@sema-agent/server 7.50.0 → 7.52.0

package/dist/runtime-governance.d.ts

@@ -111,7 +111,7 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  * `autonomyOverrides(autonomy).shellGate`(`AUTONOMY=ask`)与 `MANUAL_MODE_SHELL_GATE` 旋钮,取「有一个
  * 是 always」。`commandPolicy` 不入判据:它产的是 `toolPolicy` 的 ask,不抬 shellGate 档,与本格无关。
  *
- * ⚠️ **已知残留(codex 对抗复审 2026-08-11 逮到,如实登记而不是掩盖)**:本判据读的是**当下**的
+ * ⚠️ **已知残留(codex 交叉复审 2026-08-11 逮到,如实登记而不是掩盖)**:本判据读的是**当下**的
  * config,而 `config.autonomy` 是**热改**的(`config-center/apply-effective.ts` 就地写 `config.autonomy`)。
  * 于是失真是**双向**的,不是我原先写的「只往缺席方向」:
  *  · 缺席向(常见):mint 之后运维把 `AUTONOMY=ask` 撤了 ⇒ 老 park 行归不出治理出身,少标一个;

package/dist/security.d.ts

@@ -25,9 +25,9 @@ export interface SessionListItem {
  * E6 fail-closed 守卫的辖域判据:**这个请求是不是一次「破坏性会话写」**。
  *
  * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
- * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一威胁形、爆炸半径**更大**,却没门。
+ * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一风险形、爆炸半径**更大**,却没门。
  *
- * 威胁形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * 风险形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
  * `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
  * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
  *
@@ -55,7 +55,7 @@ export declare const LEGACY_UNOWNED_AMNESTY_TENANT = "default";
  *   ① 单机形 `!requirePrincipal` —— 多租部署本臂**死路**(header 必到、键必具名);
  *   ② 存量行恰为无主 `owner === null` —— 任何具名 owner 的行不受影响;
  *   ③ 调用方恰为 `default` 主 —— 非 default 的具名主对无主行仍走原门(404 / deleted:false)。
- * 反向风险有界:①限定的单机形本就单用户,把无主行判给 default 主不产生跨租泄露。
+ * 反向风险有界:①限定的单机形本就单用户,把无主行判给 default 主不产生跨租外泄。
  *
  * 🪦 墓碑注(与第一臂同源):这是两个表示法之间的**过渡承接**。存量随会话生命周期消亡后,本臂
  * 连同 {@link LEGACY_UNOWNED_AMNESTY_TENANT} 与几处调用点可**整删**,不留兼容层。
@@ -235,7 +235,7 @@ export declare function createAuthorizer(config: ServiceConfig, sessionStore: Ow
 export declare const PRINCIPAL_MAX_LENGTH = 190;
 /** 修1 — the SINGLE registry of internal sentinel/scope identifiers a tenant principal must never equal.
  *  🔴 新增内部 sentinel scope 必须在此登记(精确值加 RESERVED_PRINCIPALS,前缀族加
- *  RESERVED_PRINCIPAL_PREFIXES),否则 assertPrincipalShape 会放行同名租户 = 与内部 scope 行合流的越权面。
+ *  RESERVED_PRINCIPAL_PREFIXES),否则 assertPrincipalShape 会放行同名租户 = 与内部 scope 行合流的超范围面。
  *  Current entries (where each is minted): `"_"` = single-user/anonymous sentinel (checkpoint/sendfile/
  *  resource-suspend scope family); `"__none__"` = missing-principal placeholder on the decide/pending gates
  *  (http/server.ts `principal ?? "__none__"`); `"_leader"` = leader durable-approval scope
@@ -281,7 +281,7 @@ export declare const decodeCheckpointScope: (scope: string) => string | undefine
 /** Read the authenticated principal from the trusted header. Never from the body. */
 export declare function principalFrom(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /** Header carrying the crypto-verified principal JWT on a direct-door worker (the issuer signs it; the worker only
- *  verifies). The trusted twin of `config.principalHeader` (the latter is client-spoofable on a direct door). */
+ *  verifies). The trusted twin of `config.principalHeader` (the latter is client-self-asserted on a direct door). */
 export declare const PRINCIPAL_TOKEN_HEADER = "x-approval-principal-token";
 /**
  * direct-door 决策证明三件套的另外两个头名(JWT 在上面那个常量里)。

package/dist/security.js

@@ -7,7 +7,7 @@ export function isDestructiveSessionWrite(method, url) {
     if (method === "PUT")
         return /^\/v1\/sessions\/[^/]+\/policy$/.test(url);
     if (method === "POST")
-        return /^\/v1\/sessions\/[^/]+\/(sync\/import|fork)$/.test(url);
+        return /^\/v1\/sessions\/[^/]+\/(sync\/import|fork|memory\/erase)$/.test(url);
     return false;
 }
 export const LEGACY_UNOWNED_AMNESTY_TENANT = "default";

package/dist/session-sync.d.ts

@@ -45,23 +45,40 @@
  */
 import type { StoreBackend } from "./plugins/store-backend.js";
 import { type SyncRelation } from "./session-sync-kernel.js";
-import { type SessionTreeEntry, type SessionRulesRecord, type FileSnapshotResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
-import type { ServiceFileSnapshotStore, ServiceSessionPolicyStore, ResumeAnchorStore } from "./plugins/store-backend.js";
+import { type SessionTreeEntry, type SessionRulesRecord, type FileHistoryExport, type FileHistoryResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
+import type { ServiceFileHistoryStore, ServiceSessionPolicyStore, ResumeAnchorStore } from "./plugins/store-backend.js";
 /** A blob getter: content-addressed bytes for a sha256 hash, or `undefined` if the source can't supply them.
  *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
- *  content-addressed snapshot bytes lazily (the live PUSH route's `importManifest` replay). */
+ *  content-addressed history bytes lazily (the live PUSH route's `importHistory` replay). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
-/** The snapshot-import capability face of a `FileSnapshotStore` — signature verbatim = the authoritative
- *  implementation, `FileSnapshotStoreSql.importManifest` (src/plugins/file-snapshot-store-sql.ts:201). */
-export interface FileSnapshotImportFace {
-    importManifest(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: BlobGetter): Promise<FileSnapshotResult>;
+/** The history-import capability face of a `FileHistoryStore` (`importHistory` is OPTIONAL on the core
+ *  contract — a store without it cannot be a 2c history sink). */
+export interface FileHistoryImportFace {
+    importHistory(scope: string, data: FileHistoryExport, srcGetBlob: BlobGetter): Promise<FileHistoryResult>;
 }
-/** Single-point capability probe (design/158 R7): does `fs` carry the optional `importManifest` snapshot-import
- *  seam? Returns the bound method (never a naked function reference — `this` inside `importManifest` must resolve
- *  to `fs`, exactly like `asServiceDeps`'s other capability-probe-then-bind authorities) or `undefined` when the
- *  seam is absent (an older/in-memory dev store). Callers gate on the RETURN VALUE, not a separate `typeof` check,
- *  so there is exactly one place that knows the shape of the probe. */
-export declare function fileSnapshotImportFace(fs: unknown): FileSnapshotImportFace | undefined;
+/** Single-point capability probe (design/158 R7): does `fs` carry the optional `importHistory` seam?
+ *  Returns the bound method (never a naked function reference — `this` inside must resolve to `fs`) or
+ *  `undefined` when absent. Callers gate on the RETURN VALUE, not a separate `typeof` check, so there is
+ *  exactly one place that knows the shape of the probe. */
+export declare function fileHistoryImportFace(fs: unknown): FileHistoryImportFace | undefined;
+/**
+ * The 2c PUSH replay of a session's file-history graph — keep-SOURCE convergence over core's
+ * non-destructive-target law. `importHistory` refuses a target that already holds a DIFFERENT graph
+ * (typed `conflict`; the identical envelope re-publishes idempotently). On that arm, when the store has
+ * the purge seam, the sync's documented semantic (the destination converges to the source's state, same
+ * posture as the policy/anchor replays) is applied: wipe the scope, then import once more. A store
+ * WITHOUT `deleteBySession` (the local-lane core file store) surfaces the typed conflict unchanged —
+ * an honest capability limit, never a silent half-state.
+ *
+ * Honest residual (recorded, not hidden): if the RE-import after the wipe fails (a blob corrupted in
+ * transit past the Phase-A presence check), the destination's old graph is already gone and the target
+ * is left EMPTY — worse than the moment before this call, but strictly self-healing: the client re-PUTs
+ * the blob and re-POSTs, and the retry lands on an empty target (importHistory's first-import arm).
+ * The alternative (keeping the old graph) would wedge every retry on the same typed conflict forever.
+ */
+export declare function replayFileHistory(store: ServiceFileHistoryStore, scope: string, envelope: FileHistoryExport, srcGetBlob: BlobGetter, opts: {
+    allowReplace: boolean;
+}): Promise<FileHistoryResult>;
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its
@@ -71,11 +88,10 @@ export interface SessionBundle {
     sessionId: string;
     /** The FULL durable conversation log (compaction floor bypassed), verbatim ids/parents/payload — `exportEntries`. */
     entries: SessionTreeEntry[];
-    /** One per E19 file snapshot (keyed by `SessionTreeEntry.id` = `key`); manifest = [relPath, blobHash] tuples. */
-    snapshots: Array<{
-        key: string;
-        manifest: Array<[string, string]>;
-    }>;
+    /** The session's per-edited-file rewind history graph (core's versioned `FileHistoryExport` envelope —
+     *  tracked set + version chains + boundaries; blob BYTES travel separately, content-addressed). `null` =
+     *  no history / the source store cannot export. Replaces the retired E19 `snapshots` manifests (S-15). */
+    fileHistory: FileHistoryExport | null;
     /** Every (principal, rules) record for the session, across ALL principals (E6 `listBySession`). */
     policy: SessionRulesRecord[];
     /** Every E18 resume-at anchor (eventId→entryId + its source owner; owner is RE-KEYED on import, §9). */
@@ -101,11 +117,8 @@ export interface SessionManifest {
     entryCount: number;
     /** The session's current leaf `SessionTreeEntry.id` (session_meta.leaf_id), or null if it has none. */
     leafId: string | null;
-    /** One per E19 file snapshot (keyed by entry id); manifest = [relPath, blobHash] tuples. EXACTLY as the bundle. */
-    snapshots: Array<{
-        key: string;
-        manifest: Array<[string, string]>;
-    }>;
+    /** The per-edited-file rewind history envelope (S-15; see {@link SessionBundle.fileHistory}). EXACTLY as the bundle. */
+    fileHistory: FileHistoryExport | null;
     /** Every (principal, rules) record across ALL principals (E6 `listBySession`). EXACTLY as the bundle. */
     policy: SessionRulesRecord[];
     /** Every E18 resume-at anchor (eventId→entryId + source owner; RE-KEYED on import, §9). EXACTLY as the bundle. */
@@ -125,7 +138,7 @@ export interface SessionManifest {
  *
  * The OWNER is NOT exported (import re-stamps it, §9). The owner-scope GATE is the CALLER's (route P1d): this returns
  * `null` ONLY for "session does not exist". (Named exportSessionManifest, NOT exportManifest, to avoid the collision
- * with `FileSnapshotStore.exportManifest`.)
+ * with the history store's own export verb.)
  */
 export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend): Promise<{
     manifest: SessionManifest;
@@ -152,24 +165,26 @@ export declare function replayPolicyRecords(store: Pick<SessionPolicyStore, "get
 /** #137 ② 能力预检(fail-loud 方向,[2195] 判据:保护型能力缺席=fail-closed):consented
  *  overwrite-dst 需要 policy 店的 `deleteBySession` purge seam 才能不留混合态;缺席=true,路由在
  *  commit **之前**用它干净中止(此时零写入落地),wire 拒因字面量归路由所有(api-error-text-freeze
- *  锚字面站点)。anchor 店的 deleteBySession 是类型必填、快照店有 core 必填的 `reap` 兜底,都不构成
- *  缺席面;唯一可缺的就是 policy 这条(core 接口上是可选方法)。 */
+ *  锚字面站点)。anchor 店的 deleteBySession 是类型必填、history 店有 core 必填的 `reap` 兜底(+
+ *  {@link replayFileHistory} 的 conflict 收敛臂),都不构成缺席面;唯一可缺的就是 policy 这条
+ *  (core 接口上是可选方法)。 */
 export declare function overwriteWipeIncapable(policyStore: ServiceSessionPolicyStore | undefined): boolean;
 /** #137 ②(死码 ⓪ 擦除步的移植):consented overwrite-dst = keep-source,结果必须是**源端那
- *  一份**,不得混成「源端对话 + 目的端遗留 policy/anchor/快照」(混合态比丢历史更危险:悬空
- *  anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、共享 key 快照因
- *  importManifest create-once 永远留着目的端字节)。调用时点=commit(原子 swap)成功**之后**、
- *  附随物重放**之前**:死码在任何写入前擦(其 entries 写本身非原子);活路由有真 commit point,
- *  擦在 commit 前会在「commit 失败」时留下反向混合态(目的端对话完好、附随物已毁)——方向更坏。
+ *  一份**,不得混成「源端对话 + 目的端遗留 policy/anchor/历史」(混合态比丢历史更危险:悬空
+ *  anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、目的端旧历史图挡住源端图的
+ *  importHistory 空目标法则)。调用时点=commit(原子 swap)成功**之后**、附随物重放**之前**:
+ *  死码在任何写入前擦(其 entries 写本身非原子);活路由有真 commit point,擦在 commit 前会在
+ *  「commit 失败」时留下反向混合态(目的端对话完好、附随物已毁)——方向更坏。
  *  诚实残余:进程在 commit 与本函数之间崩溃时,重试落 Phase A identical 支(无 wipe)⇒ 遗留行
- *  可存活;该窗口窄于修前世界(修前=遗留行**恒**存活),与 §8「快照重放失败 ⇒ 422 重试自愈」
+ *  可存活;该窗口窄于修前世界(修前=遗留行**恒**存活),与 §8「历史重放失败 ⇒ 422 重试自愈」
  *  同款接受,记录于此不装没有。
- *  各店姿势(死码 verbatim 语义):快照=deleteBySession(SQL 孪生:manifest 即删、blob 走异步
- *  孤儿 GC)缺席则 core 必填 `reap(scope, [])`(内容寻址,他 scope 仍引用的 blob 存活);
- *  anchor=直调(类型必填);policy=deleteBySession(路由已用 {@link overwriteWipeIncapable}
- *  预检过,此处缺席=类型外的 JS 层残缺实现,直调抛 TypeError 即 fail-loud)。 */
+ *  各店姿势:file history=deleteBySession(整 scope 清空;blob 走异步孤儿 GC)缺席则 core 必填
+ *  `reap(scope, [])`(丢全部 boundary;v1 基线按 core 契约留存 —— 随后 {@link replayFileHistory}
+ *  的 conflict 臂在有 purge 缝的店上收敛,无缝的店如实 422);anchor=直调(类型必填);
+ *  policy=deleteBySession(路由已用 {@link overwriteWipeIncapable} 预检过,此处缺席=类型外的
+ *  JS 层残缺实现,直调抛 TypeError 即 fail-loud)。 */
 export declare function wipeSessionAttendants(stores: {
-    fileSnapshotStore?: ServiceFileSnapshotStore | undefined;
+    fileHistoryStore?: ServiceFileHistoryStore | undefined;
     sessionPolicyStore?: ServiceSessionPolicyStore | undefined;
     resumeAnchorStore?: Pick<ResumeAnchorStore, "deleteBySession"> | undefined;
 }, sessionId: string): Promise<void>;

package/dist/session-sync.js

@@ -1,10 +1,22 @@
 import { classifySyncRelationship } from "./session-sync-kernel.js";
 import { normalizeRules, stripRev } from "@sema-agent/core";
-export function fileSnapshotImportFace(fs) {
-    const candidate = fs?.importManifest;
+export function fileHistoryImportFace(fs) {
+    const candidate = fs?.importHistory;
     if (typeof candidate !== "function")
         return undefined;
-    return { importManifest: candidate.bind(fs) };
+    return { importHistory: candidate.bind(fs) };
+}
+export async function replayFileHistory(store, scope, envelope, srcGetBlob, opts) {
+    const face = fileHistoryImportFace(store);
+    if (face === undefined) {
+        return { ok: false, error: { code: "unsupported_format", message: "this deployment's file-history store has no importHistory seam" } };
+    }
+    let r = await face.importHistory(scope, envelope, srcGetBlob);
+    if (!r.ok && r.error.code === "conflict" && opts.allowReplace && typeof store.deleteBySession === "function") {
+        await store.deleteBySession(scope);
+        r = await face.importHistory(scope, envelope, srcGetBlob);
+    }
+    return r;
 }
 function ownerAware(backend) {
     return backend.session();
@@ -19,17 +31,8 @@ export async function exportSessionManifest(sessionId, srcBackend) {
         return null;
     const getLeafId = session.getLeafId?.bind(session);
     const leafId = getLeafId ? await getLeafId(sessionId) : null;
-    const fs = srcBackend.fileSnapshot();
-    const snapshots = [];
-    if (typeof fs.exportManifest === "function") {
-        const keys = await fs.listKeys(sessionId);
-        for (const key of keys) {
-            const manifest = await fs.exportManifest(sessionId, key);
-            if (manifest === null)
-                continue;
-            snapshots.push({ key, manifest: [...manifest] });
-        }
-    }
+    const fs = srcBackend.fileHistory();
+    const fileHistory = typeof fs.exportHistory === "function" ? await fs.exportHistory(sessionId) : null;
     const policyStore = srcBackend.sessionPolicy();
     const policy = typeof policyStore.listBySession === "function"
         ? await policyStore.listBySession(sessionId)
@@ -39,7 +42,7 @@ export async function exportSessionManifest(sessionId, srcBackend) {
     const getBlobFn = fs.getBlob?.bind(fs);
     const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;
     return {
-        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, snapshots, policy, anchors },
+        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors },
         getBlob,
     };
 }
@@ -68,7 +71,7 @@ export function overwriteWipeIncapable(policyStore) {
     return policyStore !== undefined && typeof policyStore.deleteBySession !== "function";
 }
 export async function wipeSessionAttendants(stores, sessionId) {
-    const fs = stores.fileSnapshotStore;
+    const fs = stores.fileHistoryStore;
     if (fs !== undefined) {
         if (typeof fs.deleteBySession === "function")
             await fs.deleteBySession(sessionId);

package/dist/shared-memory-scope-authorizer.d.ts

@@ -45,7 +45,7 @@ export interface SharedMemoryScopeAuthorizerOptions {
 /**
  * 活对象(闭包持有目录与取值口)⇒ `create*`(CLAUDE.md 工厂命名律)。
  *
- * **代价与它的边界**(codex 对抗复审 R1-[medium] 的一半采纳,一半具名保留):取值口按调用现算,
+ * **代价与它的边界**(codex 交叉复审 R1-[medium] 的一半采纳,一半具名保留):取值口按调用现算,
  * 意味着每次 `resolve` 都要扫一遍 `config.projects`(O(项目数 × 每项 scope 数)的纯 CPU)。
  *  · **已采纳**:principal 缺席那支不再二次建 Set —— 生产取值口(`collectDeploymentOrgScopes`)本来就用
  *    Set 建、交回来已去重,这里再包一层是纯浪费。**去重责任因此上移到取值口**(契约见下面那个字段的注),

package/dist/sighup-idle.d.ts

@@ -39,7 +39,7 @@ export interface SighupIdleDeps {
 /**
  * SIGHUP 处理器 + 它自己那只空闲窗的**停表口**。
  *
- * 🔴 `stop()` 不是可选装饰(codex 对抗复审 F2,已复现):armed 之后这只 interval **刻意不 unref**
+ * 🔴 `stop()` 不是可选装饰(codex 交叉复审 F2,已复现):armed 之后这只 interval **刻意不 unref**
  * (孤儿形下它就是关停驱动),而它握着的 `shutdown`/`escalate` 是**装配那一刻**的闭包。只摘 SIGHUP 监听、
  * 不停表 = 一个已经退役的装配仍会在 grace 到期时按旧 ctx 关停进程(实测:arm 后立刻摘监听,1.1s 后旧
  * ctx 的 `server.close` 照样被调)。注册/摘除配对必须覆盖它。

package/dist/spec-fields.d.ts

@@ -60,6 +60,27 @@ export declare function validateTaskAgents(v: unknown): string | null;
  *     `task_agent_dropped`(绝不 throw 砖 resume);重名后到者 DROP;超上限截断。幸存字段按白名单拷贝
  *     (不透传未知键 —— 非法项已整条 drop,这里只是让持久化 body 的杂键不上 spec)。全空 ⇒ undefined。 */
 export declare function taskAgentsFromBody(raw: unknown, requirePrincipal: boolean | undefined, warn: (event: string, fields: Record<string, unknown>) => void): AgentDefinition[] | undefined;
+/** [5673]②/[5697](cli 认领消费)—— fresh-submit 的 agents[].model **目录成员资格**门(形状门
+ *  {@link validateTaskAgents} 通过之后跑;调用方铸 400 `request.unknown_reference` + `available` 枚举)。
+ *  病灶=报错太晚太远:server 持目录却不查,错到 core prepare 才炸 `config.agent.unknown_model`
+ *  (dist/agents/subagent.js:1258),以「run failed」形出现而非 400;cli resolver 只挡词法形,目录
+ *  成员资格只有 server 持有。
+ *  三条判定纪律(全部 core dist 亲读):
+ *   - **只查 string 形**:core 只对 `typeof a.model === "string"` 走 `resolveModel`(subagent.js:1253);
+ *     Model 对象形 core 原样信任不查目录([879]④ 契约:自带完整 Model 配置,其 id 本就不必在目录)——
+ *     对象形没有「晚失败」病灶,这里同拒会是射程外的行为收紧,不做。
+ *   - **`catalog` 必须是 tier 展开形**(调用方传 `expandTiers(config.models, config.tiers) ?? config.models`,
+ *     resolve-spec.ts wireCatalog 同源纪律):core Runner 构造期把 deps.models 换成展开目录
+ *     (runtask.js:1472),agentCatalog.models 即它 —— 裸 config.models 会把合法档位词/CC 别名误杀 400。
+ *   - **判定=`Object.hasOwn` 纯键查**,刻意不用 `matchCatalogModel`:那是 body.model 门的四形判
+ *     (name/tier/alias/**id**),而 core 的 `resolveModel` 是纯键查(roles.js:`models?.[ref]`)——
+ *     多认 id 形会放行一个 core prepare 必炸的值(门假绿,病灶照旧)。hasOwn 顺带挡原型链键。
+ *  RESUME 重放不过此门({@link taskAgentsFromBody} 维持 defensive drop 现状;重放无 400 可回,
+ *  模型事后被移出目录时由 core prepare 拒)。 */
+export declare function unknownTaskAgentModelRef(agents: readonly unknown[], catalog: Record<string, unknown>): {
+    index: number;
+    ref: string;
+} | undefined;
 /** [876] main.ts resolveSpec 的 agents 装配片段(可 import 真 fold,[1.211 codex L]:此前 main.ts 用内联
  *  闭包,测试只能 SOURCE PIN 文本+重写同构表达式——文本锚可被「移出 resolveSpec 但保留同文」静默骗过;
  *  现在行为测试直接调这个真出口,main.ts 只剩一次调用点可锚)。语义=taskAgentsFromBody 的条件 spread:
@@ -106,7 +127,7 @@ export interface TaskLimitCaps {
 /**
  * [854]④ — normalize `body.limits` → 请求方配速意图 {maxWalltimeMs?, maxOutputTokens?, maxTurns?}。DEFENSIVE
  * (resume 重放持久化 body 不过 HTTP 400 门):仅正的有限数字存活(floor 取整),0/负/垃圾按键 DROP —— core 侧
- * 墙钟 > 0 才生效(0=不设墙,会绕过运营方封顶)、maxTurns/maxOutputTokens 的 0 无意义。每键各自被
+ * 墙钟 > 0 才生效(0=不设墙,会跳过运营方封顶)、maxTurns/maxOutputTokens 的 0 无意义。每键各自被
  * 运营方上限旋钮 clamp(Math.min;旋钮缺省不设=不封顶)。全空 ⇒ undefined。
  */
 export declare function normalizeLimits(v: unknown, caps: TaskLimitCaps, warn?: (event: string, fields: Record<string, unknown>) => void): {

package/dist/spec-fields.js

@@ -231,6 +231,17 @@ export function taskAgentsFromBody(raw, requirePrincipal, warn) {
     }
     return out.length > 0 ? out : undefined;
 }
+export function unknownTaskAgentModelRef(agents, catalog) {
+    for (let i = 0; i < agents.length; i++) {
+        const item = agents[i];
+        if (item === null || typeof item !== "object")
+            continue;
+        const model = item.model;
+        if (typeof model === "string" && !Object.hasOwn(catalog, model))
+            return { index: i, ref: model };
+    }
+    return undefined;
+}
 export function taskAgentsSpecFragment(raw, requirePrincipal, warn) {
     const agents = taskAgentsFromBody(raw, requirePrincipal, warn);
     return agents ? { agents } : {};

package/dist/store-live-probe.d.ts

@@ -7,7 +7,7 @@
  * 键形钉在 test/health-store-live.test.ts,本环判据钉在 test/store-live-probe.test.ts)。
  *
  * 判据:
- * - 有界:单拍探针经 STORE_PROBE_TIMEOUT_MS race——挂死的 pool(半开连接)不得钉死环;
+ * - 有界:单拍探针经 STORE_PROBE_TIMEOUT_MS race——挂死的 pool(半开连接)不得卡住环;
  * - 翻转披露(§M):live→dead warn `store_probe_dead`、dead→live info `store_probe_recovered`,
  *   只在翻转拍记(连续死不逐拍刷日志——down 的 DB 不该制造日志风暴);
  * - 诚实缺席:首拍落地前 state() = undefined(/health 键缺席=「还没探过」,不冒充「活」)。
@@ -50,7 +50,7 @@ export type StoreProbePublicPhrase = (typeof STORE_PROBE_PUBLIC_PHRASES)[number]
  * 原始探针异常 message → 免鉴权面可披露的闭集词。**返回值恒是 {@link STORE_PROBE_PUBLIC_PHRASES} 的
  * 一个字面量**(返回类型即闭集,写错一个词是编译错误),永不回声入参。
  *
- * 误分类的代价是「运维读到的分类不精确」,**不是泄露** —— 所以这里的判别用宽松的子串包含即可,不必为
+ * 误分类的代价是「运维读到的分类不精确」,**不是外泄** —— 所以这里的判别用宽松的子串包含即可,不必为
  * 精确性把原文碎片带出来。臂序有意义:自家的 race 超时先于泛化的 timeout 臂。
  */
 export declare function publicStoreProbeError(raw: string): StoreProbePublicPhrase;

package/dist/task-a2a.d.ts

@@ -35,7 +35,7 @@
  * 判据一到货就换 core 真源、钉子逐字不用改。
  * 🔴 **今天这两票在 env 通道上还打不响**,而这是刻意如实记下的、不是被忽略的缺口:`LOCKED_CONFIG_KEYS`
  * 经 core 的 `resolveLockedKeys` 校验(未知键拒启)、`COMPLIANCE_ADDITIONAL_DENIES` 经 `COMPLIANCE_CAPABILITIES`
- * 校验(同拒),所以运维今天**写不进** `a2a` / `a2a_peers`。而且合规那一票还有第二层:即便有人绕过 boot 期
+ * 校验(同拒),所以运维今天**写不进** `a2a` / `a2a_peers`。而且合规那一票还有第二层:即便有人跳过 boot 期
  * 校验把 `a2a_peers` 塞进档位,`resolveComplianceDenies` 对闭集外的词是**抛**(亲测 core 5.36),于是这条
  * 请求腿的失败方向是**响亮**(500)而不是安静放行 —— 方向正确,故本模块不加任何兜底。两票的代码先在场是
  * 纵深:core 词表到货那一拍这条腿自己就活了,不需要有人记得回来补;反过来(等词表到了再写判据)才是

package/dist/task-cwd.d.ts

@@ -17,6 +17,31 @@ export declare function cwdHonored(config: {
     };
     requirePrincipal?: boolean;
 }): boolean;
+/**
+ * device lane 的**平行**判别式(device-executor-lane-v2 §4.3.3,车A-4)——「员工在自己设备的项目目录
+ * 里干活」是这条车道的存在理由,所以 caller cwd 必须被尊重。
+ *
+ * 🔴 **为什么不合并进 {@link cwdHonored}**:两闸语义不同,合并会把 host 的单用户约束**放松**。
+ *  · `cwdHonored` 的 `requirePrincipal !== true` 防的是「一个租户的输入把 agent 指向 **worker 宿主**上
+ *    另一个租户/运维的目录」—— 那是一台共享机器上的跨租户穿越;
+ *  · device lane 上那个穿越面**结构性不存在**:路径落在**发起者自己的设备**上,而设备归属已由
+ *    `device_session` 绑定行(提交期用验证过的 principal 写下)+ 准入链的 owner 谓词验过。所以本闸
+ *    **不要求**单用户 —— 多租户部署里每个员工各连各的设备,正是这条车道的正常形态。
+ * 合并两者 = 让 host 车道在多租户下也开始尊重 cwd,那是一条真实的超范围面。
+ *
+ * 消费者:写侧 = `boot/resolve-spec.ts`(**单写者**,与 cwdHonored 同一处);读侧 =
+ * `plugins/remote-env-device.ts` 的工厂(`effectiveDeviceCwd`)。两侧必须同批落 —— 只开写侧会留下一个
+ * 没有消费者的登记项(这正是 A-1 把它登记进 `PLANNED_LANE_DIVERGENCES` 而不是当场开的理由)。
+ *
+ * ⚠️ 刻意**不**连带放开 `additionalDirectories`:那一位在 device v1 上诚实缺席(v2 §4.1 capability
+ * projectContext 行:「拆精确字段,device v1 对 unsupported 项显式 false,不打包沿用」)。
+ */
+export declare function deviceCwdHonored(config: {
+    remoteExec?: {
+        provider?: string;
+    };
+    requirePrincipal?: boolean;
+}): boolean;
 /**
  * [851]P3a — the OTHER host-semantics lane: provider UNSET = the in-process single-user lane. It has NO shell
  * hands (core prepare-task: no factory/executionEnv ⇒ StubExecutionEnv), so the perSession cwd/env registries

package/dist/task-cwd.js

@@ -11,6 +11,9 @@ export function isValidCwd(cwd) {
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }
+export function deviceCwdHonored(config) {
+    return config.remoteExec?.provider === "device";
+}
 export function inProcessSingleUserLane(config) {
     return config.remoteExec === undefined && config.requirePrincipal !== true;
 }

package/dist/task-mcp.d.ts

@@ -17,7 +17,7 @@
  *     MCP honored seamlessly (TOC↔cloud is a spectrum, not a wall — clay 2026-06-29: TOB = single-user + people-mgmt).
  *     The caller being the trust root, `toolAxes` (authoritative effect overrides) + `elicitation` are their own choices.
  *   - MULTI-TENANT deployment (`requirePrincipal===true`): a tenant must NOT make the SHARED worker run an arbitrary
- *     command (RCE) or connect to a body-chosen URL (SSRF). Gate CLOSED → body MCP ignored; the fleet gets MCP only
+ *     command (unrestricted exec) or connect to a body-chosen URL (SSRF). Gate CLOSED → body MCP ignored; the fleet gets MCP only
  *     through center config refs. Per-principal http-remote injection (a center `allowMcpInjection` entitlement via
  *     `runtimeCapsResolver`) is a DEFERRED v2.
  * When the gate is closed, a sent `mcpServers` is IGNORED (advertised via `capabilities.mcpInjection`).
@@ -83,7 +83,7 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  * (`requirePrincipal===true`)整只 `mcpServers` 被忽略,租户**结构上**够不着这个键(钉见
  * `test/task-mcp.test.ts` 的多租户格)。同一条腿今天已经透传 `toolAxes`(喂**审批门**,权限比本键**高**
  * 一档 —— core 明写 contentOrigin「no gate/policy/roster effect」)与 stdio 的**任意命令**(worker 宿主
- * 上的真 RCE);在那两样之后,「我声明我自己这台 server 的内容不算外来」不构成任何新的暴露面。
+ * 上的真无限制执行);在那两样之后,「我声明我自己这台 server 的内容不算外来」不构成任何新的暴露面。
  * 名字撞车时 baseline 恒赢(`mergeRequestMcp`)⇒ 调用方也改写不了一台**已配置** server 的声明。
  *
  * ## 为什么 fresh 腿是 400 而不是静默丢键
@@ -97,7 +97,7 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  * (`normalizeServer` / `resolveMcpServers`),core 根本看不到它,也就永远不会拒。
  * 与此同时 `checkpoint_ctx` 存的是**原始** `TaskRequestBody`,耐久 resume 逐字重放它,从本门逃出去的
  * `HttpError` 会被 `src/http/server.ts` 折成 `409 resume_blocked_by_policy` ⇒ 一条**升级前** park、body 里
- * 带着当时被静默忽略的坏值的任务,升级后**永久**恢复不了(codex 对抗复审 R1-[high],验真后采纳)。
+ * 带着当时被静默忽略的坏值的任务,升级后**永久**恢复不了(codex 交叉复审 R1-[high],验真后采纳)。
  * ⇒ 照本仓成文的三处 `opts.leg` 先例(`appendSystemPrompt` 案 / `@model` 名单 #233 终裁 (a) /
  * `compactionModel` 案,都逐字写着「砖死 resume 比降级糟」):fresh fail-loud,resume 降级 + 留声
  * (留声点 = {@link resolveRequestMcp} 的 `mcp_content_class_dropped`)。挂点判据在 `boot/resolve-spec.ts`。

package/dist/task-settings.d.ts

@@ -25,7 +25,7 @@
  * `combinePolicies` / `tightenTaskSpec`), so the deny-wins ENFORCEMENT is core-single-source. Only the COMPOSITION
  * is duplicated for the remote path; a proposed follow-up extracts it to `@sema-agent/sdk` for true
  * single-source. Because the core backstops (deny-wins + tighten-throws-on-loosen + this bypass-reject) hold either
- * way, a composition drift would be a local/remote CONSISTENCY gap, never a privilege escalation.
+ * way, a composition drift would be a local/remote CONSISTENCY gap, never a privilege-scope widening.
  *
  * v1 scope: `permissions` + `permissions.defaultMode` + `model` + `outputStyle` + `env` (shipped 1.26.0). DEFERRED
  * (need a seam, flagged to the team + advertised in capabilities so a caller never silently loses a setting):
@@ -97,7 +97,7 @@ export declare function effectivePermissionMode(body: {
  *    §8 保留「core auto 分类器覆盖面有新披露时可独立再裁,表驱动一行」——新披露见下段):
  *
  *    ⚠️ **`auto` 这一行有一条待裁的开口(design/201 §8 明列「core auto 分类器覆盖面有新披露时可独立再裁,
- *    表驱动一行」)。施工期对抗复审给出了那条新披露,已亲读安装包核实**:
+ *    表驱动一行」)。施工期交叉复审给出了那条新披露,已亲读安装包核实**:
  *      · core 只在**已经产生 `ask`** 之后才咨询分类器(`dist/core/hooks.js`:`if (input.autoMode &&
  *        decision.action === "ask" …)`);
  *      · 而 `shellGate:"off"` 下 core **不铸任何 shell 面的门**(`dist/core/runner/prepare-task.js` 的
@@ -155,7 +155,7 @@ export interface ParseTaskSettingsResult {
     deferred: string[];
 }
 /** Cap on `outputStyle` length — it lands in the system prompt, so it shares the `MAX_SYSTEM_PROMPT_CHARS` (16384)
- *  posture (an uncapped prompt body is a per-turn token-cost hole; adversarial review). Exported so the HTTP layer
+ *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
  *  (prepareSpec) can 400 fail-loud on submit with the SAME bound this defensive parse enforces on every path. */
 export declare const MAX_SETTINGS_OUTPUT_STYLE_CHARS = 16384;
 /** Cap on the element count of each permission list (allow/deny/ask) — bounds a pathological rule blast. */

package/dist/task-settings.js

@@ -1,5 +1,6 @@
 import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
 import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
     if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
@@ -160,7 +161,8 @@ function createAskListPolicy(askNames) {
         });
     }
     catch (e) {
-        throw new Error(`permissions.ask has rule(s) core cannot compile — ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        throw new Error(`permissions.ask has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];

package/dist/task-workflow.d.ts

@@ -78,7 +78,7 @@ export declare function normalizeRetainSubagentSessions(raw: unknown): boolean |
     max?: number;
 } | undefined;
 /**
- * Per-task wall clock by TENANCY POSTURE (clay 2026-07-04, make-real 教训①:600s 默认墙钟砍掉了健康推进的
+ * Per-task wall clock by TENANCY POSTURE (clay 2026-07-04, make-real 教训①:600s 默认墙钟截停了健康推进的
  * 长任务/chaos 恢复 run):
  *  - SINGLE-USER turnkey(`requirePrincipal !== true`)= the user IS the superadmin → **NO wall clock**
  *    (undefined; core arms none — its separate wedge safety-net still catches a stuck tool call, so "no wall"

package/dist/text-bidi.d.ts

@@ -27,8 +27,8 @@
  *  · U+061C = ALM(Arabic Letter Mark);U+200E/200F = LRM/RLM;
  *  · U+202A-202E = 嵌入/覆写族(含 RLO);U+2066-2069 = 隔离符族。
  *
- * 🔴 **U+061C 是 codex 对抗复审 [medium] 验真后补的**:首版漏了它 —— 而漏一个码点在**检测**面上不是
- * 「覆盖率差一点」,是一条完整的绕过路(只用 ALM 构造的输入让在场位缺席,壳于是照常按干净渲染)。
+ * 🔴 **U+061C 是 codex 交叉复审 [medium] 验真后补的**:首版漏了它 —— 而漏一个码点在**检测**面上不是
+ * 「覆盖率差一点」,是一条完整的跳过路(只用 ALM 构造的输入让在场位缺席,壳于是照常按干净渲染)。
  * 交叉锚:core 自己的 `APPROVER_REFUSED_CHARS_RE`(`dist/core/tool-policy.js`)同样含 `\\u061c`。
  *
  * ⚠️ 与 core 那只**更宽**的集合的差额如实登记(刻意,不是漏):core 还含 C1(`\\u0080-\\u009f`)与