@sema-agent/server 7.146.0 → 7.148.0

package/dist/stores-sql/windowed-session-storage.js

@@ -0,0 +1,70 @@
+import { InMemorySessionStorage, SessionError, leafIdAfterEntry } from "@sema-agent/core";
+export class WindowedSessionStorage {
+    view;
+    leaf;
+    constructor(metadata, entries, statedLeafId, floorEntryId) {
+        this.view = new InMemorySessionStorage({ metadata, entries, floorEntryId });
+        if (statedLeafId !== null && !entries.some((e) => e.id === statedLeafId)) {
+            throw new SessionError("corrupt_session", `Entry ${statedLeafId} not found — the log's leaf names an entry the log does not hold`);
+        }
+        this.leaf = statedLeafId;
+    }
+    getMetadata() {
+        return this.view.getMetadata();
+    }
+    async getLeafId() {
+        return this.leaf;
+    }
+    createEntryId() {
+        return this.view.createEntryId();
+    }
+    findEntries(type) {
+        return this.view.findEntries(type);
+    }
+    getLabel(id) {
+        return this.view.getLabel(id);
+    }
+    getPathToRoot(leafId) {
+        return this.view.getPathToRoot(leafId);
+    }
+    getEntries() {
+        return this.view.getEntries();
+    }
+    getFloorId() {
+        return this.view.getFloorId();
+    }
+    getReplayLoss() {
+        return this.view.getReplayLoss();
+    }
+    logMarkNow() {
+        return this.view.logMarkNow();
+    }
+    async windowFloorEntry() {
+        const floorId = this.view.getFloorId();
+        if (floorId === null)
+            return undefined;
+        const floor = await this.view.getEntry(floorId);
+        if (floor === undefined)
+            throw new SessionError("corrupt_session", `Entry ${floorId} not found — the window's floor names an entry the window does not hold`);
+        return floor;
+    }
+    async getEntry(id) {
+        return (await this.view.getEntry(id)) ?? (await this.readBelowFloor(id));
+    }
+    async appendEntry(entry, opts) {
+        await this.persist(entry, opts);
+        await this.record(entry);
+    }
+    async record(entry) {
+        await this.view.appendEntry(entry);
+        this.leaf = leafIdAfterEntry(entry);
+    }
+    async setLeafId(leafId, opts) {
+        if (leafId !== null && (await this.view.getEntry(leafId)) === undefined)
+            throw new SessionError("not_found", `Entry ${leafId} not found`);
+        const leafEntry = { type: "leaf", id: await this.view.createEntryId(), parentId: this.leaf, timestamp: new Date().toISOString(), targetId: leafId };
+        await this.persist(leafEntry, opts);
+        await this.record(leafEntry);
+    }
+}
+//# sourceMappingURL=windowed-session-storage.js.map

package/dist/submission-exit.d.ts

@@ -0,0 +1,50 @@
+import type { DeploymentShapeInput } from "./deployment-shape.js";
+import type { RunAcceptance } from "./run-acceptance.js";
+import type { SessionWithdrawFace } from "./plugins/session-birth.js";
+import type { SessionBirth, StoreKeptWord } from "./session-incarnation.js";
+/** 收场词(闭集;加词 ⇒ {@link SubmissionSeat.close} 的穷尽 switch 编译红)。 */
+export type SubmissionEnd = "accepted" | "record" | "refused";
+/** 「留」的词:店内七词 + 座内四词(`withdraw_failed` = 撤回事务抛了,按留答)。 */
+export type KeptWord = StoreKeptWord | "env" | "attached" | "accepted" | "record" | "withdraw_failed";
+/** 收场的结局(计数的 `verdict` 标签)。 */
+export type SubmissionVerdict = "withdrawn" | `kept_${KeptWord}`;
+/**
+ * 座读的部署件:计数口(缺 ⇒ 不计)与撤回之后的**进程内尾处理**(与 `DELETE /v1/sessions/:id` 同一组:会话登记簿四表 —— cwd / shellEnv / inheritEnv / 属主 ——
+ * 与 SSE watch 条目;缺 ⇒ 本部署没有那一张表)。
+ */
+export interface SubmissionSeatDeps {
+    /** 部署形(调用方递 `ServiceConfig` 整份):撤回之后记墓碑时,「同一位属主」的窄互认臂读它(`security.ts` 的 `sameSessionOwner`)。必填 —— 缺了就没有判据可记墓碑。 */
+    readonly deployment: DeploymentShapeInput<"principal">;
+    readonly metrics?: {
+        inc(name: string, labels?: Record<string, string>, n?: number): void;
+    };
+    /** 只清这一位住客的条目(记下的住客恰是候选 ⇒ 清、答 `true`)。 */
+    readonly dropSessionScopedOf?: (sessionId: string, incarnation: string) => boolean;
+    readonly sessionWatch?: {
+        dropSession(sessionId: string): void;
+    };
+}
+/** 一次提交的出口座(提交门在授权之前铸;三条提交腿只喂它、收它)。 */
+export interface SubmissionSeat {
+    /** 授权器登记新行时交来的候选与店的撤回面(只有新行臂调;调多次以第一次为准)。 */
+    noteBirth(birth: SessionBirth, face: SessionWithdrawFace): void;
+    /** 提交门铸好 spec 之后挂上受理座(闩的唯一读者在 {@link close})。 */
+    attachAcceptance(acceptance: Pick<RunAcceptance, "accepted">): void;
+    /** 本请求认领赢的耐久 run(四个建行点);同时按它的 run id 听执行环境见证(`env-witness.ts`,收场时注销)。 */
+    noteOwnRun(taskId: string): void;
+    /** 结果查询责任交给本请求自己的耐久 run(后台 run 的 202 / 断连转后台的流认领赢)。 */
+    markRecord(): void;
+    /** 执行环境为这次提交留下了按会话键的持久物。 */
+    noteEnvWitness(): void;
+    /** 此刻判不判得出「留」而不必走店(闩上 / record / 没有候选 / 有见证)。 */
+    readonly keepsWithoutWithdraw: boolean;
+    /** 收场(幂等、先到者定;不抛)。 */
+    close(): Promise<SubmissionVerdict>;
+    /** 终局应答的唯一写口:判得出「留」⇒ 立写;否则先收场({@link close},撤回事务落定)再写。交回的承诺在写完时兑现。持流的腿在引擎最后一笔会话写之后才调(终帧暂存在腿里)。 */
+    deliverTerminal(write: () => void): Promise<void>;
+}
+/** 铸一只出口座(提交门在授权之前调;不经提交门的车道没有座)。 */
+export declare function createSubmissionSeat(deps: SubmissionSeatDeps): SubmissionSeat;
+/** 拒的写口:提交门之后(有座)⇒ 经 {@link SubmissionSeat.deliverTerminal};提交门之前(没有座,集外:还没铸会话)⇒ 当场写。 */
+export declare function deliverVia(seat: Pick<SubmissionSeat, "deliverTerminal"> | undefined, write: () => void): Promise<void>;
+//# sourceMappingURL=submission-exit.d.ts.map

package/dist/submission-exit.js

@@ -0,0 +1,108 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+import { listenEnvWitness } from "./env-witness.js";
+import { retireSessionId } from "./deleted-session-ids.js";
+import { seatText } from "./trace/exit-seat.js";
+export function createSubmissionSeat(deps) {
+    let birth;
+    let acceptance;
+    let ownTaskId;
+    let recorded = false;
+    let witnessed = false;
+    let closing;
+    let unlisten;
+    const endNow = () => (acceptance?.accepted === true ? "accepted" : recorded ? "record" : "refused");
+    const settle = async () => {
+        const end = endNow();
+        let verdict;
+        switch (end) {
+            case "accepted":
+                verdict = "kept_accepted";
+                break;
+            case "record":
+                verdict = "kept_record";
+                break;
+            case "refused":
+                verdict = await withdrawOrKeep();
+                break;
+            default: {
+                const unknownEnd = end;
+                throw new Error(`submission exit: no end word ${JSON.stringify(unknownEnd)}`);
+            }
+        }
+        deps.metrics?.inc("submission_exit_total", { end, verdict });
+        return verdict;
+    };
+    const withdrawOrKeep = async () => {
+        if (birth === undefined)
+            return "kept_attached";
+        if (witnessed)
+            return "kept_env";
+        let out;
+        try {
+            out = await birth.face.withdrawBirth(birth.birth, ownTaskId);
+        }
+        catch (err) {
+            recordFailOpen("server.submission-exit.withdraw-failed", `session=${birth.birth.sessionId} err=${seatText("operator-log-text", err instanceof Error ? err.message : String(err))}`);
+            return "kept_withdraw_failed";
+        }
+        if (!out.withdrawn)
+            return `kept_${out.kept}`;
+        endWithdrawnTenancy(birth.birth);
+        return "withdrawn";
+    };
+    const endWithdrawnTenancy = (b) => {
+        retireSessionId(b.sessionId, b.owner, deps.deployment);
+        if (deps.dropSessionScopedOf?.(b.sessionId, b.incarnation) === true)
+            deps.sessionWatch?.dropSession(b.sessionId);
+    };
+    const seat = {
+        noteBirth(b, face) {
+            if (birth === undefined)
+                birth = { birth: b, face };
+        },
+        attachAcceptance(a) {
+            acceptance = a;
+        },
+        noteOwnRun(taskId) {
+            ownTaskId = taskId;
+            if (closing !== undefined || birth === undefined)
+                return;
+            unlisten?.();
+            unlisten = listenEnvWitness(taskId, () => seat.noteEnvWitness());
+        },
+        markRecord() {
+            recorded = true;
+        },
+        noteEnvWitness() {
+            witnessed = true;
+        },
+        get keepsWithoutWithdraw() {
+            return birth === undefined || witnessed || endNow() !== "refused";
+        },
+        close() {
+            if (closing === undefined) {
+                unlisten?.();
+                unlisten = undefined;
+                closing = settle();
+            }
+            return closing;
+        },
+        async deliverTerminal(write) {
+            if (closing === undefined && seat.keepsWithoutWithdraw) {
+                write();
+                return;
+            }
+            await seat.close();
+            write();
+        },
+    };
+    return seat;
+}
+export async function deliverVia(seat, write) {
+    if (seat === undefined) {
+        write();
+        return;
+    }
+    await seat.deliverTerminal(write);
+}
+//# sourceMappingURL=submission-exit.js.map

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "principalHeader" | "toolAxes" | "cardUrl" | "allowSkills")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -80,6 +80,12 @@ export declare function validateRequestA2a(raw: unknown): {
     ok: A2aDraft[];
     dropped: A2aInjectionDrop[];
 } | null;
+/**
+ * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.__proto__`:成员名过回显清洗,只会是读器的保留名,不带值、不带调用方写的对端名)——
+ * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},续跑重放腿的读法;新提交腿上同一形由判官表 400)。
+ * 挂不上的对端不算(整条不进,有自己的留声)。`storedToolAxes` = 续跑重放腿递的 M19 重读座。不是数组 ⇒ 空。
+ */
+export declare function requestA2aHeadersUnread(raw: unknown, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * 请求体 `a2aPeers`「这份声明能不能原样用」的回答者(与 MCP 的 `requestMcpDeclarationRefusal` 同一副骨架、同一个拒形):
  *  ① **列表**:在场却不是数组 / 超过 {@link MAX_REQUEST_A2A_PEERS} 条(撞帽机读位一组键)/ 某一条不是对象 ⇒ `400 request.field_invalid`;

package/dist/task-a2a.js

@@ -7,7 +7,7 @@ import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { createMountSeat, declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 import { sendHeaderOwnershipIssue } from "./task-mcp.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
@@ -33,13 +33,13 @@ export const A2A_PEER_DISPOSITION = {
 export const A2A_PEER_ENTRY_KEYS = declarationKeys(A2A_PEER_DISPOSITION);
 const A2A_PEER_ENTRY_KEY_SET = new Set(A2A_PEER_ENTRY_KEYS);
 const NO_TOLERATED_KEYS = new Set();
-const A2A_SEAT = {
+const A2A_SEAT = createMountSeat({
     list: "a2aPeers",
     cap: MAX_REQUEST_A2A_PEERS,
     subject: "peer",
     declaration: "an A2A peer declaration",
     declarations: "A2A peer declarations",
-};
+});
 function peerUrlIssue(key) {
     return (entry, at) => {
         const value = entry[key];
@@ -244,21 +244,18 @@ export function validateRequestA2a(raw) {
 }
 function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw === undefined || raw === null)
-        return { ok: [], dropped: [], toolAxesReread: [], headersLost: [] };
+        return { ok: [], dropped: [], toolAxesReread: [] };
     if (!Array.isArray(raw))
         return null;
     const ok = [];
     const dropped = [];
     const toolAxesReread = [];
-    const headersLost = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
         if (read.draft !== null) {
             ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
                 toolAxesReread.push({ peer: read.draft.spec.name, sentence: read.toolAxesReread });
-            if (read.headersLost !== undefined)
-                headersLost.push({ peer: read.draft.spec.name, lost: read.headersLost });
         }
         else
             dropped.push({ peer: declaredName(e).slice(0, 128), ...read.because });
@@ -266,7 +263,20 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw.length > MAX_REQUEST_A2A_PEERS) {
         dropped.push({ peer: `(+${raw.length - MAX_REQUEST_A2A_PEERS} over cap of ${MAX_REQUEST_A2A_PEERS})`, ...declarationOverCapFacts(A2A_SEAT, raw.length) });
     }
-    return { ok, dropped, toolAxesReread, headersLost };
+    return { ok, dropped, toolAxesReread };
+}
+export function requestA2aHeadersUnread(raw, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
+        const at = `${A2A_SEAT.list}[${i}]`;
+        const read = normalizeA2aPeer(e, "resume", at, storedToolAxes);
+        if (read.draft !== null)
+            for (const member of read.headersLost ?? [])
+                out.push(`${at}.${member}`);
+    }
+    return out;
 }
 function requestA2aPeerRefusal(entry, at) {
     const snapshot = snapshotPeer(entry, false);
@@ -323,15 +333,6 @@ export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger
             note: "this replayed request was stored before the upgrade and the peer's toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade reader reads it (members that do not fit are dropped) and the peer stays mounted — once the window closes the same request leaves this peer unmounted",
         });
     }
-    for (const h of v.headersLost) {
-        if (baselineNames.has(h.peer))
-            continue;
-        logger?.warn("a2a_peer_headers_members_dropped", {
-            peer: h.peer,
-            lost: h.lost,
-            note: "this replayed request carries a headers member named \"__proto__\" for this peer (the engine refuses that name); the peer stays mounted with every other header as written, the named member left out. A new submission with the same peer leaves it unmounted",
-        });
-    }
     return merged;
 }
 //# sourceMappingURL=task-a2a.js.map

package/dist/task-cwd.d.ts

@@ -32,9 +32,9 @@ export declare function dirCoversPath(dir: string, target: string): boolean;
  *      刻意的单写者惯用法,不是疏漏:在消费端补第二道闸 = 把一条不变量拆给两个属主(同族消费者
  *      {@link effectiveHostWorkspace} 形状完全相同)。机器背书 = test/task-cwd.test.ts 的 [ref] 两格。
  *   2. 🔴 **前瞻/防御臂,本仓当前装配下零命中**([ref],2026-08-19 合并重扫 partial,存活断言):
- *      in-process 单用户 lane(部署形表行 `inProcessSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
- *      服务一个真部署形,其实到不了 —— 该 lane 的 `remoteExec` 未设 ⇒ boot/execution-env.ts 六条工厂臂全
- *      不命中 ⇒ core 落 `StubExecutionEnv` ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
+ *      无手(`none`)单用户 lane(部署形表行 `noHandsSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
+ *      服务一个真部署形,其实到不了 —— 该 lane 声明没有执行环境 ⇒ boot/execution-env.ts 的工厂臂全
+ *      不命中、执行环境座也不给 ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
  *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleOffers` ⇒ 本函数在规则车道上根本不被调用;同 lane
  *      第 1 臂也因写侧闸只在 `callerCwd` 下开而恒空。危害口径按 refuter **降级**:死枝 ≡ 落第 3 臂
  *      `undefined` ≡ core global 缺省 ≡ [ref] 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
@@ -102,4 +102,32 @@ export declare function effectiveHostWorkspace(sessionCwd: string | undefined, c
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/** {@link launchWorkspaceOf} 读到的那一格出自哪里(闭集;起服那一行日志与随包文档的 `workspaceFrom` 词)。 */
+export type LaunchWorkspaceFrom = "workspace-flag" | "host-workspace-base" | "process-cwd";
+/** 起服时的「工作区」:目录 + 它读自哪一格。 */
+export interface LaunchWorkspace {
+    readonly dir: string;
+    readonly from: LaunchWorkspaceFrom;
+}
+/** 读起服工作区要看的部署事实(`ServiceConfig` 结构上满足:只有 `host` 车道有 `workspaceBase`)。 */
+export interface LaunchWorkspaceDeployment {
+    readonly remoteExec: {
+        readonly provider: string;
+        readonly workspaceBase?: string | undefined;
+    };
+}
+/**
+ * **起服时「工作区」的唯一读链**:显式给的(`run-local --workspace`)?? 部署声明的车道工作区底(`REMOTE_EXEC=host` 的 `HOST_WORKSPACE_BASE`)?? 本进程的工作目录。
+ * 两个入口读同一只:`run-local` 的 `workspaceDir`(它的手就跑在这个目录里)与 HTTP 服务起服时的「配置根是不是工作区祖先」那一判(`sema-config-dir.ts`)。
+ * 它回答的是**起服时本服务知道**的那一个目录;请求体里按任务给的 `cwd`(每会话登记)起服时不可知,不在这条链里。
+ */
+export declare function launchWorkspaceOf(config: LaunchWorkspaceDeployment, explicit?: string, cwd?: () => string): LaunchWorkspace;
+/**
+ * run 外回退口问「host 工厂这一次会落在一只**实在的**目录上吗」:根 = {@link effectiveHostWorkspace}(引擎 run 外环境请求的上下文归约成 `{}` ⇒ 就是登记的 cwd),
+ * 且它此刻是盘上的一只目录 ⇒ 交回它;没有根,或那只目录**不在**(`ENOENT` / `ENOTDIR`,或在但不是目录)⇒ `undefined`(调用方答 409:根不可知)。
+ * 「看不到」不是「不在」:其余 errno(`EACCES` / `ELOOP` / `EIO`)原样抛 —— 路由未分类 500 + 运维 warn,与 `memory-store-refusal.ts` 的解析故障同读法;
+ * 把它读成 409 会把一只权限 / 环路故障遮成「用户把目录移走了」。三态读法同 `project-identity.ts` 的 statFact。
+ * 只读不建:工厂对一只消失的 cwd 会 `mkdir -p` 把它建回来(那是 run 的读法),回退不许替用户把移走的目录建回来再往里写。
+ */
+export declare function presentHostWorkspaceOf(sessionCwd: string | undefined): Promise<string | undefined>;
 //# sourceMappingURL=task-cwd.d.ts.map

package/dist/task-cwd.js

@@ -1,4 +1,6 @@
 import path from "node:path";
+import { stat } from "node:fs/promises";
+import { errorCodeOf } from "./observability/err-text.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export function normalizeAbsolutePathLexically(p) {
@@ -11,7 +13,7 @@ export function dirCoversPath(dir, target) {
     return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 export function cardRuleScopeRoot(registeredCwd, config, cwd = process.cwd) {
-    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config) ? cwd() : undefined);
+    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) ? cwd() : undefined);
     return raw === undefined ? undefined : path.resolve(raw);
 }
 export function satisfiedByProcessCwd(requested, realpath, cwd = process.cwd) {
@@ -44,4 +46,26 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export function launchWorkspaceOf(config, explicit, cwd = process.cwd) {
+    if (explicit !== undefined)
+        return { dir: explicit, from: "workspace-flag" };
+    const base = config.remoteExec.provider === "host" ? config.remoteExec.workspaceBase : undefined;
+    if (base !== undefined)
+        return { dir: base, from: "host-workspace-base" };
+    return { dir: cwd(), from: "process-cwd" };
+}
+export async function presentHostWorkspaceOf(sessionCwd) {
+    const root = effectiveHostWorkspace(sessionCwd, {});
+    if (root === undefined)
+        return undefined;
+    try {
+        return (await stat(root)).isDirectory() ? root : undefined;
+    }
+    catch (err) {
+        const code = errorCodeOf(err);
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw err;
+        return undefined;
+    }
+}
 //# sourceMappingURL=task-cwd.js.map

package/dist/task-mcp.d.ts

@@ -71,7 +71,7 @@ export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrig
 /** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
 export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("env" | "kind" | "args" | "command")[];
 /** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("headers" | "url" | "kind" | "principalHeader" | "assertionHeader")[];
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("url" | "headers" | "kind" | "principalHeader" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -121,6 +121,14 @@ type ValidatedRequestMcp = {
         value: string;
     }>;
 };
+/**
+ * 一份请求的 `mcpServers` 里,读器挂得上、transport 却有几处不交给引擎的那些坐标(`mcpServers[<下标>].transport.headers` / `….env.__proto__` 一类:只有键路径,
+ * 成员名只会是读器的保留名,不带值、不带调用方写的 server 名)—— 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 MCP 一座。
+ * 读器与挂载同一只({@link normalizeServer},契约包 `readRequestMcpTransport` 报的 `lost`);挂不上的条目(硬坏形)不算 —— 它们整条不挂、有自己的通告;
+ * 名字在 `closed`(部署占住的名字,{@link deploymentClosedMcpNames})里的条目也不算 —— 合并时输给部署(`name_reserved_by_deployment`),它的 transport 一处都不会交给引擎。
+ * `storedToolAxes` = 续跑重放腿递的 M19 重读座(同一只条目在挂载时也经它判挂不挂得上)。不是数组 ⇒ 空(整只忽略那一臂,不是本判据的事)。
+ */
+export declare function requestMcpTransportUnread(raw: unknown, closed: ReadonlySet<string>, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -181,8 +189,8 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 重放腿走读器({@link normalizeServer} / {@link classifyRequestMcp}),处置:整只不是数组 ⇒ 整只忽略 + 运维 warn `mcp_injection_ignored`;条目不是对象 / 坏硬键
  * (`name` / `transport` 硬字段 / `allowTools` / `toolAxes` / `toolFaces`)⇒ 这一条 server 整条不进 + 运维 warn `mcp_injection_dropped` + 用户面通告 `mcp.injection_dropped` 点名 `field`
  * (`toolAxes` 在一次性迁移 M19 的窗开着时先按升级前读法重读一次,过了就挂,见读器的注);超上限的尾项 ⇒ `over_cap` 点名;坏软键(`contentOrigin` / `elicitation` / `source`)
- * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段 ⇒ 只不交坏的那几处(`env` / `headers` 对 JSON 存体按 7.131.x 的判据整键交或不交,
- * 交出去的剔掉 `__proto__` 名成员),server 照挂,运维 warn `mcp_transport_members_dropped` 逐处点名 —— 续跑重放腿不静默丢声明。
+ * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫 `__proto__` 的成员、
+ * `args` / `principalHeader` 坏形)⇒ 这份请求不重放(「请求成员读不出」那一只判据,`unread-request-members.ts`,经 {@link requestMcpTransportUnread} 读这一座;续跑腿折 409)。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
 /** 一次发送从一份声明里带出的头:件头(调用方原样写的名 → 值,由对端座按原字节作答)与身份头名(引擎按主体写值)。 */

package/dist/task-mcp.js

@@ -10,7 +10,7 @@ import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { MALFORMED_NAME, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { MALFORMED_NAME, createMountSeat, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -93,22 +93,31 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
     const dropped = [];
     const badContentOrigin = [];
     const toolAxesReread = [];
-    const transportLost = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
                 toolAxesReread.push({ server: v.spec.name, sentence: v.toolAxesReread });
-            if (v.transportLost.length > 0)
-                transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread, transportLost };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
+}
+export function requestMcpTransportUnread(raw, closed, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_MCP_SERVERS).entries()) {
+        const v = normalizeServer(e, () => undefined, storedToolAxes);
+        if (v.ok && !closed.has(v.spec.name))
+            for (const issue of v.transportLost)
+                out.push(`mcpServers[${i}].${issue.path}`);
+    }
+    return out;
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -143,13 +152,13 @@ export function requestMcpDeclarationRefusal(list) {
 export function assertRequestMcpEntries(bodyMcp) {
     throwDeclarationRefusal(requestMcpDeclarationRefusal(bodyMcp));
 }
-const MCP_SEAT = {
+const MCP_SEAT = createMountSeat({
     list: "mcpServers",
     cap: MAX_REQUEST_MCP_SERVERS,
     subject: "server",
     declaration: "an MCP server declaration",
     declarations: "MCP server declarations",
-};
+});
 const ENTRY_KEY_SET = new Set(MCP_SERVER_ENTRY_KEYS);
 const STDIO_TRANSPORT_KEY_SET = new Set(STDIO_MCP_TRANSPORT_KEYS);
 const HTTP_TRANSPORT_KEY_SET = new Set(HTTP_MCP_TRANSPORT_KEYS);
@@ -324,18 +333,6 @@ function classifyHonored(baseline, entries, config, desk, lease, logger, storedT
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
-    for (const t of v.transportLost) {
-        if (!mounted.has(t.server))
-            continue;
-        logger?.warn("mcp_transport_members_dropped", {
-            server: t.server,
-            lost: t.lost.slice(0, MAX_KEY_ECHO),
-            ...(t.lost.length > MAX_KEY_ECHO ? { lostTotal: t.lost.length } : {}),
-            note: "this replayed request carries parts of this server's transport declaration that cannot be handed to the engine — an env / headers record that is not a plain object of string values (left out whole, as the pre-upgrade server read it), " +
-                "a member named \"__proto__\" in env / headers (only that member is left out: the engine refuses the name), args that are not a list of strings, a principalHeader that is not a string; " +
-                "the server mounts with the rest. A new submission with the same entry is refused (400)",
-        });
-    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toMcpDraft), reservedNames, desk, lease),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],

package/dist/task-settings.d.ts

@@ -57,6 +57,7 @@ import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import type { EntryPermissionMode } from "./runtime-governance.js";
+import { type SessionExemptionRead } from "./approval.js";
 import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
@@ -309,6 +310,8 @@ export interface SettingsEnvCredentialIssue {
 export interface SettingsEnvLayer {
     readonly sent: boolean;
     readonly reaching: Readonly<Record<string, string>> | undefined;
+    /** 送来的值里有读者不交出去的东西({@link settingsEnvUnreadable}:不是对象 / 过帽 / 有成员读不出;空记录不算)—— 解析层据它报 `deferred: ["env"]`。 */
+    readonly unreadable: boolean;
 }
 /** `settings.env` 的**唯一**读法:`settings` 不是对象 ⇒ 没送;否则 `env` 只取一次,形判与收取都对这一次的值做。判据、解析层与续跑腿的剥键都吃这一份。 */
 export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
@@ -317,6 +320,16 @@ export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
  * 缺席 / 形不对 ⇒ `undefined` ⇒ 不判,形归受理门的形判)。`credentialNames` = 本进程的凭据变量名(调用方递 `serverCredentialValueSources(config.modelApiKeyEnv)`)。没有命中 ⇒ `null`。
  */
 export declare function settingsEnvCredentialIssue(reaching: Readonly<Record<string, string>> | undefined, credentialNames: readonly string[]): SettingsEnvCredentialIssue | null;
+/** {@link settingsEnvComposeIssue} 的产物:wire 文案 + 机读位(`field` 恒为 `settings.env`)。 */
+export interface SettingsEnvComposeIssue {
+    readonly message: string;
+    readonly field: "settings.env";
+}
+/**
+ * `settings.env` 里环境合成会拒的名 / 值的**受理判**(纯函数;律见上方段头)。`reaching` = {@link readSettingsEnv} 读出的那一份;缺席 / 形不对 ⇒ `undefined` ⇒ 不判(形归受理门的形判)。
+ * 没有话 ⇒ `null`;判官有话 ⇒ 句子 = 本站的头 + 判官的拒因原句(经调用方串的唯一回显口径:判官的句子里会点名变量名,名字是调用方写的串;值从不在句子里)+ 收尾。
+ */
+export declare function settingsEnvComposeIssue(reaching: Readonly<Record<string, string>> | undefined): SettingsEnvComposeIssue | null;
 /**
  * 一次性迁移 M38(窗口见 `plugins/one-time-migrations.ts` 登记表):从读到的那一份里去掉判据点名的原键,交回剥后的一份。**剥空 = 空表**(调用方送了这一块,剥完什么都不剩):
  * 解析层把它当作这次请求的环境层原样交出,`resolveSpec` 登记它 —— 覆盖这条会话上一条登记;若读成「缺席」,会话注册表按「缺席 = 留着上一条」把上一条(可能正是被剥的那个名字)留给 shell。
@@ -358,11 +371,11 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *
  *  🔴 `readDenyPatterns` / `writeProtectedExtra` / `complianceAdditionalDenies` 与 `permissions.neverAuto`([ref])= **「只收紧」座位族**:消费点 = `tighten-only-seats.ts`
  *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
- *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
+ *  (sdk 的 `SemaSettings` 已声明这四个键 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 逐键咬 server 与 sdk 两面一致)。
  *
  *  🔴 `approvalFrameFamilies`([ref])= 这条 run 的客户端**声明**渲染得了哪些审批开卡帧族 —— 不进引擎,不是 CC settings 键。消费点 = 三条执行腿的审批装配
  *  (`tool-approval.ts` 的唯一读者 `declaredApprovalFrameFamilies` → `resolveApprovalLeg`),判官 `approvalFrameFamiliesIssue`(fresh 受理 400 与宽容读者同一只)。
- *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面待声明(对账门的「server 先于 sdk」登记表记着)。
+ *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面已声明(同一只对账门咬)。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
@@ -416,11 +429,14 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 一只匹配组 / 一个条目上**读者不携带**的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);全部携带 ⇒ `null`。
  *
  * 词表 = **读者自己的答案**:`config` 是同一份 `raw` 经 {@link parseHooksConfig} 受理的产物,一只组 / 一个条目受理的键 = 可跑形在同一坐标上那只对象的键
- * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin` / `args`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理;
- * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksCoordinate}(契约包出门形 + 回显口径;凭据形键段不原样回显)。
+ * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理
+ * (契约包 19.0.0 承运 command 的 `args` / `onFailure` 与 http 的 `onFailure`、20.0.0 承运 command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、
+ * prompt 的 `continueOnBlock` 时,这里一行未改就受理了它们 —— 受理 = 读者携带;后四键本服务如实带、不执行,能力位与契约附录明写);
+ * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksFieldCoordinate}(请求坐标的唯一写法,方括号形 + 回显口径;凭据形键段不原样回显)。
  *
  * 判据边界(与另两个实例同):只判**键名**(值形归读者);拒只在 FRESH 提交面 —— 续跑重放走 {@link parseTaskSettings},读者照旧剥掉它不携带的键,存量体按受理时的读法重放(4xx 打在重放腿上会砖死停驻任务)。
- * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— 守卫条目上的 `onFailure: "block"` 被剥掉,守卫起不来时照放行;`plugin` / `args` 写在 http 条目上被剥掉,写的人以为插件上下文在。
+ * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— `plugin` 写在 http 条目上被剥掉,写的人以为插件上下文在;`args` 写在 http 条目上被剥掉,写的人以为不过 shell;
+ * `onFailure: "block"` 写在 prompt 条目上被剥掉(契约只在 command / http 上承运),写的人以为守卫起不来时失效关闭。
  */
 export declare function hooksKeyIssue(raw: unknown, config: RunnableHooksConfig): KeyClosureIssue | null;
 /**
@@ -457,14 +473,7 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
  *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
-export declare function createWorkflowAskPolicy(isExempt?: WorkflowGateWiring["isExempt"]): ToolPolicy;
-/** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
- *  fs-independent: one shape on every execution lane. */
-export interface WorkflowGateWiring {
-    /** The session "don't ask again" probe (approvalExemptionStore.has, raw toolName key) — the same store and key space the
-     *  approval seat's standing grants read; one remember="session" grant serves them all. */
-    isExempt?: (toolName: string) => boolean | Promise<boolean>;
-}
+export declare function createWorkflowAskPolicy(exemption?: SessionExemptionRead): ToolPolicy;
 /**
  * 请求的 deny / ask 两张表解析路径形规则用的**基**(`resolve-spec.ts` 每请求供)。只有这两件事:这条 task 的真根、执行环境的 home。
  * 缺席 ⇒ 不声明(规则锚在装入这只策略的那条腿的真根,`~/` 形由 {@link rejectUnmatchableSettingsNames} 响亮拒)。
@@ -524,7 +533,7 @@ export interface FsWriteGateWiring {
 }
 /**
  * 请求的 `settings.permissions.deny` / `ask` 有永远不生效的条目 ⇒ 拒点({@link rejectUnmatchableSettingsNames})抛的错:句子(`message`)与这一遍判下来的**全部**问题(`problems`,机读位的原料)。
- * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体带 `field` + `detail.problems`);其余出口(收紧不得放宽)仍抛普通 `Error`。
+ * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体根上带 `field` + `problems` + `total`);其余出口(收紧不得放宽)仍抛普通 `Error`。
  */
 export declare class SettingsRuleRefusalError extends Error {
     readonly problems: readonly EntryProblem[];