!allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle({
             by: "human",
             allowed: settleArgs.allowed,
             updatedInput: settleArgs.updatedInput,
             ...(settleArgs.source !== undefined ? { hostSource: settleArgs.source } : {}),
-            ...(!settleArgs.allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}),
+            ...(settleArgs.denyReason !== undefined ? { denyReason: settleArgs.denyReason } : {}),
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         });
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;