@sema-agent/server 7.146.0 → 7.148.0

package/dist/read-face-posture.d.ts

@@ -36,7 +36,7 @@
  * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
-import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
+import { type ExecutionLane, type LaneReadFaceDefault } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
  * 档位来源的闭集词表 —— **[ref] 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
@@ -63,14 +63,14 @@ export declare function readFaceDefaultFor(input: {
 export interface ReadFaceDeploymentSeat {
     readFace?: "open" | "roots" | undefined;
     readFaceSource: ReadFaceSource;
-    remoteExec?: {
-        readonly provider: RemoteExecProvider;
-    } | undefined;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
+    };
 }
 /**
  * 把**派生的**读面缺省按这台部署**最终生效的车道**落到配置上(显式 env / center 发布的值与来源原样不动)。返回值 = 这一次有没有改动。
- * 两个调用点,同一只函数:`loadConfig` 装配完 `remoteExec` 之后(env 三元链定的车道);车道合成步在 local 形文件覆写之后
- * (`config.d/remote-exec.json` 能把车道换成 `host` / `local-docker`,读面缺省随最终车道重派 —— 否则它停在已作废的车道上)。
+ * 一个调用点:执行车道合成步,在判点(最终车道来自显式声明)通过之后 —— 车道到那一步才定形(local 形 `config.d/remote-exec.json` 也能声明),
+ * 合成前的 raw 配置上车道可以缺席,派生不在那里做(否则会把缺席折成某条车道的缺省)。
  * 幂等:同一份配置再调一次不改。值与来源**同一处写**(`readFace` 缺席 ⟺ 来源 `engine-default`)。
  */
 export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, singleUserTurnkey: boolean): boolean;

package/dist/read-face-posture.js

@@ -1,4 +1,4 @@
-import { LANE_OPEN_READ_FACE_CAUTION, executionLaneOf, laneReadFaceDefault } from "./execution-lane-caps.js";
+import { LANE_OPEN_READ_FACE_CAUTION, laneReadFaceDefault } from "./execution-lane-caps.js";
 import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
 export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
 function readFaceForPosture(singleUserTurnkey) {
@@ -21,7 +21,7 @@ function isDerivedSource(source) {
 export function settleDerivedReadFace(seat, singleUserTurnkey) {
     if (!isDerivedSource(seat.readFaceSource))
         return false;
-    const next = readFaceDefaultFor({ laneDefault: laneReadFaceDefault(executionLaneOf(seat.remoteExec?.provider)), singleUserTurnkey });
+    const next = readFaceDefaultFor({ laneDefault: laneReadFaceDefault(seat.remoteExec.provider), singleUserTurnkey });
     if (next.readFace === seat.readFace && next.readFaceSource === seat.readFaceSource)
         return false;
     if (next.readFace === undefined)

package/dist/request-declaration-refusal.d.ts

@@ -6,11 +6,16 @@
  *  ① **列表**:在场却不是数组 / 超过挂载上限 / 某一条不是对象 ⇒ `400 request.field_invalid`(整份拒而不是挂前 N 条 / 摘掉读不出的那条:一份被悄悄截短的声明,在发送方那里读起来是「生效了」);
  *     超上限用撞帽的唯一铸点({@link limitRefusal}),拒体带机读位一组键(`field` · `reason:"over_cap"` · `count` · `cap`);
  *  ② **键名**:条目层的词表外键 ⇒ `400 request.body_shape` + `unknownKeys`(句子由各座自己写 —— 受理键表与嵌套层是座位自己的事);
- *  ③ **键值**:每个受理键一只判官 ⇒ `400 request.field_invalid`,句子 `<坐标>.<键路径> (<subject> "<名>") is not a usable declaration — <判官原因句>. …`,不回显值;
+ *  ③ **键值**:每个受理键一只判官 ⇒ `400 request.field_invalid`,句子 `<坐标>.<键路径>[ (<条目指认>)] is not a usable declaration — <判官原因句>. …`(条目指认由座位给:有申报名的座位 `(server "<名>")`,没有名字的座位不带),不回显值;
  *     判官答「URL 带凭据」时拒体另带机读位 `field` / `reason`({@link urlCredentialFacts})。
  * 第一处坏形即答:先列表、后条目;条目里先键名、后键值。各座只写**自己的**两件事:受理键表 + 键值判官表(以及它自己的词表外键句)。拒形、句尾、撞帽句不在座位文件里手拼 ——
  * 两份手拼的拒形迟早分岔(`a2aPeers` 上线时就是缺了这一整套,坏形换回 200 + 运维 warn,调用方以为声明生效了)。
  *
+ * ## 机读位(`request.field_invalid` 的每一只拒都带)
+ * 列表级与条目级的 `request.field_invalid` 拒体恒带 `field`(体内坐标:列表键 / `<列表>[i]` / `<列表>[i].<键路径>`),条目级(含条目不是对象)另带 `index`(条目在列表里的下标);撞帽那一形仍是撞帽的一组键,
+ * URL 带凭据那一形在 `field` / `reason` 之外同带 `index`。机读位只在这里铸:判官({@link DeclarationKeyJudge})只交原因,`field` 由原因的键路径铸、`index` 由骨架的循环铸 —— 座位与判官不手拼坐标。
+ * `request.body_shape` 的词表外键拒另有自己的机读位(`unknownKeys`,全坐标),不在这一组。
+ *
  * ## 射程
  * 纯值域、与租户车道无关;只在 fresh 提交腿上问(`boot/resolve-spec.ts` 的 `opts.leg`):重放存量 body 的腿走宽容读器,一个 4xx 打在 resume 上会永久砖死一条 parked 任务。
  */
@@ -19,26 +24,44 @@ import { type LimitFacts } from "./limit-refusal.js";
 import { type UrlCredentialFacts } from "./url-credential-refusal.js";
 /** 一座声明列表的名字与上限、以及拒句里要用的称呼(座位的常量,铸点只读)。 */
 export interface DeclarationSeat {
-    /** 请求体里这张列表的键,也是机读坐标的根(`mcpServers` | `a2aPeers`)。 */
+    /** 请求体里这张列表的键,也是机读坐标的根(`mcpServers` | `a2aPeers` | `images`)。 */
     readonly list: string;
     /** 挂载上限(条数;超过 ⇒ 撞帽拒)。 */
     readonly cap: number;
-    /** 一条声明所声明的东西(拒句里的单数名词:`server` | `peer`)。 */
-    readonly subject: string;
+    /** 条目级拒句里条目的指认(带前导空格,接在坐标后):有申报名的座位 = ` (server "<名>")`;坐标本身唯一的座位(没有名字的条目)= 空串。 */
+    readonly identify: (entry: Record<string, unknown>) => string;
+    /** 条目级拒句的收尾句:说清「为什么整份请求被拒、而不是照坏条目办」与出路。 */
+    readonly entryTail: string;
     /** 「一条声明」的整称(`an MCP server declaration`)。 */
     readonly declaration: string;
     /** 「多条声明」的整称(`MCP server declarations`)。 */
     readonly declarations: string;
 }
+/** 有申报名、挂在一个外部服务上的座位(`mcpServers` · `a2aPeers`)的座位常量:指认 = ` (<subject> "<名>")`,收尾句说「不挂就跑偏」。`subject` = 一条声明所声明的东西(`server` | `peer`)。 */
+export declare function createMountSeat(o: {
+    readonly list: string;
+    readonly cap: number;
+    readonly subject: string;
+    readonly declaration: string;
+    readonly declarations: string;
+}): DeclarationSeat;
 /** 一次拒绝:码 + 句 + 词表外的键名表(只在闭集那一形上在场)+ 机读位(撞帽 / URL 带凭据两形上在场)。受理口(同步 400)与探测口(`POST …/probe`)原样转述同一份。 */
 export interface DeclarationRefusal {
     readonly errorCode: "request.body_shape" | "request.field_invalid";
     readonly message: string;
     /** 词表外的键,全路径形(已清洗 + 截长 + 排序 + 封顶)。 */
     readonly unknownKeys?: readonly string[];
-    /** 撞帽:`field` · `reason:"over_cap"` · `count` · `cap`;URL 带凭据:`field` · `reason`(判官的拒因词)。 */
-    readonly facts?: UrlCredentialFacts | LimitFacts;
+    /** 机读位:撞帽 = `field` · `reason:"over_cap"` · `count` · `cap`;URL 带凭据 = `field` · `reason`(判官的拒因词)· `index`;其余 `request.field_invalid` = `field`(条目级另带 `index`)。 */
+    readonly facts?: DeclarationEntryFacts | LimitFacts;
 }
+/** 条目判官(座位的 `judgeEntry` · 键值判官表)交回的拒:机读位只会是条目级的那一组({@link DeclarationEntryFacts}),撞帽那一形只由骨架的列表级铸 —— 所以补 `index` 的函数收窄到这一型,不靠运行期猜。 */
+export type EntryRefusal = Omit<DeclarationRefusal, "facts"> & {
+    readonly facts?: DeclarationEntryFacts;
+};
+/** 列表级 / 条目级 `request.field_invalid` 拒的机读位:`field` 恒在;`index` = 条目级才有(条目在列表里的下标);URL 带凭据那一形另带判官的拒因词 `reason`。 */
+export type DeclarationEntryFacts = (Pick<UrlCredentialFacts, "field"> | UrlCredentialFacts) & {
+    readonly index?: number;
+};
 /** 一处键值坏形:键路径(相对条目)+ 判官的原因句;答「URL 带凭据」时另带判官的答案(⇒ 拒体带机读位)。 */
 export interface DeclarationKeyIssue {
     readonly path: string;
@@ -55,8 +78,8 @@ export declare function declaredName(e: unknown): string;
 export declare function declarationNameIssue(entry: Record<string, unknown>): DeclarationKeyIssue | undefined;
 /** 列表级拒句的收尾句:说清「为什么整份被拒、而不是只按读得出的那部分办」与出路(空列表 = 什么都不声明)。 */
 export declare const LIST_REFUSAL_TAIL: string;
-/** 列表级的一处坏形 → 拒(码恒 `request.field_invalid`)。`head` 只说位置与形的**种类**,不回显值。 */
-export declare function declarationListRefusal(head: string): DeclarationRefusal;
+/** 列表级的一处坏形 → 拒(码恒 `request.field_invalid`,体带 `field`)。`head` 只说位置与形的**种类**,不回显值;`field` = 坏形所在的体内坐标(列表键 / `<列表>[i]`)。 */
+export declare function declarationListRefusal(head: string, field: string): EntryRefusal;
 /**
  * 一处键值坏形**怎么被说出来**:体内坐标(`<条目坐标>.<键路径>`)+ 判官的原因句(只剥控制与双向字符,不回显值)。受理口的拒句与读器的丢弃因(请求腿运维 warn 的 `field` / `reason`)读**这一只** ——
  * 原因只来自判官表,组句只在这里(两边各写一份,迟早分岔)。
@@ -78,17 +101,17 @@ export declare function declarationOverCapFacts(seat: DeclarationSeat, count: nu
  * 「什么算对象」只在这里判。
  */
 export declare function declarationEntryNotObject(seat: DeclarationSeat, entry: unknown, at: string): string | undefined;
-/** 一处键值坏形 → 拒。**所有键同一个形**;条目名过唯一的回显清洗,读不出名字的条目用占位,坐标与原因句由 {@link declarationIssueFacts} 铸。 */
-export declare function declarationFieldRefusal(seat: DeclarationSeat, entry: Record<string, unknown>, at: string, issue: DeclarationKeyIssue): DeclarationRefusal;
+/** 一处键值坏形 → 拒。**所有键同一个形**;条目指认由座位给({@link DeclarationSeat.identify}),坐标与原因句由 {@link declarationIssueFacts} 铸,机读位 `field`(判官答 URL 带凭据时另带 `reason`)与句子点名同一个坐标。 */
+export declare function declarationFieldRefusal(seat: DeclarationSeat, entry: Record<string, unknown>, at: string, issue: DeclarationKeyIssue): EntryRefusal;
 /** 一条条目的键值判官表按受理键序问一遍,第一处坏形即返回。 */
 export declare function judgeDeclarationKeys<K extends string, E extends Record<string, unknown>>(seat: DeclarationSeat, entry: E, at: string, keys: readonly K[], judges: {
     readonly [P in K]: DeclarationKeyJudge<E>;
-}): DeclarationRefusal | undefined;
+}): EntryRefusal | undefined;
 /**
  * 一张声明列表「能不能原样用」的回答者骨架:列表级(缺席 / `null` ⇒ 没声明;不是数组 / 超上限 / 条目不是对象)在这里,条目级交座位的 `judgeEntry`(词表外的键 → 键值)。
  * `undefined` = 能原样用(或没声明;各门自己定缺席的意思)。
  */
-export declare function requestDeclarationRefusal(seat: DeclarationSeat, list: unknown, judgeEntry: (entry: Record<string, unknown>, at: string) => DeclarationRefusal | undefined): DeclarationRefusal | undefined;
+export declare function requestDeclarationRefusal(seat: DeclarationSeat, list: unknown, judgeEntry: (entry: Record<string, unknown>, at: string) => EntryRefusal | undefined): DeclarationRefusal | undefined;
 /** 受理口的转述:有答案 ⇒ 同步 400(码 / 句 / `unknownKeys` / 机读位原样);没有 ⇒ 什么也不做。 */
 export declare function throwDeclarationRefusal(refusal: DeclarationRefusal | undefined): void;
 //# sourceMappingURL=request-declaration-refusal.d.ts.map

package/dist/request-declaration-refusal.js

@@ -3,6 +3,16 @@ import { createCodedHttpError } from "./security.js";
 import { limitRefusal } from "./limit-refusal.js";
 import { echoKeyName } from "./request-key-closure.js";
 import { urlCredentialFacts } from "./url-credential-refusal.js";
+export function createMountSeat(o) {
+    return {
+        list: o.list,
+        cap: o.cap,
+        identify: (entry) => ` (${o.subject} "${echoKeyName("", declaredName(entry))}")`,
+        entryTail: mountedEntryTail(o.subject),
+        declaration: o.declaration,
+        declarations: o.declarations,
+    };
+}
 export const MALFORMED_NAME = "<malformed>";
 export function declaredName(e) {
     return e && typeof e === "object" && typeof e.name === "string" && e.name !== ""
@@ -14,10 +24,10 @@ export function declarationNameIssue(entry) {
 }
 export const LIST_REFUSAL_TAIL = "The request is refused rather than acting on part of the list: declarations that silently did not apply would read as in effect to whoever sent them. " +
     "Fix the list (an empty list declares none).";
-export function declarationListRefusal(head) {
-    return { errorCode: "request.field_invalid", message: `${head}. ${LIST_REFUSAL_TAIL}` };
+export function declarationListRefusal(head, field) {
+    return { errorCode: "request.field_invalid", message: `${head}. ${LIST_REFUSAL_TAIL}`, facts: { field } };
 }
-function entryRefusalTail(subject) {
+function mountedEntryTail(subject) {
     return (`The request is refused rather than mounting the ${subject} without it: a declaration that silently did not apply would leave the ${subject} running differently from what you declared. ` +
         "Fix the entry (an optional key may also be omitted).");
 }
@@ -32,14 +42,16 @@ export function declarationEntryNotObject(seat, entry, at) {
     return entry === null || typeof entry !== "object" || Array.isArray(entry) ? `${at} is ${describeValueShape(entry)}, not ${seat.declaration} (an object)` : undefined;
 }
 export function declarationFieldRefusal(seat, entry, at, issue) {
-    const name = echoKeyName("", declaredName(entry));
     const { field, reason } = declarationIssueFacts(at, issue);
     return {
         errorCode: "request.field_invalid",
-        message: `${field} (${seat.subject} "${name}") is not a usable declaration — ${reason}. ${entryRefusalTail(seat.subject)}`,
-        ...(issue.credential === undefined ? {} : { facts: urlCredentialFacts(`${at}.${issue.path}`, issue.credential) }),
+        message: `${field}${seat.identify(entry)} is not a usable declaration — ${reason}. ${seat.entryTail}`,
+        facts: issue.credential === undefined ? { field } : urlCredentialFacts(field, issue.credential),
     };
 }
+function withEntryIndex(refusal, index) {
+    return refusal.errorCode === "request.field_invalid" && refusal.facts !== undefined ? { ...refusal, facts: { ...refusal.facts, index } } : refusal;
+}
 export function judgeDeclarationKeys(seat, entry, at, keys, judges) {
     for (const key of keys) {
         const issue = judges[key](entry, at);
@@ -52,7 +64,7 @@ export function requestDeclarationRefusal(seat, list, judgeEntry) {
     if (list === undefined || list === null)
         return undefined;
     if (!Array.isArray(list))
-        return declarationListRefusal(`${seat.list} is ${describeValueShape(list)}, not an array of ${seat.declarations}`);
+        return declarationListRefusal(`${seat.list} is ${describeValueShape(list)}, not an array of ${seat.declarations}`, seat.list);
     if (list.length > seat.cap) {
         const capped = limitRefusal(seat.list, "entries", list.length, seat.cap, { tail: LIST_REFUSAL_TAIL });
         return { errorCode: "request.field_invalid", message: capped.message, facts: capped.facts };
@@ -62,10 +74,10 @@ export function requestDeclarationRefusal(seat, list, judgeEntry) {
         const at = `${seat.list}[${i}]`;
         const notObject = declarationEntryNotObject(seat, entry, at);
         if (notObject !== undefined)
-            return declarationListRefusal(notObject);
+            return withEntryIndex(declarationListRefusal(notObject, at), i);
         const refusal = judgeEntry(entry, at);
         if (refusal !== undefined)
-            return refusal;
+            return withEntryIndex(refusal, i);
     }
     return undefined;
 }

package/dist/request-form.d.ts

@@ -0,0 +1,58 @@
+/**
+ * **请求形的拒** —— 一条律:门先于铸。
+ *
+ * 一次提交里,判据只读**请求本身**(体 · 头里验过的主体 · 到达的腿)与**进程期不变的部署配置**(车道、主体姿态、运维旋钮 —— 不是热应用的模型面)就答得出的拒,
+ * 在授权器铸下任何会话行之前答(受理漏斗 `http/admission.ts` 调 {@link assertRequestFormBeforeMint}):会话店零写、撤回出口零次,壳的 `--resume` 清单里不会出现这次提交。
+ * 铸点之后剩下的拒,判据都要读状态 —— 会话行与它的放置、店里的内容、装配器自己装配的事实(锁集、数据根、店的接线)、热应用的模型面、主体的中心裁定、在飞状态、引擎 ——
+ * 由提交出口(`submission-exit.ts`)在终局应答之前条件撤回收场。两类不交,也没有第三类。
+ *
+ * 分类的单位是**拒绝点**(一处拒与守着它的判据),只看判据的输入,不看它今天住在哪一段。本文件的判官在铸点之前答过,装配器(`boot/resolve-spec.ts`)对同一只判官的复判读同一份输入
+ * (受理门交给装配器的那一份体 · 同一只 `ServiceConfig` 的不变字段 · 按请求记忆化的主体),答同一个结论 —— 那一读是续跑重放腿与直调嵌入方的门(它们不经受理漏斗),
+ * 在 HTTP 新提交腿上恒不拒。
+ *
+ * 句与码的唯一属主是各判官;本文件把装配器里原先内联的几只判(`inheritEnv` 的车道与射程、工具名清单读成空、附件句柄形、写容纳面、镜像档 × 车道)收成导出函数,
+ * 装配器与受理门同调;规则表的那一判与存量体重放预判共用一只组合(`http/stored-body-replay.ts` 的 `ruleTablesRefusalWithoutTaskRoot`)。
+ */
+import type { IncomingMessage } from "node:http";
+import { type TaskHostPostureScope, type TaskWriteFaceInput } from "./hosted-posture.js";
+import { type ToolListSide } from "./rule-entry-list.js";
+import { type Scenario } from "./owner-brands.js";
+import type { PermissionMode } from "@sema-agent/core";
+import type { ServiceConfig } from "./config-types.js";
+import type { TaskRequestBody } from "./http/wire-types.js";
+/**
+ * 一次提交请求的场景名从哪来(唯一读法):带场景头 ⇒ 头就是本请求的场景(分区与工具面同一个场景);体再给一个不同的 ⇒ 400 `scenario_conflict`
+ * (只在提交腿:读面没有体)。没带头 ⇒ 体原样(缺席 ⇒ 门走指派链)。
+ */
+export declare function scenarioRequestedBy(headerScenario: Scenario | undefined, bodyScenario: unknown): unknown;
+/**
+ * `inheritEnv:"all"` 的车道与射程两判(值形判在 `request-value-closure.ts` 的 `inheritEnvFieldIssue`,先于本函数):只有 host 车道消费这一位 ⇒ 别的车道 400 + 机读位
+ * `reason: lane_not_host`;射程读写容纳面那一只谓词(`hosted-posture.ts` 腿④)⇒ 托管 422 `request.host_posture_refused`。`"scrub"` 是缺省,任何车道受理。
+ */
+export declare function assertInheritEnvServed(body: {
+    readonly inheritEnv?: unknown;
+}, config: TaskHostPostureScope): void;
+/** 工具名清单里读成空的条目 ⇒ 400(判与句的属主 = `rule-entry-list.ts` `inertToolListEntryOf`;`sides` 缺省 = 两个方向都判,续跑腿只判限制方向)。 */
+export declare function assertToolListsReadable(body: unknown, sides?: readonly ToolListSide[]): void;
+/** 体 `attachmentIds` 的形:在场就必须是至多 16 只、每只 1–64 字符的串(只判形;句柄在不在、绑不绑得上读附件店,在装配器的绑定核)。 */
+export declare function assertAttachmentIdsShape(raw: unknown): void;
+/** 任务层「掀开写围栏」的模式词 × 部署天花板(判据与拒因属主 `hosted-posture.ts`)⇒ 422 `request.host_posture_refused`。 */
+export declare function assertWriteFaceAdmitted(mode: PermissionMode | undefined, config: TaskWriteFaceInput): void;
+/**
+ * 体点名的每任务镜像档 × 本部署的执行车道:车道不是 k8s ⇒ 501 `capability.k8s_lane_required`(这台部署接不了每任务镜像,换部署形态才行)。
+ * 装配器判的是**生效**的那一档(体给的 ∨ 会话绑定的);体给了档时会话绑定不读 ⇒ 这一判只读请求与车道,受理门在铸点之前判体那一档。
+ */
+export declare function assertImageProfileLane(profile: string | undefined, config: TaskHostPostureScope): void;
+/** 体上的每任务镜像档(非空串;形在受理门的值形门判过 —— 与装配器同一读法)。 */
+export declare function bodyImageProfileOf(body: {
+    readonly sandboxImageProfile?: unknown;
+}): string | undefined;
+/**
+ * **新提交的请求形判,铸点之前一次答完**(受理漏斗在值形门之后、授权器之前调;抛 `HttpError`,与装配器的同名判同句同码)。
+ * `body` = 受理门盖过入口模式章的那一份(装配器拿到的就是它)。序 = 装配器里这些判的序(一份体同时撞上两只时,先答的与修前同一只):
+ * 主体(场景头的三判)→ MCP 条目 → `inheritEnv` 车道 / 射程 → 工具名清单 → A2A 条目(超 32 条整份拒)→ `images` → 场景头 × 体 → `attachmentIds` 形 → 写容纳面 →
+ * 规则表里不靠任务根的拒(三桶 → `neverAuto`)→ 体点名的镜像档 × 车道。
+ * 不在这里的:装配器自己装配的事实(运维锁集、数据根、店的接线)、热应用的模型面(目录 / 名单 / 拒因表)、会话 / 店 / 中心 / 在飞 / 引擎 —— 那些判在铸点之后,拒走条件撤回。
+ */
+export declare function assertRequestFormBeforeMint(body: TaskRequestBody, req: IncomingMessage, config: ServiceConfig): void;
+//# sourceMappingURL=request-form.d.ts.map

package/dist/request-form.js

@@ -0,0 +1,72 @@
+import { effectivePermissionMode, parseTaskSettings } from "./task-settings.js";
+import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal, taskInheritEnvRefusal } from "./hosted-posture.js";
+import { HttpError, createCodedHttpError, verifiedSubject } from "./security.js";
+import { inheritEnvFacts } from "./request-value-closure.js";
+import { inertToolListEntryOf } from "./rule-entry-list.js";
+import { ruleTablesRefusalWithoutTaskRoot } from "./http/stored-body-replay.js";
+import { assertRequestMcpEntries } from "./task-mcp.js";
+import { assertRequestA2aEntries, snapshotRequestA2a } from "./task-a2a.js";
+import { assertRequestImages } from "./request-images.js";
+import { partsOf } from "./owner-brands.js";
+export function scenarioRequestedBy(headerScenario, bodyScenario) {
+    if (headerScenario === undefined)
+        return bodyScenario;
+    if (bodyScenario !== undefined && bodyScenario !== headerScenario) {
+        throw createCodedHttpError(400, "scenario_conflict", `the request body names scenario ${JSON.stringify(String(bodyScenario))} but the x-agent-scenario header names ${JSON.stringify(headerScenario)} — send one scenario (the header alone selects both the partition and the scenario)`);
+    }
+    return headerScenario;
+}
+export function assertInheritEnvServed(body, config) {
+    if (body.inheritEnv !== "all")
+        return;
+    const lane = config.remoteExec.provider;
+    if (lane !== "host") {
+        throw new HttpError(400, `inheritEnv:"all" applies to the host lane only (this deployment runs ${lane}) — only the host lane builds the model-driven shell's environment from this machine's own, so the declaration has no effect here; omit it (or send "scrub", the default, which every lane accepts)`, { code: "request.field_invalid", extra: inheritEnvFacts("lane_not_host") });
+    }
+    const why = taskInheritEnvRefusal(config);
+    if (why !== undefined)
+        throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+}
+export function assertToolListsReadable(body, sides) {
+    const inert = inertToolListEntryOf(body, sides);
+    if (inert !== undefined)
+        throw new HttpError(400, inert.message, { code: inert.code, ...(inert.extra !== undefined ? { extra: { ...inert.extra } } : {}) });
+}
+export function assertAttachmentIdsShape(raw) {
+    if (raw === undefined)
+        return;
+    if (!Array.isArray(raw) || !raw.every((x) => typeof x === "string" && x.length > 0 && x.length <= 64)) {
+        throw new HttpError(400, "`attachmentIds` must be an array of attachment ids (strings)");
+    }
+    if (raw.length > 16)
+        throw new HttpError(400, "`attachmentIds` exceeds the per-task limit (16)");
+}
+export function assertWriteFaceAdmitted(mode, config) {
+    const why = permissionModeWriteFaceRefusal(mode, config);
+    if (why !== undefined)
+        throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+}
+export function assertImageProfileLane(profile, config) {
+    if (profile !== undefined && config.remoteExec.provider !== "k8s") {
+        throw createCodedHttpError(501, "capability.k8s_lane_required", "sandboxImageProfile is only supported on the k8s sandbox backend");
+    }
+}
+export function bodyImageProfileOf(body) {
+    return typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 ? body.sandboxImageProfile : undefined;
+}
+export function assertRequestFormBeforeMint(body, req, config) {
+    const subject = verifiedSubject(req, config);
+    assertRequestMcpEntries(body.mcpServers);
+    assertInheritEnvServed(body, config);
+    assertToolListsReadable(body);
+    assertRequestA2aEntries(snapshotRequestA2a(body.a2aPeers, { reread: false }));
+    assertRequestImages(body.images);
+    scenarioRequestedBy(subject === undefined ? undefined : partsOf(subject).scenario, body.scenario);
+    assertAttachmentIdsShape(body.attachmentIds);
+    assertWriteFaceAdmitted(effectivePermissionMode(body, parseTaskSettings(body.settings).settings), config);
+    const ruleTables = ruleTablesRefusalWithoutTaskRoot(body, config);
+    if (ruleTables !== undefined)
+        throw new HttpError(422, ruleTables.message, { code: ruleTables.code, ...(ruleTables.extra !== undefined ? { extra: { ...ruleTables.extra } } : {}) });
+    assertImageProfileLane(bodyImageProfileOf(body), config);
+}
+//# sourceMappingURL=request-form.js.map

package/dist/request-image-urls.d.ts

@@ -1,6 +1,12 @@
-import { type UrlCredentialRefusal } from "./url-credential-refusal.js";
+import { type UrlCredentialFacts, type UrlCredentialRefusal } from "./url-credential-refusal.js";
+/** 本座的拒:URL 凭据座的整句 + 机读位,机读位另带 `index`(条目在 `images` 里的下标)—— 与 `request-declaration-refusal.ts` 骨架上条目级拒的 `index` 同一个键、同一个意思,一份 `images` 的所有条目级拒同形。 */
+export interface ImageUrlRefusal extends UrlCredentialRefusal {
+    readonly facts: UrlCredentialFacts & {
+        readonly index: number;
+    };
+}
 /** 请求体 `images` 的 URL 座:任一条目的串值 `url` 带凭据 ⇒ 拒(整句 + 机读位),列表序第一处即答;没有 ⇒ `undefined`。`images` 不是数组 / 缺席 ⇒ `undefined`(形归受理口别的门)。 */
-export declare function requestImageUrlRefusal(images: unknown): UrlCredentialRefusal | undefined;
+export declare function requestImageUrlRefusal(images: unknown): ImageUrlRefusal | undefined;
 /** fresh 提交腿的 `images` URL 门:{@link requestImageUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
 export declare function assertRequestImageUrls(bodyImages: unknown): void;
 //# sourceMappingURL=request-image-urls.d.ts.map

package/dist/request-image-urls.js

@@ -15,7 +15,8 @@ export function requestImageUrlRefusal(images) {
         if (found === undefined)
             continue;
         const at = `images[${i}]`;
-        return buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+        const refusal = buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+        return { message: refusal.message, facts: { ...refusal.facts, index: i } };
     }
     return undefined;
 }

package/dist/request-images.d.ts

@@ -0,0 +1,20 @@
+import { type DeclarationRefusal } from "./request-declaration-refusal.js";
+/** 一次提交最多带几张图(条数帽;受理口的 `413 request.payload_too_large` 与本座骨架的撞帽拒读这一个数)。 */
+export declare const MAX_IMAGES_PER_REQUEST = 20;
+/** 内联字节臂的受理键(书写序即判序)。两道编译格对引擎的 `ImageInput`:引擎长出 / 退役一个键而本表没跟 ⇒ 红。 */
+export declare const IMAGE_INLINE_KEYS: readonly ["data", "mimeType"];
+/** URL 臂的受理键。同上两道编译格。 */
+export declare const IMAGE_URL_KEYS: readonly ["url"];
+/** 请求体 `images`「这份声明能不能原样交给引擎」的回答者(骨架同形):`undefined` = 能(或缺席 / `null` = 没带图)。 */
+export declare function requestImagesRefusal(images: unknown): DeclarationRefusal | undefined;
+/**
+ * fresh 提交腿的 `images` 门(`boot/resolve-spec.ts`):先形(骨架的拒,码 / 句 / `unknownKeys` / 机读位原样),后 URL 凭据座({@link assertRequestImageUrls})。
+ * 形坏的 `images` 走不到凭据座 —— 凭据座读的是形已判过的条目。
+ */
+export declare function assertRequestImages(bodyImages: unknown): void;
+/**
+ * 一条图片的内联字节(`data` 是串才有;条目不是对象 / 没有 `data` / 不是串 ⇒ `undefined`)。受理口的内联字节帽读它,**不自己摸条目**:帽排在形判之前,条目可能是 `null`。
+ * 条目形坏不是帽的事 —— 形判在后头答。
+ */
+export declare function inlineImageData(image: unknown): string | undefined;
+//# sourceMappingURL=request-images.d.ts.map

package/dist/request-images.js

@@ -0,0 +1,59 @@
+import { describeValueShape } from "@sema-agent/settings-schema";
+import { assertRequestImageUrls } from "./request-image-urls.js";
+import { MAX_KEY_ECHO, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
+import { judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal } from "./request-declaration-refusal.js";
+export const MAX_IMAGES_PER_REQUEST = 20;
+export const IMAGE_INLINE_KEYS = ["data", "mimeType"];
+export const IMAGE_URL_KEYS = ["url"];
+const IMAGES_SEAT = {
+    list: "images",
+    cap: MAX_IMAGES_PER_REQUEST,
+    identify: () => "",
+    entryTail: "The request is refused rather than handing the engine an image it cannot read: an image that silently did not apply would leave the model answering without what you attached. " +
+        "Fix the entry (an image is either { data, mimeType } or { url }).",
+    declaration: "an image entry",
+    declarations: "image entries",
+};
+function mustBeString(key, what) {
+    return (entry) => (typeof entry[key] === "string" ? undefined : { path: key, reason: `must be a string (${what}) — got ${describeValueShape(entry[key])}` });
+}
+const INLINE_KEY_JUDGES = {
+    data: mustBeString("data", "the base64-encoded image bytes"),
+    mimeType: mustBeString("mimeType", 'an image MIME type such as "image/png"'),
+};
+const URL_KEY_JUDGES = {
+    url: mustBeString("url", "the URL the engine fetches the image from"),
+};
+const INLINE_KEY_SET = new Set(IMAGE_INLINE_KEYS);
+const URL_KEY_SET = new Set(IMAGE_URL_KEYS);
+const NO_TOLERATED_KEYS = new Set();
+function imageEntryRefusal(entry, at) {
+    const urlArm = "url" in entry;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyNames(Object.keys(entry), `${at}.`, urlArm ? URL_KEY_SET : INLINE_KEY_SET, NO_TOLERATED_KEYS, buckets);
+    if (buckets.unknown.length > 0) {
+        const unknownKeys = buckets.unknown.sort();
+        return {
+            errorCode: "request.body_shape",
+            message: `body: unrecognized key(s) on an image entry — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+                `${keyClosureClause(unknownKeys, `unknown (not a key of the ${urlArm ? "url" : "inline-bytes"} form — check the spelling; an image is either { data, mimeType } or { url }, never both)`)}. ` +
+                `Accepted: ${[...(urlArm ? IMAGE_URL_KEYS : IMAGE_INLINE_KEYS)].join(",")}`,
+            unknownKeys: unknownKeys.slice(0, MAX_KEY_ECHO),
+        };
+    }
+    return urlArm ? judgeDeclarationKeys(IMAGES_SEAT, entry, at, IMAGE_URL_KEYS, URL_KEY_JUDGES) : judgeDeclarationKeys(IMAGES_SEAT, entry, at, IMAGE_INLINE_KEYS, INLINE_KEY_JUDGES);
+}
+export function requestImagesRefusal(images) {
+    return requestDeclarationRefusal(IMAGES_SEAT, images, imageEntryRefusal);
+}
+export function assertRequestImages(bodyImages) {
+    throwDeclarationRefusal(requestImagesRefusal(bodyImages));
+    assertRequestImageUrls(bodyImages);
+}
+export function inlineImageData(image) {
+    if (image === null || typeof image !== "object")
+        return undefined;
+    const data = image.data;
+    return typeof data === "string" ? data : undefined;
+}
+//# sourceMappingURL=request-images.js.map

package/dist/request-key-closure.d.ts

@@ -46,7 +46,6 @@ export type NamedKeysOf<T> = {
 export declare function taskBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 declare const RUN_STEER_BODY_KEYS: readonly ["mode", "priority", "text"];
 declare const CONTENT_STEER_BODY_KEYS: readonly ["content"];
-declare const INTERRUPT_STEER_BODY_KEYS: readonly ["text"];
 /** `POST /v1/runs/:id/steer` 的体形(键 = 受理集,值形由路由逐键判)。 */
 export type RunSteerBody = {
     readonly [K in (typeof RUN_STEER_BODY_KEYS)[number]]?: unknown;
@@ -55,14 +54,14 @@ export type RunSteerBody = {
 export type ContentSteerBody = {
     readonly [K in (typeof CONTENT_STEER_BODY_KEYS)[number]]?: unknown;
 };
-/** `POST /v1/runs/:id/interrupt` 带 text 形的体形。 */
-export type InterruptSteerBody = {
-    readonly [K in (typeof INTERRUPT_STEER_BODY_KEYS)[number]]?: unknown;
-};
-/** 送话口的体形(闭集;词外是编译错)。`interrupt` = `POST /v1/runs/:id/interrupt` 整扇门(bare 与带 `text` 两形同一张受理集)。 */
-export type SteerBodyForm = "run" | "content" | "interrupt";
+/** 送话口的体形(闭集;词外是编译错)。 */
+export type SteerBodyForm = "run" | "content";
 /** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
+/** halt 门的拒句(定长;对每一种非空体同一句)。 */
+export declare const HALT_BODY_REFUSAL: string;
+/** halt 门的体判:空体(`undefined` / `null` / 零键对象)⇒ `null`;其余 ⇒ 拒体(键全进 `unknownKeys`,封顶同 {@link MAX_KEY_ECHO})。 */
+export declare function haltBodyIssue(raw: unknown): KeyClosureIssue | null;
 declare const PRINCIPAL_INBOX_BODY_KEYS: readonly ["to", "content", "urgent"];
 /** 受理口的体形(键 = 受理集,值形由路由逐键判)。 */
 export type PrincipalInboxBody = {

package/dist/request-key-closure.js

@@ -68,11 +68,9 @@ export function taskBodyKeyIssue(raw) {
 }
 const RUN_STEER_BODY_KEYS = ["mode", "priority", "text"];
 const CONTENT_STEER_BODY_KEYS = ["content"];
-const INTERRUPT_STEER_BODY_KEYS = ["text"];
 const STEER_DOORS = {
     run: { accepted: new Set(RUN_STEER_BODY_KEYS), door: "a steer-request" },
     content: { accepted: new Set(CONTENT_STEER_BODY_KEYS), door: "a steer-request" },
-    interrupt: { accepted: new Set(INTERRUPT_STEER_BODY_KEYS), door: "an interrupt-request" },
 };
 const STEER_UNSUPPORTED = {
     keys: new Set([...UNSUPPORTED_BODY_KEYS, ...OBJECTIVE_ONLY_BODY_KEYS]),
@@ -81,6 +79,21 @@ const STEER_UNSUPPORTED = {
 export function steerBodyKeyIssue(raw, form) {
     return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
+export const HALT_BODY_REFUSAL = "body must be empty (no body, {} or null): this door is halt — it cuts the in-flight turn and stops the run at that boundary — and takes no fields; " +
+    'to send the run a message, POST /v1/runs/:id/steer with priority:"now" (it cuts the in-flight turn first, then the run continues with that message)';
+const NO_FIELDS = new Set();
+export function haltBodyIssue(raw) {
+    if (raw === null || raw === undefined)
+        return null;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return { message: HALT_BODY_REFUSAL, unknownKeys: [], unsupportedKeys: [] };
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", NO_FIELDS, NO_FIELDS, buckets);
+    if (buckets.unknown.length === 0)
+        return null;
+    buckets.unknown.sort();
+    return { message: HALT_BODY_REFUSAL, unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO), unsupportedKeys: [] };
+}
 const PRINCIPAL_INBOX_BODY_KEYS = ["to", "content", "urgent"];
 const PRINCIPAL_INBOX_UNSUPPORTED = { keys: new Set(), label: "unsupported" };
 export function principalInboxBodyKeyIssue(raw) {

package/dist/request-value-closure.d.ts

@@ -119,17 +119,17 @@ export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
 export declare const INHERIT_ENV_VALUE_MESSAGE: string;
 /**
  * `inheritEnv` 的 `request.field_invalid` 400 的机读 `reason`([ref];闭集,**一种拒因一个词**,读者穷举读)—— 拒体另带 `field: "inheritEnv"` 与它,
- * 壳靠这两位认「这条 400 真是 `inheritEnv` 的」,不猜句子。同一个键的**三只** 400 是一类,词表一张:
+ * 壳靠这两位认「这条 400 真是 `inheritEnv` 的」,不猜句子。同一个键的**两类** 400(值形 / 车道)是一类,词表一张:
  *  · `unknown_word` —— 值形:是字符串,但不在受理词表(`"ALL"` · `"everything"` · `""`);
  *  · `not_a_string` —— 值形:根本不是字符串(名单形 `string[]` · 布尔 · 数字 · `null` · 对象);
- *  · `lane_not_host` —— `"all"` 落在非 host 车道(只有 host 工厂消费这一位,别的车道没有消费点);
- *  · `no_authorizer_session` —— `"all"` 而部署不接 authorizer(绑定按会话键控,没有会话就没有地方兑现)。
- * 前两词的判官是 {@link inheritEnvFieldIssue}(只看体);后两词的判官在 `boot/resolve-spec.ts`(要读部署事实,两腿同过)。
+ *  · `lane_not_host` —— `"all"` 落在非 host 车道(只有 host 工厂消费这一位,别的车道没有消费点)。
+ * 前两词的判官是 {@link inheritEnvFieldIssue}(只看体);`lane_not_host` 的判官在 `boot/resolve-spec.ts`(要读部署事实,两腿同过)。
+ * 没有「无会话」一词:绑定按会话键控,而一次提交的根会话由 authorizer 必填席解析、经执行上下文交进装配器(根恒在),不存在「部署不接 authorizer」的形。
  * 不在这组的:`422 request.host_posture_refused`(托管部署不兑现 `"all"`)—— 那不是这个键的值写错,而是部署姿态拒,码与写容纳面那条腿共用,按 `errorCode` 认(契约 §18)。
  * 加一种拒因 ⇒ 这里加一个词(并在判官处给它一个分支);词与因一一对应,没有一因两词、也没有一词两因。
  * 词的铸点只有 {@link inheritEnvFacts} 一处:受理门与 resolveSpec 只经它出机读位,不手拼 `field` / `reason`。
  */
-export declare const INHERIT_ENV_REFUSAL_REASONS: readonly ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export declare const INHERIT_ENV_REFUSAL_REASONS: readonly ["unknown_word", "not_a_string", "lane_not_host"];
 export type InheritEnvRefusalReason = (typeof INHERIT_ENV_REFUSAL_REASONS)[number];
 /** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用;型别名而不是接口 —— 要能直接当 `Record<string, unknown>` 用)。 */
 export type InheritEnvFacts = {

package/dist/request-value-closure.js

@@ -35,7 +35,7 @@ export const INHERIT_ENV_WORDS = ["all", "scrub"];
 export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
     `("all" = the model-driven host shell inherits this machine's whole environment except this deployment's own credentials (its configuration directory's secret-typed names), honored only on a single-user host-lane deployment; ` +
     `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
-export const INHERIT_ENV_REFUSAL_REASONS = ["unknown_word", "not_a_string", "lane_not_host", "no_authorizer_session"];
+export const INHERIT_ENV_REFUSAL_REASONS = ["unknown_word", "not_a_string", "lane_not_host"];
 export function inheritEnvFacts(reason) {
     return { field: "inheritEnv", reason };
 }

package/dist/resource-suspend.d.ts

@@ -5,28 +5,19 @@
  * task opts in, a budget/turns/walltime limit OR a scheduler preempt durably SUSPENDS the task (resumable via
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
- * 🔴 EXCLUDE cascade tasks. Core runs a cascade through `runCascade`, which maps a rung's durable suspend to a FAILED
- * result carrying the pause (`errorCode: "unexpected.suspended"`, 内层 status "needs_review" 时铸 `"unexpected.needs_review"`,
- * 停驻因由在 `terminal.nestedPause` —— 真源是 core `agents/suspend-guard.js` 的 `mapNestedSuspend`;`suspended.*` 三码是 bg
- * 子代/委派报告面的词,不落在这条 TaskResult 腿上). A rung's pause lands on the rung's own engine-minted session, which the
- * host-boundary judge (`atHostBoundary`, src/terminal.ts) leaves terminal: the service would `setTerminal(failed)` while core
- * had already minted a pending `resource_limit` checkpoint + suspended the remote VM — ORPHANING both (the run row is
- * terminal, so nothing resumes them). A resource-limit hit on a cascade task must FAIL CLEANLY (no suspend).
- * (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended VM + checkpoint on every
- * cascade task that hits a resource limit.) The arm is the judge's session cell seen from the opt-in side: the day the engine
- * lets a rung's pause land on a session the host's resume chain reaches (core [ref]), the judge's answer flips and this arm goes.
- * Every other task — a verify task included — opts in alike. A verify task's implementation leg and fix rounds run on the
- * run's own session, so the judge lifts their pause into a park of the run row (resumable through
- * `POST /v1/assistant/tasks/:id/resume`); the verifier's own leg is built by the engine without an opt-in, so a limit there
- * still fails that leg.
+ * Every task opts in alike — plain, verify and cascade. A limit hit inside a composition comes back to the host as a nested
+ * pause (`failed.nestedPause`, core `mapNestedSuspend`), which the host-boundary judge (`atHostBoundary`, src/terminal.ts) lifts
+ * into a park of the run row: the card is filed under the run's session (`checkpoint.host_session_id` — a verify task's
+ * implementation leg and fix rounds run on that session; a cascade rung's card records its composition leg, whose host
+ * session is the run's), so `POST /v1/assistant/tasks/:id/resume` finds it from the run and continues it through the same
+ * composition entry the run was submitted with (`resumeWithVerification` / `resumeCascade`). The verifier's own leg is built by
+ * the engine without an opt-in, so a limit there still fails that leg.
  */
 export declare function resourceSuspendOptIn(opts: {
     /** `RESOURCE_SUSPEND=true` (the worker-level switch). */
     enabled: boolean;
     /** `RESOURCE_SUSPEND_TTL_SEC` — 0 ⇒ core default (30d) by omitting `ttlMs`. */
     ttlSec: number;
-    /** This task requested the cascade ladder (`body.cascade === true`). */
-    isCascade: boolean;
     /** Multi-tenant isolation key — the SAME key durableApproval uses (the principal; "_" when auth is off). */
     scope: string;
     /** [ref] S-3:`RESOURCE_SUSPEND_TOTAL_TOKENS`(跨片 token 总额)。0/缺省 ⇒ 不铸键。 */

package/dist/resource-suspend.js

@@ -1,5 +1,5 @@
 export function resourceSuspendOptIn(opts) {
-    if (!opts.enabled || opts.isCascade)
+    if (!opts.enabled)
         return undefined;
     return {
         scope: opts.scope,