@sema-agent/server 7.148.0 → 7.150.0

package/dist/fleet/serving-lease.js

@@ -40,8 +40,9 @@ export function createServingLeaseClient(o) {
     const mono = o.clock?.mono ?? (() => performance.now());
     const epoch = o.clock?.epoch ?? Date.now;
     const stickyPath = o.dataRoot === undefined ? undefined : join(o.dataRoot, SERVING_LEASE_DENIED_FILE);
-    let capability;
-    const enabled = () => capability?.announced === true;
+    let fence = { kind: "presumed", since: mono() };
+    const enabled = () => fence.kind === "on";
+    let viewListener;
     let denied = false;
     let stopped = false;
     let lease;
@@ -49,6 +50,37 @@ export function createServingLeaseClient(o) {
     let timer;
     let inFlight;
     let failStreak = 0;
+    const view = () => {
+        if (denied)
+            return { state: "denied" };
+        if (fence.kind === "off")
+            return { state: "none" };
+        const now = mono();
+        if (lease !== undefined && now < lease.expiresAtMono)
+            return { state: "granted", leaseUntil: lease.leaseUntil };
+        return { state: "expired", pastOutageMax: now - (lease?.expiresAtMono ?? fence.since) >= o.outageMaxMs };
+    };
+    const changing = (change) => {
+        const before = view().state;
+        change();
+        if (view().state !== before)
+            viewListener?.();
+    };
+    const unconfirmed = (why) => {
+        recordFailOpen("server.fleet.serving-lease-unconfirmed", `worker=${o.center.worker} generation=${o.generation} why=${why}`);
+        failStreak += 1;
+        if (failStreak === 1) {
+            o.logger?.warn("fleet_serving_lease_unconfirmed", {
+                error: why,
+                note: "the fleet center has not confirmed this instance's serving lease (heartbeat or renewal unanswered, refused or unreadable, or the verdict was unknown) — this instance keeps serving until its last grant, or with no grant yet the moment the fence took effect (this process's start, for a member that has not heard the center), is FLEET_LEASE_OUTAGE_MAX_MS behind, then refuses new work (unconfirmed is never a denial)",
+            });
+        }
+    };
+    const confirmed = (by) => {
+        if (failStreak > 0)
+            o.logger?.info("fleet_serving_lease_recovered", { after: failStreak, by });
+        failStreak = 0;
+    };
     const clear = () => {
         if (timer !== undefined)
             clearTimeout(timer);
@@ -79,6 +111,9 @@ export function createServingLeaseClient(o) {
     const enterDenied = (denial) => {
         if (denied)
             return;
+        changing(() => enterDeniedNow(denial));
+    };
+    const enterDeniedNow = (denial) => {
         denied = true;
         lease = undefined;
         clear();
@@ -118,25 +153,22 @@ export function createServingLeaseClient(o) {
             why = err instanceof Error ? err.message : String(err);
         }
         if (reading === undefined || reading.verdict === "unknown") {
-            const unconfirmed = reading === undefined ? why : "verdict=unknown (the center holds no lifecycle object for this instance right now)";
-            recordFailOpen("server.fleet.serving-lease-unconfirmed", `worker=${o.center.worker} generation=${o.generation} why=${unconfirmed}`);
-            failStreak += 1;
-            if (failStreak === 1)
-                o.logger?.warn("fleet_serving_lease_unconfirmed", { error: unconfirmed, note: "the serving lease could not be renewed (the center is unreachable or did not confirm this instance) — this instance keeps serving until the lease expires and then for FLEET_LEASE_OUTAGE_MAX_MS more before it refuses new work (unconfirmed is never a denial)" });
+            if (fence.kind === "on")
+                unconfirmed(reading === undefined ? why : "verdict=unknown (the center holds no lifecycle object for this instance right now)");
             schedule(nextInMs);
             return;
         }
-        if (failStreak > 0)
-            o.logger?.info("fleet_serving_lease_recovered", { after: failStreak });
-        failStreak = 0;
+        confirmed("verdict");
         switch (reading.verdict) {
-            case "granted":
+            case "granted": {
                 if (denied)
                     return;
-                lease = { expiresAtMono: sendMono + reading.ttlMs, leaseUntil: sendEpoch + reading.ttlMs };
+                const granted = { expiresAtMono: sendMono + reading.ttlMs, leaseUntil: sendEpoch + reading.ttlMs };
+                changing(() => (lease = granted));
                 nextInMs = reading.ttlMs / 3;
                 schedule(nextInMs);
                 return;
+            }
             case "denied":
                 enterDenied({ from: "center", reason: reading.reason });
                 return;
@@ -154,34 +186,48 @@ export function createServingLeaseClient(o) {
         });
         return inFlight;
     };
+    const noteDeclaration = (caps) => {
+        const on = caps.servingLease === true;
+        if (!on)
+            recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${fence.kind}`);
+        if (on && fence.kind !== "on") {
+            fence = { kind: "on", since: fence.since ?? mono() };
+            o.logger?.info("fleet_serving_lease_enabled", { generation: o.generation, worker: o.center.worker });
+            void renewNow();
+        }
+        else if (!on && fence.kind !== "off") {
+            const was = fence.kind;
+            fence = { kind: "off", since: was === "on" ? fence.since : undefined };
+            clear();
+            confirmed("not-enforced");
+            if (was === "on")
+                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again; its outage clock is not reset (when the capability returns, the last grant and the moment the fence first took effect in this process still count)" });
+        }
+    };
     return {
-        noteCenterCapabilities(caps) {
+        noteHeartbeat(hearing) {
             if (stopped || denied)
                 return;
-            const on = caps?.servingLease === true;
-            if (!on)
-                recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${enabled() ? "enabled" : "none"}`);
-            if (on && !enabled()) {
-                capability = { announced: true, firstSeenAtMono: capability?.firstSeenAtMono ?? mono() };
-                o.logger?.info("fleet_serving_lease_enabled", { generation: o.generation, worker: o.center.worker });
-                void renewNow();
-            }
-            else if (!on && capability?.announced === true) {
-                capability = { announced: false, firstSeenAtMono: capability.firstSeenAtMono };
-                clear();
-                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again; its outage clock is not reset (when the capability returns, the last grant and this process's first sighting of the capability still count)" });
+            switch (hearing.kind) {
+                case "silent":
+                    if (fence.kind === "presumed")
+                        unconfirmed(`heartbeat:${hearing.why}`);
+                    return;
+                case "reading":
+                    if (fence.kind === "presumed")
+                        changing(() => noteDeclaration(hearing.capabilities));
+                    else
+                        noteDeclaration(hearing.capabilities);
+                    return;
+                default: {
+                    const unhandled = hearing;
+                    throw new Error(`serving lease: unknown heartbeat hearing ${JSON.stringify(unhandled)}`);
+                }
             }
         },
-        view() {
-            if (denied)
-                return { state: "denied" };
-            if (capability === undefined || !capability.announced)
-                return { state: "none" };
-            const now = mono();
-            if (lease !== undefined && now < lease.expiresAtMono)
-                return { state: "granted", leaseUntil: lease.leaseUntil };
-            const expiredAt = lease?.expiresAtMono ?? capability.firstSeenAtMono;
-            return { state: "expired", pastOutageMax: now - expiredAt >= o.outageMaxMs };
+        view,
+        onViewChange(listener) {
+            viewListener = listener;
         },
         resumeStickyDenial() {
             if (stickyPath === undefined || denied)

package/dist/fleet-client.d.ts

@@ -18,9 +18,10 @@
  *  - **`modelRefusals?`([ref])**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
  *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
  *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
- *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`
- *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
+ *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因 / 报租约态,比任何观测都快):draining 翻转由收尾链直调
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`;租约态由事件引起的
+ *    翻转(推定的终结 / 续租判决 / 被拒 —— 不自激的那几样,见 `fleet/serving-lease.ts` 规则 2′)由装配层把服务租约客户端的 `onViewChange` 接到
+ *    `announceNow`(三处 = 三类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
  *    (worker,instanceId,windowStartMs) 重发安全;**发送失败 → merge 回累计器**,并入下一窗(失败窗从未入账,
@@ -30,8 +31,9 @@
  *    不在下一个人的凭证下上报(不记到别人头上);它留在原箱,那个身份回来时照常报出去,收尾时还压着就响亮一行。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type CapabilityReading, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
+import type { HeartbeatHearing } from "./fleet/serving-lease.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type CenterCredentialSource } from "./center-credential.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
@@ -118,10 +120,10 @@ export interface FleetClientOpts {
     /** [ref]:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */
     modelRefusals: () => ModelRefusalsSignal | undefined;
-    /** 编排器片 2:每一次**能力读数**交出去一次(装配层接服务租约客户端的 `noteCenterCapabilities`)。规则见 {@link capabilityReadingOf}:
-     *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
-     *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
-    onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
+    /** 编排器片 2:**每一次公告尝试恰好交一只**听到的东西(装配层接服务租约客户端的 `noteHeartbeat`;只有 fleet 成员接)。`reading` = 中心的显式
+     *  声明(规则见 {@link capabilityReadingOf});其余一律 `silent`(`why` 闭集:`HTTP <状态>` / 请求抛出的那句 / `reply-unreadable:<因>` /
+     *  `not-sent:<那句>`)—— 没听到不是「没有」,租约客户端按沉默处置。没接这一只 ⇒ 不读答复体(非成员的心跳答复不进任何租约臂)。 */
+    onHeartbeat?: (hearing: HeartbeatHearing) => void;
     /** [ref]:按凭证身份分箱的用量账(缺席 = 用量环不装)。 */
     usage?: FleetUsageBins;
     heartbeatMs?: number;
@@ -149,13 +151,13 @@ export interface FleetClient {
     flushFinalUsage: () => Promise<void>;
 }
 /**
- * 心跳 2xx 答复读不成能力读数的原因 —— 一张闭集:`body` = 答复体本身读不出(空体 / 截断 / 非 JSON),其余两词 = 契约读器
- * `readCapabilityReading` 的 `unreadable` 两因(`not-an-object` / `invalid-capabilities`)。
+ * 心跳 2xx 答复读不成能力读数的原因 —— 一张闭集:`body` = 答复体本身读不出(空体 / 截断 / 非 JSON),其余三词 = 契约读器
+ * `readCapabilityReading` 的 `unreadable` 三因(`not-an-object` / `capabilities-absent` / `invalid-capabilities`)。
  */
 export type AnnounceReplyFlaw = "body" | Extract<CapabilityReading, {
     kind: "unreadable";
 }>["why"];
-/** 本仓对一次心跳答复的读法:契约三态,`unreadable` 的原因扩成 {@link AnnounceReplyFlaw}(`detail` = 读不出体时的那句错误,当数据交出)。 */
+/** 本仓对一次心跳答复的读法:契约两态,`unreadable` 的原因扩成 {@link AnnounceReplyFlaw}(`detail` = 读不出体时的那句错误,当数据交出)。 */
 export type AnnounceReplyReading = Exclude<CapabilityReading, {
     kind: "unreadable";
 }> | {

package/dist/fleet-client.js

@@ -110,9 +110,40 @@ export function startFleetClient(opts) {
     let failStreak = 0;
     let unreadableStreak = 0;
     const address = opts.advertiseAddress;
+    const announceFailed = (error) => {
+        failStreak += 1;
+        if (failStreak === 1)
+            opts.logger?.warn("fleet_announce_failed", { error });
+    };
+    const hearReply = async (res, leaseState) => {
+        const reading = await capabilityReadingOf(res);
+        switch (reading.kind) {
+            case "declared":
+                unreadableStreak = 0;
+                return { kind: "reading", capabilities: reading.capabilities };
+            case "unreadable":
+                recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${leaseState}`);
+                unreadableStreak += 1;
+                if (unreadableStreak === 1) {
+                    opts.logger?.warn("fleet_announce_reply_unreadable", {
+                        status: res.status,
+                        why: reading.why,
+                        ...(reading.detail !== undefined ? { error: reading.detail } : {}),
+                        note: "the fleet center's heartbeat reply is not a capability declaration (unreadable body, not an object, no capabilities key, or a malformed capabilities value) — no reading taken; the serving lease keeps its state and outage clock (a member that has heard no declaration stays inside the presumed fence)",
+                    });
+                }
+                return { kind: "silent", why: `reply-unreadable:${reading.why}` };
+            default: {
+                const unhandled = reading;
+                throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
+            }
+        }
+    };
     const announceOnce = async () => {
         if (stopped || address === undefined)
             return;
+        let hearing;
+        let sending = false;
         try {
             const signal = opts.signal();
             const engineSignal = buildEngineSignal(signal);
@@ -129,43 +160,32 @@ export function startFleetClient(opts) {
                 ...fleetMembershipKeys(signal),
                 [ENGINE_SIGNAL_KEY]: engineSignal,
             };
+            sending = true;
             const { res } = await send("fleet-instances", "POST", body);
-            if (!res.ok)
-                throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
-            if (opts.onCenterCapabilities !== undefined) {
-                const reading = await capabilityReadingOf(res);
-                switch (reading.kind) {
-                    case "declared":
-                    case "undeclared":
-                        unreadableStreak = 0;
-                        opts.onCenterCapabilities(reading.kind === "declared" ? reading.capabilities : undefined);
-                        break;
-                    case "unreadable":
-                        recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${signal.lease.state}`);
-                        unreadableStreak += 1;
-                        if (unreadableStreak === 1) {
-                            opts.logger?.warn("fleet_announce_reply_unreadable", {
-                                status: res.status,
-                                why: reading.why,
-                                ...(reading.detail !== undefined ? { error: reading.detail } : {}),
-                                note: "the fleet center's heartbeat reply is not a capability reading (unreadable body, not an object, or a malformed capabilities value) — no reading taken; the last one stands (the serving lease keeps its state and outage clock)",
-                            });
-                        }
-                        break;
-                    default: {
-                        const unhandled = reading;
-                        throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
-                    }
-                }
+            if (!res.ok) {
+                hearing = { kind: "silent", why: `HTTP ${res.status}` };
+                announceFailed(`announce ${res.status}${await rejectionSnippet(res)}`);
             }
-            if (failStreak > 0)
-                opts.logger?.info("fleet_announce_recovered", { after: failStreak });
-            failStreak = 0;
+            else {
+                if (failStreak > 0)
+                    opts.logger?.info("fleet_announce_recovered", { after: failStreak });
+                failStreak = 0;
+                if (opts.onHeartbeat !== undefined)
+                    hearing = await hearReply(res, signal.lease.state);
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : String(err);
+            hearing = { kind: "silent", why: sending ? error : `not-sent:${error}` };
+            announceFailed(error);
+        }
+        if (hearing === undefined || opts.onHeartbeat === undefined)
+            return;
+        try {
+            opts.onHeartbeat(hearing);
         }
         catch (err) {
-            failStreak += 1;
-            if (failStreak === 1)
-                opts.logger?.warn("fleet_announce_failed", { error: err instanceof Error ? err.message : String(err) });
+            opts.logger?.warn("fleet_heartbeat_listener_failed", { error: err instanceof Error ? err.message : String(err), note: "the serving-lease client threw while taking this heartbeat's hearing — this beat did not reach the fence; the announce loop goes on" });
         }
     };
     let inFlight;

package/dist/history-anchor.js

@@ -10,7 +10,7 @@ async function unknownAnchorCause(readers, reader, sessionId, handle) {
     if (reader === undefined)
         return NO_ANCHOR;
     try {
-        const run = await readVisibleRun(reader, readers.runs, handle);
+        const run = (await readVisibleRun(reader, readers.runs, handle))?.row;
         if (run === undefined || run.sessionId !== sessionId)
             return NO_ANCHOR;
         return (await readers.anchors.resolve(sessionId, handle, run.owner)) === undefined ? PROMPT_WITHOUT_ANCHOR : NO_ANCHOR;

package/dist/hitl-delivery.d.ts

@@ -29,7 +29,7 @@ export interface HitlSinks {
     readonly live?: boolean;
 }
 /**
- * 一条腿的传输(无状态)。`deliver` 与 `reachable` 是**属性**(不是方法签名)—— 帧型参数因此逆变。腿上装出的那一只是全族型(`HitlTransport<HitlFrame>`,
+ * 一条腿的传输(无状态)。`deliver` 是**属性**(不是方法签名)—— 帧型参数因此逆变。腿上装出的那一只是全族型(`HitlTransport<HitlFrame>`,
  * 一腿一只、三族共用);**窄化发生在装进族上下文那一步**:审批上下文的判别联合把传输型钉到本族帧(呈卡族收不进旧族帧),竞速机的目标从族上下文取
  * ⇒ 混族的 (transport, frame) 对编译不过。直接拿全族型传输喂竞速机的代码不受这道型约束(三只协调器都从族上下文取,`P14` 编译期钉)。
  */
@@ -39,8 +39,6 @@ export interface HitlTransport<F extends HitlFrame> {
      * 写抛 / 已死 ⇒ 直写没接下(不碰死连接)。③ 交回每只涉及的 sink 接下与否。**永不 reject。**
      */
     readonly deliver: (frame: F, onto?: HitlSinks) => Promise<HitlSinks>;
-    /** 判决面谓词:有直写 ⇒ 直写此刻活着;只有账本 ⇒ 恒真(账本 tail 随时可被接上)。谓词读不出 ⇒ 假(判决面 fail-closed 到停驻)。 */
-    readonly reachable: () => boolean;
 }
 /** 直写面:一个具名帧写 + 「此刻还活着吗」。 */
 export interface HitlLiveSink<F extends HitlFrame> {

package/dist/hitl-delivery.js

@@ -66,7 +66,7 @@ export function createHitlTransport(sinks) {
         }
         return ledgerAccepted !== undefined ? { ledger: ledgerAccepted, live: liveAccepted } : { live: liveAccepted };
     };
-    return { deliver, reachable: () => live === undefined || liveAlive(live) };
+    return { deliver };
 }
 export function createHitlOpenRace(args) {
     const opens = args.targets.map((t) => t.transport.deliver(t.frame));

package/dist/hooks/command-spawn.d.ts

@@ -46,9 +46,14 @@ export type CommandSpawnPlan = {
 export declare function composeHookEnvLayer(requestEnv: Readonly<Record<string, string>> | undefined, cwd: string, plugin: HookPluginContext | undefined): Record<string, string> & {
     CLAUDE_PROJECT_DIR: string;
 };
+/**
+ * 这条 hook 的子进程会拿到的环境:有效环境层叠在继承那一半之上(组合属主 = `hook-runner.ts` 的 `hookChildEnv`,本模块不写第二份组合,只问它的读数)。
+ * 组合拒(授予形坏 / 放回点到本服务自有凭据名)⇒ 抛,起法按「起不来」答(与 spawn 时组合抛同一个结局)。
+ */
+export type HookChildEnvOf = (layer: Readonly<Record<string, string>>) => Readonly<Record<string, string | undefined>>;
 /**
  * 一条 command 条目的起法(规则见文件头)。`cwd` = 本次 hook 的工作目录(`CLAUDE_PROJECT_DIR` 的缺省值);`requestEnv` = 请求 `settings.env`(hook 环境的一层;**必传**:没有就显式传 `undefined`,
- * 漏传是编译红,不会静默丢掉请求给的 env),合并与读法见 {@link composeHookEnvLayer} / {@link contextVarValue}。有副作用的只有两步,都只在条目带 `plugin` 时发生:读插件根是否是目录、建数据目录(CC 同:注入即建)。
+ * 漏传是编译红,不会静默丢掉请求给的 env),合并与读法见 {@link composeHookEnvLayer} / {@link contextVarValue};`childEnvOf` = 组合的读数入口({@link HookChildEnvOf})。有副作用的只有两步,都只在条目带 `plugin` 时发生:读插件根是否是目录、建数据目录(CC 同:注入即建)。
  */
-export declare function planCommandSpawn(entry: RunnableCommandHookEntry, cwd: string, requestEnv: Readonly<Record<string, string>> | undefined): Promise<CommandSpawnPlan>;
+export declare function planCommandSpawn(entry: RunnableCommandHookEntry, cwd: string, requestEnv: Readonly<Record<string, string>> | undefined, childEnvOf: HookChildEnvOf): Promise<CommandSpawnPlan>;
 //# sourceMappingURL=command-spawn.d.ts.map

package/dist/hooks/command-spawn.js

@@ -59,17 +59,24 @@ const refOf = (name) => "${" + name + "}";
 export function composeHookEnvLayer(requestEnv, cwd, plugin) {
     return { ...requestEnv, CLAUDE_PROJECT_DIR: requestEnv?.CLAUDE_PROJECT_DIR ?? cwd, ...hookPluginEnv(plugin) };
 }
-function contextVarValue(name, layer) {
-    const v = layer[name];
+function contextVarValue(name, env) {
+    const v = env[name];
     return v !== undefined && v.length > 0 ? v : undefined;
 }
-export async function planCommandSpawn(entry, cwd, requestEnv) {
+export async function planCommandSpawn(entry, cwd, requestEnv, childEnvOf) {
     const texts = [entry.command, ...(entry.args ?? [])];
     const p = entry.plugin;
     const env = composeHookEnvLayer(requestEnv, cwd, p);
+    let seen;
+    try {
+        seen = childEnvOf(env);
+    }
+    catch (e) {
+        return { kind: "refused", error: e instanceof Error ? e.message : String(e) };
+    }
     const values = new Map([["CLAUDE_PROJECT_DIR", env.CLAUDE_PROJECT_DIR]]);
     for (const [name, ref] of CONTEXT_VARS) {
-        const value = contextVarValue(name, env);
+        const value = contextVarValue(name, seen);
         if (value !== undefined) {
             values.set(name, value);
             continue;
@@ -79,8 +86,8 @@ export async function planCommandSpawn(entry, cwd, requestEnv) {
         return {
             kind: "refused",
             error: p !== undefined
-                ? `hook command references ${ref} but only ${ROOT_REF} is available for this hook (it carries no plugin data directory and the request settings.env does not set ${name})`
-                : `hook command references ${ref} but the hook is not associated with a plugin and the request settings.env does not set ${name} (the variable is only available to hooks that carry a plugin context, or to a request that sets it in settings.env)`,
+                ? `hook command references ${ref} but only ${ROOT_REF} is available for this hook (it carries no plugin data directory and the hook environment does not set ${name}; a request can set it in settings.env)`
+                : `hook command references ${ref} but the hook is not associated with a plugin and the hook environment does not set ${name} (the variable is set for hooks that carry a plugin context; a request can set it in settings.env)`,
         };
     }
     if (p !== undefined) {

package/dist/hooks/hook-runner.d.ts

@@ -533,6 +533,11 @@ export interface HookRunnerContext {
      * `[]` = 没有层写名单(不限,与引擎外的参照实现「名单未设 ⇒ 不限」同读)。今天唯一的层来源是请求的 `settings`(`task-settings.ts` 的 `httpHookAllowlist`,源 `flagSettings`)。
      */
     httpHookAllowlistLayers: readonly HttpHookAllowlistLayer[];
+    /**
+     * 部署方点名放回 hook 环境的服务进程变量名(`HOOK_ENV_ALLOW` 的生效名单,`config.hookEnvAllow`;读者 = {@link hookChildEnv} 的两个入口:命令腿 spawn 与 http 插值)。必填:每个装配点都要说 ——
+     * `[]` = 不放回(hook 环境 = 十二名基础名单 + 有效环境层)。这是服务进程变量进 hook 环境的**唯一**来源;请求层(条目 `allowedEnvVars`、`settings.httpHookAllowedEnvVars`)只收窄、不授予。
+     */
+    hookEnvAllow: readonly string[];
     /**
      * 部署座在**任务座之下**挂了链成员的站点式样(引擎的准入记录读出,`boot/deployment-mods.ts` 的 `belowTaskChainPatternsOf`)。必填:每个装配点都要说 ——
      * `[]` = 任务座之下没有部署座的链成员(部署注册只在任务座之上、只有观察者,或没有部署注册)。读者 = PreToolUse 翻译的只许收紧({@link chainsBelowTaskOn};请求钩子两条车道在这些站上只许收紧)。

package/dist/hooks/hook-runner.js

@@ -36,12 +36,15 @@ const MIN_HOOK_CONTEXT_PARTIAL_CHARS = 256;
 const MAX_TOOL_RESPONSE_CHARS = 32_768;
 const MAX_TOOL_INPUT_CHARS = 262_144;
 const HOOK_ENV_ALLOWLIST = ["PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ", "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR"];
-function hookChildEnv(layer, spawning) {
-    const o = { policy: [...HOOK_ENV_ALLOWLIST], allow: [], grants: [layer] };
+function hookChildEnv(layer, putBack, spawning) {
+    const o = { policy: [...HOOK_ENV_ALLOWLIST], allow: putBack, grants: [layer] };
     return spawning ? hostSubprocessEnv({ site: "server.hooks.spawn-env", ...o }) : composeHostSubprocessEnv(o);
 }
+function hookChildView(ctx) {
+    return (layer) => hookChildEnv(layer, ctx.hookEnvAllow, false);
+}
 function hookEnv(ctx) {
-    return hookChildEnv(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
+    return hookChildView(ctx)(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined));
 }
 export const SETTINGS_HOOK_STATIONS = {
     PreToolUse: "classic.PreToolUse",
@@ -861,7 +864,7 @@ function readBelowPreToolUse(below) {
     };
 }
 function spawnPlannedCommand(plan, ctx, stdio) {
-    const env = hookChildEnv(plan.env, true);
+    const env = hookChildEnv(plan.env, ctx.hookEnvAllow, true);
     if (plan.kind === "exec")
         return spawn(plan.file, [...plan.args], { cwd: ctx.cwd, env, stdio, detached: true });
     const sh = hostShell();
@@ -926,7 +929,7 @@ function createHookTreeLadder(child, ctx, event) {
     };
 }
 async function runCommandHook(entry, payload, ctx, halt, event) {
-    const plan = await planCommandSpawn(entry, ctx.cwd, ctx.shellEnv);
+    const plan = await planCommandSpawn(entry, ctx.cwd, ctx.shellEnv, hookChildView(ctx));
     if (plan.kind === "refused")
         return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: plan.error };
     if (plan.kind === "shell") {
@@ -1011,7 +1014,7 @@ async function fireAsyncCommandHook(entry, payload, ctx, event, halt) {
     try {
         const rewake = entry.asyncRewake === true;
         const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
-        const plan = await planCommandSpawn(entry, ctx.cwd, ctx.shellEnv);
+        const plan = await planCommandSpawn(entry, ctx.cwd, ctx.shellEnv, hookChildView(ctx));
         if (plan.kind === "refused")
             throw new Error(plan.error);
         if (plan.kind === "shell")
@@ -1740,7 +1743,8 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
                                 asked = alsoAsks(lane, prior.asked ?? prior.unreadable?.message, clipDataText(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS));
                                 spoke = true;
                             }
-                            if (decision === "allow" || decision === undefined) {
+                            const counted = decision === "allow" || decision === "ask" || decision === undefined;
+                            if (counted) {
                                 if (ran.distrust !== undefined && hookLaneOf(ran.source) === "unmanaged" && (decision === "allow" || proposesRewrite)) {
                                     noteVerdictUntrusted(ctx, { event: "PreToolUse", reason: ran.distrust, entry, source: ran.source, toolName });
                                 }

package/dist/http/active-run-conflict.d.ts

@@ -15,7 +15,7 @@
  */
 import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
-import { type RunRecord } from "../plugins/store-contracts.js";
+import type { RunStore } from "../plugins/store-backend.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-face.js";
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
@@ -113,12 +113,8 @@ interface ConflictProbeDeps<TToken> {
     /** 结构形入参,但 `status` 取 run 行的**闭词表**(合并码重扫):判 park 要走词表属主
      *  `isParkedRunStatus`,而它的入参是穷举联合 —— 这一格写成开放 `string` 就只能在调用点裸 cast,
      *  绕开那道编译期执法(core 加一个 park 类成员时本文件不会红)。 */
-    /** 持有者那一行(只读 `status`;409 体只点名**活着**的持有者 —— 心跳过期的持有者在认领冲突处已被判死、认领已放,见 run 店 `createRun`)。 */
-    runStore?: {
-        getRun?: (id: string) => Promise<{
-            status?: RunRecord["status"];
-        } | null | undefined>;
-    } | undefined;
+    /** 持有者那一行的状态(不带属主的一格事实,经属主存取器 `runFactsOf` 读;409 体只点名**活着**的持有者 —— 心跳过期的持有者在认领冲突处已被判死、认领已放,见 run 店 `createRun`)。 */
+    runStore?: Pick<RunStore, "getRun"> | undefined;
     checkpointStore?: {
         peekPendingScope?: (sessionId: string, binding?: PendingRowBinding) => Promise<string | null | undefined>;
         findPendingTokenBySession?: (sessionId: string, scope?: string, binding?: PendingRowBinding) => Promise<TToken | null | undefined>;

package/dist/http/active-run-conflict.js

@@ -1,5 +1,6 @@
 import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
+import { runFactsOf } from "./owner-access.js";
 import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-face.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { refusalBody } from "./refusal-body.js";
@@ -46,8 +47,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
     if (!activeTaskId)
         return base;
     try {
-        const row = await deps.runStore?.getRun?.(activeTaskId);
-        const status = row?.status;
+        const status = deps.runStore === undefined ? undefined : (await runFactsOf(deps.runStore, activeTaskId))?.status;
         if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {

package/dist/http/admission.js

@@ -2,7 +2,7 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, appendFold, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
@@ -25,7 +25,7 @@ import { legFactsOf } from "../leg-facts.js";
 import { createSubmissionSeat } from "../submission-exit.js";
 import { assertRequestFormBeforeMint } from "../request-form.js";
 import { headerStr } from "./principal-gate.js";
-import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
+import { SUBMISSION_CLAIM_FACE, resolveBeforeClaim, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { promptScreenDeclared } from "../prompt-screen.js";
@@ -214,7 +214,7 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`, limitFacts("settings.outputStyle", "characters", st.outputStyle.length, MAX_SETTINGS_OUTPUT_STYLE_CHARS));
                 return null;
             }
-            const foldedChars = typeof st.outputStyle === "string" && st.outputStyle.length > 0 && typeof body.appendSystemPrompt === "string" ? body.appendSystemPrompt.length + 2 + st.outputStyle.length : 0;
+            const foldedChars = typeof st.outputStyle === "string" && st.outputStyle.length > 0 && typeof body.appendSystemPrompt === "string" ? appendFold([body.appendSystemPrompt, st.outputStyle]).chars : 0;
             if (foldedChars > MAX_SYSTEM_PROMPT_CHARS) {
                 sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`, fieldConflictFacts("system_prompt_fold", ["appendSystemPrompt", "settings.outputStyle"], { count: foldedChars, cap: MAX_SYSTEM_PROMPT_CHARS }));
                 return null;
@@ -749,12 +749,12 @@ export function createAdmission(ctx) {
         const seat = createSubmissionSeat({ deployment: deps.config, metrics: deps.metrics, dropSessionScopedOf: deps.dropSessionScopedOf, sessionWatch: deps.sessionWatch });
         try {
             const auth = await deps.authorize({ req, body: admitted, onBirth: (birth, face) => seat.noteBirth(birth, face) });
-            const execution = await resolveExecutionContext(deps, { kind: "fresh", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)), judged: auth.head, req, deviceId: admitted.deviceId });
+            const execution = await resolveBeforeClaim(deps, { kind: "fresh", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)), judged: auth.head, req, deviceId: admitted.deviceId }, SUBMISSION_CLAIM_FACE);
             const engineNotices = [];
             const resolved = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legRoute?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease, execution });
             const facts = legFactsOf(resolved);
             const runner = runnerFor(resolved);
-            const spec = stampSpecRoot(resolved, execution, admitted);
+            const spec = stampSpecRoot(resolved, execution, cascade ? { use: "ladder_host" } : { use: "session", requireExistingSession: admitted.requireExistingSession });
             const model = modelIdOf(spec.model);
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, screened: promptScreenDeclared([deps.deploymentMods, spec.mods]), ...(model !== undefined ? { model } : {}) });
             seat.attachAcceptance(acceptance);