@sema-agent/server 7.147.0 → 7.149.0

package/dist/host-lsp-manager.d.ts

@@ -1,14 +1,22 @@
 /**
- * [ref](core 7.30.1 [ref] 提货)—— **宿主车道本地语言服务器**的唯一构造点。
+ * **本机语言服务器管理器的唯一铸点**:「这台部署挂不挂本机语言服务器」的唯一答者与唯一构造点([ref] 起构造形一份;[ref] 起判据也一份)。
  *
- * ## 病(DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
+ * ## 律(一句)
+ * 本机语言服务器只在「worker 盘就是调用方的盘」时挂 —— 部署形表的既有行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主)× 旋钮
+ * `LSP_HOST_ENABLED`。理由:core 的 `NodeLspManager` 在 worker 上起本机子进程、在 worker 盘上找根,问的正是「这块盘是不是调用方的」;
+ * 车道能力表不另存一位(同一个答案的第二个写者)。两个入口(服务装配 `boot/execution-env.ts`、纯本地 CLI `run-local.ts`)的 `lspManager`
+ * 就是本函数的返回值,不再有任何条件(结构钉 `test/secret-env-scrub-disclosure.test.ts` 的 P1,逐格钉 `test/lsp-host-manager.test.ts` 的 P2)。
+ * 「绑得住读」(`openBound`)不是运行期判据:它是「手在本 worker 盘上」的车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts`),
+ * 运行期的不可绑拒由引擎答。
+ *
+ * ## 子进程 env:病([ref],core 7.30.1 [ref] 提货;DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
  * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的
  * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
  * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
  * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
  * 本仓唯一组合 `hostSubprocessEnv` 的结果 —— 引擎 `inheritedHostEnv("scrub")` ∪ 点名放回)。
  *
- * ## 规则(一句)
+ * ## 子进程 env:规则(一句)
  * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键([ref],见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
@@ -31,12 +39,18 @@
  * (带当前放行名单与出路句),这一行就是「剥了什么」的用户可见面 —— 语言服务器侧从不报。
  *
  * ## 两个调用点
- * `boot/execution-env.ts`(服务的 host 车道)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })`;
- * 现在都经本函数 —— 构造形只有一份,剥除规则也就只能有一份(源码对账钉在 `test/secret-env-scrub-disclosure.test.ts`)。
- * 两处都交整份 `config`(类型只要 `lspEnvAllow` 一格),放行名单因此只有一个读点。
+ * `boot/execution-env.ts`(服务装配)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })` 与各自的挂载判据;
+ * 现在都只取本函数的返回值 —— 构造形、剥除规则与判据都只有一份。两处都交整份 `config`,放行名单与判据因此只有一个读点。
  */
 import { NodeLspManager } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
-/** 构造宿主车道的本地语言服务器管理器(`create*`:返回活对象)。`log` = 管理器的观测钩(open/heal/degrade/evict 事件)。 */
-export declare function createHostLspManager(config: Pick<ServiceConfig, "lspEnvAllow">, log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
+import { type DeploymentShapeInput } from "./deployment-shape.js";
+/** 铸点读的配置:部署形那一行的两根轴(车道 · 租户)+ 旋钮 + 放行名单(`ServiceConfig` 结构上满足)。 */
+export type LspManagerConfig = DeploymentShapeInput<"lane" | "principal"> & Pick<ServiceConfig, "lspHostEnabled" | "lspEnvAllow">;
+/**
+ * 本机语言服务器管理器(`create*`:返回活对象)—— worker 盘是调用方的盘(`callerOwnsWorkerDisk`)∧ `LSP_HOST_ENABLED` ⇒ 一只 `NodeLspManager`;
+ * 否则 `undefined`(这台部署没有本机语言服务器;引擎据管理器席缺席不挂 `LSP` 工具,`wiring_manifest.lsp` 缺席)。
+ * `log` = 管理器的观测钩(open/heal/degrade/evict 事件)。
+ */
+export declare function createLspManager(config: LspManagerConfig, log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager | undefined;
 //# sourceMappingURL=host-lsp-manager.d.ts.map

package/dist/host-lsp-manager.js

@@ -1,6 +1,9 @@
 import { NodeLspManager } from "@sema-agent/core";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { hostSubprocessEnv } from "./server-secret-env.js";
-export function createHostLspManager(config, log) {
+export function createLspManager(config, log) {
+    if (!(DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config) && config.lspHostEnabled))
+        return undefined;
     const composed = hostSubprocessEnv({ site: "server.lsp.spawn-env", allow: config.lspEnvAllow });
     const env = {};
     for (const [k, v] of Object.entries(composed))

package/dist/http/active-run-conflict.d.ts

@@ -81,28 +81,6 @@ export interface ActiveRunConflictBody {
      *  best-effort**:缺席 = 无法证明(跨副本/重启后),不是「不活」——诚实缺席,绝不铸 0。消费端
      *  (cli running 臂,[ref] C3)凭它区分「真忙的后台 run」与「久无进展的疑似僵局」,替代猜测文案。 */
     msSinceLastActivity?: number;
-    /**
-     * [ref](c)([ref]② 成文的洞 (c) 的修):**两面口径的对齐位**。
-     *
-     * 病:poll 面(`GET /v1/runs/:id`)对「`running` 且 `now - updatedAt > runStaleSec`」的行**折叠**成
-     * `status:"failed"`(+「run stalled (instance lost?)」),而本体把 run 行 `status` **原样**报 `running`。
-     * ⇒ 自愈窗内(心跳 30s 断供 + `REAP_RUN_STALE_SEC` 默认 120s + `REAP_INTERVAL_SEC` 默认 60s ⇒ SQL 车道
-     * 上界 ≈180s;LOCAL/file 车道无周期腿,上界 = ∞)同一条死 run 两面自相矛盾:409 说「还在跑,去
-     * steer/cancel」,poll 说「已经 failed」。壳只能靠猜。
-     *
-     * 🔴 **刻意不学 poll 面谎报终态**:409 的 `activeTaskStatus` 是 run 行的**真**状态,而且这条 run 的
-     * session claim **确实**还攥着(reaper 还没跑);把它折成 `failed` 会造出「行说 failed 但锁还在、
-     * 新提交照旧 409」的第二种自相矛盾。改用 additive 的判别位:`stale:true` 与既有 `activeTaskStatus` /
-     * `msSinceLastActivity` **并存**,壳凭它把两面对上(「poll 那边会说 failed = 这条大概率是死行」)。
-     *
-     * 🔴 **只在为真时在场**(与 `PendingGateMaterial.governanceForced` 同一条纪律):缺席 = 「没有陈旧的
-     * 证据」,**不是**「证明它活着」——判据只有 `updated_at` 一维,慢而活的 run 有误杀窗([ref]② 洞 (b)
-     * 原样有效)。⇒ 这一位是**分诊材料**,不是终态断言。
-     *
-     * 🔴 **只对 `running` 铸**:park 两态(suspended/needs_review)根本不在 `reapStale` 射程内([ref]②
-     * 洞 (a)),给它们标 stale 就是假材料。
-     */
-    stale?: true;
     pendingGate?: PendingGateMaterial;
 }
 /** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
@@ -125,20 +103,6 @@ export interface ActiveRunConflictDoneResult {
     activeTaskStatus?: string;
     /** [ref] S1:与 409 body 同键同语义(见 {@link ActiveRunConflictBody.msSinceLastActivity})。 */
     msSinceLastActivity?: number;
-    /**
-     * [ref](c):与 409 body 同键同语义(见 {@link ActiveRunConflictBody.stale})。
-     *
-     * 🔴 **跨仓欠账,如实登记**(codex 交叉复审 R1-[medium] 验真后的真形):sema-sdk 的
-     * `spec/openapi.yaml` 里 `ActiveRunConflictDoneResult` 是 `additionalProperties: false` 的**封闭**
-     * schema,今天只声明 `status/errorCode/errorMessage/activeTaskId/activeTaskStatus/pendingGate` 六键。
-     * ⚠️ 亲验后的关键修正:这**不是本键引入的新问题** —— `msSinceLastActivity`([ref] S1)早就在这条
-     * done 帧上,同样没进那张封闭表,即**同族违例已存在**且没有任何门看得见它(producer-contract 只校
-     * 409 体那条 op,不校这条 SSE 帧)。本批**刻意不**为了绕开它而让 done 帧与 409 体分家(「同材料禁
-     * 分家」是本文件自己的纪律,分家换来的是两面口径再次相左 —— 正是本件在修的病)。
-     * ⇒ 跟车件已上报:sema-sdk 侧把 `msSinceLastActivity` + `stale` 一并补进该 schema,并给
-     * producer-contract 加一条**真** SSE 冲突 done 帧的校验格(今天那条空白正是两键都能悄悄漂出去的原因)。
-     */
-    stale?: true;
     pendingGate?: PendingGateMaterial;
 }
 /** 一份提交拒绝体是不是**会话占用冲突**体(`buildActiveRunConflict` 的产物)—— 判别位 = 机器码,与 sdk 终帧联合里冲突臂的窄化同一个位。
@@ -149,12 +113,10 @@ interface ConflictProbeDeps<TToken> {
     /** 结构形入参,但 `status` 取 run 行的**闭词表**(合并码重扫):判 park 要走词表属主
      *  `isParkedRunStatus`,而它的入参是穷举联合 —— 这一格写成开放 `string` 就只能在调用点裸 cast,
      *  绕开那道编译期执法(core 加一个 park 类成员时本文件不会红)。 */
-    /** `updatedAt`([ref](c)):stale 折叠的唯一判据维([ref]② 洞 (b):慢而活的 run 有误杀窗)。可选 —— 缺席
-     *  或不可解析 ⇒ `stale` 键诚实缺席(与本模块「材料是 best-effort 增强」同方向)。 */
+    /** 持有者那一行(只读 `status`;409 体只点名**活着**的持有者 —— 心跳过期的持有者在认领冲突处已被判死、认领已放,见 run 店 `createRun`)。 */
     runStore?: {
         getRun?: (id: string) => Promise<{
             status?: RunRecord["status"];
-            updatedAt?: string;
         } | null | undefined>;
     } | undefined;
     checkpointStore?: {
@@ -165,6 +127,7 @@ interface ConflictProbeDeps<TToken> {
          *  裁定加的取证格 —— 见 `runtime-governance.ts` 的 `governanceOriginOf` 推导论证。`checkpointId`([ref],core 5.42.0)
          *  是行的非秘密稳定身份,可选 —— legacy 行没有它(见 `PendingGateMaterial.checkpointId`)。 */
         get?: (token: TToken) => Promise<{
+            sessionId?: string;
             checkpointId?: string;
             gate?: {
                 kind?: string;
@@ -176,10 +139,6 @@ interface ConflictProbeDeps<TToken> {
     } | undefined;
     /** [ref]:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席 —— 与 best-effort 同方向)。 */
     governance?: GovernancePosture | undefined;
-    /** [ref](c):stale 折叠的阈值(秒),生产装配 = `config.runStaleSec` —— 与 poll 面
-     *  (`routes/runs.ts` 的 `deps.config.runStaleSec * 1000`)**同一个旋钮**,两面口径因此同源。
-     *  缺席/非正数 ⇒ 不折叠(键缺席),等价于「本部署没有配这条判据」。 */
-    runStaleSec?: number | undefined;
     /** [ref] S1:turn 活性读口(生产装配 = `readTurnActivityMs`,turn-activity.ts)。返回最后活性时刻
      *  (epoch ms)或 undefined。可选:未装配/读不到 ⇒ `msSinceLastActivity` 键缺席,best-effort 同方向。 */
     turnActivity?: ((taskId: string) => number | undefined) | undefined;

package/dist/http/active-run-conflict.js

@@ -31,7 +31,6 @@ export function toDoneFrameResult(body) {
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),
         ...(body.msSinceLastActivity !== undefined ? { msSinceLastActivity: body.msSinceLastActivity } : {}),
-        ...(body.stale !== undefined ? { stale: body.stale } : {}),
         ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
     };
 }
@@ -53,26 +52,23 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             return base;
         if (status === "running") {
             const lastAt = deps.turnActivity?.(activeTaskId);
-            const updatedAtMs = row?.updatedAt !== undefined ? new Date(row.updatedAt).getTime() : Number.NaN;
-            const staleMs = (deps.runStaleSec ?? 0) * 1000;
-            const stale = staleMs > 0 && Number.isFinite(updatedAtMs) && Date.now() - updatedAtMs > staleMs;
             return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
                 ...baseFacts,
                 activeTaskStatus: status,
                 ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
-                ...(stale ? { stale: true } : {}),
             });
         }
         const cs = deps.checkpointStore;
         let pendingGate;
         if (cs?.findPendingTokenBySession) {
-            const runBinding = { gateKinds: LIVE_RUN_GATE_KINDS };
+            const runBinding = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
             const scope = (await cs.peekPendingScope?.(sessionId, runBinding)) ?? undefined;
             const token = scope === null ? null : await cs.findPendingTokenBySession(sessionId, scope, runBinding);
             const row = token ? await cs.get?.(token) : undefined;
             const gate = row?.gate;
             const kind = gate?.kind;
-            const decidePath = kind ? resumeEntryForGate(kind, { sessionId, taskId: activeTaskId }) : null;
+            const cardSessionId = row?.sessionId;
+            const decidePath = kind && cardSessionId ? resumeEntryForGate(kind, { sessionId: cardSessionId, taskId: activeTaskId }) : null;
             const governanceForced = governanceOriginOf(gate, deps.governance);
             const checkpointId = trustedCheckpointId(row?.checkpointId, token);
             if (kind && decidePath) {

package/dist/http/admission.d.ts

@@ -6,18 +6,10 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { TaskRequestBody } from "./wire-types.js";
 import { HttpError } from "../security.js";
-import { type LimitFacts } from "../limit-refusal.js";
+import { type SkillItemRefusal } from "../spec-fields.js";
 import type { PreparedTaskSubmission, RouteHelpers } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
-/** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在
- *  dist/core/runner/synthetic-tools.js,未从 core 包根导出,故钉本地孪生+本出处注记)。修7 曾对齐旧
- *  20k 截断门([ref] 飞轮考据:20k 是压缩保留区口径,invoke 时刻用错),core 1.293 撤门后本门跟随回收
- *  ([ref]① 收口)——HTTP 面与引擎加载门同值,超限 400 fail-loud 而非引擎侧整拒后难诊断。
- *
- *  🔴 **这是技能面**唯一**剩下的尺寸门,而且它不是超集帽**:引擎在装配期对超 1 MiB 的技能本就整拒
- *  (config 阶段错误),门上先答只是把同一个判决搬到调用方看得懂的地方。[ref] 退役的三条帽
- *  (条数 / description / name 长度)都没有这个性质——它们是本仓自造的、CC 与引擎都没有的门。 */
-export declare const MAX_SKILL_CONTENT_CHARS = 1048576;
+export { MAX_SKILL_CONTENT_CHARS } from "../spec-fields.js";
 export declare const MAX_SYSTEM_PROMPT_CHARS = 16384;
 /** Cap on a request's `outputSchema` (JSON-serialized) — an uncapped schema bloats the prompt + the per-turn
  *  validation cost. 32KB comfortably holds a rich nested schema while bounding the abuse surface. */
@@ -53,17 +45,11 @@ export declare const MAX_OUTPUT_SCHEMA_CHARS = 32768;
  * 🔴 **server 侧禁裁列表 / 禁截描述**:渲染归引擎(单一属主)。本函数只判「这一条技能的形能不能用」。
  */
 export declare function validateUserSkills(skills: unknown): UserSkillsRefusal | null;
-/** `body.skills` 的拒:句子 + 撞帽时的机读位(`field` / `reason` / `count` / `cap`;形错只有句子)。与子代定义那道门(`spec-fields.ts` 的 `TaskAgentsRefusal`)同形。 */
+/** `body.skills` 的拒:句子 + 机读位(`field` = 体内坐标;撞帽另带 `reason` / `count` / `cap`)。与子代定义那道门(`spec-fields.ts` 的 `TaskAgentsRefusal`)同形。 */
 export interface UserSkillsRefusal {
     readonly message: string;
-    readonly facts?: LimitFacts;
+    readonly facts?: SkillItemRefusal["facts"];
 }
-/**
- * core 7.41.0 [ref] —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
- * (`allowedTools` / `disallowedTools`)、圈工具 = deny 规则(请求 `settings.permissions.deny` / 运维 `APPROVAL_DENY`)或子代定义的
- * `agents[].allowTools`、圈写路径 = 会话规则 `allowDirs`(`PUT /v1/sessions/:id/policy`)。
- */
-export declare const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 \u2014 a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 export declare function createAdmission(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];

package/dist/http/admission.js

@@ -2,7 +2,7 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
@@ -13,25 +13,30 @@ import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHisto
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
-import { ATTACHMENT_BOOLEAN_KEYS, ATTACHMENT_KEYS, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { ATTACHMENT_BOOLEAN_KEYS, ATTACHMENT_KEYS, normalizeApproachNotice, skillItemIssue, skillRefusalAt, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 import { echoCallerText, quotedCallerText } from "../caller-text-echo.js";
+import { MAX_IMAGES_PER_REQUEST, inlineImageData } from "../request-images.js";
 import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
-import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { legFactsOf } from "../leg-facts.js";
-import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
+import { createSubmissionSeat } from "../submission-exit.js";
+import { assertRequestFormBeforeMint } from "../request-form.js";
+import { headerStr } from "./principal-gate.js";
+import { SUBMISSION_CLAIM_FACE, resolveBeforeClaim, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { promptScreenDeclared } from "../prompt-screen.js";
 import { sendError, sendHttpError } from "./send.js";
 import { refuseSubmitBody } from "./request-guards.js";
 import { sqlWallsOf } from "../plugins/sql-driver.js";
-import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { personOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
-export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
+export { MAX_SKILL_CONTENT_CHARS } from "../spec-fields.js";
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
 const MAX_JOB_ID_CHARS = 64;
@@ -52,45 +57,17 @@ export function validateUserSkills(skills) {
     if (skills === undefined)
         return null;
     if (!Array.isArray(skills))
-        return { message: "skills must be an array of { name, description, content }" };
+        return { message: "skills must be an array of { name, description, content }", facts: { field: "skills" } };
     for (let k = 0; k < skills.length; k++) {
-        const shape = userSkillShapeIssue(skills[k], k);
-        if (shape !== null)
-            return shape;
+        const issue = skillItemIssue(skills[k]);
+        if (issue !== null)
+            return skillRefusalAt(`skills[${k}]`, issue);
         const over = skillToolListsOverCap(skills[k], `skills[${k}]`, "top");
         if (over !== undefined)
             return { message: over.message, ...(over.extra !== undefined ? { facts: over.extra } : {}) };
     }
     return null;
 }
-function userSkillShapeIssue(item, index) {
-    if (item === null || typeof item !== "object")
-        return { message: "each skill must be an object { name, description, content }" };
-    const s = item;
-    if (typeof s["name"] !== "string" || s["name"].length === 0)
-        return { message: "skill.name must be a non-empty string" };
-    if (typeof s["description"] !== "string")
-        return { message: "skill.description must be a string" };
-    if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS) {
-        const facts = overCharsFacts(`skills[${index}].content`, s["content"], MAX_SKILL_CONTENT_CHARS);
-        return { message: `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`, ...(facts === undefined ? {} : { facts }) };
-    }
-    if (s["baseDir"] !== undefined && !isAbsoluteHostPath(s["baseDir"])) {
-        const facts = overCharsFacts(`skills[${index}].baseDir`, s["baseDir"], ABSOLUTE_HOST_PATH_MAX);
-        return { message: `skill.baseDir must be an absolute path string of at most ${ABSOLUTE_HOST_PATH_MAX} characters with no ".." segment and no NUL byte (it is not resolved or read here — the engine only substitutes it into the skill's own text)`, ...(facts === undefined ? {} : { facts }) };
-    }
-    if (skillCarriesRetiredManifest(s))
-        return { message: SKILL_MANIFEST_RETIRED };
-    if (s["mods"] !== undefined)
-        return { message: "skill.mods is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)" };
-    for (const key of ["allowedTools", "disallowedTools"]) {
-        if (s[key] !== undefined && !skillToolListOk(s[key]))
-            return { message: `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))` };
-    }
-    return null;
-}
-export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
-const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = IMAGE_ADMISSION.hard.imageBase64Chars;
 function mentionableNames(config, catalog) {
     return Object.keys(catalog).filter((n) => n !== "default" && isAtMentionable(n, catalog, config.atMention, config.modelRefusals));
@@ -103,6 +80,10 @@ function refuseUnavailableModel(res, config, field, ref) {
     sendError(res, 400, "request.model_unavailable", message);
     return true;
 }
+function refuseNotBoolean(res, field) {
+    sendError(res, 400, "request.field_invalid", `${field} must be a boolean`, { field });
+    return null;
+}
 const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v === "object" ? "an object" : `a ${typeof v}`);
 function hostPathListRefusal(field, raw) {
     if (!Array.isArray(raw))
@@ -285,15 +266,20 @@ export function createAdmission(ctx) {
                         return null;
                     }
                 }
-                const credentialIssue = settingsEnvCredentialIssue(readSettingsEnv(st).reaching, serverCredentialValueSources(deps.config.modelApiKeyEnv));
+                const envReaching = readSettingsEnv(st).reaching;
+                const composeIssue = settingsEnvComposeIssue(envReaching);
+                if (composeIssue !== null) {
+                    sendError(res, 400, "request.field_invalid", composeIssue.message, { field: composeIssue.field });
+                    return null;
+                }
+                const credentialIssue = settingsEnvCredentialIssue(envReaching, serverCredentialValueSources(deps.config.modelApiKeyEnv));
                 if (credentialIssue !== null) {
                     sendError(res, 400, "request.env_credential_refused", credentialIssue.message, { ...credentialIssue.fields });
                     return null;
                 }
             }
             if (st.ultracode !== undefined && typeof st.ultracode !== "boolean") {
-                sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
-                return null;
+                return refuseNotBoolean(res, "settings.ultracode");
             }
             if (st.skillListingBudgetFraction !== undefined && !skillListingBudgetFractionOk(st.skillListingBudgetFraction)) {
                 sendError(res, 400, "request.field_invalid", "settings.skillListingBudgetFraction must be a number greater than 0 and at most 1");
@@ -304,14 +290,13 @@ export function createAdmission(ctx) {
                 return null;
             }
             if (st.autoCompactEnabled !== undefined && !autoCompactEnabledOk(st.autoCompactEnabled)) {
-                sendError(res, 400, "request.field_invalid", "settings.autoCompactEnabled must be a boolean");
-                return null;
+                return refuseNotBoolean(res, "settings.autoCompactEnabled");
             }
             if (st.hooks !== undefined && st.hooks !== null) {
                 const hooksParsed = parseHooksConfig(st.hooks);
                 if (!hooksParsed.config) {
                     const refusal = buildHooksRefusal(hooksParsed.issue);
-                    sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
+                    sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
                     return null;
                 }
                 {
@@ -332,7 +317,7 @@ export function createAdmission(ctx) {
                 const toolMatcher = hooksMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (toolMatcher !== undefined) {
                     const refusal = buildHooksRefusal(toolMatcher);
-                    sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
+                    sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
                     return null;
                 }
             }
@@ -355,8 +340,8 @@ export function createAdmission(ctx) {
                 return null;
             }
             for (const [i, img] of body.images.entries()) {
-                const data = img.data;
-                const dataBytes = typeof data === "string" ? Buffer.byteLength(data, "utf8") : 0;
+                const data = inlineImageData(img);
+                const dataBytes = data !== undefined ? Buffer.byteLength(data, "utf8") : 0;
                 if (dataBytes > MAX_IMAGE_BASE64_BYTES) {
                     sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes (the engine's inline-image limit — the model API's 5 MB image cap)`, limitFacts(`images[${i}].data`, "bytes", dataBytes, MAX_IMAGE_BASE64_BYTES));
                     return null;
@@ -446,12 +431,10 @@ export function createAdmission(ctx) {
             }
         }
         if (body.restoreFiles !== undefined && typeof body.restoreFiles !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "restoreFiles must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "restoreFiles");
         }
         if (body.acceptPartialRestore !== undefined && typeof body.acceptPartialRestore !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "acceptPartialRestore must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "acceptPartialRestore");
         }
         if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
             sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
@@ -476,16 +459,13 @@ export function createAdmission(ctx) {
             return null;
         }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "requireExistingSession");
         }
         if (body.enableFork !== undefined && typeof body.enableFork !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "enableFork must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "enableFork");
         }
         if (body.selfOrchestration !== undefined && typeof body.selfOrchestration !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "selfOrchestration must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "selfOrchestration");
         }
         {
             const admission = facts.selfOrchestrationAdmission(deps);
@@ -505,14 +485,12 @@ export function createAdmission(ctx) {
             for (const k of ["allowDegrade", "allowFailover", "bypassBreaker"]) {
                 const v = r[k];
                 if (v !== undefined && typeof v !== "boolean") {
-                    sendError(res, 400, "request.field_invalid", `resilience.${k} must be a boolean`);
-                    return null;
+                    return refuseNotBoolean(res, `resilience.${k}`);
                 }
             }
         }
         if (body.finalVerification !== undefined && typeof body.finalVerification !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "finalVerification must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "finalVerification");
         }
         if (body.limits !== undefined) {
             const l = body.limits;
@@ -584,8 +562,7 @@ export function createAdmission(ctx) {
             }
         }
         if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "interactiveTools");
         }
         const approvalReach = body.approvalReach;
         if (approvalReach !== undefined && !isApprovalReach(approvalReach)) {
@@ -593,17 +570,14 @@ export function createAdmission(ctx) {
             return null;
         }
         if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "oneShot");
         }
         if (body.retainBackgroundProcesses !== undefined && typeof body.retainBackgroundProcesses !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
-            return null;
+            return refuseNotBoolean(res, "retainBackgroundProcesses");
         }
         for (const key of ["excludeAllTools", "disableSkills"]) {
             if (body[key] !== undefined && typeof body[key] !== "boolean") {
-                sendError(res, 400, "request.field_invalid", `${key} must be a boolean`);
-                return null;
+                return refuseNotBoolean(res, key);
             }
         }
         if (body.disableSkills === true) {
@@ -630,8 +604,7 @@ export function createAdmission(ctx) {
         {
             const v = body.promptLean;
             if (v !== undefined && typeof v !== "boolean") {
-                sendError(res, 400, "request.field_invalid", "promptLean must be a boolean");
-                return null;
+                return refuseNotBoolean(res, "promptLean");
             }
         }
         {
@@ -708,8 +681,7 @@ export function createAdmission(ctx) {
             }
             for (const k of ATTACHMENT_BOOLEAN_KEYS) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
-                    sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
-                    return null;
+                    return refuseNotBoolean(res, `attachments.${k}`);
                 }
             }
             if (rec.todoReminderMode !== undefined && rec.todoReminderMode !== "baseline" && rec.todoReminderMode !== "off") {
@@ -751,32 +723,57 @@ export function createAdmission(ctx) {
             }
         }
         const { body: admitted, entry: entryMode } = stampSubmissionEntryMode(body, deps.config);
+        try {
+            assertRequestFormBeforeMint(admitted, req, deps.config);
+        }
+        catch (err) {
+            if (!(err instanceof HttpError))
+                throw err;
+            if (onTypedFailure)
+                onTypedFailure(err);
+            else
+                sendHttpError(res, err);
+            return null;
+        }
+        if (legRoute?.liveStream === true) {
+            if (verify || cascade) {
+                sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs", fieldConflictFacts("cascade_verify", verify ? (cascade ? ["verify", "cascade"] : ["verify"]) : ["cascade"]));
+                return null;
+            }
+            if (headerStr(req.headers["x-detach-on-disconnect"]) === "true" && !facts.durableRuns(deps).available) {
+                sendError(res, 400, "request.precondition_unmet", "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable");
+                return null;
+            }
+        }
         const lease = deps.peerDesk.lease("fresh");
+        const seat = createSubmissionSeat({ deployment: deps.config, metrics: deps.metrics, dropSessionScopedOf: deps.dropSessionScopedOf, sessionWatch: deps.sessionWatch });
         try {
-            const auth = await deps.authorize({ req, body: admitted });
-            const execution = await resolveExecutionContext(deps, { kind: "fresh", root: auth.sessionId, principal: auth.principal, judged: auth.head, req, deviceId: admitted.deviceId });
+            const auth = await deps.authorize({ req, body: admitted, onBirth: (birth, face) => seat.noteBirth(birth, face) });
+            const execution = await resolveBeforeClaim(deps, { kind: "fresh", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)), judged: auth.head, req, deviceId: admitted.deviceId }, SUBMISSION_CLAIM_FACE);
             const engineNotices = [];
             const resolved = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legRoute?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease, execution });
             const facts = legFactsOf(resolved);
             const runner = runnerFor(resolved);
-            const spec = stampSpecRoot(resolved, execution);
+            const spec = stampSpecRoot(resolved, execution, cascade ? { use: "ladder_host" } : { use: "session", requireExistingSession: admitted.requireExistingSession });
             const model = modelIdOf(spec.model);
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, screened: promptScreenDeclared([deps.deploymentMods, spec.mods]), ...(model !== undefined ? { model } : {}) });
+            seat.attachAcceptance(acceptance);
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
-            return { spec, runner, legFacts: facts, auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, execution, ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
+            return { spec, runner, legFacts: facts, auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, seat, peerLease: lease, execution, ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
             lease.release();
             if (err instanceof HttpError) {
                 if (onTypedFailure) {
-                    onTypedFailure(err);
+                    await seat.deliverTerminal(() => onTypedFailure(err));
                     return null;
                 }
-                sendHttpError(res, err);
+                await seat.deliverTerminal(() => sendHttpError(res, err));
                 return null;
             }
+            await seat.close();
             throw err;
         }
     }

package/dist/http/approval-sweeps.d.ts

@@ -4,14 +4,14 @@
  * ②`redeemParkedAsk`([ref],live 回决腿的 PARKED 赎回席,装配层接进协调器的晚绑座)。
  * 两者都走 resume 家族的 `resumeCheckpoint`,所以它们的属主是「谁在无 HTTP 请求的情况下替人做决定」这件事,
  * 不是请求流水线。`createWallClockJumpGuard` 建的 `denySweepClockGuard` 是 ① 的私有件,随它同居。
- * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `mayDiscloseRowError`),机器算(closure-free-vars)与手抄一致。
+ * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `decisionRowAdmits`),机器算(closure-free-vars)与手抄一致。
  */
 import { type ParkedAskRedeemRequest, type ParkedAskRedeemResult } from "../tool-approval.js";
-import type { createResumeLegs } from "./resume-legs.js";
+import { type createResumeLegs } from "./resume-legs.js";
 import type { FlatServiceDeps } from "./server.js";
 export declare function createApprovalSweeps(ctx: {
     deps: FlatServiceDeps;
-} & Pick<ReturnType<typeof createResumeLegs>, "resumeCheckpoint" | "mayDiscloseRowError">): {
+} & Pick<ReturnType<typeof createResumeLegs>, "resumeCheckpoint" | "decisionRowAdmits">): {
     denyExpiredApprovals: (now: number) => Promise<void>;
     redeemParkedAsk: (req: ParkedAskRedeemRequest) => Promise<ParkedAskRedeemResult>;
 };