@sema-agent/server 7.147.0 → 7.149.0

package/dist/config-provider.js

@@ -1,13 +1,13 @@
-import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore, readEnvModelsDecision } from "@sema-agent/settings-schema/node";
 import { envModelsDecisionTag } from "@sema-agent/settings-schema";
 import { REMOTE_CATALOG_SOURCE } from "./env-model-table-gate.js";
 import { assertLocalConfigDirTrusted } from "./config-dir-trust.js";
-import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
+import { candidateRefusedBy } from "./config-pull-failure.js";
+import { danglingRefs, emptyEffective, findSkillContent, promptArtifactFor, renderRefIssue, resolveEffectiveForWorker, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, skillToolListsOf, WebAdminHttpError, } from "./web-admin-client/facade.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { remoteConfigProviderUrlRefusal } from "./config-invariants.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -31,7 +31,7 @@ const redactContractSentence = (text) => redactSecrets(text);
 const redactDroppedEntry = (d) => ({ ...d, error: redactContractSentence(d.error) });
 const redactRefusedDocument = (d) => ({ ...d, error: redactContractSentence(d.error) });
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
-export function raceBootFetch(fetch, budgetMs) {
+export function raceBootFetch(pull, budgetMs) {
     if (budgetMs <= 0)
         return Promise.resolve(BOOT_FETCH_DEFERRED);
     let timer;
@@ -39,7 +39,7 @@ export function raceBootFetch(fetch, budgetMs) {
         timer = setTimeout(() => res(BOOT_FETCH_DEFERRED), budgetMs);
         timer.unref?.();
     });
-    return Promise.race([fetch.finally(() => clearTimeout(timer)), budget]);
+    return Promise.race([pull.finally(() => clearTimeout(timer)), budget]);
 }
 export class RemoteConfigProvider {
     cc;
@@ -95,7 +95,15 @@ export class LocalConfigProvider {
     }
     async fetchEffective(etag) {
         await assertLocalConfigDirTrusted({ root: this.root, declaredOwnerUid: this.#declaredOwnerUid });
-        const read = await this.#store.read();
+        let read;
+        try {
+            read = await this.#store.read();
+        }
+        catch (readerError) {
+            if (isFileSystemError(readerError))
+                throw readerError;
+            throw candidateRefusedBy(readerError);
+        }
         const envModels = await readEnvModelsDecision(this.root);
         const catalogSource = { kind: "local", root: this.root, envModels };
         const tag = buildLocalConfigEtag(read.kind === "refused" ? read.version : read.effective.version, envModels);
@@ -128,7 +136,7 @@ export class LocalConfigProvider {
         this.#servedSkills = eff.skills;
         const unreadKeys = localUnreadPromptKeys(eff.prompts);
         return {
-            effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
+            effective: withDroppedCatalogEntries(publishLocalEffective(eff), folded.droppedCatalogEntries),
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
             ...(unreadKeys.length > 0 ? { unreadKeys } : {}),
@@ -138,9 +146,15 @@ export class LocalConfigProvider {
         return findSkillContent(this.#servedSkills, contentHash);
     }
 }
+function isFileSystemError(e) {
+    if (!(e instanceof Error))
+        return false;
+    const { syscall, code } = e;
+    return typeof syscall === "string" && typeof code === "string";
+}
 function refusedFaces(read) {
     return {
-        effective: mapToServiceEffective({ ...emptyEffective(), version: read.version }, read.version),
+        effective: publishLocalEffective({ ...emptyEffective(), version: read.version }),
         refusedDocuments: read.refusals.map(redactRefusedDocument),
     };
 }
@@ -152,108 +166,9 @@ function localPromptsWire(prompts, version) {
     const artifact = prompts === undefined ? undefined : promptArtifactFor(prompts, null);
     return artifact === undefined ? {} : { prompts: { schemaVersion: 2, artifact: { ...artifact, sourceRevision: `local:r${version}` } } };
 }
-export function mapToServiceEffective(eff, version) {
-    return {
-        version,
-        updatedAt: eff.updatedAt,
-        models: {
-            models: (eff.models.models ?? []).map((m) => ({
-                name: m.name,
-                id: m.id,
-                provider: m.provider,
-                api: m.api,
-                ...(m.baseUrl !== undefined ? { baseUrl: m.baseUrl } : {}),
-                ...(m.apiKeyEnv !== undefined ? { apiKeyEnv: m.apiKeyEnv } : {}),
-                ...(m.sealedApiKey !== undefined ? { sealedApiKey: m.sealedApiKey } : {}),
-                ...(m.quotaWeight !== undefined ? { quotaWeight: m.quotaWeight } : {}),
-                tier: m.tier,
-                ...(m.reasoning !== undefined ? { reasoning: m.reasoning } : {}),
-                ...(m.vision !== undefined ? { vision: m.vision } : {}),
-                ...(m.thinkingLevelMap !== undefined ? { thinkingLevelMap: m.thinkingLevelMap } : {}),
-                ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
-                ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
-                ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),
-                ...(typeof m.charsPerToken === "number" ? { charsPerToken: m.charsPerToken } : {}),
-                ...(m.cost !== undefined ? { cost: m.cost } : {}),
-                ...(m.extraBody !== undefined ? { extraBody: m.extraBody } : {}),
-                ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(m.headers !== undefined ? { headers: m.headers } : {}),
-                ...(m.promptGuidance !== undefined ? { promptGuidance: m.promptGuidance } : {}),
-                enabled: m.enabled,
-            })),
-            roles: eff.models.roles ?? {},
-            atMention: eff.models.atMention,
-            ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
-            ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
-        },
-        ...(eff.collab?.templates?.length ? { collab: { templates: eff.collab.templates } } : {}),
-        ...(eff.plugins?.plugins?.length ? { plugins: { plugins: eff.plugins.plugins } } : {}),
-        a2a: eff.a2a,
-        skills: {
-            skills: (eff.skills.skills ?? []).map((s) => ({
-                name: s.name,
-                description: s.description,
-                scenarios: s.scenarios ?? [],
-                contentHash: skillContentHash(s.content),
-                enabled: s.enabled,
-                ...skillToolListsOf(s),
-            })),
-        },
-        mcp: {
-            servers: (eff.mcp.servers ?? []).map((s) => {
-                const base = {
-                    name: s.name,
-                    scenarios: s.scenarios ?? [],
-                    enabled: s.enabled,
-                    ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
-                    ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
-                    ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
-                    ...readMcpSourceLabel(s.name, s.source),
-                    ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
-                    ...(s.toolAxes !== undefined ? { toolAxes: s.toolAxes } : {}),
-                    ...(s.sessionMetaKey !== undefined ? { sessionMetaKey: s.sessionMetaKey } : {}),
-                    ...(s.startupTimeoutMs !== undefined ? { startupTimeoutMs: s.startupTimeoutMs } : {}),
-                    ...(s.authForm !== undefined ? { authForm: s.authForm } : {}),
-                    ...(s.entryKind !== undefined ? { entryKind: s.entryKind } : {}),
-                };
-                if (s.transport.kind === "stdio") {
-                    return {
-                        ...base,
-                        transport: {
-                            kind: "stdio",
-                            command: s.transport.command,
-                            ...(s.transport.args !== undefined ? { args: s.transport.args } : {}),
-                            ...(s.transport.envRefs !== undefined ? { envRefs: s.transport.envRefs } : {}),
-                        },
-                    };
-                }
-                return {
-                    ...base,
-                    transport: {
-                        kind: "http",
-                        url: s.transport.url,
-                        ...(s.transport.headerRefs !== undefined ? { headerRefs: s.transport.headerRefs } : {}),
-                        ...(s.transport.principalHeader !== undefined ? { principalHeader: s.transport.principalHeader } : {}),
-                        ...(s.transport.assertionHeader !== undefined ? { assertionHeader: s.transport.assertionHeader } : {}),
-                    },
-                };
-            }),
-        },
-        ...localPromptsWire(eff.prompts, version),
-        scenarios: {
-            scenarios: (eff.scenarios.scenarios ?? []).map((sc) => ({
-                name: sc.name,
-                toolset: sc.toolset,
-                enabled: sc.enabled,
-            })),
-        },
-        ...(eff.limits !== undefined ? { limits: eff.limits } : {}),
-        governance: {
-            ...(eff.governance.autonomy !== undefined ? { autonomy: eff.governance.autonomy } : {}),
-            ...(eff.governance.commandPolicy !== undefined ? { commandPolicy: eff.governance.commandPolicy } : {}),
-            ...(eff.governance.approvalRequire !== undefined ? { approvalRequire: eff.governance.approvalRequire } : {}),
-        },
-    };
+export function publishLocalEffective(eff) {
+    const { prompts: _storageForm, ...wire } = resolveEffectiveForWorker(eff, null).config;
+    return { ...wire, ...localPromptsWire(eff.prompts, eff.version) };
 }
 export function createConfigProvider(input) {
     const kind = configSourceKind({ configProvider: input.provider, webAdmin: input.webAdmin });

package/dist/config-pull-failure.d.ts

@@ -0,0 +1,50 @@
+/**
+ * 一次配置拉取失败的**成因** —— 在拉取那一层定一次,失败行(起服 `config_source_unreachable_using_env` / 刷新拍 `web_admin_refresh_failed` /
+ * 迟到起服重拉 `config_boot_arrival_repull_failed` / run-local)读同一个值(错误上的 `pullCause`),不各写一份。
+ *
+ * 判据只有一条:**错误的型**。拉取层自己铸型 —— 契约读腿整包抛 ⇒ 读腿那一处包成 {@link ConfigCandidateRefusedError}({@link candidateRefusedBy};远程腿 `http-client.ts`、本地腿
+ * `config-provider.ts`;本地腿的目录信任拒 `ConfigDirUntrustedError` 是它的子类);应答属于一把已不在用的中心凭证 ⇒ {@link ConfigPullSupersededError}
+ * (起服服务的拉取口 `pullEffective`);其余一切出自拉取口的抛 ⇒ 拉取口包成 {@link ConfigSourceUnreachableError}。所以一只 catch 不用自记「走到哪一段了」:
+ * 是 {@link ConfigPullError} ⇒ 拉取失败(词 = 它的 `pullCause`);不是 ⇒ 拉取已成、后面的段抛的。
+ *
+ * 包装不改运维读到的那一句:包出来的错与原错 `name` / `message` 逐字同(`String(err)` 逐字同),原错挂在 `cause` 上。
+ *
+ * 纯叶(零 import)。
+ */
+/**
+ * 拉取失败的成因闭集(词序即文档序;加词 ⇒ {@link configPullFailureNote} 的穷尽 `switch` 编译红):
+ *  · `unreachable` —— 没拿到候选:传输错 / HTTP 非 2xx / 凭证取不到 / 重定向被拒 / 超时 / 读体途中断;本地腿上文件系统的错(读不到目录里的字节);
+ *  · `rejected` —— 配置源答了,本引擎拒收这份候选:契约读腿整包抛(门控域判形失败、载荷不是有效视图、体不是 JSON),或本地配置目录不被信任;
+ *  · `superseded` —— 应答在飞期间中心凭证换了人,这份应答属于上一把凭证 ⇒ 弃掉(下一拉按现凭证)。
+ */
+export declare const CONFIG_PULL_FAILURE_CAUSES: readonly ["unreachable", "rejected", "superseded"];
+export type ConfigPullFailureCause = (typeof CONFIG_PULL_FAILURE_CAUSES)[number];
+/** 刷新失败行的成因:拉取失败三词之外多一词 `apply_refused`(拉取已成、应用段抛 —— 起服把这一形记成另一个事件 `config_apply_refused`,刷新拍与迟到起服只有一行)。 */
+export type ConfigRefreshFailureCause = ConfigPullFailureCause | "apply_refused";
+/** 拉取层铸的错误型的共同基类(具体型只有下面三只与目录信任拒;成因读 `pullCause`)。 */
+export declare abstract class ConfigPullError extends Error {
+    abstract readonly pullCause: ConfigPullFailureCause;
+    protected constructor(message: string, name: string, options?: ErrorOptions);
+}
+/** `rejected`:配置源答了,本引擎拒收这份候选。读腿处用 {@link candidateRefusedBy} 包读者的原错;目录信任拒(`ConfigDirUntrustedError`)是子类,自铸句子。 */
+export declare class ConfigCandidateRefusedError extends ConfigPullError {
+    readonly pullCause: "rejected";
+    constructor(message: string, name: string, options?: ErrorOptions);
+}
+/** 读腿整包抛 ⇒ `rejected`(与原错 `name` / `message` 逐字同,原错挂 `cause`)。远程腿 `fetchEffective` 与本地腿 `LocalConfigProvider.fetchEffective` 的读腿处各调一次。 */
+export declare function candidateRefusedBy(readerError: unknown): ConfigCandidateRefusedError;
+/** `superseded`:应答属于一把已不在用的中心凭证。 */
+export declare class ConfigPullSupersededError extends ConfigPullError {
+    readonly pullCause: "superseded";
+    constructor(message: string);
+}
+/** `unreachable`:没拿到候选。拉取口用 {@link asConfigPullError} 包其余一切抛。 */
+export declare class ConfigSourceUnreachableError extends ConfigPullError {
+    readonly pullCause: "unreachable";
+    constructor(transportError: unknown);
+}
+/** 一次拉取的抛 ⇒ 拉取层铸的型(已是 ⇒ 原样;否则 ⇒ `unreachable`)。拉取口(起服服务的 `pullEffective`、run-local 的那一拉)的 catch 只调它。 */
+export declare function asConfigPullError(err: unknown): ConfigPullError;
+/** 失败行的 `note`(穷尽 switch:成因闭集加词不补句 ⇒ 编译红)。 */
+export declare function configPullFailureNote(cause: ConfigPullFailureCause): string;
+//# sourceMappingURL=config-pull-failure.d.ts.map

package/dist/config-pull-failure.js

@@ -0,0 +1,48 @@
+export const CONFIG_PULL_FAILURE_CAUSES = ["unreachable", "rejected", "superseded"];
+const nameOf = (e) => (e instanceof Error ? e.name : "Error");
+const messageOf = (e) => (e instanceof Error ? e.message : String(e));
+export class ConfigPullError extends Error {
+    constructor(message, name, options) {
+        super(message, options);
+        this.name = name;
+    }
+}
+export class ConfigCandidateRefusedError extends ConfigPullError {
+    pullCause = "rejected";
+    constructor(message, name, options) {
+        super(message, name, options);
+    }
+}
+export function candidateRefusedBy(readerError) {
+    return new ConfigCandidateRefusedError(messageOf(readerError), nameOf(readerError), { cause: readerError });
+}
+export class ConfigPullSupersededError extends ConfigPullError {
+    pullCause = "superseded";
+    constructor(message) {
+        super(message, "Error");
+    }
+}
+export class ConfigSourceUnreachableError extends ConfigPullError {
+    pullCause = "unreachable";
+    constructor(transportError) {
+        super(messageOf(transportError), nameOf(transportError), { cause: transportError });
+    }
+}
+export function asConfigPullError(err) {
+    return err instanceof ConfigPullError ? err : new ConfigSourceUnreachableError(err);
+}
+export function configPullFailureNote(cause) {
+    switch (cause) {
+        case "unreachable":
+            return "no candidate was obtained from the config source (transport error, non-2xx answer, credential unavailable, redirect refused, timeout, or a filesystem error reading the local config directory) — the serving config stays as it is and the next pull retries";
+        case "rejected":
+            return "the config source answered but this engine refuses the candidate (a gate domain failed its schema, the payload is not an effective config, or the local config directory is not trusted) — `err` carries the reader's sentence with the field path; fix the named document";
+        case "superseded":
+            return "the answer belonged to a center credential that is no longer current — discarded; the next pull runs under the current credential";
+        default: {
+            const unhandled = cause;
+            throw new Error(`config pull failure: unknown cause ${String(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=config-pull-failure.js.map

package/dist/config-types.d.ts

@@ -5,10 +5,12 @@
  *  in config.ts, which re-exports these names so existing `from "./config.js"` importers keep
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
+import type { LocalStoreDeclarationWord } from "./local-store-declaration.js";
 import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedCustodyPoison } from "./key-resolver.js";
 import type { ModelEntryRefusal } from "./model-entry-refusal.js";
+import type { ContextWindowSource } from "./model-context-window.js";
 import type { DroppedCatalogEntry } from "./web-admin-client/read-warnings.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
@@ -24,6 +26,7 @@ import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sem
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 import type { AtMention, ProjectRegistration, SandboxGitConfig } from "@sema-agent/settings-schema";
 import type { ModsDeclaration } from "./mods-declaration.js";
+import type { LocalDockerCapacityConfig } from "./plugins/local-docker-capacity.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
  *  {@link ServiceConfigFlat.memoryEmbedder}。纯数据 —— 端点原文照存(拼 `/embeddings` 是 transport
@@ -359,6 +362,11 @@ export interface A2aServeSkill {
     description?: string;
     /** INTERNAL scenario key this skill runs under. NEVER projected onto the card. */
     scenario: string;
+    /** Who this skill is PUBLISHED to (exact verified principal names). Absent = every caller. A caller whose verified person is
+     *  not listed neither sees the skill on any card nor can name it by id — a PUBLICATION choice, not a capability grant (the
+     *  scenario behind it stays reachable through every entry that does not read skills; the scenario gate is the only authority).
+     *  NEVER projected onto the card. */
+    audience?: readonly string[];
 }
 /**
  * DESIGN-269 §3.3 车2 —— the server-as-peer block. **Absence IS the OFF state** (`A2A_SERVE_ENABLED`
@@ -378,7 +386,7 @@ export interface A2aServeConfig {
     description?: string;
     /** `A2A_SERVE_URL` — the PUBLIC JSON-RPC endpoint URL announced on the card (http/https, validated). */
     url: string;
-    /** `A2A_SERVE_SKILLS` — declared skills (may be empty: an honest "I take work, I advertise no skill"). */
+    /** `A2A_SERVE_SKILLS` (versioned envelope `{"version":2,"skills":[…]}`) — declared skills (may be empty: an honest "I take work, I advertise no skill"). */
     skills: A2aServeSkill[];
     /** `A2A_SERVE_BLOCKING_WAIT_MS` — how long a `blocking:true` `message/send` waits for a terminal state
      *  before answering `working` and letting the caller poll `tasks/get`. Server-side budget only — it is
@@ -658,6 +666,9 @@ export type RemoteExecConfig = {
     /** [ref] —— `DOCKER_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同一只解析器、
      *  同一只谓词;每条 `docker exec` 以 `-e K=V` 注入)。键缺席 = 旋钮未设 / 空串。 */
     env?: Record<string, string>;
+    /** 车道容器帽(`DOCKER_MAX_CONTAINERS`)。> 0 才在场;缺席 = 关 = 不建闸
+     *  (`plugins/local-docker-capacity.ts`,计数律与射程的唯一属主)。 */
+    capacity?: LocalDockerCapacityConfig;
 };
 export interface ServiceConfigFlat {
     port: number;
@@ -759,9 +770,23 @@ export interface ServiceConfigFlat {
      * 源码钉(`test/served-model-route.test.ts` 的类钉)把这两处写口列成白名单。
      */
     envModel: Model;
+    /**
+     * `envModel.contextWindow` 的来源(`declared` = `MODEL_CONTEXT_WINDOW` 声明了;`assumed` = 没声明、落假定值)。`loadConfig` 与 `envModel` 同一次解出
+     * (`model-context-window.ts` 的 `resolveContextWindow`),此后永不换。唯一读者:中心腿的 BL-8 继承 —— 目录条目没写窗 ⇒ 继承 `envModel` 的窗,
+     * 来源随之(env 声明了 ⇒ 条目也是 declared)。不从 env 再读一遍:「声明了没有」只在解窗的那一处判。
+     */
+    envModelContextWindowSource: ContextWindowSource;
     /** Model catalog by name (1.24): always `default` + the main model's id, plus an optional cheap model.
      *  Used to resolve roles and to allow-list `@-model` mentions. */
     models: Record<string, Model>;
+    /**
+     * 每个目录名的上下文窗来源(`declared` / `assumed`,闭集;值 = `models[name].contextWindow` 那个数是谁写的)。**与 `models` 同键**(别名 `default` 随它指的条目)、
+     * 同世代同 commit:env 腿与 `models` 经同一只组法铸(`envLaneTable`),applyEffective 在铸目录模型的同一圈里铸、与 `models` 一起整表换。
+     * 数住在 `Model.contextWindow`(引擎的席),来源住这里 —— 两者出自同一次解(`resolveContextWindow`),没有第二个判点。
+     * 读者:`GET /v1/models` 行的 `contextWindowSource`、运维通告 `model_context_window_assumed` 的唯一发声器(`context-window-notice.ts`:模型表定形之后 / 每次模型面落地之后)。
+     * 名不在表里 ⇒ 读者不答来源(行不带该键):只有绕过两条铸腿手写 `models` 的嵌入方 / 夹具会落到这里。
+     */
+    contextWindowSources: Readonly<Record<string, ContextWindowSource>>;
     /** Per-model API-key override: catalog model NAME → the env var NAME holding that model's key (from
      *  web-admin `apiKeyEnv`). Drives the spec's `getApiKeyAndHeaders` so each model/rung authenticates
      *  with its own upstream account; a model absent here falls back to the gateway key. Env path: empty. */
@@ -1126,6 +1151,7 @@ export interface ServiceConfigFlat {
      * `SEALED_KEY_DIR` —— 模型钥匙保管目录(sealed 形的 X25519 钥匙对 `<publicKeyId>.json`,连同停驻行封签那一域的子目录 `checkpoint-ctx-keys/`)。
      * **缺席不铸键** ⇒ 保管目录 = `<localDataRoot>/sealed-key`(今天的行为;建不了只是一行 warn,sealed 模型逐个 `no_key_store`)。
      * 给了 ⇒ 绝对路径(相对路径 loadConfig 拒启),该目录是**唯一**保管目录;起服在它上面建不了保管店 ⇒ 拒启(fail-closed:运维点名了目录)。
+     * 给了 ∧ 停驻审批耐久(`DURABLE_APPROVAL` ∧ 检查点店耐久)∧ 它的介质判 `ephemeral` ⇒ 起服第 2 段店的持久性准入拒启(`store-admission.ts`;缺席时的缺省目录不进这一判)。
      * 谁需要:读同一份 `config.d` 而数据根不同的多台引擎(终端 × 桌面端默认形)—— sealed 条目绑定的是钥匙身份(`publicKeyId` → 钥匙对),指到同一目录 ⇒ 同一把钥。
      */
     sealedKeyDir?: string;
@@ -1142,6 +1168,14 @@ export interface ServiceConfigFlat {
      * 只有 `local`(file)后端读它;SQL 后端的 hydrate 不经这条路。
      */
     runStoreStrictHydrate: boolean;
+    /**
+     * `LOCAL_STORE_DURABILITY=ephemeral` —— 运维**声明**这台部署的 local 店易失(闭集只有这一个词;缺席 = 店型的设计声明「活过进程重启」)。
+     * 唯一读者 `local-store-declaration.ts` 的 `localStoreDeclarationOf`:声明之后 local 后端交给**两半**店(会话店顶层、检查点店)的引擎声明都是
+     * `process-local` ⇒ 起服布线审计的拒启臂(声明 durable ∧ 数据根介质易失)不再咬,数据根落在容器可写层 / tmpfs / emptyDir 上照常起服,起服 warn 一行。
+     * 后果 = 店里的会话、停驻审批与记忆不随容器 / Pod 替换保留(进程重启照旧活过:文件还在同一只容器里)。读面的持久性读数(`store.durability`)照旧按介质如实报。
+     * 部署者自己设 —— 壳 / 编排器不替用户写(写了就是替用户放弃这份承诺)。SQL / memory 后端不读它。
+     */
+    localStoreDurability: LocalStoreDeclarationWord | undefined;
     /** PostgreSQL connection (used iff dbBackend === "pg"). Mirror of `tidb`. Env: PG_HOST/PG_PORT/PG_USER/
      *  PG_PASSWORD/PG_DATABASE/PG_POOL_SIZE. */
     pg?: {
@@ -1361,7 +1395,7 @@ export interface ServiceConfigFlat {
      * `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT` —— 「出示这台部署的 service 凭据、不报主体的调用方是谁」的**唯一声明座**。缺省 `true`(不设 = 今天的读法):
      * 它代部署本人说话(fleet 调用方,运维聚合口的 service 臂);`false` ⇒ 它是**无身份调用方**,各面按既有的「过了凭据门、没有主体」那一臂答
      * (fleet 读面 401 identity、运维聚合口 401 operator、舰队流多租 401 principal_required / 单用户落 `default`、写档 401 identity、无主 placed 子代 404)。
-     * 只改一处:`http/principal-gate.ts` 的 `actsForDeployment` 多这一个合取项 —— 它的两个读者(fleet 调用方的凭据臂、`/metrics*` 的 service 臂)一次继承,
+     * 只改一处:`http/principal-gate.ts` 的 `actsForDeployment` 多这一个合取项 —— 它的两个读者(fleet 调用方的那一格、`/metrics*` 族)一次继承,
      * 零新拒码、零新闸点;自报位 `/health.auth.serviceTokenActsForDeployment` = 配了 service 凭据 ∧ 本位。没配 service 凭据的部署上声明 `false` 是空真(那一臂本来就够不着)。
      * env 独有(词表布尔,词表外拒启;没有 `config.d` 文件形、没有中心写位),起服读一次、热路径够不着(不是热键)。
      */
@@ -1859,20 +1893,20 @@ export interface ServiceConfigFlat {
      *  core 自动延迟」这句(本行旧文案)作废:缺省窗下一个中小 MCP 名册够不着阈值,首请求带全 schema。
      *  唯一不受门的是调用方的 `TaskSpec.deferTools` 字面名单。口径全文见 src/capabilities/tool-defer.ts 头注。 */
     toolDeferLongtail: boolean;
-    /** LSP code-intelligence tool ([ref] §13.1): mount core's `lsp` tool, routed to an E2B LSP sidecar. Requires
-     *  REMOTE_EXEC=e2b. Default OFF (the on-the-fly language-server install is heavy until an E2B template bakes it).
-     *  `LSP_ENABLED=true`. */
-    lspEnabled: boolean;
-    /** TOC local LSP (core 1.190 `NodeLspManager`, host lane only): mount core's `lsp` tool over LOCAL `child_process`
-     *  language servers (CC `services/lsp` parity). Unlike the sandbox lane it needs NO baked template — just the
-     *  server binary on PATH, and it DEGRADES gracefully (ENOENT → grep/read) + spawns lazily/cached, so it is DEFAULT
-     *  ON for the host lane (CC-parity); set `LSP_HOST_ENABLED=false` to opt out. (`REMOTE_EXEC=host` only — ssh/adb/
-     *  local-docker can't reach a local child process to the right filesystem.)
-     *  [ref] B4 (lens4 N7): this lane used to share `LSP_ENABLED` with `lspEnabled` above — one env name driving
-     *  two OPPOSITE defaults. It now has its own knob. 🪦 server 3.0.0: `LSP_ENABLED=false` (the pre-split host
-     *  opt-out) is a **fail-loud tombstone** — it refuses boot naming `LSP_HOST_ENABLED`; `LSP_ENABLED=true` keeps
-     *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
+    /** Local LSP (core `NodeLspManager`): mount core's `lsp` tool over LOCAL `child_process` language servers (CC `services/lsp`
+     *  parity) — needs just the server binary on PATH, DEGRADES gracefully (ENOENT → grep/read), spawns lazily/cached ⇒ DEFAULT ON
+     *  (`LSP_HOST_ENABLED=false` opts out). The knob is conjoined by the one mint point `createLspManager` with deployment-shape row
+     *  `callerOwnsWorkerDisk` (host lane ∧ single-principal) — no other lane mounts LSP. The sandbox-lane knob `LSP_ENABLED` is a
+     *  tombstone in settings-schema `RETIRED_ENVS` (refused at the top of `loadConfig`; this repo neither reads nor re-words it). */
     lspHostEnabled: boolean;
+    /** `AUTO_BACKGROUND_ON_TIMEOUT` —— 前台 Bash 命令撞上**它自己的**超时时,合格的命令(资格由引擎判:命令里没有 `git`、首词不是 `sleep`)
+     *  被转成后台任务继续跑,而不是被杀(引擎 `HandsBandOptions.autoBackgroundOnTimeout`;引擎缺省关,本服务作为部署者**缺省开**)。
+     *  同一个开关在引擎里还管第二个触发:有人的输入排队等着本轮边界、而合格命令还在跑 ⇒ 引擎把它转后台好让输入送达(引擎刻意只设一个开关)。
+     *  `=false` ⇒ 两件都不做,超时即杀(引擎缺省形)。读点只有一处:手带铸点 `buildHandsBand`(共享基座与 leader 车道同调),每只有手的 Runner 同源。
+     *  CC 2.1.316 对位:合格命令缺省武装(`cli316.js:273095`,合格判 ∧ 非显式后台);env `CLAUDE_CODE_AUTO_BACKGROUND_TIMEOUT_MS` 只缩短超时(`cli316.js:266918`),本服务不设对应旋钮。
+     *  只在能把运行中的命令领养成后台的车道上生效(执行环境 `backgroundCapabilities.supportsDetach`);其余车道值照传、引擎与适配器按契约忽略 ——
+     *  这一根旋钮在本车道上生不生效由 `GET /health` 的 `autoBackgroundOnTimeout`(三词)如实报(`capability-facts.ts` 的事实 `autoBackgroundOnTimeout`)。 */
+    autoBackgroundOnTimeout: boolean;
     /** [ref] —— host-lane language-server env **named allowlist** (`LSP_ENV_ALLOW=NAME,NAME`). The language server's env is
      *  the engine's `inheritedHostEnv("scrub")` (shape rules + this deployment's declared own credentials); each name here is put back **verbatim** from the service's own env on top of that
      *  (`allowlistedEnv`, the same "named keys pass" predicate as the host shell's `inheritEnv:[names]`) — the deployer
@@ -1883,6 +1917,13 @@ export interface ServiceConfigFlat {
      *  make it into this list (an absent name is a per-index boot warn) — so every downstream echo of it (the scrub
      *  disclosure's `allowed`, the config catalog) carries real key names only, never a value pasted in place of a name. */
     lspEnvAllow: readonly string[];
+    /** settings hook 环境的**点名放回**(`HOOK_ENV_ALLOW=NAME,NAME`;名单型 env 旋钮族,渠道 `host-put-back`)。hook 环境只有一只组合(`hooks/hook-runner.ts` `hookChildEnv`):
+     *  继承 = 十二名基础名单(引擎严格名单臂)∪ 本名单点到的变量(从本服务进程环境原样放回,同一条严格名单臂 —— 本服务自有凭据拒 —— 名是,或值是本服务的某一枚凭据(列表形凭据逐枚比);组合这一刻引擎照样扣下值副本),
+     *  之上叠请求的有效环境层(`settings.env` + hook 自己的变量)。命令腿的子进程 env 与 http 条目 header 的 `$NAME` 插值读同一份;能插哪些名仍由条目 `allowedEnvVars`
+     *  ∩ 准入层 `httpHookAllowedEnvVars` 定(只收窄)。服务进程变量进 hook 环境**只有这一个来源**(部署方声明),请求层任何键都授予不了。
+     *  `[]` = 缺省(未设 / 空串):不放回任何变量。形错 / 点名名单型旋钮 / 点名本服务自有凭据名 ⇒ 拒启点名第几段、不回显值;本进程环境里没有的名按序号 warn、不进名单;
+     *  `REQUIRE_PRINCIPAL=true` ⇒ 恒 `[]`(请求的 settings hooks 在该姿态下不跑;起服 warn 一次)。 */
+    hookEnvAllow: readonly string[];
     /** Graceful drain: how long SIGTERM waits for in-flight turns (live streams + bg/resume legs on this
      *  instance) to finish before the hard shutdown. During drain, new billable submissions get 503+Retry-After and
      *  /health carries `draining:true`. Default 10min (an interactive turn is minutes, not seconds — a
@@ -2170,7 +2211,7 @@ export interface ServiceConfigFlat {
     /** 部署**要不要求**读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED`,布尔,缺省 false)—— 交引擎 `RunnerDeps.readDenyFloorRequired`
      *  (部署姿态座席族的一席,唯一取值点 `buildDeploymentPostureSeats`)。判官是引擎:一个 run 的读拒表有行、而它的执行环境块
      *  `keepsReadFloor` 不为真时 —— true ⇒ 准备期拒(`config.read_deny_floor_unkept`,一个命令都不起;同步腿 409);false ⇒ run 照跑,
-     *  每 run 一条 operator 通告同码(递归读照读表里的文件,通告不是保护)。出厂读拒档(credentials / agent-config)在岗时每条带手 run 的表都有行;
+     *  每 run 一条同码通告(run 事件流一帧 + 终局结果 `readDenyFloor` + 运维日志一行,同一句点名 `REMOTE_EXEC=<车道>` 与本旋钮;递归读照读表里的文件,通告不是保护)。出厂读拒档(credentials / agent-config)在岗时每条带手 run 的表都有行;
      *  本仓七车道的块今天都不守地板 ⇒ 设 true 的部署上带手 run 一律拒起(起服 warn `read_deny_floor_required_unkept` 先说)。
      *  **仅 deployment 席**:TaskSpec 上没有同名键,任务无法放宽自己的部署。 */
     readDenyFloorRequired: boolean;
@@ -2197,7 +2238,7 @@ export interface ServiceConfigFlat {
      *  判点在三个提交门(`POST /v1/runs` 与 A2A `message/send`、`POST /v1/tasks`、`POST /v1/tasks/stream`)的幂等重放之后;续跑 / 唤醒 / 审批作答不判。
      *  属主 `http/run-concurrency-cap.ts`。 */
     runMaxConcurrent: number;
-    /** `RUN_MAX_CONCURRENT_PER_PRINCIPAL`:同一**已验提交主体**(`gatedPrincipal`,与成本配额门同键)在本副本的在飞 run 上限(整数,0 / 缺省 = 不设)。
+    /** `RUN_MAX_CONCURRENT_PER_PRINCIPAL`:同一**已验提交主体**(`gatedSubject`,与成本配额门同键)在本副本的在飞 run 上限(整数,0 / 缺省 = 不设)。
      *  无主体请求(无头 service 凭据)不判这一帽,只受 {@link ServiceConfigFlat.runMaxConcurrent}。 */
     runMaxConcurrentPerPrincipal: number;
     /** Operator CEILING on per-task cost (USD) / tokens (1.37 budget gate). A request may ask for a
@@ -2347,15 +2388,15 @@ export interface ServiceConfigFlat {
     configProvider?: ConfigProviderWord;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */
     configLocalDir?: string;
-    /** 本地配置源的目录信任判官(`config-dir-trust.ts`)多信的那一个属主 uid —— 本服务用户与 root 之外,`config.d` 及其路径上的目录与文档还可以属于谁
+    /** 目录信任判官(`config-dir-trust.ts`:本地配置源、LKG 读回、调度共享店三只读者同一只)多信的那一个属主 uid —— 本服务用户与 root 之外,`config.d` / LKG / 调度店及其路径上的目录与文档还可以属于谁
      *  (userns-remap 的 bind-mount 呈现为未映射 uid、运维用户持有的配置)。只放宽属主判据,模式判据照校。缺席 = 只信本服务用户与 root。
      *  Env: CONFIG_LOCAL_OWNER_UID(形错拒启;解析口 `parseConfigLocalOwnerUid`)。 */
     configLocalOwnerUid?: number;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
-export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "sealedKeyDir" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
+export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "sealedKeyDir" | "runStoreStrictHydrate" | "localStoreDurability" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
-export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
+export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "envModelContextWindowSource" | "models" | "contextWindowSources" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atMention" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAskRetentionMs" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry" | "principalInboxAssistant">;
@@ -2369,7 +2410,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "serviceTokenActsForDeployment" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentStallMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentStallMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspHostEnabled" | "lspEnvAllow" | "hookEnvAllow" | "autoBackgroundOnTimeout" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "adoptionImportMaxSessions" | "adoptionImportMaxSessionBytes" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "engineFirstAttachMs" | "engineHandoverLingerMs" | "rateLimitPerMin" | "runMaxConcurrent" | "runMaxConcurrentPerPrincipal" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.d.ts

@@ -205,7 +205,7 @@ export declare function entryDeclarableRemoteExec(lane: EntryDeclarableLane): Re
  *
  *  Semantics are the two dialects' semantics VERBATIM — an opt-in knob is `boolEnv(x, false)`, an opt-out knob is
  *  `boolEnv(x, true)` — for the two literals and for unset. Anything else goes through `parseBoolWord` ([ref]-rc2,
- *  [ref]): `1`/`0`/`yes`/`no`/`on`/`off` in any case are read as the operator meant them (`LSP_ENABLED=1` reads as
+ *  [ref]): `1`/`0`/`yes`/`no`/`on`/`off` in any case are read as the operator meant them (`LEADER_ENABLED=1` reads as
  *  "on" to a human, and now to the parser too), and an unknown word REFUSES TO BOOT — it no longer lands on the
  *  default with a warning (that was this helper's first form, retired with [ref]-rc2; [ref] corrected this note).
  *
@@ -235,22 +235,23 @@ export declare function configKnobTable(): ConfigKnobRecord[];
 export declare const hostBackgroundShellEnabled: () => boolean;
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export declare const hostExecSpoolEnabled: () => boolean;
-/** 名单在活配置里的落点(服务进程四只旋钮;bake-runner 那只在它自己的进程里,不在 `ServiceConfig`)。 */
-export type EnvNameAllowlistSeats = Pick<ServiceConfig, "lspEnvAllow" | "remoteExec">;
+/** 名单在活配置里的落点(服务进程五只旋钮;bake-runner 那只在它自己的进程里,不在 `ServiceConfig`)。 */
+export type EnvNameAllowlistSeats = Pick<ServiceConfig, "lspEnvAllow" | "hookEnvAllow" | "remoteExec">;
 /**
  * 沙箱名单(表列 `channel: "sandbox-grant"` 的服务侧旋钮,表派生)此刻交出去的名 —— 起服行 `remote_exec_enabled.sandboxEnvKeys` 读它(`boot/execution-env.ts`,
  * 排序后只出键名)。只有被选中车道的那一只有落点;e2b / k8s 报的是名单点到的键,不含 `SANDBOX_PKG_SOURCE` 推导出的包源变量(那一组是区域常量,装配点另并)。
  */
 export declare function sandboxEnvNamesInForce(seats: EnvNameAllowlistSeats): readonly string[];
-/** 声明增长后重判的一处命中:哪只旋钮、它交出去的哪个名、判官的拒因({@link ownCredentialNameProblem} 那一句,只回显名)。 */
+/** 声明增长后重判的一处命中:哪只旋钮、它交出去的哪个名、判官的拒因({@link ownCredentialProblem} 那一句,只回显名)。 */
 export interface OwnCredentialInForce {
     readonly knob: ServerEnvNameAllowlistKnob;
     readonly name: string;
     readonly problem: string;
 }
 /**
- * 解析器头注 ② 那条不变量在**声明增长**那一刻的半边:对活配置里每只名单此刻交出去的名问**同一只**判官({@link ownCredentialNameProblem} → 引擎
- * `inheritEnvPolicyProblem`,读引擎此刻的声明)。读活配置的落点,不重读 env(名单是起服输入;解析那一刻已判过形与当时的声明)。返回每一处命中,空 = 不相交。
+ * 解析器头注 ② 那条不变量在**声明增长**那一刻的半边:对活配置里每只名单此刻交出去的名问**同一只**判官({@link ownCredentialProblem} → `ownCredentialVariable`,
+ * 读引擎此刻的声明:增长并进的名,与增长并进的值 —— 新条目 `apiKeyEnv` 的值等于名单交出去的某个变量的值,同样命中)。读活配置的落点(名单是起服输入;
+ * 解析那一刻已判过形与当时的声明)。返回每一处命中,空 = 不相交。
  * 调用点只有一处 = 声明增长的那一处(`apply-effective.ts` 的换代声明,真声明之后、席位换装之前)。
  */
 export declare function ownCredentialHitsInForce(seats: EnvNameAllowlistSeats): OwnCredentialInForce[];
@@ -300,9 +301,9 @@ export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]):
  *     {@link findCcRuleFormNames}(它同时是 `allow` 腿的**唯一**判据,见下方例外说明)。
  *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):[ref](core 7.41.0 [ref])起判据是 core 导出的
  *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
- *     补全协议前缀。退役名里**没有后继**的那一种(判词 `retired` 不带 `currentName`:`TeamCreate` / `TaskOutput` / `MultiEdit`)不在拒面 ——
- *     `namespaced-rule-name.ts` 的 `isRetiredWithoutSuccessor` 是唯一读法:**有通告席的表**({@link UnmatchableToolNameJudgment} 的 `noticeSeat`)上这一行不拒、原样留着,
- *     读这张表的一方说一句(引擎读的请求规则桶由引擎通告;只有本服务读的运维 / 中心名单由装配处日志点名);没有通告席的表(请求体 `neverAuto`)照拒。
+ *     补全协议前缀。退役名里**没有后继**的那一种(`TeamCreate` / `TaskOutput` / `MultiEdit`)不在拒面 ——
+ *     唯一读法 = 引擎的账(core 7.66.0 [ref],`namespaced-rule-name.ts` 的 `isRetiredLeftOut`):**有通告席的表**({@link UnmatchableToolNameJudgment} 的 `noticeSeat`)上这一行不拒、原样留着,
+ *     读这张表的一方说一句(引擎读的请求规则桶由引擎通告;只有本服务读的运维 / 中心名单由装配处日志点名;请求体 `neverAuto` 由本服务据账铸通告)。
  *   - 够不着挂载工具的协议名:**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、对端段里的部分通配 `mcp__git*`、超长 / 归一后带连串下划线的服务器段、对端段为空的
  *     `mcp__` / `mcp____x`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。判官是引擎的 `judgeRuleToolName`(core 7.43.0 [ref] (b)
  *     的判词 `unmintable_segment`,句子带它的 guidance 与 1:1 现名);本仓 7.116.0–7.117.x 那只自比 `mintNamespacePrefix` 的对照随之退役。
@@ -365,10 +366,10 @@ export type UnmatchableToolNameJudgment = {
     readonly behavior: PermissionRule["behavior"];
     readonly pathBases?: PathRuleBases;
     /**
-     * 这张表上退役且**无后继**的名字({@link isRetiredWithoutSuccessor})由谁说那一句:`engine` = 引擎准备期名字审计铸 `config.legacy_tool_name`
-     * (表经带名单投影的策略到达引擎:请求体 `settings.permissions.deny` / `ask`);`server` = 本服务读这张表的那一处落一行日志(运维 `APPROVAL_REQUIRE` /
-     * `DENY` / `NEVER_AUTO` 起服、中心 `governance.approvalRequire` 落配)。**在场才不拒**:不拒必须配恰一句话;缺席 = 这张表没有通告席(请求体
-     * `settings.permissions.neverAuto`:引擎不读这张表,它编成的策略不带名单投影)⇒ 照拒;放行那一天由本服务铸通告(引擎导出「条目 + 句」源之后),那时加第三个席位词。
+     * 这张表上退役且**无后继**的名字(引擎的账 {@link isRetiredLeftOut})由谁说那一句:`engine` = 引擎准备期名字审计铸 `config.legacy_tool_name`
+     * (表经带名单投影的策略到达引擎:请求体 `settings.permissions.deny` / `ask`);`server` = 本服务读这张表的那一处说(运维 `APPROVAL_REQUIRE` /
+     * `DENY` / `NEVER_AUTO` 起服日志、中心 `governance.approvalRequire` 落配日志、请求体 `settings.permissions.neverAuto` 的用户面通告 —— 后者 core 7.66.0 [ref] 起:
+     * 本服务据引擎的账铸 `config.legacy_tool_name`,句子与 detail 是引擎的)。**在场才不拒**:不拒必须配恰一句话;缺席 = 这张表没有人说话 ⇒ 照拒。
      */
     readonly noticeSeat?: "engine" | "server";
 };
@@ -582,12 +583,4 @@ export declare function splitLocalRoots(a: {
     dataRoot: string;
     configRoot: string;
 } | undefined;
-export declare function resolveBindHost(config: {
-    bindHost?: string;
-    /** 缝合审 M5:`bindHost` 的**来源**决定它算不算 operator 明示,见下。 */
-    bindHostSource?: "BIND_HOST" | "HOST";
-    allowUnauthedWrites?: boolean;
-    authToken?: string;
-    authTokens?: Record<string, string>;
-}): string | undefined;
 //# sourceMappingURL=config.d.ts.map