@sema-agent/server 7.4.0 → 7.6.0

package/dist/boot/resolve-spec.d.ts

@@ -1,9 +1,10 @@
-import { type MemoryBackend, type RunnerDeps, type ToolPolicy } from "@sema-agent/core";
+import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
 import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
 import type { ServiceConfig } from "../config.js";
+import { type LiveQuestionFace } from "../deployment-governance.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type HookLlmCall } from "../hooks/hook-runner.js";
 import type { createHookLlm } from "../hooks/hook-llm.js";
@@ -58,9 +59,7 @@ export interface ResolveSpecCtx {
     /** #152 ([2703] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=
      *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME
      *  (否则 spec.onQuestion 恒遮蔽 RunnerDeps.onQuestion 的活人腿);缺席时行为与旧形逐字一致。 */
-    liveQuestionFace: {
-        hasLiveContext(): boolean;
-    } | undefined;
+    liveQuestionFace: LiveQuestionFace | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
@@ -69,21 +68,6 @@ export interface ResolveSpecCtx {
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;
 }
-/** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
- *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- *  活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
- *  RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
- *  durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留(此时执行只会拿到 headless
- *  空答,park 才是把问题送到人面前的那条腿)。
- *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
- *  ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
- *  地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
- *  只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
- *  自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
- *  语义;豁免注在彼处互指,接活体面之日必须并回本工厂。 */
-export declare function createDurableQuestionGate(live: {
-    hasLiveContext(): boolean;
-} | undefined): ToolPolicy;
 export declare function createResolveSpec(ctx: ResolveSpecCtx): ServiceDeps["resolveSpec"];
 export {};
 //# sourceMappingURL=resolve-spec.d.ts.map

package/dist/boot/resolve-spec.js

@@ -19,14 +19,14 @@
  */
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, expandTiers, tightenTaskSpec } from "@sema-agent/core";
-import { createDurableAskPolicy } from "../approval.js";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, expandTiers, tightenTaskSpec } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { gateScenarioRequest, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
+import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -49,33 +49,25 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSet
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-/** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
- *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- *  活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
- *  RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
- *  durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留(此时执行只会拿到 headless
- *  空答,park 才是把问题送到人面前的那条腿)。
- *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
- *  ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
- *  地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
- *  只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
- *  自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
- *  语义;豁免注在彼处互指,接活体面之日必须并回本工厂。 */
-export function createDurableQuestionGate(live) {
-    if (live === undefined)
-        return createDurableQuestionPolicy();
-    return {
-        check(req) {
-            if (req.toolName !== "AskUserQuestion")
-                return { action: "allow" };
-            return live.hasLiveContext()
-                ? { action: "allow" }
-                : { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };
-        },
-    };
-}
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, } = ctx;
+    // ── #177 的两件 boot 期收口(把守卫集搬到 governance 拍之后才成立的两条)────────────────────────
+    //
+    // ① 守卫集的**编译**从此每个请求都发生(旧家只在 default/auto/acceptEdits 三个模式臂里发生)。
+    //    非法旋钮值必须当场炸在启动上而不是每任务一条 500 —— 判据与文案随 design/181 件一搬进构造口
+    //    (`assertGuardPatternsUsable`),赎回腿/run-local 装配时调同一只,三腿同得。
+    assertGuardPatternsUsable(config);
+    // ② governance 拍的 DENY 基线让 `spec.toolPolicy` 在**任何**客户端表态下都在场,于是 core 的
+    //    「write-capable hand tools are present but UNGATED」那条 onError 不再触发(core 判据是
+    //    `policyLayers.length > 0`,prepare-task dist 亲读)。它此前是「部署一个门都没接」这个 misconfig
+    //    的唯一信号,而守卫集只挡那二十来个路径段、其余写目标照旧无裁决 —— 信号不能因为本件静默消失。
+    //    条件 = 两条产 toolPolicy 的腿都不在场(durable 门关 ∧ 单用户 auto-accept 基线不适用),即修前
+    //    `spec.toolPolicy` 恒缺席的那一形;三个量都是 boot 常量,所以这里说一次而不是每任务说一次。
+    //    判据与文案随 design/181 件三搬进构造口(`buildOnlySensitiveBaselineWarning`),run-local 腿调同
+    //    一只 —— 本处零行为变化(条件与字段逐字同前)。
+    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
+    if (onlySensitiveBaseline)
+        logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
     // Deployment-owned mapping. Tools/prompt/skills come from the selected scenario (assembled once,
     // bound per request); identity/session/policy stay server-side. Never taken from the request body.
     // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
@@ -564,8 +556,9 @@ export function createResolveSpec(ctx) {
             // [1144]/[1146] (core 1.328 R2): promptProfile 双形轴直通——纯呈现轴无租户门(deferTools 姿势);
             // 缺省不挂键(引擎缺省 simple);非法值由 HTTP 门 400,resume 重放 defensive DROP。
             ...(() => { const v = promptProfileFromBody(body.promptProfile); return v ? { promptProfile: v } : {}; })(),
-            // [2856]②(core 5.14.0):deferred 工具激活后的 schema 供给策略,per-task 位。core 侧读法是
-            // `spec.toolMaterializeStrategy ?? env ?? "static"` ⇒ **缺省不挂键**才能让进程级 env 继续说话;
+            // [2856]②(core 5.14.0 引入;5.15.0 BREAKING 末项默认翻 swap):deferred 工具激活后的 schema 供给
+            // 策略,per-task 位。core 侧读法是 `spec.toolMaterializeStrategy ?? env ?? "swap"`(5.16.0 dist
+            // prepare-task 亲读)⇒ **缺省不挂键**才能让进程级 env 继续说话;
             // 挂一个「缺省值」上去会把 env 车道悄悄夺权。非法值由 HTTP 门 400,resume 重放 defensive DROP。
             ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
             // [922]①/[915]② (core 1.296): interactiveTools 三态旋钮直通——boolean 上 spec(壳 -p 恒 stamp false=
@@ -750,9 +743,11 @@ export function createResolveSpec(ctx) {
             // the QuestionAnswer (server.ts `body.answer` → onQuestion closure). #152([2703] 案二): the question
             // policy is LIVE-AWARE when the QuestionCoordinator is wired — a live-stream leg adjudicates `allow`
             // (the live human answers over the stream) instead of unconditionally parking; see durableQuestionPolicy.
+            // design/181 件一:基线的**构造**归 `createApprovalBaselinePolicy`(三腿单一属主);本处只做部署形
+            // 判断——哪一形该有 durable 轴、哪一形铺 allow-all、哪一形留 `undefined`(见下两条注)。
             toolPolicy: durableEnabled
-                ? combinePolicies(createDurableQuestionGate(liveQuestionFace), createDurableAskPolicy({
-                    requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
+                ? createApprovalBaselinePolicy(config, {
+                    question: liveQuestionFace,
                     // The probe key is the CONTINUED session (auth.sessionId — the same id that keys the
                     // durable checkpoint /decide route). A fresh session (no body.sessionId) has no exemptions by
                     // construction; fail-closed inside the policy on a store error.
@@ -762,20 +757,21 @@ export function createResolveSpec(ctx) {
                             onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: auth.sessionId, toolName, rawToolName }),
                         }
                         : {}),
-                }))
+                })
                 : singleUserAutoAcceptBaseline
                     // 🔴 (live finding: single-user host-lane Bash ran UNGATED, no adjudication): a
                     // single-user turnkey worker with NO expressed gate intent previously left `toolPolicy` UNDEFINED →
                     // core's write-capable hand tools mount UNADJUDICATED (core error-logs it every task; host lane has NO
                     // sandbox to fall back on). CC's trust model is auto-accept, but the GATE MECHANISM must be PRESENT
                     // (core 原则: "机制留、默认可更宽 auto-accept"). So wire an adjudicated auto-accept BASELINE
-                    // (`createAllowDenyPolicy({})` = a present, effect-aware policy that allows all): satisfies core's
-                    // `hasEffectAwareGate`, restores observability + a hook/tighten point, and the operator STILL tightens
-                    // irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by applyRuntimeGovernance).
+                    // (the durable-less arm of `createApprovalBaselinePolicy` = a present, effect-aware policy that allows
+                    // all): satisfies core's `hasEffectAwareGate`, restores observability + a hook/tighten point, and the
+                    // operator STILL tightens irreversible ops via `AUTONOMY` / `commandPolicy` (layered TIGHTEN-ONLY by
+                    // applyRuntimeGovernance).
                     // Interactive approval routed to the shell HITL = follow-on. 🔴 `singleUserAutoAcceptBaseline` requires
                     // ZERO gate intent — a single-user op who SET approval flags but wired no store falls to `undefined`
                     // (core warns = real misconfig, not masked); multi-tenant likewise stays `undefined` (approval required).
-                    ? createAllowDenyPolicy({})
+                    ? createApprovalBaselinePolicy(config)
                     : undefined,
             // Durable suspend needs both the store (here, per-task) and the opt-in scope key (multi-tenant =
             // principal; "_" when auth is off). core suspends on a policy `ask` only when these are present.
@@ -829,11 +825,33 @@ export function createResolveSpec(ctx) {
         // be an inconsistent false-safety: approval would still be live).
         // #153([2713] 分单②):MANUAL_MODE_SHELL_GATE 在此无条件施加(与 autonomy 同拍)——部署旋钮不再
         // 依赖客户端 settings 在场性/模式臂/host lane(三重条件曾让 print/headless 腿与沙箱 lane 全静默失效)。
-        const governedBase = applyRuntimeGovernance(spec, {
-            autonomy: config.autonomy,
-            commandPolicy: config.commandPolicy,
-            ...(config.manualModeShellGate ? { manualModeShellGate: config.manualModeShellGate } : {}),
-        });
+        //
+        // #177([2951] issue #29):SENSITIVE_WRITE_PATTERNS 是 #153 漏下的兄弟旋钮,同病同修——operator
+        // 守卫集预铸成纯 DENY policy 在 governance 拍无条件施加(bypassPermissions/键缺席/settings 整缺席
+        // 都掀不掉;deny-wins 折叠,普通目标弃权 ⇒ 不给 bypass 加 ask 门,[820] 表第四行逐字保持)。
+        // 裁决 env/cwd 在此**单点**铸,settings 折叠的 fsWriteGate wiring 复用同一份(两处各铸一份正是
+        // 漂移的成因)。lane 分形与 cwd 三形/哨兵的完整理由成文在下方 settings 块(修5/W4/#165),此处不复述。
+        const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
+        const pathAdjudication = hostSemanticsLane
+            ? (() => {
+                const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
+                const gateCwd = sessionCwd ??
+                    (config.remoteExec === undefined
+                        ? process.cwd()
+                        : join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted")); // never created — see the settings block
+                return { env: new NodeExecutionEnv({ cwd: gateCwd }), cwd: gateCwd };
+            })()
+            : {
+                env: new DeferredSandboxPathEnv({
+                    sessionId: auth?.sessionId,
+                    slots: sandboxPathEnvSlots,
+                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
+                }),
+            };
+        // design/181 件一:governance 实参(含守卫集预铸)归 `createDeploymentGovernanceInputs`(三腿单一
+        // 属主),**折叠属主不变**——仍是这一句 `applyRuntimeGovernance` → core `tightenTaskSpec`。每请求现调,
+        // 读的是活 config(autonomy/commandPolicy 热改;resume 腿按当前值重折,与上方审批基线同姿势)。
+        const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         // Fold the client's per-request settings stamp onto the governed spec, TIGHTEN-ONLY (deny-wins) — AFTER
         // the approval baseline + operator governance, so the order is deployment ⊇ operator ⊇ client (each can only
         // narrow). tightenTaskSpec THROWS if the client settings would LOOSEN a stricter baseline → a 422 client error
@@ -866,8 +884,7 @@ export function createResolveSpec(ctx) {
         // [820]③ scratchpadDir, hoisted from the envFacts block below so the SAME per-session dir feeds BOTH the
         // `# Environment` fact and the fs-write gate's exemptDirs (single-source path via scratchpadDirFor inside
         // ensureScratchpadDir). HOST-semantics lanes only + session required — rationale at the envFacts consumer.
-        // 判别式单一真源:补集(沙箱裁决 lane)是写门代理与工厂装饰器的挂载条件,两处各写一份正是漂移的成因。
-        const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
+        // (hostSemanticsLane 判别式已随 #177 上移到 governance 拍前——单一真源不变,只是搬了家。)
         // G3([816]③/[820]③,[1840]§四):壳供 body.scratchpadDir 优先——壳(CC 形)有自己的 per-session
         // scratchpad 约定路径,接受后事实/豁免/根围栏三处同源指向壳的目录(壳侧提示词与 server 写门不再
         // 两个 scratchpad)。验收门 fail-closed(多租户/远程 lane/浅路径全拒收,warn 后回落自算)——
@@ -905,13 +922,11 @@ export function createResolveSpec(ctx) {
             //    (hand 工具的书面契约形)与 scratchpad exempt 均不受影响。
             //  · provider 未设(in-process host / run-local)⇒ hands 就在本进程 cwd 跑(无 factory),process.cwd()
             //    正是真工作目录,保留。
-            // 两形**共有**的两件(都与 env/cwd 无关,故不随 lane 分叉——单一属主,两臂各抄一份正是漂移的成因):
+            // 两形**共有**的一件(与 env/cwd 无关,故不随 lane 分叉——单一属主,两臂各抄一份正是漂移的成因):
             const gateCommon = {
-                // ③ (core 1.295) sensitive-path write deny set:组合进 gate 腿的同一 combinePolicies 折叠
-                // (deny 恒赢 —— 豁免/acceptDirs 越不过;集合取舍 core 成文,server 只透传 config 旋钮:
-                // 缺省 = core RECOMMENDED_SENSITIVE_PATTERNS,SENSITIVE_WRITE_PATTERNS 显式替换/off 关闭)。
-                // 沙箱 lane 上它按**词法** key 的路径段匹配(#156)——glob 本就只看段名,不需要真 fs。
-                ...(config.sensitiveWritePatterns.length > 0 ? { sensitivePatterns: config.sensitiveWritePatterns } : {}),
+                // ③ 的 sensitive-path DENY 腿已随 #177([2951] issue #29)搬到 governance 拍(见上方
+                // sensitivePathPolicy)——wiring 不再承运守卫集,FsWriteGateWiring.sensitivePatterns 字段一并拆除
+                // (#153 shellGate 同形搬家:部署级旋钮不得挂在客户端表态派生腿上)。
                 // [1557]§四 的 shellGate 旧家已随 #153 搬到 applyRuntimeGovernance(governance 层无条件施加,
                 // 见上方 governedBase)——wiring 不再承运该旋钮,FsWriteGateWiring.shellGate 字段一并拆除。
                 // [841]① / core 1.294 exemption seam:gate 产 ask 前查同一只 approval_exemption 店(与 decide
@@ -932,19 +947,14 @@ export function createResolveSpec(ctx) {
                     : {}),
             };
             const fsWriteGate = hostSemanticsLane
-                ? (() => {
-                    const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
-                    const gateCwd = sessionCwd ??
-                        (config.remoteExec === undefined
-                            ? process.cwd()
-                            : join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted")); // never created — see above
-                    return {
-                        env: new NodeExecutionEnv({ cwd: gateCwd }),
-                        cwd: gateCwd,
-                        ...(scratchpadDir ? { scratchpadDir } : {}),
-                        ...gateCommon,
-                    };
-                })()
+                ? {
+                    // env/cwd 构造已随 #177 上移(governance 拍前的 pathAdjudication 单点),此处复用同一份——
+                    // 守卫集 DENY 腿与写门 ask 腿在同一 env/同一 cwd 基准上裁决,两腿不可能分家漂移。
+                    env: pathAdjudication.env,
+                    ...(pathAdjudication.cwd !== undefined ? { cwd: pathAdjudication.cwd } : {}),
+                    ...(scratchpadDir ? { scratchpadDir } : {}),
+                    ...gateCommon,
+                }
                 : // 沙箱 lane(#165):裁决 env = `DeferredSandboxPathEnv` 代理 —— 裁决时刻(必在 prepare 之后)
                     // 去 per-session slot 里取本 task 的**真沙箱 env**,转发 exists/canonicalPath/fileInfo/readLink。
                     // 于是绝对路径的 symlink 真身、存在性都是真沙箱 fs 的事实,域内软链指向守卫段照样 deny;
@@ -965,11 +975,7 @@ export function createResolveSpec(ctx) {
                     (() => {
                         const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
                         return {
-                            env: new DeferredSandboxPathEnv({
-                                sessionId: auth?.sessionId,
-                                slots: sandboxPathEnvSlots,
-                                logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
-                            }),
+                            env: pathAdjudication.env, // #177 单点构造(DeferredSandboxPathEnv 代理),与守卫集 DENY 腿同一份
                             ...gateCommon,
                             ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
                             // codex 复审 B(2026-08-05,dist 亲读+实测):core 的 canonicalizeTarget 把反斜杠 UNC 形在**入口**

package/dist/boot/runner-deps.d.ts

@@ -9,7 +9,7 @@
  * (`runnerTierFrozen` 判据就取自构造那一刻的 `config.tiers`)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
-import { type RunnerDeps, type WorkflowRunStore } from "@sema-agent/core";
+import { type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
 import type { buildPricing, createTracer } from "../budget.js";
 import type { ServiceConfig } from "../config.js";
@@ -25,6 +25,28 @@ import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
+/**
+ * `RunnerDeps.onAsk` 的装配(#168 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
+ *
+ * 为什么值得有名字:bg / resume 两条腿**没有** per-task `spec.onAsk` 装配点(routes/runs.ts 只递 ALS 与
+ * 两个窗旋钮),它们唯一的审批接缝就是这一格。端到端测试此前只能把这一行**照抄**一份,再靠一条读源码
+ * 的正则当漂移告警 —— 那种锚只抓得到「这一行没了/改名了」,抓不到任何语义变化,而且抄件与真件从此是两
+ * 份实现。提成导出之后,测试直接取本函数,接缝与 production 是**同一个符号**。
+ *
+ * 命名(CLAUDE.md 工厂命名律):返回的是一个闭包(活对象)⇒ `create*`。
+ *
+ * 返回型**刻意窄于** `RunnerDeps["onAsk"]`(它还允许 `"allow"`/`"deny"` 两个字符串常量):本仓的接缝
+ * 恒是回调形,而 core 的 sync-first 判据只看 `onAsk !== undefined` ⇒ 字符串模式会顶掉 durable park
+ * (core backlog #73,黑板 [2897]④ / [2899] 已知悉)。窄返回型把「本仓零受迫于那一形」变成编译期事实。
+ *
+ * 语义逐字不变:[816]/[820]② 的 live tool-approval 接缝(core `resolveAsk` 读 `spec.onAsk ?? deps.onAsk`),
+ * ALS 路由同 `onQuestion` —— 被协调器 `runWithContext` 包住的腿才够得着人。[879] G1 终态(core 1.295
+ * OnAsk 三值化)下**恒**接线:回调逐 ask 时刻判活人,无附着/卡送达失败 ⇒ 返 `"unavailable"`,core 以
+ * `approverUnavailable` 回路把该 ask 交回 `suspendAsk` 走 durable park;无 park 设施的部署 core 自己
+ * fail-closed deny。协调器缺席(协议未上场)⇒ `undefined`,即「这条部署没有活人接缝」。
+ */
+export type RunnerDepsOnAsk = (req: Parameters<ToolApprovalCoordinator["ask"]>[0], signal?: AbortSignal) => Promise<AskOutcome>;
+export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordinator | undefined): RunnerDepsOnAsk | undefined;
 export interface RunnerDepsCtx {
     config: ServiceConfig;
     logger: Logger;

package/dist/boot/runner-deps.js

@@ -20,6 +20,11 @@ import { resolveServedSession } from "../orchestration/workflow-completion-inbox
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
+export function createRunnerDepsOnAsk(toolApproval) {
+    if (!toolApproval)
+        return undefined;
+    return (req, signal) => toolApproval.ask(req, signal);
+}
 export function createSharedRunnerDeps(ctx) {
     // 具名带类型的字面量(非裸 return)——deps-literal-shape-gate 的 POINTS 按 `const X: T = {` 咬装配
     // 字面量,裸 return 形在它的覆盖外(复审 2026-07-30 F5):conditional-spread 病在这里就会失检。
@@ -215,17 +220,9 @@ export function createRunnerDeps(ctx) {
         // (live-stream leg → this coordinator; no-live-context leg → durable park). The sentinel is stamped only
         // when the coordinator is absent (ASK_QUESTION_ENABLED off).
         onQuestion: question ? question.question : undefined,
-        // [816]/[820]②: the live tool-approval seam (core `resolveAsk` — `spec.onAsk ?? deps.onAsk`). ALS-routed like
-        // onQuestion: a leg wrapped by the coordinator's runWithContext reaches the human.
-        //
-        // [879] G1 终态(core 1.295 OnAsk 三值化):恒 wire。回调逐 ask 时刻判活人——ALS 附着腿 ⇒ 同步三选卡;
-        // 无附着/卡送达失败 ⇒ 返 "unavailable",core 以 approverUnavailable 回路把该 ask 交回 suspendAsk 走
-        // durable park(prepare-task 分路带 `approverUnavailable !== true` 豁免位,dist 亲读)——park 与 live 卡
-        // 两全,1.199 的「durable 部署不 wire deps.onAsk」止血撤除。无 park 设施的部署 core 自己 fail-closed
-        // deny(resolveAsk 的 unavailable 文案),与旧姿势同向。
-        onAsk: toolApproval
-            ? (req, signal) => toolApproval.ask(req, signal)
-            : undefined,
+        // live tool-approval 接缝 —— 语义与历史全部搬进 `createRunnerDepsOnAsk` 的头注(#168 件4:同一份
+        // 说明只留一处,不在装配点复述)。
+        onAsk: createRunnerDepsOnAsk(toolApproval),
         // [822]② auto permission mode, deployment half: RunnerDeps.autoMode is the operator TRUST face of core's
         // auto-mode classifier (1.276/1.277) — wiring it alone arms NOTHING (core requires the per-principal entitlement
         // runtimeCaps.autoMode === true from center, fail-closed dark by default; see runtime-caps-resolver.ts). With

package/dist/boot/workflow-orchestration.d.ts

@@ -11,13 +11,13 @@
  *     → `workflowRunStore`(包装体)的顺序是数据依赖链,不可重排。
  *  3. `getRunStore()` 是晚绑取值(runStore 在本段之后构造),原文靠同作用域前向引用。
  */
-import { type WorkflowRunStore } from "@sema-agent/core";
+import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
-import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
+import { JournalingWorkflowRunStore, WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
@@ -37,10 +37,15 @@ export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCt
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
     workflowNotifyGate: WorkflowNotifyGate | undefined;
     fleetBus: FleetEventBus;
-    workflowRunStore: WorkflowRunStore | undefined;
+    workflowRunStore: JournalingWorkflowRunStore | undefined;
     workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     workflowAgentRegistry: WorkflowAgentRegistry | undefined;
     subagentSteerRegistry: SubagentSteerRegistry;
+    workflowRecoverOpts: {
+        orphanGraceMs?: number;
+        finalizeStartedBeforeMs?: number;
+        publishTerminalFleetRow?: (id: string, run: WorkflowRun) => void;
+    };
 };
 //# sourceMappingURL=workflow-orchestration.d.ts.map

package/dist/boot/workflow-orchestration.js

@@ -20,6 +20,11 @@ import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 export function createWorkflowOrchestration(ctx) {
     const { config, logger, metrics, localRoot, backend, getRunStore } = ctx;
+    // [2995] boot-orphan 判死界:此刻之前记入 journal 的 pending 条目属于**前世进程**(workflow 执行器是
+    // in-process 的,随前世死)。取在 journal/gate 构造之前 ⇒ 本进程随后 record 的每条 createdAt 常态下都严格
+    // 晚于它。⚠️ 它是**必要不充分**条件:时钟回拨会让本世条目落到界下,判死的最终锚是 gate 内的
+    // incarnation 名册(见 WorkflowNotifyGate.recordedThisIncarnation),两者取交集。
+    const workflowBootAtMs = Date.now();
     // S8 / SVC-1 workflow run store (design/97 S1b): records LLM-authored BACKGROUND workflow
     // runs for the /v1/workflows list+detail view (live subscribe is in-process via subscribeWorkflow,
     // store-independent). Only present when self-orchestration is enabled (else no runs to record).
@@ -120,6 +125,23 @@ export function createWorkflowOrchestration(ctx) {
     const workflowRunStore = baseWorkflowRunStore
         ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus)
         : undefined;
+    // [2995]/[2999] recover 两半的**单点合成**(boot 扫描与周期扫描共用同一对象,防两处漂移——#177 同族教训):
+    //  · finalizeStartedBeforeMs = 诚实性半场,**只在 replica-local(File)journal 形**:SQL journal 是跨副本
+    //    的(上面 1.108 注),pending running run 可能活在别的 replica,那里年龄(grace)是唯一健全的孤儿代理。
+    //    (进程内是否本世记录由 gate 自己的 incarnation 锚判,时钟回拨不参与——见 recover 的键注。)
+    //  · publishTerminalFleetRow = 判死臂的**撤行**口:sweep 翻完 durable 行后经 wrapper 的同一投影发终帧+移除,
+    //    store/面板/notify 三面一个答案。⚠️ 复审第 1 轮两条 high 的收口:sweep **绝不**发 running 行(读时快照
+    //    铸出来的行可能永远无人可撤——跨副本形属主在别的副本、同副本形 live 终态可能已把行撤了)。fleet 活行的
+    //    唯一写者是本副本 wrapper 的 put/update 观察点。
+    // 授权条件直接问「这本 journal 是不是 replica-local」,**不拿 sqlWorkflowRunStore 当代理**:两处各写一遍
+    // 必漂移,而漂移方向是把判死授权交给共享 journal = 杀别副本正在跑的 run。未知/新 journal 实现 ⇒ 恒 false
+    // (fail-closed:最坏只是孤儿多等一个 grace 窗)。
+    const replicaLocalNotifyJournal = workflowNotifyJournal instanceof FileWorkflowNotifyJournalStore;
+    const workflowRecoverOpts = {
+        orphanGraceMs: config.workflowOrphanGraceMs,
+        ...(replicaLocalNotifyJournal ? { finalizeStartedBeforeMs: workflowBootAtMs } : {}),
+        ...(workflowRunStore ? { publishTerminalFleetRow: (id, run) => workflowRunStore.republishFleet(id, run) } : {}),
+    };
     // SVC-2 (core CORE-7/CORE-9 Part A): the durable resume journal. core 1.145.0 added `RunnerDeps.workflowJournalStore`
     // (twin of workflowRunStore) + auto-wires it into the run_workflow tool's startWorkflow(RunWorkflowOptions.journalStore);
     // the tool's `resumeFromRunId` input then replays the longest unchanged prefix. tidb/pg = durable cross-replica resume;
@@ -144,7 +166,7 @@ export function createWorkflowOrchestration(ctx) {
     return {
         sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion,
         workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink,
-        workflowAgentRegistry, subagentSteerRegistry,
+        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts,
     };
 }
 //# sourceMappingURL=workflow-orchestration.js.map

package/dist/budget.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cost / budget / trace wiring for the Runner (core 1.37) — pure, testable helpers kept out of the
+ * Cost / budget / trace wiring for the Runner (core 5.x) — pure, testable helpers kept out of the
  * auto-running main.ts:
  *   ③ buildPricing   — Model.cost catalog → injected ModelPricing (authoritative costMicroUsd).
  *   ④ createTracer    — core's content-free TraceEvents → /metrics (spend, first-token, tool calls).

package/dist/budget.js

@@ -1,5 +1,5 @@
 /**
- * Cost / budget / trace wiring for the Runner (core 1.37) — pure, testable helpers kept out of the
+ * Cost / budget / trace wiring for the Runner (core 5.x) — pure, testable helpers kept out of the
  * auto-running main.ts:
  *   ③ buildPricing   — Model.cost catalog → injected ModelPricing (authoritative costMicroUsd).
  *   ④ createTracer    — core's content-free TraceEvents → /metrics (spend, first-token, tool calls).

package/dist/capabilities/repo-tools.d.ts

@@ -11,7 +11,7 @@ export interface RepoCoords {
     owner: string;
     repo: string;
 }
-/** Parse `owner/name` or a repo URL (e.g. http://host:9999/AI-Only/sema-server.git). */
+/** Parse `owner/name` or a repo URL (e.g. https://git.example.com/some-org/some-repo.git). */
 export declare function parseRepo(input: string): RepoCoords;
 /** Thin read-only Gitea API client. Built once at startup; bound to a repo per task. */
 export declare class GiteaClient {

package/dist/capabilities/repo-tools.js

@@ -1,5 +1,5 @@
 import { Type } from "typebox";
-/** Parse `owner/name` or a repo URL (e.g. http://host:9999/AI-Only/sema-server.git). */
+/** Parse `owner/name` or a repo URL (e.g. https://git.example.com/some-org/some-repo.git). */
 export function parseRepo(input) {
     const s = input.trim().replace(/\.git$/, "");
     const m = /^[a-z]+:\/\/[^/]+\/(.+)$/i.exec(s);
@@ -42,7 +42,13 @@ export class GiteaClient {
     async tree(coords, ref) {
         const { owner, repo } = coords;
         const body = (await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=true&per_page=${MAX_TREE_ENTRIES}`)).json());
-        return (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
+        const paths = (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
+        // The upstream API caps the listing at `per_page` and reports the overflow via `truncated` — it does
+        // not report how many entries were left out. Surface that (same disclosure-marker family as
+        // `readFile`/`pullDiff` below) so a review lens never mistakes a capped tree for the whole repo.
+        return body.truncated
+            ? [...paths, `…[truncated, tree has more than ${MAX_TREE_ENTRIES} entries]`]
+            : paths;
     }
     async readFile(coords, path, ref) {
         const { owner, repo } = coords;

package/dist/config-center/apply-effective.js

@@ -434,20 +434,43 @@ export function runtimeGatePresent(rt, key) {
  *
  * 顺带 C1-2:数组项 trim + 去空串,与 env csv 归一(`csv()` 的 `.map(trim).filter(Boolean)`)一致——
  * 否则 `" Bash "` 从中心腿进来会是个永不匹配的名字,正是本条要消灭的那类静默失效。
+ *
+ * ⚠️ codex R1(#186 同批复审):**形错必须拒域,不能折成 `[]`**。旧实现先按 `typeof === "string"` 过滤再验
+ * 判据,于是 `[123]`(非串项)与 `"Bash"`(整个不是数组)双双归约成空名单、判据自然干净 ⇒ 被当作「运维
+ * 显式把闸关掉」落配,把前值换成空门且**零告警**。方向与 A1 相反(A1 是门空转,这条是门蒸发),但同属本域
+ * 要堵的失败,且在安全轴上是静默 fail-open。判据分家:**空串/纯空白仍丢弃**(C1-2 的 env csv 归一,env 腿
+ * 产不出非串项),**非串项 / 非数组=形错 ⇒ 拒整域保前值**;显式 `[]` 依旧是合法的「闸关掉」。
  */
 function stageApprovalRequire(raw, logger) {
-    // wire verbatim ⇒ 不信任元素形状(整表是 center 发的):非串项与空串一并落地板,与 env csv 归一同形。
-    const names = (Array.isArray(raw) ? raw : [])
-        .map((n) => (typeof n === "string" ? n.trim() : n))
-        .filter((n) => typeof n === "string" && n.length > 0);
+    // `kept` 逐臂说真话:内容臂的后果是「门空转」,形错臂的后果是「门蒸发」——两句不能混用。
+    const refuse = (detail, names, kept) => {
+        logger?.warn("sema_registry_approval_require_invalid", { detail, names: [...names], kept });
+        return {};
+    };
+    const KEPT_WOULD_MATCH_NOTHING = "the prior approvalRequire is unchanged — the published list would have silently matched nothing";
+    const KEPT_WOULD_REMOVE_GATE = "the prior approvalRequire is unchanged — coercing this malformed value would have silently REMOVED the approval gate";
+    // 形错门(codex R1),先于内容判据:此处**不能**静默归一,归一的结果恰好是「空门」。
+    // 非数组一支是**纵深防御**:唯一调用点先过 `runtimeGatePresent`(判 `Array.isArray`),非数组在那里就按
+    // 「缺席」跳过、保前值——已是 fail-safe。本函数签名收 `unknown`,所以自己也把这一形收口,免得 present
+    // 判据日后放宽时非数组悄悄掉进下面的归一腿(测试两支都钉了)。
+    if (!Array.isArray(raw)) {
+        return refuse(`published runtime.approvalRequire must be an ARRAY of whole tool names — got ${raw === null ? "null" : typeof raw}. ` +
+            `Refusing the domain instead of coercing it: an empty list means "no approval gate", so coercing a malformed value would SILENTLY remove the gate.`, [], KEPT_WOULD_REMOVE_GATE);
+    }
+    // 逐项报**下标 + 实际类型**(运维要能在发布件里定位到那一项;只报个数无法行动)。
+    const nonString = raw
+        .map((n, i) => (typeof n === "string" ? undefined : { i, t: n === null ? "null" : typeof n }))
+        .filter((e) => e !== undefined);
+    if (nonString.length > 0) {
+        return refuse(`published runtime.approvalRequire contains ${nonString.length} non-string entr${nonString.length === 1 ? "y" : "ies"} ` +
+            `(${nonString.map((e) => `[${e.i}]:${e.t}`).join(", ")}) — every entry must be a whole tool name string. ` +
+            `Refusing the domain instead of dropping them: dropping every entry would SILENTLY remove the approval gate.`, nonString.map((e) => `[${e.i}]`), KEPT_WOULD_REMOVE_GATE);
+    }
+    // wire verbatim ⇒ 空串/纯空白按 env csv 归一丢弃(C1-2);元素形状已在上面的形错门收口。
+    const names = raw.filter((n) => typeof n === "string").map((n) => n.trim()).filter((n) => n.length > 0);
     const bad = findUnmatchableToolNames(names);
     if (bad.length > 0) {
-        logger?.warn("sema_registry_approval_require_invalid", {
-            detail: formatUnmatchableToolNames("published runtime.approvalRequire", bad),
-            names: bad.map((b) => b.name),
-            kept: "the prior approvalRequire is unchanged — the published list would have silently matched nothing",
-        });
-        return {};
+        return refuse(formatUnmatchableToolNames("published runtime.approvalRequire", bad), bad.map((b) => b.name), KEPT_WOULD_MATCH_NOTHING);
     }
     return { value: names };
 }

package/dist/config-provider.d.ts

@@ -98,6 +98,7 @@ export declare class RemoteConfigProvider implements ConfigProvider {
  * version as the etag (so the caller's "skip re-apply if etag unchanged" works locally too).
  */
 export declare class LocalConfigProvider implements ConfigProvider {
+    #private;
     readonly kind: "local";
     private readonly store;
     /** [875]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时

package/dist/config-provider.js

@@ -131,8 +131,12 @@ export class LocalConfigProvider {
     /** [875]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     root;
+    /** 注入 store(测试缝)时保持其自带行为;自建时 fetchEffective 每次按调用铸新 store 挂 warning 座
+     *  (见 fetchEffective 头注)。 */
+    #injectedStore;
     constructor(root, store) {
         this.root = root;
+        this.#injectedStore = store;
         this.store = store ?? new FileConfigStore(root);
     }
     async fetchEffective(etag) {
@@ -146,7 +150,20 @@ export class LocalConfigProvider {
         // [898] tolerant read(0.10.12):catalog 域坏文件 ⇒ 该域 default+domainErrors 单列(不再连坐整包回落
         // env);gate 域坏文件仍 throw(走 caller 的整包 catch)。坏文件文本 hash 参与 version(坏≠absent、
         // 坏→修好均 bump),304-skip 纪律不漏拍——所以坏域场景下 etag 对比照旧安全。
-        const { effective: eff, domainErrors } = await this.store.getEffective({ tolerant: true });
+        // [3073]#204④:判形失败(schema 坏形/重名条目)走的是 buildEffective 的 `onWarning`(parse 层落
+        // default),不走 READ 层 throw——不接这个座,domainErrors 恒空,域被静默清空而排障 hint 只能谎报
+        // 「文件空」。warning 座是 store 构造级而 fetch 可能重叠(boot 超窗后台腿 vs 首拍 refresh),
+        // 共享缓冲会把别次快照的警告错记到本次结果(codex F2)——故自建形每次 fetch 铸新 store 配本地
+        // 收集器(FileConfigStore 无跨调用状态,按次构造零成本);注入 store(测试缝)保持其自带行为。
+        const parseWarnings = [];
+        const store = this.#injectedStore ??
+            new FileConfigStore(this.root, {
+                onWarning: (w) => {
+                    if (w.kind === "domain-defaulted")
+                        parseWarnings.push({ domain: w.domain, error: w.error instanceof Error ? w.error.message : String(w.error) });
+                },
+            });
+        const { effective: eff, domainErrors } = await store.getEffective({ tolerant: true });
         const tag = String(eff.version);
         if (etag !== undefined && etag === tag)
             return null; // unchanged → mirror remote 304
@@ -157,14 +174,17 @@ export class LocalConfigProvider {
         // The resolver gets THIS snapshot's domain values as `pending` (builder output is default-filled for
         // every domain), so the check never re-reads config.d — the one-atomic-snapshot invariant above holds.
         const refErrors = [];
-        const resolve = siblingResolver(this.store, eff);
+        const resolve = siblingResolver(store, eff);
         for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             // path CLEAR (locates the entry) + message operand-fingerprinted (see redactConfigError).
             if (issues.length > 0)
                 refErrors.push({ domain: d, error: issues.map((i) => `${i.path.join(".")}: ${redactConfigError(i.message)}`).join("; ") });
         }
-        const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...refErrors];
+        // parse 层判形失败与 READ 层坏文件同渠道:两者都是「坏域落 default」,候选门(§9.5-5)与排障 hint
+        // 需要同样看见——此前判形失败静默(domainErrors 空+域被清空),比坏文件更隐蔽。
+        const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
+        const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return { effective: mapToServiceEffective(eff, eff.version), etag: tag, ...(errors.length > 0 ? { domainErrors: errors } : {}) };
     }
     async fetchSkillContent(contentHash) {