@sema-agent/server 7.147.0 → 7.148.0

package/dist/submission-exit.d.ts

@@ -0,0 +1,50 @@
+import type { DeploymentShapeInput } from "./deployment-shape.js";
+import type { RunAcceptance } from "./run-acceptance.js";
+import type { SessionWithdrawFace } from "./plugins/session-birth.js";
+import type { SessionBirth, StoreKeptWord } from "./session-incarnation.js";
+/** 收场词(闭集;加词 ⇒ {@link SubmissionSeat.close} 的穷尽 switch 编译红)。 */
+export type SubmissionEnd = "accepted" | "record" | "refused";
+/** 「留」的词:店内七词 + 座内四词(`withdraw_failed` = 撤回事务抛了,按留答)。 */
+export type KeptWord = StoreKeptWord | "env" | "attached" | "accepted" | "record" | "withdraw_failed";
+/** 收场的结局(计数的 `verdict` 标签)。 */
+export type SubmissionVerdict = "withdrawn" | `kept_${KeptWord}`;
+/**
+ * 座读的部署件:计数口(缺 ⇒ 不计)与撤回之后的**进程内尾处理**(与 `DELETE /v1/sessions/:id` 同一组:会话登记簿四表 —— cwd / shellEnv / inheritEnv / 属主 ——
+ * 与 SSE watch 条目;缺 ⇒ 本部署没有那一张表)。
+ */
+export interface SubmissionSeatDeps {
+    /** 部署形(调用方递 `ServiceConfig` 整份):撤回之后记墓碑时,「同一位属主」的窄互认臂读它(`security.ts` 的 `sameSessionOwner`)。必填 —— 缺了就没有判据可记墓碑。 */
+    readonly deployment: DeploymentShapeInput<"principal">;
+    readonly metrics?: {
+        inc(name: string, labels?: Record<string, string>, n?: number): void;
+    };
+    /** 只清这一位住客的条目(记下的住客恰是候选 ⇒ 清、答 `true`)。 */
+    readonly dropSessionScopedOf?: (sessionId: string, incarnation: string) => boolean;
+    readonly sessionWatch?: {
+        dropSession(sessionId: string): void;
+    };
+}
+/** 一次提交的出口座(提交门在授权之前铸;三条提交腿只喂它、收它)。 */
+export interface SubmissionSeat {
+    /** 授权器登记新行时交来的候选与店的撤回面(只有新行臂调;调多次以第一次为准)。 */
+    noteBirth(birth: SessionBirth, face: SessionWithdrawFace): void;
+    /** 提交门铸好 spec 之后挂上受理座(闩的唯一读者在 {@link close})。 */
+    attachAcceptance(acceptance: Pick<RunAcceptance, "accepted">): void;
+    /** 本请求认领赢的耐久 run(四个建行点);同时按它的 run id 听执行环境见证(`env-witness.ts`,收场时注销)。 */
+    noteOwnRun(taskId: string): void;
+    /** 结果查询责任交给本请求自己的耐久 run(后台 run 的 202 / 断连转后台的流认领赢)。 */
+    markRecord(): void;
+    /** 执行环境为这次提交留下了按会话键的持久物。 */
+    noteEnvWitness(): void;
+    /** 此刻判不判得出「留」而不必走店(闩上 / record / 没有候选 / 有见证)。 */
+    readonly keepsWithoutWithdraw: boolean;
+    /** 收场(幂等、先到者定;不抛)。 */
+    close(): Promise<SubmissionVerdict>;
+    /** 终局应答的唯一写口:判得出「留」⇒ 立写;否则先收场({@link close},撤回事务落定)再写。交回的承诺在写完时兑现。持流的腿在引擎最后一笔会话写之后才调(终帧暂存在腿里)。 */
+    deliverTerminal(write: () => void): Promise<void>;
+}
+/** 铸一只出口座(提交门在授权之前调;不经提交门的车道没有座)。 */
+export declare function createSubmissionSeat(deps: SubmissionSeatDeps): SubmissionSeat;
+/** 拒的写口:提交门之后(有座)⇒ 经 {@link SubmissionSeat.deliverTerminal};提交门之前(没有座,集外:还没铸会话)⇒ 当场写。 */
+export declare function deliverVia(seat: Pick<SubmissionSeat, "deliverTerminal"> | undefined, write: () => void): Promise<void>;
+//# sourceMappingURL=submission-exit.d.ts.map

package/dist/submission-exit.js

@@ -0,0 +1,108 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+import { listenEnvWitness } from "./env-witness.js";
+import { retireSessionId } from "./deleted-session-ids.js";
+import { seatText } from "./trace/exit-seat.js";
+export function createSubmissionSeat(deps) {
+    let birth;
+    let acceptance;
+    let ownTaskId;
+    let recorded = false;
+    let witnessed = false;
+    let closing;
+    let unlisten;
+    const endNow = () => (acceptance?.accepted === true ? "accepted" : recorded ? "record" : "refused");
+    const settle = async () => {
+        const end = endNow();
+        let verdict;
+        switch (end) {
+            case "accepted":
+                verdict = "kept_accepted";
+                break;
+            case "record":
+                verdict = "kept_record";
+                break;
+            case "refused":
+                verdict = await withdrawOrKeep();
+                break;
+            default: {
+                const unknownEnd = end;
+                throw new Error(`submission exit: no end word ${JSON.stringify(unknownEnd)}`);
+            }
+        }
+        deps.metrics?.inc("submission_exit_total", { end, verdict });
+        return verdict;
+    };
+    const withdrawOrKeep = async () => {
+        if (birth === undefined)
+            return "kept_attached";
+        if (witnessed)
+            return "kept_env";
+        let out;
+        try {
+            out = await birth.face.withdrawBirth(birth.birth, ownTaskId);
+        }
+        catch (err) {
+            recordFailOpen("server.submission-exit.withdraw-failed", `session=${birth.birth.sessionId} err=${seatText("operator-log-text", err instanceof Error ? err.message : String(err))}`);
+            return "kept_withdraw_failed";
+        }
+        if (!out.withdrawn)
+            return `kept_${out.kept}`;
+        endWithdrawnTenancy(birth.birth);
+        return "withdrawn";
+    };
+    const endWithdrawnTenancy = (b) => {
+        retireSessionId(b.sessionId, b.owner, deps.deployment);
+        if (deps.dropSessionScopedOf?.(b.sessionId, b.incarnation) === true)
+            deps.sessionWatch?.dropSession(b.sessionId);
+    };
+    const seat = {
+        noteBirth(b, face) {
+            if (birth === undefined)
+                birth = { birth: b, face };
+        },
+        attachAcceptance(a) {
+            acceptance = a;
+        },
+        noteOwnRun(taskId) {
+            ownTaskId = taskId;
+            if (closing !== undefined || birth === undefined)
+                return;
+            unlisten?.();
+            unlisten = listenEnvWitness(taskId, () => seat.noteEnvWitness());
+        },
+        markRecord() {
+            recorded = true;
+        },
+        noteEnvWitness() {
+            witnessed = true;
+        },
+        get keepsWithoutWithdraw() {
+            return birth === undefined || witnessed || endNow() !== "refused";
+        },
+        close() {
+            if (closing === undefined) {
+                unlisten?.();
+                unlisten = undefined;
+                closing = settle();
+            }
+            return closing;
+        },
+        async deliverTerminal(write) {
+            if (closing === undefined && seat.keepsWithoutWithdraw) {
+                write();
+                return;
+            }
+            await seat.close();
+            write();
+        },
+    };
+    return seat;
+}
+export async function deliverVia(seat, write) {
+    if (seat === undefined) {
+        write();
+        return;
+    }
+    await seat.deliverTerminal(write);
+}
+//# sourceMappingURL=submission-exit.js.map

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。

package/dist/task-a2a.js

@@ -7,7 +7,7 @@ import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { createMountSeat, declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 import { sendHeaderOwnershipIssue } from "./task-mcp.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
@@ -33,13 +33,13 @@ export const A2A_PEER_DISPOSITION = {
 export const A2A_PEER_ENTRY_KEYS = declarationKeys(A2A_PEER_DISPOSITION);
 const A2A_PEER_ENTRY_KEY_SET = new Set(A2A_PEER_ENTRY_KEYS);
 const NO_TOLERATED_KEYS = new Set();
-const A2A_SEAT = {
+const A2A_SEAT = createMountSeat({
     list: "a2aPeers",
     cap: MAX_REQUEST_A2A_PEERS,
     subject: "peer",
     declaration: "an A2A peer declaration",
     declarations: "A2A peer declarations",
-};
+});
 function peerUrlIssue(key) {
     return (entry, at) => {
         const value = entry[key];

package/dist/task-cwd.d.ts

@@ -102,6 +102,26 @@ export declare function effectiveHostWorkspace(sessionCwd: string | undefined, c
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/** {@link launchWorkspaceOf} 读到的那一格出自哪里(闭集;起服那一行日志与随包文档的 `workspaceFrom` 词)。 */
+export type LaunchWorkspaceFrom = "workspace-flag" | "host-workspace-base" | "process-cwd";
+/** 起服时的「工作区」:目录 + 它读自哪一格。 */
+export interface LaunchWorkspace {
+    readonly dir: string;
+    readonly from: LaunchWorkspaceFrom;
+}
+/** 读起服工作区要看的部署事实(`ServiceConfig` 结构上满足:只有 `host` 车道有 `workspaceBase`)。 */
+export interface LaunchWorkspaceDeployment {
+    readonly remoteExec: {
+        readonly provider: string;
+        readonly workspaceBase?: string | undefined;
+    };
+}
+/**
+ * **起服时「工作区」的唯一读链**:显式给的(`run-local --workspace`)?? 部署声明的车道工作区底(`REMOTE_EXEC=host` 的 `HOST_WORKSPACE_BASE`)?? 本进程的工作目录。
+ * 两个入口读同一只:`run-local` 的 `workspaceDir`(它的手就跑在这个目录里)与 HTTP 服务起服时的「配置根是不是工作区祖先」那一判(`sema-config-dir.ts`)。
+ * 它回答的是**起服时本服务知道**的那一个目录;请求体里按任务给的 `cwd`(每会话登记)起服时不可知,不在这条链里。
+ */
+export declare function launchWorkspaceOf(config: LaunchWorkspaceDeployment, explicit?: string, cwd?: () => string): LaunchWorkspace;
 /**
  * run 外回退口问「host 工厂这一次会落在一只**实在的**目录上吗」:根 = {@link effectiveHostWorkspace}(引擎 run 外环境请求的上下文归约成 `{}` ⇒ 就是登记的 cwd),
  * 且它此刻是盘上的一只目录 ⇒ 交回它;没有根,或那只目录**不在**(`ENOENT` / `ENOTDIR`,或在但不是目录)⇒ `undefined`(调用方答 409:根不可知)。

package/dist/task-cwd.js

@@ -46,6 +46,14 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export function launchWorkspaceOf(config, explicit, cwd = process.cwd) {
+    if (explicit !== undefined)
+        return { dir: explicit, from: "workspace-flag" };
+    const base = config.remoteExec.provider === "host" ? config.remoteExec.workspaceBase : undefined;
+    if (base !== undefined)
+        return { dir: base, from: "host-workspace-base" };
+    return { dir: cwd(), from: "process-cwd" };
+}
 export async function presentHostWorkspaceOf(sessionCwd) {
     const root = effectiveHostWorkspace(sessionCwd, {});
     if (root === undefined)

package/dist/task-mcp.d.ts

@@ -71,7 +71,7 @@ export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrig
 /** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
 export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("env" | "kind" | "args" | "command")[];
 /** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("headers" | "url" | "kind" | "principalHeader" | "assertionHeader")[];
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("url" | "headers" | "kind" | "principalHeader" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is

package/dist/task-mcp.js

@@ -10,7 +10,7 @@ import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { MALFORMED_NAME, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { MALFORMED_NAME, createMountSeat, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -152,13 +152,13 @@ export function requestMcpDeclarationRefusal(list) {
 export function assertRequestMcpEntries(bodyMcp) {
     throwDeclarationRefusal(requestMcpDeclarationRefusal(bodyMcp));
 }
-const MCP_SEAT = {
+const MCP_SEAT = createMountSeat({
     list: "mcpServers",
     cap: MAX_REQUEST_MCP_SERVERS,
     subject: "server",
     declaration: "an MCP server declaration",
     declarations: "MCP server declarations",
-};
+});
 const ENTRY_KEY_SET = new Set(MCP_SERVER_ENTRY_KEYS);
 const STDIO_TRANSPORT_KEY_SET = new Set(STDIO_MCP_TRANSPORT_KEYS);
 const HTTP_TRANSPORT_KEY_SET = new Set(HTTP_MCP_TRANSPORT_KEYS);

package/dist/task-settings.d.ts

@@ -57,6 +57,7 @@ import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import type { EntryPermissionMode } from "./runtime-governance.js";
+import { type SessionExemptionRead } from "./approval.js";
 import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
@@ -319,6 +320,16 @@ export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
  * 缺席 / 形不对 ⇒ `undefined` ⇒ 不判,形归受理门的形判)。`credentialNames` = 本进程的凭据变量名(调用方递 `serverCredentialValueSources(config.modelApiKeyEnv)`)。没有命中 ⇒ `null`。
  */
 export declare function settingsEnvCredentialIssue(reaching: Readonly<Record<string, string>> | undefined, credentialNames: readonly string[]): SettingsEnvCredentialIssue | null;
+/** {@link settingsEnvComposeIssue} 的产物:wire 文案 + 机读位(`field` 恒为 `settings.env`)。 */
+export interface SettingsEnvComposeIssue {
+    readonly message: string;
+    readonly field: "settings.env";
+}
+/**
+ * `settings.env` 里环境合成会拒的名 / 值的**受理判**(纯函数;律见上方段头)。`reaching` = {@link readSettingsEnv} 读出的那一份;缺席 / 形不对 ⇒ `undefined` ⇒ 不判(形归受理门的形判)。
+ * 没有话 ⇒ `null`;判官有话 ⇒ 句子 = 本站的头 + 判官的拒因原句(经调用方串的唯一回显口径:判官的句子里会点名变量名,名字是调用方写的串;值从不在句子里)+ 收尾。
+ */
+export declare function settingsEnvComposeIssue(reaching: Readonly<Record<string, string>> | undefined): SettingsEnvComposeIssue | null;
 /**
  * 一次性迁移 M38(窗口见 `plugins/one-time-migrations.ts` 登记表):从读到的那一份里去掉判据点名的原键,交回剥后的一份。**剥空 = 空表**(调用方送了这一块,剥完什么都不剩):
  * 解析层把它当作这次请求的环境层原样交出,`resolveSpec` 登记它 —— 覆盖这条会话上一条登记;若读成「缺席」,会话注册表按「缺席 = 留着上一条」把上一条(可能正是被剥的那个名字)留给 shell。
@@ -421,7 +432,7 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理
  * (契约包 19.0.0 承运 command 的 `args` / `onFailure` 与 http 的 `onFailure`、20.0.0 承运 command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、
  * prompt 的 `continueOnBlock` 时,这里一行未改就受理了它们 —— 受理 = 读者携带;后四键本服务如实带、不执行,能力位与契约附录明写);
- * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksCoordinate}(契约包出门形 + 回显口径;凭据形键段不原样回显)。
+ * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksFieldCoordinate}(请求坐标的唯一写法,方括号形 + 回显口径;凭据形键段不原样回显)。
  *
  * 判据边界(与另两个实例同):只判**键名**(值形归读者);拒只在 FRESH 提交面 —— 续跑重放走 {@link parseTaskSettings},读者照旧剥掉它不携带的键,存量体按受理时的读法重放(4xx 打在重放腿上会砖死停驻任务)。
  * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— `plugin` 写在 http 条目上被剥掉,写的人以为插件上下文在;`args` 写在 http 条目上被剥掉,写的人以为不过 shell;
@@ -462,14 +473,7 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
  *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
-export declare function createWorkflowAskPolicy(isExempt?: WorkflowGateWiring["isExempt"]): ToolPolicy;
-/** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
- *  fs-independent: one shape on every execution lane. */
-export interface WorkflowGateWiring {
-    /** The session "don't ask again" probe (approvalExemptionStore.has, raw toolName key) — the same store and key space the
-     *  approval seat's standing grants read; one remember="session" grant serves them all. */
-    isExempt?: (toolName: string) => boolean | Promise<boolean>;
-}
+export declare function createWorkflowAskPolicy(exemption?: SessionExemptionRead): ToolPolicy;
 /**
  * 请求的 deny / ask 两张表解析路径形规则用的**基**(`resolve-spec.ts` 每请求供)。只有这两件事:这条 task 的真根、执行环境的 home。
  * 缺席 ⇒ 不声明(规则锚在装入这只策略的那条腿的真根,`~/` 形由 {@link rejectUnmatchableSettingsNames} 响亮拒)。
@@ -529,7 +533,7 @@ export interface FsWriteGateWiring {
 }
 /**
  * 请求的 `settings.permissions.deny` / `ask` 有永远不生效的条目 ⇒ 拒点({@link rejectUnmatchableSettingsNames})抛的错:句子(`message`)与这一遍判下来的**全部**问题(`problems`,机读位的原料)。
- * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体带 `field` + `detail.problems`);其余出口(收紧不得放宽)仍抛普通 `Error`。
+ * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体根上带 `field` + `problems` + `total`);其余出口(收紧不得放宽)仍抛普通 `Error`。
  */
 export declare class SettingsRuleRefusalError extends Error {
     readonly problems: readonly EntryProblem[];

package/dist/task-settings.js

@@ -1,4 +1,4 @@
-import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, hostChildEnvProblem, } from "@sema-agent/core";
 import { judgeUnmatchableToolNames } from "./config.js";
 import { NAME_TABLE_BEHAVIOR } from "./namespaced-rule-name.js";
 import { entryProblem } from "./entry-problems.js";
@@ -7,7 +7,7 @@ import { allowLayerEntryCountIssue, describeAllowLayerOverCap } from "./rule-ent
 import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
+import { hooksFieldCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
 import { HTTP_HOOK_ALLOWLIST_KEYS, SETTINGS_SOURCES, containsSecretToken } from "@sema-agent/settings-schema";
 import { echoCallerText } from "./caller-text-echo.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -140,6 +140,15 @@ export function settingsEnvCredentialIssue(reaching, credentialNames) {
         keys: hits.map((h) => h.key),
     };
 }
+const ENV_COMPOSE_REFUSAL_TAIL = "The request is refused rather than accepted into a task whose hooks and shell would fail to start: fix or remove the variable concerned";
+export function settingsEnvComposeIssue(reaching) {
+    if (reaching === undefined)
+        return null;
+    const verdict = hostChildEnvProblem([], reaching);
+    if (verdict === undefined)
+        return null;
+    return { message: `settings.env cannot be composed into a child process environment — ${echoCallerText(verdict, { maxChars: MAX_SETTINGS_ENV_KEY_CHARS + 128 })}. ${ENV_COMPOSE_REFUSAL_TAIL}`, field: "settings.env" };
+}
 export function withoutKeys(layer, keys) {
     const drop = new Set(keys);
     return { sent: layer.sent, reaching: Object.fromEntries(Object.entries(layer.reaching ?? {}).filter(([k]) => !drop.has(k))), unreadable: layer.unreadable };
@@ -261,7 +270,7 @@ export function hooksKeyIssue(raw, config) {
             return;
         for (const [key, value] of Object.entries(rawNode))
             if (value !== undefined && !Object.hasOwn(carried, key))
-                unknown.push(hooksCoordinate([...at, key]));
+                unknown.push(hooksFieldCoordinate([...at, key]));
     };
     for (const [event, groups] of Object.entries(config)) {
         for (const [groupIndex, group] of (groups ?? []).entries()) {
@@ -394,16 +403,18 @@ export function acceptAppendSystemPrompt(v, warn) {
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
-export function createWorkflowAskPolicy(isExempt) {
+export function createWorkflowAskPolicy(exemption) {
     return {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
             const ask = { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
-            if (isExempt && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, false))) {
+            if (exemption && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, false))) {
                 try {
-                    if (await isExempt(req.toolName))
+                    if (await exemption.has(req.toolName)) {
+                        exemption.onExempted(req.toolName);
                         return { action: "allow", decisionReason: "rule" };
+                    }
                 }
                 catch {
                 }
@@ -567,7 +578,7 @@ export function deriveSettingsPolicy(settings, bases) {
 }
 export function neverAutoNamesRefusal(names) {
     const field = tightenOnlySeatField("neverAuto");
-    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR });
+    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR, noticeSeat: "server" });
     if (judged === undefined)
         return undefined;
     return { message: judged.message, problems: judged.bad.map((b) => entryProblem(SETTINGS_RULE_REFUSAL_CODE, field, b.name, b.reason)) };

package/dist/terminal.d.ts

@@ -1,24 +1,3 @@
-/**
- * 终局因由(`TaskResult.terminal`)的 server 侧**读**面 —— 一个叶子模块:依赖 `@sema-agent/core`、进程级记录器(`observability/fail-open.ts`)
- * 与秘密脱敏器(`trace/redact.ts`,只作码判官 {@link isCodeToken} 的一条合取);本仓的结果汇点 / 出口座反过来依赖本模块,本模块不依赖它们。
- *
- * core 7.6.0([ref] S6 D-8,BREAKING)把 `TaskResult` 上并列的八个平面键
- * (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` / `checkpointId` /
- * `checkpointGate` / `workspaceRestoreMode`)删成**一条**带标因由 `terminal: TerminalCause`
- * (`completed` | `failed{code?,message?,nestedPause?}` | `blocked{reason}` | `paused{gate,token,…}`)。
- * 合法组合从此是**形状**而不是一串跨字段的口头约定(「`suspended` ⇔ 有 token」「review park 与 approval
- * park 不同时置位」)。
- *
- * ## 本仓的两条纪律(与 core 的单铸律配套)
- *
- * 1. **判断读因由,不读平面词**。`terminal.kind === "paused"` 是判据;`terminalProjection(terminal).status
- *    === "suspended"` 不是 —— 后者把一次投影塞进读点,于是同一个事实有了两个真源。
- * 2. **`terminalProjection` 只在明确的「投影出口」用一次**:必须继续说五词 `TaskStatus` 的那几张脸
- *    (run 行的 `status` / `error` 列、`tasks_total{status}` 计量标签、fleet 行的终态词)。出口之外不拼。
- *
- * wire 面(HTTP 任务体、SSE `done.result`)**就是结果本身**,所以它跟着 core 一起丢八键、带 `terminal`
- * —— 那里没有投影,只有转发(见 {@link sealResultForExit} 的例外)。
- */
 import { terminalProjection, type PausedCause, type TaskStatus, type TerminalCause } from "@sema-agent/core";
 /**
  * 这次失败带的**机器码**(`terminal.failed.code`);非失败终局 ⇒ `undefined`。
@@ -124,7 +103,8 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
 /**
  * **一条结果离开引擎、进入本仓(可重放账本 / run 行 / wire)的唯一封口** —— 两件事,一个出口:
  *  ①摘掉**耐久恢复能力凭据**(`CheckpointToken`)—— 座表 {@link PAUSE_SEATS} 上的每一座;②把**域外的失败码**折成本仓的
- *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes})。
+ *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes});
+ *  因由上折码时**失败句同时换成对外句**(类别句 + 原码尾注,库驱动原句不上 wire,{@link outwardStoreFailure})。
  *
  * 🔴 为什么两件事合在一只函数里而不是并列两只(7.92.2 改名 `stripResumeToken` → `sealResultForExit`):
  * 它们是**同一个出口上的同一件事** —— 「这条结果可以见人了吗」。并列两只 = 六个结算点各自要记得调两次,
@@ -146,10 +126,10 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
  * {@link sealStoredResult} —— 升级前落盘、还带着凭据的存量行在读面上同样摘掉。两件事都**幂等**,重复过口是同形。
  *
  * ── 折码的运维线索:一句定形字段,两只入口各说一只词 ──
- * 字段 `original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<观看点>`,只有闭集词、数字与码({@link isCodeToken}):
- * 失败句只报字节数,**永不**报原文 —— 失败句是自由文本(驱动句里可以有连接串 / 口令),结果里的那份由结果汇点脱敏,运维线索没有汇点,
- * 所以压根不带它;码形座里装着文字的、长得像码的秘密同理只报 `<not-a-code>`。`at` 说这是哪一次观看,**一个入口一只词**(类型给定,不靠记得传):
- *  · 本函数 = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ `at=exit`,每折一次一行 `[terminal] outward_failure_code_folded <字段>` —— 每次都是一件新的失败;
+ * 字段 `original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<观看点>`,只有闭集词、数字与码({@link isCodeToken});码形座里装着文字的、长得像码的秘密同理只报 `<not-a-code>`。
+ * 失败句(库驱动原句,自由文本:可以有连接串 / 口令 / 库账号 / 表名)**不上 wire**({@link outwardStoreFailure}),只进**写入口**那一行的末尾格 `message=<JSON 串>` ——
+ * 经出口座的一句话行(`operator-log-text`:凭据形换记号、剥控制字符、有界),读座的再观看不带(同一行存量行每读一次就重放一次)。`at` 说这是哪一次观看,**一个入口一只词**(类型给定,不靠记得传):
+ *  · 本函数 = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ `at=exit`,每折一次一行 `[terminal] outward_failure_code_folded <字段>[ message=<句>]` —— 每次都是一件新的失败;
  *  · {@link sealStoredResult} = 存量行的**再观看**(读座必填)⇒ 走 fail-open 纪律(登记 tag `server.terminal.stored-result-code-folded`):
  *    逐读计数 + 逐读探针行 + 每进程一次 warn,detail 即上面那句字段。读面每次轮询 / 每个观看者 / 每次重连都重放同一批行 ——
  *    计数让「旧失败被读了多少次」看得见,一次 warn 让日志不随读次放大;去重归记录器一只,不另造表。
@@ -166,6 +146,12 @@ export declare function sealResultForExit<T extends {
 export declare function sealStoredResult<T extends {
     readonly terminal?: unknown;
 }>(result: T, seat: StoredResultReadSeat): T;
+/**
+ * 腿**抛出**的错落进 run 行 `error` 列时的对外句(没有终局结果、没有因由的那一臂:`runs.ts` 后台腿的兜底腿与它的孪生 `resume-legs.ts` 兜底腿)—— 与终局因由是**同一只**
+ * 铸点({@link outwardStoreFailure}):抛出物自带的 `code`({@link errorCodeOf},字符串)出了本仓词法 ⇒ 同码同句;没有码 / 码在词法内(本仓与引擎自己的错、普通 `Error`)⇒ 文本逐字,非库错误照旧。
+ * `message` 是调用方已取出的抛出文本({@link errorText} 的产物,不抛);本函数不抛(读码口不抛)。
+ */
+export declare function outwardThrownMessage(err: unknown, message: string): string;
 /**
  * **投影出口的唯一属主**([ref])—— core 的 `terminalProjection` + 对外码归一,一次。
  *
@@ -208,30 +194,26 @@ export declare function pausedCauseOf(terminal: TerminalCause): PausedCause | un
  * **宿主边界上的诚实终局** —— 宿主 run 行停不停、停在哪个词上,只问这一只判官。
  *
  *  · 本腿自己的 `paused` ⇒ 原样(它就是宿主腿的停驻);
- *  · `failed.nestedPause` 且 `result.sessionId === hostSessionId` ⇒ 把那次停驻**整只**提成本腿的终局因由
- *    (门 / 凭据 / `checkpointId` 同址;结果的其余格 —— `stats` / `verification` / … —— 原样);
- *  · 其余 ⇒ **同一引用**原样(真失败;或嵌套停驻的卡不在宿主会话上)。
- *
- * 为什么判据是「停驻的那条腿跑在宿主会话上」:宿主的续跑链按会话把一张卡连回 run —— 决定腿按卡的会话找行
- * (`getActiveTaskId`)与续跑输入(`getCtx`),取消按 run 的会话找待决卡,过期收割按会话相等连行与卡。卡在宿主会话上,
- * 这条 run 才兑现得了它;判官只把兑现得了的停驻判成停驻。verify 的实现腿与修复轮跑在宿主会话上 ⇒ 提;cascade
- * 每级被引擎剥掉会话、级上的卡落在级自己现铸的会话上 ⇒ 不提(照常终局)。这不是按组合器分的特例:引擎让级上的卡落到
- * 宿主可连的会话上的那一天,答案随事实翻,本函数一个字不改。读 `result.sessionId` 而不去店里读卡:它与卡行的会话是同一次
- * `runTask` 的同一个量,零 I/O。
- *
- * 前提:结果出自 core 的组合器(可信产者)—— `failed.nestedPause` 只由引擎的嵌套边界包停驻铸,`paused` 只在卡行写入确认之后返回。
- * 判官**不**验证那张卡在不在、是不是这一张、此刻什么态;会话相等不是对卡的校验。验证器**自己**的停驻
- * (`verification.verifierPause`)不在结果因由里,本函数看不见它 —— 那一形照常终局;它那张卡本服务兑现不了,由结算点当场作废
+ *  · `failed.nestedPause` ⇒ 把那次停驻**整只**提成本腿的终局因由(门 / 凭据 / `checkpointId` 同址;结果的其余格 —— `stats` / `verification` / … —— 原样);
+ *  · 其余 ⇒ **同一引用**原样(真失败)。
+ *
+ * 为什么没有「停驻在不在宿主会话上」这一格:宿主的续跑链按**卡的归属会话**把卡连回 run(`checkpoint.host_session_id`,读法
+ * `plugins/checkpoint-index-columns.ts` 的 `hostSessionOf`:决断腿找 run 行与续跑输入、取消找 run 的卡、两条停驻收割、续跑输入回收都读它),
+ * 而组合入口在宿主边界上交回的每一次嵌套停驻,卡都归宿主的会话:verify 的实现腿与修复轮跑在宿主会话上(卡没有组合腿,归自己的会话 = 宿主会话);
+ * cascade 的每一级在自己现铸的会话里跑,卡上记着组合腿 `{ entry: "cascade", hostSessionId: spec.sessionId }`,归调用方的会话 = 宿主会话
+ * (本服务的组合写口恒带会话:提交腿没有不带会话的 run)。所以「宿主的续跑链兑现得了它」对每一次嵌套停驻都成立 —— 判官不读会话。
+ *
+ * 前提:结果出自 core 的组合器(可信产者),且组合器拿到的 spec 带宿主的会话 —— `failed.nestedPause` 只由引擎的嵌套边界包停驻铸,
+ * `paused` 只在卡行写入确认之后返回。判官**不**验证那张卡在不在、是不是这一张、此刻什么态。验证器**自己**的停驻
+ * (`verification.verifierPause`)不在结果因由里,本函数看不见它 —— 那一形照常终局;它那张卡归验证器自己的会话、本服务兑现不了,由结算点当场作废
  * (`verifier-pause-card.ts`),凭据由封口按座表摘。
  *
  * 纯函数,不读店、不抛。凭据随提升上来,摘除仍归 {@link sealResultForExit}(调用方照旧先 graft 后封口)。
  * 判官只答「该不该停驻」;认领保不保得住是停驻写口**写成功**与否的事(行写口对 `running` / `suspended` 行 CAS)。
- * `hostSessionId` 缺席 = 没有宿主会话 ⇒ 没有续跑链兑现得了嵌套停驻 ⇒ 原样(相等判自然为假,不另设臂)。
  */
 export declare function atHostBoundary<T extends {
     readonly terminal: TerminalCause;
-    readonly sessionId: string;
-}>(result: T, hostSessionId: string | undefined): T;
+}>(result: T): T;
 /**
  * **持久 blob 的平面读面** —— 把一条**任何年代**的持久终局结果读成五词 `status` + 三个平面文本格。
  *

package/dist/terminal.js

@@ -1,7 +1,10 @@
+import { writeLogText } from "./observability/logger.js";
 import { terminalProjection } from "@sema-agent/core";
 import { errorCodeOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
+import { seatText } from "./trace/exit-seat.js";
+import { storeFaultSentenceOfCode } from "./plugins/store-fault.js";
 export function failureCodeOf(terminal) {
     return terminal.kind === "failed" ? terminal.code : undefined;
 }
@@ -72,12 +75,24 @@ function foldCauseCode(terminal, at) {
     const t = failedCauseWithCode(terminal);
     if (t === undefined)
         return terminal;
-    const outward = outwardFailureCode(t.code);
-    if (outward === t.code)
+    if (outwardFailureCode(t.code) === t.code)
         return terminal;
-    reportFold(t.code, outward, t.message, at);
-    const message = typeof t.message === "string" ? t.message : "the durable store failed";
-    return { ...t, code: outward, message: `${message} [original code: ${t.code}]` };
+    const folded = outwardStoreFailure(t.code, t.message, at);
+    return { ...t, code: folded.code, message: folded.message };
+}
+function outwardStoreFailure(code, message, at) {
+    const outward = outwardFailureCode(code);
+    reportFold(code, outward, message, at);
+    return { code: outward, message: outwardStoreMessage(code) };
+}
+function outwardStoreMessage(code) {
+    return `${storeFaultSentenceOfCode(code)} [original code: ${code}]`;
+}
+export function outwardThrownMessage(err, message) {
+    const code = errorCodeOf(err);
+    if (code === undefined || outwardFailureCode(code) === code)
+        return message;
+    return outwardStoreFailure(code, message, "exit").message;
 }
 function foldAttemptCodes(attempts, at) {
     if (!Array.isArray(attempts))
@@ -102,9 +117,11 @@ function reportFold(code, outward, message, at) {
     const messageBytes = typeof message === "string" ? Buffer.byteLength(message, "utf8") : 0;
     const fields = `original=${isCodeToken(code) ? code : "<not-a-code>"} outward=${outward} messageBytes=${messageBytes} at=${at}`;
     switch (at) {
-        case "exit":
-            console.warn(`[terminal] outward_failure_code_folded ${fields}`);
+        case "exit": {
+            const sentence = typeof message === "string" && message !== "" ? ` message=${JSON.stringify(seatText("operator-log-text", message))}` : "";
+            writeLogText("stderr", `[terminal] outward_failure_code_folded ${fields}${sentence}`);
             return;
+        }
         case "run.result":
         case "ev.done.result":
             recordFailOpen(STORED_RESULT_FOLD_TAG, fields);
@@ -126,7 +143,9 @@ export function outwardPlane(terminal) {
     if (plane.errorCode === undefined)
         return plane;
     const outward = outwardFailureCode(plane.errorCode);
-    return outward === plane.errorCode ? plane : { ...plane, errorCode: outward };
+    if (outward === plane.errorCode)
+        return plane;
+    return plane.status === "failed" ? { ...plane, errorCode: outward, errorMessage: outwardStoreMessage(plane.errorCode) } : { ...plane, errorCode: outward };
 }
 export function nestedPauseOf(terminal) {
     return terminal.kind === "failed" ? terminal.nestedPause : undefined;
@@ -134,9 +153,9 @@ export function nestedPauseOf(terminal) {
 export function pausedCauseOf(terminal) {
     return terminal.kind === "paused" ? terminal : nestedPauseOf(terminal);
 }
-export function atHostBoundary(result, hostSessionId) {
+export function atHostBoundary(result) {
     const parked = nestedPauseOf(result.terminal);
-    if (parked === undefined || result.sessionId !== hostSessionId)
+    if (parked === undefined)
         return result;
     return { ...result, terminal: parked };
 }
@@ -162,10 +181,11 @@ export function persistedPlaneOf(result) {
             };
         }
     }
+    const flatFolded = typeof r.errorCode === "string" && outwardFailureCode(r.errorCode) !== r.errorCode;
     return {
         ...(typeof r.status === "string" ? { status: r.status } : {}),
         ...(typeof r.errorCode === "string" ? { errorCode: outwardFailureCode(r.errorCode) } : {}),
-        ...(typeof r.errorMessage === "string" ? { errorMessage: r.errorMessage } : {}),
+        ...(typeof r.errorMessage === "string" ? { errorMessage: flatFolded && typeof r.errorCode === "string" ? outwardStoreMessage(r.errorCode) : r.errorMessage } : {}),
         ...(typeof r.blockedReason === "string" ? { blockedReason: r.blockedReason } : {}),
     };
 }