@sema-agent/server 7.148.0 → 7.149.0

package/dist/approval-card.d.ts

@@ -86,14 +86,14 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         name: "name";
         path: "path";
         host: "host";
+        tool: "tool";
+        pattern: "pattern";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
-        pattern: "pattern";
         subpath: "subpath";
         name_prefix: "name_prefix";
         subdomain: "subdomain";
-        tool: "tool";
     }>;
     command: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
@@ -105,14 +105,14 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
             name: "name";
             path: "path";
             host: "host";
+            tool: "tool";
+            pattern: "pattern";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
-            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
-            tool: "tool";
         }>;
         command: z.ZodString;
         segment: z.ZodString;
@@ -574,15 +574,15 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     approvalCard: z.ZodOptional<z.ZodEnum<{
-        shell: "shell";
-        plan: "plan";
-        skill: "skill";
         question: "question";
+        fetch: "fetch";
         "file-edit": "file-edit";
         "file-write": "file-write";
         "notebook-edit": "notebook-edit";
-        fetch: "fetch";
+        shell: "shell";
+        skill: "skill";
         workflow: "workflow";
+        plan: "plan";
         generic: "generic";
         "computer-access": "computer-access";
         "computer-control": "computer-control";
@@ -590,10 +590,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
-            hook: "hook";
-            skill: "skill";
-            deployment: "deployment";
             request: "request";
+            deployment: "deployment";
+            skill: "skill";
+            hook: "hook";
             persisted: "persisted";
         }>;
         entries: z.ZodArray<z.ZodString>;
@@ -606,14 +606,14 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             name: "name";
             path: "path";
             host: "host";
+            tool: "tool";
+            pattern: "pattern";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
-            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
-            tool: "tool";
         }>;
         command: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
@@ -625,14 +625,14 @@ export declare const ApprovalCardSchema: z.ZodObject<{
                 name: "name";
                 path: "path";
                 host: "host";
+                tool: "tool";
+                pattern: "pattern";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
-                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
-                tool: "tool";
             }>;
             command: z.ZodString;
             segment: z.ZodString;
@@ -692,8 +692,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceSessionId: z.ZodOptional<z.ZodString>;
     agentId: z.ZodOptional<z.ZodString>;
@@ -708,7 +708,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }>;
         words: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
-        by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+        by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
         words: z.ZodString;
     }, z.core.$strict>]>>>;
     delegation: z.ZodOptional<z.ZodObject<{
@@ -752,15 +752,15 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         approvalCard: z.ZodOptional<z.ZodEnum<{
-            shell: "shell";
-            plan: "plan";
-            skill: "skill";
             question: "question";
+            fetch: "fetch";
             "file-edit": "file-edit";
             "file-write": "file-write";
             "notebook-edit": "notebook-edit";
-            fetch: "fetch";
+            shell: "shell";
+            skill: "skill";
             workflow: "workflow";
+            plan: "plan";
             generic: "generic";
             "computer-access": "computer-access";
             "computer-control": "computer-control";
@@ -768,10 +768,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
-                hook: "hook";
-                skill: "skill";
-                deployment: "deployment";
                 request: "request";
+                deployment: "deployment";
+                skill: "skill";
+                hook: "hook";
                 persisted: "persisted";
             }>;
             entries: z.ZodArray<z.ZodString>;
@@ -784,14 +784,14 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 name: "name";
                 path: "path";
                 host: "host";
+                tool: "tool";
+                pattern: "pattern";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
-                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
-                tool: "tool";
             }>;
             command: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
@@ -803,14 +803,14 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                     name: "name";
                     path: "path";
                     host: "host";
+                    tool: "tool";
+                    pattern: "pattern";
                     exact: "exact";
                     prefix: "prefix";
                     wildcard: "wildcard";
-                    pattern: "pattern";
                     subpath: "subpath";
                     name_prefix: "name_prefix";
                     subdomain: "subdomain";
-                    tool: "tool";
                 }>;
                 command: z.ZodString;
                 segment: z.ZodString;
@@ -870,8 +870,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceSessionId: z.ZodOptional<z.ZodString>;
         agentId: z.ZodOptional<z.ZodString>;
@@ -886,7 +886,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }>;
             words: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
-            by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+            by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
             words: z.ZodString;
         }, z.core.$strict>]>>>;
         delegation: z.ZodOptional<z.ZodObject<{

package/dist/approval-leg-origin.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 一条腿的**审批出处两格**:执行车道 + 这条腿的会话此刻的住客令牌(化身,`session-incarnation.ts`)。
+ *
+ * 两格都取自装配点手里**同一只**执行上下文(`http/execution-context.ts` 的 `ExecutionContext`:解析器步 ① 那一次行读的住客 + 由此定的车道)。三条提交腿
+ * (同步 · 后台 · 续跑)与 parked 赎回腿经 {@link approvalLegOriginOf} 一处读、一处展开进 `ToolApprovalRunContext` / `boundAsk` / `boundUnattendedAsk` /
+ * `approverSeatFor` 的身份 —— 出处的新格只在这一处加,不会有哪个装配点漏带。读者:协调器的「本会话放行」进程内表(`tool-approval.ts` `sessionAllowKey`),
+ * 键含 {@link ApprovalLegOrigin.incarnation} ⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+ *
+ * 叶模块(只有类型位的 import):装配点的各层模块都从这里取,不经协调器本体,不构成运行时环。
+ */
+import type { ExecutionLane } from "./execution-lane-caps.js";
+export interface ApprovalLegOrigin {
+    /**
+     * 这条腿的执行车道(必填:出处没有车道的问不可表示)—— 每只席的身份都从所在边界的执行上下文铸(`ctx.lane`)。铸入三句:新行 ⇒ 本出处的车道;
+     * 既有行命中 / 收养 ⇒ 行上的车道(派生只对新行有意义,既有行一律采信行上的);无问店的活登记 ⇒ 本出处的车道。
+     */
+    readonly executionLane: ExecutionLane;
+    /**
+     * 这条腿的会话(`sessionId`)此刻的**住客令牌**(化身,`session-incarnation.ts`)—— 装配点写所在边界执行上下文那一读的住客(`ctx.occupant.incarnation`,
+     * 与 {@link executionLane} 同一只上下文、同一次行读;不另读第二次)。出处带化身:「本会话放行」(协调器的进程内授权表)的键含它,读写两点都取这一格
+     * (与 `sessionId` 同源同理由随**出处**走,不取投递连接的)⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+     * 缺席 = 这条腿读不出这位住客(会话店不带执行席 / 腿没有会话):这条腿上**不读也不铸**进程内授权(点 `allow_session` 只放行这一次,回执 `rememberApplied:false`)。
+     */
+    readonly incarnation?: string;
+}
+/** 执行上下文 → 这条腿的出处两格({@link ApprovalLegOrigin})。形参只取两样(车道、住客),不依赖 http 层的类型。 */
+export declare function approvalLegOriginOf(execution: {
+    readonly lane: ExecutionLane;
+    readonly occupant?: {
+        readonly incarnation: string;
+    } | undefined;
+}): ApprovalLegOrigin;
+//# sourceMappingURL=approval-leg-origin.d.ts.map

package/dist/approval-leg-origin.js

@@ -0,0 +1,4 @@
+export function approvalLegOriginOf(execution) {
+    return { executionLane: execution.lane, ...(execution.occupant !== undefined ? { incarnation: execution.occupant.incarnation } : {}) };
+}
+//# sourceMappingURL=approval-leg-origin.js.map

package/dist/auth-bridge.d.ts

@@ -58,14 +58,22 @@ type ReportedOutcome = {
  * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
-/** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */
+/**
+ * The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache, and the issuer it verifies for.
+ * This is also the type of the injected seat (`ServiceDeps.webAdminJwtVerifier`): an embedder's verifier states which issuer it verifies, so `createHttpServer`
+ * can pair it with the config's bridge ("which issuer does this deployment accept" has one source — the config — and one comparison, at that seat).
+ */
 export interface WebAdminJwtVerifier {
+    /** The issuer this verifier verifies tokens for, in {@link normalizeBridgeIssuer} form (what the R4 `iss` check compares against). The factory mints it from its own option; the seat compares it with the config's reading. */
+    readonly issuer: string;
     verify: (bearer: string) => Promise<VerifyOutcome>;
 }
 /** 缓存键的常规刷新周期缺省(秒):过期后下一发在后台重拉,当前请求不等。 */
 export declare const DEFAULT_JWKS_TTL_SEC: number;
 /** 一次 JWKS 拉取的时限(毫秒):kid 未知、超离线宽限、后台刷新三条路用同一只拉取,同一个时限。 */
 export declare const JWKS_FETCH_TIMEOUT_MS = 10000;
+/** The one normal form of a bridge issuer: trailing slashes folded. The R4 `iss` check compares both sides in this form, and the `createHttpServer` pairing seat compares the verifier's {@link WebAdminJwtVerifier.issuer} with the config's reading in this same form (one reading, so the two can never disagree about what "the same issuer" means). */
+export declare const normalizeBridgeIssuer: (s: string) => string;
 /**
  * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为拒因闭集
  * {@link AuthBridgeRefusal}(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。

package/dist/auth-bridge.js

@@ -40,9 +40,9 @@ function b64urlJson(seg) {
         return undefined;
     }
 }
-const stripSlash = (s) => s.replace(/\/+$/, "");
+export const normalizeBridgeIssuer = (s) => s.replace(/\/+$/, "");
 export function createWebAdminJwtVerifier(opts) {
-    const issuer = stripSlash(opts.issuer);
+    const issuer = normalizeBridgeIssuer(opts.issuer);
     const displayIssuer = buildDisplaySafeUrl(issuer);
     const jwksUrl = opts.jwksUrl ?? `${issuer}${WEB_ADMIN_JWKS_PATH}`;
     const clockSkewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
@@ -122,7 +122,7 @@ export function createWebAdminJwtVerifier(opts) {
         const kid = typeof header.kid === "string" ? header.kid : undefined;
         if (!kid)
             return fail("malformed");
-        const iss = typeof payload.iss === "string" ? stripSlash(payload.iss) : undefined;
+        const iss = typeof payload.iss === "string" ? normalizeBridgeIssuer(payload.iss) : undefined;
         if (iss !== issuer)
             return fail("unknown_issuer", kid);
         if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
@@ -163,6 +163,6 @@ export function createWebAdminJwtVerifier(opts) {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: "ok" });
         return { ok: true, identity: { ...mapped.identity, scope: scoped.scope } };
     }
-    return { verify };
+    return { issuer, verify };
 }
 //# sourceMappingURL=auth-bridge.js.map

package/dist/auth-keys.d.ts

@@ -2,7 +2,8 @@
  * AUTH KEY-SET parsing ([ref] A4) — the env→key-set decoders for the two D-G credential planes, moved VERBATIM
  * out of security.ts: {@link parseApprovalHmacKeys} (APPROVAL_HMAC_KEYS — the rotating HMAC secret set, decision
  * INTEGRITY) and {@link parsePrincipalJwks} (PRINCIPAL_JWT_PUBKEYS — the rotating issuer public-key set, principal
- * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
+ * IDENTITY), plus {@link parseServiceAuthTokens} (SERVICE_AUTH_TOKENS — the per-system service token table). config.ts consumes
+ * these decoders + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
  * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([ref] 兼容面全清).
@@ -54,4 +55,12 @@ export interface PrincipalJwtKey {
  *  [ref]: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
  *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
 export declare function parsePrincipalJwks(raw: string | undefined, onReject: OnKeySetRejection): PrincipalJwtKey[];
+/**
+ * Parse SERVICE_AUTH_TOKENS — the per-system service credential table, `tok=system` pairs separated by commas (token →
+ * system name; the `source` of a run is derived from the token, never self-asserted). Each pair is trimmed and split at
+ * its FIRST `=` (a system name may hold `=`); a pair without `=`, or with an empty token or system, is not an entry.
+ * THE one reading: `loadConfig` builds `authTokens` from it, and the withheld table declares each token as a credential
+ * value of its own (`server-secret-env.ts`) — a copy of one token under another variable name is the same credential.
+ */
+export declare function parseServiceAuthTokens(raw: string | undefined): Record<string, string>;
 //# sourceMappingURL=auth-keys.d.ts.map

package/dist/auth-keys.js

@@ -63,4 +63,12 @@ export function parsePrincipalJwks(raw, onReject) {
     });
     return out;
 }
+export function parseServiceAuthTokens(raw) {
+    return Object.fromEntries((raw ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.includes("="))
+        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
+        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+}
 //# sourceMappingURL=auth-keys.js.map

package/dist/boot/execution-env.js

@@ -40,7 +40,7 @@ import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
-import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { settleReadDenyFloor } from "./execution-lane.js";
 import { seatText } from "../trace/exit-seat.js";
 import { countSessionResidentBackground } from "../session-resident-background.js";
 function boundedSessionSetter(map, maxEntries) {
@@ -384,22 +384,21 @@ export function createExecutionEnv(ctx) {
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
-                backgroundShell: config.requirePrincipal !== true,
+                backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config),
             };
-            executionEnvFactory = (ctx) => {
+            executionEnvFactory = hostExecutionEnvFactory(hostCfg, (ctx) => {
                 if (ctx.isolation === "worktree")
                     throw hostWorktreeUnwrappedRefusal();
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
-                const env = hostExecutionEnvFactory({
-                    ...hostCfg,
+                return {
                     ...(cwd ? { workspaceDir: cwd } : {}),
                     ...(shellEnv ? { env: shellEnv } : {}),
                     ...(inheritEnv !== undefined ? { inheritEnv } : {}),
-                })(ctx);
-                return lspManager && !cwd ? evictLspOnDestroy(env, lspManager) : env;
-            };
+                    ...(lspManager && !cwd ? { minted: (env) => void evictLspOnDestroy(env, lspManager) } : {}),
+                };
+            });
         }
     }
     else if (config.remoteExec.provider === "local-docker") {
@@ -441,14 +440,14 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true, gitBase: true });
+            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config), gitBase: true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
                 ...(config.worktreeIsolation.commit ? { commit: config.worktreeIsolation.commit } : {}),
                 baseEnvForGit: gitBaseEnv,
                 rootEnvAt: (dir) => {
-                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
+                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config) });
                     return lspManager ? evictLspOnDestroy(env, lspManager) : env;
                 },
                 logger,
@@ -501,7 +500,7 @@ export function createExecutionEnv(ctx) {
         if (config.remoteExec.provider === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
-    warnReadDenyFloorUnkept(config, logger);
+    settleReadDenyFloor(config, logger);
     const unreadableReported = new Set();
     let stallReapFailureReported = false;
     const stallMs = config.backgroundAgentStallMs;

package/dist/boot/execution-lane.d.ts

@@ -58,12 +58,14 @@ export declare function composeDeclaredExecutionLane(loaded: LoadedConfig, logge
  */
 export declare function settleHostLaneShell(config: Pick<ServiceConfig, "remoteExec">, logger: Pick<Logger, "info" | "warn">): Promise<void>;
 /**
- * **读地板的起服一行**:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
- * 起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`)。
+ * **读拒字节地板在本部署上怎么说** —— 两件事,一个入口:
+ *  ① 把部署的执行车道装给说法的属主(`read-deny-floor-notice.ts` 的 `installReadDenyFloorDeployment`):每条 run 的通告 / 结果格 / 拒句由它点名 `REMOTE_EXEC=<车道>`;
+ *  ② 起服一行:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
+ *     起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`,句子 = 每条 run 的拒句)。
  * 两个入口调同一只(与 {@link settleHostLaneShell} 同形):HTTP 服务在执行环境装配里(`boot/execution-env.ts`,有没有执行环境工厂都调),`run-local` 在宿主车道定下之后 ——
- * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先说。不要求 / 车道守地板 ⇒ 零动作。
+ * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先装、先说。不要求 / 车道守地板 ⇒ 不出那一行(装照装:车道名是每条 run 的说法要的)。
  */
-export declare function warnReadDenyFloorUnkept(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
+export declare function settleReadDenyFloor(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
 /**
  * 车道合成之后的跨域不变量 —— 表(`config-invariants.ts`)里读 `remoteExec.provider` 的那几条,boot 期 `live === next`。
  * 同步、纯判据:只读 config,不碰文件(测试可以对 `loadConfig()` 的产物直接调它)。

package/dist/boot/execution-lane.js

@@ -3,6 +3,7 @@ import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
 import { entryDeclarableRemoteExec } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 import { seatText } from "../trace/exit-seat.js";
@@ -70,7 +71,8 @@ export async function settleHostLaneShell(config, logger) {
         return;
     await settleHostShellAtBoot(logger);
 }
-export function warnReadDenyFloorUnkept(config, logger) {
+export function settleReadDenyFloor(config, logger) {
+    installReadDenyFloorDeployment(config);
     const note = buildReadDenyFloorUnkeptNote(config);
     if (note !== undefined)
         logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec.provider, note });

package/dist/boot/org-delivery.d.ts

@@ -9,7 +9,8 @@
  * 消费方取自**同一个** `RunnerDeps` 对象(`principalInboxConsumerOf(runnerDeps)`),不从 config 再读一遍(core 契约原句:
  * 「over the same RunnerDeps the deployment runs its legs with」)。
  */
-import { type MailboxStore, type OrgDeliveryGate, type RunnerDeps } from "@sema-agent/core";
+import { type MailboxStore, type RunnerDeps } from "@sema-agent/core";
+import { type ServerOrgDeliveryGate } from "../org-delivery-gate.js";
 import type { OrgMemoryDirectory } from "../org-memory-admission.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 import type { Logger } from "../observability/logger.js";
@@ -24,5 +25,5 @@ export interface OrgDeliveryMountInput {
     readonly logger: Pick<Logger, "info">;
 }
 /** 门在座 ⇒ 门;部署没声明消费方 ⇒ `undefined`;声明了而前提缺 ⇒ 抛(拒启)。 */
-export declare function mountOrgDeliveryGate(input: OrgDeliveryMountInput): OrgDeliveryGate | undefined;
+export declare function mountOrgDeliveryGate(input: OrgDeliveryMountInput): ServerOrgDeliveryGate | undefined;
 //# sourceMappingURL=org-delivery.d.ts.map

package/dist/boot/resolve-spec.js

@@ -17,7 +17,7 @@ import { createSettingsHooksRegistrations, settingsHooksBudgetMs } from "../hook
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, pickUserModel, refusedCatalogEntry, terminalCatalogName } from "../model-select.js";
-import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage } from "../model-entry-refusal.js";
+import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage, refusedNameLogField } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -205,7 +205,8 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness } };
+        const registeredCwd = perSessionCwd.get(root);
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, ...(registeredCwd !== undefined ? { registeredCwd } : {}) } };
     };
     const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
         const { parts: subjectParts, person } = identityAxesOf(auth);
@@ -302,6 +303,7 @@ export function createResolveSpec(ctx) {
                 logger,
                 sessionId: root,
                 cwd: perSessionCwd.get(root) ?? process.cwd(),
+                hookEnvAllow: config.hookEnvAllow,
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
                 httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 belowTaskChainPatterns,
@@ -336,7 +338,7 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested, name, refusal), { code: "request.model_unavailable" });
             }
             metrics.inc("task_model_unavailable_fallback_total");
-            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), name, code: refusal.code, source, fallback: picked.model, sessionId: root });
+            logger.warn("task_model_unavailable_fallback", { requested: echoModelRef(requested), ...refusedNameLogField("name", name), code: refusal.code, source, fallback: picked.model, sessionId: root });
         }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
@@ -516,7 +518,7 @@ export function createResolveSpec(ctx) {
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, peerDesk, opts.lease, logger, opts?.onNotice !== undefined ? { sessionId: root, emit: opts.onNotice } : undefined, storedToolAxes),
-            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
+            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",

package/dist/boot/runner-deps.js

@@ -9,6 +9,7 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { defaultEngineNoticeRouter, redactNoticeMessage, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
+import { presentEngineNotice } from "../read-deny-floor-notice.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
@@ -48,7 +49,8 @@ export const PROMPT_CACHE_BREAK_CAUSE_LEVEL = {
 const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUSE_LEVEL));
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
-    return (notice) => {
+    return (engineNotice) => {
+        const notice = presentEngineNotice(engineNotice);
         const detail = redactNoticeRuleText(notice.code, notice.detail);
         const message = redactNoticeMessage(notice.message);
         logger.warn("engine_notice", { code: notice.code, message, ...(detail !== undefined ? { detail } : {}) });

package/dist/boot/stage-01-config.d.ts

@@ -1,5 +1,6 @@
 export declare function runStage01(): {
     config: import("../config-types.js").LoadedConfig;
+    localAdmission: import("../plugins/local-data-root-admission.js").LocalDataRootAdmission | undefined;
     localRoot: string;
     logger: import("../observability/logger.js").Logger;
     metrics: import("../observability/metrics.js").Metrics;

package/dist/boot/stage-01-config.js

@@ -13,8 +13,9 @@ import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub
 import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
-import { provisionSemaConfigDir } from "../sema-config-dir.js";
 import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "../server-secret-env.js";
+import { admitLocalDataRoot } from "../plugins/local-data-root-admission.js";
+import { localBackendRootOf } from "../plugins/store-backend.js";
 import { installDefaultEngineNoticeSeat } from "./runner-deps.js";
 export function runStage01() {
     declareServerWithheldEnv();
@@ -62,7 +63,7 @@ export function runStage01() {
         else
             logger.info("run_failed", fields);
     });
-    provisionSemaConfigDir(config, logger);
+    const localAdmission = config.dbBackend === "local" ? admitLocalDataRoot(localBackendRootOf(config)) : undefined;
     const localRoot = configLocalRoot(config);
     const rootsSplit = splitLocalRoots({
         localDataRoot: config.localDataRoot,
@@ -77,6 +78,6 @@ export function runStage01() {
         });
     }
     installOutboundDispatcher(logger);
-    return { config, localRoot, logger, metrics };
+    return { config, localAdmission, localRoot, logger, metrics };
 }
 //# sourceMappingURL=stage-01-config.js.map

package/dist/boot/stage-02-web-admin-pull.d.ts

@@ -4,6 +4,7 @@ export declare function runStage02(ctx: Awaited<ReturnType<typeof runStage01>>):
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
     storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
+    localAdmission: import("../plugins/local-data-root-admission.js").LocalDataRootAdmission | undefined;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;