@sema-agent/server 7.146.0 → 7.147.0

package/dist/capabilities/center-plugins.js

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { promises as fsp, realpathSync, existsSync, readFileSync, lstatSync, statSync } from "node:fs";
 import { join, resolve, isAbsolute, sep } from "node:path";
+import { ensureDir } from "@sema-agent/core";
 import { assertConfined, loadSkills } from "./skills.js";
 import { buildDisplaySafeUrl, redactSecrets } from "../trace/redact.js";
 import { gitSubprocessEnv } from "../server-secret-env.js";
@@ -132,6 +133,9 @@ export function materializablePlugins(eff, allowHosts) {
         return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
     });
 }
+export function pluginCacheRootFor(dataRoot) {
+    return join(dataRoot, "plugin-cache");
+}
 export async function applyCenterPlugins(baseline, eff, opts) {
     const shape = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
@@ -165,12 +169,12 @@ export async function applyCenterPlugins(baseline, eff, opts) {
         let materialized = false;
         try {
             await fsp.rm(staging, { recursive: true, force: true });
-            await fsp.mkdir(staging, { recursive: true });
+            ensureDir(staging);
             const plan = gitClonePlan({ url: v.url, dest: staging, sha: v.sha });
             for (const step of plan.steps)
                 await runGit(step);
             await fsp.rm(liveDir, { recursive: true, force: true });
-            await fsp.mkdir(join(opts.cacheRoot, v.name), { recursive: true });
+            ensureDir(join(opts.cacheRoot, v.name));
             await fsp.rename(staging, liveDir);
             materialized = true;
         }

package/dist/capabilities/composite-members.d.ts

@@ -47,6 +47,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"];
     readonly settings: readonly ["permissions"];
+    readonly settingsContract: readonly ["version", "hookEntryFields"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];

package/dist/capabilities/composite-members.js

@@ -8,6 +8,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"],
     settings: ["permissions"],
+    settingsContract: ["version", "hookEntryFields"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],

package/dist/capabilities/execution-lane.d.ts

@@ -1,6 +1,6 @@
-import { type ExecutionLane, type RemoteExecProvider } from "../execution-lane-caps.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 export interface ExecutionLaneCapability {
-    /** 本部署的执行车道词(闭集 = {@link ExecutionLane} 八词;`REMOTE_EXEC` 未设 ⇒ `"in-process"`,见头注 [ref] 段)。 */
+    /** 本部署的执行车道词(闭集 = {@link ExecutionLane} 八词;合成之后恒是部署声明的那一条;无手 = 声明的 `"none"`,见头注)。 */
     readonly provider: ExecutionLane;
     /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
      *  属主 = 部署形表行 `toolsOnThisHost`,与 `skills[].baseDir` 的铸点同一行。 */
@@ -11,13 +11,13 @@ export interface ExecutionLaneCapability {
 }
 /**
  * 部署席 → 消费端窄投影。形照 `projectWebSearchCapability` / `projectSqlEngineCapability`:
- * 不碰 config.ts(只从车道表模块取词与归一读口,那是叶),于是本模块是叶。
+ * 不碰 config.ts(只从车道表模块取能力位,那是叶),于是本模块是叶。
  *
- * 🔴 本处**不写**任何缺席折词([ref] 门 D):缺席归一只在 {@link executionLaneOf} 一处。
+ * 🔴 本处**不写**任何缺席折词([ref] 门 D):入参是已合成的配置,车道必在(没有声明的部署在合成步拒启)。
  */
 export declare function projectExecutionLaneCapability(config: {
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
-    } | undefined;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
+    };
 }): ExecutionLaneCapability;
 //# sourceMappingURL=execution-lane.d.ts.map

package/dist/capabilities/execution-lane.js

@@ -1,7 +1,7 @@
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 export function projectExecutionLaneCapability(config) {
-    const lane = executionLaneOf(config.remoteExec?.provider);
+    const lane = config.remoteExec.provider;
     const handsWired = laneWiresExecutionEnv(lane);
     return {
         provider: lane,

package/dist/capabilities/hands-lane.d.ts

@@ -42,7 +42,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
 /**
  * 一个场景在一台部署上起的 run **有没有工作区** —— core prepare 的 `handsEnabled`(`ownedEnv || deps.executionEnv`)在本仓的镜像,**唯一一只判官**。
  * 两个条件缺一不可:场景挂手({@link pickHandsRunner} 选有手 Runner,即带 `executionEnvFactory` 的那只)∧ 这台部署的执行车道有手
- * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`in-process` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
+ * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`none` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
  * (`config.user_attachment_invalid`「this run has no workspace」)与场景详情读面的 `attachmentSupplies` 都落在这一只的答案上。
  * **穷举 switch**:`ScenarioHands` 加词而此处不表态 = 编译红(与 {@link pickHandsRunner} 同一条纪律)。
  */

package/dist/capabilities/scenarios.d.ts

@@ -73,10 +73,9 @@ export declare function buildExcludeToolsSeat(scenarioExcludes: readonly string[
  */
 export interface ScenarioContext {
     /**
-     * 本请求的会话 id。属主 = `boot/resolve-spec.ts` 的 `auth.sessionId`(authorizer 解析 + 归属校验
-     * 过的那一只),**绝不是 `body.sessionId`** —— 后者是调用方自报串,拿它当会话级设施的分区键
-     * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「sessionId comes from `auth`, NEVER the
-     * body」的逐字纪律)。
+     * 本请求的会话 id。属主 = `boot/resolve-spec.ts` 的 `root`(= `opts.execution.root`:authorizer 解析 + 归属校验
+     * 过的那一只,续跑 = checkpoint 的会话),**绝不是 `body.sessionId`** —— 后者是调用方自报串,拿它当会话级设施的分区键
+     * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「根来自执行上下文,绝不来自请求体」的逐字纪律)。
      *
      * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对不交座的行、boot 期那一次 Agent 工具探针、
      * `builtinScenarioDetails` 的工具名探针)。此时会话级设施退化为 per-call 实例 —— 不为它发明
@@ -105,7 +104,7 @@ export interface ScenarioDeps {
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
     /**
-     * [ref]:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
+     * [ref]:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;声明 `REMOTE_EXEC=none` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
      * 「这个场景的 run 有没有工作区」({@link runHasWorkspace}),进而给出附件可受理供给集。**缺席按没有手读**(宁少说不多说:不广告一个会撞 400 的 `path`)。
      */
     handsLane?: boolean;
@@ -350,6 +349,16 @@ export interface ScenarioRuling {
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */
     allowlist: string[];
 }
+/**
+ * 一次中心裁定读数(`principalCaps.scenarioRuling` / `peekScenarioRuling` 的答)—— **三态,各恰一条出路**({@link gateScenarioRequest} 逐态判):
+ *  · {@link ScenarioRuling} —— 中心答了治理两键 ⇒ 按它执法(指派为缺省、白名单限点名);
+ *  · `undefined`(**缺席**)—— 这一问没有中心可问,或中心答了但不管场景:部署没接中心(无中心 / 干跑 / `run-local` / 嵌入方不给)、
+ *    匿名运行(无 principal,零中心往返)、旧中心不发治理两键 ⇒ 无治理,请求名或部署缺省;
+ *  · `"unavailable"`(**故障**)—— 部署接了中心、请求带 principal,而这一问答不出来:不可达 / 超时 / 答复读不出(非 2xx、体判坏、
+ *    回声不符、在飞期间凭据身份换了)/ 治理两键形不对 ⇒ 该 run 拒。这位主体此刻的指派与白名单不可知:缺省链可能比他的指派更宽,点名也判不了白名单。
+ * 缺席与故障的界画在「有没有中心可问」:读数的客户端只在部署接了中心时存在,没接中心的部署走不到故障态。
+ */
+export type ScenarioRulingRead = ScenarioRuling | "unavailable" | undefined;
 /**
  * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
  *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
@@ -373,17 +382,21 @@ export declare function danglingScenarioRefusal(name: string, source: ScenarioNa
 /**
  * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
  * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
+ * 读数 `ruling` 三态各一条出路({@link ScenarioRulingRead}),判序:
+ *
+ *   1. body.scenario 显式给出而不在册 ⇒ typed 400 `scenario_unknown`(调用方的错;词表面先于治理面,不等中心)。
+ *   2. 读数 `"unavailable"`(中心配了却答不出)⇒ 503 `state.scenario_assignment_unavailable`(体 `permanence: "transient"`:这一拍答不出,
+ *      不是准入策略 —— 续跑腿据它不折成 409 `resume_blocked_by_policy`,见 `http/checkpoint-ctx.ts` 的 `resumeAssemblyRefusalAnswer`),点名与不点名同拒 ——
+ *      这位主体的指派与白名单此刻不可知,缺省链不能替他答,点名也判不了白名单。运维日志一行 `scenario_assignment_unavailable`(`principal`;
+ *      取数失败本身由主体客户端的 `onError` 另记一行)。
+ *   3. body.scenario 显式给出(在册):白名单非空且集外 ⇒ typed 400 `scenario_not_allowed`(附 allowlist —— 机器码归 wire、人话归壳 / web);
+ *      集内,或白名单为空(缺席 / 中心答了「无指派」)⇒ 用户主动切换赢。
+ *   4. body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者(缺席 / `scenario: null`)⇒ defaultScenario。链上的名字不在册 ⇒ 503
+ *      `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default({@link danglingScenarioRefusal})。
  *
- *   - body.scenario 显式给出:不在册 ⇒ typed 400 `scenario_unknown`(调用方的错);allowlist 非空且集外 ⇒ typed 拒绝
- *     (400 `scenario_not_allowed`,附 allowlist ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空
- *     (无 ruling / 该 principal 三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
- *     不收紧,恒不比没有治理时更宽;caps 故障不把用户锁死在 default——场景切换不是权限放大面,fail-open
- *     到现状,与 workflows 面的 fail-closed 是刻意的 posture 差异,见 runtime-caps-resolver)。
- *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。链上的名字不在册 ⇒ 503
- *     `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default
- *     ({@link danglingScenarioRefusal})。`principal` 只进那一行运维日志,不参与判定。
+ * `principal` 只进运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
+export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
 /**
  * 一条请求的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
  *
@@ -395,7 +408,8 @@ export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined,
  *
  * 契约:`(principal, requested) => 在册的场景名`(返回值一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
  * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。
- * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 无 ruling,门退回「请求名或部署缺省」那条现状链。
+ * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 读数恒缺席,门走「请求名或部署缺省」那条链;
+ * 在场 ⇒ 它的读数三态({@link ScenarioRulingRead})原样交门,故障态由门拒。
  */
 export interface ScenarioGateSources {
     readonly config: {
@@ -404,8 +418,8 @@ export interface ScenarioGateSources {
     /** 场景表(活引用):词表按调用时的自有键取,与表同生同灭。 */
     readonly scenarios: Readonly<Record<string, unknown>>;
     readonly principalCaps: {
-        scenarioRuling(principal: string | undefined): Promise<ScenarioRuling | undefined>;
-        peekScenarioRuling(principal: string | undefined): Promise<ScenarioRuling | undefined>;
+        scenarioRuling(principal: string | undefined): Promise<ScenarioRulingRead>;
+        peekScenarioRuling(principal: string | undefined): Promise<ScenarioRulingRead>;
     } | undefined;
     readonly logger?: Logger;
 }
@@ -413,7 +427,7 @@ export type ScenarioGate = (principal: string | undefined, requested: unknown) =
 /**
  * 门问中心裁定走哪条腿(闭集;新增一词 ⇒ 下面的穷尽 `switch` 编译红)—— 与 `resolveRuntimeCaps` / `peekRuntimeCaps` 是同一对:
  *  · `enforce` —— 任务提交腿:中心裁定走执法腿,center 硬失败铸下的 fail-closed 降级项两腿都认;
- *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份 fail-open 判决,但硬失败铸的降级项只对读面自己算数,
+ *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
  *    不替这个主体的真提交留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面不许成为别人被拒的原因)。
  */
 export type ScenarioGateLeg = "enforce" | "peek";

package/dist/capabilities/scenarios.js

@@ -285,6 +285,7 @@ export function buildRunSkills(args, logger) {
         logger?.warn("user_skills_dropped", { reason: "name reserved by scenario (or duplicate)", names: dropped });
     return { specs, roster };
 }
+const SCENARIO_ASSIGNMENT_UNAVAILABLE_REFUSAL = "this principal's scenario assignment could not be read — the configuration center did not answer (unreachable, timed out, or an unreadable reply), so no scenario was assigned and nothing ran — retry once the center answers again (the operator restores the link from this deployment to its configuration center)";
 function registeredScenariosClause(known) {
     return `this deployment's scenarios are: ${known.join(", ")}`;
 }
@@ -303,22 +304,25 @@ export function danglingScenarioRefusal(name, source, known) {
     }
 }
 export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known, logger, principal) {
+    if (typeof bodyScenario === "string" && !known.includes(bodyScenario)) {
+        throw new HttpError(400, `unknown scenario "${bodyScenario}" — ${registeredScenariosClause(known)}`, {
+            code: "scenario_unknown",
+            extra: { known: [...known] },
+        });
+    }
+    if (ruling === "unavailable") {
+        logger?.warn("scenario_assignment_unavailable", principal !== undefined ? { principal } : {});
+        throw createCodedHttpError(503, "state.scenario_assignment_unavailable", SCENARIO_ASSIGNMENT_UNAVAILABLE_REFUSAL, { permanence: "transient" });
+    }
     if (typeof bodyScenario === "string") {
-        const requested = bodyScenario;
-        if (!known.includes(requested)) {
-            throw new HttpError(400, `unknown scenario "${bodyScenario}" — ${registeredScenariosClause(known)}`, {
-                code: "scenario_unknown",
-                extra: { known: [...known] },
-            });
-        }
         const allowed = ruling?.allowlist ?? [];
-        if (allowed.length > 0 && !allowed.includes(requested)) {
+        if (allowed.length > 0 && !allowed.includes(bodyScenario)) {
             throw new HttpError(400, `scenario "${bodyScenario}" is not in this principal's assigned allowlist`, {
                 code: "scenario_not_allowed",
                 extra: { allowlist: allowed },
             });
         }
-        return requested;
+        return bodyScenario;
     }
     const [name, source] = ruling?.scenario != null ? [ruling.scenario, "ruling"] : [defaultScenario, "deployment"];
     const refusal = danglingScenarioRefusal(name, source, known);

package/dist/capabilities/settings-contract.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `GET /v1/capabilities` 的 `settingsContract` 位 —— **本服务内嵌的设置契约是哪一版、它的读者对每一型 hook 条目携带哪些字段**(版本位:恒在场,不随部署形变)。
+ *
+ * ## 病
+ * 一个键会不会被本服务的读者当契约外键剥掉(续跑重放腿)/ 在新提交面 400(键闭集门),今天消费方只能靠自己维护的「哪一版服务端认哪些键」代际表猜 ——
+ * 契约包一升版(例:19.0.0 起 command 条目承运 `args` / `onFailure`、http 条目承运 `onFailure`),那张表就漂。答案的真源在读者这一侧,所以由读者说。
+ *
+ * ## 形
+ * `{ version: string, hookEntryFields: { command | prompt | agent | http | mcp_tool: string[] } }`:
+ *  · `version` —— 已装 `@sema-agent/settings-schema` 的 package.json 版本号,读口唯一(`web-admin-client/center-request.ts` 的 {@link SETTINGS_SCHEMA_VERSION},对中心协商的 major 也由它派生);
+ *  · `hookEntryFields` —— 契约条目字段表按型的投影,**只投键名,不投取值类**;列序 = 契约分类器装上的条目的键序(判别位 `type` 不在列里)。
+ *    值源 = 契约包导出的字段表 {@link HOOK_ENTRY_FIELDS}(深冻结;本仓零镜像)—— 本模块不手抄、不另持。
+ * 「读者携带 ≠ 本服务执行」:本服务只跑 command / http / prompt / agent 四型(`mcp_tool` 整份拒,见 `hooks/hook-runner.ts` 的 `HOOK_ENTRY_TYPE_RUNS`),
+ * 列里也有本服务如实带、不执行的键(command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、prompt 的 `continueOnBlock`);
+ * hooks 整只是否被采纳看 `taskSettings.hooks`;本位只答「契约面上这一型有哪些字段」。
+ */
+import { type HookEntryFields, type HookEntryType } from "@sema-agent/settings-schema/hooks";
+/** 一型的契约字段名(导出字段表那一行的键;判别位 `type` 不在表里)。 */
+export type HookContractEntryField<T extends HookEntryType> = Extract<keyof HookEntryFields[T], string>;
+/** 能力位 `settingsContract` 的形。 */
+export interface SettingsContractCapability {
+    readonly version: string;
+    readonly hookEntryFields: {
+        readonly [T in HookEntryType]: readonly HookContractEntryField<T>[];
+    };
+}
+/** 能力位的值(纯数据;进程内不变,装载时投影一次)。列的顺序随导出表的型序。 */
+export declare const SETTINGS_CONTRACT_CAPABILITY: SettingsContractCapability;
+//# sourceMappingURL=settings-contract.d.ts.map

package/dist/capabilities/settings-contract.js

@@ -0,0 +1,14 @@
+import { HOOK_ENTRY_FIELDS } from "@sema-agent/settings-schema/hooks";
+import { SETTINGS_SCHEMA_VERSION } from "../web-admin-client/center-request.js";
+const columnOf = (type) => Object.keys(HOOK_ENTRY_FIELDS[type]);
+export const SETTINGS_CONTRACT_CAPABILITY = {
+    version: SETTINGS_SCHEMA_VERSION,
+    hookEntryFields: {
+        command: columnOf("command"),
+        prompt: columnOf("prompt"),
+        agent: columnOf("agent"),
+        http: columnOf("http"),
+        mcp_tool: columnOf("mcp_tool"),
+    },
+};
+//# sourceMappingURL=settings-contract.js.map

package/dist/capabilities/skills.d.ts

@@ -1,5 +1,5 @@
 import type { SkillSpec } from "@sema-agent/core";
-import type { RemoteExecProvider } from "../execution-lane-caps.js";
+import type { ExecutionLane } from "../execution-lane-caps.js";
 import { type Logger } from "../observability/logger.js";
 /**
  * Built-in skills baked into the image, loaded ONCE at startup (no per-task disk IO). A skill is a
@@ -79,13 +79,13 @@ export declare function loadSkills(dir: string, opts: LoadSkillsOptions): Loaded
  * 各写一遍 `loadSkills(config.skillsDir, { toolsShareThisFilesystem: <车道判据>(config) })`,测试只能
  * 直传布尔去证 `loadSkills`(`baked-skills.test.ts`),证不到「config → 装配腿 → baseDir」这一段;收成一只
  * 之后,联合格从 config 走到 `baseDir`(`test/capabilities-http.test.ts` [ref] 段)证的就是两处装配点本人。
- * 判据属主:部署形表行 `toolsOnThisHost`([ref];[ref] 起 in-process ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
+ * 判据属主:部署形表行 `toolsOnThisHost`([ref];无手车道 `none` ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
  */
 export declare function loadDeploymentSkills(config: {
     readonly skillsDir: string;
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
-    } | undefined;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
+    };
 }, logger?: Logger): LoadedSkill[];
 /** 一个技能范围交进 `TaskSpec` 的技能(场景工厂的 `skills`)。范围从哪来见 `scenarios.ts` 的 `BUILTIN_SCENARIO_SKILL_SCOPE`(center 场景 = 它自己的名字)。 */
 export declare function skillsForScenario(loaded: readonly LoadedSkill[], scope: string): SkillSpec[];

package/dist/capability-facts.d.ts

@@ -25,6 +25,7 @@ import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/sto
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
+import type { ResumeAnchorStore } from "./plugins/store-backend.js";
 import type { EngineHandoverDoor } from "./boot/engine-lease.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
 export declare const CAPABILITY_FACT_WHY: {
@@ -44,6 +45,11 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_policy_store_absent: "no session policy store is wired";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
     readonly file_history_store_absent: "no file-history store is wired";
+    readonly resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through)";
+    readonly execution_lane_handless: "the execution lane mounts no execution environment (REMOTE_EXEC=none), so a session has no working tree to rewind";
+    readonly workspace_rebuilt_per_task: "each task's workspace is rebuilt when the task starts on this deployment (a fresh directory, container or sandbox, or a restore from the workspace snapshot store that a rewind cannot yet take part in), so a rewind would not land in the tree the next task starts from";
+    readonly session_store_shared: "the session store is shared by several server instances (DB_BACKEND=mysql|pg) and no durable claim spans an out-of-run rewind yet, so a rewind could interleave with a run or another rewind started on another instance";
+    readonly file_history_preview_absent: "the file-history store implements no diffStats preview (the SQL backends)";
     readonly session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)";
     readonly session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)";
     readonly policy_purge_absent: "the session policy store has no deleteBySession purge verb";
@@ -81,6 +87,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
+    readonly project_registry_absent: "no project registry is served here: projects are published only by the configuration center (settings-schema does not read the projects domain from the local config.d), and no center configuration is applied (SEMA_WEB_ADMIN_URL unset, or SEMA_WEB_ADMIN_DRY_RUN on)";
     readonly workflow_engine_absent: "the workflow engine is not available on this worker";
     readonly entitlement_resolver_absent: "self-orchestration is on for a multi-tenant worker with no per-principal entitlement source";
     readonly workflow_run_store_absent: "no workflow run store is wired (SELF_ORCHESTRATION_ENABLED)";
@@ -201,6 +208,29 @@ export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessio
     historyStore: ServiceFileHistoryStore;
     blobExchange: ServiceBlobExchange;
 }>;
+type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" | "resume_anchor_store_absent" | "execution_lane_handless" | "workspace_rebuilt_per_task" | "session_store_shared";
+/**
+ * run 外的「只恢复代码」口(`POST /v1/sessions/:id/rewind-files`,[ref])这台部署**解不解得出** —— 能力位 `sessionRewindFiles` 与该口的 501 读这一只。
+ * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(引擎 `Runner.rewindFiles` 读的同一只;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、不摘店,
+ * 所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店(`to` 手柄经它翻成 entry id,`history-anchor.ts`)∧ 执行车道有手
+ * (无手车道上引擎恒拒 `rewind.files_env_unsupported`:没有工作区可回退 —— 位说有而口恒拒不许发生)∧ 即时回退的工作区活过一次执行(部署形表行 `rewindableWorkspace`;
+ * 否则恢复的结果到不了下一次执行)∧ 会话店由本进程独占(local 后端:数据根被一个活进程锁住 ⇒ 引擎的进程内会话锁就是全局互斥;
+ * SQL 后端被多副本共用,而 run 外回退还没有一只跨副本的持久认领 —— 「先查认领再交引擎」只是检查不是互斥,所以在共享店上位为假、口 501,不留「检查即放行」)。
+ * 动词本身是引擎 `Runner` 的必有成员(型上必在),不是一格。
+ * 见证 = 判过在场的三只设施;路由在拒臂之后只读见证。
+ */
+export declare function sessionRewindFiles(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy, {
+    historyStore: ServiceFileHistoryStore;
+    anchors: ResumeAnchorStore;
+    sessionStorage: HeadReadingSessionStore;
+}>;
+/**
+ * 同一口的 `dryRun` **带不带改动统计** —— 能力位 `sessionRewindFilesPreview`。= 立即回退可用 ∧ 店实现了 core 契约的可选座 `diffStats`
+ * (引擎在 `dryRun` 上读的就是这一座:缺座 ⇒ 应答 `preview: null`)。逐后端如实:core 的文件店有,SQL 双生没有(那一座要的逐文件预览判官
+ * `previewFileDelta` 不在 core 包根导出面上,本仓不另写一份 —— 等 core 导出它,SQL 店补这一座、本位随之转真,路由零改)。本位为假**不是**口不收 `dryRun`:口照收,答 `preview: null`
+ * (「这台给不出统计」≠「什么都不会变」);所以本事实没有 501 拒点,只有能力位读它。
+ */
+export declare function sessionRewindFilesPreview(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
 /** 持久审批底座(checkpoint 店)在场 —— `/v1/approvals/*` 与 `/v1/assistant/*` 整条车道、会话 wake 都站在它上面。 */
 export declare function checkpointPark(d: Pick<Deps, "checkpointStore">): Fact<"checkpoint_store_absent", {
     checkpointStore: Store<"checkpointStore">;
@@ -270,6 +300,14 @@ export declare function imagePool(d: Pick<Deps, "imageIndex">): Fact<"image_inde
 export declare function agentRoster(d: Pick<Deps, "backgroundAgentStore">): Fact<"background_agent_store_absent", {
     store: Store<"backgroundAgentStore">;
 }>;
+/**
+ * 项目登记簿在不在(`GET /v1/projects*` 的 501 与 `capabilities.projects` 同读)。登记簿只由配置中心下发(settings-schema 的本地读取集不收
+ * `projects` 域)⇒ 在场 ⟺ 中心腿在应用配置(配了中心 ∧ 非 dry-run)。这条判据住在 `centerEntitlementSourceWired`(同一件事:中心的配置
+ * 在这台部署上生效),这里读它,不写第二份条件。见证 = 登记簿那张表(`config.projects`,applyEffective 就地换代,引用恒定)。
+ */
+export declare function projectRegistry(d: Pick<Deps, "config">): Fact<"project_registry_absent", {
+    registry: ServiceConfig["projects"];
+}>;
 export declare function sendFileLedger(d: Pick<Deps, "sendFileLedger">): Fact<"sendfile_ledger_absent", {
     ledger: Store<"sendFileLedger">;
 }>;

package/dist/capability-facts.js

@@ -4,9 +4,11 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
 import { headReadOf } from "./session-incarnation.js";
+import { laneWiresExecutionEnv } from "./execution-lane-caps.js";
 export const CAPABILITY_FACT_WHY = {
     run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)",
     subagent_registry_absent: "the sub-agent steer registry is not wired",
@@ -24,6 +26,11 @@ export const CAPABILITY_FACT_WHY = {
     session_policy_store_absent: "no session policy store is wired",
     store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)",
     file_history_store_absent: "no file-history store is wired",
+    resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through)",
+    execution_lane_handless: "the execution lane mounts no execution environment (REMOTE_EXEC=none), so a session has no working tree to rewind",
+    workspace_rebuilt_per_task: "each task's workspace is rebuilt when the task starts on this deployment (a fresh directory, container or sandbox, or a restore from the workspace snapshot store that a rewind cannot yet take part in), so a rewind would not land in the tree the next task starts from",
+    session_store_shared: "the session store is shared by several server instances (DB_BACKEND=mysql|pg) and no durable claim spans an out-of-run rewind yet, so a rewind could interleave with a run or another rewind started on another instance",
+    file_history_preview_absent: "the file-history store implements no diffStats preview (the SQL backends)",
     session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)",
     session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)",
     policy_purge_absent: "the session policy store has no deleteBySession purge verb",
@@ -61,6 +68,7 @@ export const CAPABILITY_FACT_WHY = {
     read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
+    project_registry_absent: `no project registry is served here: projects are published only by the configuration center (settings-schema does not read the projects domain from the local config.d), and no center configuration is applied (${WEB_ADMIN_ENV.url} unset, or ${WEB_ADMIN_ENV.dryRun} on)`,
     workflow_engine_absent: "the workflow engine is not available on this worker",
     entitlement_resolver_absent: "self-orchestration is on for a multi-tenant worker with no per-principal entitlement source",
     workflow_run_store_absent: "no workflow run store is wired (SELF_ORCHESTRATION_ENABLED)",
@@ -195,6 +203,28 @@ export function sessionSyncFileHistory(d) {
     const blobExchange = blobExchangeOf(sync.historyStore);
     return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
 }
+export function sessionRewindFiles(d) {
+    if (d.fileHistoryStore === undefined)
+        return no("file_history_store_absent");
+    const owned = sessionOwnership(d);
+    if (!owned.available)
+        return owned;
+    if (d.resumeAnchorStore === undefined)
+        return no("resume_anchor_store_absent");
+    if (!laneWiresExecutionEnv(d.config.remoteExec.provider))
+        return no("execution_lane_handless");
+    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(d.config))
+        return no("workspace_rebuilt_per_task");
+    if (d.backend?.kind !== "local")
+        return no("session_store_shared");
+    return yes({ historyStore: d.fileHistoryStore, anchors: d.resumeAnchorStore, sessionStorage: owned.sessionStorage });
+}
+export function sessionRewindFilesPreview(d) {
+    const rewind = sessionRewindFiles(d);
+    if (!rewind.available)
+        return rewind;
+    return rewind.historyStore.diffStats !== undefined ? YES : no("file_history_preview_absent");
+}
 export function checkpointPark(d) {
     return d.checkpointStore !== undefined ? yes({ checkpointStore: d.checkpointStore }) : no("checkpoint_store_absent");
 }
@@ -281,6 +311,9 @@ export function imagePool(d) {
 export function agentRoster(d) {
     return d.backgroundAgentStore !== undefined ? yes({ store: d.backgroundAgentStore }) : no("background_agent_store_absent");
 }
+export function projectRegistry(d) {
+    return centerEntitlementSourceWired(d.config) ? yes({ registry: d.config.projects }) : no("project_registry_absent");
+}
 export function sendFileLedger(d) {
     return d.sendFileLedger !== undefined ? yes({ ledger: d.sendFileLedger }) : no("sendfile_ledger_absent");
 }
@@ -456,7 +489,7 @@ export function hostScheduler(c) {
         return no("scheduler_disabled");
     if (c.requirePrincipal === true)
         return no("multi_tenant_deployment");
-    if (c.remoteExec?.provider !== "host")
+    if (c.remoteExec.provider !== "host")
         return no("not_host_lane");
     return YES;
 }

package/dist/center-credential-renewer.js

@@ -4,6 +4,7 @@ import { basename, dirname, join } from "node:path";
 import { WEB_ADMIN_ENV, WebAdminCredentialEnvelope, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 import { ACCESS_TOKEN_TTL_SECONDS, OAuthErrorResponse, TokenGrantResponse } from "@sema-agent/settings-schema/api/auth";
 import { CENTER_PULL_TIMEOUT_MS, CenterRedirectRefusedError, centerTokenRefresh } from "./web-admin-client/center-request.js";
+import { OWNER_ONLY_FILE_MODE } from "./plugins/owner-only-file-mode.js";
 export const CENTER_CREDENTIAL_RENEW_LEAD_KEY = "CENTER_CREDENTIAL_RENEW_LEAD_MS";
 export const CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS = 5 * 60_000;
 export const CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS = CENTER_PULL_TIMEOUT_MS;
@@ -51,10 +52,10 @@ const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const tmpResiduePattern = (path) => new RegExp(`^\\.${escapeRegExp(basename(path))}\\.\\d+\\.[0-9a-f]{${TMP_RANDOM_BYTES * 2}}\\.tmp$`);
 function prepareTmp(path, envelope, discard, onCleanupFailure) {
     const tmp = join(dirname(path), tmpNameFor(path));
-    const fd = openSync(tmp, "wx", 0o600);
+    const fd = openSync(tmp, "wx", OWNER_ONLY_FILE_MODE);
     let written = false;
     try {
-        fchmodSync(fd, 0o600);
+        fchmodSync(fd, OWNER_ONLY_FILE_MODE);
         writeFileSync(fd, `${JSON.stringify(envelope)}\n`, "utf8");
         fsyncSync(fd);
         written = true;

package/dist/config-catalog.js

@@ -15,7 +15,7 @@ import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVI
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
+import { ALL_EXECUTION_LANES, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
@@ -101,6 +101,7 @@ export const CONFIG_CATALOG = [
     r("BG_AGENT_PARK_CLAIM_STALE_MS", "orchestration", "number", "parked 后台 agent 的 stale-claim 清算窗(ms;claimer 崩死的行由此解卡)", { staticDefault: String(60 * 60_000), configKey: "backgroundAgentParkClaimStaleMs" }),
     r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
+    r("BG_AGENT_STALL_MS", "orchestration", "number", "会话驻留后台子代理的停滞收割窗(ms;最后一次工具活动距今超此值 ⇒ 行收成 killed、归因 system、run 中止;缺省 = 下限,只许拉大,无关闭档)", { derivedDefaultNote: "缺席 ⇒ max(600000, max(STREAM_ASK_WINDOW_MS, UNREACHED_ASK_TTL_MS, QUESTION_TTL_MS, MCP_ELICITATION_TTL_MS) + 引擎单命令上限(缺省 600000));单用户 posture 下 86400000 + 600000", configKey: "backgroundAgentStallMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
     r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${WEB_ADMIN_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
     r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
@@ -264,6 +265,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_EMBEDDER_DIM", "memory", "number", "embeddings 维度声明"),
     r("MEMORY_EMBEDDER_ENDPOINT", "memory", "url", "OpenAI 兼容 /embeddings 端点(pg 记忆后端的向量面)"),
     r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
+    r("MEMORY_EMBEDDER_REEMBED", "memory", "string", "清列重嵌的确认口令 `<model>/<dimensions>`:记下的 embedder 身份与配置对不上时,缺席 ⇒ 拒启、一行不清;在场且恰好点名配置的身份 ⇒ 清掉向量列按该身份重嵌一次(记下之后惰性);形不对或对不上 ⇒ 拒启", { danger: DATA }),
     r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
     r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on", configKey: "memoryEngineEnabled", booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/mysql=DB 真身,多租户点亮的唯一门;方言与 DB_BACKEND 同字)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
@@ -372,8 +374,8 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥)", { danger: SEC, configKey: "operatorPrincipals" }),
-    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)"),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -407,9 +409,8 @@ export const CONFIG_CATALOG = [
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace" }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: ALL_EXECUTION_LANES, danger: SEC, derivedDefaultNote: "无缺省:每个部署都声明执行车道 —— 未声明(且 CONFIG_PROVIDER=local 时 config.d/remote-exec.json 也没点名)/ 空串 ⇒ 拒启,拒句给一行修法(保持 7.146.0 及更早的行为:CONFIG_PROVIDER 非 local 写 none,local 写 host)。none = 声明「不给工具执行环境」:**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed:凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。曾经把「未设」改成拒启的 REQUIRE_EXECUTION_LANE 已退役(墓碑:设了即拒启,见 retired[])", configKey: "remoteExec", resolve: (c) => c.remoteExec.provider }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明与车道出厂答案(host ⇒ 本进程家目录,e2b ⇒ /home/user)都是主张:读得出家目录的车道(k8s / local-docker / ssh / adb / e2b / host)在每只执行环境开起来时拿环境里命令看到的 $HOME 证它(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开;不声明且车道没有出厂答案时,建环境那一拍实测 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认 boot 期答案);device 读不了 ⇒ 声明即座、起服 warn execution_lane_home_unmeasured 披露未实测", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user(两者都在环境开起来时与 $HOME 对证);k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
-    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),