@sema-agent/server 7.148.0 → 7.150.0

package/dist/leader/endpoint.js

@@ -6,6 +6,7 @@ import { idemKeyOf } from "../http/idempotency.js";
 import { refusalBody } from "../http/refusal-body.js";
 import { LIVENESS_HEARTBEAT_MS } from "../config-invariants.js";
 import { seatText } from "../trace/exit-seat.js";
+import { readVisibleLeaderRow } from "../http/owner-access.js";
 function statusForLeaderResult(result) {
     if (result.conflict)
         return "needs_human";
@@ -62,7 +63,7 @@ export function createLeaderEndpoint(runLeader, opts) {
             ? setInterval(() => {
                 if (ac.signal.aborted)
                     return;
-                void readRow(id).then((row) => {
+                void readDrivenRow(id).then((row) => {
                     if (row === undefined || row.status !== "running")
                         abortLocal(id, "stall_verdict");
                     else if (row.cancelRequested)
@@ -139,13 +140,13 @@ export function createLeaderEndpoint(runLeader, opts) {
             }
         })();
     }
-    function readRow(id) {
+    function readDrivenRow(id) {
         return opts.store.getRun(id);
     }
     const opErr = (e) => seatText("operator-log-error", e instanceof Error ? e.message : String(e));
     async function cancelFlagAfterSettle(id) {
         try {
-            return (await readRow(id))?.cancelRequested === true;
+            return (await readDrivenRow(id))?.cancelRequested === true;
         }
         catch (e) {
             opts.logger?.error?.("leader_cancel_flag_reread_failed", { id, err: opErr(e), effect: "if a cancel landed on this run just before its terminal write, its worker parks are expired only when the cancel is re-sent" });
@@ -305,8 +306,8 @@ export function createLeaderEndpoint(runLeader, opts) {
         if (m) {
             const id = m[1];
             if (opts.store) {
-                const run = await readRow(id);
-                if (!run || !ownerOk(run.owner))
+                const run = await readVisibleLeaderRow(opts.store, id, ownerOk);
+                if (!run)
                     return NOT_FOUND;
                 return getBody(run);
             }
@@ -327,15 +328,15 @@ export function createLeaderEndpoint(runLeader, opts) {
     }
     async function cancel(id, ownerOk) {
         if (opts.store) {
-            const row = await readRow(id);
-            if (!row || !ownerOk(row.owner))
+            const row = await readVisibleLeaderRow(opts.store, id, ownerOk);
+            if (!row)
                 return NOT_FOUND;
             if (row.status === "running") {
                 if (await opts.store.requestCancel(id)) {
                     abortLocal(id, "cancel_verb");
                     return { status: 202, body: { leaderRunId: id, status: "cancelling", cancelRequested: true } };
                 }
-                const now = await readRow(id);
+                const now = await readVisibleLeaderRow(opts.store, id, ownerOk);
                 if (!now)
                     return NOT_FOUND;
                 return answerTerminal(id, now);

package/dist/leg-facts.d.ts

@@ -1,7 +1,7 @@
 /**
- * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证)—— server 自有的载体,**不搭引擎 spec 的车**。
+ * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证 · 登记的工作目录 · 继承的项目上下文)—— server 自有的载体,**不搭引擎 spec 的车**。
  *
- * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出三件
+ * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出五件
  * 只有 server 自己读的事实 —— 它们以装配器**自己的输出对象**为键登记在这一张表里(单一铸点 {@link mintLegFacts}),由两只漏斗
  * (受理 `http/admission.ts` 的 `prepareSpec` · 续跑 `http/resume-legs.ts` 的 `resolveResumeSpec`)在拿到装配输出的**同一只对象**时
  * 读一次(唯一读口 {@link legFactsOf},读在 `stampSpecRoot` 复制之前),此后作普通值随 `PreparedTaskSubmission.legFacts` /
@@ -18,6 +18,7 @@
 import type { ScenarioHands } from "./capabilities/hands-lane.js";
 import type { RunSkillEntry } from "./capabilities/skills.js";
 import type { DelegationRootWitness } from "./delegated-session-owner.js";
+import type { ProjectContext } from "./project-context.js";
 /** 一条腿的部署事实(冻结记录)。 */
 export interface LegFacts {
     /** 执行车道:`none` ⇒ 无手孪生 Runner。读者 = 生产选路器。 */
@@ -26,6 +27,16 @@ export interface LegFacts {
     readonly skills: readonly RunSkillEntry[];
     /** 受理时读根会话行的那一读(会话 id + 住客)。读者 = 腿的会话行记录座(`session-workspace.ts`)。 */
     readonly sessionWitness: DelegationRootWitness;
+    /**
+     * 这次提交的根会话登记的工作目录(提交体 `cwd` 经唯一写口 `setSessionCwd` 登记的那一枚;装配器在登记之后读一次)。缺席 = 没登记。
+     * 读者 = 三只组合入口(同步 / 后台 / 续跑腿的梯子与验证门):经 `compositionLegRoot`(`task-cwd.ts`)交给它们驱动的每一条腿当交活方的工作目录。
+     */
+    readonly registeredCwd?: string;
+    /**
+     * 这条 run 继承到的项目上下文(`project-context.ts`):新提交腿在装配器头部判出的那一份,续跑腿是从续跑重建输入重放的那一份。缺席 = 没继承。
+     * 读者 = 提交腿写续跑重建输入的那一笔(`submit-ctx.ts` `persistSubmissionCtx` → `CheckpointCtx.projectContext`):判一次、随 run 冻结。
+     */
+    readonly projectContext?: ProjectContext;
 }
 /**
  * 铸事实(**单一属主**:只允许 `createResolveSpec` 的出口调用)。同一只对象被第二次铸 ⇒ 当场抛 —— 两个写者是漂移的成因,

package/dist/leg-facts.js

@@ -6,6 +6,8 @@ export function mintLegFacts(resolved, facts) {
         hands: facts.hands,
         skills: Object.freeze(facts.skills.map((e) => Object.freeze({ ...e }))),
         sessionWitness: Object.freeze({ ...facts.sessionWitness }),
+        ...(facts.registeredCwd !== undefined ? { registeredCwd: facts.registeredCwd } : {}),
+        ...(facts.projectContext !== undefined ? { projectContext: Object.freeze({ ...facts.projectContext }) } : {}),
     }));
     return resolved;
 }

package/dist/local-store-declaration.d.ts

@@ -0,0 +1,54 @@
+/**
+ * **local 店对引擎的声明**(会话店顶层 · 检查点店「两半」读同一份;委派分区的声明是子代转录档位的判据,不随两半降)—— 「这台部署向谁承诺店活过替换」的唯一读者,与运维那一个词的闭集。
+ *
+ * ## 规则(一句)
+ * local 文件店的设计声明是「活过进程重启」(`SESSION_DURABILITY`);起服的店持久性准入(`store-admission.ts`,第 2 段、第一笔写之前)拿这句声明与数据根介质对表
+ * (声明 `durable` ∧ 介质 `ephemeral` ⇒ 拒启 `config.store_not_durable`;第 9 段布线审计对引擎读到的声明同判)。声明降为引擎的 `process-local` 只有两个来源,都由 {@link localStoreDeclarationOf} 一处答:
+ *  · 运维写了 `LOCAL_STORE_DURABILITY=ephemeral`(闭集只有这一个词;缺席 = 设计声明);
+ *  · 店落在**调用方自己的盘**上(部署形表行 `callerOwnsWorkerDisk`:host 车道 ∧ 单主)且数据根介质判 `ephemeral` —— 调用方的工作区、工具与会话史同在那块盘上,
+ *    部署不替他承诺他自己那块易失盘活过替换(参照实现在无卷容器里同形)。
+ * 两半一起降:只降会话店,引擎的 durable-park 自检读出缺口(`durableParkGapOf`:检查点活过、会话不活);只降检查点店同理。
+ *
+ * 叶模块:值导入只有部署形表(叶)与店型常量的属主;`store-posture.ts` / `store-admission.ts` / `config.ts` / local 后端各读这里,不各写一份。
+ */
+import type { StoreDurability as EngineStoreDurability } from "@sema-agent/core";
+import { type DeploymentShapeInput } from "./deployment-shape.js";
+import type { StoreDurability } from "./store-posture.js";
+/** `LOCAL_STORE_DURABILITY` 的词(闭集,只有「易失」一个词;缺席 = 店型的设计声明)。不给第二个放宽词 —— 声明只有「我就是易失」这一句。 */
+export declare const LOCAL_STORE_DECLARATION_WORDS: readonly ["ephemeral"];
+export type LocalStoreDeclarationWord = (typeof LOCAL_STORE_DECLARATION_WORDS)[number];
+/**
+ * local 店声明的依据词(闭集;引擎声明词由 {@link engineDurabilityOfDeclarationRule} 的穷举 switch 派生 —— 加词 ⇒ 编译红):
+ *  · `declared_ephemeral` —— 运维写了 `LOCAL_STORE_DURABILITY=ephemeral` ⇒ `process-local`(不论车道与介质:这是部署者对自己的店说的话);
+ *  · `callers_own_volatile_disk` —— 部署形表行 `callerOwnsWorkerDisk` 成立(host 车道 ∧ 单主:店所在的盘就是调用方自己的盘 —— 他的工作区、工具与会话史同在一块盘上,
+ *    CC 在容器里同形)且数据根介质判 `ephemeral` ⇒ `process-local`:部署不替调用方承诺他自己那块易失盘活过替换;
+ *  · `store_design` —— 其余:local 文件店的设计声明(活过进程重启,`SESSION_DURABILITY`)。店落在调用方看不见的 worker 盘上而介质易失 ⇒ 审计拒启;
+ *    调用方自己的盘判 `durable` / `unknown` ⇒ 声明照旧(开发机、挂了卷的容器、非 Linux)。
+ */
+export declare const LOCAL_STORE_DECLARATION_RULES: readonly ["declared_ephemeral", "callers_own_volatile_disk", "store_design"];
+export type LocalStoreDeclarationRule = (typeof LOCAL_STORE_DECLARATION_RULES)[number];
+/** 依据词 → 引擎声明词(穷举 switch)。 */
+export declare function engineDurabilityOfDeclarationRule(rule: LocalStoreDeclarationRule): EngineStoreDurability;
+/** local 店的声明(依据词 + 派生的引擎声明词;两半店读同一份)。 */
+export interface LocalStoreDeclaration {
+    readonly rule: LocalStoreDeclarationRule;
+    readonly durability: EngineStoreDurability;
+}
+/** 声明读的部署事实:部署形表行 `callerOwnsWorkerDisk` 的读入形(车道 × 租户)+ 运维的词 `LOCAL_STORE_DURABILITY`(`ServiceConfig` 结构上满足)。 */
+export type LocalStoreDeclarationDeployment = DeploymentShapeInput<"lane" | "principal"> & {
+    readonly localStoreDurability: LocalStoreDeclarationWord | undefined;
+};
+/**
+ * 🔴 「local 店对引擎声明自己活过什么」的**唯一读者**(两个调用点读同一组输入:local 后端的构造 —— 两半店的声明都从它的返回值来;起服第 2 段的店持久性准入 `store-admission.ts` —— 拒启判读同一份)。
+ * `dataRootMedium` = 起服第 2 段对数据根介质的判定;没有起服证据的入口(`run-local`、嵌入方直调 `createStoreBackend`)递 `unknown` —— 与装配值同一条缺证据律:
+ * 判不出的介质不放宽声明,只有运维的词能。
+ */
+export declare function localStoreDeclarationOf(deployment: LocalStoreDeclarationDeployment, dataRootMedium: StoreDurability): LocalStoreDeclaration;
+/** 依据词的人读形(布线审计的 warn 行与店的持久性准入的拒句用)。 */
+export declare function describeLocalStoreDeclaration(d: LocalStoreDeclaration): string;
+/**
+ * `LOCAL_STORE_DURABILITY` 的读法(配置装载调这一只):缺席 / 空串 ⇒ `undefined`(设计声明);恰为闭集里的词(去首尾空白后逐字)⇒ 那个词;
+ * 别的任何值 ⇒ 抛(拒启)—— 一个读不懂的声明不许被折成「持久」或「易失」中的任何一边。
+ */
+export declare function parseLocalStoreDurabilityWord(raw: string | undefined): LocalStoreDeclarationWord | undefined;
+//# sourceMappingURL=local-store-declaration.d.ts.map

package/dist/local-store-declaration.js

@@ -0,0 +1,59 @@
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { SESSION_DURABILITY } from "./plugins/session-placement.js";
+export const LOCAL_STORE_DECLARATION_WORDS = ["ephemeral"];
+export const LOCAL_STORE_DECLARATION_RULES = ["declared_ephemeral", "callers_own_volatile_disk", "store_design"];
+export function engineDurabilityOfDeclarationRule(rule) {
+    switch (rule) {
+        case "declared_ephemeral":
+        case "callers_own_volatile_disk":
+            return "process-local";
+        case "store_design":
+            return SESSION_DURABILITY;
+        default: {
+            const unhandled = rule;
+            throw new Error(`store posture: no ruling for local store declaration rule ${String(unhandled)}`);
+        }
+    }
+}
+export function localStoreDeclarationOf(deployment, dataRootMedium) {
+    const of = (rule) => ({ rule, durability: engineDurabilityOfDeclarationRule(rule) });
+    const word = deployment.localStoreDurability;
+    switch (word) {
+        case "ephemeral":
+            return of("declared_ephemeral");
+        case undefined:
+            if (dataRootMedium === "ephemeral" && DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(deployment))
+                return of("callers_own_volatile_disk");
+            return of("store_design");
+        default: {
+            const unhandled = word;
+            throw new Error(`unhandled LOCAL_STORE_DURABILITY word ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function describeLocalStoreDeclaration(d) {
+    switch (d.rule) {
+        case "declared_ephemeral":
+            return "the operator declared LOCAL_STORE_DURABILITY=ephemeral";
+        case "callers_own_volatile_disk":
+            return "the store sits on the caller's own disk (host execution lane, single owner), and that disk does not survive a container / Pod replacement";
+        case "store_design":
+            return "the local file store's own declaration";
+        default: {
+            const unhandled = d.rule;
+            throw new Error(`store posture: no wording for local store declaration rule ${String(unhandled)}`);
+        }
+    }
+}
+export function parseLocalStoreDurabilityWord(raw) {
+    const w = raw?.trim() ?? "";
+    if (w === "")
+        return undefined;
+    const word = LOCAL_STORE_DECLARATION_WORDS.find((x) => x === w);
+    if (word !== undefined)
+        return word;
+    throw new Error(`LOCAL_STORE_DURABILITY=${JSON.stringify(raw)} is not a recognized declaration — the only word is ${LOCAL_STORE_DECLARATION_WORDS.map((x) => `"${x}"`).join(", ")} ` +
+        `(the local store declares itself process-local: sessions, parked approvals and memory do not survive a container / Pod replacement). ` +
+        `Leave it unset for the store's own durable declaration. Refusing to boot rather than reading a declaration nobody can read as either one.`);
+}
+//# sourceMappingURL=local-store-declaration.js.map

package/dist/mcp-assertion-header.d.ts

@@ -5,7 +5,7 @@
  * 请求面条目的形 = 契约包的请求传输形({@link RequestMcpServerSpec}:stdio 带 `env`、http 带 `headers` / `principalHeader` / `assertionHeader`),wire 上的形由它说。
  * 交给引擎的声明不带件值:引擎的声明收据对带 `headers` / `env` 的声明整条拒,件由部署的对端座在发送时作答。所以每条条目按它那一臂的处置表
  * ({@link MCP_STDIO_TRANSPORT_DISPOSITION} / {@link MCP_HTTP_TRANSPORT_DISPOSITION})拆成草稿:`env` / `headers` 进草稿的件,`assertionHeader` 承载不发送,其余进声明。
- * 拆法只有 `plain-string-record.ts` 的 `splitDeclaration` 一只、键的去处只有表一处说;两张表各带三道编译格(请求臂加 / 减键、引擎臂加键、引擎臂删键都编译红)。
+ * 拆法只有 `request-declaration-disposition.ts` 的 `splitDeclaration` 一只、键的去处只有表一处说;两张表各带三道编译格(请求臂加 / 减键、引擎臂加键、引擎臂删键都编译红)。
  * 草稿只有胜出者(部署同名者赢,`task-mcp.ts` 的 `mergeRequestMcp`)才经对端座的唯一铸点(`peer-seat.ts` 的 `mintDeclaration`)登记,登记换来的引用放进声明的传输臂。
  *
  * ## `assertionHeader`:一条律,一个键一种读法

package/dist/mcp-assertion-header.js

@@ -1,4 +1,4 @@
-import { splitDeclaration } from "./plain-string-record.js";
+import { splitDeclaration } from "./request-declaration-disposition.js";
 export const MCP_STDIO_TRANSPORT_DISPOSITION = { args: "engine", command: "engine", env: "seat", kind: "engine" };
 export const MCP_HTTP_TRANSPORT_DISPOSITION = { assertionHeader: "withheld", headers: "seat", kind: "engine", principalHeader: "engine", url: "engine" };
 const MCP_REQUEST_TRANSPORT_ARMS = {

package/dist/mcp-authorization-face.d.ts

@@ -1,14 +1,19 @@
 /**
- * MCP 授权事实(core 7.59.0 `McpAuthorization`:`{ reason, authorizeUrl?, resourceMetadataUrl? }`,与 `errorCode: "unauthorized"` 同行)的**出门投影** ——
- * 本仓三张面(`wiring_manifest.mcp[]` 行、重拨回执的 `status`、`//mcp` 面板的 `servers[]`)同读这一只。
+ * MCP 授权记录(core 7.59.0 `McpAuthorization`:`{ reason, authorizeUrl?, resourceMetadataUrl? }`,与 `errorCode: "unauthorized"` 同在)的**出门投影** ——
+ * 一条记录无论坐在哪个投影载体里,离开本服务只经这一张处置表、这一只投影。五个投影点同读它:状态行投影(`wiring_manifest.mcp[]` 行;账本帧、面板的
+ * `lastLegMcp.mcp[]`、能力面两口读的都是它的产物)、重拨回执的 `status`、会话 MCP 面板的 `servers[]`、通告 `mcp.authorization_required` 的 `detail`
+ * (登记 `NOTICE_DETAIL_RECORDS`,`trace/engine-notice-wire.ts`)、会话历史读面里工具结果卡的 `details.authorization`(登记 `TOOL_CARD_RECORDS`,`trace/tool-card.ts`)。
+ * (工具卡的读者 `trace/tool-card.ts` 是后者的那一只:活面 `tool_end.structured` 上挂着授权记录的自注册卡同读。)记录成员是**结构位**:只经本表出门,
+ * 不过自由文本的脱敏、深扫与截断。会话同步拉取口不是投影:它把存档逐字复制给属主,存档里带不带远端的地址由引擎的写入决定。
  *
- * 只投闭集词 `reason`(`rejected` = 端点答 401 且授权座的重问没给出能过的凭据 / `scope` = 403 `insufficient_scope` / `none` = 授权座答「未授权」):
- * 判据直读引擎的 `MCP_AUTHORIZATION_REASONS`(不抄词表);词出闭集、非串、整只不是对象 ⇒ 整格缺席(最弱断言,不铸词)。
- * 两只地址**不出门**:`authorizeUrl` 只来自部署的授权座,本部署今天没有授权座;`resourceMetadataUrl` 是远端在挑战头里自报的地址,不可信 —— 两只地址的去向
- * (授权座 + 出口座)是授权记录面的设计,不在本投影里放行。用户面的「去授权」由会话通告 `mcp.authorization_required` 承载。
+ * `reason` 是闭集词(`rejected` = 端点答 401 且对端座的重问没给出能过的凭据 / `scope` = 403 `insufficient_scope` / `none` = 对端座答「未授权」):
+ * 判据直读引擎的 `MCP_AUTHORIZATION_REASONS`(不抄词表);词出闭集、非串、整只不是对象 ⇒ 整条记录缺席(最弱断言,不铸词)。
+ * 两只地址今天不出门:`authorizeUrl` 只来自对端座 —— 座在,但今天没有会答需授权的凭据来源(地址的唯一入口与它的判法随那一臂立);
+ * `resourceMetadataUrl` 是远端在挑战头里自报的地址(终态 `strip`:没有消费方需要它 —— 客户端不跑授权发现;摆在「去授权」旁边的远端地址是钓鱼面)。
  */
-import { type McpAuthorizationReason } from "@sema-agent/core";
-/** 授权记录的处置表(三面同读;`core-keyset-guard.ts` 读表 —— 门与投影一个写者):`reason` 认得才出门(闭集词;在场而认不得 ⇒ 丢并计一次),两只地址本面不出现。 */
+import { type McpAuthorization, type McpAuthorizationReason } from "@sema-agent/core";
+import { type FaceOf } from "./trace/projection-table.js";
+/** 授权记录的处置表(五个投影点同读;`core-keyset-guard.ts` 读表 —— 门与投影一个写者):`reason` 认得才出门(闭集词;在场而认不得 ⇒ 丢并计一次),两只地址不出门。 */
 export declare const MCP_AUTHORIZATION_DISPOSITIONS: {
     readonly reason: {
         readonly forward: (w: unknown) => w is McpAuthorizationReason;
@@ -16,12 +21,11 @@ export declare const MCP_AUTHORIZATION_DISPOSITIONS: {
     readonly authorizeUrl: "strip";
     readonly resourceMetadataUrl: "strip";
 };
-/** 处置表一格的放行谓词所窄化到的型(`forward: (w: unknown) => w is T` ⇒ `T`):表放行什么,出门值就是什么型。 */
-type ForwardedAs<F> = F extends (w: unknown) => w is infer T ? T : never;
-/** 本投影的产物 = 表里 `reason` 一格放行后的型。词的型只有表这一个写者,出口不再判第二遍。 */
-export type McpAuthorizationFace = {
-    readonly reason: ForwardedAs<(typeof MCP_AUTHORIZATION_DISPOSITIONS)["reason"]["forward"]>;
-};
+/** 记录的成员名 = 表的键(冻结拷贝;成员集只有表一处写)。平铺载体(通告 `detail`)按它认哪几位是这条记录。 */
+export declare const MCP_AUTHORIZATION_MEMBERS: readonly string[];
+type TableFace = FaceOf<McpAuthorization, typeof MCP_AUTHORIZATION_DISPOSITIONS>;
+/** 本投影的产物 = 表的出门型({@link FaceOf}:表翻一格,型随之变);记录级规则「`reason` 在 ⇔ 记录在」在出口上,所以 `reason` 必在。 */
+export type McpAuthorizationFace = TableFace & Required<Pick<TableFace, "reason">>;
 export declare function projectMcpAuthorization(v: unknown): McpAuthorizationFace | undefined;
 export {};
 //# sourceMappingURL=mcp-authorization-face.d.ts.map

package/dist/mcp-authorization-face.js

@@ -6,10 +6,11 @@ export const MCP_AUTHORIZATION_DISPOSITIONS = {
     authorizeUrl: "strip",
     resourceMetadataUrl: "strip",
 };
+export const MCP_AUTHORIZATION_MEMBERS = Object.freeze(Object.keys(MCP_AUTHORIZATION_DISPOSITIONS));
 export function projectMcpAuthorization(v) {
     if (typeof v !== "object" || v === null || Array.isArray(v))
         return undefined;
-    const { reason } = projectByTable("mcp.authorization", MCP_AUTHORIZATION_DISPOSITIONS, v, undefined);
-    return reason !== undefined ? { reason } : undefined;
+    const face = projectByTable("mcp.authorization", MCP_AUTHORIZATION_DISPOSITIONS, v, undefined);
+    return face.reason === undefined ? undefined : { ...face, reason: face.reason };
 }
 //# sourceMappingURL=mcp-authorization-face.js.map

package/dist/memory-project-layer.js

@@ -29,7 +29,7 @@ export function createMemoryProjectLayers(deps) {
     };
     return {
         async prepare(config, scope, taskRoot) {
-            const layer = memoryProjectLayerFor(config, scope, taskRoot);
+            const layer = await memoryProjectLayerFor(config, scope, taskRoot);
             const current = layer?.key.scope;
             if (layer === undefined || current === undefined)
                 return layer?.key;

package/dist/memory-scope.d.ts

@@ -62,8 +62,8 @@ export declare function memoryScopeFor(config: ServiceConfig, principal?: string
  * 读不到(根在沙箱/设备盘上,或 host 车道会话没登记 cwd、spec 期还不知道根)⇒ 调用方传 `undefined` ⇒ `{ absent: "unreadable" }`,
  * core 铸 operator 通知 `memory.project_scope_absent`,写照常落全局层 —— **响亮**,不是静默落 `local`。
  *
- * 🔴 [ref] 键形:项目层 = **全局层的属主 × 项目身份**,`userrepo:<属主段>/<档>.<摘要>`(文法 `project-layer-key.ts`,身份 `project-identity.ts`);
- * 属主 = `projectLayerOwnerOf(scope)`。
+ * 🔴 [ref] 键形:项目层 = **全局层的属主 × 项目身份**,`userrepo:<属主段>/<档>.<摘要>`(文法 `project-layer-key.ts`,身份 `project-identity.ts`
+ * —— 检出带 `.sema/project` 记号 ⇒ 记号档,读法与引擎判官同一只;没有记号 ⇒ git 根回落);属主 = `projectLayerOwnerOf(scope)`。
  *
  * 🔴 **写家只落复制路径覆盖得到的层**(7.98.0 合并复审 F1,主会话裁「统一规则,不做特判」):写家 = 读列表里、本部署
  * **每一条已配置的复制路径都覆盖到**的最具体的一层。项目层不在覆盖面里 ⇒ 本任务**不按项目键控**,写家落全局层 —— 否则开了
@@ -77,9 +77,9 @@ export declare function memoryScopeFor(config: ServiceConfig, principal?: string
  *  · 记忆面暗(`scope` 缺席)—— 没有 spec 可铸,也就不读盘;
  *  · 本任务的项目层不在复制覆盖面里(见上)—— 让位给全局层。
  */
-export declare function memoryProjectKeyFor(config: Pick<ServiceConfig, "requirePrincipal" | "memorySync">, scope: string | undefined, taskRoot: string | undefined): MemoryProjectKey | undefined;
+export declare function memoryProjectKeyFor(config: Pick<ServiceConfig, "requirePrincipal" | "memorySync">, scope: string | undefined, taskRoot: string | undefined): Promise<MemoryProjectKey | undefined>;
 /** {@link memoryProjectKeyFor} 的同一条规则,带上本 checkout 要折进当前层的旧层(`memory-project-layer.ts` 读它)。 */
-export declare function memoryProjectLayerFor(config: Pick<ServiceConfig, "requirePrincipal" | "memorySync">, scope: string | undefined, taskRoot: string | undefined): ProjectLayerOfTask | undefined;
+export declare function memoryProjectLayerFor(config: Pick<ServiceConfig, "requirePrincipal" | "memorySync">, scope: string | undefined, taskRoot: string | undefined): Promise<ProjectLayerOfTask | undefined>;
 /**
  * 本部署记忆的**复制覆盖面** —— 唯一属主(7.98.0 合并复审 F1)。「复制路径」= 把某一层记忆搬出本机的腿;今天只有一条:
  * TOC 同步客户端腿(`MEMORY_SYNC_*`,`memory-sync-client.ts`)。🔴 [ref]:一条复制路径复制**它那一层**(`config.memorySync.scope`)

package/dist/memory-scope.js

@@ -34,13 +34,13 @@ export function memoryScopeFor(config, principal, projectId) {
     }
     return config.memoryScope;
 }
-export function memoryProjectKeyFor(config, scope, taskRoot) {
-    return memoryProjectLayerFor(config, scope, taskRoot)?.key;
+export async function memoryProjectKeyFor(config, scope, taskRoot) {
+    return (await memoryProjectLayerFor(config, scope, taskRoot))?.key;
 }
-export function memoryProjectLayerFor(config, scope, taskRoot) {
+export async function memoryProjectLayerFor(config, scope, taskRoot) {
     if (config.requirePrincipal === true || scope === undefined)
         return undefined;
-    const layer = projectLayerForTaskRoot(taskRoot, projectLayerOwnerOf(scope));
+    const layer = await projectLayerForTaskRoot(taskRoot, projectLayerOwnerOf(scope));
     if (layer.key.scope !== undefined && !replicationCovers(memoryReplicationCoverage(config), layer.key.scope))
         return undefined;
     return layer;

package/dist/memory-store-refusal.d.ts

@@ -30,7 +30,7 @@
  *     找码;这一半候 core 的结构化码位(登记在案,codex 一审 C3)。
  *
  * ## 不是这一族的形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂;今两形 + 一只已退的形)
- *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`
+ *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,[ref])⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`
  *    (core 7.44.0 起 scope home 非目录**不再**走这一类 —— 它有了自己的码,见上;`ControlPlaneCorruptError` 只剩真控制面损坏);
  *  · (已不存在的一形)引擎原地写撞硬链(nlink>1):≤ 引擎 7.55.x 是无码文本 `has N names (a hard link) … not written`、走该写点既有的失败车道;
  *    引擎 7.56.0 起那只写给**这个名字**另建一个新文件(原子改名落位,其余名字保留原文件),拒绝与那句文本一并消失 —— 本仓从未读过那句文本,零码;

package/dist/memory-sync-client.js

@@ -3,7 +3,7 @@ import { readFile, readdir, rename, rmdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { carriesCredential, ensureDir, syncMemoryScope, } from "@sema-agent/core";
 import { replicationCovers } from "./memory-scope.js";
-import { parseProjectLayerKey } from "./project-layer-key.js";
+import { compareProjectLayersForSync, parseProjectLayerKey } from "./project-layer-key.js";
 import { atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
 import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
 import { buildMemorySyncIdentityBootRefusal, readMemorySyncIdentity } from "./memory-sync-identity.js";
@@ -272,7 +272,7 @@ export function createMemorySyncRunner(opts) {
             opts.log.warn("memory_sync_layer_enumeration_unsupported", { scope: opts.scope, reason: local.reason, note: "only the sync layer and tracked project layers are synced" });
         }
         const projectLayers = new Set([...(local.supported ? local.scopes : []), ...tracked].filter(isCoveredProjectLayer));
-        return [opts.scope, ...[...projectLayers].sort()];
+        return [opts.scope, ...[...projectLayers].sort(compareProjectLayersForSync)];
     };
     const syncLayer = async (scope, reason, calls) => {
         const cursorPath = memorySyncCursorPath(memoryEngineDir, scope);

package/dist/model-context-window.d.ts

@@ -1,18 +1,57 @@
 /**
- * The window this server ASSUMES for a model whose context window nobody declared — ONE spelling of the number.
+ * A model's context window: ONE resolver, ONE spelling of the assumed number, ONE word for where the window came from.
  *
- * Three readers fall back to it and nothing else may carry a copy: the env leg (`config.ts`: `MODEL_CONTEXT_WINDOW` unset ⇒ this value,
- * and the `MODEL_MAX_TOKENS` default `min(32000, window)` reads the SAME resolved window), the center leg (`web-admin-client/apply-effective.ts`:
- * `entry.contextWindow ?? env model's window ?? this value`) and the config catalog's default note (`config-catalog.ts`). A literal copied
- * into any of them is a second source that drifts the day the assumption changes — a center roster would then assume one window while
- * the env model assumes another, and the operator-facing default note would name a third.
+ * ## The rule
+ * A window is either **declared** — someone along the model's inheritance chain wrote a number: the catalog entry's `contextWindow`,
+ * the deployment's `MODEL_CONTEXT_WINDOW` (inherited by every catalog entry that writes none, BL-8), or `MODEL_CHEAP_CONTEXT_WINDOW`
+ * (the cheap slot; unset ⇒ it inherits the main slot's resolution) — or **assumed**: nobody along the chain wrote one, and this server
+ * fills {@link ASSUMED_CONTEXT_WINDOW}. {@link resolveContextWindow} is the only place that decides; it hands back the number AND its
+ * source as one value, and an inheriting reader passes the parent's resolution down whole — so the source travels with the number and
+ * no reader re-derives "was it declared?" on its own.
  *
- * This is a conservative CEILING GUESS, not a measurement: the engine needs a window to size its compaction trigger and the tool-schema
- * defer threshold, and an undeclared window must never be read optimistically — so every model that reaches the engine carries SOME window,
- * declared or this one (a catalog entry may omit `contextWindow`; the readers above fill it). Whether the value is conservative for a
- * given model is a per-model question this constant does not answer.
+ * Readers: the env leg (`config.ts`: main slot, cheap slot inheriting the main resolution), the center leg (`web-admin-client/apply-effective.ts`:
+ * entry → env main resolution), and the config catalog's default note (`config-catalog.ts`, which describes the assumed arm and so names the constant).
+ * The source is disclosed twice and read from the same per-model table both times (`ServiceConfig.contextWindowSources`): the `GET /v1/models`
+ * row key `contextWindowSource`, and the operator line {@link buildContextWindowAssumedNotice} (once per served model whose window is assumed; the one
+ * emitter is `context-window-notice.ts`, run after the served table settles).
+ *
+ * ## The assumed number
+ * A conservative guess, not a measurement: the engine needs a window to size its compaction trigger and the tool-schema defer
+ * threshold, and an undeclared window must never be read optimistically — so every model that reaches the engine carries SOME window,
+ * declared or this one. "Conservative" has one meaning here: the number is no larger than the smallest real window any model family in
+ * this stack's own deployments is known to declare, so an undeclared window errs toward "compaction and tool-schema deferral start
+ * earlier than the model needs", not toward "the model reaches its limit before compaction starts". It is ONE number, not a table keyed
+ * by model family — a per-family table would be a second source for the same fact. A model whose real window is larger declares it
+ * (catalog entry `contextWindow` / `MODEL_CONTEXT_WINDOW`); the disclosure above is how an operator / client learns which rows still
+ * ride on this number.
  *
  * Pure leaf: no imports.
  */
-export declare const ASSUMED_CONTEXT_WINDOW = 262144;
+export declare const ASSUMED_CONTEXT_WINDOW = 131072;
+/** Where a model's window came from — closed set; consumers switch exhaustively. */
+export declare const CONTEXT_WINDOW_SOURCES: readonly ["declared", "assumed"];
+export type ContextWindowSource = (typeof CONTEXT_WINDOW_SOURCES)[number];
+/** A resolved window: the number the engine gets and where it came from (one value — never split across two reads). */
+export interface ResolvedContextWindow {
+    readonly window: number;
+    readonly source: ContextWindowSource;
+}
+/**
+ * The one resolver. `declared` = the number this level of the chain wrote (`undefined` = wrote none); `inherited` = the parent level's
+ * resolution (omitted at the root ⇒ the assumed arm). Declared ⇒ that number, `declared`; otherwise the parent's resolution unchanged —
+ * a catalog entry that writes no window under a deployment that declared `MODEL_CONTEXT_WINDOW` is declared, under one that did not it is assumed.
+ */
+export declare function resolveContextWindow(declared: number | undefined, inherited?: ResolvedContextWindow): ResolvedContextWindow;
+/**
+ * The operator line for one served model whose window is assumed (plain data; both legs emit this shape, the event name lives here only).
+ * `declareAt` names where the operator writes the number to make it declared (the env knob for an env slot, the catalog entry otherwise).
+ */
+export declare function buildContextWindowAssumedNotice(row: {
+    readonly model: string;
+    readonly window: number;
+    readonly declareAt: string;
+}): {
+    readonly event: "model_context_window_assumed";
+    readonly fields: Record<string, string>;
+};
 //# sourceMappingURL=model-context-window.d.ts.map

package/dist/model-context-window.js

@@ -1,2 +1,21 @@
-export const ASSUMED_CONTEXT_WINDOW = 262144;
+export const ASSUMED_CONTEXT_WINDOW = 131072;
+export const CONTEXT_WINDOW_SOURCES = ["declared", "assumed"];
+const ASSUMED = Object.freeze({ window: ASSUMED_CONTEXT_WINDOW, source: "assumed" });
+export function resolveContextWindow(declared, inherited = ASSUMED) {
+    return declared !== undefined ? { window: declared, source: "declared" } : inherited;
+}
+export function buildContextWindowAssumedNotice(row) {
+    return {
+        event: "model_context_window_assumed",
+        fields: {
+            model: row.model,
+            contextWindow: String(row.window),
+            declareAt: row.declareAt,
+            note: `no context window is declared for model "${row.model}" — this server assumes ${row.window} tokens (a conservative guess, not a measurement): ` +
+                `the engine sizes its compaction trigger on it, so a model whose real window is smaller reaches its limit before compaction starts, ` +
+                `and a model whose real window is larger compacts earlier than it needs to. ` +
+                `GET /v1/models marks this row contextWindowSource:"assumed". Declare the real window at ${row.declareAt} — said once per model.`,
+        },
+    };
+}
 //# sourceMappingURL=model-context-window.js.map

package/dist/model-entry-refusal.d.ts

@@ -58,7 +58,7 @@ export type CatalogEntryVerdict = {
 };
 /**
  * **逐条判据**:`ok` = 本部署能完整服务它(连同判出它的那一份读数)。判序即语义:先形(不合形的条目谈不上走哪条腿),再腿。
- * 形分两段、同一个码(`config.model_entry_invalid`):settings-schema 的 `ModelEntry`,再是 [ref] 的 `headers`(白名单 + 线路 + 值形,
+ * 形分三段、同一个码(`config.model_entry_invalid`):settings-schema 的 `ModelEntry`,再是 [ref] 的名字(凭据形的名不收,见 {@link credentialNameRefusal}),再是 [ref] 的 `headers`(白名单 + 线路 + 值形,
  * 判据单属主 `model-entry-headers.ts`;settings-schema 6.3.0 的 `ModelEntry` 还没有这个键 —— 候裁加字段,届时词表不另抄)。
  *
  * 形判的属主是 settings-schema 的 `ModelEntry`(两条读腿用的就是它)—— 本仓不手抄任何一条字段规则;这里在第二道边界(绕过读腿的
@@ -114,9 +114,9 @@ export interface ModelRefusalVerdict {
 /**
  * [ref] —— 判决 → `/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的 wire 形(settings-schema `ModelRefusalsSignal`,纯投影):
  * 名 → 码,**值只码**(拒因事实里的上游 id / provider 词 / 坏字段键 / 出路句都不上 wire —— `entry_invalid` 行是没人验过的行,id / provider
- * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 settings-schema `isReportableRefusalName`(唯一判据,
- * import 不复制;6.3.0 起 = 标识符白名单 ∧ 无密钥形 ∧ 无 URL userinfo)—— 秘密形 / 空串 / `__proto__` / 不是标识符的串这类出不了门的名不进键、
- * 不计数;引擎内部的判决不受影响;本机日志 / 拒因句里的写名同样先问这一只([ref],{@link disclosableRefusalName}:不可披露的名只写码)。
+ * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 {@link disclosableRefusalName}([ref] 起 wire 出口与日志 / 拒因句同一个口:
+ * settings-schema `isReportableRefusalName`〔6.3.0 起 = 标识符白名单 ∧ 无密钥形 ∧ 无 URL userinfo,import 不复制〕∧ 脱敏器的强证据臂不认它是凭据)—— 秘密形 /
+ * 空串 / `__proto__` / 不是标识符的串这类出不了门的名不进键、不计数;引擎内部的判决不受影响;本机日志 / 拒因句里的写名同样先问这一个口([ref]:不可披露的名只写码)。
  * 逐条空且无组拒 ⇒ `undefined`(键缺席:「没有」只有一种拼法)。
  */
 export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefined): ModelRefusalsSignal | undefined;
@@ -144,6 +144,7 @@ export declare function echoModelRef(ref: string): string;
  * hook 选模型的失败文案 —— 各处同一句)。`field` = 调用方的通道名(`model` / `compactionModel` / `agents[0].model` /
  * `@-mention`),`requested` = 调用方发来的**原形**(name 或 id;本函数回显它时过 {@link echoModelRef},调用方不预先截)。
  * 别名段(`(catalog entry …)`)的判断读原形:ref 与条目名逐字相同 ⇒ 不带,不因回显截短而误判成「另有条目」。
+ * 别名段里的条目名过 {@link nameSlot}([ref]):调用方按上游 id 点中一条名字是凭据形的条目时,名字是**配置里的字**、不是调用方写的字,不可披露的名不原样回给他。
  */
 export declare function modelUnavailableMessage(field: string, requested: string, name: string, r: ModelEntryRefusal): string;
 /**

package/dist/model-entry-refusal.js

@@ -4,6 +4,7 @@ import { catalogBrainLane } from "./model-provider.js";
 import { readCatalogEntryHeaders } from "./model-entry-headers.js";
 import { DroppedCatalogEntryRow, describeSchemaIssueFields, describeSchemaIssues } from "./web-admin-client/read-warnings.js";
 import { echoCallerText } from "./caller-text-echo.js";
+import { isCredentialShapedUnit } from "./trace/redact.js";
 import { DEFAULT_MODEL_REF } from "./model-select.js";
 export const ENTRY_REFUSAL_REASON_OF = {
     "config.model_no_brain": "no_brain",
@@ -29,6 +30,8 @@ export function judgeCatalogEntry(m, ctx) {
         return { ok: false, refusal: entryInvalidRefusal(typeof m.id === "string" ? m.id : "", typeof m.provider === "string" ? m.provider : "", fields, describeSchemaIssues(shape.error) ?? fields.join(", ")) };
     }
     const e = shape.data;
+    if (isCredentialShapedUnit(e.name))
+        return { ok: false, refusal: credentialNameRefusal(e.id, e.provider) };
     const headers = readCatalogEntryHeaders(e.headers, e.api);
     if (!headers.ok)
         return { ok: false, refusal: entryInvalidRefusal(e.id, e.provider, headers.fields, headers.issue) };
@@ -74,6 +77,17 @@ function entryInvalidRefusal(id, provider, fields, issues) {
             "deployment's catalog on its own (the other entries keep serving) instead of being served with a value nothing validated; fix the entry to bring it back",
     };
 }
+function credentialNameRefusal(id, provider) {
+    return {
+        ...refusalCause("config.model_entry_invalid"),
+        id,
+        provider,
+        fields: ["name"],
+        detail: "the catalog entry's name field is credential-shaped (the engine's secret scanner reads it as a credential) — an entry name is returned verbatim by GET /v1/models " +
+            "and serves as the @-mention handle, so the entry is not served rather than served under a name that every log line has to mask; rename the entry to a plain identifier " +
+            "to bring it back, and treat the credential as exposed if the name was pasted from a real one",
+    };
+}
 function droppedRowEnabled(row) {
     return row.identity?.enabled !== false;
 }
@@ -116,13 +130,13 @@ export function judgeCatalogEntries(enabled, ctx, dropped) {
 export function buildModelRefusalsSignal(v) {
     if (v === undefined)
         return undefined;
-    const entries = Object.fromEntries(Object.entries(v.entries).flatMap(([name, r]) => (isReportableRefusalName(name) ? [[name, r.code]] : [])));
+    const entries = Object.fromEntries(Object.entries(v.entries).flatMap(([name, r]) => (disclosableRefusalName(name) !== undefined ? [[name, r.code]] : [])));
     if (Object.keys(entries).length === 0 && v.plane === undefined)
         return undefined;
     return v.plane === undefined ? { entries } : { entries, plane: v.plane };
 }
 function disclosableRefusalName(name) {
-    return isReportableRefusalName(name) ? name : undefined;
+    return isReportableRefusalName(name) && !isCredentialShapedUnit(name) ? name : undefined;
 }
 export function refusedNameLogField(key, name) {
     const shown = disclosableRefusalName(name);
@@ -159,7 +173,7 @@ export function echoModelRef(ref) {
     return echoCallerText(ref, { maxChars: MODEL_REF_ECHO_CHARS });
 }
 export function modelUnavailableMessage(field, requested, name, r) {
-    const alias = requested === name ? "" : ` (catalog entry "${name}")`;
+    const alias = requested === name ? "" : ` (catalog entry ${nameSlot(name)})`;
     return `${field} "${echoModelRef(requested)}"${alias} is published in the catalog but unavailable on this deployment [${r.code}] — ${r.detail}`;
 }
 export function modelNotAllowedMessage(field, requested, resolved) {

package/dist/model-reach-scope.d.ts

@@ -4,7 +4,8 @@
  * 两层,一只 `AsyncLocalStorage`:
  *  · **腿层**(`withModelReachScope`,三条带用户面投递口的 run 腿各包一次:流式 `POST /v1/tasks/stream`、后台 `POST /v1/runs`、续跑):
  *    带着这条腿的两枚身份 —— `sessionId`(通告归属键)与 `taskId`(这条腿的 run 资源 id,= 本腿交给引擎的 `spec.taskId`;7.121.0)——
- *    与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
+ *    与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);腿层的 `sessionId` 同时是读拒字节地板通告的归属键
+ *    (`read-deny-floor-notice.ts` 的 `presentEngineNotice`:腿派出去的 run —— cascade 的级、验证器、子代 —— 的那一帧落在这条腿的流上);
  *  · **调用层**(`createModelReachBrain` 每次模型调用包一次):一只可变的 {@link ModelCallReach},出网观察者
  *    (`outbound-dispatcher.ts` 的 undici 诊断通道订阅)把这次调用发出的每一条请求的**结局**记在上面 —— 最后一条是
  *    「连上了、有了回答」还是「建连就失败了」。

package/dist/observability/corrupt-read-seat.d.ts

@@ -41,7 +41,7 @@ export declare function createCorruptReadFailOpenSeat(tag: FailOpenTag, leg?: (i
  * 这一座里有安全轴的脸(session-policy),所以每命中一行 warn 保留(降成「每进程一次」是降级,[ref] 的裁定);**在此之上**,认出的脸另记账:
  *  · session-policy 脸 ⇒ R 类 tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒;
  *    core 7.41.0 [ref] 起本会话的枚举拒、别的会话的抹除不动它、重绑带走它 —— 但只对**有归属**的坏行(行里的 `__sid`,否则同名高水位标记的 `__sid`);
- *    无从归属的坏行仍按「无规则」(core 已知限制 KL-1299-a 接受:无从归属 ≠ 本会话);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的)。
+ *    无从归属的坏行仍按「无规则」(core 已知限制 [ref] 接受:无从归属 ≠ 本会话);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的)。
  *    抹除扫走无归属坏行那一形 core 是否披露、座上数不数得到,未亲核。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只记账、不改放行**(R 类:有界放行,计数长期保留);
  *  · 其余脸 ⇒ 不计(见 {@link DurableAbsenceFace})。
  * 记账**先于** warn:记账是总函数,warn 可能抛(core 的 guard 会吞掉那个抛),一次日志故障不许吃掉计数。