@sema-agent/server 7.147.0 → 7.149.0

package/dist/task-settings.d.ts

@@ -57,6 +57,7 @@ import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import { type HttpHookAllowlistLayer } from "@sema-agent/settings-schema";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import type { EntryPermissionMode } from "./runtime-governance.js";
+import { type SessionExemptionRead } from "./approval.js";
 import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
@@ -319,6 +320,16 @@ export declare function readSettingsEnv(settings: unknown): SettingsEnvLayer;
  * 缺席 / 形不对 ⇒ `undefined` ⇒ 不判,形归受理门的形判)。`credentialNames` = 本进程的凭据变量名(调用方递 `serverCredentialValueSources(config.modelApiKeyEnv)`)。没有命中 ⇒ `null`。
  */
 export declare function settingsEnvCredentialIssue(reaching: Readonly<Record<string, string>> | undefined, credentialNames: readonly string[]): SettingsEnvCredentialIssue | null;
+/** {@link settingsEnvComposeIssue} 的产物:wire 文案 + 机读位(`field` 恒为 `settings.env`)。 */
+export interface SettingsEnvComposeIssue {
+    readonly message: string;
+    readonly field: "settings.env";
+}
+/**
+ * `settings.env` 里环境合成会拒的名 / 值的**受理判**(纯函数;律见上方段头)。`reaching` = {@link readSettingsEnv} 读出的那一份;缺席 / 形不对 ⇒ `undefined` ⇒ 不判(形归受理门的形判)。
+ * 没有话 ⇒ `null`;判官有话 ⇒ 句子 = 本站的头 + 判官的拒因原句(经调用方串的唯一回显口径:判官的句子里会点名变量名,名字是调用方写的串;值从不在句子里)+ 收尾。
+ */
+export declare function settingsEnvComposeIssue(reaching: Readonly<Record<string, string>> | undefined): SettingsEnvComposeIssue | null;
 /**
  * 一次性迁移 M38(窗口见 `plugins/one-time-migrations.ts` 登记表):从读到的那一份里去掉判据点名的原键,交回剥后的一份。**剥空 = 空表**(调用方送了这一块,剥完什么都不剩):
  * 解析层把它当作这次请求的环境层原样交出,`resolveSpec` 登记它 —— 覆盖这条会话上一条登记;若读成「缺席」,会话注册表按「缺席 = 留着上一条」把上一条(可能正是被剥的那个名字)留给 shell。
@@ -421,7 +432,7 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * (契约分类器携带的字段 + 本仓 wire 键:组的 `source`、command 条目的 `plugin`)。本函数不另立键表 —— 契约给某一型加字段、分类器开始携带它,这里随之受理
  * (契约包 19.0.0 承运 command 的 `args` / `onFailure` 与 http 的 `onFailure`、20.0.0 承运 command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、
  * prompt 的 `continueOnBlock` 时,这里一行未改就受理了它们 —— 受理 = 读者携带;后四键本服务如实带、不执行,能力位与契约附录明写);
- * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksCoordinate}(契约包出门形 + 回显口径;凭据形键段不原样回显)。
+ * 受理 ⇒ 分类器答 `loaded` ⇒ 组与条目的下标与原值逐位对齐。值为 `undefined` 的键与缺席同读(读者同一口径)。坐标经 {@link hooksFieldCoordinate}(请求坐标的唯一写法,方括号形 + 回显口径;凭据形键段不原样回显)。
  *
  * 判据边界(与另两个实例同):只判**键名**(值形归读者);拒只在 FRESH 提交面 —— 续跑重放走 {@link parseTaskSettings},读者照旧剥掉它不携带的键,存量体按受理时的读法重放(4xx 打在重放腿上会砖死停驻任务)。
  * 为什么必须拒:一只被剥掉的键对调用方读作「生效了」—— `plugin` 写在 http 条目上被剥掉,写的人以为插件上下文在;`args` 写在 http 条目上被剥掉,写的人以为不过 shell;
@@ -462,14 +473,7 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
  *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
-export declare function createWorkflowAskPolicy(isExempt?: WorkflowGateWiring["isExempt"]): ToolPolicy;
-/** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
- *  fs-independent: one shape on every execution lane. */
-export interface WorkflowGateWiring {
-    /** The session "don't ask again" probe (approvalExemptionStore.has, raw toolName key) — the same store and key space the
-     *  approval seat's standing grants read; one remember="session" grant serves them all. */
-    isExempt?: (toolName: string) => boolean | Promise<boolean>;
-}
+export declare function createWorkflowAskPolicy(exemption?: SessionExemptionRead): ToolPolicy;
 /**
  * 请求的 deny / ask 两张表解析路径形规则用的**基**(`resolve-spec.ts` 每请求供)。只有这两件事:这条 task 的真根、执行环境的 home。
  * 缺席 ⇒ 不声明(规则锚在装入这只策略的那条腿的真根,`~/` 形由 {@link rejectUnmatchableSettingsNames} 响亮拒)。
@@ -529,7 +533,7 @@ export interface FsWriteGateWiring {
 }
 /**
  * 请求的 `settings.permissions.deny` / `ask` 有永远不生效的条目 ⇒ 拒点({@link rejectUnmatchableSettingsNames})抛的错:句子(`message`)与这一遍判下来的**全部**问题(`problems`,机读位的原料)。
- * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体带 `field` + `detail.problems`);其余出口(收紧不得放宽)仍抛普通 `Error`。
+ * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体根上带 `field` + `problems` + `total`);其余出口(收紧不得放宽)仍抛普通 `Error`。
  */
 export declare class SettingsRuleRefusalError extends Error {
     readonly problems: readonly EntryProblem[];

package/dist/task-settings.js

@@ -1,4 +1,4 @@
-import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, hostChildEnvProblem, } from "@sema-agent/core";
 import { judgeUnmatchableToolNames } from "./config.js";
 import { NAME_TABLE_BEHAVIOR } from "./namespaced-rule-name.js";
 import { entryProblem } from "./entry-problems.js";
@@ -7,7 +7,7 @@ import { allowLayerEntryCountIssue, describeAllowLayerOverCap } from "./rule-ent
 import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
+import { hooksFieldCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
 import { HTTP_HOOK_ALLOWLIST_KEYS, SETTINGS_SOURCES, containsSecretToken } from "@sema-agent/settings-schema";
 import { echoCallerText } from "./caller-text-echo.js";
 import { heldRuleName } from "./tool-rule-names.js";
@@ -135,11 +135,21 @@ export function settingsEnvCredentialIssue(reaching, credentialNames) {
         message: `settings.env carries credentials: ${named.join(", ")}${more}. A credential reaches the engine only through the environment its process starts from, never through a request's settings.env — ` +
             "that block comes from a settings file the model can read, and the request hands it to the session's shell and hooks. Move these out of settings.env into the engine's environment " +
             "(a sema shell that keeps credentials in its credentials.env file does this; upgrade a shell that still writes them into settings.json). " +
+            "A settings hook reads a variable from the engine's environment only when the deployment names it in HOOK_ENV_ALLOW; this engine's own credential variables (the entries matched by name) reach no hook at all. " +
             "If an entry is not a credential: rename a variable that matched by name, or keep a value that matched by shape out of settings.env the same way (the shape scan is deliberately coarse)",
         fields: { field: "settings.env", entries },
         keys: hits.map((h) => h.key),
     };
 }
+const ENV_COMPOSE_REFUSAL_TAIL = "The request is refused rather than accepted into a task whose hooks and shell would fail to start: fix or remove the variable concerned";
+export function settingsEnvComposeIssue(reaching) {
+    if (reaching === undefined)
+        return null;
+    const verdict = hostChildEnvProblem([], reaching);
+    if (verdict === undefined)
+        return null;
+    return { message: `settings.env cannot be composed into a child process environment — ${echoCallerText(verdict, { maxChars: MAX_SETTINGS_ENV_KEY_CHARS + 128 })}. ${ENV_COMPOSE_REFUSAL_TAIL}`, field: "settings.env" };
+}
 export function withoutKeys(layer, keys) {
     const drop = new Set(keys);
     return { sent: layer.sent, reaching: Object.fromEntries(Object.entries(layer.reaching ?? {}).filter(([k]) => !drop.has(k))), unreadable: layer.unreadable };
@@ -261,7 +271,7 @@ export function hooksKeyIssue(raw, config) {
             return;
         for (const [key, value] of Object.entries(rawNode))
             if (value !== undefined && !Object.hasOwn(carried, key))
-                unknown.push(hooksCoordinate([...at, key]));
+                unknown.push(hooksFieldCoordinate([...at, key]));
     };
     for (const [event, groups] of Object.entries(config)) {
         for (const [groupIndex, group] of (groups ?? []).entries()) {
@@ -394,16 +404,18 @@ export function acceptAppendSystemPrompt(v, warn) {
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
-export function createWorkflowAskPolicy(isExempt) {
+export function createWorkflowAskPolicy(exemption) {
     return {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
             const ask = { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
-            if (isExempt && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, false))) {
+            if (exemption && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, false))) {
                 try {
-                    if (await isExempt(req.toolName))
+                    if (await exemption.has(req.toolName)) {
+                        exemption.onExempted(req.toolName);
                         return { action: "allow", decisionReason: "rule" };
+                    }
                 }
                 catch {
                 }
@@ -567,7 +579,7 @@ export function deriveSettingsPolicy(settings, bases) {
 }
 export function neverAutoNamesRefusal(names) {
     const field = tightenOnlySeatField("neverAuto");
-    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR });
+    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR, noticeSeat: "server" });
     if (judged === undefined)
         return undefined;
     return { message: judged.message, problems: judged.bad.map((b) => entryProblem(SETTINGS_RULE_REFUSAL_CODE, field, b.name, b.reason)) };

package/dist/terminal.d.ts

@@ -1,24 +1,3 @@
-/**
- * 终局因由(`TaskResult.terminal`)的 server 侧**读**面 —— 一个叶子模块:依赖 `@sema-agent/core`、进程级记录器(`observability/fail-open.ts`)
- * 与秘密脱敏器(`trace/redact.ts`,只作码判官 {@link isCodeToken} 的一条合取);本仓的结果汇点 / 出口座反过来依赖本模块,本模块不依赖它们。
- *
- * core 7.6.0([ref] S6 D-8,BREAKING)把 `TaskResult` 上并列的八个平面键
- * (`status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` / `checkpointId` /
- * `checkpointGate` / `workspaceRestoreMode`)删成**一条**带标因由 `terminal: TerminalCause`
- * (`completed` | `failed{code?,message?,nestedPause?}` | `blocked{reason}` | `paused{gate,token,…}`)。
- * 合法组合从此是**形状**而不是一串跨字段的口头约定(「`suspended` ⇔ 有 token」「review park 与 approval
- * park 不同时置位」)。
- *
- * ## 本仓的两条纪律(与 core 的单铸律配套)
- *
- * 1. **判断读因由,不读平面词**。`terminal.kind === "paused"` 是判据;`terminalProjection(terminal).status
- *    === "suspended"` 不是 —— 后者把一次投影塞进读点,于是同一个事实有了两个真源。
- * 2. **`terminalProjection` 只在明确的「投影出口」用一次**:必须继续说五词 `TaskStatus` 的那几张脸
- *    (run 行的 `status` / `error` 列、`tasks_total{status}` 计量标签、fleet 行的终态词)。出口之外不拼。
- *
- * wire 面(HTTP 任务体、SSE `done.result`)**就是结果本身**,所以它跟着 core 一起丢八键、带 `terminal`
- * —— 那里没有投影,只有转发(见 {@link sealResultForExit} 的例外)。
- */
 import { terminalProjection, type PausedCause, type TaskStatus, type TerminalCause } from "@sema-agent/core";
 /**
  * 这次失败带的**机器码**(`terminal.failed.code`);非失败终局 ⇒ `undefined`。
@@ -124,7 +103,10 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
 /**
  * **一条结果离开引擎、进入本仓(可重放账本 / run 行 / wire)的唯一封口** —— 两件事,一个出口:
  *  ①摘掉**耐久恢复能力凭据**(`CheckpointToken`)—— 座表 {@link PAUSE_SEATS} 上的每一座;②把**域外的失败码**折成本仓的
- *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes})。
+ *  `internal.store_error`({@link outwardFailureCode},[ref])—— 码座两只:因由的 `terminal.code` 与 cascade 每一级的 `attempts[].errorCode`(同一类码,见 {@link foldOutwardFailureCodes});
+ *  因由上折码时**失败句同时换成对外句**(类别句 + 原码尾注,库驱动原句不上 wire,{@link outwardStoreFailure})。
+ *  同一处还接上本仓对**读拒字节地板不守**的说法(属主 `read-deny-floor-notice.ts`):拒起的失败句是本仓那一句(码不变),照跑的结果按 `runId` 挂 `readDenyFloor`
+ *  ({@link withReadDenyFloorSummary})—— 结果离开引擎的每个出口都经这里,说法一处接上。
  *
  * 🔴 为什么两件事合在一只函数里而不是并列两只(7.92.2 改名 `stripResumeToken` → `sealResultForExit`):
  * 它们是**同一个出口上的同一件事** —— 「这条结果可以见人了吗」。并列两只 = 六个结算点各自要记得调两次,
@@ -146,10 +128,10 @@ export declare function mapPauseSeats<T>(result: T, f: (seat: SeatObject, keys:
  * {@link sealStoredResult} —— 升级前落盘、还带着凭据的存量行在读面上同样摘掉。两件事都**幂等**,重复过口是同形。
  *
  * ── 折码的运维线索:一句定形字段,两只入口各说一只词 ──
- * 字段 `original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<观看点>`,只有闭集词、数字与码({@link isCodeToken}):
- * 失败句只报字节数,**永不**报原文 —— 失败句是自由文本(驱动句里可以有连接串 / 口令),结果里的那份由结果汇点脱敏,运维线索没有汇点,
- * 所以压根不带它;码形座里装着文字的、长得像码的秘密同理只报 `<not-a-code>`。`at` 说这是哪一次观看,**一个入口一只词**(类型给定,不靠记得传):
- *  · 本函数 = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ `at=exit`,每折一次一行 `[terminal] outward_failure_code_folded <字段>` —— 每次都是一件新的失败;
+ * 字段 `original=<码 | <not-a-code>> outward=<对外词> messageBytes=<n> at=<观看点>`,只有闭集词、数字与码({@link isCodeToken});码形座里装着文字的、长得像码的秘密同理只报 `<not-a-code>`。
+ * 失败句(库驱动原句,自由文本:可以有连接串 / 口令 / 库账号 / 表名)**不上 wire**({@link outwardStoreFailure}),只进**写入口**那一行的末尾格 `message=<JSON 串>` ——
+ * 经出口座的一句话行(`operator-log-text`:凭据形换记号、剥控制字符、有界),读座的再观看不带(同一行存量行每读一次就重放一次)。`at` 说这是哪一次观看,**一个入口一只词**(类型给定,不靠记得传):
+ *  · 本函数 = 结果**第一次**离开引擎(店的写口 / 出口铸体)⇒ `at=exit`,每折一次一行 `[terminal] outward_failure_code_folded <字段>[ message=<句>]` —— 每次都是一件新的失败;
  *  · {@link sealStoredResult} = 存量行的**再观看**(读座必填)⇒ 走 fail-open 纪律(登记 tag `server.terminal.stored-result-code-folded`):
  *    逐读计数 + 逐读探针行 + 每进程一次 warn,detail 即上面那句字段。读面每次轮询 / 每个观看者 / 每次重连都重放同一批行 ——
  *    计数让「旧失败被读了多少次」看得见,一次 warn 让日志不随读次放大;去重归记录器一只,不另造表。
@@ -166,6 +148,12 @@ export declare function sealResultForExit<T extends {
 export declare function sealStoredResult<T extends {
     readonly terminal?: unknown;
 }>(result: T, seat: StoredResultReadSeat): T;
+/**
+ * 腿**抛出**的错落进 run 行 `error` 列时的对外句(没有终局结果、没有因由的那一臂:`runs.ts` 后台腿的兜底腿与它的孪生 `resume-legs.ts` 兜底腿)—— 与终局因由是**同一只**
+ * 铸点({@link outwardStoreFailure}):抛出物自带的 `code`({@link errorCodeOf},字符串)出了本仓词法 ⇒ 同码同句;没有码 / 码在词法内(本仓与引擎自己的错、普通 `Error`)⇒ 文本逐字,非库错误照旧。
+ * `message` 是调用方已取出的抛出文本({@link errorText} 的产物,不抛);本函数不抛(读码口不抛)。
+ */
+export declare function outwardThrownMessage(err: unknown, message: string): string;
 /**
  * **投影出口的唯一属主**([ref])—— core 的 `terminalProjection` + 对外码归一,一次。
  *
@@ -208,30 +196,26 @@ export declare function pausedCauseOf(terminal: TerminalCause): PausedCause | un
  * **宿主边界上的诚实终局** —— 宿主 run 行停不停、停在哪个词上,只问这一只判官。
  *
  *  · 本腿自己的 `paused` ⇒ 原样(它就是宿主腿的停驻);
- *  · `failed.nestedPause` 且 `result.sessionId === hostSessionId` ⇒ 把那次停驻**整只**提成本腿的终局因由
- *    (门 / 凭据 / `checkpointId` 同址;结果的其余格 —— `stats` / `verification` / … —— 原样);
- *  · 其余 ⇒ **同一引用**原样(真失败;或嵌套停驻的卡不在宿主会话上)。
- *
- * 为什么判据是「停驻的那条腿跑在宿主会话上」:宿主的续跑链按会话把一张卡连回 run —— 决定腿按卡的会话找行
- * (`getActiveTaskId`)与续跑输入(`getCtx`),取消按 run 的会话找待决卡,过期收割按会话相等连行与卡。卡在宿主会话上,
- * 这条 run 才兑现得了它;判官只把兑现得了的停驻判成停驻。verify 的实现腿与修复轮跑在宿主会话上 ⇒ 提;cascade
- * 每级被引擎剥掉会话、级上的卡落在级自己现铸的会话上 ⇒ 不提(照常终局)。这不是按组合器分的特例:引擎让级上的卡落到
- * 宿主可连的会话上的那一天,答案随事实翻,本函数一个字不改。读 `result.sessionId` 而不去店里读卡:它与卡行的会话是同一次
- * `runTask` 的同一个量,零 I/O。
- *
- * 前提:结果出自 core 的组合器(可信产者)—— `failed.nestedPause` 只由引擎的嵌套边界包停驻铸,`paused` 只在卡行写入确认之后返回。
- * 判官**不**验证那张卡在不在、是不是这一张、此刻什么态;会话相等不是对卡的校验。验证器**自己**的停驻
- * (`verification.verifierPause`)不在结果因由里,本函数看不见它 —— 那一形照常终局;它那张卡本服务兑现不了,由结算点当场作废
+ *  · `failed.nestedPause` ⇒ 把那次停驻**整只**提成本腿的终局因由(门 / 凭据 / `checkpointId` 同址;结果的其余格 —— `stats` / `verification` / … —— 原样);
+ *  · 其余 ⇒ **同一引用**原样(真失败)。
+ *
+ * 为什么没有「停驻在不在宿主会话上」这一格:宿主的续跑链按**卡的归属会话**把卡连回 run(`checkpoint.host_session_id`,读法
+ * `plugins/checkpoint-index-columns.ts` 的 `hostSessionOf`:决断腿找 run 行与续跑输入、取消找 run 的卡、两条停驻收割、续跑输入回收都读它),
+ * 而组合入口在宿主边界上交回的每一次嵌套停驻,卡都归宿主的会话:verify 的实现腿与修复轮跑在宿主会话上(卡没有组合腿,归自己的会话 = 宿主会话);
+ * cascade 的每一级在自己现铸的会话里跑,卡上记着组合腿 `{ entry: "cascade", hostSessionId: spec.sessionId }`,归调用方的会话 = 宿主会话
+ * (本服务的组合写口恒带会话:提交腿没有不带会话的 run)。所以「宿主的续跑链兑现得了它」对每一次嵌套停驻都成立 —— 判官不读会话。
+ *
+ * 前提:结果出自 core 的组合器(可信产者),且组合器拿到的 spec 带宿主的会话 —— `failed.nestedPause` 只由引擎的嵌套边界包停驻铸,
+ * `paused` 只在卡行写入确认之后返回。判官**不**验证那张卡在不在、是不是这一张、此刻什么态。验证器**自己**的停驻
+ * (`verification.verifierPause`)不在结果因由里,本函数看不见它 —— 那一形照常终局;它那张卡归验证器自己的会话、本服务兑现不了,由结算点当场作废
  * (`verifier-pause-card.ts`),凭据由封口按座表摘。
  *
  * 纯函数,不读店、不抛。凭据随提升上来,摘除仍归 {@link sealResultForExit}(调用方照旧先 graft 后封口)。
  * 判官只答「该不该停驻」;认领保不保得住是停驻写口**写成功**与否的事(行写口对 `running` / `suspended` 行 CAS)。
- * `hostSessionId` 缺席 = 没有宿主会话 ⇒ 没有续跑链兑现得了嵌套停驻 ⇒ 原样(相等判自然为假,不另设臂)。
  */
 export declare function atHostBoundary<T extends {
     readonly terminal: TerminalCause;
-    readonly sessionId: string;
-}>(result: T, hostSessionId: string | undefined): T;
+}>(result: T): T;
 /**
  * **持久 blob 的平面读面** —— 把一条**任何年代**的持久终局结果读成五词 `status` + 三个平面文本格。
  *

package/dist/terminal.js

@@ -1,7 +1,11 @@
+import { writeLogText } from "./observability/logger.js";
 import { terminalProjection } from "@sema-agent/core";
 import { errorCodeOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
+import { seatText } from "./trace/exit-seat.js";
+import { storeFaultSentenceOfCode } from "./plugins/store-fault.js";
+import { readDenyFloorRefusalMessage, readDenyFloorSummaryOf } from "./read-deny-floor-notice.js";
 export function failureCodeOf(terminal) {
     return terminal.kind === "failed" ? terminal.code : undefined;
 }
@@ -56,7 +60,14 @@ export function sealStoredResult(result, seat) {
 function seal(result, at) {
     if (result === null || typeof result !== "object")
         return result;
-    return foldOutwardFailureCodes(mapPauseSeats(result, dropCapability), at);
+    const sealed = foldOutwardFailureCodes(mapPauseSeats(result, dropCapability), at);
+    return at === "exit" ? withReadDenyFloorSummary(sealed) : sealed;
+}
+function withReadDenyFloorSummary(result) {
+    if (result.readDenyFloor !== undefined)
+        return result;
+    const summary = readDenyFloorSummaryOf(result.runId);
+    return summary === undefined ? result : { ...result, readDenyFloor: summary };
 }
 function foldOutwardFailureCodes(result, at) {
     const terminal = foldCauseCode(result.terminal, at);
@@ -72,12 +83,26 @@ function foldCauseCode(terminal, at) {
     const t = failedCauseWithCode(terminal);
     if (t === undefined)
         return terminal;
-    const outward = outwardFailureCode(t.code);
-    if (outward === t.code)
-        return terminal;
-    reportFold(t.code, outward, t.message, at);
-    const message = typeof t.message === "string" ? t.message : "the durable store failed";
-    return { ...t, code: outward, message: `${message} [original code: ${t.code}]` };
+    if (outwardFailureCode(t.code) === t.code) {
+        const presented = at === "exit" ? readDenyFloorRefusalMessage(t.code) : undefined;
+        return presented === undefined || presented === t.message ? terminal : { ...t, message: presented };
+    }
+    const folded = outwardStoreFailure(t.code, t.message, at);
+    return { ...t, code: folded.code, message: folded.message };
+}
+function outwardStoreFailure(code, message, at) {
+    const outward = outwardFailureCode(code);
+    reportFold(code, outward, message, at);
+    return { code: outward, message: outwardStoreMessage(code) };
+}
+function outwardStoreMessage(code) {
+    return `${storeFaultSentenceOfCode(code)} [original code: ${code}]`;
+}
+export function outwardThrownMessage(err, message) {
+    const code = errorCodeOf(err);
+    if (code === undefined || outwardFailureCode(code) === code)
+        return message;
+    return outwardStoreFailure(code, message, "exit").message;
 }
 function foldAttemptCodes(attempts, at) {
     if (!Array.isArray(attempts))
@@ -102,9 +127,11 @@ function reportFold(code, outward, message, at) {
     const messageBytes = typeof message === "string" ? Buffer.byteLength(message, "utf8") : 0;
     const fields = `original=${isCodeToken(code) ? code : "<not-a-code>"} outward=${outward} messageBytes=${messageBytes} at=${at}`;
     switch (at) {
-        case "exit":
-            console.warn(`[terminal] outward_failure_code_folded ${fields}`);
+        case "exit": {
+            const sentence = typeof message === "string" && message !== "" ? ` message=${JSON.stringify(seatText("operator-log-text", message))}` : "";
+            writeLogText("stderr", `[terminal] outward_failure_code_folded ${fields}${sentence}`);
             return;
+        }
         case "run.result":
         case "ev.done.result":
             recordFailOpen(STORED_RESULT_FOLD_TAG, fields);
@@ -122,11 +149,18 @@ function failedCauseWithCode(t) {
     return kind === "failed" && typeof code === "string" ? { ...t, kind, code } : undefined;
 }
 export function outwardPlane(terminal) {
+    return outwardProjection(terminal, "exit");
+}
+function outwardProjection(terminal, at) {
     const plane = terminalProjection(terminal);
     if (plane.errorCode === undefined)
         return plane;
     const outward = outwardFailureCode(plane.errorCode);
-    return outward === plane.errorCode ? plane : { ...plane, errorCode: outward };
+    if (outward === plane.errorCode) {
+        const presented = at === "exit" && plane.status === "failed" ? readDenyFloorRefusalMessage(plane.errorCode) : undefined;
+        return presented === undefined ? plane : { ...plane, errorMessage: presented };
+    }
+    return plane.status === "failed" ? { ...plane, errorCode: outward, errorMessage: outwardStoreMessage(plane.errorCode) } : { ...plane, errorCode: outward };
 }
 export function nestedPauseOf(terminal) {
     return terminal.kind === "failed" ? terminal.nestedPause : undefined;
@@ -134,9 +168,9 @@ export function nestedPauseOf(terminal) {
 export function pausedCauseOf(terminal) {
     return terminal.kind === "paused" ? terminal : nestedPauseOf(terminal);
 }
-export function atHostBoundary(result, hostSessionId) {
+export function atHostBoundary(result) {
     const parked = nestedPauseOf(result.terminal);
-    if (parked === undefined || result.sessionId !== hostSessionId)
+    if (parked === undefined)
         return result;
     return { ...result, terminal: parked };
 }
@@ -147,7 +181,7 @@ export function persistedPlaneOf(result) {
     if (r.terminal !== null && typeof r.terminal === "object") {
         let projected;
         try {
-            projected = outwardPlane(r.terminal);
+            projected = outwardProjection(r.terminal, "stored");
         }
         catch (e) {
             recordFailOpen("server.terminal.persisted-plane-malformed", e instanceof Error ? e.message : String(e));
@@ -162,10 +196,11 @@ export function persistedPlaneOf(result) {
             };
         }
     }
+    const flatFolded = typeof r.errorCode === "string" && outwardFailureCode(r.errorCode) !== r.errorCode;
     return {
         ...(typeof r.status === "string" ? { status: r.status } : {}),
         ...(typeof r.errorCode === "string" ? { errorCode: outwardFailureCode(r.errorCode) } : {}),
-        ...(typeof r.errorMessage === "string" ? { errorMessage: r.errorMessage } : {}),
+        ...(typeof r.errorMessage === "string" ? { errorMessage: flatFolded && typeof r.errorCode === "string" ? outwardStoreMessage(r.errorCode) : r.errorMessage } : {}),
         ...(typeof r.blockedReason === "string" ? { blockedReason: r.blockedReason } : {}),
     };
 }