@sema-agent/server 7.3.0 → 7.4.0

package/dist/boot/resolve-spec.js

@@ -48,7 +48,7 @@ import { resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, coercePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, withPermissionMode } from "../task-settings.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
-import { LexicalPathExecutionEnv } from "./lexical-path-env.js";
+import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 /** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
  *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
  *  活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
@@ -866,7 +866,8 @@ export function createResolveSpec(ctx) {
         // [820]③ scratchpadDir, hoisted from the envFacts block below so the SAME per-session dir feeds BOTH the
         // `# Environment` fact and the fs-write gate's exemptDirs (single-source path via scratchpadDirFor inside
         // ensureScratchpadDir). HOST-semantics lanes only + session required — rationale at the envFacts consumer.
-        const hostSemanticsLane = config.remoteExec === undefined || config.remoteExec.provider === "host";
+        // 判别式单一真源:补集(沙箱裁决 lane)是写门代理与工厂装饰器的挂载条件,两处各写一份正是漂移的成因。
+        const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
         // G3([816]③/[820]③,[1840]§四):壳供 body.scratchpadDir 优先——壳(CC 形)有自己的 per-session
         // scratchpad 约定路径,接受后事实/豁免/根围栏三处同源指向壳的目录(壳侧提示词与 server 写门不再
         // 两个 scratchpad)。验收门 fail-closed(多租户/远程 lane/浅路径全拒收,warn 后回落自算)——
@@ -885,18 +886,14 @@ export function createResolveSpec(ctx) {
             //    target/dir 交给给定 env 的**真实 fs**(exists/canonicalPath/readLink,dist 亲读),所以 env 必须
             //    就是 hand 工具真正写的那块盘 —— 这里给 worker 本机的 NodeExecutionEnv(构造是纯字段赋值,不 spawn)。
             //
-            // ② 沙箱 lane(e2b/k8s/ssh/adb/local-docker,#156):沙箱 env 由 core 在 spec **之后**才铸
+            // ② 沙箱 lane(e2b/k8s/ssh/adb/local-docker,#165):沙箱 env 由 core 在 spec **之后**才铸
             //    (executionEnvFactory),spec 期把 worker 本机 env 递进去会拿**别人机器上的 fs 事实**裁决
-            //    (symlink/exists 全答错),而错误的 allow 比没有门更糟 —— 这就是 [816] 当年在这些 lane 上诚实
-            //    不挂门的理由(#153 的 ③ 号注把它记成余款)。过渡还款不是把本机 fs 递进去,而是换一个**没有 fs**
-            //    的裁决 env:LexicalPathExecutionEnv 只对 POSIX 绝对路径做词法归一,其余(相对路径/`~`/Windows 形)
-            //    一律「解析不出」⇒ core 落 ask。于是沙箱 lane 拿到「绝对路径按词法判、其余 fail-closed」的写门,
-            //    sensitivePatterns 的 deny 腿(按路径段词法匹配)与 isExempt 会话豁免探针(name-keyed,不做 fs
-            //    裁决)照常施加。**一个自动放行域都不铸**——两个候选域(cwd / scratchpad)各自的理由与代价写在
-            //    下面那条臂的注里,合起来的效果是 acceptEdits 在沙箱 lane 退化成与 default 同形(全 ask),与本段
-            //    ① 里 host factory lane 的哨兵先例同一个 fail-safe 方向。
-            //    已知残余面(symlink 形看不见)与终局 seam(core [2751] 给 HookToolContext 加只读 env 能力窄面,
-            //    排 174/#22 窗;到货后本过渡形整体退役换正解)成文在 lexical-path-env.ts 的文件头。
+            //    (symlink/exists 全答错),而错误的 allow 比没有门更糟。解法是把「取 env」推迟到裁决时刻:
+            //    `DeferredSandboxPathEnv` 是个代理,per-session slot 由工厂装饰器在铸 env 时填(boot/execution-env.ts
+            //    链尾),写门每次 canonicalize 都转发那台**真沙箱**的 exists/canonicalPath/fileInfo/readLink。
+            //    唯一不转发的是 `absolutePath`(相对路径基准之争,理由在下面那条臂与代理模块的文件头)。
+            //    cwd 仍不铸 ⇒ 无 acceptDirs、相对路径恒 ask;scratchpad 豁免按 host 同形补回(真 canonicalize
+            //    在场,软链逃逸形会落回真身裁决)。sensitivePatterns 的 deny 腿与 isExempt 会话豁免探针照常施加。
             //
             // 修5(三路复审 W4,cwd 基准漂移):gate 的 cwd 基准=与 hands 真跑处同源,分三形:
             //  · session 注册过 cwd(cwdHonored 已在注册处把关)⇒ 用它——与 host factory 的 effectiveHostWorkspace
@@ -948,34 +945,49 @@ export function createResolveSpec(ctx) {
                         ...gateCommon,
                     };
                 })()
-                : // 沙箱 lane(#156):无 fs 的词法裁决 env,且**刻意不给** cwd 与 scratchpadDir —— 两者都是
-                    // 「自动放行域」,而在纯词法规则下一个放行域就是本设计唯一可能产生**错误 allow** 的地方
-                    // (词法看不见 symlink:域内一个指向域外的软链会被判成域内)。其余裁决只会是 ask 或 deny。
+                : // 沙箱 lane(#165):裁决 env = `DeferredSandboxPathEnv` 代理 —— 裁决时刻(必在 prepare 之后)
+                    // 去 per-session slot 里取本 task 的**真沙箱 env**,转发 exists/canonicalPath/fileInfo/readLink。
+                    // 于是绝对路径的 symlink 真身、存在性都是真沙箱 fs 的事实,域内软链指向守卫段照样 deny;
+                    // slot 空/歧义 ⇒ 转发面报错 ⇒ core 判 `unresolvedSymlink` ⇒ 写门 ask + sensitive deny(fail-closed)。
                     //
-                    // ⚠️ 沙箱侧 scratchpad 的对应物**确实存在**(plugins/remote-scratchpad.ts:`/tmp/scratchpad/<sessionId>`,
-                    // e2b/k8s/local-docker/ssh 四 lane,由 factory 装饰器 lazy mkdir、并由下面的 envFacts 同源广告;
-                    // adb 无此约定)。这里**明知而不豁免**:host lane 的同一豁免是经真 fs canonicalize 过的(软链会被
-                    // 解到真身),词法版给不出同等保证,所以按 fail-closed 偏置落 ask。代价有界且可见——沙箱里写
-                    // scratchpad 会多一次询问,而不是任何功能坏掉;终局 seam(core [2751] 真 env 窄面)到货后应当把
-                    // 这条豁免按 host 同形补回。
-                    {
-                        env: new LexicalPathExecutionEnv(),
-                        ...gateCommon,
-                        // codex 复审 B(2026-08-05,dist 亲读+实测):core 的 canonicalizeTarget 把反斜杠 UNC 形在**入口**
-                        // 短路成 ok:true/key=原样——不经本 env,canon 便「成功」,gate 随后就咨询豁免探针;name-keyed
-                        // 命中即 allow,「非 POSIX 绝对形一律 ask」就被豁免会话越过(相对形/盘符形没这个洞:它们的
-                        // canon 失败先于豁免咨询)。沙箱臂因此给探针加 canonical-key 守门:只有 `/` 开头(=真经过
-                        // LexicalPathExecutionEnv 词法归一)的 key 才享豁免,其余落回 defaultWrite 的 ask。host 臂不加
-                        // (真 fs canonicalize 的 key 可信,[841]① 原契约不动)。
-                        ...(gateCommon.isExempt
-                            ? {
-                                isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
-                            }
-                            : {}),
-                    };
+                    // **`cwd` 仍不给**(显式裁定,非过渡欠款):`cwd` 同时是 core 的 `rootPath`(相对路径基准)与
+                    // acceptEdits 的 accept 域。沙箱里那个基准是 engine 跟踪的 cwd,不是 env 自己的 cwd,server 侧要
+                    // 铸它得先建一个 per-task 跟踪面——那是独立一件(与 host 臂哨兵同族的漂移风险)。后果:相对路径
+                    // 恒 ask,acceptEdits 在沙箱 lane 与 default 同形(全 ask),fail-safe 方向。
+                    //
+                    // **scratchpad 豁免按 host 同形补回**:`/tmp/scratchpad/<sessionId>`(remote-scratchpad.ts 单一
+                    // 真源,e2b/k8s/local-docker/ssh 四 lane;adb 无此约定故无豁免)。#156 当年不豁免是因为词法版
+                    // 看不见软链——域内一个指向域外的软链会被判成域内;现在 exemptDirs 与写目标两侧都过真
+                    // canonicalize,逃逸形会解出域外真身而落回真身裁决,host lane 的同一保证在这里成立了。
+                    // 注:远程 lane 的**根围栏**admit 走的是 core 对 `spec.envFacts.scratchpadDir` 的自建根(prepare 期
+                    // canonicalize/实体化),而那条事实在 `SANDBOX_ENV_FACTS=false` 下不发——那种配置里根围栏先拒,
+                    // 本豁免够不着(方向更严,不是放行面);host 臂的 additionalDirectories 折叠不受影响。
+                    (() => {
+                        const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
+                        return {
+                            env: new DeferredSandboxPathEnv({
+                                sessionId: auth?.sessionId,
+                                slots: sandboxPathEnvSlots,
+                                logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
+                            }),
+                            ...gateCommon,
+                            ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
+                            // codex 复审 B(2026-08-05,dist 亲读+实测):core 的 canonicalizeTarget 把反斜杠 UNC 形在**入口**
+                            // 短路成 ok:true/key=原样——不经本 env,canon 便「成功」,gate 随后就咨询豁免探针;name-keyed
+                            // 命中即 allow,「非 POSIX 绝对形一律 ask」就被豁免会话越过(相对形/盘符形没这个洞:它们的
+                            // canon 失败先于豁免咨询)。沙箱臂因此给探针加 canonical-key 守门:只有 `/` 开头(=真经过本
+                            // 代理的路径面)的 key 才享豁免,其余落回 defaultWrite 的 ask。host 臂不加
+                            // (真 fs canonicalize 的 key 可信,[841]① 原契约不动)。
+                            ...(gateCommon.isExempt
+                                ? {
+                                    isExempt: (toolName, canonicalPath) => canonicalPath.startsWith("/") ? gateCommon.isExempt(toolName) : false,
+                                }
+                                : {}),
+                        };
+                    })();
             // [1248]②/codex F2 — the workflow ask leg's session-exemption probe. Name-keyed and never fs-adjudicated,
             // so it was on EVERY lane from day one (the fs gate has been too since #156, by a different route: a
-            // lexical env rather than no gate). Same store + canonical toolName key space as the
+            // lane-specific adjudication env rather than no gate). Same store + canonical toolName key space as the
             // fs-gate probe — one remember="session" grant serves both; without it the durable lane re-parks every
             // later run_workflow call after an operator already granted "don't ask again this session".
             const workflowGate = approvalExemptionStore && auth?.sessionId

package/dist/capabilities/center-prompts.js

@@ -22,6 +22,7 @@
 import { verifyPromptArtifact } from "@sema-agent/core";
 import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 /** 判形半场(validateCenterPrompts/validatePromptsDomain/CORE_ENGINE_VERSION 及两 interface)已下沉到
  *  中立叶子 `src/prompts-domain-validate.ts`(design/158 S6);消费者直引真源([2354] 兼容面全清,
  *  此处兼容 re-export 已删)。 */
@@ -56,7 +57,9 @@ export function withPromptArtifactBackfill(inner, fetchRaw, log) {
                         log.warn("center_prompts_backfill_rejected", { digest: canonical, ...(v.ok ? { got: v.artifact.artifactDigest, code: "digest_mismatch" } : { code: v.code, reason: v.reason }) });
                         return undefined;
                     }
-                    await inner.put(raw).catch(() => undefined); // cache best-effort
+                    // cache best-effort —— #157:F 类兜底(工件已验签且已返回;失败的代价只是下次再取一次网络),
+                    // 留痕是为了让"缓存其实一直没写成"不必靠回填流量异常来发现。
+                    await inner.put(raw).catch(() => recordFailOpen("server.prompts.artifact-cache-write-failed", `digest=${canonical}`));
                     log.info("center_prompts_backfilled", { digest: canonical });
                     return raw;
                 }

package/dist/capabilities/oa-tools.d.ts

@@ -0,0 +1,15 @@
+import type { ToolSpec } from "@sema-agent/core";
+/**
+ * OA scenario — tools are thin HTTP clients to the OA backend's existing APIs (read = /api/v1/*,
+ * write = /api/assets/*). The shared service token + the request's principal are forwarded so OA
+ * enforces THAT end-user's RBAC + audit (the service never holds per-user creds). Decoupled: the
+ * service knows no OA schema/DB — OA stays the source of truth (its /api/v1/meta is self-describing).
+ */
+export interface OaCtx {
+    baseUrl: string;
+    token: string;
+    principal?: string;
+}
+export declare function oaTools(ctx: OaCtx): ToolSpec[];
+export declare const oaPrompt: import("@sema-agent/core").PromptProvider;
+//# sourceMappingURL=oa-tools.d.ts.map

package/dist/capabilities/oa-tools.js

@@ -0,0 +1,54 @@
+import { Type } from "typebox";
+import { stablePrompt } from "./prompt.js";
+async function oaFetch(ctx, path, init) {
+    if (!ctx.baseUrl || !ctx.token)
+        return "OA 后端未配置(OA_API_BASEURL / OA_SERVICE_TOKEN)";
+    try {
+        const res = await fetch(ctx.baseUrl + path, {
+            method: init?.method ?? "GET",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${ctx.token}`,
+                ...(ctx.principal ? { "x-agent-principal": ctx.principal } : {}),
+            },
+            body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
+        });
+        const text = await res.text();
+        if (!res.ok)
+            return `OA ${res.status}: ${text.slice(0, 600)}`;
+        return text.slice(0, 60_000);
+    }
+    catch (e) {
+        return `调用 OA 失败：${e.message}`;
+    }
+}
+const needWrite = (ctx) => (!ctx.principal ? "缺少身份(principal)，无法代表用户写库；请让调用方带上 x-agent-principal。" : null);
+export function oaTools(ctx) {
+    const obj = Type.Object({}, { additionalProperties: true });
+    return [
+        { name: "oa_schema", effect: "read", description: "取 OA 数据结构(每类资产的字段/必填/条件必填 requiredWhen/联动 showWhen/枚举、生命周期、表名)。建/改前先调它，别凭记忆。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/meta") },
+        { name: "oa_alerts", effect: "read", description: "派生告警：GP 闲置(已注册未变现) / APP 未上架(已接广告未 LIVE)。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/alerts") },
+        { name: "oa_list", effect: "read", description: "列出某类资产。type∈gp/package/ad-platform/ad-unit/email/environment/proxy。可选 q 关键字。", parameters: Type.Object({ type: Type.String(), q: Type.Optional(Type.String()) }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}${x.q ? `?q=${encodeURIComponent(x.q)}` : ""}`); } },
+        { name: "oa_get", effect: "read", description: "取某资产详情(敏感字段为掩码)。", parameters: Type.Object({ type: Type.String(), id: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`); } },
+        { name: "oa_lookup", effect: "read", description: "约定字段值反查(同手机/证件=同一实物)。field: phone|idCardNo|bizLicenseNo。", parameters: Type.Object({ field: Type.String(), value: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/lookup?field=${encodeURIComponent(x.field)}&value=${encodeURIComponent(x.value)}`); } },
+        { name: "oa_create", effect: "write", description: "创建实体(走 OA 校验+当前用户 RBAC+审计)。type + data(字段对象，参照 oa_schema)。失败会返回缺失/非法字段。", parameters: Type.Object({ type: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}`, { method: "POST", body: x.data ?? {} }); } },
+        { name: "oa_update", effect: "write", description: "改字段(敏感留空=保持原值；状态字段改不动，用 oa_transition)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`, { method: "PATCH", body: x.data ?? {} }); } },
+        { name: "oa_transition", effect: "write", description: "受控状态流转(先 oa_schema 看可用迁移；风险/弃用等需 note)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), to: Type.String(), note: Type.Optional(Type.String()) }), execute: (a) => { const e = needWrite(ctx); if (e)
+                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}/transition`, { method: "POST", body: { to: x.to, note: x.note ?? null } }); } },
+    ];
+}
+// OA business prompt MOVED OUT — migration complete (design/29, 2026-06-05). Persona / 工作准则 / UI
+// markers (::FORM:: / ::GOTO:: / ::SUGGEST:: / ::ISSUE_FORM::) / 分级确认 / 报bug流程 are OA's business,
+// and OA now injects the WHOLE thing per request via `request.systemPrompt` (it holds the service token,
+// content is stable per OA version → cacheable prefix; page context still rides `objective`). Keeping
+// any of it here would just DUPLICATE OA's prompt, so the base is EMPTY — single source of truth = OA.
+// The service stays business-agnostic: it provides the oa_* tools (referenced by NAME from OA's prompt;
+// they carry their own descriptions) and nothing else. `stablePrompt` keeps STABLE→VARIABLE order —
+// OA's systemPrompt is appended after this (empty) base, before core's <user_memory>.
+// (::ISSUE_FORM:: is parsed/rendered + submitted entirely by OA's frontend via OA /api/ai/issue — the
+//  service never touches it; `open_gitea_issue` remains only as the unattended/automated fallback.)
+const OA_SYSTEM = "";
+export const oaPrompt = stablePrompt(OA_SYSTEM);
+//# sourceMappingURL=oa-tools.js.map

package/dist/config-types.d.ts

@@ -9,6 +9,7 @@ import type { SealedKeyPoison } from "./sealed-key.js";
 import type { McpServerSpec, Model, ModelRoles } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
+import type { QuestionThrottle } from "./question.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 /** A sema-registry MCP server resolved to a core spec (env-NAME refs already → real values) plus the
@@ -831,6 +832,12 @@ export interface ServiceConfigFlat {
      *  stream (the durable-suspend leg is wired separately). A CC cap → posture-gated (single-user turnkey →
      *  ON; multi-tenant opt-in); `ASK_QUESTION_ENABLED=true/false` overrides. */
     askQuestionEnabled: boolean;
+    /** #166 裁2:AskUserQuestion 的**裁量窗**——每 run 腿的并发帽 / 总量帽 / 无人应答的释放窗。窗用尽或到期
+     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core。
+     *  `QUESTION_MAX_CONCURRENT_PER_RUN`(默认 2)/ `QUESTION_MAX_TOTAL_PER_RUN`(20)/ `QUESTION_TTL_MS`
+     *  (300000),越界值启动期响亮拒(照 `MCP_ELICITATION_*` 同门,不静默夹取)。缺席 ⇒ 协调器出厂窗
+     *  {@link import("./question.js").DEFAULT_QUESTION_THROTTLE}(与本旋钮族默认逐字同值)。 */
+    questionThrottle?: QuestionThrottle;
     /** [816]/[820]② live tool-approval HITL — mount the ToolApprovalCoordinator on `RunnerDeps.onAsk` + the
      *  `POST /v1/tool-approvals/:id/respond` route so a policy `ask` (the fs-write gate, ask-lists, non-durable safety
      *  asks) routes to the live human as the CC three-choice card on the run's stream (core 1.290 sync-ask leg). A CC
@@ -975,7 +982,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "toolApprovalEnabled" | "streamAskWindowMarginMs" | "streamApproval" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "streamAskWindowMarginMs" | "streamApproval" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "memoryOrgAdmissionMode" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -5,6 +5,7 @@ import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, pr
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
+import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 function csv(name) {
     return (process.env[name] ?? "")
         .split(",")
@@ -998,6 +999,13 @@ function parseApprovalDomain(ctx) {
             },
         },
         askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"), // §4④ AskUserQuestion live HITL; posture-gated (single-user → ON)
+        // #166 裁2:AskUserQuestion 裁量窗三旋钮,姿势照 MCP_ELICITATION_* 抄(bounded ⇒ 越界启动期拒,不静默
+        // 夹取)。默认值 = 协调器出厂窗逐字(纯旋钮化,零行为改动)。
+        questionThrottle: {
+            maxConcurrentPerRun: numEnvBounded("QUESTION_MAX_CONCURRENT_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxConcurrentPerRun), 1, 64),
+            maxTotalPerRun: numEnvBounded("QUESTION_MAX_TOTAL_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxTotalPerRun), 1, 10_000),
+            ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
+        },
         toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
         // #151 车2(design/172 §3.3 D3):ToolApprovalCoordinator 窗长三元的安全余量。numEnv fail-loud 形,
         // 照邻居旋钮(approvalTimeoutSec 等)抄——坏形（非数字)在启动期炸,不静默折成 NaN。
@@ -1483,7 +1491,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "askQuestionEnabled", "toolApprovalEnabled", "streamAskWindowMarginMs", "streamApproval", "mcpElicitation",
+    "resourceSuspendTtlSec", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "streamAskWindowMarginMs", "streamApproval", "mcpElicitation",
     "sensitiveWritePatterns", "manualModeShellGate",
 ];
 const MEMORY_GROUP_KEYS = [

package/dist/elicitation.js

@@ -27,6 +27,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, delimitUntrusted } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Size bounds on the UNTRUSTED server-controlled payload (the throttle bounds COUNT, these bound SIZE — an
  *  opted-in-but-hostile server otherwise amplifies a multi-MB prompt/schema into the durable log + SSE socket).
  *  The message is a human-facing prompt (a few KB is ample); a requestedSchema over the cap is dropped (the form
@@ -187,6 +188,8 @@ export class ElicitationCoordinator {
             rc.lastByServer.set(req.server, t);
         }
         catch {
+            // #157:投递失败 ⇒ decline。方向已是 fail-closed(问不到人就是拒),缺的只是留痕。
+            recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
             settle({ action: "decline" }); // inflight rolled back in settle
         }
         const answer = await answerP;
@@ -195,7 +198,8 @@ export class ElicitationCoordinator {
         // ordering-uncritical: the shell already has the answer via respond; a late/lost dismiss is cosmetic.
         void Promise.resolve()
             .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() }))
-            .catch(() => undefined);
+            // #157:F 类兜底,与 question.ts 的孪生面同形同 tag 形(丢收尾渲染,不丢答案)。
+            .catch(() => recordFailOpen("server.elicitation.complete-breadcrumb-dropped", `elicitation=${id}`));
         return answer;
     };
     /** `POST /v1/elicitations/:id/respond` — resolve a parked elicitation with the shell's answer. Owner-gated with a

package/dist/finance/cost-taxonomy.d.ts

@@ -0,0 +1,34 @@
+export interface InfraCostRates {
+    toolCallMicroUsd: number;
+    sandboxSecMicroUsd: number;
+    egressGbMicroUsd: number;
+}
+export interface InfraUsage {
+    toolCalls: number;
+    sandboxWalltimeMs: number;
+    egressBytes: number;
+}
+export interface InfraCostBreakdown {
+    toolCallMicroUsd: number;
+    sandboxWalltimeMicroUsd: number;
+    egressMicroUsd: number;
+    totalMicroUsd: number;
+}
+export interface LlmCostBreakdown {
+    llmRootMicroUsd: number;
+    nestedSubagentMicroUsd: number;
+    memoryConsolidationMicroUsd: number;
+    compactionMicroUsd: number;
+}
+export interface SupervisorCostBreakdown {
+    llm: LlmCostBreakdown | null;
+    infra: InfraCostBreakdown;
+    totalMicroUsd: number;
+}
+export declare function infraCost(usage: InfraUsage, rates: InfraCostRates): InfraCostBreakdown;
+export declare function composeSupervisorCost(llm: LlmCostBreakdown | null, llmTotalMicroUsd: number, infra: InfraCostBreakdown): SupervisorCostBreakdown;
+export declare function hasInfraPricing(r: InfraCostRates): boolean;
+export declare function infraUsageFromEvents(events: ReadonlyArray<{
+    type?: string;
+}>, runDurationMs: number): InfraUsage;
+//# sourceMappingURL=cost-taxonomy.d.ts.map

package/dist/finance/cost-taxonomy.js

@@ -0,0 +1,26 @@
+const nonNeg = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+export function infraCost(usage, rates) {
+    const toolCallMicroUsd = nonNeg(usage.toolCalls) * nonNeg(rates.toolCallMicroUsd);
+    const sandboxWalltimeMicroUsd = (nonNeg(usage.sandboxWalltimeMs) / 1000) * nonNeg(rates.sandboxSecMicroUsd);
+    const egressMicroUsd = (nonNeg(usage.egressBytes) / 1_000_000_000) * nonNeg(rates.egressGbMicroUsd);
+    return {
+        toolCallMicroUsd,
+        sandboxWalltimeMicroUsd,
+        egressMicroUsd,
+        totalMicroUsd: toolCallMicroUsd + sandboxWalltimeMicroUsd + egressMicroUsd,
+    };
+}
+export function composeSupervisorCost(llm, llmTotalMicroUsd, infra) {
+    return { llm, infra, totalMicroUsd: nonNeg(llmTotalMicroUsd) + infra.totalMicroUsd };
+}
+export function hasInfraPricing(r) {
+    return r.toolCallMicroUsd > 0 || r.sandboxSecMicroUsd > 0 || r.egressGbMicroUsd > 0;
+}
+export function infraUsageFromEvents(events, runDurationMs) {
+    return {
+        toolCalls: events.reduce((n, e) => (e.type === "tool_start" ? n + 1 : n), 0),
+        sandboxWalltimeMs: nonNeg(runDurationMs),
+        egressBytes: 0,
+    };
+}
+//# sourceMappingURL=cost-taxonomy.js.map

package/dist/hooks/hook-runner.js

@@ -706,6 +706,10 @@ export function createTaskHooks(config, ctx) {
             let currentInput = input;
             let rewritten = false;
             let asked;
+            // #157 fail-open 治理(P 类,tag `server.hooks.pretooluse-unknown-permission-word`):本轮见过
+            // 词表外的 `permissionDecision`。安全域闭集词表的 miss 不是"没意见"——钩子作者**表过态**,只是
+            // 用了我们不认识的词;把它折成放行等于替他改判。置位后禁止本轮铸 `action:"allow"`(见末尾折叠)。
+            let unknownDecision = false;
             const contexts = [];
             const deadlineAt = Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000; // 跨全部组的事件级预算
             // 逐条串行(deny 立即短路;updatedInput 串进后续条目 payload——确定性优先,CC 的并行聚合语义
@@ -771,6 +775,18 @@ export function createTaskHooks(config, ctx) {
                                 rewritten = true;
                             }
                         }
+                        else if (decision !== "deny" && decision !== "ask") {
+                            // 闭集 miss(拼错大小写的 deny / 自造词 / 非字符串 / null)。该条目的裁决**整条不采信**:
+                            // 它的 updatedInput 也不进串(上面的 if 已排除),并置位禁 allow。CC 的 `allow`/`deny`/
+                            // `ask` 三词是唯一词表;新词入表须同时进这里,否则它在本仓的语义就是"不采信"。
+                            unknownDecision = true;
+                            ctx.logger.warn("hook_permission_decision_unknown", {
+                                event: "PreToolUse",
+                                decision: clip(typeof decision === "string" ? decision : typeof decision, 200),
+                                tool: toolName,
+                                effect: "hook ruling not honored (closed word set is allow|deny|ask); this call falls back to the engine gate",
+                            });
+                        }
                     }
                 }
             }
@@ -785,6 +801,22 @@ export function createTaskHooks(config, ctx) {
                     ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
                 };
             }
+            if (unknownDecision) {
+                // #157:本轮有一条**不采信**的裁决 ⇒ 一律折 `ask`(人在环)。两条都不行,各有其害:
+                //  · `allow` —— 显式放行短路,引擎门不再裁决,等于替钩子作者把 DENY 改判成放行;
+                //  · `undefined`(无裁决)—— 看着中立,其实**不是** fail-closed(codex 复审 HIGH,2026-08-07):
+                //    引擎拿到无裁决就走普通门,而 bypassPermissions / acceptEdits 档下普通门就是放行,
+                //    钩子作者写的 DENY 照样跑。词表 miss 的语义是「保护型判词坏了」而不是「钩子没表态」。
+                // 已有改写则随 `ask` 投递:改写通常正是 redact/clamp,丢了它 approve 后执行的是【原始】args
+                // —— `ask` 是唯一既 fail-closed 又能带 updatedInput 的裁决形。不采信的那条自己的改写不在其中
+                // (上面的 if 已把它挡在串外),否则一个坏判词就是一条免审的 args 改写通道。
+                return {
+                    action: "ask",
+                    message: "a PreToolUse hook returned an unrecognized permissionDecision — approval required",
+                    ...(rewritten ? { updatedInput: currentInput } : {}),
+                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                };
+            }
             if (rewritten || contexts.length > 0) {
                 return {
                     action: "allow",

package/dist/http/routes/diagnostics.d.ts

@@ -0,0 +1,84 @@
+/**
+ * #154 件二+件三 —— **装配自证**域:启动期静态自检(拒启判据)与 operator 诊断读面
+ * (`GET /v1/diagnostics/wiring`)。
+ *
+ * 🔴 两件为什么同住一个模块:它们回答的是同一个问题(「这台 worker 到底接了什么线」),只是一个在 boot
+ * 用它拒绝启动、一个在运行期把它读给 operator。分成两处 = 拒启用的判据与诊断报的读数会各自演化,而
+ * 「拒启说没矛盾、诊断页显示矛盾」正是本设计要消灭的那类装配谎言。故 boot 半场是本文件导出的**纯函数**
+ * (可单测、无 I/O),路由半场只是它的读口。
+ *
+ * 分层:本模块不值 import `server.ts`(那条边会闭合运行时装载环),对它只有 `import type`。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { WiringManifest } from "@sema-agent/core";
+import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";
+import type { RouteCtx } from "../route-ctx.js";
+/** 流内审批门的读数形:上场即 `"active"`,否则是那五个合取项里**第一个**不满足的原因词
+ *  (与 `resolveStreamApprovalGate` 同一闭集,新增 reason 在此处编译红)。 */
+export type StreamApprovalGateReading = "active" | Extract<StreamApprovalGate, {
+    active: false;
+}>["reason"];
+/** server 自己的装配谓词读数(core 的静态半场之外的那一半:本仓在这台 worker 上做出的判断)。 */
+export interface ServerWiringGates {
+    streamApproval: StreamApprovalGateReading;
+    durableApproval: boolean;
+    checkpointStore: boolean;
+}
+/** `buildServerWiringGates` 的入参 = 三个谓词各自的**真输入**(不接受已算好的布尔:那样这里读到的就
+ *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
+export interface ServerWiringGateInput {
+    toolApprovalEnabled: boolean;
+    streamApprovalEnabled: boolean;
+    /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
+    backend: StreamApprovalGateInput["backend"];
+    /** 在场性即事实;本面不取实例,故 `unknown` 足够(取窄型会把整棵 store 类型树拖进诊断域)。 */
+    checkpointStore: unknown;
+    durableApproval: boolean;
+}
+/** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
+ *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个
+ *  符号,所以诊断页读到的与消费端撞到的行为不可能不同。 */
+export declare function buildServerWiringGates(input: ServerWiringGateInput): ServerWiringGates;
+/** 启动自检的判决:`refusals` 非空 ⇒ 拒启(装配谎言);`warnings` ⇒ 留痕但放行。 */
+export interface StaticWiringAudit {
+    refusals: readonly string[];
+    warnings: readonly string[];
+}
+/** 自检输入 = core 的静态半场 + 我方装配现场的两件事实。 */
+export interface StaticWiringFacts {
+    /** core `describeStaticWiring(deps, specTemplate)` 的产物。 */
+    manifest: WiringManifest;
+    /** 我方喂给 `resolveStreamApprovalGate` 的 `parkFacility` 实参(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
+    parkFacility: boolean;
+    /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
+    backendKind: "mysql" | "pg" | "local" | undefined;
+}
+/**
+ * 三项对表(设计稿件二)。判据全是**两个独立谓词对同一件事的答案**,矛盾即装配谎言 —— 装配谎言不是
+ * 「配置不理想」,是「服务端对自己接了什么线的两套说法互斥」,继续启动只会把矛盾带进运行期的每一条腿。
+ *
+ *  ① park 设施:core 从 `spec.checkpointStore ?? deps.checkpointStore` 判 `parkLane.capable`,我方从
+ *     `backend.checkpoint ∧ DURABLE_APPROVAL` 判 `parkFacility` 并据此决定流内审批协议上不上场。两者
+ *     不等 ⇒ 协议按「窗到期能 park」上场而引擎侧根本不 park(结局是 core fail-closed deny),或反之
+ *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
+ *     park,窗到期依旧无降级目的地。
+ *  ② 会话店持久性:manifest 声明 `declared_durable` 而后端是 local / 根本没有后端 ⇒ 「重启存活」的声明
+ *     没有介质兑现。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。
+ *  ③ interaction posture 声明 `interactive` 却没有任何 question 投递面 ⇒ 只 **warn**:core 在 prepare 时
+ *     会按腿拒,boot 先一步把话说成人话。不拒启,因为部署形本身可能只是暂时没接活体面,而 core 侧已有
+ *     兜底门 —— 拒启会把一个可运行的部署挡在门外。
+ *  ④ park 车道的持久性读数不可信时 ⇒ **warn**(理由与这条判据为什么不是拒启,见其行内注)。
+ *
+ * 判决分两级是有判据的:**拒启**留给「两个谓词对同一件事互斥」(其中一个必错,继续跑就是带着谎言服务);
+ * **警告**留给「读数不可信/声明不完整」(信号本身还不足以断定谁错,据此拒启会挡住正常部署)。
+ */
+export declare function buildStaticWiringAudit(facts: StaticWiringFacts): StaticWiringAudit;
+/**
+ * boot 消费口:`refusals` 非空即抛(拒启,与 memory+durable 两条既有拒启同族的 fail-loud 形),
+ * `warnings` 逐条 warn。返回判决本体,调用方可以继续把读数打进启动 info 行。
+ */
+export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, logger: {
+    warn: (msg: string, meta?: Record<string, unknown>) => void;
+} | undefined): StaticWiringAudit;
+export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=diagnostics.d.ts.map