@sema-agent/server 7.52.0 → 7.53.0

package/dist/task-cwd.d.ts

@@ -43,7 +43,7 @@ export declare function deviceCwdHonored(config: {
     requirePrincipal?: boolean;
 }): boolean;
 /**
- * [851]P3a — the OTHER host-semantics lane: provider UNSET = the in-process single-user lane. It has NO shell
+ * [ref]P3a — the OTHER host-semantics lane: provider UNSET = the in-process single-user lane. It has NO shell
  * hands (core prepare-task: no factory/executionEnv ⇒ StubExecutionEnv), so the perSession cwd/env registries
  * have no consumer there — but PROCESS-level consumers (hooks commands, the C4 projectContext local read) still
  * see the engine's own `process.cwd()`/`process.env`. When the shell spawned the engine in the caller's own
@@ -58,37 +58,37 @@ export declare function inProcessSingleUserLane(config: {
     requirePrincipal?: boolean;
 }): boolean;
 /**
- * #295(F-1,[4512] 修向 (b')):卡批「不再询问」落盘规则的 **project root** —— 「这次授权是在哪个
+ * [ref](F-1,[ref] 修向 (b')):卡批「不再询问」落盘规则的 **project root** —— 「这次授权是在哪个
  * 工作目录里点的」。取值与既有 cwd 语义同源,不新造坐标系:
  *   1. session 显式注册的 cwd(cwd seam,host lane;与 {@link effectiveHostWorkspace} 第 1 优先级同源)
  *      —— **今天唯一真的会命中的那一臂**;⚠️ 它**不含 lane 判据**,lane 语义完全依赖「`perSessionCwd`
  *      只在 `cwdHonored` 为真时被写」这条跨文件外部不变量(写侧唯一入口 boot/resolve-spec.ts)。这是
  *      刻意的单写者惯用法,不是疏漏:在消费端补第二道闸 = 把一条不变量拆给两个属主(同族消费者
- *      {@link effectiveHostWorkspace} 形状完全相同)。机器背书 = test/task-cwd.test.ts 的 A-054.2 两格。
- *   2. 🔴 **前瞻/防御臂,本仓当前装配下零命中**(A-054.21,2026-08-19 合并重扫 partial,存活断言):
+ *      {@link effectiveHostWorkspace} 形状完全相同)。机器背书 = test/task-cwd.test.ts 的 [ref] 两格。
+ *   2. 🔴 **前瞻/防御臂,本仓当前装配下零命中**([ref],2026-08-19 合并重扫 partial,存活断言):
  *      in-process 单用户 lane({@link inProcessSingleUserLane})取引擎自身 `process.cwd()`。它读起来像在
  *      服务一个真部署形,其实到不了 —— 该 lane 的 `remoteExec` 未设 ⇒ boot/execution-env.ts 六条工厂臂全
  *      不命中 ⇒ core 落 `StubExecutionEnv` ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
  *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleOffers` ⇒ 本函数在规则车道上根本不被调用;同 lane
  *      第 1 臂也因写侧闸只在 `cwdHonored` 下开而恒空。危害口径按 refuter **降级**:死枝 ≡ 落第 3 臂
- *      `undefined` ≡ core global 缺省 ≡ #295 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
+ *      `undefined` ≡ core global 缺省 ≡ [ref] 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
  *      🚧 **给将来接手的人的红线**:这条 lane 若哪天真接上 hands,root 必须取 `executionEnv.cwd`(core 的
  *      `taskRootFinal` 就是它),**不是** `process.cwd()` —— 两者在静态 env 装配形下可以完全不同,照现注
  *      直接接线会铸出一个真的歪 root。真正的本地开箱形(`CONFIG_PROVIDER=local`)被 config 默认成
- *      **host** lane,受益的是第 1 臂;本臂不是「#295 的本地形受益臂」。
+ *      **host** lane,受益的是第 1 臂;本臂不是「[ref] 的本地形受益臂」。
  *   3. 其余(远程沙箱 / REMOTE_EXEC=host 未注册 / 多租户)⇒ `undefined`:root 在 server 坐标系里
- *      不可知,调用方**不铸 scope**,落 core 的 global 缺省(= #295 修前行为,恒不更宽;也绝不铸一个
+ *      不可知,调用方**不铸 scope**,落 core 的 global 缺省(= [ref] 修前行为,恒不更宽;也绝不铸一个
  *      与规则判定时 cwd 不同坐标系的 root —— 那会静默把「不再询问」变成恒不命中)。
  *
- * 🔴 出口 = `path.resolve(原字节)`,**禁 realpath**(A-054.F-A,2026-08-19 合并重扫 confirmed high):
+ * 🔴 出口 = `path.resolve(原字节)`,**禁 realpath**([ref].F-A,2026-08-19 合并重扫 confirmed high):
  * core 判定这条规则时喂进 `scopeCoversCwd` 的 cwd = `executionEnv.cwd` = host env 构造里的
  * `path.resolve(同一条注册原字节)`(remote-env-host.ts),比较是**纯串**(`pathWithinRoot`,零
  * realpath)。初版这里走 realpath(据 core `PersistedAllowRule.scope` JSDoc「root 由构造方
- * canonicalize」)——但 JSDoc 说的是义务、实现行才是事实([3578] 宪法):core 自己喂进匹配的 cwd
+ * canonicalize」)——但 JSDoc 说的是义务、实现行才是事实([ref] 宪法):core 自己喂进匹配的 cwd
  * 恰恰**未** canonicalize,单侧规范化=两坐标系分叉,注册 cwd 含符号链接段时(macOS `/tmp`、
  * `~/work→/mnt/...`)落盘规则**永不命中**,「不再询问」恒失效。正解=root 与判定坐标出自**同一条
  * 串、同一种规范化**;将来 core 若把判定面改 canonicalize,这里必须同批跟(端到端钉在
- * test/task-cwd.test.ts 的 A-054.F-A 格,靠真 `scopeCoversCwd` 咬住两侧任何一侧的单独漂移)。
+ * test/task-cwd.test.ts 的 [ref].F-A 格,靠真 `scopeCoversCwd` 咬住两侧任何一侧的单独漂移)。
  * `path.resolve` 不抛 ⇒ 初版的 realpath 失败 F 类兜底臂(`rule-scope-root-unresolvable`)随之退役
  * (census 行同批销,fail-open.ts)。
  */
@@ -109,7 +109,7 @@ export declare function shellEnvMismatchCount(requested: Record<string, string>,
 /** Cap on the number of `--add-dir` entries a caller may attach (bounds a pathological allowlist blast). */
 export declare const MAX_ADDITIONAL_DIRS = 64;
 /**
- * design/119 (CC `--add-dir` parity): validate an untrusted `body.additionalDirectories` — extra host dirs the
+ * [ref] (CC `--add-dir` parity): validate an untrusted `body.additionalDirectories` — extra host dirs the
  * FILE tools may access beyond the containment root (core canonicalizes each into its allowlist + lists them in the
  * `# Environment` block). Gated identically to {@link cwdHonored}: these are the caller's OWN-machine paths, so they
  * only make sense — and are only safe — on the single-user host lane (on a cloud/container lane a file-tool root is

package/dist/task-mcp.d.ts

@@ -39,7 +39,7 @@ export declare function mcpInjectionHonored(config: {
 }): boolean;
 /**
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
- * valid subset + the names of dropped (malformed/over-cap) entries + design/378's `badContentOrigin`
+ * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
  */
 export declare function validateRequestMcp(raw: unknown): {
@@ -51,14 +51,14 @@ export declare function validateRequestMcp(raw: unknown): {
     }>;
 } | null;
 /**
- * design/170 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
+ * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
  * 为什么在这里也拒一次(与 core 的 prepare 门不是「两处裁决」):设计稿把裁决点定在 server 治理层,
  * core 的 preflight 执行的是**同一条**判据的引擎侧终局形。二者语义等价、位置不同 —— 一个请求根本不该
  * 进 core 才发现自己被锁,而消费端拿到一条同步 4xx 比拿到一个跑起来又终态失败的任务可诊断得多。
  *
  * 判据是「请求**占位**」而不是「请求的值合不合法」:锁是两态的,占了就整拒,不静默丢(静默丢正是
- * design/170 §2.3 讲的那种把判决变成探针的形)。键缺席 / 显式 `null` 都不是占位。
+ * [ref] §2.3 讲的那种把判决变成探针的形)。键缺席 / 显式 `null` 都不是占位。
  *
  * ⚠️ **不看车道**:多租户腿本来就会忽略 body MCP(`mcpInjectionHonored` 关),但锁在场时忽略是错的
  * 失败方向 —— operator 声明了「本部署不收任务自带 MCP」,那就该说出来,而不是安静地当没看见。
@@ -69,7 +69,7 @@ export declare function validateRequestMcp(raw: unknown): {
  */
 export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: ReadonlySet<LockedKey>): void;
 /**
- * design/378(core 5.60.0 提货批件②)—— 请求体里 `mcpServers[].contentOrigin` 的**值域门**,腿首同步拒。
+ * [ref](core 5.60.0 提货批件②)—— 请求体里 `mcpServers[].contentOrigin` 的**值域门**,腿首同步拒。
  *
  * ## 先把 core 的硬条款抄下来,因为本腿的全部争议都在它上面
  * `McpServerSpec.contentOrigin` 顶注逐字:「TRUST SOURCE — a DEPLOYMENT-plane key … any assembly layer
@@ -98,7 +98,7 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  * 与此同时 `checkpoint_ctx` 存的是**原始** `TaskRequestBody`,耐久 resume 逐字重放它,从本门逃出去的
  * `HttpError` 会被 `src/http/server.ts` 折成 `409 resume_blocked_by_policy` ⇒ 一条**升级前** park、body 里
  * 带着当时被静默忽略的坏值的任务,升级后**永久**恢复不了(codex 交叉复审 R1-[high],验真后采纳)。
- * ⇒ 照本仓成文的三处 `opts.leg` 先例(`appendSystemPrompt` 案 / `@model` 名单 #233 终裁 (a) /
+ * ⇒ 照本仓成文的三处 `opts.leg` 先例(`appendSystemPrompt` 案 / `@model` 名单 [ref] 终裁 (a) /
  * `compactionModel` 案,都逐字写着「砖死 resume 比降级糟」):fresh fail-loud,resume 降级 + 留声
  * (留声点 = {@link resolveRequestMcp} 的 `mcp_content_class_dropped`)。挂点判据在 `boot/resolve-spec.ts`。
  *

package/dist/task-settings.d.ts

@@ -8,17 +8,17 @@
  * Design: `TaskRequest.settings` is a
  * PER-REQUEST ephemeral stamp = the v2-design TASK layer (a single-run override, NOT durable). It folds into THIS
  * spec via {@link tightenTaskSpec} and that is all — it is NEVER written to the durable `SessionPolicyStore` (the
- * operator/principal axis, design/99 §E6, a different trust axis + lifecycle). Re-applying on a resume leg is
+ * operator/principal axis, [ref] §E6, a different trust axis + lifecycle). Re-applying on a resume leg is
  * idempotent (the same tighten), so no special resume handling is needed (mirrors runtime-governance).
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3):
  *  - permissions are TIGHTEN-ONLY — folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any
  *    override that would LOOSEN a stricter base safety field. The client can only ADD denies/asks/handsReadOnly on
  *    top of the deployment + operator baseline, never widen it.
- *  - permissionMode(轴B #2 注释保鲜,1.254——[816]/[820] 后的真实现):`defaultMode` 收**五**模式
+ *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
  *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
- *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[816] 拍照。
+ *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[ref] 拍照。
  *
  * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
  * the shell's LOCAL-Runner resolver — both compose the SAME core primitives (`createAllowDenyPolicy` /
@@ -37,36 +37,36 @@
  */
 import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider } from "@sema-agent/core";
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
-/** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [820]/[822] five-word
- *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set (A-065 P2-1 corpus check): CC's own
+/** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [ref]/[ref] five-word
+ *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set ([ref] P2-1 corpus check): CC's own
  *  full enum is SIX words (= ours + `dontAsk`), CC's managed/remote form accepts FOUR (= ours − `bypassPermissions`,
  *  which it warns-and-ignores). Ours = {CC-remote four} ∪ {`bypassPermissions`} — registered divergence, not parity.
- *  `bypassPermissions` and `auto` joined the set with the [816] fs-write gate: since the gate exists, every
+ *  `bypassPermissions` and `auto` joined the set with the [ref] fs-write gate: since the gate exists, every
  *  mode is a choice of HOW MUCH mode-derived gating the interpretation layer ADDS on top of the deployment baseline —
- *  `bypassPermissions` adds none (= the pre-[816] behavior of every mode: "不加门" not "开门", [820] table row 4; the
+ *  `bypassPermissions` adds none (= the pre-[ref] behavior of every mode: "不加门" not "开门", [ref] table row 4; the
  *  deployment approval/governance baseline is composed OUTSIDE this derive and is untouchable from a settings stamp),
  *  and `auto` adds the same ask gate as `default` with core's auto-mode classifier screening the asks upstream
- *  (entitlement-gated in core, [822]②). */
+ *  (entitlement-gated in core, [ref]②). */
 export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto";
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
  * CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
  * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the mode only selects the CLIENT-derived
  * gate ({@link deriveSettingsPolicy}); it can never subtract from the deployment/operator policy (applyTaskSettings
- * folds via tightenTaskSpec, deny-wins). Post-[816] the honored set is the five-word table above (NOT "CC verbatim" —
+ * folds via tightenTaskSpec, deny-wins). Post-[ref] the honored set is the five-word table above (NOT "CC verbatim" —
  * see the {@link SettingsPermissionMode} header for the three-set contrast; the earlier "five CC modes" wording here
- * was A-065 P2-1's finding: no CC set has five members). `acceptEdits`,
+ * was [ref] P2-1's finding: no CC set has five members). `acceptEdits`,
  * `bypassPermissions` and `auto` are HONORED as gate-shape choices (they no longer coerce to `default`, which
  * would FORCE the manual ask gate onto a caller that explicitly asked for less asking — with the gate live, the old
  * coercion would have been a behavior change for them, incl. a headless-deny regression for bypass callers). An
  * UNKNOWN string still coerces to `default` (fail-safe: the most-asking mode).
- * #157-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-five-mode value
+ * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-five-mode value
  * (server.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
  * population the gate deliberately does not cover: RESUME replay of a persisted pre-gate body (outputStyle/model
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
 export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
-/** L2 ultracode (design/111): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
+/** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
  *  future-proof). Awareness rides for free: core composes ORCHESTRATION_AWARENESS from thinking∈{xhigh,max}, no field. */
@@ -76,7 +76,7 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
 export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
 /**
- * design/201 §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
+ * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
  * 都没有 ⇒ `undefined` = **无表态**(调用点据此不写键,而不是替调用方选一个默认值)。
  *
@@ -89,14 +89,14 @@ export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
 }, settings: ParsedTaskSettings | undefined): SettingsPermissionMode | undefined;
 /**
- * design/201 §2 —— 显式 permission mode → `TaskSpec.shellGate` 档位的**翻译表(单一真源)**。
+ * [ref] §2 —— 显式 permission mode → `TaskSpec.shellGate` 档位的**翻译表(单一真源)**。
  *
  *  · `bypassPermissions` ⇒ `"off"` —— CC `--dangerously-skip-permissions` 的对位裁定
  *    (与 fs-write 面的 bypass 臂两面归一,见 {@link deriveSettingsPolicy})。
- *  · `auto` ⇒ `"classify"` —— **design/201 §8 开口按施工期新披露亲裁改译**(原裁定字面是 off,
+ *  · `auto` ⇒ `"classify"` —— **[ref] §8 开口按施工期新披露亲裁改译**(原裁定字面是 off,
  *    §8 保留「core auto 分类器覆盖面有新披露时可独立再裁,表驱动一行」——新披露见下段):
  *
- *    ⚠️ **`auto` 这一行有一条待裁的开口(design/201 §8 明列「core auto 分类器覆盖面有新披露时可独立再裁,
+ *    ⚠️ **`auto` 这一行有一条待裁的开口([ref] §8 明列「core auto 分类器覆盖面有新披露时可独立再裁,
  *    表驱动一行」)。施工期交叉复审给出了那条新披露,已亲读安装包核实**:
  *      · core 只在**已经产生 `ask`** 之后才咨询分类器(`dist/core/hooks.js`:`if (input.autoMode &&
  *        decision.action === "ask" …)`);
@@ -105,7 +105,7 @@ export declare function effectivePermissionMode(body: {
  *        却没有 shell 安全轴折叠」)。
  *    两条合起来:`auto` × off ⇒ Bash 既不产 ask、分类器也就永不被咨询 —— off 档下「筛选权交给分类器」
  *    不成立。故 auto 归 classify 组:分类器坐在 classify 产的 ask 之上,语义才真是「交给分类器」
- *    (良性只读命令由分类器自动放行,其余 ask;这正是 auto 模式的本义)。发车帖向 [3378] 裁定链披露此
+ *    (良性只读命令由分类器自动放行,其余 ask;这正是 auto 模式的本义)。发车帖向 [ref] 裁定链披露此
  *    一行偏离;core auto 分类器若来日在 off 档下也有咨询点,可再裁回(表驱动一行)。
  *  · `default` / `acceptEdits` / `plan` ⇒ `"classify"` —— 这一档原先由壳无条件注入 `MANUAL_MODE_SHELL_GATE`
  *    供给(车道缺省走了 operator 通道),现在归位到表态轴。`plan` 本身 handsReadOnly(core 明写此档下
@@ -116,7 +116,7 @@ export declare function effectivePermissionMode(body: {
  * 缺席默认是 off,但**写**一个 off 会成为 governance 的 base,与缺席不是同一件事)。
  *
  * 🔴 **闭集 exhaustive switch,无 default 臂**:五个模式词是封闭词表,新增一个模式而不更新本表
- * 是**编译错误**(#157 的安全轴纪律:词表的未知项不许有静默兜底臂)。
+ * 是**编译错误**([ref] 的安全轴纪律:词表的未知项不许有静默兜底臂)。
  */
 export declare function shellGateForMode(effMode: SettingsPermissionMode): "off" | "classify";
 /** The validated, service-trusted subset of `SemaSettings` we project onto the spec. `env` is parsed only to REPORT
@@ -133,11 +133,11 @@ export interface ParsedTaskSettings {
     model?: string;
     outputStyle?: string;
     /** `settings.env` → per-task shell env. core deliberately keeps NO
-     *  `TaskSpec.env` (an untrusted caller must not swap the sandbox — design/44 §7 Q4); per-session shell env rides
-     *  the TRUSTED `executionEnvFactory` seam (`shellEnv`) instead. design/107 "env = capability axis": HONORED only on
+     *  `TaskSpec.env` (an untrusted caller must not swap the sandbox — [ref] §7 Q4); per-session shell env rides
+     *  the TRUSTED `executionEnvFactory` seam (`shellEnv`) instead. [ref] "env = capability axis": HONORED only on
      *  the single-user host lane (`cwdHonored`), IGNORED on any cloud/multi-tenant lane. Parsed here; gated at apply. */
     shellEnv?: Record<string, string>;
-    /** L2 ultracode preset (design/111): a CC-parity `settings.ultracode` boolean that EXPANDS to the two existing
+    /** L2 ultracode preset ([ref]): a CC-parity `settings.ultracode` boolean that EXPANDS to the two existing
      *  orthogonal axes — `thinking:"max"` (the reasoning axis) + `selfOrchestration:true` (the orchestration axis,
      *  through its existing fail-closed gate). NOT a new mechanism; just a preset that fans out to existing spec fields. */
     ultracode?: boolean;
@@ -168,11 +168,11 @@ export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
  * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked; unknown keys are ignored
  * (forward-compatible, matching the SDK's open `[k: string]: unknown`). `defaultMode` accepts the FIVE modes
- * (post-[816]; unknown values coerce to `default` — see the header note). Returns the
+ * (post-[ref]; unknown values coerce to `default` — see the header note). Returns the
  * present-but-deferred field names so the caller can warn/advertise rather than silently dropping `env`/`hooks`.
  */
 export declare function parseTaskSettings(raw: unknown): ParseTaskSettingsResult;
-/** Defensive acceptance of the `appendSystemPrompt` rider ([1478] R2 + codex F2): the HTTP 400 gate (prepareSpec,
+/** Defensive acceptance of the `appendSystemPrompt` rider ([ref] R2 + codex F2): the HTTP 400 gate (prepareSpec,
  *  MAX_SYSTEM_PROMPT_CHARS) only covers FRESH submits — every resume family re-enters resolveSpec on a STORED body,
  *  and a pre-1.243 store preserved unknown request keys verbatim (the field was INERT then), so an over-cap legacy
  *  value must not become active prompt content after rollout (context exhaustion / spend hole). Over-cap ⇒ dropped +
@@ -196,44 +196,44 @@ export declare function hasConstitutionAnchors(text: unknown): boolean;
  *  (REPLACE_ALL_EXCLUDED strips role.append) → append-less true. */
 export declare function providerDropsAppend(provider: PromptProvider | undefined, userSystemPrompt: string | undefined): boolean;
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
-/** [1248]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
+/** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
  *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
- *  since #156 — the sandbox lanes wire a gate of their own shape instead of no gate). */
+ *  since [ref] — the sandbox lanes wire a gate of their own shape instead of no gate). */
 export interface WorkflowGateWiring {
     /** The session "don't ask again" probe (approvalExemptionStore.has, canonical toolName key) — same store and
      *  key space as the fs-write gate's probe; one remember="session" grant serves both. */
     isExempt?: (toolName: string) => boolean | Promise<boolean>;
 }
-/** [816]/[820]① — everything the mode-derived fs-write ask gate needs from the deployment, provided by
- *  `resolve-spec.ts`. Absent ⇒ no gate is derived (the pre-[816] behavior).
+/** [ref]/[ref]① — everything the mode-derived fs-write ask gate needs from the deployment, provided by
+ *  `resolve-spec.ts`. Absent ⇒ no gate is derived (the pre-[ref] behavior).
  *
  *  WHY the `env` matters: core's `createFsWriteGatePolicy` canonicalizes every target/dir through the given `env`
  *  (real `exists`/`canonicalPath`/`readLink` fs access — read in dist, fs-write-gate-policy.js), so on a
  *  HOST-SEMANTICS lane (`REMOTE_EXEC` unset or "host") the env MUST be the fs the hand tools write.
  *
- *  #156/#165 — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
+ *  [ref]/[ref] — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
  *  tools run OFF this box and the per-task sandbox env is minted inside core (executionEnvFactory) AFTER spec
  *  build, so a worker-local env would adjudicate against the WRONG fs (a wrong ALLOW is worse than no gate — that
- *  is why [816] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
+ *  is why [ref] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
  *  (`src/boot/deferred-sandbox-path-env.ts`) instead: a proxy that forwards the fs READ primitives to the task's
  *  REAL sandbox env at adjudication time (a per-session slot the factory decorator fills), keeping only
  *  `absolutePath` lexical so no relative path is resolved against the wrong base. Empty slot ⇒ fail-closed. */
 export interface FsWriteGateWiring {
     /** The env the gate canonicalizes against — the worker host env on the host lane, the
-     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes (#165). */
+     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes ([ref]). */
     env: ExecutionEnv;
     /** The task's working directory: the factory's `rootPath` (relative-path base) AND the acceptEdits accept domain.
-     *  ABSENT on the sandbox lanes (#156/#165): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
+     *  ABSENT on the sandbox lanes ([ref]/[ref]): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
      *  neither spec time nor the env proxy can supply the right base — inventing one would mint a bogus auto-allow
      *  domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths fail to resolve
      *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
      *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
-    /** The session scratchpad dir (envFacts.scratchpadDir, [820]③) — writes there are always auto-allowed. */
+    /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;
-    /** [841]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),
+    /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),
      *  called by core as `(canonicalToolName, canonicalPath)`. The host arm ignores the second argument (the key
-     *  comes from a real-fs canonicalize and the grant is deliberately name-keyed); the sandbox arm (#156) uses it
+     *  comes from a real-fs canonicalize and the grant is deliberately name-keyed); the sandbox arm ([ref]) uses it
      *  to confine the exemption to POSIX-absolute canonical keys — core's `canonicalizeTarget` short-circuits
      *  backslash-UNC forms to `ok:true, key=raw` WITHOUT consulting the env, and an unconfined name-keyed grant
      *  would turn those unresolvable forms into an allow (codex review 2026-08-05).
@@ -242,7 +242,7 @@ export interface FsWriteGateWiring {
      *  toolName key space as the ask-policy layer's exemption probe — ONE grant serves both layers; the gate-level
      *  check is what makes "allow all session" bite SAME-TURN for the parent and inherited child tasks (the ask
      *  path is never re-entered). (codex M1 的边界注记:sensitive-path DENY 腿与本探针的「豁免越不过 deny」
-     *  保证仍成立——但那条腿已随 #177 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
+     *  保证仍成立——但那条腿已随 [ref] 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
      *  本 wiring 的组合点。) */
     isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
 }

package/dist/task-workflow.d.ts

@@ -23,7 +23,7 @@ export declare function selfOrchestrationFromBody(body: {
     requirePrincipal?: boolean;
 }, hasEntitlementResolver: boolean): true | undefined;
 /**
- * §4 (Fork) — map the per-task `body.enableFork` intent onto `TaskSpec.enableFork`. core 1.257 (design/136 BREAKING)
+ * §4 (Fork) — map the per-task `body.enableFork` intent onto `TaskSpec.enableFork`. core 1.257 ([ref] BREAKING)
  * RETIRED the standalone `Fork` tool; a fork is now `Agent(subagent_type:"fork")`, and `enableFork` is one of the two
  * governance axes (`forkGovernanceDenial(spec.enableFork, runtimeCaps.allowFork)`) that gate it.
  *
@@ -61,12 +61,12 @@ export declare function workflowModelAllowlistFor(config: {
     requirePrincipal?: boolean;
     models: Record<string, unknown>;
 }): string[] | undefined;
-/** design/122 caps for a caller-supplied `retainSubagentSessions` object (core defaults 30min/16; the ledger
+/** [ref] caps for a caller-supplied `retainSubagentSessions` object (core defaults 30min/16; the ledger
  *  is run-scoped and fully released at parent end, so these only bound the WITHIN-RUN memory pin). */
 export declare const RETAIN_SUBAGENT_TTL_MS_CAP: number;
 export declare const RETAIN_SUBAGENT_MAX_CAP = 64;
 /**
- * design/122 (core 1.225): normalize an untrusted `body.retainSubagentSessions` onto the TaskSpec field.
+ * [ref] (core 1.225): normalize an untrusted `body.retainSubagentSessions` onto the TaskSpec field.
  * `true`/`false` pass through (core's own defaults apply); an object keeps only NUMERIC ttlMs/max, each
  * clamped to a positive integer under the cap (retention pins settled child sessions in memory for the
  * parent run's lifetime — the knob must not become a caller-controlled resource hold). Anything malformed →

package/dist/text-bidi.d.ts

@@ -15,7 +15,7 @@
  *    清洗面比检测面宽是对的:那两处要的是「只留可打印的一行」。
  *
  * ## 案锚
- * Trojan Source([4537]②;`docs/DISEASE-SHAPES.md` 的不可见字符条):字面控制符让**人审与机器门看到
+ * Trojan Source([ref]②;`docs/DISEASE-SHAPES.md` 的不可见字符条):字面控制符让**人审与机器门看到
  * 两份不同的文本**。审批卡是本仓唯一一处「把模型写的命令交给人眼判断」的面,所以它需要的是**披露**
  * (告诉壳「这串里有 bidi」),不是清洗 —— 清洗会改掉即将被执行的那串字节,让卡上显示的与真正跑的不是
  * 同一个东西,那比不披露更坏。