@sema-agent/server 7.56.0 → 7.57.0

package/dist/run-local.js

@@ -14,7 +14,7 @@ import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
-import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
+import { loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -445,7 +445,7 @@ export async function runLocal(argv, deps = {}) {
     }
     const mention = parseModelMention(args.objective, Object.keys(config.models));
     const scope = args.user ?? "local";
-    const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
+    const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "discuss");
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
     const a2a = a2aForScenario(config.a2aPeers, scenarioName);

package/dist/runs.d.ts

@@ -308,10 +308,13 @@ promptManifests?: PromptManifestTracker,
  * `streamApprovalOn` = 协议上场判据(`resolveStreamApprovalGate`,由路由层求值后传进来 —— 本函数是纯
  * 执行腿,不该自己读 backend/config)。为假 ⇒ 只接既有四键 ctx(呈卡口/腿轴都不接),本腿字节逐字不变。
  */
+/** `windowMs` 收成 `number | undefined`([ref] + codex r1-[medium]):`undefined` = **这份装配没有
+ *  `streamApproval` 段**(stub-harness),不是「运维显式关窗」—— 两者自 [ref] 起结局不同(后者即答
+ *  无人值守终局),路由层因此不许再折算,见 `resolveApprovalLeg` 的 `windowMs` 域注。 */
 approval?: {
     coordinator: ToolApprovalCoordinator;
     streamApprovalOn: boolean;
-    windowMs: number;
+    windowMs: number | undefined;
     windowMarginMs: number;
 }, 
 /** [ref]:park 投影腿的 checkpoint 读口(`deps.checkpointStore`)。在场时,durable park 的

package/dist/runs.js

@@ -1,15 +1,18 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
+import { redactErrorMessage } from "./observability/run-terminal-log.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
 import { createLedgerSink } from "./trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
+import { buildCancelContext } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { errorText as errText } from "./observability/err-text.js";
 import { LIVENESS_HEARTBEAT_MS } from "./config-invariants.js";
 export async function backgroundAgentOutput(registry, handle, access, agentStore) {
     const row = registry.getAccessibleTask(handle, access);
@@ -162,7 +165,10 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const preemptCtrl = new AbortController();
     if (preemptEligible)
         preemptable?.set(taskId, preemptCtrl);
-    const cancelledResult = () => ({ taskId, sessionId: spec.sessionId, status: "failed", errorCode: "cancelled", errorMessage: "cancelled by user", stats: { turns: 0, tokens: 0 } });
+    const cancelledResult = () => {
+        const ctx = buildCancelContext(taskId, startedAt);
+        return { taskId, sessionId: spec.sessionId, status: "failed", errorCode: "cancelled", errorMessage: "cancelled by user", stats: { turns: 0, tokens: 0 }, ...(ctx ? { cancelContext: ctx } : {}) };
+    };
     const recordDone = (result, status) => {
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status });
@@ -178,7 +184,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const owner = principal ?? null;
     const approvalLeg = resolveApprovalLeg({
         streamApprovalOn: approval?.streamApprovalOn === true,
-        windowMs: approval?.windowMs ?? 0,
+        windowMs: approval?.windowMs,
         windowMarginMs: approval?.windowMarginMs ?? 0,
         ...(typeof spec.limits?.maxWalltimeMs === "number" ? { legWalltimeMs: spec.limits.maxWalltimeMs } : {}),
         nowMonotonicMs: performance.now(),
@@ -221,7 +227,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status: "needs_review" });
     };
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: () => recordTurnActivity(taskId) });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData) });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);
@@ -410,18 +416,33 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 : withApproval();
         });
         if (!reached && cancelCtrl.signal.aborted) {
-            await flush();
+            try {
+                await flush();
+            }
+            catch (e) {
+                recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-clean-cancel ${errText(e)}`);
+            }
             const c = cancelledResult();
-            await append("failed", { errorMessage: c.errorMessage ?? "cancelled by user", errorCode: "cancelled" });
+            try {
+                await append("failed", { errorMessage: c.errorMessage ?? "cancelled by user", errorCode: "cancelled" });
+            }
+            catch (e) {
+                recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-clean-cancel ${errText(e)}`);
+            }
             reached = { kind: "done", result: c };
             await runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null);
             recordDone(c, "cancelled");
         }
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
+        const message = errText(err);
         try {
-            await flush();
+            try {
+                await flush();
+            }
+            catch (e) {
+                recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-catch ${errText(e)}`);
+            }
             if (reached?.kind === "done") {
                 await runStore.setTerminal(taskId, reached.result.status, reached.result, reached.result.errorMessage ?? null);
             }
@@ -433,12 +454,22 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             }
             else if (cancelCtrl.signal.aborted) {
                 const c = cancelledResult();
-                await append("failed", { errorMessage: c.errorMessage ?? "cancelled by user", errorCode: "cancelled" });
+                try {
+                    await append("failed", { errorMessage: c.errorMessage ?? "cancelled by user", errorCode: "cancelled" });
+                }
+                catch (e) {
+                    recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-thrown-cancel ${errText(e)}`);
+                }
                 await runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null);
             }
             else {
-                const safeMsg = redactSecrets(message);
-                await append("failed", { errorMessage: safeMsg });
+                const safeMsg = redactErrorMessage(message) ?? message;
+                try {
+                    await append("failed", { errorMessage: safeMsg });
+                }
+                catch (e) {
+                    recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-failed ${errText(e)}`);
+                }
                 await runStore.setTerminal(taskId, "failed", null, safeMsg);
             }
         }

package/dist/runtime-caps-resolver.d.ts

@@ -6,9 +6,35 @@
  * `EntitlementRuntimeCaps` themselves stay as-is below: they are core's / registry-core's own contract type
  * names, not ours to rename.)
  * It is the ENFORCE last-link of the three-stage workflows gate
- * (engine-can ∧ center-may ∧ shell-show): core calls it ONCE per task at prepare time with `spec.principal`,
- * and the engine enforces the two caps it CAN enforce — `allowWorkflows` (deny self-orchestration) and
- * `forceDurableGate` (force a policy `ask` onto the durable-approval wire).
+ * (engine-can ∧ center-may ∧ shell-show): core calls it with `spec.principal`.
+ *
+ * ⚠️ **调用次数不是「每任务一次」**（[ref]① 随 codex r1-[medium] 亲验后纠：旧句写「ONCE per task at
+ * prepare time」）：prepare 期解析一次（prepare-task.js:1826），**并且** capture-opt-out 的 flip 动词每被打一次
+ * 就再解析一次（prepare-memory.js:572 的 `flip` → :538 `resolveCaptureEntitlementFresh` → :542 本 resolver）。
+ * 所以本 resolver 必须是**可重入、可多次调用**的，缓存的 TTL 语义对 flip 腿同样生效；把它当「每任务一次的
+ * 快照」来实现（例如在里面攒 per-task 状态）会在 flip 腿上出错。
+ *
+ * ⚠️ [ref]① 纠失实：核心那句曾写作「引擎只执法它能执法的**两**个 cap」—— 早已不属实。core 7.2.0
+ * 装树 dist **亲读**的消费点是**六**个（本仓 node_modules 实测；下列坐标除注明外均在 `dist/core/runner/` 下，
+ * `agents/subagent.js` 那一条已就地标出 —— 说「均在 runner 下」是 r1 抓到的第二处过头话）：
+ *  · `allowWorkflows`  — prepare-task.js:1917 `runtimeCaps?.allowWorkflows !== false`（deny 自编排；:1918-1919 另发 onError）
+ *  · `allowFork`       — prepare-task.js:1867 `forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork)`（+:2418 拒由，agents/subagent.js:1575 拒词）
+ *  · `allowObservers`  — prepare-task.js:1868 `=== true`（**极性与 allow* 相反**：显式 opt-in，默认 OFF）
+ *  · `forceDurableGate`— prepare-task.js:1644/1646 的 durable/content mandate、:2337 活 content-ask 抑制、
+ *                        :2365 durable question face（该行合取 `resolveCheckpointStore(spec, deps) !== undefined`
+ *                        ⇒ **无 checkpoint 店的部署上这一面本就不成立**，该键在那里 inert）
+ *  · `autoMode`        — prepare-task.js:1869 `=== true` **∧** `deps.autoMode !== undefined`（部署需先具备分类器；
+ *                        显式 opt-in 极性，且 [ref] 起本侧传的是三态 org deny 位，见 toCoreRuntimeCaps 头注）
+ *  · `allowMemoryOptOut` — prepare-memory.js:542-543 `resolveCaptureEntitlementFresh`（+prepare-task.js:2474-2475
+ *                        的 value/faulted 投影）；**极性反转，但只在 `open` 姿态下**——判决全表在
+ *                        `dist/core/runner/memory-capture-optout.js` 的 `adjudicateCaptureOptOut`，按
+ *                        `RunnerDeps.memoryCapturePolicy` 三姿态分叉（codex r1-[medium] 亲验后纠：旧句无条件
+ *                        写「fault 读作 ALLOW」，只对其中一姿态成立）：
+ *                        · `"open"`（缺省）:1 只有显式 `false` 拒；**fault ⇒ ALLOW** + `faultDisclosure`（:32-37）
+ *                        · `"governed"`     :14-23 要**显式 `true`** 才准；`false` / 缺席 / fault **一律拒**
+ *                          （拒由分「answered false」与「verdict absent / resolver fault」两句）
+ *                        · `"capture-required"`:4-12 **完全不看本 verdict**（逐字「resolver-independent」），恒拒
+ * 只有 `allowUltracode` 是被 DROP 的那一个（下文）。
  *
  * It pulls the PER-PRINCIPAL entitlement from center's `GET /api/config/effective?principal=` (via
  * {@link fetchPrincipalCaps}). center has ALREADY pre-resolved the tighten-only intersection (fleet defaults ∩
@@ -17,10 +43,16 @@
  * a per-principal TTL+ETag CACHE (so per-task prepare-time lookups don't hammer center) and FAIL-CLOSED degrade.
  *
  * 🔐 FAIL-CLOSED (core security mandate, prepare-task.ts): an entitlement-resolver outage must NEVER silently
- * GRANT a capability center may have denied. On a hard fetch error we return `{ allowWorkflows: false }` (deny the
- * OPTIONAL workflows privilege) and do NOT force the durable gate (that could strand an autonomous run on an
- * absent operator — the same minimal degrade core applies when the resolver throws). We never serve a STALE
- * cached GRANT past its TTL on a fresh-fetch failure (a revoked cap must not linger because center blipped).
+ * GRANT a capability center may have denied. On a hard fetch error we mint `{ allowWorkflows: false, allowFork: false,
+ * autoMode: false }` — the three OPTIONAL **amplification** caps — and do NOT force the durable gate (that could
+ * strand an autonomous run on an absent operator). We never serve a STALE cached GRANT past its TTL on a
+ * fresh-fetch failure (a revoked cap must not linger because center blipped).
+ * ⚠️ [ref]① 纠失实：这段曾写作「降级为 `{ allowWorkflows: false }`」，与真码不符 —— 真铸点在本文件
+ * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那三键：`allowFork` 自提货批就在，
+ * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起）。
+ * 🔒 **三键以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
+ * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
+ * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
@@ -55,8 +87,11 @@ export interface EntitlementsResolverOpts {
     onError?: (err: Error, principal: string) => void;
 }
 /** Map center's `EntitlementRuntimeCaps` → the subset core's engine enforces. `allowUltracode` (shell/UX) is
- *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are the three the
- *  engine enforces. Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
+ *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are **three of the
+ *  six** the engine reads — the other three (`allowObservers` / `autoMode` / `allowMemoryOptOut`) are documented
+ *  below and forwarded by the same body; the full consumption-point table with core 7.2.0 dist coordinates is in this
+ *  module's header ([ref]①: this line used to say 「the three」, i.e. claimed the set was closed at three).
+ *  Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
  *  do NOT trust the wire to be boolean. center serializes these as zod-validated booleans, but a schema drift / proxy
  *  mangling that sent a TRUTHY non-boolean (e.g. the STRING "false") would slip past core's strict `=== false` deny
  *  check and silently GRANT. So a cap that is PRESENT but not a real boolean is a contract breach → THROW (the
@@ -70,11 +105,20 @@ export interface EntitlementsResolverOpts {
  *  说过话」的显式判决,污染 env-baseline 合成序,见 applyObserverEnvOptIn)。非 boolean 虽然骗不过 core
  *  的 `=== true`(不会误 GRANT),但 PRESENT-非-boolean 与 allow* 同属同一 body 的契约破损信号 → 同款 THROW。
  *
- *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
- *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[ref]B-6a:registry-core
- *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
- *  (allowObservers 同款收编先例)。 */
+ *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`;**[ref] / core [ref] 起三态**,黑板 [ref]/[ref]):
+ *  `undefined`(center 缺席/未答)= 不阻;`true` = 不阻;`false` = **org deny**(CC `permissions.disableAutoMode`
+ *  镜像)。core 武装式 = `spec.autoModeRequested === true ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`
+ *  ——「用户开 + org 拒」极性(此前是 `=== true` 的「org 授予」极性,无 center 的本地部署零授予路径 ⇒ auto 永不
+ *  武装,真实用户诊断的病根)。
+ *  🔴 **上面那条武装式是 [ref] 的目标形,不是「本仓现在装的那版 core 的形」——引用它之前先看装的是哪版**
+ *  ([ref]① 随 codex r2-[high] 补:我方在 WIRE 附录 F 照抄这一句,写成了「7.2.0 的行为」,而 npm **7.2.0
+ *  不含 [ref]** —— 它的 `dist/core/runner/prepare-task.js:1869` 逐字仍是 `runtimeCaps?.autoMode === true &&
+ *  deps.autoMode !== undefined`,即旧「org 授予」极性、**缺键 ⇒ 不武装**)。判「现在是哪套极性」的唯一判据 =
+ *  安装包探针 `CORE_ARMS_AUTO_ON_INTENT`(`src/auto-mode-face.ts`;实测本树 7.2.0 ⇒ **false** = 旧式臂),
+ *  代码侧已按它分臂,失实的只是散落各处的散文。⚠️ 同形措辞在本文件 :209 / :362-364 / :548 与
+ *  `src/boot/runtime-caps.ts:182` 还各有一处(均 [ref] 既有文字,本批未逐条改 —— 登记在 handoff 未闭环项)。
+ *  所以**缺键=不写键**在这条轴上是行为承重的(在新式 core 上):补一个 false 就是替 org 说了一句
+ *  它没说的 deny;在旧式 core 上两者同为「不武装」,差别不显形。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /**
  * #A5([ref] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。
@@ -87,8 +131,9 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * `permissionModeAuto.entitlementSource` 披露位。两处各写一份条件,就是本仓在册的
  * 「诊断页说亮、能力位说暗」病族的入口(装配与披露对同一件事各算各的)。
  *
- * ⚠️ **辖域**:说的是「源在不在」,不是「某个 principal 被授权了」。授权是 per-principal 的
- * (`RuntimeCaps.autoMode === true` 逐 principal 解),任何部署级布尔都对它说不了话。
+ * ⚠️ **辖域**:说的是「源在不在」,不是「某个 principal 被授权/被拒了」。org deny 位是 per-principal 的
+ * (`RuntimeCaps.autoMode` 三态逐 principal 解,[ref] 起「缺席=不阻」),任何部署级布尔都对它说不了话——
+ * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
 /** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
@@ -99,8 +144,39 @@ export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig,
 export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
-    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork). */
+    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;
+     *  [ref]① 随批纠：此处是同一句降级声明的第二个写者，漏了 [ref] 加的 `autoMode`。真铸点同上）。 */
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
+    /**
+     * 🔴 [ref] —— **只读**腿:与 {@link PrincipalEntitlementsClient.resolveRuntimeCaps} **同一只**缓存/同一条抓取/同一份
+     * fail-closed 判决,唯一的差别是 center 硬失败时它铸的降级项**只对自己算数**,提交腿不认。
+     *
+     * 病灶(合并重扫 finding):`/v1/capabilities` 的 auto 自查读面用的是提交腿那只 resolver,于是**一次 GET**
+     * 在 center 抖动的瞬间就会替这个 principal 铸下一条 `{allowWorkflows:false, allowFork:false, autoMode:false}`
+     * 的短窗 deny —— 随后 `denyTtlMs` 窗内该 principal 的**真提交**被这条读面留下的项拒掉。读面是纯披露,不该有
+     * 写副作用,更不该是别人任务被拒的原因。
+     *
+     * 姿态选择(为什么不是「读面改答 resolver_fault」):判决**逐字不变** —— 读面回答的是「此刻提交会不会武装」,
+     * 而 center 持续故障时提交腿确实看到 fail-closed 的 deny,所以答 `org_denied` 是当下真值;本修只摘掉副作用,
+     * 不改词、不改极性(`onError` 审计行照打,故障照样有可观察面)。
+     *
+     * 🔴 **界画在「这句话是谁说的」**(codex r2 [high] 逐条核后的定界,不是「读面完全不碰缓存」):
+     *  · **成功项 = center 亲口答的那份** —— 与提交腿自己抓到的**逐字同一份**、同一条 `ttlMs`、同一个**已验证**
+     *    身份(读面的 principal 走 `gatedPrincipal` → `verifiedPrincipal`,与提交腿同源,读不到别人的格)。读面
+     *    只是把这个 principal 自己那一格**预热**了一下;org 撤销后的陈旧窗由部署级 `ttlMs` 定义,与哪一腿预热
+     *    的无关(提交腿自己预热同样如此),本批**零改动**。
+     *  · **降级项 = server 自铸的判决** —— center 从没说过这句 deny,是本层在故障时替它说的。让一次**读**铸的
+     *    这句话去拒掉别人的**提交**,才是本修要摘的那件事。两者的差别不是「值一不一样」,是「谁是作者」。
+     *
+     * ⚠️ 两条缓存纪律(缺一就换出另一个病):
+     *  · **成功抓取照旧落缓存**,且命中提交腿刚拉的那份即用 —— 读面不是缓存旁路;
+     *  · **硬失败的降级项照旧落缓存,但标出处**(`readMintedDeny`):只读腿自己认(否则 center 持续故障时每次
+     *    GET 一个 8s RTT,读面成了对着故障 center 的放大面),提交腿忽略它、照常重抓。
+     * in-flight 去重与提交腿共用(同 principal 的并发只一次往返);提交腿**亲历**了这次抓取(自起 or 搭在途)
+     * 而它硬失败 ⇒ 该降级项当场升格为执法项(codex r1 [medium]:否则一条总抢在提交前面的轮询会让每次提交
+     * 都重抓,denyTtl 的界对提交腿失效)。让它升格的是一次真提交自己吃到的硬失败,不是那次读。
+     */
+    peekRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     /** The resolved per-principal scenario ruling for resolveSpec's gateScenarioRequest —
      *  FAIL-OPEN on error / older center without scenario keys / no principal (undefined = no governance, legacy passthrough).
      *  Scenario switching is not a privilege-amplifying face; a center blip must not pin users to `default`. */
@@ -170,6 +246,33 @@ export interface MemoryOptOutVerdictSource {
 export declare function applyMemoryOptOutGrant(base: EntitlementsResolverFn | undefined, source: MemoryOptOutVerdictSource | undefined, opts: {
     onFault: (err: Error, principal: string | undefined) => void;
 }): EntitlementsResolverFn | undefined;
+/**
+ * [ref] —— `governed` 姿态 + **center-only** verdict 源那一形的**运行期**披露(纯观测,零判决改写)。
+ *
+ * 为什么单独存在:`allowMemoryOptOut` 在 settings-schema 的 `EntitlementRuntimeCaps` 里是**可选键**
+ * (`z.ZodOptional<z.ZodBoolean>`),而 {@link toCoreRuntimeCaps} 对缺席**不铸键**(FAULT-TRANSIT:缺席
+ * 原样过境,绝不铸 false)。于是「配了一个非 dry-run 的 center」只证**源在场**,不证 center 会**为这个
+ * principal 发这个键** —— 一台 center 从不发该键的 governed worker 会正常起动,然后把每一个
+ * `memory.capture:"off"` 都以 `memory.capture_optout_denied`(verdict absent)拒掉,而运维只看见「opt-out 全拒」。
+ * 启动期那一行 warn 说的是「这一形有风险」;这一行说的是「它**真的**发生了」。
+ *
+ * 姿态:**每因由一次**(防每任务刷屏)、**不改判**(caps 逐字返回,极性仍由 core 按姿态判)、
+ * 只在 `enabled`(= governed ∧ 无本地 grant 店 ∧ center 源在场)时挂;否则返回 **同一引用**(零行为差)。
+ * 缺席判据取最终合成结果:`typeof caps?.allowMemoryOptOut !== "boolean"` —— center 没发键、center 拉取
+ * 降级(fail-closed entry 不含本键)都算,两者对 core 是同一件事(verdict absent ⇒ 拒跑)。
+ *
+ * 🔴 **因由是闭集两员,各占各的格**(codex r1-[medium] 验真后修):`createPrincipalEntitlementsClient` 的
+ * `resolveRuntimeCaps` 对 `principal === undefined` **直接返回 undefined、根本不问 center**(匿名/系统 run
+ * 没有 per-principal 身份),而 core 对**每一个**任务都调这只 resolver(不只是带 opt-out 声明的那些)。
+ * 单格去重会让**第一个匿名任务**烧掉那一格,日志却说「center 省了键」——归因错、且此后真正的具名缺键
+ * 永不留证。两员分格,且两句话说的是两件不同的事:匿名腿在 center-only 源上**结构性**永远拿不到 verdict
+ * (本地 grant 表的部署缺省行才答匿名),具名腿则是「center 这次没发这个可选键」。
+ */
+export type GovernedVerdictAbsenceReason = "anonymous_lane" | "center_verdict_absent";
+export declare function applyGovernedVerdictAbsenceWarning(base: EntitlementsResolverFn | undefined, opts: {
+    enabled: boolean;
+    warn: (reason: GovernedVerdictAbsenceReason, principal: string | undefined) => void;
+}): EntitlementsResolverFn | undefined;
 /**
  * observer 开闸线的 env 半场:`EXPERIMENTAL_OBSERVER_AGENTS=true` 时把
  * `RuntimeCaps.allowObservers: true` 作为**部署基线**合成进 caps resolver(core 1.270.0/1.273.0 的
@@ -193,4 +296,17 @@ export declare function applyObserverEnvOptIn(centerResolver: EntitlementsResolv
     requirePrincipal: boolean;
     warn?: (msg: string, fields?: Record<string, unknown>) => void;
 }): EntitlementsResolverFn | undefined;
+/**
+ * [ref] ③(黑板 [ref]/[ref],core [ref] 合修)—— `PERMISSIONS_DISABLE_AUTO_MODE` 的合成层:CC
+ * `permissions.disableAutoMode` 的本地镜像(ANCHOR-250 §6.4 的只可更严棘轮),**tighten-only**:
+ *  · deny=true ⇒ 每个 principal 的 `caps.autoMode` 折成 `false`(org deny 位)。center 授予 `true` **翻不回**——
+ *    本层写在最外(boot/runtime-caps.ts 合成序:center → observer env 基线 → memory grant → 本层),后写者赢,
+ *    且只往严处写;center 对该 principal 无答(undefined)同样折 false(deny 是部署级表态,不看 principal)。
+ *  · deny 未设 ⇒ 原 resolver **同一引用**透传(零行为差;无 center 的部署仍是 `undefined` ⇒ caps 缺席 ⇒
+ *    三态之「缺席=不阻」,这正是 auto 在本地部署能武装起来的路径)。
+ *  · 极性与 applyObserverEnvOptIn 相反:那条是「env 开」的放宽基线(center 带键则 center 赢),本条是
+ *    「env 拒」的收紧棘轮(center 带键也不能赢)。两条不共用一只函数正是因为方向相反。
+ *  🔴 没有 fail-open 臂:本层是纯合成,不做 I/O;base 抛错原样上抛(base 各层自带 fail-closed/缺席臂)。
+ */
+export declare function applyLocalAutoModeDeny(base: EntitlementsResolverFn | undefined, deny: boolean): EntitlementsResolverFn | undefined;
 //# sourceMappingURL=runtime-caps-resolver.d.ts.map

package/dist/runtime-caps-resolver.js

@@ -80,6 +80,7 @@ export function createPrincipalEntitlementsClient(opts) {
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
     const cache = new Map();
     const inflight = new Map();
+    const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
     const putCache = (key, entry) => {
         if (cache.size >= MAX_CACHE) {
@@ -90,9 +91,15 @@ export function createPrincipalEntitlementsClient(opts) {
         }
         cache.set(key, entry);
     };
-    async function load(principal) {
+    async function load(principal, recordDeny = true) {
+        const entry = await loadRaw(principal, recordDeny);
+        if (recordDeny)
+            readMintedDeny.delete(entry);
+        return entry;
+    }
+    async function loadRaw(principal, recordDeny) {
         const cached = cache.get(principal);
-        if (cached && cached.expiresAt > now())
+        if (cached && cached.expiresAt > now() && !(recordDeny && readMintedDeny.has(cached)))
             return cached;
         const dup = inflight.get(principal);
         if (dup)
@@ -135,7 +142,9 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, expiresAt: now() + denyTtlMs };
+                if (!recordDeny)
+                    readMintedDeny.add(entry);
                 putCache(principal, entry);
                 try {
                     onError(e, principal);
@@ -152,6 +161,7 @@ export function createPrincipalEntitlementsClient(opts) {
     }
     return {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
+        peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
@@ -183,6 +193,27 @@ export function applyMemoryOptOutGrant(base, source, opts) {
         return { ...(caps ?? {}), allowMemoryOptOut: allow };
     };
 }
+export function applyGovernedVerdictAbsenceWarning(base, opts) {
+    if (!opts.enabled)
+        return base;
+    const warned = new Set();
+    return async (principal) => {
+        const caps = base !== undefined ? await base(principal) : undefined;
+        if (typeof caps?.allowMemoryOptOut !== "boolean") {
+            const reason = principal === undefined ? "anonymous_lane" : "center_verdict_absent";
+            if (!warned.has(reason)) {
+                warned.add(reason);
+                try {
+                    opts.warn(reason, principal);
+                }
+                catch (hookErr) {
+                    recordFailOpen("server.memory-optout-verdict-absence.warn-hook-threw", String(hookErr));
+                }
+            }
+        }
+        return caps;
+    };
+}
 export function applyObserverEnvOptIn(centerResolver, opts) {
     if (!opts.experimentalObserverAgents)
         return centerResolver;
@@ -196,4 +227,11 @@ export function applyObserverEnvOptIn(centerResolver, opts) {
         return () => ({ allowObservers: true });
     return async (principal) => ({ allowObservers: true, ...(await centerResolver(principal)) });
 }
+export function applyLocalAutoModeDeny(base, deny) {
+    if (!deny)
+        return base;
+    if (base === undefined)
+        return () => ({ autoMode: false });
+    return async (principal) => ({ ...(await base(principal)), autoMode: false });
+}
 //# sourceMappingURL=runtime-caps-resolver.js.map

package/dist/task-settings.d.ts

@@ -66,6 +66,9 @@ export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypas
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
 export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
+/** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
+ *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
+export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
@@ -129,6 +132,18 @@ export interface ParsedTaskSettings {
         /** Carried for completeness; v1 folds `ask` into the gate via the deny-wins base (see {@link applyTaskSettings}). */
         ask?: string[];
         defaultMode?: SettingsPermissionMode;
+        /** [ref] 件⑥([ref] §3.4,[ref];PM 裁 [ref]):CC settings 的 kill-switch `permissions.disableAutoMode`,cli 投影
+         *  (settingsRulesWire.ts toWireSettings)而此前本白名单丢弃 ⇒ 用户/managed 层关 auto 到不了引擎。语义 = 只能关
+         *  不能开(tighten-only):把生效模式 auto 折 default(座不写 ⇒ 不武装)。折叠单点 = {@link effectivePermissionMode}。
+         *  `disableBypassPermissionsMode` 本批不做落点([ref] 另立)。
+         *
+         *  🔴 **受理集 = `"disable" | true | false`**([ref] 放宽一档,原为「只认字面 `"disable"`」)。两套拼写**都是已发布
+         *  契约**:CC 250 的 `Ct` 严极词 `"disable"`,与 `@sema-agent/sdk` 8.1.0 `SettingsPermissions.disableAutoMode?: boolean`
+         *  (`dist/settings.d.ts`)。按已发布 SDK 类型写 `true`/`false` 的客户端此前一律 400 —— [ref] 的「只认 disable」是
+         *  「拒非法**拼错**」,boolean 不是拼错。归一化**不做**:三形逐字过 parse(拒体/日志里看得见调用方真发的是哪一形),
+         *  语义归一只在折叠单点做(`"disable"` ≡ `true`)。受理集之外(别的词/数字/对象)= fresh 提交 HTTP 门 400,
+         *  resume 重放宽臂丢弃(两层姿势同 defaultMode)。 */
+        disableAutoMode?: "disable" | boolean;
     };
     model?: string;
     outputStyle?: string;
@@ -164,12 +179,51 @@ export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+/** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
+ *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 在 {@link parseTaskSettings};
+ *  `webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。 */
+export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
+/** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
+export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+/** CC/SDK 合约里合法、本 service **不接线**的顶层键(出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的
+ *  三个 deferred CC 键)。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响文案,不影响判决。 */
+export declare const TASK_SETTINGS_UNSUPPORTED_KEYS: readonly ["apiKeyHelper", "sandbox", "statusLine"];
+/** 同上,`settings.permissions` 子层(出处 = SDK `SettingsPermissions` 的三个声明键)。
+ *  `additionalDirectories` 有**同请求替代面**:顶层 `body.additionalDirectories`([ref],resolve-spec 真消费)。 */
+export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["additionalDirectories", "disableBypassPermissionsMode"];
+/** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
+ *  放大成流量面。超出部分只报数。 */
+export declare const MAX_SETTINGS_KEY_ECHO = 20;
+/** {@link taskSettingsKeyIssue} 的拒体:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
+export interface TaskSettingsKeyIssue {
+    message: string;
+    /** 词表外的键(拼错/未来键),`settings.x` / `settings.permissions.x` 全路径形,已清洗+截断+排序+封顶。 */
+    unknownKeys: string[];
+    /** CC/SDK 合约合法但本 service 不接线的键,同形。 */
+    unsupportedKeys: string[];
+}
+/**
+ * FRESH 提交面的 `settings` 键闭集裁决:顶层或 `permissions` 子层出现受理集之外的键 ⇒ 返回拒体(调用方 400
+ * `request.body_shape`);全部受理 ⇒ `null`。
+ *
+ * 判据边界(有意窄):
+ *  · 只判**键名**。值形校验(outputStyle 上限 / permissions 数组上限 / env 形 / hooks 契约 / defaultMode 闭集)
+ *    仍归各自既有门,本门零改动、零抢话。
+ *  · `settings` 本身非对象、或 `permissions` 非对象(数组/标量/null)⇒ 本门**不判**,留给既有的
+ *    「settings must be an object」/「settings.permissions must be an object」两道门,免得同一个体被两句话抢答。
+ *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
+ */
+export declare function taskSettingsKeyIssue(raw: unknown): TaskSettingsKeyIssue | null;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
- * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked; unknown keys are ignored
- * (forward-compatible, matching the SDK's open `[k: string]: unknown`). `defaultMode` accepts the FIVE modes
- * (post-[ref]; unknown values coerce to `default` — see the header note). Returns the
+ * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE
+ * modes (post-[ref]; unknown values coerce to `default` — see the header note). Returns the
  * present-but-deferred field names so the caller can warn/advertise rather than silently dropping `env`/`hooks`.
+ *
+ * 🔴 未知键在**本层**照旧忽略,而那**不是** wire 的现行为([ref] 件①,PM 裁「拒」[ref]):本层是 RESUME
+ * 重放也走的宽容层,一个 4xx 在这里会把存量 parked 任务永久砖死;FRESH 提交面由 {@link taskSettingsKeyIssue}
+ * 在 `server.ts` prepareSpec 里 400 响亮拒 + 逐字列名。双层姿势与 outputStyle / permissionMode 两处逐字相同。
  */
 export declare function parseTaskSettings(raw: unknown): ParseTaskSettingsResult;
 /** Defensive acceptance of the `appendSystemPrompt` rider ([ref] R2 + codex F2): the HTTP 400 gate (prepareSpec,