@sema-agent/server 7.56.0 → 7.58.0

package/dist/auto-mode-face.js

@@ -0,0 +1,99 @@
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { resolveTaskModel } from "@sema-agent/core";
+export function classifierRouteFor(deps) {
+    try {
+        return { id: resolveTaskModel({ modelRole: "classifier" }, deps).model.id };
+    }
+    catch (err) {
+        return { id: undefined, fault: err instanceof Error ? err.message : String(err) };
+    }
+}
+export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
+export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
+    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\";座缺席)——只属意图武装式,旧式 core 不读模式",
+    deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器);旧式 core 下另含「无 center 源 = 零授予路径」",
+    org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项;旧式 core 下另含「center 在场但未授予」",
+    local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false",
+    settings_denied: "settings 层 permissions.disableAutoMode 取 disable 或 true(两套已发布拼写同义;用户/managed 层 kill-switch)把本 run 折成非 auto —— capabilities 查询串不带 settings,本词由 run 级面产([6128] PM 裁定第六员)",
+    resolver_fault: "per-principal caps resolver 抛错/答非记录(core 同形全拒:autoMode:false + onError phase config)",
+};
+function armingProbeFailure(what) {
+    return new Error(`auto-mode arming probe cannot decide (${what}). This probe answers ONE question — does the INSTALLED @sema-agent/core arm ` +
+        `auto mode from the task's INTENT seat (core #521: spec.autoModeRequested ∧ seat ∧ caps !== false), or from the older ` +
+        `"org grants it" polarity (runtimeCaps.autoMode === true ∧ seat)? The two polarities are OPPOSITE on the permission axis, ` +
+        `so guessing would silently put this deployment on the wrong one — either arming runs the org never granted, or reporting ` +
+        `"not armed" at /v1/capabilities while the engine really is arming (#157: no silent fail-open on the permission axis). ` +
+        `Refusing to start instead. Fix: reinstall the engine (rm -rf node_modules && npm ci) so the package ships its full dist, ` +
+        `or — if core moved/renamed the arming site — update the probe in src/auto-mode-face.ts to read the new one.`);
+}
+export function coreArmsAutoOnIntentProbe(distDir) {
+    const dist = distDir ?? dirname(createRequire(import.meta.url).resolve("@sema-agent/core"));
+    const armingSite = join(dist, "core", "runner", "prepare-task.js");
+    let armingSrc;
+    try {
+        armingSrc = readFileSync(armingSite, "utf8");
+    }
+    catch (err) {
+        throw armingProbeFailure(`the engine's arming site is unreadable at ${armingSite}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (armingSrc.includes(CORE_AUTO_MODE_INTENT_SEAT))
+        return true;
+    const snapPath = join(dist, "..", "test", "export-surface.snapshot.json");
+    let snap;
+    try {
+        const parsed = ExportSurfaceSnapshotSchema.safeParse(JSON.parse(readFileSync(snapPath, "utf8")));
+        if (!parsed.success)
+            throw new Error(`export-surface snapshot shape mismatch: ${parsed.error.issues.map((i) => i.path.join(".") + ":" + i.message).join("; ")}`);
+        snap = parsed.data;
+    }
+    catch (err) {
+        throw armingProbeFailure(`the arming seat is absent from ${armingSite} and the corroborating export-surface snapshot is unreadable at ${snapPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!snap.exports || typeof snap.exports !== "object")
+        throw armingProbeFailure(`core export-surface snapshot malformed at ${snapPath}`);
+    if (typeof snap.exports.mailboxCrossProcessMountVerdict === "string") {
+        throw armingProbeFailure(`contradiction — the installed core's export surface is at/after the batch that shipped #521, but its arming site ` +
+            `(${armingSite}) never names \`${CORE_AUTO_MODE_INTENT_SEAT}\`, so the engine either moved the arming site or renamed the seat`);
+    }
+    return false;
+}
+const CORE_AUTO_MODE_INTENT_SEAT = "autoModeRequested";
+let armsOnIntentMemo;
+const ExportSurfaceSnapshotSchema = z.object({ exports: z.record(z.string(), z.string()).optional() }).passthrough();
+export function coreArmsAutoOnIntent() {
+    if (armsOnIntentMemo === undefined)
+        armsOnIntentMemo = coreArmsAutoOnIntentProbe();
+    return armsOnIntentMemo;
+}
+export async function judgeAutoModeArming(face, input) {
+    const route = face?.seatMounted ? face.classifierModel?.() : undefined;
+    const model = route !== undefined ? { model: route } : {};
+    if (face?.engineArmsOnIntent && input.requestedMode !== undefined && input.requestedMode !== "auto")
+        return { armed: false, reason: "mode_not_auto", ...model };
+    if (face === undefined || !face.seatMounted)
+        return { armed: false, reason: "deployment_incapable" };
+    let caps;
+    try {
+        caps = face.resolveCaps !== undefined ? await face.resolveCaps(input.principal) : undefined;
+    }
+    catch (err) {
+        return { armed: false, reason: "resolver_fault", ...model, fault: err instanceof Error ? err.message : String(err) };
+    }
+    const deniedWord = input.localDeny ? "local_denied" : "org_denied";
+    if (face.engineArmsOnIntent) {
+        if (caps?.autoMode === false)
+            return { armed: false, reason: deniedWord, ...model };
+        return { armed: true, ...model };
+    }
+    if (caps?.autoMode === true)
+        return { armed: true, ...model };
+    if (caps?.autoMode === false)
+        return { armed: false, reason: deniedWord, ...model };
+    if (!input.entitlementSource)
+        return { armed: false, reason: "deployment_incapable", ...model };
+    return { armed: false, reason: "org_denied", ...model };
+}
+//# sourceMappingURL=auto-mode-face.js.map

package/dist/bench/s1/arms.js

@@ -1,4 +1,4 @@
-import { leafBudgetFields } from "./runner-ctx.js";
+import { leafBudgetFields, s1DebugGit } from "./runner-ctx.js";
 import {} from "./tasks.js";
 import { decideApproval, decidePlan } from "./reviewer.js";
 import { oracleTrulyCorrect, pickOracleVerdicts, armTag, S1_SCHEMA_VERSION, S1_CORE_VERSION, } from "./row.js";
@@ -164,7 +164,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
             vr = await deps.runWithVerification(implSpec);
         }
         catch (e) {
-            if (process.env.S1_DEBUG_GIT)
+            if (s1DebugGit())
                 console.error("[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
@@ -176,7 +176,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
                 finishedAt: ctx.clock.now(),
             });
         }
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error("[S1 SOLO vr.status]", vr.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         return assembleRow({
@@ -210,7 +210,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
             }
         }
         catch (e) {
-            if (process.env.S1_DEBUG_GIT)
+            if (s1DebugGit())
                 console.error(`[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
@@ -222,7 +222,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
                 finishedAt: ctx.clock.now(),
             });
         }
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1 SUP vr.status driver=${trap.supDriver}]`, vr.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(vr.checkpointGate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         const runStatus = classifyRunStatus({ status: vr.status, repairTerminal });

package/dist/bench/s1/live-deps.js

@@ -7,7 +7,7 @@ import { createDurableAskPolicy } from "../../approval.js";
 import { createLeaderRunner } from "../../leader/wire.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
 import { makeRepairOracle } from "./repair-oracle-adapter.js";
-import { assertDistinctEnvs } from "./runner-ctx.js";
+import { assertDistinctEnvs, s1DebugGit } from "./runner-ctx.js";
 const W = "/home/user";
 const REPO = `${W}/repo`;
 const BASE_REF = "s1-base";
@@ -112,7 +112,7 @@ async function transferWorkerTreeToGrader(worker, grader) {
     const ext = await sh(grader)(`set -e; test -s /tmp/s1-wt.tar; rm -rf ${REPO}; mkdir -p ${REPO}; tar -xf /tmp/s1-wt.tar -C ${REPO}; echo "EXTRACTED=$(ls -A ${REPO} | wc -l)"`);
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
     return { head, base };
 }
@@ -141,7 +141,7 @@ async function importBundleBinaryToGrader(grader, tarBuffer, shas) {
     const ext = await sh(grader)(`set -e; test -s /tmp/s1-wt.tar; rm -rf ${REPO}; mkdir -p ${REPO}; tar -xf /tmp/s1-wt.tar -C ${REPO}; echo "EXTRACTED=$(ls -A ${REPO} | wc -l)"`);
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_TAR team] head=${shas.head.slice(0, 8)} base=${shas.base.slice(0, 8)} ${ext.out.slice(-60)}`);
     return shas;
 }
@@ -196,7 +196,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
             state.shas = await transferWorkerTreeToGrader(worker, grader);
         const task = { ...oracleTaskFromTrap(trap), ...(state.shas ? { deliveredShas: state.shas } : {}) };
         const v = await runStandaloneOracle(grader, graderTransport(grader), worker, task);
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
         return v;
     };
@@ -250,27 +250,27 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
                         execFileSync("git", ["clone", "-q", "--branch", branch, remoteUrl, cloneDir], { stdio: ["ignore", "ignore", "pipe"] });
                     }
                     catch (e1) {
-                        if (process.env.S1_DEBUG_GIT)
+                        if (s1DebugGit())
                             console.error(`[S1_DEBUG_IMPORT] cp clone --branch ${branch} failed: ${e1.stderr?.toString().slice(-200)}; retrying default`);
                         execFileSync("git", ["clone", "-q", remoteUrl, cloneDir], { stdio: ["ignore", "ignore", "pipe"] });
                     }
                     const baseHash = execFileSync("git", ["-C", cloneDir, "rev-list", "--max-parents=0", "HEAD"]).toString().trim().split("\n").pop().trim();
                     const head = execFileSync("git", ["-C", cloneDir, "rev-parse", "HEAD"]).toString().trim();
                     if (!/^[0-9a-f]{40}$/.test(baseHash) || head === baseHash) {
-                        if (process.env.S1_DEBUG_GIT)
+                        if (s1DebugGit())
                             console.error(`[S1_DEBUG_IMPORT] cp integrated tree not delivered: head=${head} base=${baseHash}`);
                         return false;
                     }
                     const bundlePath = join(tmp, "team.bundle");
                     execFileSync("git", ["-C", cloneDir, "archive", "--format=tar", "-o", bundlePath, "HEAD"], { stdio: ["ignore", "ignore", "pipe"] });
                     const buffer = readFileSync(bundlePath);
-                    if (process.env.S1_DEBUG_GIT)
+                    if (s1DebugGit())
                         console.error(`[S1_DEBUG_IMPORT] cp integrated head=${head} base=${baseHash} tar bytes=${buffer.length}`);
                     state.teamBundle = { buffer, head, base: baseHash };
                     return true;
                 }
                 catch (e) {
-                    if (process.env.S1_DEBUG_GIT)
+                    if (s1DebugGit())
                         console.error(`[S1_DEBUG_IMPORT] control-plane THREW:`, e instanceof Error ? e.message : String(e));
                     return false;
                 }
@@ -361,7 +361,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_CONFLICT_ROUNDS = process.env.LEADER_CONFLICT_ROUNDS ?? "2";
     const run = createLeaderRunner({
         brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
-        ...(process.env.S1_DEBUG_GIT ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
+        ...(s1DebugGit() ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });
     const teamSeedWrite = (trap.seedFiles ?? [])
         .map((f) => {
@@ -415,13 +415,13 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
         });
     }
     catch (e) {
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1_DEBUG_LEADER ${trap.id}] run() THREW:`, e instanceof Error ? (e.stack ?? e.message) : String(e));
         killDaemon();
         rmSync(baseDir, { recursive: true, force: true });
         return { ok: false, reports: [], infraFailed: true };
     }
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_LEADER ${trap.id}] ok=${res.ok} error=${JSON.stringify(res.error)} cancelled=${res.cancelled} merge=${JSON.stringify(res.merge)} repairTerminal=${res.repairTerminal} reports=${(res.reports ?? []).length} reportsDetail=${JSON.stringify((res.reports ?? []).map((r) => ({ w: r.workerId, ok: r.ok, err: r.error })))?.slice(0, 400)}`);
     let imported = false;
     const merged = res.merge?.ok === true;

package/dist/bench/s1/run-firm.js

@@ -7,6 +7,7 @@ import { makeBenchClock } from "./runner-ctx.js";
 import { buildS1Report, S1_SCHEMA_VERSION, S1_CORE_VERSION } from "./row.js";
 import { armTag } from "./row.js";
 import { buildLiveDeps, liveRuntimeConfigFromEnv } from "./live-deps.js";
+import { setS1DebugGit } from "./runner-ctx.js";
 export function enumerateCells(seeds, filter = {}) {
     const cells = [];
     const source = filter.only ? ALL_TRAPS : FIRM_TRAPS;
@@ -184,6 +185,7 @@ function parseArgs(argv) {
     const cellTimeoutMs = positiveIntArg(get("cell-timeout-ms"), 15 * 60_000, "--cell-timeout-ms");
     return {
         dryRun: argv.includes("--dry-run"),
+        debugGit: argv.includes("--debug-git"),
         seeds,
         cellTimeoutMs,
         ledgerPath: get("ledger") ?? path.resolve(`./s1-out/${runId}.ledger.jsonl`),
@@ -234,6 +236,7 @@ function dryRunMockFactory() {
 }
 export async function main(argv = process.argv.slice(2)) {
     const args = parseArgs(argv);
+    setS1DebugGit(args.debugGit);
     const liveRuntime = liveRuntimeConfigFromEnv();
     if (!args.dryRun && !liveRuntime) {
         console.error("[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +

package/dist/bench/s1/runner-ctx.d.ts

@@ -17,6 +17,10 @@
  * + the clock; a deterministic shape test exercises it with a MOCK runner (no real agents, no keys).
  */
 import type { ExecutionEnv } from "@sema-agent/core";
+/** 由 bench 入口(`run-firm.ts` 的 `--debug-git`)翻开;不调 = 关。 */
+export declare function setS1DebugGit(on: boolean): void;
+/** tar/import/oracle/leader 四族 stderr 追踪开着没有(读侧单点)。 */
+export declare function s1DebugGit(): boolean;
 /**
  * The budget block the budget-match guard compares. NOT a s1.v1 RawRow field (the contract carries no budget) —
  * it is a PRODUCER-side fairness descriptor (one per emitted cell). `teamWorkerBudgetSumUsd` is the bigger-pie

package/dist/bench/s1/runner-ctx.js

@@ -1,3 +1,10 @@
+let debugGit = false;
+export function setS1DebugGit(on) {
+    debugGit = on;
+}
+export function s1DebugGit() {
+    return debugGit;
+}
 export function budgetDescriptor(budget, arm, teamWorkerBudgetSumUsd) {
     return {
         modelId: budget.modelId,

package/dist/boot/config-center.js

@@ -14,6 +14,7 @@ import { configLkgEnabled } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
 import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
@@ -366,12 +367,32 @@ export async function createConfigCenterRuntime(ctx) {
                 try {
                     const fileRx = await loadRemoteExec(localRoot);
                     if (fileRx) {
+                        const preemptedLane = config.remoteExec?.provider ?? "in-process";
+                        const isolatedLane = (lane) => {
+                            const word = executionLaneOf(lane === "in-process" ? undefined : lane);
+                            return word !== undefined && executionLaneCaps(word).isolation === "supported";
+                        };
+                        const disclosePreemption = (winner) => {
+                            if (winner === preemptedLane)
+                                return;
+                            const downgrade = isolatedLane(preemptedLane) && !isolatedLane(winner);
+                            logger.warn("remote_exec_lane_preempted_by_file", {
+                                preemptedLane,
+                                effectiveLane: winner,
+                                root: localRoot,
+                                isolationDowngrade: downgrade,
+                                note: `config.d/remote-exec.json (CONFIG_PROVIDER=local, file-wins) replaced the env-derived execution lane ` +
+                                    `"${preemptedLane}" with "${winner}" — any REMOTE_EXEC/lane coordinate env for "${preemptedLane}" is now INERT` +
+                                    (downgrade ? `. This is an ISOLATION DOWNGRADE: tasks run on a non-isolated target. Delete/fix the file, or unset the lane env if the file is the intended source.` : `. Delete/fix the file, or unset the lane env if the file is the intended source.`),
+                            });
+                        };
                         if (fileRx.provider === "host") {
                             config.remoteExec = {
                                 provider: "host",
                                 ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
                                 ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
                             };
+                            disclosePreemption("host");
                             logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
                         }
                         else if (fileRx.provider === "local-docker") {
@@ -383,10 +404,11 @@ export async function createConfigCenterRuntime(ctx) {
                                 ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
                                 ...(fileRx.network ? { network: fileRx.network } : {}),
                             };
+                            disclosePreemption("local-docker");
                             logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
                         }
                         else {
-                            logger.warn("remote_exec_file_isolated_lane_unwired", { provider: fileRx.provider, note: "e2b/k8s/ssh/adb are sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map)" });
+                            logger.warn("remote_exec_file_isolated_lane_unwired", { provider: fileRx.provider, effectiveLane: preemptedLane, note: "e2b/k8s/ssh/adb are sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map) — the env-derived lane above stays in force" });
                         }
                     }
                 }

package/dist/boot/coordinators.js

@@ -26,6 +26,17 @@ export function createLiveCoordinators(ctx) {
             checkpointStore: backend?.checkpoint !== undefined,
             durableApproval: config.durableApproval === true,
             toolApproval: config.toolApprovalEnabled === true,
+            askWindowMs: config.streamApproval.windowMs,
+        });
+    }
+    if (config.toolApprovalEnabled === true && config.streamApproval.windowMs === 0) {
+        logger.warn("stream_ask_window_zero", {
+            unattendedPolicy: config.unattendedApprovalPolicy,
+            parkFacility: durableEnabled,
+            streamApproval: streamApprovalGate.active ? "active" : streamApprovalGate.reason,
+            note: durableEnabled && config.unattendedApprovalPolicy === "park"
+                ? "STREAM_ASK_WINDOW_MS=0 — no approval card is emitted on ANY leg; every gated ask parks immediately (answer it via POST /v1/approvals/:sessionId/decide). Set a positive window (ms) to get live cards back."
+                : "STREAM_ASK_WINDOW_MS=0 — no approval card is emitted on ANY leg, and this deployment has no park destination (UNATTENDED_APPROVAL_POLICY=deny and/or no checkpoint store), so every gated tool call is refused fail-closed. Set a positive window (ms), or wire DURABLE_APPROVAL + a checkpoint store.",
         });
     }
     const approvalAskAudit = config.toolApprovalEnabled && backend?.kind === "local" && config.localDataRoot !== undefined
@@ -45,8 +56,9 @@ export function createLiveCoordinators(ctx) {
     }
     const toolApproval = config.toolApprovalEnabled
         ? new ToolApprovalCoordinator({
+            ttlMs: config.streamApproval.windowMs,
             ...(streamApprovalGate.active
-                ? { askStore: streamApprovalGate.askStore, ttlMs: config.streamApproval.windowMs, unreachedTtlMs: config.streamApproval.unreachedTtlMs }
+                ? { askStore: streamApprovalGate.askStore, unreachedTtlMs: config.streamApproval.unreachedTtlMs }
                 : {}),
             windowMarginMs: config.streamAskWindowMarginMs,
             admitMaxPerTask: config.streamApproval.admitMaxPerTask,

package/dist/boot/parked-revive-gate.d.ts

@@ -57,9 +57,14 @@ export interface ParkedReviveGateDeps {
      * 手抄一个等价签名会让 core 改这条 seam 的那天变成静默漂移而不是编译期事件)。
      */
     readonly resolveRuntimeCaps?: RunnerDeps["runtimeCapsResolver"];
-    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 的武装条件是
-     *  `runtimeCaps.autoMode === true` **∧** 这一面在场,两个半场缺一不武装(prepare-task 原式)。 */
+    /** `RunnerDeps.autoMode` 分类器面(信任门半场)在不在场 —— core 7.2.0 的武装条件是
+     *  `runtimeCaps.autoMode === true` **∧** 这一面在场(prepare-task 原式)。⚠️ [ref] / core [ref] 起武装式换成
+     *  `spec.autoModeRequested === true ∧ 席位 ∧ runtimeCaps?.autoMode !== false`——本文件的镜像
+     *  {@link autoModePostureOf} **未随改**(赎回行无父 run 的 auto 意图可读),见该函数头注的未闭环登记。 */
     readonly autoModeSeatMounted?: boolean;
+    /** [ref]:父 run 的 auto 意图(`TaskSpec.autoModeRequested` / 链位)——意图武装式下重建 decider 的第三项。⚠️ 今日
+     *  **无持久源**(core [ref] 链位 live-only;RunRecord 无 body),生产装配不递 ⇒ 恒缺席;座留给 core 持久化到货。 */
+    readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
         info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;

package/dist/boot/parked-revive-gate.js

@@ -1,3 +1,4 @@
+import { coreArmsAutoOnIntent } from "../auto-mode-face.js";
 import { join } from "node:path";
 import { createAutoModeDecider, NodeExecutionEnv } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -66,8 +67,18 @@ async function resolveCapsFor(deps, identity) {
     }
 }
 function autoModePostureOf(deps, row, caps) {
-    if (deps.autoModeSeatMounted !== true || caps?.autoMode !== true)
+    if (deps.autoModeSeatMounted !== true)
         return {};
+    if (!coreArmsAutoOnIntent()) {
+        if (caps?.autoMode !== true)
+            return {};
+    }
+    else {
+        if (caps?.autoMode === false)
+            return {};
+        if (deps.parentAutoModeIntent?.(row) !== true)
+            return {};
+    }
     return { autoMode: { decider: createUnreachableAncestorClassifier(deps, row) } };
 }
 function createUnreachableAncestorClassifier(deps, row) {

package/dist/boot/resolve-spec.d.ts

@@ -50,6 +50,9 @@ export interface ResolveSpecCtx {
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };
+    /** [ref] 件⑤:per-session「显式 bypassPermissions」登记簿的写腿(`boot/session-shell-gate-registry.ts`);
+     *  阶段④ 算出 effMode 的那一行登记,runner-deps 的 config 忠告汇点按 sessionId 回查定级。缺席(桩)= 不登记。 */
+    noteSessionShellGate?: ((sessionId: string | undefined, explicitOff: boolean) => void) | undefined;
     resumeAnchorStore: ReturnType<StoreBackend["resumeAnchor"]> | undefined;
     ownerAware: OwnerAwareSessionStore;
     taskLimitCaps: {

package/dist/boot/resolve-spec.js

@@ -36,7 +36,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
     if (onlySensitiveBaseline)
@@ -52,6 +52,7 @@ export function createResolveSpec(ctx) {
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
+        noteSessionShellGate?.(auth?.sessionId, effMode === "bypassPermissions");
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
         const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
@@ -278,6 +279,7 @@ export function createResolveSpec(ctx) {
             additionalReadDirectories,
             enablePlanMode: config.planModeEnabled ? true : undefined,
             ...(effMode ? { shellGate: shellGateForMode(effMode) } : {}),
+            ...(effMode === "auto" ? { autoModeRequested: true } : {}),
             selfOrchestration: selfOrchestrationFromBody({ selfOrchestration: body.selfOrchestration === true || parsedSettings.settings?.ultracode === true }, config, Boolean(centerRuntimeCapsResolver)),
             forwardSubagentEvents: body.forwardSubagentEvents === true ? true : undefined,
             retainSubagentSessions: normalizeRetainSubagentSessions(body.retainSubagentSessions),

package/dist/boot/runner-deps.d.ts

@@ -52,6 +52,14 @@ import type { MemorySyncRunner } from "../memory-sync-client.js";
  */
 export type RunnerDepsOnAsk = (req: Parameters<ToolApprovalCoordinator["ask"]>[0], signal?: AbortSignal) => Promise<AskOutcome>;
 export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordinator | undefined): RunnerDepsOnAsk | undefined;
+/** [ref] 件⑤:core `onError(phase:"config")` 的 `classification` 已知词表。⚠️ core d.ts(`RunnerDeps.onError` 注)只登记了
+ *  prompt-cache 相的五词,config 相的词**只在 dist js 出现**(7.2.0 亲扫 dist 下全部 js 的 `phase: "config"` 发射点:五词——
+ *  `interaction-posture-refused`(prepare-config-doors)/ `memory-tools-not-mounted` / `sandbox-admission-unavailable` /
+ *  `shared-memory-not-mounted` / `shell-gate-off`(prepare-hands-readface));[ref] 去幻觉轮真抓:首版只写了 shell-gate-off
+ *  一词,其余四词会被误标 unknown。所以这是「按实现亲读」的开集快照,不是 core 类型闭集——词表外的值原样进日志并标
+ *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
+ *  的 dist 扫描格钉住(core 加词/收进 d.ts 那天先红)。 */
+export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 export interface RunnerDepsCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -113,6 +121,10 @@ export interface RunnerDepsCtx {
      *  来源=configCenter.takeMcpRevocations()(取走即声明接线,restart 豁免与承接绑同一动作)。
      *  缺席=undefined=pre-338 语义(纯 env 部署无中心撤销面)。 */
     mcpRevocations: RunnerDeps["mcpRevocations"];
+    /** [ref] 件⑤([ref] server ③):per-session「显式 bypassPermissions」登记簿的读腿 —— `onError(phase:"config",
+     *  classification:"shell-gate-off")` 在本 session 显式声明 bypass 时降级 info(正常态不打 warn)。缺席(桩 /
+     *  run-local)= 照 warn(退化方向=多一条告警)。 */
+    sessionShellGateExplicitlyOff?: ((sessionId: string) => boolean) | undefined;
     /**
      * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
      *

package/dist/boot/runner-deps.js

@@ -15,6 +15,13 @@ export function createRunnerDepsOnAsk(toolApproval) {
         return undefined;
     return (req, signal) => toolApproval.ask(req, signal);
 }
+export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
+    "interaction-posture-refused",
+    "memory-tools-not-mounted",
+    "sandbox-admission-unavailable",
+    "shared-memory-not-mounted",
+    "shell-gate-off",
+]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter) {
     return (notice) => {
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(notice.detail !== undefined ? { detail: notice.detail } : {}) });
@@ -71,7 +78,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecordStore, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecordStore, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -216,8 +223,26 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "config") {
-                logger.warn("runner_config_advisory", { sessionId: ctx.sessionId, info: String(err) });
-                metrics.inc("runner_config_advisory_total");
+                const code = typeof err?.code === "string" ? err.code : undefined;
+                const classification = ctx.classification;
+                const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
+                const expectedShellGateOff = classification === "shell-gate-off" && sessionShellGateExplicitlyOff?.(ctx.sessionId) === true;
+                const fields = {
+                    sessionId: ctx.sessionId,
+                    ...(code !== undefined ? { code } : {}),
+                    ...(classification !== undefined ? { classification, classificationKnown } : {}),
+                    ...(expectedShellGateOff ? { expected: "bypassPermissions declared by the caller for this session — shell gate off is the requested posture, not a misconfiguration" } : {}),
+                    info: String(err),
+                };
+                if (expectedShellGateOff)
+                    logger.info("runner_config_advisory", fields);
+                else
+                    logger.warn("runner_config_advisory", fields);
+                metrics.inc("runner_config_advisory_total", {
+                    ...(code !== undefined ? { code } : {}),
+                    ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
+                    level: expectedShellGateOff ? "info" : "warn",
+                });
                 return;
             }
             logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, err: String(err) });

package/dist/boot/runtime-caps.d.ts

@@ -9,7 +9,7 @@
  */
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
-import { type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
+import { type EntitlementsResolverFn, type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
 export interface RuntimeCapsCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -22,24 +22,34 @@ export interface RuntimeCapsCtx {
  * D1 / `boot/retention-lane.ts` 同姿态:安全/合规控件不得半开)。
  *
  * governed 的语义是「per-principal verdict **必答**」:core 对 verdict 缺席一律**拒跑**(fail-closed,部署显式
- * 选的方向)。而 verdict 只能来自一个源 —— 本批唯一源 = SQL 后端上的 `memory_optout_grant` 表(三层折叠后
- * 恒答显式 boolean)。governed 而无源 ⇒ 每一个 `capture:"off"` 声明都被 core 以
+ * 选的方向)。verdict 源**两条**(析取,[ref] 起):①SQL 后端上的 `memory_optout_grant` 表(三层折叠后
+ * 恒答显式 boolean),②非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`。
+ * governed 而两源皆无 ⇒ 每一个 `capture:"off"` 声明都被 core 以
  * `memory.capture_optout_denied` 拒掉,而运维看到的只是一台「启动成功、opt-out 全拒」的机器 —— 正是
- * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:要么接 SQL 后端(表随中央
- * ensureSchema 建),要么改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、后者全拒,
- * 都不问 verdict)。
+ * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:接 SQL 后端(表随中央
+ * ensureSchema 建)、接非 dry-run center,或改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、
+ * 后者全拒,都不问 verdict)。
  *
  * ⚠️ center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema 的独立小件([ref] §四 开放问题①),
- * 已到货(1.4.0,[ref])——析取臂已加(centerEntitlementPresent),判据不变;dry-run 不算源(不 APPLY 即不 ENFORCE 同律)。
+ * 已到货(1.4.0,[ref])——析取臂已加,dry-run 不算源(不 APPLY 即不 ENFORCE 同律)。
+ *
+ * 🔴 **[ref] —— 第三臂的辖域**:它证的是「center 这个**源**在场」,**不是**「center 会为每个 principal
+ * **发** `allowMemoryOptOut`」。该键在 settings-schema 里是**可选**的(`z.ZodOptional<z.ZodBoolean>`),
+ * `toCoreRuntimeCaps` 对缺席不铸键 ⇒ 一台 center 从不发该键的 governed worker 照样起动、然后每一个
+ * `memory.capture:"off"` 恒拒(core: verdict absent)。这条**不能**在启动期证死(部署级布尔对 per-principal
+ * 的授权说不了话,且 boot 期去问 center 会把拒启挂在一次网络上),所以取「拒启臂放行 + 两处响亮」:
+ * 启动期一行 `memory_capture_governed_center_only_source`(这一形有风险)+ 运行期首次真缺席一行
+ * (见 `applyGovernedVerdictAbsenceWarning`,一次性、不改判)。
  */
 export declare function assertMemoryCapturePolicyWirable(input: {
     policy: ServiceConfig["memoryCapturePolicy"];
     grantSourceWired: boolean;
-    centerEntitlementPresent?: boolean;
+    centerEntitlementSourceWired?: boolean;
 }): void;
 export declare function createRuntimeCaps(ctx: RuntimeCapsCtx): {
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
-    runtimeCapsResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsResolver: EntitlementsResolverFn | undefined;
+    runtimeCapsPeekResolver: EntitlementsResolverFn | undefined;
 };
 //# sourceMappingURL=runtime-caps.d.ts.map