@sema-agent/server 7.147.0 → 7.148.0

package/dist/config.js

@@ -1,9 +1,10 @@
+import { writeLogText } from "./observability/logger.js";
 import { readFileSync } from "node:fs";
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
+import { hostOfUrl, HOST_UNREADABLE_SENTENCE, compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -24,11 +25,13 @@ import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
 import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
+import { RUN_STALE_SEC_DEFAULT } from "./run-stale-default.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
+import { ASSUMED_CONTEXT_WINDOW } from "./model-context-window.js";
+import { MODEL_THINKING_LEVELS, THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isModelThinkingLevel, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
-import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, isRetiredWithoutSuccessor, retiredWithoutSuccessorEntries, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
+import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, isRetiredLeftOut, retiredLeftOutEntries, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal, operatorSingleUserRefusal, remoteConfigProviderUrlRefusal, retentionLaneRefusal, workflowParkDecisionDomainRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
@@ -42,11 +45,12 @@ import { sandboxForwardedEnvOf } from "./execution-config-root.js";
 import { SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS, laneMissingEnv, readDeclaredLaneTable } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { deploymentRuleRefusal } from "./rule-issue-reading.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { readReadDenyEntry } from "./read-deny-entry.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
-import { modelProviderRefusal } from "./model-provider.js";
+import { catalogBrainLane, modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { DEVICE_RELAY_NONE, DEVICE_RELAY_RULE, deviceRelayFlaws, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
@@ -54,9 +58,10 @@ import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { anthropicCredentialRefusal, csvOf, declaredCredential, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { echoCallerText } from "./caller-text-echo.js";
+import { PRINCIPAL_MAX_BYTES, principalShapeProblem } from "./principal-shape.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { parseConfigLocalOwnerUid } from "./config-dir-trust.js";
-import { allowlistedEnv } from "./server-secret-env.js";
+import { allowlistedEnv, ownCredentialDeclarationRefusal } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
@@ -170,6 +175,10 @@ function nonNegativeIntEnv(name, role, fallback = "0") {
         throw new Error(`env ${name}=${n} must be an integer(${role};计数轴不接受小数——单位写漏了?)`);
     return n;
 }
+function parseLocalDockerCapacityEnv() {
+    const maxContainers = nonNegativeIntEnv("DOCKER_MAX_CONTAINERS", "local-docker 车道同时在跑的容器数上限");
+    return maxContainers > 0 ? { maxContainers } : undefined;
+}
 function numEnvBounded(name, fallback, min, max) {
     const n = numEnv(name, fallback);
     if (n < min || n > max)
@@ -1061,13 +1070,22 @@ function parseModelDomain() {
     }
     const extraBody = buildExtraBody();
     const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
-    const envApi = provider === "anthropic" ? "anthropic-messages" : "openai-completions";
+    const envLaneWire = ((lane) => {
+        switch (lane) {
+            case "anthropic":
+                return { api: "anthropic-messages", promptCacheFamily: "input-excludes-cached" };
+            case "gateway":
+                return { api: "openai-completions", promptCacheFamily: "input-includes-cached" };
+        }
+    })(catalogBrainLane(provider));
+    const envApi = envLaneWire.api;
     const envCompatDeclared = buildModelCompat("openai-completions", {
         reasoningEffortLevels: parseReasoningEffortLevels(csv("MODEL_REASONING_EFFORT_LEVELS")),
         thinkingFormat: parseThinkingFormat(process.env.MODEL_THINKING_FORMAT),
     });
     const envCompat = envApi === "openai-completions" ? envCompatDeclared : undefined;
     const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
+    const contextWindow = numEnv("MODEL_CONTEXT_WINDOW", String(ASSUMED_CONTEXT_WINDOW));
     const model = {
         id: modelId,
         name: modelId,
@@ -1081,12 +1099,12 @@ function parseModelDomain() {
             cacheRead: costEnv("MODEL_COST_CACHE_READ", "unset"),
             cacheWrite: costEnv("MODEL_COST_CACHE_WRITE", "unset"),
         }, undefined)),
-        contextWindow: numEnv("MODEL_CONTEXT_WINDOW", "262144"),
+        contextWindow,
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
             ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
-            : Math.min(32000, numEnv("MODEL_CONTEXT_WINDOW", "262144")),
+            : Math.min(32000, contextWindow),
         ...(optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") } : {}),
-        params: { promptCacheFamily: provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
+        params: { promptCacheFamily: envLaneWire.promptCacheFamily },
         ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
         ...(envCompat ? { compat: envCompat } : {}),
         ...(extraBody ? { extraBody } : {}),
@@ -1249,11 +1267,9 @@ function parseDefaultThinking(raw) {
     const v = raw?.trim();
     if (v === undefined || v === "")
         return undefined;
-    if (v === "off")
-        return undefined;
-    if (!isThinkingTier(v)) {
-        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a thinking tier — valid: ${THINKING_LEVELS.join(" | ")} | off ` +
-            `("off" = no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
+    if (!isModelThinkingLevel(v)) {
+        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a model thinking tier — valid: ${MODEL_THINKING_LEVELS.join(" | ")} ` +
+            `("off" = the model's requests default to thinking off; leave it unset for no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
     }
     return v;
 }
@@ -1263,7 +1279,7 @@ function parseReasoningEffortLevels(words) {
     const bad = words.filter((w) => !isThinkingTier(w));
     if (bad.length > 0) {
         throw new Error(`env MODEL_REASONING_EFFORT_LEVELS has unknown tier(s): ${bad.join(", ")} (valid: ${THINKING_LEVELS.join(" | ")})` +
-            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (no model-level default), it is not an effort tier an endpoint can accept' : ""}. ` +
+            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (the model default tier), it is not an effort tier an endpoint can accept' : ""}. ` +
             `Bad words used to be dropped SILENTLY, narrowing the declared ladder without a word (#210 A 档).`);
     }
     return words.filter(isThinkingTier);
@@ -1301,7 +1317,7 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    return { code: issue.code, guidance: `${issue.code} — core's rule grammar cannot compile this entry: ${issue.message}` };
+    return deploymentRuleRefusal(issue);
 }
 function findUnmatchableToolNames(names, opts) {
     const out = [];
@@ -1315,7 +1331,7 @@ function findUnmatchableToolNames(names, opts) {
         }
         const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
         const judged = unmatchableRuleNameOf(subject, opts.behavior);
-        const verdict = opts.noticeSeat !== undefined && isRetiredWithoutSuccessor(judged) ? undefined : judged;
+        const verdict = opts.noticeSeat !== undefined && isRetiredLeftOut(name) ? undefined : judged;
         if (verdict?.kind === "retired") {
             out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject), reason: verdict.kind });
             continue;
@@ -1421,7 +1437,7 @@ function parseApprovalDomain(ctx) {
         windowMsSource: streamAskWindowMsSource,
         onPostureYield: (facts) => {
             streamAskWindowMsEffectiveSource = "engine-default";
-            process.stderr.write(`[config] stream_ask_window_posture_yielded: the single-user posture default STREAM_ASK_WINDOW_MS=${facts.windowMs} would violate the explicit STREAM_APPROVAL_ORPHAN_TTL_MS=${facts.orphanTtlMs} (window + ADHOC_GRACE ${facts.adhocGraceMs} must be strictly less) — falling back to 300000; set STREAM_ASK_WINDOW_MS explicitly to choose\n`);
+            writeLogText("stderr", `[config] stream_ask_window_posture_yielded: the single-user posture default STREAM_ASK_WINDOW_MS=${facts.windowMs} would violate the explicit STREAM_APPROVAL_ORPHAN_TTL_MS=${facts.orphanTtlMs} (window + ADHOC_GRACE ${facts.adhocGraceMs} must be strictly less) — falling back to 300000; set STREAM_ASK_WINDOW_MS explicitly to choose`);
         },
     });
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
@@ -1431,7 +1447,7 @@ function parseApprovalDomain(ctx) {
         const unmatchable = unmatchableToolNamesRefusal(envName, names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR, noticeSeat: "server" });
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
-        const skipped = retiredWithoutSuccessorEntries(names, NAME_TABLE_BEHAVIOR);
+        const skipped = retiredLeftOutEntries(envName, names);
         if (skipped.length > 0) {
             CONFIG_NOTICES.push({
                 level: "warn",
@@ -2009,13 +2025,8 @@ function parseOrchestrationDomain(ctx) {
     const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
     hostBackgroundShellEnabled();
     hostExecSpoolEnabled();
-    const lspHostEnabled = (() => {
-        if (process.env.LSP_ENABLED === "false") {
-            throw new Error("LSP_ENABLED=false no longer drives the HOST lane (removed in server 3.0.0) — set LSP_HOST_ENABLED=false " +
-                "for the host lane; LSP_ENABLED remains the SANDBOX-lane opt-in only (migration table in USAGE.md)");
-        }
-        return boolEnv("LSP_HOST_ENABLED", true);
-    })();
+    const lspHostEnabled = boolEnv("LSP_HOST_ENABLED", true);
+    const autoBackgroundOnTimeout = boolEnv("AUTO_BACKGROUND_ON_TIMEOUT", true);
     const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
     const declaredLane = declaredExecutionLane(process.env.REMOTE_EXEC);
     const readFaceFacts = process.env.READ_FACE !== undefined
@@ -2121,6 +2132,7 @@ function parseOrchestrationDomain(ctx) {
                                                             : {}),
                                                         ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
                                                         ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
+                                                        ...((capacity) => (capacity !== undefined ? { capacity } : {}))(parseLocalDockerCapacityEnv()),
                                                     }
                                                     :
                                                         declaredLane === "device"
@@ -2188,8 +2200,8 @@ function parseOrchestrationDomain(ctx) {
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true),
         envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true),
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
-        lspEnabled: boolEnv("LSP_ENABLED", false),
         lspHostEnabled,
+        autoBackgroundOnTimeout,
         lspEnvAllow,
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
@@ -2274,7 +2286,7 @@ function parseLimitsHttpDomain() {
             return sec;
         })(),
         reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
-        runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
+        runStaleSec: numEnv("REAP_RUN_STALE_SEC", String(RUN_STALE_SEC_DEFAULT)),
         toolResultTtlSec: (() => {
             const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
             if (ttl <= 0) {
@@ -2315,7 +2327,11 @@ function parseGitApiKind(raw, baseUrl) {
         throw new Error(`GIT_API_BASEURL="${buildDisplaySafeUrl(baseUrl)}" is not a valid URL (expected e.g. https://git.example.com)`);
     }
     const u = new URL(baseUrl);
-    const host = u.hostname.replace(/\.$/, "").toLowerCase();
+    const reading = hostOfUrl(baseUrl);
+    if ("unreadable" in reading) {
+        throw new Error(`GIT_API_BASEURL names no host — ${HOST_UNREADABLE_SENTENCE[reading.unreadable]} (expected e.g. https://git.example.com; the token goes in GIT_API_TOKEN)`);
+    }
+    const host = reading.host;
     const githubFamily = host === "github.com" || host === "api.github.com" || host.endsWith(".github.com");
     if (kind === "gitea" && githubFamily) {
         throw new Error(`GIT_API_BASEURL points at ${host} but GIT_API_KIND is "gitea" — the Gitea API shapes 404 on GitHub. Set GIT_API_KIND=github (base url should be https://api.github.com, or your GHE /api/v3 root).`);
@@ -2504,6 +2520,11 @@ function parseA2aServe() {
         blockingWaitMs: numEnvBounded("A2A_SERVE_BLOCKING_WAIT_MS", "45000", 0, 300_000),
     };
 }
+const A2A_SERVE_SKILLS_VERSION = 2;
+const A2A_SERVE_SKILL_KEYS = ["id", "name", "description", "scenario", "audience"];
+const A2A_SERVE_SKILL_ENTRY_SHAPE = "{id, name?, description?, scenario, audience?}";
+const A2A_SERVE_SKILLS_SHAPE = `{"version":${A2A_SERVE_SKILLS_VERSION},"skills":[${A2A_SERVE_SKILL_ENTRY_SHAPE}, …]}`;
+const A2A_SERVE_MAX_AUDIENCE = 64;
 function parseA2aServeSkills(raw) {
     if (raw === undefined || raw.trim() === "")
         return [];
@@ -2512,18 +2533,38 @@ function parseA2aServeSkills(raw) {
         parsed = JSON.parse(raw);
     }
     catch (e) {
-        throw new Error(`A2A_SERVE_SKILLS must be a JSON array of {id, name?, description?, scenario} objects — it did not parse as JSON (${e.message})`);
-    }
-    if (!Array.isArray(parsed))
-        throw new Error(`A2A_SERVE_SKILLS must be a JSON ARRAY of {id, name?, description?, scenario} objects; got ${typeof parsed}`);
-    if (parsed.length > A2A_SERVE_MAX_SKILLS)
-        throw new Error(`A2A_SERVE_SKILLS declares ${parsed.length} skills — at most ${A2A_SERVE_MAX_SKILLS} are accepted (the card is a public document fetched by anonymous callers)`);
+        throw new Error(`A2A_SERVE_SKILLS must be a JSON object ${A2A_SERVE_SKILLS_SHAPE} — it did not parse as JSON (${e.message})`);
+    }
+    if (Array.isArray(parsed)) {
+        throw new Error(`A2A_SERVE_SKILLS is a bare JSON array — that form is retired: the value is now a versioned envelope ${A2A_SERVE_SKILLS_SHAPE}. ` +
+            `Migrate by wrapping the old value unchanged: {"version":${A2A_SERVE_SKILLS_VERSION},"skills":<the old array>} (an \`audience\` member is only read inside the envelope).`);
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        throw new Error(`A2A_SERVE_SKILLS must be a JSON object ${A2A_SERVE_SKILLS_SHAPE}; got ${parsed === null ? "null" : typeof parsed}`);
+    const envelope = parsed;
+    for (const key of Object.keys(envelope)) {
+        if (key !== "version" && key !== "skills")
+            throw new Error(`A2A_SERVE_SKILLS carries an unknown key ${JSON.stringify(key.slice(0, 64))} — the envelope's keys are exactly "version" and "skills"`);
+    }
+    if (envelope.version !== A2A_SERVE_SKILLS_VERSION) {
+        throw new Error(`A2A_SERVE_SKILLS.version must be the number ${A2A_SERVE_SKILLS_VERSION} — this build reads exactly that envelope version (a different or missing version is refused rather than guessed: the version is what keeps a build from misreading a shape it does not know)`);
+    }
+    const skills = envelope.skills;
+    if (!Array.isArray(skills))
+        throw new Error(`A2A_SERVE_SKILLS.skills must be a JSON array of ${A2A_SERVE_SKILL_ENTRY_SHAPE} objects`);
+    if (skills.length > A2A_SERVE_MAX_SKILLS)
+        throw new Error(`A2A_SERVE_SKILLS declares ${skills.length} skills — at most ${A2A_SERVE_MAX_SKILLS} are accepted (the card is a public document fetched by anonymous callers)`);
     const seen = new Set();
-    return parsed.map((entry, i) => {
-        const at = `A2A_SERVE_SKILLS[${i}]`;
+    return skills.map((entry, i) => {
+        const at = `A2A_SERVE_SKILLS.skills[${i}]`;
         if (typeof entry !== "object" || entry === null || Array.isArray(entry))
-            throw new Error(`${at} must be an object {id, name?, description?, scenario}`);
+            throw new Error(`${at} must be an object ${A2A_SERVE_SKILL_ENTRY_SHAPE}`);
         const e = entry;
+        for (const key of Object.keys(e)) {
+            if (!A2A_SERVE_SKILL_KEYS.includes(key)) {
+                throw new Error(`${at} carries an unknown key ${JSON.stringify(key.slice(0, 64))} — an entry's keys are exactly ${A2A_SERVE_SKILL_KEYS.map((k) => JSON.stringify(k)).join(", ")} (an unknown key is refused, never dropped: a misspelt "audience" would otherwise publish the skill to everyone)`);
+            }
+        }
         const str = (key, required, max) => {
             const v = e[key];
             if (v === undefined) {
@@ -2544,7 +2585,36 @@ function parseA2aServeSkills(raw) {
         const name = str("name", false, A2A_SERVE_MAX_TEXT_CHARS);
         const description = str("description", false, A2A_SERVE_MAX_TEXT_CHARS);
         const scenario = str("scenario", true, A2A_SERVE_MAX_ID_CHARS);
-        return { id, ...(name !== undefined ? { name } : {}), ...(description !== undefined ? { description } : {}), scenario };
+        const audience = parseA2aServeAudience(e.audience, at);
+        return { id, ...(name !== undefined ? { name } : {}), ...(description !== undefined ? { description } : {}), scenario, ...(audience !== undefined ? { audience } : {}) };
+    });
+}
+function parseA2aServeAudience(v, at) {
+    if (v === undefined)
+        return undefined;
+    const rule = `must be a non-empty JSON array of at most ${A2A_SERVE_MAX_AUDIENCE} principal names (omit the key to publish the skill to every caller)`;
+    if (!Array.isArray(v) || v.length === 0)
+        throw new Error(`${at}.audience ${rule}`);
+    if (v.length > A2A_SERVE_MAX_AUDIENCE)
+        throw new Error(`${at}.audience lists ${v.length} principals — it ${rule}`);
+    return v.map((item, j) => {
+        if (typeof item !== "string")
+            throw new Error(`${at}.audience[${j}] must be a string (a principal name)`);
+        const problem = principalShapeProblem(item);
+        switch (problem) {
+            case undefined:
+                return item;
+            case "not_a_name":
+                throw new Error(`${at}.audience[${j}] is not a principal name (empty, or carries characters no verified identity can have) — list the exact principal names this skill is published to`);
+            case "reserved":
+                throw new Error(`${at}.audience[${j}] is a reserved internal identifier (an internal scope sentinel or a reserved prefix), which no caller can authenticate as — list real principal names`);
+            case "too_long":
+                throw new Error(`${at}.audience[${j}] exceeds ${PRINCIPAL_MAX_BYTES} UTF-8 bytes, longer than any principal a caller can authenticate as`);
+            default: {
+                const unknownProblem = problem;
+                throw new Error(`${at}.audience[${j}]: unknown principal-shape verdict ${String(unknownProblem)}`);
+            }
+        }
     });
 }
 const STORE_GROUP_KEYS = [
@@ -2580,7 +2650,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs", "backgroundAgentStallMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
-    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspHostEnabled", "lspEnvAllow", "autoBackgroundOnTimeout",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired", "sandboxReadFloor",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
 ];
@@ -2705,6 +2775,9 @@ function k8sWorkspaceCache() {
     return { mount, size };
 }
 export function loadConfig() {
+    const undeclared = ownCredentialDeclarationRefusal();
+    if (undeclared !== undefined)
+        throw new Error(undeclared);
     rejectRetiredEnvs();
     CONFIG_WARNINGS.length = 0;
     CONFIG_NOTICES.length = 0;
@@ -2816,11 +2889,4 @@ export function splitLocalRoots(a) {
         return undefined;
     return { dataRoot: a.localDataRoot, configRoot };
 }
-export function resolveBindHost(config) {
-    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-    const mustNarrow = Boolean(config.allowUnauthedWrites) && !anyServiceAuth;
-    if (config.bindHost && !(mustNarrow && config.bindHostSource === "HOST"))
-        return config.bindHost;
-    return mustNarrow ? "127.0.0.1" : undefined;
-}
 //# sourceMappingURL=config.js.map

package/dist/delegated-session-owner.d.ts

@@ -29,7 +29,7 @@
 import type { SessionPlacement } from "@sema-agent/core";
 import type { SessionFace } from "./session-incarnation.js";
 import type { SqlDialect } from "./plugins/sql-driver.js";
-/** 孤行哨兵属主的前缀(保留主体前缀:`security.ts` 的 `RESERVED_PRINCIPAL_PREFIXES` 登记它,任何身份来源报出带它的主体都在鉴权边界被拒)。 */
+/** 孤行哨兵属主的前缀(保留主体前缀:`principal-shape.ts` 的 `RESERVED_PRINCIPAL_PREFIXES` 登记它,任何身份来源报出带它的主体都在鉴权边界被拒)。 */
 export declare const ORPHAN_SESSION_OWNER_PREFIX = "_orphan:";
 /** 一只推不出属主的子代会话的哨兵属主(每只会话一个值:即便哪天有谁误配出这个串,也只够得着这一只)。 */
 export declare function orphanSessionOwner(sessionId: string): string;

package/dist/deleted-session-ids.d.ts

@@ -2,10 +2,11 @@ import type { DeploymentShapeInput } from "./deployment-shape.js";
 /** 表的条数上限(一条约百字节量级)。引擎的会话暂存自己按会话数有上限(超了整会话驱逐最旧);本表的上限比它宽得多。 */
 export declare const DELETED_SESSION_ID_CAP = 50000;
 /**
- * **铸点**(唯一):本进程的在线删除协调器在删除会话本体之前记一笔 —— 围栏先立,id 才空出来。删除随后失败也无害:
+ * **铸点**(唯一的函数;两处调用者):本进程的在线删除协调器在删除会话本体之前记一笔 —— 围栏先立,id 才空出来;提交出口撤回一只被拒提交铸下的会话之后同步记一笔
+ * (`submission-exit.ts`,判撤才记)。删除随后失败也无害:
  * 这一笔只拒「别的属主」,而会话还在时别的属主本来就用不了它。
  * 同一只 id 再删一次:这一次的删前属主对已记的每一位都等价(同一只等价律判)⇒ 收进集合(前几位一位不丢 —— 等价律有方向、不传递,只记最新一位会让
- * 「哨兵删 → 无主重登再删 → `default` 用」绕过「哨兵 ≢ `default`」);对某一位不等价 ⇒ 记成「谁都不是」。后一次删除从不覆盖前一位(前一位的暂存仍可能在本进程)。
+ * 「无主删 → `default` 重登再删 → 无主体的调用方用」绕过「`default` 的行 ≢ 无主体的调用方」);对某一位不等价 ⇒ 记成「谁都不是」。后一次删除从不覆盖前一位(前一位的暂存仍可能在本进程)。
  * `deployment` = 部署形(等价律的窄互认臂读它;调用方递 `ServiceConfig` 整份)。
  */
 export declare function retireSessionId(sessionId: string, owner: string | null, deployment: DeploymentShapeInput<"principal">): void;

package/dist/deployment-governance.d.ts

@@ -1,5 +1,5 @@
 import { FileError, StubExecutionEnv, type ExecutionEnv, type PathFamily, type Result, type ToolPolicy } from "@sema-agent/core";
-import { type DeploymentListExemption } from "./approval.js";
+import { type SessionExemptionRead } from "./approval.js";
 import type { ServiceConfig } from "./config.js";
 import type { applyRuntimeGovernance } from "./runtime-governance.js";
 /** `applyRuntimeGovernance` 的 governance 实参 —— 从折叠属主的签名位**推导**,不复制形状
@@ -84,8 +84,8 @@ export interface DurableApprovalSeat {
     readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
-    /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createDeploymentListExemption`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
-    readonly exemption?: DeploymentListExemption;
+    /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createSessionExemptionRead`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
+    readonly exemption?: SessionExemptionRead;
 }
 /** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店:run-local 一次性腿)。 */
 export interface LiveApprovalSeat {

package/dist/deployment-shape.d.ts

@@ -6,8 +6,9 @@
  * `DEPLOYMENT_SHAPE_PREDICATES.<行>.holds(config)`,不 import 散落函数;表外不许再长出一只自读部署形事实的布尔判据
  * (反向门 `test/deployment-shape-gate.test.ts` 按语法树判,判据逐字写在那份门的头注里)。
  *
- * ## 两根轴,每根轴一个读口(原始配置键只在这两个函数里被读)
+ * ## 三根轴,每根轴一个读口(原始配置键只在这三个函数里被读)
  *  · `principal` —— 运维的 `REQUIRE_PRINCIPAL` 声明({@link readPrincipalAxis})。
+ *  · `identity` —— 这台部署在**配置**上接了哪几个已验身份来源(唯一读法 `configuredIdentitySources`,`identity-source.ts`)+ 有没有声明只读 trace 凭据({@link readIdentityAxis})。
  *  · `lane` —— `REMOTE_EXEC` 的归一车道词(`executionLaneOf`,认不出 ⇒ `undefined`,行必须 fail-closed)+ 那条车道的能力表行 +
  *    这份部署上执行环境的能力块(唯一作者 `capabilitiesFor`;k8s 的快照店是它的输入)+ 车道子旋钮(k8s 运行时类)({@link readLaneAxis})。
  *
@@ -16,15 +17,16 @@
  * `holds` 的入参型 = 所声明轴读入形的交叉({@link DeploymentShapeInput}),所以调用方递完整 `ServiceConfig` 或只递那几键的窄形都行。
  *
  * ## 什么进表、什么不进
- * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 14 行;同一条规则的多个消费者读同一行,不各成一行)。
+ * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 15 行;同一条规则的多个消费者读同一行,不各成一行)。
  * 把一行与**非形事实**(锁键、合规档位、审批意图、请求身份、请求体)合取的能力判据是**消费者**,住在它自己的模块
  * (`mcpInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
  * 车道表(`execution-lane-caps.ts`)按车道词键控的布尔列(`laneIsolated` 等)是车道轴自己的事实表,不是「部署」的谓词;行读它们。
  *
- * 依赖纪律:叶模块 —— 值导入只有 `execution-lane-caps.ts`(它本身是叶),零运行期环(引擎只 type-import)。
+ * 依赖纪律:叶模块 —— 值导入只有 `execution-lane-caps.ts` 与 `identity-source.ts`(两者本身是叶),零运行期环(引擎只 type-import)。
  */
 import type { ExecutionEnvCapabilities } from "@sema-agent/core";
 import { type ExecutionLane, type ExecutionLaneCaps } from "./execution-lane-caps.js";
+import { type IdentitySource, type IdentitySourceConfig } from "./identity-source.js";
 /** `principal` 轴读的配置键(`ServiceConfig` 结构上满足)。 */
 export interface PrincipalAxisInput {
     readonly requirePrincipal?: boolean | undefined;
@@ -34,6 +36,17 @@ export interface PrincipalAxisFacts {
     /** 运维声明了 `REQUIRE_PRINCIPAL=true`。 */
     readonly declared: boolean;
 }
+/** `identity` 轴读的配置键(`ServiceConfig` 结构上满足):身份来源的配置面 + 只读 trace 凭据。 */
+export interface IdentityAxisInput extends IdentitySourceConfig {
+    readonly traceToken?: string | undefined;
+}
+/** `identity` 轴的事实。 */
+export interface IdentityAxisFacts {
+    /** 配置接了线的已验身份来源(`configuredIdentitySources`,序同 `IDENTITY_SOURCES`)。鉴权桥那一格 = 配置里有 issuer(显式或中心回退)—— 验签器由起服第 9 段按同一个读数建。 */
+    readonly sources: readonly IdentitySource[];
+    /** 声明了只读 trace 凭据(不是身份来源:它不验任何主体,但这台部署因此有一道凭据门)。 */
+    readonly traceTokenDeclared: boolean;
+}
 /** `lane` 轴读的配置键:**已合成**的 `remoteExec` 里本表用得到的那几键(`ServiceConfig` 的判别联合每一臂结构上都满足;车道必在 ——
  *  没有声明的部署在执行车道合成步拒启)。`provider` 收开放串:手搓的部署形 / 外部输入上认不出的词 ⇒ 行在 `lane` 那一格 fail-closed。 */
 export interface LaneAxisInput {
@@ -60,6 +73,10 @@ interface AxisShapes {
         readonly input: PrincipalAxisInput;
         readonly facts: PrincipalAxisFacts;
     };
+    readonly identity: {
+        readonly input: IdentityAxisInput;
+        readonly facts: IdentityAxisFacts;
+    };
     readonly lane: {
         readonly input: LaneAxisInput;
         readonly facts: LaneAxisFacts;
@@ -86,6 +103,14 @@ export interface DeploymentShapePredicate<A extends DeploymentShapeAxis> {
 export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
     /** 身份门的问法。读者:请求面的身份 / 属主门(`http/principal-gate.ts`、`http/request-guards.ts`、`security.ts`)。 */
     principalRequired: DeploymentShapePredicate<"principal">;
+    /**
+     * 「这台部署有没有身份边界」的问法 —— 有 = 请求里有东西替主体作保或拦在门外:声明了 `REQUIRE_PRINCIPAL`,或配置接了任一已验身份来源
+     * (service 凭据 / 鉴权桥 issuer,含中心回退 / 直连门),或声明了只读 trace 凭据。没有 = dev-open:主体头是谁都能自报的标签。
+     * 只读配置(验签器在起服第 9 段按同一个配置读数建 ⇒「验签器在场」≡「配置里有桥」),所以先于验签器的起服段(第 3 段的一次性迁移)与请求面读到同一个答案。
+     * 读者:请求面的 dev-open 判据(`http/principal-gate.ts` 的 `devOpenDeployment`:属主存取器的 fleet 一格与 `/metrics` 族的免凭据臂)、
+     * 一次性迁移 M48 的输入(`plugins/store-backend.ts`:有边界 ⇒ 不改写哨兵属主)。
+     */
+    identityBoundary: DeploymentShapePredicate<"identity" | "principal">;
     /**
      * 租户轴的问法。今天与 {@link DEPLOYMENT_SHAPE_PREDICATES.principalRequired} 读**同一个声明**([ref] ①:托管 / 多租 ⇔ `REQUIRE_PRINCIPAL=true`,
      * 签发方配置是身份验签轴、不算租户证据)—— 两个问题、一根轴、一个读口;「鉴权必需」与「多租形」拆成两个声明时只改这一行的判官。
@@ -93,7 +118,8 @@ export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
     multiTenant: DeploymentShapePredicate<"principal">;
     /** 读能力表 `callerCwd` 位(host = 单主才开;device = 路径落在发起者自己的设备上,归属由根会话行执行格上的设备绑定验过,不要求单主)。 */
     callerCwd: DeploymentShapePredicate<"lane" | "principal">;
-    /** 调用方给的宿主绝对路径(附加目录 / 项目上下文 / 本机 SendUserFile / 指令文件探针)只在「手就在本 worker 的盘上 ∧ 单主」时指向调用方自己的东西。 */
+    /** 调用方给的宿主绝对路径(附加目录 / 项目上下文 / 本机 SendUserFile / 指令文件探针)只在「手就在本 worker 的盘上 ∧ 单主」时指向调用方自己的东西;
+     *  本机语言服务器(`createLspManager`:本机子进程、在 worker 盘上找根)同问这一句,读这一行 × `LSP_HOST_ENABLED`。 */
     callerOwnsWorkerDisk: DeploymentShapePredicate<"lane" | "principal">;
     /** wire `executionLane.toolsOnThisHost` 与出厂 / 中心技能的 `baseDir`:只问文件系统同一性,与租户无关(出厂内容每个租户拿到同一份)。 */
     toolsOnThisHost: DeploymentShapePredicate<"lane">;

package/dist/deployment-shape.js

@@ -1,7 +1,11 @@
 import { capabilitiesFor, executionLaneCaps, executionLaneOf, handsOnWorkerFilePlane, laneWiresExecutionEnv } from "./execution-lane-caps.js";
+import { configuredIdentitySources } from "./identity-source.js";
 function readPrincipalAxis(deployment) {
     return { declared: deployment.requirePrincipal === true };
 }
+function readIdentityAxis(deployment) {
+    return { sources: configuredIdentitySources(deployment), traceTokenDeclared: Boolean(deployment.traceToken) };
+}
 function readLaneAxis(deployment) {
     const declaration = deployment.remoteExec;
     const lane = executionLaneOf(declaration.provider);
@@ -16,6 +20,8 @@ function readAxis(axis, deployment) {
     switch (axis) {
         case "principal":
             return readPrincipalAxis(deployment);
+        case "identity":
+            return readIdentityAxis(deployment);
         case "lane":
             return readLaneAxis(deployment);
     }
@@ -47,6 +53,7 @@ function capabilityHolds(cap, principal) {
 const VM_ISOLATION_RUNTIME_CLASSES = new Set(["kata", "kata-qemu", "kata-clh", "kata-fc", "gvisor", "runsc"]);
 export const DEPLOYMENT_SHAPE_PREDICATES = Object.freeze({
     principalRequired: createPredicate(["principal"], "身份轴:运维声明了 REQUIRE_PRINCIPAL=true —— 每个调用方都必须带一个验过的主体。", ({ principal }) => principal.declared),
+    identityBoundary: createPredicate(["principal", "identity"], "身份轴:这台部署有身份边界 —— 声明了 REQUIRE_PRINCIPAL,或配置接了任一已验身份来源(service 凭据 / 鉴权桥 / 直连门),或声明了只读 trace 凭据。", ({ principal, identity }) => principal.declared || identity.sources.length > 0 || identity.traceTokenDeclared),
     multiTenant: createPredicate(["principal"], "租户轴:这台部署服务不止一个主人(托管 / 多租;C-R100 ① 由 REQUIRE_PRINCIPAL=true 声明)。", ({ principal }) => principal.declared),
     callerCwd: createPredicate(["lane", "principal"], "车道 × 租户 / 设备归属:调用方送来的 cwd(与 settings.env)被尊重 —— host 车道且单主,或 device 车道。", ({ lane, principal }) => lane.caps !== undefined && capabilityHolds(lane.caps.callerCwd, principal)),
     callerOwnsWorkerDisk: createPredicate(["lane", "principal"], "车道 × 租户:手就在本 worker 的盘上且部署只有一个主人 —— 这块盘上的路径就是调用方自己的。", ({ lane, principal }) => lane.lane !== undefined && handsOnWorkerFilePlane(lane.lane) && !principal.declared),

package/dist/egress-redirect.d.ts

@@ -1,12 +1,30 @@
 /**
- * 本服务**自己**发往配置端点的出站请求(hook 直连模型腿 `hooks/hook-llm.ts`、记忆 embedder `plugins/memory-embedder.ts`)的
- * 重定向律 —— 与 core 7.51.0([ref])一方 brain 的请求同一条:请求以 `redirect: "manual"` 发出,端点回重定向 ⇒ 拒;
- * 不跟、不重试、拒句不点名目标。
+ * 本服务**自己**发出的每一个出站 HTTP 请求的重定向律 —— 与 core 7.51.0([ref])一方 brain 的请求同一条:
+ * 请求以 `redirect: "manual"` 发出,对端回重定向 ⇒ 拒;不跟、不重试,拒句不点名目标。
  *
  * 为什么:请求只去被判过的那个根。传输层(undici)跟随 POST 307 / 308 时把请求体(用户内容 / 记忆正文)原样送到
- * `Location`,跨 origin 只剥 `authorization` —— anthropic 形的 `x-api-key` 随行(`test/hook-llm.test.ts` 的 G1 格在
- * 7.128.x 上实测送达重定向目标)。判据与拒句与 core 的 brain 请求门同形(`opaqueredirect` 或 3xx)。
+ * `Location`,跨 origin 只剥 `authorization` —— 自定义凭据头(`x-api-key` / `X-Subscription-Token` / OTLP 的 `headers` / S3 预签名的 query)
+ * 随行,同 origin 的跟随连 `authorization` 一起带走(`test/hook-llm.test.ts` 的 G1 格在 7.128.x 上实测送达重定向目标)。
+ *
+ * **一只出口**:{@link createEgressFetch} 是本仓里全局 `fetch` 的**唯一**值引用(`test/egress-redirect-surfaces.test.ts` 的语法树门:
+ * 全树零第二处全局 `fetch`、`redirect` 选项只写这里一处、`createEgressFetch(` 调用点闭集登记 —— 新加出站面必登)。
+ * 每个出站面各自造一只带「出路」句的出口,请求只经它发出;注入的 `fetchImpl`(测试座 / 嵌入方)同样被它包住 ——
+ * 注入不是绕过判据的门。判据 {@link egressRedirectRefusal} 不导出:没有「自己设 `redirect: manual` 再自己判」的第二种写法。
+ *
+ * 响亮:对端回重定向 ⇒ 抛 {@link EgressRedirectRefusedError}(带对端回的码),拒句前面由各面的失败臂冠上自己的面名。
+ * 各面既有的失败臂(日志 / 失败码 / 终态)照旧收它 —— 没有哪一面把它吞成「没拿到结果」而不留话。
+ */
+/** 对端回了重定向、本服务按律不跟:`status` 是对端回的码(0 = `opaqueredirect`)。`message` = 拒句,不回显 `Location` / 凭据 / 请求体。 */
+export declare class EgressRedirectRefusedError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * 造一只出站 `fetch`:`redirect: "manual"` 强制(调用方传的 `redirect` 不作数),回重定向 ⇒ 抛 {@link EgressRedirectRefusedError}。
+ *
+ *  · `fix` = 出路一句(「把最终地址写进哪一席」),由各面按自己打的那一席给;拼进拒句。
+ *  · `fetchImpl` 缺席 ⇒ 调用时现取全局 `fetch`(不在造出口时捕获:测试对全局 `fetch` 的替换在造出口之后也生效);在场 ⇒ 用它,同样被判。
+ *  · 其余答复(2xx / 4xx / 5xx / 304)原样交回,各面自己的失败臂照旧。
  */
-/** 端点回的是重定向 ⇒ 拒句(调用方在前面冠上自己的面名);否则 `undefined`。命中时丢弃响应体(不读、不留连接)。 */
-export declare function egressRedirectRefusal(res: Response, fix: string): string | undefined;
+export declare function createEgressFetch(fix: string, fetchImpl?: typeof fetch): typeof fetch;
 //# sourceMappingURL=egress-redirect.d.ts.map

package/dist/egress-redirect.js

@@ -1,7 +1,25 @@
-export function egressRedirectRefusal(res, fix) {
-    if (res.type !== "opaqueredirect" && !(res.status >= 300 && res.status < 400))
+export class EgressRedirectRefusedError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = "EgressRedirectRefusedError";
+        this.status = status;
+    }
+}
+const NOT_MODIFIED = 304;
+function egressRedirectRefusal(res, fix) {
+    if (res.type !== "opaqueredirect" && !(res.status >= 300 && res.status < 400 && res.status !== NOT_MODIFIED))
         return undefined;
     void res.body?.cancel().catch(() => undefined);
     return `endpoint answered with a redirect${res.status > 0 ? ` (HTTP ${res.status})` : ""}; it was not followed and no credential was sent anywhere else — ${fix}`;
 }
+export function createEgressFetch(fix, fetchImpl) {
+    return async (input, init) => {
+        const res = await (fetchImpl ?? fetch)(input, { ...init, redirect: "manual" });
+        const refusal = egressRedirectRefusal(res, fix);
+        if (refusal !== undefined)
+            throw new EgressRedirectRefusedError(res.status, refusal);
+        return res;
+    };
+}
 //# sourceMappingURL=egress-redirect.js.map

package/dist/elicitation.d.ts

@@ -1,4 +1,5 @@
 import { type McpElicitRequest, type McpElicitResponse } from "@sema-agent/core";
+import { type HitlTransport } from "./hitl-delivery.js";
 /** A live elicitation frame delivered to whoever is tailing this run's stream. `type` IS the SSE event name
  *  (mirrors the named-event convention: the payload also carries `type` so a proxy that strips event names still
  *  works). The shell renders the `elicitation` frame as a dialog and dismisses on `elicitation_complete`. */
@@ -27,13 +28,13 @@ export interface ElicitationFrame {
     /** "elicitation" only: `serverNowMs + expiresInMs` — the absolute deadline on the server's clock. */
     expiresAtMs?: number;
 }
-/** The per-run context `onElicit` recovers via ALS. `emit` delivers a frame to the run's live stream;
- *  `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an elicitation parked awaiting a
- *  human, since the MCP per-request signal may not be chained to the run abort. */
+/** The per-run context `onElicit` recovers via ALS. `transport` = the leg's ONE HITL transport (shared with the question and
+ *  approval contexts of the same leg); `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an
+ *  elicitation parked awaiting a human, since the MCP per-request signal may not be chained to the run abort. */
 export interface ElicitationRunContext {
     taskId: string;
     owner: string | null;
-    emit: (frame: ElicitationFrame) => void | Promise<void>;
+    transport: HitlTransport<ElicitationFrame>;
     abortSignal?: AbortSignal;
 }
 export interface ElicitationThrottle {
@@ -81,7 +82,7 @@ export declare class ElicitationCoordinator {
     elicit: (req: McpElicitRequest, signal?: AbortSignal) => Promise<McpElicitResponse>;
     /** `POST /v1/elicitations/:id/respond` — resolve a parked elicitation with the shell's answer. Owner-gated with a
      *  404 (no existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404.
-     *  Returns the HTTP {status, body}; the HTTP layer owns auth (gatedPrincipal + REQUIRE_PRINCIPAL) before calling. */
+     *  Returns the HTTP {status, body}; the HTTP layer owns auth (gatedSubject + REQUIRE_PRINCIPAL) before calling. */
     respond(id: string, principal: string | undefined, body: unknown): {
         status: number;
         body: unknown;