@sema-agent/server 7.147.0 → 7.149.0

package/dist/config.js

@@ -1,11 +1,12 @@
+import { writeLogText } from "./observability/logger.js";
 import { readFileSync } from "node:fs";
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
+import { hostOfUrl, HOST_UNREADABLE_SENTENCE, compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
-import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+import { parseApprovalHmacKeys, parsePrincipalJwks, parseServiceAuthTokens } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { buildRuleListJudgeOptions } from "./permission-rule-list.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
@@ -24,11 +25,13 @@ import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
 import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
+import { RUN_STALE_SEC_DEFAULT } from "./run-stale-default.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
+import { resolveContextWindow } from "./model-context-window.js";
+import { MODEL_THINKING_LEVELS, THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isModelThinkingLevel, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
-import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, isRetiredWithoutSuccessor, retiredWithoutSuccessorEntries, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
+import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, isRetiredLeftOut, retiredLeftOutEntries, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal, operatorSingleUserRefusal, remoteConfigProviderUrlRefusal, retentionLaneRefusal, workflowParkDecisionDomainRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
@@ -38,15 +41,17 @@ import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { parseLocalStoreDurabilityWord } from "./local-store-declaration.js";
 import { sandboxForwardedEnvOf } from "./execution-config-root.js";
 import { SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS, laneMissingEnv, readDeclaredLaneTable } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { deploymentRuleRefusal } from "./rule-issue-reading.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { readReadDenyEntry } from "./read-deny-entry.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
-import { modelProviderRefusal } from "./model-provider.js";
+import { catalogBrainLane, modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { DEVICE_RELAY_NONE, DEVICE_RELAY_RULE, deviceRelayFlaws, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
@@ -54,9 +59,10 @@ import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { anthropicCredentialRefusal, csvOf, declaredCredential, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { echoCallerText } from "./caller-text-echo.js";
+import { PRINCIPAL_MAX_BYTES, principalShapeProblem } from "./principal-shape.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { parseConfigLocalOwnerUid } from "./config-dir-trust.js";
-import { allowlistedEnv } from "./server-secret-env.js";
+import { allowlistedEnv, ownCredentialDeclarationRefusal, ownCredentialVariable } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
@@ -170,6 +176,10 @@ function nonNegativeIntEnv(name, role, fallback = "0") {
         throw new Error(`env ${name}=${n} must be an integer(${role};计数轴不接受小数——单位写漏了?)`);
     return n;
 }
+function parseLocalDockerCapacityEnv() {
+    const maxContainers = nonNegativeIntEnv("DOCKER_MAX_CONTAINERS", "local-docker 车道同时在跑的容器数上限");
+    return maxContainers > 0 ? { maxContainers } : undefined;
+}
 function numEnvBounded(name, fallback, min, max) {
     const n = numEnv(name, fallback);
     if (n < min || n > max)
@@ -556,14 +566,18 @@ const OWN_CREDENTIAL_HANDOFF = {
     "host-put-back": { where: "a put-back list hands the named variable back, as written, to the child the engine withheld it from", whom: "that child" },
     "sandbox-grant": { where: "a sandbox list puts the named variable, as written, into a sandbox the model can read", whom: "the sandbox" },
 };
-function ownCredentialNameProblem(name, channel) {
-    if (inheritEnvPolicyProblem([name]) === undefined)
+function ownCredentialProblem(name, channel) {
+    const held = ownCredentialVariable(name);
+    if (held === undefined)
         return undefined;
     const { where, whom } = OWN_CREDENTIAL_HANDOFF[channel];
-    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list)`;
+    const copy = held === "value" ? "a copy under another name (its value is one of this service's credentials); " : "";
+    const engine = held === "name" ? "the engine refuses it on any allow list" : "the engine withholds it from every child";
+    return `this deployment's own credential — ${copy}${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (${engine})`;
 }
 const NAMES_IN_FORCE = {
     LSP_ENV_ALLOW: (c) => c.lspEnvAllow,
+    HOOK_ENV_ALLOW: (c) => c.hookEnvAllow,
     E2B_SANDBOX_ENV: (c) => (c.remoteExec.provider === "e2b" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
     K8S_SANDBOX_ENV: (c) => (c.remoteExec.provider === "k8s" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
     DOCKER_SANDBOX_ENV: (c) => (c.remoteExec.provider === "local-docker" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
@@ -574,7 +588,7 @@ export function sandboxEnvNamesInForce(seats) {
 }
 export function ownCredentialHitsInForce(seats) {
     return SERVER_ENV_NAME_ALLOWLIST_KNOBS.flatMap((knob) => NAMES_IN_FORCE[knob](seats).flatMap((name) => {
-        const problem = ownCredentialNameProblem(name, ENV_NAME_ALLOWLIST_KNOBS[knob].channel);
+        const problem = ownCredentialProblem(name, ENV_NAME_ALLOWLIST_KNOBS[knob].channel);
         return problem === undefined ? [] : [{ knob, name, problem }];
     }));
 }
@@ -591,7 +605,7 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
                 : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
                     ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
-                    : ownCredentialNameProblem(seg, spec.channel);
+                    : ownCredentialProblem(seg, spec.channel);
         if (problem === undefined)
             return;
         throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
@@ -753,6 +767,7 @@ function optionalEnumKey(key, envName, raw, allowed) {
     }
     return { [key]: raw };
 }
+const PRINCIPAL_INBOX_ECHO_CHARS = 96;
 function principalInboxAssistantKey(raw) {
     if (raw === undefined || raw === "")
         return {};
@@ -760,7 +775,9 @@ function principalInboxAssistantKey(raw) {
         principalInboxConsumerOf({ principalInboxConsumer: { assistant: raw } });
     }
     catch (err) {
-        throw new Error(`env PRINCIPAL_INBOX_ASSISTANT must name the agent handle that consumes the principal inbox (or stay UNSET for no cross-principal delivery): ${err instanceof Error ? err.message : String(err)}`);
+        const shown = JSON.stringify(raw.length > PRINCIPAL_INBOX_ECHO_CHARS ? `${raw.slice(0, PRINCIPAL_INBOX_ECHO_CHARS)}…` : raw);
+        throw new Error(`env PRINCIPAL_INBOX_ASSISTANT must name the agent handle that consumes the principal inbox, or be unset or the empty string for no cross-principal delivery (a blank value is neither — whitespace is not "empty"): ` +
+            `the value ${shown} is refused — ${err instanceof Error ? err.message : String(err)}`);
     }
     return { principalInboxAssistant: raw };
 }
@@ -966,6 +983,7 @@ function parseStoreDomain(ctx) {
             return raw;
         })()),
         runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
+        localStoreDurability: parseLocalStoreDurabilityWord(process.env.LOCAL_STORE_DURABILITY),
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
@@ -1061,13 +1079,22 @@ function parseModelDomain() {
     }
     const extraBody = buildExtraBody();
     const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
-    const envApi = provider === "anthropic" ? "anthropic-messages" : "openai-completions";
+    const envLaneWire = ((lane) => {
+        switch (lane) {
+            case "anthropic":
+                return { api: "anthropic-messages", promptCacheFamily: "input-excludes-cached" };
+            case "gateway":
+                return { api: "openai-completions", promptCacheFamily: "input-includes-cached" };
+        }
+    })(catalogBrainLane(provider));
+    const envApi = envLaneWire.api;
     const envCompatDeclared = buildModelCompat("openai-completions", {
         reasoningEffortLevels: parseReasoningEffortLevels(csv("MODEL_REASONING_EFFORT_LEVELS")),
         thinkingFormat: parseThinkingFormat(process.env.MODEL_THINKING_FORMAT),
     });
     const envCompat = envApi === "openai-completions" ? envCompatDeclared : undefined;
     const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
+    const mainWindow = resolveContextWindow(optNumEnvStrict("MODEL_CONTEXT_WINDOW"));
     const model = {
         id: modelId,
         name: modelId,
@@ -1081,12 +1108,12 @@ function parseModelDomain() {
             cacheRead: costEnv("MODEL_COST_CACHE_READ", "unset"),
             cacheWrite: costEnv("MODEL_COST_CACHE_WRITE", "unset"),
         }, undefined)),
-        contextWindow: numEnv("MODEL_CONTEXT_WINDOW", "262144"),
+        contextWindow: mainWindow.window,
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
             ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
-            : Math.min(32000, numEnv("MODEL_CONTEXT_WINDOW", "262144")),
+            : Math.min(32000, mainWindow.window),
         ...(optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") } : {}),
-        params: { promptCacheFamily: provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
+        params: { promptCacheFamily: envLaneWire.promptCacheFamily },
         ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
         ...(envCompat ? { compat: envCompat } : {}),
         ...(extraBody ? { extraBody } : {}),
@@ -1120,6 +1147,8 @@ function parseModelDomain() {
             break;
     }
     const cheapMintedId = mintedCheapId(cheapSlot);
+    const cheapDeclaredWindow = cheapMintedId === undefined ? undefined : optNumEnvStrict("MODEL_CHEAP_CONTEXT_WINDOW");
+    const cheapWindow = resolveContextWindow(cheapDeclaredWindow, mainWindow);
     const cheapModel = cheapMintedId !== undefined
         ? {
             ...model,
@@ -1132,7 +1161,7 @@ function parseModelDomain() {
                 cacheRead: costEnv("MODEL_CHEAP_COST_CACHE_READ", "declares-zero"),
                 cacheWrite: costEnv("MODEL_CHEAP_COST_CACHE_WRITE", "declares-zero"),
             }, model.cost)),
-            contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
+            contextWindow: cheapWindow.window,
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
         }
@@ -1154,7 +1183,7 @@ function parseModelDomain() {
     if (cheapModel) {
         const cheapAct = optFinitePositiveEnv("MODEL_CHEAP_AUTO_COMPACT_TOKENS");
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
-            const inherited = process.env.MODEL_CHEAP_CONTEXT_WINDOW === undefined || process.env.MODEL_CHEAP_CONTEXT_WINDOW === "";
+            const inherited = cheapDeclaredWindow === undefined;
             CONFIG_NOTICES.push({
                 level: "warn",
                 event: "auto_compact_window_not_derived_1m",
@@ -1168,6 +1197,7 @@ function parseModelDomain() {
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
     const models = envLaneTable(modelId, model, cheapModel);
+    const contextWindowSources = Object.fromEntries(Object.entries(envLaneTable(modelId, { id: model.id, source: mainWindow.source }, cheapModel !== undefined ? { id: cheapModel.id, source: cheapWindow.source } : undefined)).map(([name, slot]) => [name, slot.source]));
     const gatewayApiKey = route.gatewayApiKey;
     if (gatewayBaseUrl === undefined && declaredCredential(gatewayApiKey) !== undefined) {
         CONFIG_NOTICES.push({
@@ -1223,7 +1253,9 @@ function parseModelDomain() {
         },
         model,
         envModel: model,
+        envModelContextWindowSource: mainWindow.source,
         models,
+        contextWindowSources,
         modelApiKeyEnv: {},
         modelApiKeys: {},
         modelRefusals: {},
@@ -1249,11 +1281,9 @@ function parseDefaultThinking(raw) {
     const v = raw?.trim();
     if (v === undefined || v === "")
         return undefined;
-    if (v === "off")
-        return undefined;
-    if (!isThinkingTier(v)) {
-        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a thinking tier — valid: ${THINKING_LEVELS.join(" | ")} | off ` +
-            `("off" = no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
+    if (!isModelThinkingLevel(v)) {
+        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a model thinking tier — valid: ${MODEL_THINKING_LEVELS.join(" | ")} ` +
+            `("off" = the model's requests default to thinking off; leave it unset for no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
     }
     return v;
 }
@@ -1263,7 +1293,7 @@ function parseReasoningEffortLevels(words) {
     const bad = words.filter((w) => !isThinkingTier(w));
     if (bad.length > 0) {
         throw new Error(`env MODEL_REASONING_EFFORT_LEVELS has unknown tier(s): ${bad.join(", ")} (valid: ${THINKING_LEVELS.join(" | ")})` +
-            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (no model-level default), it is not an effort tier an endpoint can accept' : ""}. ` +
+            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (the model default tier), it is not an effort tier an endpoint can accept' : ""}. ` +
             `Bad words used to be dropped SILENTLY, narrowing the declared ladder without a word (#210 A 档).`);
     }
     return words.filter(isThinkingTier);
@@ -1301,7 +1331,7 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    return { code: issue.code, guidance: `${issue.code} — core's rule grammar cannot compile this entry: ${issue.message}` };
+    return deploymentRuleRefusal(issue);
 }
 function findUnmatchableToolNames(names, opts) {
     const out = [];
@@ -1315,7 +1345,7 @@ function findUnmatchableToolNames(names, opts) {
         }
         const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
         const judged = unmatchableRuleNameOf(subject, opts.behavior);
-        const verdict = opts.noticeSeat !== undefined && isRetiredWithoutSuccessor(judged) ? undefined : judged;
+        const verdict = opts.noticeSeat !== undefined && isRetiredLeftOut(name) ? undefined : judged;
         if (verdict?.kind === "retired") {
             out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject), reason: verdict.kind });
             continue;
@@ -1421,7 +1451,7 @@ function parseApprovalDomain(ctx) {
         windowMsSource: streamAskWindowMsSource,
         onPostureYield: (facts) => {
             streamAskWindowMsEffectiveSource = "engine-default";
-            process.stderr.write(`[config] stream_ask_window_posture_yielded: the single-user posture default STREAM_ASK_WINDOW_MS=${facts.windowMs} would violate the explicit STREAM_APPROVAL_ORPHAN_TTL_MS=${facts.orphanTtlMs} (window + ADHOC_GRACE ${facts.adhocGraceMs} must be strictly less) — falling back to 300000; set STREAM_ASK_WINDOW_MS explicitly to choose\n`);
+            writeLogText("stderr", `[config] stream_ask_window_posture_yielded: the single-user posture default STREAM_ASK_WINDOW_MS=${facts.windowMs} would violate the explicit STREAM_APPROVAL_ORPHAN_TTL_MS=${facts.orphanTtlMs} (window + ADHOC_GRACE ${facts.adhocGraceMs} must be strictly less) — falling back to 300000; set STREAM_ASK_WINDOW_MS explicitly to choose`);
         },
     });
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
@@ -1431,7 +1461,7 @@ function parseApprovalDomain(ctx) {
         const unmatchable = unmatchableToolNamesRefusal(envName, names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR, noticeSeat: "server" });
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
-        const skipped = retiredWithoutSuccessorEntries(names, NAME_TABLE_BEHAVIOR);
+        const skipped = retiredLeftOutEntries(envName, names);
         if (skipped.length > 0) {
             CONFIG_NOTICES.push({
                 level: "warn",
@@ -1964,12 +1994,7 @@ function parseAuthDomain(ctx) {
     const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
     const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
     const principalJwtMaxTtlSec = parseNumOrFailNonNegative("PRINCIPAL_JWT_MAX_TTL_SEC", env("PRINCIPAL_JWT_MAX_TTL_SEC", "120"));
-    const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter((s) => s.includes("="))
-        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
-        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+    const authTokens = parseServiceAuthTokens(process.env.SERVICE_AUTH_TOKENS);
     return {
         bindHost: process.env.BIND_HOST || undefined,
         bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : undefined,
@@ -2009,14 +2034,10 @@ function parseOrchestrationDomain(ctx) {
     const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
     hostBackgroundShellEnabled();
     hostExecSpoolEnabled();
-    const lspHostEnabled = (() => {
-        if (process.env.LSP_ENABLED === "false") {
-            throw new Error("LSP_ENABLED=false no longer drives the HOST lane (removed in server 3.0.0) — set LSP_HOST_ENABLED=false " +
-                "for the host lane; LSP_ENABLED remains the SANDBOX-lane opt-in only (migration table in USAGE.md)");
-        }
-        return boolEnv("LSP_HOST_ENABLED", true);
-    })();
+    const lspHostEnabled = boolEnv("LSP_HOST_ENABLED", true);
+    const autoBackgroundOnTimeout = boolEnv("AUTO_BACKGROUND_ON_TIMEOUT", true);
     const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
+    const hookEnvAllow = parseEnvNameAllowlist("HOOK_ENV_ALLOW", singleUserTurnkey) ?? [];
     const declaredLane = declaredExecutionLane(process.env.REMOTE_EXEC);
     const readFaceFacts = process.env.READ_FACE !== undefined
         ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
@@ -2121,6 +2142,7 @@ function parseOrchestrationDomain(ctx) {
                                                             : {}),
                                                         ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
                                                         ...((names) => (names !== undefined ? { env: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("DOCKER_SANDBOX_ENV", singleUserTurnkey)),
+                                                        ...((capacity) => (capacity !== undefined ? { capacity } : {}))(parseLocalDockerCapacityEnv()),
                                                     }
                                                     :
                                                         declaredLane === "device"
@@ -2188,9 +2210,10 @@ function parseOrchestrationDomain(ctx) {
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true),
         envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true),
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
-        lspEnabled: boolEnv("LSP_ENABLED", false),
         lspHostEnabled,
+        autoBackgroundOnTimeout,
         lspEnvAllow,
+        hookEnvAllow,
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
@@ -2274,7 +2297,7 @@ function parseLimitsHttpDomain() {
             return sec;
         })(),
         reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
-        runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
+        runStaleSec: numEnv("REAP_RUN_STALE_SEC", String(RUN_STALE_SEC_DEFAULT)),
         toolResultTtlSec: (() => {
             const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
             if (ttl <= 0) {
@@ -2315,7 +2338,11 @@ function parseGitApiKind(raw, baseUrl) {
         throw new Error(`GIT_API_BASEURL="${buildDisplaySafeUrl(baseUrl)}" is not a valid URL (expected e.g. https://git.example.com)`);
     }
     const u = new URL(baseUrl);
-    const host = u.hostname.replace(/\.$/, "").toLowerCase();
+    const reading = hostOfUrl(baseUrl);
+    if ("unreadable" in reading) {
+        throw new Error(`GIT_API_BASEURL names no host — ${HOST_UNREADABLE_SENTENCE[reading.unreadable]} (expected e.g. https://git.example.com; the token goes in GIT_API_TOKEN)`);
+    }
+    const host = reading.host;
     const githubFamily = host === "github.com" || host === "api.github.com" || host.endsWith(".github.com");
     if (kind === "gitea" && githubFamily) {
         throw new Error(`GIT_API_BASEURL points at ${host} but GIT_API_KIND is "gitea" — the Gitea API shapes 404 on GitHub. Set GIT_API_KIND=github (base url should be https://api.github.com, or your GHE /api/v3 root).`);
@@ -2504,6 +2531,11 @@ function parseA2aServe() {
         blockingWaitMs: numEnvBounded("A2A_SERVE_BLOCKING_WAIT_MS", "45000", 0, 300_000),
     };
 }
+const A2A_SERVE_SKILLS_VERSION = 2;
+const A2A_SERVE_SKILL_KEYS = ["id", "name", "description", "scenario", "audience"];
+const A2A_SERVE_SKILL_ENTRY_SHAPE = "{id, name?, description?, scenario, audience?}";
+const A2A_SERVE_SKILLS_SHAPE = `{"version":${A2A_SERVE_SKILLS_VERSION},"skills":[${A2A_SERVE_SKILL_ENTRY_SHAPE}, …]}`;
+const A2A_SERVE_MAX_AUDIENCE = 64;
 function parseA2aServeSkills(raw) {
     if (raw === undefined || raw.trim() === "")
         return [];
@@ -2512,18 +2544,38 @@ function parseA2aServeSkills(raw) {
         parsed = JSON.parse(raw);
     }
     catch (e) {
-        throw new Error(`A2A_SERVE_SKILLS must be a JSON array of {id, name?, description?, scenario} objects — it did not parse as JSON (${e.message})`);
-    }
-    if (!Array.isArray(parsed))
-        throw new Error(`A2A_SERVE_SKILLS must be a JSON ARRAY of {id, name?, description?, scenario} objects; got ${typeof parsed}`);
-    if (parsed.length > A2A_SERVE_MAX_SKILLS)
-        throw new Error(`A2A_SERVE_SKILLS declares ${parsed.length} skills — at most ${A2A_SERVE_MAX_SKILLS} are accepted (the card is a public document fetched by anonymous callers)`);
+        throw new Error(`A2A_SERVE_SKILLS must be a JSON object ${A2A_SERVE_SKILLS_SHAPE} — it did not parse as JSON (${e.message})`);
+    }
+    if (Array.isArray(parsed)) {
+        throw new Error(`A2A_SERVE_SKILLS is a bare JSON array — that form is retired: the value is now a versioned envelope ${A2A_SERVE_SKILLS_SHAPE}. ` +
+            `Migrate by wrapping the old value unchanged: {"version":${A2A_SERVE_SKILLS_VERSION},"skills":<the old array>} (an \`audience\` member is only read inside the envelope).`);
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        throw new Error(`A2A_SERVE_SKILLS must be a JSON object ${A2A_SERVE_SKILLS_SHAPE}; got ${parsed === null ? "null" : typeof parsed}`);
+    const envelope = parsed;
+    for (const key of Object.keys(envelope)) {
+        if (key !== "version" && key !== "skills")
+            throw new Error(`A2A_SERVE_SKILLS carries an unknown key ${JSON.stringify(key.slice(0, 64))} — the envelope's keys are exactly "version" and "skills"`);
+    }
+    if (envelope.version !== A2A_SERVE_SKILLS_VERSION) {
+        throw new Error(`A2A_SERVE_SKILLS.version must be the number ${A2A_SERVE_SKILLS_VERSION} — this build reads exactly that envelope version (a different or missing version is refused rather than guessed: the version is what keeps a build from misreading a shape it does not know)`);
+    }
+    const skills = envelope.skills;
+    if (!Array.isArray(skills))
+        throw new Error(`A2A_SERVE_SKILLS.skills must be a JSON array of ${A2A_SERVE_SKILL_ENTRY_SHAPE} objects`);
+    if (skills.length > A2A_SERVE_MAX_SKILLS)
+        throw new Error(`A2A_SERVE_SKILLS declares ${skills.length} skills — at most ${A2A_SERVE_MAX_SKILLS} are accepted (the card is a public document fetched by anonymous callers)`);
     const seen = new Set();
-    return parsed.map((entry, i) => {
-        const at = `A2A_SERVE_SKILLS[${i}]`;
+    return skills.map((entry, i) => {
+        const at = `A2A_SERVE_SKILLS.skills[${i}]`;
         if (typeof entry !== "object" || entry === null || Array.isArray(entry))
-            throw new Error(`${at} must be an object {id, name?, description?, scenario}`);
+            throw new Error(`${at} must be an object ${A2A_SERVE_SKILL_ENTRY_SHAPE}`);
         const e = entry;
+        for (const key of Object.keys(e)) {
+            if (!A2A_SERVE_SKILL_KEYS.includes(key)) {
+                throw new Error(`${at} carries an unknown key ${JSON.stringify(key.slice(0, 64))} — an entry's keys are exactly ${A2A_SERVE_SKILL_KEYS.map((k) => JSON.stringify(k)).join(", ")} (an unknown key is refused, never dropped: a misspelt "audience" would otherwise publish the skill to everyone)`);
+            }
+        }
         const str = (key, required, max) => {
             const v = e[key];
             if (v === undefined) {
@@ -2544,16 +2596,45 @@ function parseA2aServeSkills(raw) {
         const name = str("name", false, A2A_SERVE_MAX_TEXT_CHARS);
         const description = str("description", false, A2A_SERVE_MAX_TEXT_CHARS);
         const scenario = str("scenario", true, A2A_SERVE_MAX_ID_CHARS);
-        return { id, ...(name !== undefined ? { name } : {}), ...(description !== undefined ? { description } : {}), scenario };
+        const audience = parseA2aServeAudience(e.audience, at);
+        return { id, ...(name !== undefined ? { name } : {}), ...(description !== undefined ? { description } : {}), scenario, ...(audience !== undefined ? { audience } : {}) };
+    });
+}
+function parseA2aServeAudience(v, at) {
+    if (v === undefined)
+        return undefined;
+    const rule = `must be a non-empty JSON array of at most ${A2A_SERVE_MAX_AUDIENCE} principal names (omit the key to publish the skill to every caller)`;
+    if (!Array.isArray(v) || v.length === 0)
+        throw new Error(`${at}.audience ${rule}`);
+    if (v.length > A2A_SERVE_MAX_AUDIENCE)
+        throw new Error(`${at}.audience lists ${v.length} principals — it ${rule}`);
+    return v.map((item, j) => {
+        if (typeof item !== "string")
+            throw new Error(`${at}.audience[${j}] must be a string (a principal name)`);
+        const problem = principalShapeProblem(item);
+        switch (problem) {
+            case undefined:
+                return item;
+            case "not_a_name":
+                throw new Error(`${at}.audience[${j}] is not a principal name (empty, or carries characters no verified identity can have) — list the exact principal names this skill is published to`);
+            case "reserved":
+                throw new Error(`${at}.audience[${j}] is a reserved internal identifier (an internal scope sentinel or a reserved prefix), which no caller can authenticate as — list real principal names`);
+            case "too_long":
+                throw new Error(`${at}.audience[${j}] exceeds ${PRINCIPAL_MAX_BYTES} UTF-8 bytes, longer than any principal a caller can authenticate as`);
+            default: {
+                const unknownProblem = problem;
+                throw new Error(`${at}.audience[${j}]: unknown principal-shape verdict ${String(unknownProblem)}`);
+            }
+        }
     });
 }
 const STORE_GROUP_KEYS = [
     "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot", "sealedKeyDir",
-    "runStoreStrictHydrate",
+    "runStoreStrictHydrate", "localStoreDurability",
     "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "fileHistoryCapture", "sendUserFile",
 ];
 const MODEL_PLANE_GROUP_KEYS = [
-    "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
+    "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "envModelContextWindowSource", "models", "contextWindowSources",
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
@@ -2580,7 +2661,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs", "backgroundAgentStallMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
-    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspHostEnabled", "lspEnvAllow", "hookEnvAllow", "autoBackgroundOnTimeout",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired", "sandboxReadFloor",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
 ];
@@ -2705,6 +2786,9 @@ function k8sWorkspaceCache() {
     return { mount, size };
 }
 export function loadConfig() {
+    const undeclared = ownCredentialDeclarationRefusal();
+    if (undeclared !== undefined)
+        throw new Error(undeclared);
     rejectRetiredEnvs();
     CONFIG_WARNINGS.length = 0;
     CONFIG_NOTICES.length = 0;
@@ -2816,11 +2900,4 @@ export function splitLocalRoots(a) {
         return undefined;
     return { dataRoot: a.localDataRoot, configRoot };
 }
-export function resolveBindHost(config) {
-    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-    const mustNarrow = Boolean(config.allowUnauthedWrites) && !anyServiceAuth;
-    if (config.bindHost && !(mustNarrow && config.bindHostSource === "HOST"))
-        return config.bindHost;
-    return mustNarrow ? "127.0.0.1" : undefined;
-}
 //# sourceMappingURL=config.js.map

package/dist/context-window-notice.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 「这只模型的窗是假定的」运维通告的**唯一发声器**(行的形与事件名属 `model-context-window.ts` 的 `buildContextWindowAssumedNotice`)。
+ *
+ * ## 说什么
+ * **进程此刻服务的那张模型表**里,窗来源(`config.contextWindowSources`,与 `GET /v1/models` 行的 `contextWindowSource` 同一张表)是 `assumed` 的每只模型一行;
+ * 一个名每进程只说一次(同一份活配置一本账 —— 起服说过的名,目录落地 / 「无中心配置」档回到 env 表时不再说)。
+ *
+ * ## 在哪说(位置即判据,与「配了 $ 天花板但目录未定价」那一句同一条纪律)
+ *  · 起服:模型表**定形之后**(装配第 2 段目录应用之后的不变量区末尾、run-local 配置源应用之后的同一位置)—— 不在 `loadConfig` 里说:那一拍只见 env 表,
+ *    目录随后在 boot 被采纳时 env 表整张不服务,在那里说就是对一只不会服务的模型报警(行里还会说 `GET /v1/models` 有它的行,而那一行并不存在)。
+ *  · 运行中:每次模型面 commit 之后(目录换代、迟到的 boot 目录、「无中心配置」档回到 env 表 —— `applyEffective` 一处)。
+ * 严格名册布防时 env 表是占位、从不被派发(`isRosterGateArmed`;路由判官对它豁免的同一个事实)⇒ env 表在服时不说。
+ *
+ * ## 哪些名
+ * 别名(`default` 与某个本名指向同一只模型)不另说;目录里真有一条**叫** `default` 的条目(不是别名)照说。
+ */
+import type { Model } from "@sema-agent/core";
+import { type ContextWindowSource } from "./model-context-window.js";
+/** 发声器读的那几格活配置(结构子集;`ServiceConfig` 满足)。 */
+export interface AssumedWindowView {
+    readonly model: Model;
+    readonly envModel: Model;
+    readonly models: Readonly<Record<string, Model>>;
+    readonly contextWindowSources: Readonly<Record<string, ContextWindowSource>>;
+}
+export declare function warnAssumedContextWindows(config: AssumedWindowView, logger: {
+    warn(event: string, fields?: Record<string, unknown>): void;
+} | undefined, opts: {
+    readonly envTableIsPlaceholder: boolean;
+}): void;
+//# sourceMappingURL=context-window-notice.d.ts.map

package/dist/context-window-notice.js

@@ -0,0 +1,28 @@
+import { buildContextWindowAssumedNotice } from "./model-context-window.js";
+import { DEFAULT_MODEL_REF, servedModelTableLeg } from "./model-select.js";
+const assumedWindowNamesSaid = new WeakMap();
+export function warnAssumedContextWindows(config, logger, opts) {
+    if (logger === undefined)
+        return;
+    const leg = servedModelTableLeg(config);
+    if (leg === "env" && opts.envTableIsPlaceholder)
+        return;
+    const said = assumedWindowNamesSaid.get(config) ?? new Set();
+    assumedWindowNamesSaid.set(config, said);
+    const named = new Set(Object.entries(config.models).filter(([name]) => name !== DEFAULT_MODEL_REF).map(([, m]) => m));
+    for (const [name, m] of Object.entries(config.models)) {
+        if (name === DEFAULT_MODEL_REF && named.has(m))
+            continue;
+        if (said.has(name) || config.contextWindowSources[name] !== "assumed")
+            continue;
+        said.add(name);
+        const declareAt = leg === "catalog"
+            ? "the catalog entry's contextWindow (or MODEL_CONTEXT_WINDOW, which every entry without one inherits)"
+            : m === config.envModel
+                ? "MODEL_CONTEXT_WINDOW"
+                : "MODEL_CHEAP_CONTEXT_WINDOW (or MODEL_CONTEXT_WINDOW, which the cheap slot inherits)";
+        const notice = buildContextWindowAssumedNotice({ model: name, window: m.contextWindow, declareAt });
+        logger.warn(notice.event, notice.fields);
+    }
+}
+//# sourceMappingURL=context-window-notice.js.map

package/dist/delegated-session-owner.d.ts

@@ -29,7 +29,7 @@
 import type { SessionPlacement } from "@sema-agent/core";
 import type { SessionFace } from "./session-incarnation.js";
 import type { SqlDialect } from "./plugins/sql-driver.js";
-/** 孤行哨兵属主的前缀(保留主体前缀:`security.ts` 的 `RESERVED_PRINCIPAL_PREFIXES` 登记它,任何身份来源报出带它的主体都在鉴权边界被拒)。 */
+/** 孤行哨兵属主的前缀(保留主体前缀:`principal-shape.ts` 的 `RESERVED_PRINCIPAL_PREFIXES` 登记它,任何身份来源报出带它的主体都在鉴权边界被拒)。 */
 export declare const ORPHAN_SESSION_OWNER_PREFIX = "_orphan:";
 /** 一只推不出属主的子代会话的哨兵属主(每只会话一个值:即便哪天有谁误配出这个串,也只够得着这一只)。 */
 export declare function orphanSessionOwner(sessionId: string): string;

package/dist/deleted-session-ids.d.ts

@@ -2,10 +2,11 @@ import type { DeploymentShapeInput } from "./deployment-shape.js";
 /** 表的条数上限(一条约百字节量级)。引擎的会话暂存自己按会话数有上限(超了整会话驱逐最旧);本表的上限比它宽得多。 */
 export declare const DELETED_SESSION_ID_CAP = 50000;
 /**
- * **铸点**(唯一):本进程的在线删除协调器在删除会话本体之前记一笔 —— 围栏先立,id 才空出来。删除随后失败也无害:
+ * **铸点**(唯一的函数;两处调用者):本进程的在线删除协调器在删除会话本体之前记一笔 —— 围栏先立,id 才空出来;提交出口撤回一只被拒提交铸下的会话之后同步记一笔
+ * (`submission-exit.ts`,判撤才记)。删除随后失败也无害:
  * 这一笔只拒「别的属主」,而会话还在时别的属主本来就用不了它。
  * 同一只 id 再删一次:这一次的删前属主对已记的每一位都等价(同一只等价律判)⇒ 收进集合(前几位一位不丢 —— 等价律有方向、不传递,只记最新一位会让
- * 「哨兵删 → 无主重登再删 → `default` 用」绕过「哨兵 ≢ `default`」);对某一位不等价 ⇒ 记成「谁都不是」。后一次删除从不覆盖前一位(前一位的暂存仍可能在本进程)。
+ * 「无主删 → `default` 重登再删 → 无主体的调用方用」绕过「`default` 的行 ≢ 无主体的调用方」);对某一位不等价 ⇒ 记成「谁都不是」。后一次删除从不覆盖前一位(前一位的暂存仍可能在本进程)。
  * `deployment` = 部署形(等价律的窄互认臂读它;调用方递 `ServiceConfig` 整份)。
  */
 export declare function retireSessionId(sessionId: string, owner: string | null, deployment: DeploymentShapeInput<"principal">): void;

package/dist/deployment-governance.d.ts

@@ -1,5 +1,5 @@
 import { FileError, StubExecutionEnv, type ExecutionEnv, type PathFamily, type Result, type ToolPolicy } from "@sema-agent/core";
-import { type DeploymentListExemption } from "./approval.js";
+import { type SessionExemptionRead } from "./approval.js";
 import type { ServiceConfig } from "./config.js";
 import type { applyRuntimeGovernance } from "./runtime-governance.js";
 /** `applyRuntimeGovernance` 的 governance 实参 —— 从折叠属主的签名位**推导**,不复制形状
@@ -84,8 +84,8 @@ export interface DurableApprovalSeat {
     readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
-    /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createDeploymentListExemption`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
-    readonly exemption?: DeploymentListExemption;
+    /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createSessionExemptionRead`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
+    readonly exemption?: SessionExemptionRead;
 }
 /** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店:run-local 一次性腿)。 */
 export interface LiveApprovalSeat {