@sema-agent/server 7.148.0 → 7.150.0

package/dist/config.d.ts

@@ -235,22 +235,23 @@ export declare function configKnobTable(): ConfigKnobRecord[];
 export declare const hostBackgroundShellEnabled: () => boolean;
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export declare const hostExecSpoolEnabled: () => boolean;
-/** 名单在活配置里的落点(服务进程四只旋钮;bake-runner 那只在它自己的进程里,不在 `ServiceConfig`)。 */
-export type EnvNameAllowlistSeats = Pick<ServiceConfig, "lspEnvAllow" | "remoteExec">;
+/** 名单在活配置里的落点(服务进程五只旋钮;bake-runner 那只在它自己的进程里,不在 `ServiceConfig`)。 */
+export type EnvNameAllowlistSeats = Pick<ServiceConfig, "lspEnvAllow" | "hookEnvAllow" | "remoteExec">;
 /**
  * 沙箱名单(表列 `channel: "sandbox-grant"` 的服务侧旋钮,表派生)此刻交出去的名 —— 起服行 `remote_exec_enabled.sandboxEnvKeys` 读它(`boot/execution-env.ts`,
  * 排序后只出键名)。只有被选中车道的那一只有落点;e2b / k8s 报的是名单点到的键,不含 `SANDBOX_PKG_SOURCE` 推导出的包源变量(那一组是区域常量,装配点另并)。
  */
 export declare function sandboxEnvNamesInForce(seats: EnvNameAllowlistSeats): readonly string[];
-/** 声明增长后重判的一处命中:哪只旋钮、它交出去的哪个名、判官的拒因({@link ownCredentialNameProblem} 那一句,只回显名)。 */
+/** 声明增长后重判的一处命中:哪只旋钮、它交出去的哪个名、判官的拒因({@link ownCredentialProblem} 那一句,只回显名)。 */
 export interface OwnCredentialInForce {
     readonly knob: ServerEnvNameAllowlistKnob;
     readonly name: string;
     readonly problem: string;
 }
 /**
- * 解析器头注 ② 那条不变量在**声明增长**那一刻的半边:对活配置里每只名单此刻交出去的名问**同一只**判官({@link ownCredentialNameProblem} → 引擎
- * `inheritEnvPolicyProblem`,读引擎此刻的声明)。读活配置的落点,不重读 env(名单是起服输入;解析那一刻已判过形与当时的声明)。返回每一处命中,空 = 不相交。
+ * 解析器头注 ② 那条不变量在**声明增长**那一刻的半边:对活配置里每只名单此刻交出去的名问**同一只**判官({@link ownCredentialProblem} → `ownCredentialVariable`,
+ * 读引擎此刻的声明:增长并进的名,与增长并进的值 —— 新条目 `apiKeyEnv` 的值等于名单交出去的某个变量的值,同样命中)。读活配置的落点(名单是起服输入;
+ * 解析那一刻已判过形与当时的声明)。返回每一处命中,空 = 不相交。
  * 调用点只有一处 = 声明增长的那一处(`apply-effective.ts` 的换代声明,真声明之后、席位换装之前)。
  */
 export declare function ownCredentialHitsInForce(seats: EnvNameAllowlistSeats): OwnCredentialInForce[];

package/dist/config.js

@@ -4,9 +4,9 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { hostOfUrl, HOST_UNREADABLE_SENTENCE, compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
+import { hostOfUrl, HOST_UNREADABLE_SENTENCE, compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope, resolveBashTimeoutCaps } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
-import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+import { parseApprovalHmacKeys, parsePrincipalJwks, parseServiceAuthTokens } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { buildRuleListJudgeOptions } from "./permission-rule-list.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
@@ -27,7 +27,7 @@ import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { RUN_STALE_SEC_DEFAULT } from "./run-stale-default.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { ASSUMED_CONTEXT_WINDOW } from "./model-context-window.js";
+import { resolveContextWindow } from "./model-context-window.js";
 import { MODEL_THINKING_LEVELS, THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isModelThinkingLevel, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
@@ -41,6 +41,7 @@ import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { parseLocalStoreDurabilityWord } from "./local-store-declaration.js";
 import { sandboxForwardedEnvOf } from "./execution-config-root.js";
 import { SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS, laneMissingEnv, readDeclaredLaneTable } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
@@ -61,7 +62,7 @@ import { echoCallerText } from "./caller-text-echo.js";
 import { PRINCIPAL_MAX_BYTES, principalShapeProblem } from "./principal-shape.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { parseConfigLocalOwnerUid } from "./config-dir-trust.js";
-import { allowlistedEnv, ownCredentialDeclarationRefusal } from "./server-secret-env.js";
+import { allowlistedEnv, ownCredentialDeclarationRefusal, ownCredentialVariable } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
@@ -565,14 +566,18 @@ const OWN_CREDENTIAL_HANDOFF = {
     "host-put-back": { where: "a put-back list hands the named variable back, as written, to the child the engine withheld it from", whom: "that child" },
     "sandbox-grant": { where: "a sandbox list puts the named variable, as written, into a sandbox the model can read", whom: "the sandbox" },
 };
-function ownCredentialNameProblem(name, channel) {
-    if (inheritEnvPolicyProblem([name]) === undefined)
+function ownCredentialProblem(name, channel) {
+    const held = ownCredentialVariable(name);
+    if (held === undefined)
         return undefined;
     const { where, whom } = OWN_CREDENTIAL_HANDOFF[channel];
-    return `this deployment's own credential — ${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (the engine refuses it on any allow list)`;
+    const copy = held === "value" ? "a copy under another name (its value is one of this service's credentials); " : "";
+    const engine = held === "name" ? "the engine refuses it on any allow list" : "the engine withholds it from every child";
+    return `this deployment's own credential — ${copy}${where}; give ${whom} a credential of its own (another name and another value) and list that name instead (${engine})`;
 }
 const NAMES_IN_FORCE = {
     LSP_ENV_ALLOW: (c) => c.lspEnvAllow,
+    HOOK_ENV_ALLOW: (c) => c.hookEnvAllow,
     E2B_SANDBOX_ENV: (c) => (c.remoteExec.provider === "e2b" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
     K8S_SANDBOX_ENV: (c) => (c.remoteExec.provider === "k8s" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
     DOCKER_SANDBOX_ENV: (c) => (c.remoteExec.provider === "local-docker" ? Object.keys(sandboxForwardedEnvOf(c)) : []),
@@ -583,7 +588,7 @@ export function sandboxEnvNamesInForce(seats) {
 }
 export function ownCredentialHitsInForce(seats) {
     return SERVER_ENV_NAME_ALLOWLIST_KNOBS.flatMap((knob) => NAMES_IN_FORCE[knob](seats).flatMap((name) => {
-        const problem = ownCredentialNameProblem(name, ENV_NAME_ALLOWLIST_KNOBS[knob].channel);
+        const problem = ownCredentialProblem(name, ENV_NAME_ALLOWLIST_KNOBS[knob].channel);
         return problem === undefined ? [] : [{ knob, name, problem }];
     }));
 }
@@ -600,7 +605,7 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
                 : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
                     ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
-                    : ownCredentialNameProblem(seg, spec.channel);
+                    : ownCredentialProblem(seg, spec.channel);
         if (problem === undefined)
             return;
         throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
@@ -762,6 +767,7 @@ function optionalEnumKey(key, envName, raw, allowed) {
     }
     return { [key]: raw };
 }
+const PRINCIPAL_INBOX_ECHO_CHARS = 96;
 function principalInboxAssistantKey(raw) {
     if (raw === undefined || raw === "")
         return {};
@@ -769,7 +775,9 @@ function principalInboxAssistantKey(raw) {
         principalInboxConsumerOf({ principalInboxConsumer: { assistant: raw } });
     }
     catch (err) {
-        throw new Error(`env PRINCIPAL_INBOX_ASSISTANT must name the agent handle that consumes the principal inbox (or stay UNSET for no cross-principal delivery): ${err instanceof Error ? err.message : String(err)}`);
+        const shown = JSON.stringify(raw.length > PRINCIPAL_INBOX_ECHO_CHARS ? `${raw.slice(0, PRINCIPAL_INBOX_ECHO_CHARS)}…` : raw);
+        throw new Error(`env PRINCIPAL_INBOX_ASSISTANT must name the agent handle that consumes the principal inbox, or be unset or the empty string for no cross-principal delivery (a blank value is neither — whitespace is not "empty"): ` +
+            `the value ${shown} is refused — ${err instanceof Error ? err.message : String(err)}`);
     }
     return { principalInboxAssistant: raw };
 }
@@ -975,6 +983,7 @@ function parseStoreDomain(ctx) {
             return raw;
         })()),
         runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
+        localStoreDurability: parseLocalStoreDurabilityWord(process.env.LOCAL_STORE_DURABILITY),
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
@@ -1085,7 +1094,7 @@ function parseModelDomain() {
     });
     const envCompat = envApi === "openai-completions" ? envCompatDeclared : undefined;
     const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
-    const contextWindow = numEnv("MODEL_CONTEXT_WINDOW", String(ASSUMED_CONTEXT_WINDOW));
+    const mainWindow = resolveContextWindow(optNumEnvStrict("MODEL_CONTEXT_WINDOW"));
     const model = {
         id: modelId,
         name: modelId,
@@ -1099,10 +1108,10 @@ function parseModelDomain() {
             cacheRead: costEnv("MODEL_COST_CACHE_READ", "unset"),
             cacheWrite: costEnv("MODEL_COST_CACHE_WRITE", "unset"),
         }, undefined)),
-        contextWindow,
+        contextWindow: mainWindow.window,
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
             ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
-            : Math.min(32000, contextWindow),
+            : Math.min(32000, mainWindow.window),
         ...(optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") } : {}),
         params: { promptCacheFamily: envLaneWire.promptCacheFamily },
         ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
@@ -1138,6 +1147,8 @@ function parseModelDomain() {
             break;
     }
     const cheapMintedId = mintedCheapId(cheapSlot);
+    const cheapDeclaredWindow = cheapMintedId === undefined ? undefined : optNumEnvStrict("MODEL_CHEAP_CONTEXT_WINDOW");
+    const cheapWindow = resolveContextWindow(cheapDeclaredWindow, mainWindow);
     const cheapModel = cheapMintedId !== undefined
         ? {
             ...model,
@@ -1150,7 +1161,7 @@ function parseModelDomain() {
                 cacheRead: costEnv("MODEL_CHEAP_COST_CACHE_READ", "declares-zero"),
                 cacheWrite: costEnv("MODEL_CHEAP_COST_CACHE_WRITE", "declares-zero"),
             }, model.cost)),
-            contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
+            contextWindow: cheapWindow.window,
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
         }
@@ -1172,7 +1183,7 @@ function parseModelDomain() {
     if (cheapModel) {
         const cheapAct = optFinitePositiveEnv("MODEL_CHEAP_AUTO_COMPACT_TOKENS");
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
-            const inherited = process.env.MODEL_CHEAP_CONTEXT_WINDOW === undefined || process.env.MODEL_CHEAP_CONTEXT_WINDOW === "";
+            const inherited = cheapDeclaredWindow === undefined;
             CONFIG_NOTICES.push({
                 level: "warn",
                 event: "auto_compact_window_not_derived_1m",
@@ -1186,6 +1197,7 @@ function parseModelDomain() {
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
     const models = envLaneTable(modelId, model, cheapModel);
+    const contextWindowSources = Object.fromEntries(Object.entries(envLaneTable(modelId, { id: model.id, source: mainWindow.source }, cheapModel !== undefined ? { id: cheapModel.id, source: cheapWindow.source } : undefined)).map(([name, slot]) => [name, slot.source]));
     const gatewayApiKey = route.gatewayApiKey;
     if (gatewayBaseUrl === undefined && declaredCredential(gatewayApiKey) !== undefined) {
         CONFIG_NOTICES.push({
@@ -1241,7 +1253,9 @@ function parseModelDomain() {
         },
         model,
         envModel: model,
+        envModelContextWindowSource: mainWindow.source,
         models,
+        contextWindowSources,
         modelApiKeyEnv: {},
         modelApiKeys: {},
         modelRefusals: {},
@@ -1980,12 +1994,7 @@ function parseAuthDomain(ctx) {
     const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
     const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
     const principalJwtMaxTtlSec = parseNumOrFailNonNegative("PRINCIPAL_JWT_MAX_TTL_SEC", env("PRINCIPAL_JWT_MAX_TTL_SEC", "120"));
-    const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter((s) => s.includes("="))
-        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
-        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+    const authTokens = parseServiceAuthTokens(process.env.SERVICE_AUTH_TOKENS);
     return {
         bindHost: process.env.BIND_HOST || undefined,
         bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : undefined,
@@ -2028,6 +2037,7 @@ function parseOrchestrationDomain(ctx) {
     const lspHostEnabled = boolEnv("LSP_HOST_ENABLED", true);
     const autoBackgroundOnTimeout = boolEnv("AUTO_BACKGROUND_ON_TIMEOUT", true);
     const lspEnvAllow = parseEnvNameAllowlist("LSP_ENV_ALLOW", singleUserTurnkey) ?? [];
+    const hookEnvAllow = parseEnvNameAllowlist("HOOK_ENV_ALLOW", singleUserTurnkey) ?? [];
     const declaredLane = declaredExecutionLane(process.env.REMOTE_EXEC);
     const readFaceFacts = process.env.READ_FACE !== undefined
         ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
@@ -2203,6 +2213,7 @@ function parseOrchestrationDomain(ctx) {
         lspHostEnabled,
         autoBackgroundOnTimeout,
         lspEnvAllow,
+        hookEnvAllow,
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
@@ -2619,11 +2630,11 @@ function parseA2aServeAudience(v, at) {
 }
 const STORE_GROUP_KEYS = [
     "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot", "sealedKeyDir",
-    "runStoreStrictHydrate",
+    "runStoreStrictHydrate", "localStoreDurability",
     "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "fileHistoryCapture", "sendUserFile",
 ];
 const MODEL_PLANE_GROUP_KEYS = [
-    "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
+    "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "envModelContextWindowSource", "models", "contextWindowSources",
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
@@ -2650,7 +2661,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs", "backgroundAgentStallMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
-    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspHostEnabled", "lspEnvAllow", "autoBackgroundOnTimeout",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspHostEnabled", "lspEnvAllow", "hookEnvAllow", "autoBackgroundOnTimeout",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude", "readDenyFloorRequired", "sandboxReadFloor",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
 ];

package/dist/context-window-notice.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 「这只模型的窗是假定的」运维通告的**唯一发声器**(行的形与事件名属 `model-context-window.ts` 的 `buildContextWindowAssumedNotice`)。
+ *
+ * ## 说什么
+ * **进程此刻服务的那张模型表**里,窗来源(`config.contextWindowSources`,与 `GET /v1/models` 行的 `contextWindowSource` 同一张表)是 `assumed` 的每只模型一行;
+ * 一个名每进程只说一次(同一份活配置一本账 —— 起服说过的名,目录落地 / 「无中心配置」档回到 env 表时不再说)。
+ *
+ * ## 在哪说(位置即判据,与「配了 $ 天花板但目录未定价」那一句同一条纪律)
+ *  · 起服:模型表**定形之后**(装配第 2 段目录应用之后的不变量区末尾、run-local 配置源应用之后的同一位置)—— 不在 `loadConfig` 里说:那一拍只见 env 表,
+ *    目录随后在 boot 被采纳时 env 表整张不服务,在那里说就是对一只不会服务的模型报警(行里还会说 `GET /v1/models` 有它的行,而那一行并不存在)。
+ *  · 运行中:每次模型面 commit 之后(目录换代、迟到的 boot 目录、「无中心配置」档回到 env 表 —— `applyEffective` 一处)。
+ * 严格名册布防时 env 表是占位、从不被派发(`isRosterGateArmed`;路由判官对它豁免的同一个事实)⇒ env 表在服时不说。
+ *
+ * ## 哪些名
+ * 别名(`default` 与某个本名指向同一只模型)不另说;目录里真有一条**叫** `default` 的条目(不是别名)照说。
+ */
+import type { Model } from "@sema-agent/core";
+import { type ContextWindowSource } from "./model-context-window.js";
+/** 发声器读的那几格活配置(结构子集;`ServiceConfig` 满足)。 */
+export interface AssumedWindowView {
+    readonly model: Model;
+    readonly envModel: Model;
+    readonly models: Readonly<Record<string, Model>>;
+    readonly contextWindowSources: Readonly<Record<string, ContextWindowSource>>;
+}
+export declare function warnAssumedContextWindows(config: AssumedWindowView, logger: {
+    warn(event: string, fields?: Record<string, unknown>): void;
+} | undefined, opts: {
+    readonly envTableIsPlaceholder: boolean;
+}): void;
+//# sourceMappingURL=context-window-notice.d.ts.map

package/dist/context-window-notice.js

@@ -0,0 +1,28 @@
+import { buildContextWindowAssumedNotice } from "./model-context-window.js";
+import { DEFAULT_MODEL_REF, servedModelTableLeg } from "./model-select.js";
+const assumedWindowNamesSaid = new WeakMap();
+export function warnAssumedContextWindows(config, logger, opts) {
+    if (logger === undefined)
+        return;
+    const leg = servedModelTableLeg(config);
+    if (leg === "env" && opts.envTableIsPlaceholder)
+        return;
+    const said = assumedWindowNamesSaid.get(config) ?? new Set();
+    assumedWindowNamesSaid.set(config, said);
+    const named = new Set(Object.entries(config.models).filter(([name]) => name !== DEFAULT_MODEL_REF).map(([, m]) => m));
+    for (const [name, m] of Object.entries(config.models)) {
+        if (name === DEFAULT_MODEL_REF && named.has(m))
+            continue;
+        if (said.has(name) || config.contextWindowSources[name] !== "assumed")
+            continue;
+        said.add(name);
+        const declareAt = leg === "catalog"
+            ? "the catalog entry's contextWindow (or MODEL_CONTEXT_WINDOW, which every entry without one inherits)"
+            : m === config.envModel
+                ? "MODEL_CONTEXT_WINDOW"
+                : "MODEL_CHEAP_CONTEXT_WINDOW (or MODEL_CONTEXT_WINDOW, which the cheap slot inherits)";
+        const notice = buildContextWindowAssumedNotice({ model: name, window: m.contextWindow, declareAt });
+        logger.warn(notice.event, notice.fields);
+    }
+}
+//# sourceMappingURL=context-window-notice.js.map

package/dist/deployment-governance.d.ts

@@ -58,15 +58,12 @@ export interface PathAdjudication {
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
     readonly taskHome?: string;
 }
-/** [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门的活体面探针(QuestionCoordinator 的切面)。 */
-export interface LiveQuestionFace {
-    hasLiveContext(): boolean;
-}
 /**
  * [ref] —— 审批基线的**席**:这条腿上「一个名单产的 `ask` 由谁来服」。闭集三形,每条腿**显式**说出自己那一形
  * ({@link createApprovalBaselinePolicy} 的席参数必填、按 `kind` 穷举 —— 闭集 +1 = 编译红):
- *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。AskUserQuestion 的问答门
- *    **只**叠在这一形上(它的 `ask` 语义就是 durable park)。
+ *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。core 的问答策略
+ *    (`createDurableQuestionPolicy()`,原形逐字)**只**叠在这一形上:它对引擎的问题工具答 `ask`,落点归 core 的同步优先
+ *    (有问题席 ⇒ 先投卡、席在窗内拿到答即交答;没拿到 ⇒ 停驻 —— 卡由活面呈出而窗走完的那一问除外:席抛,引擎的投递失败臂不停驻)。
  *  · `live`    —— Runner 的活 onAsk 席当场服 ask(run-local 的 `createLocalApprover`:TTY 问 y/N / 无 TTY 当场拒;
  *    core `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退,ask 落回调)。三张名单与 durable 席**同一只**策略。
  *  · `absent`  —— 没有谁服 ask ⇒ adjudicated allow-all;**只**服务零名单(HTTP 腿「durable 关 ∧ 单用户零意图」)。
@@ -79,11 +76,9 @@ export interface LiveQuestionFace {
 export type ApprovalSeat = DurableApprovalSeat | LiveApprovalSeat | AbsentApprovalSeat;
 /** 席的形名(补偿 warn 等只需要「哪一形」的读者读它,不必铸整只席)。 */
 export type ApprovalSeatKind = ApprovalSeat["kind"];
-/** durable 席:checkpoint suspend/resume 服 ask,问答门叠在名单策略上。 */
+/** durable 席:checkpoint suspend/resume 服 ask,core 的问答策略叠在名单策略上。 */
 export interface DurableApprovalSeat {
     readonly kind: "durable";
-    /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
-    readonly question: LiveQuestionFace | undefined;
     /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createSessionExemptionRead`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
     readonly exemption?: SessionExemptionRead;
 }
@@ -95,23 +90,6 @@ export interface LiveApprovalSeat {
 export interface AbsentApprovalSeat {
     readonly kind: "absent";
 }
-/**
- * [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
- * `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- * 活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
- * RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
- * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
- * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
- * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 「是不是引擎的问题工具」不在本层判:core 7.56.0 [ref] 起本门**组合** core 原形的答(它读调用的脸 —— 引擎挂载点 + 目录契约 id,不读名字;
- * 它答 `ask` ⇒ 是;本层只在那之上按活流分腿)。决断口的 pre-CAS 守卫(「批准问答必须带答」)仍按保留名读(core 同版「Not changed here」那一条)。
- * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
- * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
- * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
- * 自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
- * 语义;豁免注在彼处互指,接活体面之日必须并回本工厂。
- */
-export declare function createDurableQuestionGate(live: LiveQuestionFace | undefined): ToolPolicy;
 /**
  * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 交叉复审 round1 finding 1,红先复现)。
  *
@@ -266,8 +244,9 @@ export declare function buildApprovalGrantNotice(config: {
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
  * 三形,按席穷举([ref],席的定义见 {@link ApprovalSeat}):
- *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
- *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
+ *  · `durable` ⇒ core 的问答策略(原形逐字,不包)+ 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
+ *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend;问题族的 `ask` 先过 core 的同步优先
+ *    (问题席在窗内拿到答 ⇒ 交答;没拿到 ⇒ 停驻;活面呈出而窗走完 ⇒ 投递失败臂)—— 「有没有人」本口不预判,唯一判官是那一次投递的结局。
  *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
  *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。
  *  · `absent`  ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、

package/dist/deployment-governance.js

@@ -1,19 +1,6 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
-export function createDurableQuestionGate(live) {
-    const durable = createDurableQuestionPolicy();
-    if (live === undefined)
-        return durable;
-    return {
-        async check(req) {
-            const answer = await durable.check(req);
-            if (answer.action !== "ask")
-                return answer;
-            return live.hasLiveContext() ? { action: "allow" } : answer;
-        },
-    };
-}
 export const SANDBOX_TREE_FAMILY = "posix";
 function writeTargetFormOf(req) {
     if (!isProtectedWrite(req))
@@ -125,7 +112,7 @@ export function buildApprovalGrantNotice(config) {
 export function createApprovalBaselinePolicy(config, seat) {
     switch (seat.kind) {
         case "durable":
-            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat.exemption));
+            return combinePolicies(createDurableQuestionPolicy(), createApprovalListPolicy(config, seat.exemption));
         case "live":
             return createApprovalListPolicy(config, undefined);
         case "absent":

package/dist/deployment-shape.d.ts

@@ -105,36 +105,45 @@ export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
     principalRequired: DeploymentShapePredicate<"principal">;
     /**
      * 「这台部署有没有身份边界」的问法 —— 有 = 请求里有东西替主体作保或拦在门外:声明了 `REQUIRE_PRINCIPAL`,或配置接了任一已验身份来源
-     * (service 凭据 / 鉴权桥 issuer,含中心回退 / 直连门),或声明了只读 trace 凭据。没有 = dev-open:主体头是谁都能自报的标签。
+     * (service 凭据 / 鉴权桥 issuer,含中心回退 / 直连门),或声明了只读 trace 凭据。没有 = dev-open:主体头是谁都能自报的(不是认证;报了它的请求仍为那位主体)。
      * 只读配置(验签器在起服第 9 段按同一个配置读数建 ⇒「验签器在场」≡「配置里有桥」),所以先于验签器的起服段(第 3 段的一次性迁移)与请求面读到同一个答案。
-     * 读者:请求面的 dev-open 判据(`http/principal-gate.ts` 的 `devOpenDeployment`:属主存取器的 fleet 一格与 `/metrics` 族的免凭据臂)、
+     * 读者:请求面的 dev-open 判据(`http/principal-gate.ts` 的 `devOpenDeployment`,`actsForDeployment` 的一臂:不报主体的调用方在属主存取器的 fleet 一格与 `/metrics` 族上代部署本人)、
      * 一次性迁移 M48 的输入(`plugins/store-backend.ts`:有边界 ⇒ 不改写哨兵属主)。
      */
-    identityBoundary: DeploymentShapePredicate<"identity" | "principal">;
+    identityBoundary: DeploymentShapePredicate<"principal" | "identity">;
     /**
      * 租户轴的问法。今天与 {@link DEPLOYMENT_SHAPE_PREDICATES.principalRequired} 读**同一个声明**([ref] ①:托管 / 多租 ⇔ `REQUIRE_PRINCIPAL=true`,
      * 签发方配置是身份验签轴、不算租户证据)—— 两个问题、一根轴、一个读口;「鉴权必需」与「多租形」拆成两个声明时只改这一行的判官。
      */
     multiTenant: DeploymentShapePredicate<"principal">;
     /** 读能力表 `callerCwd` 位(host = 单主才开;device = 路径落在发起者自己的设备上,归属由根会话行执行格上的设备绑定验过,不要求单主)。 */
-    callerCwd: DeploymentShapePredicate<"lane" | "principal">;
+    callerCwd: DeploymentShapePredicate<"principal" | "lane">;
     /** 调用方给的宿主绝对路径(附加目录 / 项目上下文 / 本机 SendUserFile / 指令文件探针)只在「手就在本 worker 的盘上 ∧ 单主」时指向调用方自己的东西;
-     *  本机语言服务器(`createLspManager`:本机子进程、在 worker 盘上找根)同问这一句,读这一行 × `LSP_HOST_ENABLED`。 */
-    callerOwnsWorkerDisk: DeploymentShapePredicate<"lane" | "principal">;
+     *  本机语言服务器(`createLspManager`:本机子进程、在 worker 盘上找根)同问这一句,读这一行 × `LSP_HOST_ENABLED`。
+     *  local 店的声明(`local-store-declaration.ts` 的 `localStoreDeclarationOf`)同问这一句:店的数据根就在这块盘上,盘是调用方自己的且易失 ⇒ 部署不替他声明它活过替换。 */
+    callerOwnsWorkerDisk: DeploymentShapePredicate<"principal" | "lane">;
     /** wire `executionLane.toolsOnThisHost` 与出厂 / 中心技能的 `baseDir`:只问文件系统同一性,与租户无关(出厂内容每个租户拿到同一份)。 */
     toolsOnThisHost: DeploymentShapePredicate<"lane">;
     /** 无手形(声明 `none`;判据读执行环境块 `io`,不点名车道词)且单主:进程级消费者(hooks 命令、项目上下文本机读、卡批规则 root)看到的就是引擎自己的进程 cwd / env。 */
-    noHandsSingleUser: DeploymentShapePredicate<"lane" | "principal">;
+    noHandsSingleUser: DeploymentShapePredicate<"principal" | "lane">;
     /** 任务层替部署声明宿主姿态(bypassPermissions 开写面 / host shell 继承整份环境)的射程:device 车道上跨租户宿主穿越结构性不存在(clay 裁定③)。 */
-    taskHostPostureDeclarations: DeploymentShapePredicate<"lane" | "principal">;
+    taskHostPostureDeclarations: DeploymentShapePredicate<"principal" | "lane">;
     /** 写门走代理裁决(执行环境块 `hostLocalPaths` 为假:路径不是本 worker 盘上的文件);认不出的词 ⇒ 走代理(代理 slot 空 ⇒ 写门 fail-closed)。 */
     sandboxPathAdjudication: DeploymentShapePredicate<"lane">;
     /** 读能力表 `sandboxSendUserFile` 位(e2b / k8s 每任务一只沙箱 ⇒ 任何租户;ssh 共享一台真机 ⇒ 只单主)。 */
-    sandboxSendUserFile: DeploymentShapePredicate<"lane" | "principal">;
+    sandboxSendUserFile: DeploymentShapePredicate<"principal" | "lane">;
     /** 读能力表 `remoteScratchpad` 位(`/tmp/scratchpad/<sessionId>` 远端约定)。 */
     remoteScratchpad: DeploymentShapePredicate<"lane">;
+    /**
+     * 读能力表 `backgroundShell` 位 —— 「这条车道的执行环境能不能开后台 shell(`run_in_background` / `BashOutput` / `KillShell`),含把运行中的前台命令领养成后台任务」的**唯一**答者:
+     * e2b / k8s 每任务一只沙箱 ⇒ 任何租户;host(命令落在 worker 宿主上的同一张进程表)⇒ 只单主;其余车道(含 none)没有后台 shell;认不出的车道 ⇒ 否。
+     * 读者(同读这一行,没有第二份判别式):三只声明后台 shell 的适配器的 `backgroundCapabilities`(`supported` 与 `supportsDetach` 是同一个答案)、
+     * host 适配器的装配点(`boot/execution-env.ts` / `run-local.ts` 把行的答案交给适配器的 `backgroundShell`)、能力事实 `autoBackgroundOnTimeout`(`/health.autoBackgroundOnTimeout`)。
+     * 全局关停开关 `HOST_BG_ENABLED` 不在行里 —— 它是旋钮不是部署形,host 适配器与事实在行之上各合取一次。
+     */
+    backgroundShell: DeploymentShapePredicate<"principal" | "lane">;
     /** 读能力表 `tenantSeparation` 位(值来自 settings-schema 车道词表正本);唯一读者 = 跨域不变量 `multi-tenant-shared-lane`。 */
-    laneSeparatesTenants: DeploymentShapePredicate<"lane" | "principal">;
+    laneSeparatesTenants: DeploymentShapePredicate<"principal" | "lane">;
     /**
      * [ref] —— **VM 级**隔离强度(独立内核:e2b 的 Firecracker microVM;k8s 只在 Kata / gVisor 运行时类上)。与执行环境块 `isolation` 键
      * (OS 级边界,容器即算;wire `executionLane.isolated` 的属主 `laneIsolated`)是两个问题,所以不叫「isolated」。读者:A 值路由。
@@ -157,7 +166,7 @@ export declare const DEPLOYMENT_SHAPE_PREDICATES: Readonly<{
      *  · `none`:没有执行环境(能力事实先判无手车道,这里照样表态)。
      * 读者:能力事实 `sessionRewindFiles`(能力位与该口的 501 同读这一行)。
      */
-    rewindableWorkspace: DeploymentShapePredicate<"lane" | "principal">;
+    rewindableWorkspace: DeploymentShapePredicate<"principal" | "lane">;
 }>;
 export {};
 //# sourceMappingURL=deployment-shape.d.ts.map

package/dist/deployment-shape.js

@@ -63,6 +63,7 @@ export const DEPLOYMENT_SHAPE_PREDICATES = Object.freeze({
     sandboxPathAdjudication: createPredicate(["lane"], "车道:写门的路径事实要经代理到执行环境里取(文件平面不在本 worker 盘上;认不出的车道也走代理)。", ({ lane }) => lane.block === undefined || !lane.block.hostLocalPaths),
     sandboxSendUserFile: createPredicate(["lane", "principal"], "车道 × 租户:SendUserFile 的沙箱直传腿可以挂(沙箱盘 = 租户自己的任务工作区,或共享真机上的单主部署)。", ({ lane, principal }) => lane.caps !== undefined && capabilityHolds(lane.caps.sandboxSendUserFile, principal)),
     remoteScratchpad: createPredicate(["lane"], "车道:执行环境里按会话分的远端 scratchpad 约定适用。", ({ lane }) => lane.caps !== undefined && lane.caps.remoteScratchpad === "supported"),
+    backgroundShell: createPredicate(["lane", "principal"], "车道 × 租户:本车道的执行环境可以开后台 shell(含领养运行中的前台命令)—— e2b / k8s 任何租户,host 只单主,其余车道没有。", ({ lane, principal }) => lane.caps !== undefined && capabilityHolds(lane.caps.backgroundShell, principal)),
     laneSeparatesTenants: createPredicate(["lane", "principal"], "车道 × 租户:这条车道在这台部署上不让两个租户的命令落在同一个共享目标上(单主部署恒成立;认不出的车道不成立)。", ({ lane, principal }) => lane.caps !== undefined && capabilityHolds(lane.caps.tenantSeparation, principal)),
     vmIsolatedHands: createPredicate(["lane"], "车道 / 隔离强度:手跑在 VM 级边界里(独立内核);runc / 共享内核 / 真机 / 认不出 ⇒ 否。", ({ lane }) => {
         if (lane.lane === "e2b")

package/dist/device-ws-hub.d.ts

@@ -209,6 +209,7 @@ export interface DeviceWsHub {
     declaredSupports(deviceId: string): ReadonlySet<DeviceInstructionKind> | undefined;
     close(): Promise<void>;
 }
+export declare const DEVICE_MAX_PAYLOAD_PART_BYTES: number;
 /** per-remote 帽键的来源(闭集;指标 `device_preauth_key_total{source}` 与 cap-hit 行 `keySource` 同一张表)。 */
 export declare const DEVICE_PREAUTH_KEY_SOURCES: readonly ["socket", "xff", "fallback"];
 export type DevicePreAuthKeySource = (typeof DEVICE_PREAUTH_KEY_SOURCES)[number];