@sema-agent/server 7.147.0 → 7.149.0

package/dist/stores-sql/tool-result-store-sql.js

@@ -3,7 +3,7 @@ import { pgSanitizeText } from "../plugins/pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-declaration.js";
 import { ensureIndexes } from "../plugins/ensure-index.js";
-import { describeProbedTableDrift, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
+import { probedMissingColumnRefusal, schemaMismatchRefusal, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
 import { isMissingColumnError } from "../plugins/sql-errors.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
@@ -29,7 +29,7 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
         : "SELECT character_maximum_length AS len FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'tool_result' AND column_name = 'ref'").catch(() => ({ rows: [] }));
     const width = Number(widthRow.rows[0]?.len ?? NaN);
     if (Number.isFinite(width) && width < MAX_MINTED_TOOL_RESULT_REF_CHARS) {
-        throw new Error(`tool_result.ref is VARCHAR(${width}) but core 5.26.0 mints refs up to ${MAX_MINTED_TOOL_RESULT_REF_CHARS} characters ` +
+        throw schemaMismatchRefusal(`tool_result.ref is VARCHAR(${width}) but core 5.26.0 mints refs up to ${MAX_MINTED_TOOL_RESULT_REF_CHARS} characters ` +
             `(#119 made the ref injective: four \`~\`-separated segments) — refusing to start. A truncating primary key aliases two distinct refs onto ` +
             `one row — one run's tool output reads back from another run's ref. ` +
             `The ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} database is behind this build on that key column; offloaded results are a recoverable-window cache, ` +
@@ -46,13 +46,11 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
     catch (err) {
         if (!isMissingColumnError(err, dialect))
             throw err;
-        throw new Error(`tool_result is missing the #119 provenance columns (owner_session_id / owner_task_id) — refusing to start. ` +
+        throw await probedMissingColumnRefusal(query, dialect, ["tool_result"], `tool_result is missing the #119 provenance columns (owner_session_id / owner_task_id) — refusing to start. ` +
             `This release picks up @sema-agent/core 5.26.0, which changed how an offloaded tool result is addressed ` +
             `(the ref grew past the old VARCHAR(190) key) and made the store record who wrote each row. Without the columns every offload write ` +
             `fails with unknown column and core's failure arm turns it into an inline placeholder — the service keeps running and the tool output is lost. ` +
-            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected).\n` +
-            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
-            (await describeProbedTableDrift(query, dialect, ["tool_result"])));
+            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected).`, err);
     }
 }
 function toolResultAgeCutoff(now, opts) {

package/dist/stores-sql/windowed-session-storage.d.ts

@@ -45,6 +45,11 @@ export declare abstract class WindowedSessionStorage implements SessionStorage {
     getReplayLoss(): ReturnType<InMemorySessionStorage["getReplayLoss"]>;
     /** 窗口此刻的日志标记(同步读;引擎存储的读法)。 */
     logMarkNow(): SessionLogMark;
+    /**
+     * 窗口的地板那一条(窗口里就有,不另读库)—— 地板之下的 epoch 锚从它的父起沿分支走(`plugins/session-epoch-anchor.ts` 的 `epochFloorOf`)。
+     * 没有地板(整条日志都在窗口里)⇒ `undefined`;地板 id 指向窗口里没有的条目 ⇒ 坏会话(响亮)。
+     */
+    protected windowFloorEntry(): Promise<SessionTreeEntry | undefined>;
     /** 窗口里没有的 id(地板之下)回落到库。 */
     getEntry(id: string): Promise<SessionTreeEntry | undefined>;
     appendEntry(entry: SessionTreeEntry, opts?: SessionWriteOptions): Promise<void>;

package/dist/stores-sql/windowed-session-storage.js

@@ -39,6 +39,15 @@ export class WindowedSessionStorage {
     logMarkNow() {
         return this.view.logMarkNow();
     }
+    async windowFloorEntry() {
+        const floorId = this.view.getFloorId();
+        if (floorId === null)
+            return undefined;
+        const floor = await this.view.getEntry(floorId);
+        if (floor === undefined)
+            throw new SessionError("corrupt_session", `Entry ${floorId} not found — the window's floor names an entry the window does not hold`);
+        return floor;
+    }
     async getEntry(id) {
         return (await this.view.getEntry(id)) ?? (await this.readBelowFloor(id));
     }

package/dist/submission-exit.d.ts

@@ -0,0 +1,50 @@
+import type { DeploymentShapeInput } from "./deployment-shape.js";
+import type { RunAcceptance } from "./run-acceptance.js";
+import type { SessionWithdrawFace } from "./plugins/session-birth.js";
+import type { SessionBirth, StoreKeptWord } from "./session-incarnation.js";
+/** 收场词(闭集;加词 ⇒ {@link SubmissionSeat.close} 的穷尽 switch 编译红)。 */
+export type SubmissionEnd = "accepted" | "record" | "refused";
+/** 「留」的词:店内七词 + 座内四词(`withdraw_failed` = 撤回事务抛了,按留答)。 */
+export type KeptWord = StoreKeptWord | "env" | "attached" | "accepted" | "record" | "withdraw_failed";
+/** 收场的结局(计数的 `verdict` 标签)。 */
+export type SubmissionVerdict = "withdrawn" | `kept_${KeptWord}`;
+/**
+ * 座读的部署件:计数口(缺 ⇒ 不计)与撤回之后的**进程内尾处理**(与 `DELETE /v1/sessions/:id` 同一组:会话登记簿四表 —— cwd / shellEnv / inheritEnv / 属主 ——
+ * 与 SSE watch 条目;缺 ⇒ 本部署没有那一张表)。
+ */
+export interface SubmissionSeatDeps {
+    /** 部署形(调用方递 `ServiceConfig` 整份):撤回之后记墓碑时,「同一位属主」的窄互认臂读它(`security.ts` 的 `sameSessionOwner`)。必填 —— 缺了就没有判据可记墓碑。 */
+    readonly deployment: DeploymentShapeInput<"principal">;
+    readonly metrics?: {
+        inc(name: string, labels?: Record<string, string>, n?: number): void;
+    };
+    /** 只清这一位住客的条目(记下的住客恰是候选 ⇒ 清、答 `true`)。 */
+    readonly dropSessionScopedOf?: (sessionId: string, incarnation: string) => boolean;
+    readonly sessionWatch?: {
+        dropSession(sessionId: string): void;
+    };
+}
+/** 一次提交的出口座(提交门在授权之前铸;三条提交腿只喂它、收它)。 */
+export interface SubmissionSeat {
+    /** 授权器登记新行时交来的候选与店的撤回面(只有新行臂调;调多次以第一次为准)。 */
+    noteBirth(birth: SessionBirth, face: SessionWithdrawFace): void;
+    /** 提交门铸好 spec 之后挂上受理座(闩的唯一读者在 {@link close})。 */
+    attachAcceptance(acceptance: Pick<RunAcceptance, "accepted">): void;
+    /** 本请求认领赢的耐久 run(四个建行点);同时按它的 run id 听执行环境见证(`env-witness.ts`,收场时注销)。 */
+    noteOwnRun(taskId: string): void;
+    /** 结果查询责任交给本请求自己的耐久 run(后台 run 的 202 / 断连转后台的流认领赢)。 */
+    markRecord(): void;
+    /** 执行环境为这次提交留下了按会话键的持久物。 */
+    noteEnvWitness(): void;
+    /** 此刻判不判得出「留」而不必走店(闩上 / record / 没有候选 / 有见证)。 */
+    readonly keepsWithoutWithdraw: boolean;
+    /** 收场(幂等、先到者定;不抛)。 */
+    close(): Promise<SubmissionVerdict>;
+    /** 终局应答的唯一写口:判得出「留」⇒ 立写;否则先收场({@link close},撤回事务落定)再写。交回的承诺在写完时兑现。持流的腿在引擎最后一笔会话写之后才调(终帧暂存在腿里)。 */
+    deliverTerminal(write: () => void): Promise<void>;
+}
+/** 铸一只出口座(提交门在授权之前调;不经提交门的车道没有座)。 */
+export declare function createSubmissionSeat(deps: SubmissionSeatDeps): SubmissionSeat;
+/** 拒的写口:提交门之后(有座)⇒ 经 {@link SubmissionSeat.deliverTerminal};提交门之前(没有座,集外:还没铸会话)⇒ 当场写。 */
+export declare function deliverVia(seat: Pick<SubmissionSeat, "deliverTerminal"> | undefined, write: () => void): Promise<void>;
+//# sourceMappingURL=submission-exit.d.ts.map

package/dist/submission-exit.js

@@ -0,0 +1,108 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+import { listenEnvWitness } from "./env-witness.js";
+import { retireSessionId } from "./deleted-session-ids.js";
+import { seatText } from "./trace/exit-seat.js";
+export function createSubmissionSeat(deps) {
+    let birth;
+    let acceptance;
+    let ownTaskId;
+    let recorded = false;
+    let witnessed = false;
+    let closing;
+    let unlisten;
+    const endNow = () => (acceptance?.accepted === true ? "accepted" : recorded ? "record" : "refused");
+    const settle = async () => {
+        const end = endNow();
+        let verdict;
+        switch (end) {
+            case "accepted":
+                verdict = "kept_accepted";
+                break;
+            case "record":
+                verdict = "kept_record";
+                break;
+            case "refused":
+                verdict = await withdrawOrKeep();
+                break;
+            default: {
+                const unknownEnd = end;
+                throw new Error(`submission exit: no end word ${JSON.stringify(unknownEnd)}`);
+            }
+        }
+        deps.metrics?.inc("submission_exit_total", { end, verdict });
+        return verdict;
+    };
+    const withdrawOrKeep = async () => {
+        if (birth === undefined)
+            return "kept_attached";
+        if (witnessed)
+            return "kept_env";
+        let out;
+        try {
+            out = await birth.face.withdrawBirth(birth.birth, ownTaskId);
+        }
+        catch (err) {
+            recordFailOpen("server.submission-exit.withdraw-failed", `session=${birth.birth.sessionId} err=${seatText("operator-log-text", err instanceof Error ? err.message : String(err))}`);
+            return "kept_withdraw_failed";
+        }
+        if (!out.withdrawn)
+            return `kept_${out.kept}`;
+        endWithdrawnTenancy(birth.birth);
+        return "withdrawn";
+    };
+    const endWithdrawnTenancy = (b) => {
+        retireSessionId(b.sessionId, b.owner, deps.deployment);
+        if (deps.dropSessionScopedOf?.(b.sessionId, b.incarnation) === true)
+            deps.sessionWatch?.dropSession(b.sessionId);
+    };
+    const seat = {
+        noteBirth(b, face) {
+            if (birth === undefined)
+                birth = { birth: b, face };
+        },
+        attachAcceptance(a) {
+            acceptance = a;
+        },
+        noteOwnRun(taskId) {
+            ownTaskId = taskId;
+            if (closing !== undefined || birth === undefined)
+                return;
+            unlisten?.();
+            unlisten = listenEnvWitness(taskId, () => seat.noteEnvWitness());
+        },
+        markRecord() {
+            recorded = true;
+        },
+        noteEnvWitness() {
+            witnessed = true;
+        },
+        get keepsWithoutWithdraw() {
+            return birth === undefined || witnessed || endNow() !== "refused";
+        },
+        close() {
+            if (closing === undefined) {
+                unlisten?.();
+                unlisten = undefined;
+                closing = settle();
+            }
+            return closing;
+        },
+        async deliverTerminal(write) {
+            if (closing === undefined && seat.keepsWithoutWithdraw) {
+                write();
+                return;
+            }
+            await seat.close();
+            write();
+        },
+    };
+    return seat;
+}
+export async function deliverVia(seat, write) {
+    if (seat === undefined) {
+        write();
+        return;
+    }
+    await seat.deliverTerminal(write);
+}
+//# sourceMappingURL=submission-exit.js.map

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("url" | "name" | "headers" | "toolAxes" | "principalHeader" | "cardUrl" | "allowSkills")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -68,8 +68,6 @@ export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" |
 export declare function snapshotRequestA2a(raw: unknown, options: {
     readonly reread: boolean;
 }): unknown;
-/** 读这条对端的是哪条腿:`fresh` = 新提交;`resume` = 续跑重放升级前存下的请求体(`boot/resolve-spec.ts` 的 `opts.leg` 分流,同一个读法)。 */
-type A2aRequestLeg = "fresh" | "resume";
 /** 请求面对端 → 草稿:按 {@link A2A_PEER_DISPOSITION} 拆(`headers` 进件,其余进声明;拆法与 MCP 请求腿同一只 `splitDeclaration`)。件缺席或空 ⇒ 草稿不带件。纯函数,不登记。 */
 export declare function toA2aDraft(peer: RequestA2aPeer): A2aDraft;
 /**
@@ -81,8 +79,8 @@ export declare function validateRequestA2a(raw: unknown): {
     dropped: A2aInjectionDrop[];
 } | null;
 /**
- * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.__proto__`:成员名过回显清洗,只会是读器的保留名,不带值、不带调用方写的对端名)——
- * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},续跑重放腿的读法;新提交腿上同一形由判官表 400)。
+ * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.<保留名>`:成员名只会是契约包保留成员名表里的名字,不带值、不带调用方写的对端名)——
+ * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},只有一种读法;新提交腿上同一形先由判官表 400)。
  * 挂不上的对端不算(整条不进,有自己的留声)。`storedToolAxes` = 续跑重放腿递的 M19 重读座。不是数组 ⇒ 空。
  */
 export declare function requestA2aHeadersUnread(raw: unknown, storedToolAxes?: StoredToolAxesRereadM19): string[];
@@ -123,9 +121,6 @@ desk: Pick<PeerDesk, "declare">, lease: PeerLease, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
 }, 
-/** 哪条腿在读(`boot/resolve-spec.ts` 按 `opts.leg` 递;缺省 = 新提交,最严的读法):只决定 `headers` 里 `__proto__` 名成员的处置(见 {@link normalizeA2aPeer})。 */
-leg?: A2aRequestLeg, 
 /** 一次性迁移 M19 的重读座(窗口见 `plugins/one-time-migrations.ts` 登记表):只在续跑重放腿、只在窗开着时由 `boot/resolve-spec.ts` 递进来 —— 与 MCP 请求腿同一份。 */
 storedToolAxes?: StoredToolAxesRereadM19): A2aServerSpec[] | undefined;
-export {};
 //# sourceMappingURL=task-a2a.d.ts.map

package/dist/task-a2a.js

@@ -1,13 +1,13 @@
 import { types } from "node:util";
 import { resolveComplianceDenies } from "@sema-agent/core";
-import { describeNotStringArray, describeValueShape, findUrlCredential, isStringArray } from "@sema-agent/settings-schema";
+import { describeNotStringArray, describeValueShape, findUrlCredential, isStringArray, readPlainStringRecord } from "@sema-agent/settings-schema";
 import { errorKindOf } from "./observability/err-text.js";
-import { declarationKeys, readPlainStringRecord, splitDeclaration } from "./plain-string-record.js";
+import { declarationKeys, splitDeclaration } from "./request-declaration-disposition.js";
 import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
-import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
+import { MAX_KEY_ECHO, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { createMountSeat, declarationEntryNotObject, declarationIssueFacts, declarationNameIssue, declarationOverCapFacts, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 import { sendHeaderOwnershipIssue } from "./task-mcp.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
@@ -33,13 +33,13 @@ export const A2A_PEER_DISPOSITION = {
 export const A2A_PEER_ENTRY_KEYS = declarationKeys(A2A_PEER_DISPOSITION);
 const A2A_PEER_ENTRY_KEY_SET = new Set(A2A_PEER_ENTRY_KEYS);
 const NO_TOLERATED_KEYS = new Set();
-const A2A_SEAT = {
+const A2A_SEAT = createMountSeat({
     list: "a2aPeers",
     cap: MAX_REQUEST_A2A_PEERS,
     subject: "peer",
     declaration: "an A2A peer declaration",
     declarations: "A2A peer declarations",
-};
+});
 function peerUrlIssue(key) {
     return (entry, at) => {
         const value = entry[key];
@@ -53,7 +53,12 @@ function peerUrlIssue(key) {
     };
 }
 const A2A_SEND_HEADER_PATHS = { headers: "headers", principalHeader: "principalHeader" };
-const HEADERS_RESERVED_MEMBER_PATH = "headers.__proto__";
+function readPeerHeaders(raw) {
+    const read = readPlainStringRecord(raw);
+    if (!read.ok)
+        return { record: undefined, issues: [{ path: "headers", reason: `must be a plain object of string values — ${read.detail}` }] };
+    return { record: read.record, issues: read.reservedMembers.map((name) => ({ path: `headers.${name}`, reason: `no member of a declaration may be named "${name}"` })) };
+}
 const PEER_SNAPSHOT = Symbol("a2aPeerSnapshot");
 function openCloneNode(v, ancestors) {
     if (v === null || v === undefined || typeof v === "string" || typeof v === "number" || typeof v === "boolean")
@@ -134,7 +139,7 @@ function mintPeerSnapshot(entry, reread) {
         cardUrl: source.cardUrl,
         principalHeader: source.principalHeader,
         allowSkills: Array.isArray(allowSkills) ? Array.from(allowSkills) : allowSkills,
-        headers: headers === undefined ? undefined : readPlainStringRecord(headers),
+        headers: headers === undefined ? undefined : readPeerHeaders(headers),
         toolAxes: toolAxesRead,
         toolAxesDeclared: reread && toolAxesRead !== undefined && !toolAxesRead.ok ? cloneDeclaration(toolAxes) : undefined,
         unknownKeys: Object.keys(source).filter((name) => !A2A_PEER_ENTRY_KEY_SET.has(name)),
@@ -162,18 +167,10 @@ const A2A_PEER_KEY_JUDGES = {
     name: declarationNameIssue,
     url: peerUrlIssue("url"),
     cardUrl: peerUrlIssue("cardUrl"),
-    headers: (o) => {
-        const read = o.headers;
-        if (read === undefined)
-            return undefined;
-        if (!read.ok)
-            return { path: "headers", reason: `must be a plain object of string values — ${read.member === undefined ? read.fault : `its member "${echoKeyName("", read.member)}" ${read.fault}`}` };
-        const reserved = read.stripped[0];
-        return reserved === undefined ? undefined : { path: HEADERS_RESERVED_MEMBER_PATH, reason: reserved.fault };
-    },
+    headers: (o) => o.headers?.issues[0],
     principalHeader: (o) => o.principalHeader !== undefined && typeof o.principalHeader !== "string"
         ? { path: "principalHeader", reason: `must be a string (a header name) — got ${describeValueShape(o.principalHeader)}` }
-        : sendHeaderOwnershipIssue({ headers: o.headers?.ok === true ? o.headers.record : undefined, principalHeader: o.principalHeader }, "a2a", A2A_SEND_HEADER_PATHS),
+        : sendHeaderOwnershipIssue({ headers: o.headers?.record, principalHeader: o.principalHeader }, "a2a", A2A_SEND_HEADER_PATHS),
     allowSkills: (o) => o.allowSkills === undefined || isStringArray(o.allowSkills)
         ? undefined
         : { path: "allowSkills", reason: `must be an array of strings (omit the key to leave the peer's skills unrestricted) — got ${describeNotStringArray(o.allowSkills)}` },
@@ -182,19 +179,20 @@ const A2A_PEER_KEY_JUDGES = {
         return read === undefined || read.ok ? undefined : toolAxesIssue(read);
     },
 };
-function normalizeA2aPeer(e, leg, at, storedToolAxes) {
+function normalizeA2aPeer(e, at, storedToolAxes) {
     const dropBecause = (issue) => ({ draft: null, because: declarationIssueFacts(at, issue) });
     const notObject = declarationEntryNotObject(A2A_SEAT, e, at);
     if (notObject !== undefined)
         return { draft: null, because: { field: at, reason: notObject } };
     const o = snapshotPeer(e, storedToolAxes !== undefined);
+    const lost = o.headers?.record === undefined ? [] : o.headers.issues;
     for (const key of A2A_PEER_ENTRY_KEYS) {
         const issue = A2A_PEER_KEY_JUDGES[key](o, at);
         if (issue === undefined)
             continue;
         if (issue.credential !== undefined)
             continue;
-        if (leg === "resume" && issue.path === HEADERS_RESERVED_MEMBER_PATH)
+        if (lost.includes(issue))
             continue;
         if (key === "toolAxes" && storedToolAxes !== undefined)
             continue;
@@ -204,9 +202,9 @@ function normalizeA2aPeer(e, leg, at, storedToolAxes) {
     if (o.cardUrl !== undefined)
         spec.cardUrl = o.cardUrl;
     const { headers, toolAxes: axes } = o;
-    if (headers?.ok === true)
+    if (headers?.record !== undefined)
         spec.headers = headers.record;
-    const lost = headers?.ok === true && headers.stripped.length > 0 ? { headersLost: headers.stripped.map((m) => echoKeyName("headers.", m.name)) } : {};
+    const headersLost = lost.length > 0 ? { headersLost: lost.map((issue) => issue.path) } : {};
     if (o.principalHeader !== undefined)
         spec.principalHeader = o.principalHeader;
     if (o.allowSkills !== undefined)
@@ -227,22 +225,22 @@ function normalizeA2aPeer(e, leg, at, storedToolAxes) {
                 return unread;
             if (again.toolAxes !== undefined)
                 spec.toolAxes = again.toolAxes;
-            return { draft: toA2aDraft(spec), toolAxesReread: peerSentence(axes.problem), ...lost };
+            return { draft: toA2aDraft(spec), toolAxesReread: peerSentence(axes.problem), ...headersLost };
         }
         if (axes.toolAxes !== undefined)
             spec.toolAxes = axes.toolAxes;
     }
-    return { draft: toA2aDraft(spec), ...lost };
+    return { draft: toA2aDraft(spec), ...headersLost };
 }
 export function toA2aDraft(peer) {
     const split = splitDeclaration(peer, A2A_PEER_DISPOSITION);
     return { spec: split.engine, ...(split.pieces === undefined ? {} : { pieces: split.pieces }) };
 }
 export function validateRequestA2a(raw) {
-    const v = validateRequestA2aEntries(raw, "fresh");
+    const v = validateRequestA2aEntries(raw);
     return v === null ? null : { ok: v.ok, dropped: v.dropped };
 }
-function validateRequestA2aEntries(raw, leg, storedToolAxes) {
+function validateRequestA2aEntries(raw, storedToolAxes) {
     if (raw === undefined || raw === null)
         return { ok: [], dropped: [], toolAxesReread: [] };
     if (!Array.isArray(raw))
@@ -251,7 +249,7 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     const dropped = [];
     const toolAxesReread = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
-        const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
+        const read = normalizeA2aPeer(e, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
         if (read.draft !== null) {
             ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
@@ -271,7 +269,7 @@ export function requestA2aHeadersUnread(raw, storedToolAxes) {
     const out = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const at = `${A2A_SEAT.list}[${i}]`;
-        const read = normalizeA2aPeer(e, "resume", at, storedToolAxes);
+        const read = normalizeA2aPeer(e, at, storedToolAxes);
         if (read.draft !== null)
             for (const member of read.headersLost ?? [])
                 out.push(`${at}.${member}`);
@@ -307,14 +305,14 @@ export function mergeRequestA2a(baseline, drafts, desk, lease) {
     const winners = drafts.filter((d) => !taken.has(d.spec.name));
     return winners.length === 0 ? baseline : [...(baseline ?? []), ...winners.map((d) => mintDeclaration(desk, d, lease))];
 }
-export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger, leg = "fresh", storedToolAxes) {
+export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger, storedToolAxes) {
     if (bodyA2a === undefined || bodyA2a === null)
         return baseline;
     if (!a2aInjectionHonored(config)) {
         logger?.warn("a2a_injection_ignored", { reason: "gate_closed (per-request A2A peers honored only on a single-user, unlocked, compliance-permitted deployment)" });
         return baseline;
     }
-    const v = validateRequestA2aEntries(bodyA2a, leg, storedToolAxes);
+    const v = validateRequestA2aEntries(bodyA2a, storedToolAxes);
     if (v === null) {
         logger?.warn("a2a_injection_ignored", { reason: "a2aPeers not an array" });
         return baseline;

package/dist/task-cwd.d.ts

@@ -1,4 +1,5 @@
 import { type DeploymentShapeInput } from "./deployment-shape.js";
+import type { RunInternals } from "@sema-agent/core";
 /**
  * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
  * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符
@@ -85,23 +86,58 @@ export declare function parseAdditionalDirectories(raw: unknown): string[] | und
  * sandbox — "当前工作目录为空"): resolve the HOST lane's effective workspace for a task. Precedence:
  *   1. the session's explicitly-registered `cwd` (the caller's own launch dir, the cwd seam) — an explicit
  *      per-session choice always wins;
- *   2. the TRUSTED `ctx.parentCwd` (core threads the PARENT task's working root via `RunInternals` when this
- *      task is a delegated child — never a TaskSpec field), UNLESS the child asked for `isolation:"worktree"`
- *      (an isolated fan-out child must not share the parent's mutable dir) — then `undefined`;
- *   3. undefined → the factory's ephemeral per-task dir (top-level task with no registered cwd).
+ *   2. the TRUSTED `ctx.parentCwd` — the working root of the run that handed this leg its work, via `RunInternals`
+ *      (never a TaskSpec field): a delegating parent (core threads it to a delegated child) or a composition host (the
+ *      submission whose cascade ladder / verification gate this leg belongs to: those legs run in sessions the engine
+ *      mints, which arm 1 cannot read, so the composition entries hand them the submission's registered cwd —
+ *      {@link compositionLegRoot}) — UNLESS the leg asked for `isolation:"worktree"` (an isolated fan-out child must
+ *      not share the parent's mutable dir) — then `undefined`;
+ *   3. undefined → the factory's ephemeral per-task dir (no registered cwd anywhere up the chain).
  * The `isolation:"worktree"` ⇒ `undefined` rule is this function's own and holds by itself (the child never inherits the
  * parent's dir). It is NOT what answers a worktree ask on the host lane: `boot/execution-env.ts` never reaches here with one —
  * the worktree wrapper (one layer out) mints the tree and does not call the base factory, and without the wrapper the base
  * factory REFUSES (`isolation.unavailable`) instead of minting the empty ephemeral dir rule 3 would give. That refusal arm is
  * revoked when engine 7.61.0 refuses by itself; this function's rule then goes on keeping the child off the parent's dir.
- * CC parity: a Task sub-agent inherits the main session's cwd. Trust: `parentCwd` comes from core's trusted
- * run-internals channel (same posture as `isolation`), so no tenancy gate is needed here — but the HOST lane
- * itself is single-user by deployment shape, and container lanes (k8s/e2b/local-docker) never consult this.
+ * CC parity: a Task sub-agent inherits the main session's cwd. Trust: `parentCwd` comes from the trusted
+ * run-internals channel (same posture as `isolation`) — written by core's delegation callers, or by this service's
+ * composition entries from a cwd the registration gate (`callerCwd`) already admitted — so no tenancy gate is needed
+ * here; the HOST lane itself is single-user by deployment shape, and container lanes (k8s/e2b/local-docker) never consult this.
  */
 export declare function effectiveHostWorkspace(sessionCwd: string | undefined, ctx: {
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/**
+ * 组合入口(`runCascade` / `resumeCascade` / `runWithVerification` / `resumeWithVerification`)交给它驱动的**每一条腿**的那一格:这次提交登记的工作目录,
+ * 作交活方的工作目录(`RunInternals.parentCwd`)—— {@link effectiveHostWorkspace} 的第 2 臂,委派子代用的同一臂(device 车道的 `effectiveDeviceCwd` 同序)。
+ *
+ * 为什么组合腿要它:梯子的每一级是在引擎**现铸的会话**里冷跑(core `runCascade` 剥掉 spec 的 `sessionId`),验证门的验证器腿的 spec 不带会话 ——
+ * 工厂按腿的会话查登记表(第 1 臂)查不到提交登记在根会话上的那一枚,不交就落第 3 臂(临时目录):用户让梯子在项目里改文件,改到了别处;验证器验的是一只空目录。
+ * 跑在根会话上的腿(验证门的实现腿 / 修复腿)第 1 臂先命中,同一个值。
+ * 没登记(`registeredCwd` 缺席:非 host / device 车道、多租户、根会话的提交从没带过 `cwd`、嵌入方装配器没铸事实)⇒ 空对象 —— 每一条腿照旧落临时目录、收场由托管表删。
+ * 登记粘在会话上(`setSessionCwd` 只在请求带 `cwd` 时写):同一会话之前带过、这次不带 ⇒ 交的仍是那一枚 —— 与第 1 臂对同一会话上普通 run 的读法一致。
+ */
+export declare function compositionLegRoot(registeredCwd: string | undefined): Pick<RunInternals, "parentCwd">;
+/** {@link launchWorkspaceOf} 读到的那一格出自哪里(闭集;起服那一行日志与随包文档的 `workspaceFrom` 词)。 */
+export type LaunchWorkspaceFrom = "workspace-flag" | "host-workspace-base" | "process-cwd";
+/** 起服时的「工作区」:目录 + 它读自哪一格。 */
+export interface LaunchWorkspace {
+    readonly dir: string;
+    readonly from: LaunchWorkspaceFrom;
+}
+/** 读起服工作区要看的部署事实(`ServiceConfig` 结构上满足:只有 `host` 车道有 `workspaceBase`)。 */
+export interface LaunchWorkspaceDeployment {
+    readonly remoteExec: {
+        readonly provider: string;
+        readonly workspaceBase?: string | undefined;
+    };
+}
+/**
+ * **起服时「工作区」的唯一读链**:显式给的(`run-local --workspace`)?? 部署声明的车道工作区底(`REMOTE_EXEC=host` 的 `HOST_WORKSPACE_BASE`)?? 本进程的工作目录。
+ * 两个入口读同一只:`run-local` 的 `workspaceDir`(它的手就跑在这个目录里)与 HTTP 服务起服时的「配置根是不是工作区祖先」那一判(`sema-config-dir.ts`)。
+ * 它回答的是**起服时本服务知道**的那一个目录;请求体里按任务给的 `cwd`(每会话登记)起服时不可知,不在这条链里。
+ */
+export declare function launchWorkspaceOf(config: LaunchWorkspaceDeployment, explicit?: string, cwd?: () => string): LaunchWorkspace;
 /**
  * run 外回退口问「host 工厂这一次会落在一只**实在的**目录上吗」:根 = {@link effectiveHostWorkspace}(引擎 run 外环境请求的上下文归约成 `{}` ⇒ 就是登记的 cwd),
  * 且它此刻是盘上的一只目录 ⇒ 交回它;没有根,或那只目录**不在**(`ENOENT` / `ENOTDIR`,或在但不是目录)⇒ `undefined`(调用方答 409:根不可知)。

package/dist/task-cwd.js

@@ -46,6 +46,17 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export function compositionLegRoot(registeredCwd) {
+    return registeredCwd !== undefined ? { parentCwd: registeredCwd } : {};
+}
+export function launchWorkspaceOf(config, explicit, cwd = process.cwd) {
+    if (explicit !== undefined)
+        return { dir: explicit, from: "workspace-flag" };
+    const base = config.remoteExec.provider === "host" ? config.remoteExec.workspaceBase : undefined;
+    if (base !== undefined)
+        return { dir: base, from: "host-workspace-base" };
+    return { dir: cwd(), from: "process-cwd" };
+}
 export async function presentHostWorkspaceOf(sessionCwd) {
     const root = effectiveHostWorkspace(sessionCwd, {});
     if (root === undefined)

package/dist/task-mcp.d.ts

@@ -69,9 +69,9 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  */
 export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
 /** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
-export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("env" | "kind" | "args" | "command")[];
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("kind" | "env" | "args" | "command")[];
 /** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("headers" | "url" | "kind" | "principalHeader" | "assertionHeader")[];
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("url" | "kind" | "headers" | "principalHeader" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -189,7 +189,7 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 重放腿走读器({@link normalizeServer} / {@link classifyRequestMcp}),处置:整只不是数组 ⇒ 整只忽略 + 运维 warn `mcp_injection_ignored`;条目不是对象 / 坏硬键
  * (`name` / `transport` 硬字段 / `allowTools` / `toolAxes` / `toolFaces`)⇒ 这一条 server 整条不进 + 运维 warn `mcp_injection_dropped` + 用户面通告 `mcp.injection_dropped` 点名 `field`
  * (`toolAxes` 在一次性迁移 M19 的窗开着时先按升级前读法重读一次,过了就挂,见读器的注);超上限的尾项 ⇒ `over_cap` 点名;坏软键(`contentOrigin` / `elicitation` / `source`)
- * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫 `__proto__` 的成员、
+ * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫保留名(`__proto__` / `constructor` / `prototype`)的成员、
  * `args` / `principalHeader` 坏形)⇒ 这份请求不重放(「请求成员读不出」那一只判据,`unread-request-members.ts`,经 {@link requestMcpTransportUnread} 读这一座;续跑腿折 409)。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;

package/dist/task-mcp.js

@@ -5,12 +5,12 @@ import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
 import { MCP_HTTP_TRANSPORT_DISPOSITION, MCP_STDIO_TRANSPORT_DISPOSITION, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toMcpDraft, } from "./mcp-assertion-header.js";
-import { declarationKeys } from "./plain-string-record.js";
+import { declarationKeys } from "./request-declaration-disposition.js";
 import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
-import { MALFORMED_NAME, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
+import { MALFORMED_NAME, createMountSeat, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -152,13 +152,13 @@ export function requestMcpDeclarationRefusal(list) {
 export function assertRequestMcpEntries(bodyMcp) {
     throwDeclarationRefusal(requestMcpDeclarationRefusal(bodyMcp));
 }
-const MCP_SEAT = {
+const MCP_SEAT = createMountSeat({
     list: "mcpServers",
     cap: MAX_REQUEST_MCP_SERVERS,
     subject: "server",
     declaration: "an MCP server declaration",
     declarations: "MCP server declarations",
-};
+});
 const ENTRY_KEY_SET = new Set(MCP_SERVER_ENTRY_KEYS);
 const STDIO_TRANSPORT_KEY_SET = new Set(STDIO_MCP_TRANSPORT_KEYS);
 const HTTP_TRANSPORT_KEY_SET = new Set(HTTP_MCP_TRANSPORT_KEYS);