@sema-agent/server 7.98.0 → 7.100.0

package/dist/fleet-lease.js

@@ -1,4 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
+import { CenterCredentialUnavailableError } from "./center-credential.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -8,15 +10,11 @@ export class FleetLeaseManager {
     state = new Map();
     inflight = new Map();
     f;
-    base;
-    headers;
     now;
     failStreak = 0;
     constructor(opts) {
         this.opts = opts;
         this.f = opts.fetchImpl ?? fetch;
-        this.base = opts.center.baseUrl.replace(/\/+$/, "");
-        this.headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
         this.now = opts.now ?? Date.now;
     }
     async admit(principal) {
@@ -46,6 +44,11 @@ export class FleetLeaseManager {
     peek(principal) {
         return this.state.get(principal)?.kind;
     }
+    authFailOpen(principal, status, note) {
+        this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status, principal, note });
+        this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(status) });
+        return { ok: true };
+    }
     set(principal, st) {
         if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
             const oldest = this.state.keys().next().value;
@@ -64,11 +67,11 @@ export class FleetLeaseManager {
     }
     async issueOrRenewInner(principal) {
         try {
-            const res = await this.f(`${this.base}/api/fleet/leases`, {
+            const { res } = await centerFetch(this.opts.center, { kind: "fleet-leases" }, {
                 method: "POST",
-                headers: this.headers,
-                body: JSON.stringify({ principal, worker: this.opts.center.worker }),
-                signal: AbortSignal.timeout(LEASE_FETCH_TIMEOUT_MS),
+                json: { principal, worker: this.opts.center.worker },
+                timeoutMs: LEASE_FETCH_TIMEOUT_MS,
+                fetchImpl: this.f,
             });
             if (res.status === 200) {
                 const body = (await res.json());
@@ -100,13 +103,14 @@ export class FleetLeaseManager {
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {
-                this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status: res.status, principal, note: "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)" });
-                this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(res.status) });
-                return { ok: true };
+                return this.authFailOpen(principal, res.status, "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)");
             }
             throw new Error(`lease ${res.status}`);
         }
         catch (err) {
+            if (err instanceof CenterCredentialUnavailableError) {
+                return this.authFailOpen(principal, "credential-unreadable", `${err.reason} — no lease request sent (budget NOT enforced until the credential is readable)`);
+            }
             this.failStreak += 1;
             if (this.failStreak === 1)
                 this.opts.logger?.warn?.("fleet_lease_unavailable_fail_open", { error: err instanceof Error ? err.message : String(err) });
@@ -117,8 +121,8 @@ export class FleetLeaseManager {
 }
 export function createFleetLeaseFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
-    if (!cc?.baseUrl || !cc.token || !cc.worker)
+    if (!cc?.baseUrl || !cc.credential.declared || !cc.worker)
         return undefined;
-    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker } });
+    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker } });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/host-lsp-manager.d.ts

@@ -0,0 +1,29 @@
+/**
+ * S-616(core 7.30.1 #1073 提货)—— **宿主车道本地语言服务器**的唯一构造点。
+ *
+ * ## 病(DEBTS S-684 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
+ * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的
+ * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
+ * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
+ * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
+ * `scrubServerSecrets` 的结果)。
+ *
+ * ## 规则(一句)
+ * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) —— 与模型可驱动的 host shell(`inheritEnv:"scrub"`)
+ * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
+ * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
+ * 剥掉了什么经既有观测面留痕(site = `server.lsp.spawn-env`,每 site×key 一次披露 + 逐次计数)—— core 那侧
+ * 刻意不报(无收集器,KL),本仓这一格补上。
+ *
+ * ## 时刻
+ * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
+ * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
+ *
+ * ## 两个调用点
+ * `boot/execution-env.ts`(服务的 host 车道)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })`;
+ * 现在都经本函数 —— 构造形只有一份,剥除规则也就只能有一份(源码对账钉在 `test/secret-env-scrub-disclosure.test.ts`)。
+ */
+import { NodeLspManager } from "@sema-agent/core";
+/** 构造宿主车道的本地语言服务器管理器(`create*`:返回活对象)。`log` = 管理器的观测钩(open/heal/degrade/evict 事件)。 */
+export declare function createHostLspManager(log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
+//# sourceMappingURL=host-lsp-manager.d.ts.map

package/dist/host-lsp-manager.js

@@ -0,0 +1,14 @@
+import { NodeLspManager } from "@sema-agent/core";
+import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "./server-secret-env.js";
+export function createHostLspManager(log) {
+    const findings = [];
+    const scrubbed = scrubServerSecrets(process.env, findings);
+    recordSecretEnvScrub("server.lsp.spawn-env", findings);
+    const env = {};
+    for (const [k, v] of Object.entries(scrubbed))
+        if (v !== undefined)
+            env[k] = v;
+    return new NodeLspManager({ log, env });
+}
+//# sourceMappingURL=host-lsp-manager.js.map

package/dist/hosted-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-591 / S-564(车LT,7.95.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ * S-591 / S-564(车LT,7.95.0)→ S-671 / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
  *
  * ## 为什么是一处
  *
@@ -21,60 +21,62 @@
  *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
  *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
  *
- * 两条判据的**交集之外**有一形谁都不管:**多用户部署但运维没开 `REQUIRE_PRINCIPAL`,也没有 org 治理**。
- * 那台机器上每一条赦免都成立(它自称单用户),而每一道天花板都不成立(它没有 org 分区)。
- * ⇒ 先把这个判定位铸成**一处**,再让两条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
+ * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
  * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
  *
- * ## 判据的**唯一**标准:运维**显式点名了一个外部身份签发方**
- *
- * 🔴 判据里**必须**有不读 `requirePrincipal` 的臂,否则腿①(S-564)是同义反复
- * (「`REQUIRE_PRINCIPAL` 没设 ⇒ 要求设 `REQUIRE_PRINCIPAL`」永不触发)。所以词表分两类:
- *  · `require-principal` —— 运维**已经说了**这是多租户(定义式,零假阳);
- *  · 另外两条 —— 运维没说,但他**显式点了一个外部签发方的名字**。一台机器一个可信主人的形
- *    (CC 的信任模型)不需要向任何人验签:签发方存在 ⇒ 身份来自这台机器之外 ⇒ 有别人。
- *
- * ## 🔴 「受控于控制面」**不是**托管证据(主会话裁定⑥ 的二选一,本仓选这一侧)
- *
- * 初版收过第三条臂 `managed-worker`(`SEMA_REGISTRY_WORKER` 在场 = reconciler 管着这台 worker)。
- * **实测两个反例后撤回**:
- *  · `src/run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 之后才 `loadConfig()` —— 一个共享 `.env` 带着
- *    registry 键就让本机 CLI **拒启**,而拒因指的那根旋钮正是它自己会覆盖回去的(codex 对抗复审同批独立复现);
- *  · 本仓自己的 `test/config-coverage-blocks.test.ts` 两格(configCenter 块)就是「有 worker 名、没开
- *    `REQUIRE_PRINCIPAL`」——它们在初版上当场红。
- * ⇒ **fleet 管理轴 ≠ 租户轴**。同理 `AUTH_BRIDGE_ISSUER` 只收**显式 env**,**绝不**收 boot 期那条
- * `?? config.configCenter?.baseUrl` 的回退(`boot/stage-09-leader.ts`)—— 那条回退的事实来源同样是
- * 「配了 center」,收它等于把刚撤回的那条臂换个名字装回来,精度还更差。
- *
- * ## 精度优先于召回(逐条写下被排除的候选,不留「我没想到」的空白)
- *
- * 假阳 = 一台单用户 turnkey 被拒启 / 被收走一个它一直在用的能力。假阴 = 缺口照旧。
- * 两者都坏,但假阳会当场打到在跑的部署,所以词表只收**单用户形写不出来**的证据:
+ * ## 判据:托管 ⇔ 运维显式声明 `REQUIRE_PRINCIPAL=true`(clay 裁定 [ref] ①,2026-09-23)
+ *
+ * 只有一条定义式证据,零推断。7.95.0–7.98.x 还收过两条「运维点名了一个外部身份签发方」的推断臂
+ * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
+ *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
+ *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
+ *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
+ * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
+ * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ *
+ * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
+ * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
+ * `run-local.ts` 为那两臂清 env 的清除口。
+ *
+ * ## 被排除的候选(逐条写下,不留「我没想到」的空白)
+ *
+ * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
+ *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
+ *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
- *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空,
- *    于是一台开了烤门的单用户机器会被判成托管。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— 见上一段,已实测撤回。
+ *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。
  *  · ❌ `DB_BACKEND=mysql|pg` —— 那是**耐久性**轴,不是租户轴(单用户要 durable run 也得开)。
  *  · ❌ `BIND_HOST` 非回环 —— 容器里 `0.0.0.0` 是单用户常态(compose/k8s 默认)。
- *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴;
- *    一个自己给自己上合规档的单用户部署不该因此被拒启。
- *
- * **已知召回缺口(显式登记,不用「应该很少」填空)**:一台既不验 principal-JWT、也没点 auth-bridge
- * 签发方的团队机器(例如只靠反代加一层 basic auth)本表**看不见**。它的运维面补偿是:
- * `REQUIRE_PRINCIPAL=true` 本身就是那台机器该设的键,而 `docs/DEPLOY-PREREQS.md` 的「托管形前置」段
- * 把判据写成了给人读的清单。
+ *  · ❌ `COMPLIANCE_PROFILE` / `RETENTION_MAX_AGE_DAYS` / `LOCKED_CONFIG_KEYS` —— 数据/治理轴。
+ *
+ * ## 🔴 召回缺口是**全量**的(显式登记,不用「应该很少」填空)
+ *
+ * 一台多用户 / 团队机器只要运维**忘设** `REQUIRE_PRINCIPAL`,本判据就**看不见**它 —— 无论它有没有
+ * 配签发方、受不受 reconciler 管。那台机器上:`principal` 缺席走单用户 `"default"` 赦免 ⇒ 全服无主会话
+ * 被列给每一个调用方;上面四条能力授予面(hooks / `settings.env` / `cwd` / `additionalDirectories`)对每个
+ * 调用方打开;写容纳面天花板与 `approverPosture` 留声两条腿(下文)也按单用户放行。
+ * `settings.env` 的射程要说准:适配器的 `env` 是**并**到 `process.env` 上的逐键覆盖(`plugins/remote-env-host.ts`
+ * 的 `mergeEnv`),而 `task-settings.ts` 的 `cleanEnvMap` 没有任何键名拒集 ⇒ `PATH` / `LD_PRELOAD` /
+ * `NODE_OPTIONS` 一视同仁。
+ * **补偿**:`REQUIRE_PRINCIPAL=true` 本来就是那台机器该设的键(运维自己的声明;server 不替他推断)——
+ * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
-/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。 */
-export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal", "principal-jwt", "auth-bridge-issuer"];
-/** 一条证据(闭集三词)。 */
+/** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
+ *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
+export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
+/** 一条证据(闭集一词)。 */
 export type HostedEvidence = (typeof HOSTED_EVIDENCE_WORDS)[number];
 /**
- * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。
- * `ServiceConfig` 与 `CrossInvariantView` 都**结构上**满足本形,所以 boot 腿、热路径腿与请求腿读同一只函数。
+ * 本判据读的配置键集 —— 取自平铺配置型(键名/类型永不与真配置漂)。`ServiceConfig` **结构上**满足本形,
+ * 所以请求腿(阶段④)与能力面读同一只函数。
  */
-export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer">>;
+export type HostedPostureInput = Readonly<Pick<ServiceConfigFlat, "requirePrincipal">>;
 /** 一台 worker 的托管姿态事实(值 + 证据)——纯数据。 */
 export interface HostedPostureFacts {
     /** 这台部署是不是托管 / 多租。 */
@@ -83,60 +85,14 @@ export interface HostedPostureFacts {
     readonly evidence: readonly HostedEvidence[];
 }
 /**
- * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ `requirePrincipal === true`([ref] ①)。
  *
- * 🔴 `evidence` 收**全部**命中而不是第一条:拒因要告诉运维「这台机器凭哪几件事被判成托管」,
- * 只报一条会让他改掉那一条之后再撞一次同样的拒(两次拒启之间他学不到全貌)。
+ * `evidence` 仍是数组(按词表顺序收**全部**命中):拒因逐字点它们,运维才知道改哪儿;词表是闭集,
+ * 形状不随词数变。
  */
 export declare function buildHostedPosture(c: HostedPostureInput): HostedPostureFacts;
-/**
- * 判据里**非定义式**那两条证据背后的 env 名 —— 即「运维显式点名了一个外部身份签发方」的全部拼法。
- *
- * 🔴 **单一属主**:`src/run-local.ts` 那条「强制单用户」的腿按本表清 env(W-新8)。它**结构上**兑现不了
- * 这些键(它把 `REQUIRE_PRINCIPAL` 焊死成 false ⇒ principal 门根本不上场),留着它们只会让判据看见一个
- * 假事实、然后拿一个**它自己会覆盖回去**的旋钮当拒因。名表抄第二份的那天,加一条证据 = run-local 静默漏清。
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(那是定义式那一条,run-local 自己显式写值)也**没有**
- * `SEMA_REGISTRY_*`(fleet 管理轴,本判据根本不读 —— 本机 CLI 从组织下发面取配置是正当用法)。
- */
-export declare const HOSTED_EVIDENCE_ENV_KEYS: readonly ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
-/**
- * 把上表那几根 env **清掉**(`run-local.ts` 的「强制单用户」腿调它)。
- *
- * 🔴 **为什么是四行字面 `delete` 而不是照表循环**:配置目录的 D1 对账门按文件数**动态 env 读点**并且是
- * **只降不升的棘轮** —— `process.env[k]` 那种计算属性读它一个都不放过(理由是动态读让「这个文件读了哪些
- * 键」变成机器看不见的事)。照表循环会给 `run-local.ts` 顶上第 3 处动态读、当场撞棘轮。⇒ 名字写成字面,
- * **但只写这一处**;上面那张表仍是**声明面**的属主,两者的一致性由
- * `test/hosted-posture.test.ts` 的行为格看着(逐个设上再调一次,断言全没了)——不是靠人眼比对。
- *
- * ⚠️ 表里**没有** `REQUIRE_PRINCIPAL`(定义式那条,调用方自己显式写值)也没有 `SEMA_REGISTRY_*`
- * (fleet 管理轴,本判据根本不读)。
- */
-export declare function clearHostedEvidenceEnv(): void;
 /** 一条证据的运维事实句 —— **穷举 switch,无缺省臂**(词表加员即编译红)。 */
 export declare function hostedEvidenceNote(e: HostedEvidence): string;
-/**
- * **腿①(S-564)** —— 托管形部署必须显式开 `REQUIRE_PRINCIPAL`。返回拒因;`undefined` = 通过。
- *
- * 判据与文案的**唯一属主**:boot 期的拒启 throw(`config.ts` 的跨域不变量区)与
- * `CONFIG_CROSS_INVARIANTS` 表(`config-invariants.ts`)**调同一只**,不各抄一份([ref] 的纪律 +
- * [ref]「禁手抄投影」)。
- *
- * 🔴 **表里那一行今天是「预置纵深」,不是在岗执法**(主会话裁定⑤,撤回初版那句「热路径同样在岗」):
- * `checkCrossInvariants` 的候选视图(`config-hot` 那条腿)今天只覆写 limits 那 14 员键,本判据读的
- * 5 个键**一个都不在里面** ⇒ 那一行在热路径上**永不返回拒因**。它先在场是纵深(哪天候选视图覆盖到
- * auth 域,它自己就活),不是现在有人在执法。**假覆盖比没覆盖更坏**(7.94.0 自己刚立的反面规矩)。
- *
- * 🔴 **为什么是拒启而不是 warn**:`principal` 缺席在本仓走 `"default"` 赦免 —— 一台没开这根旋钮的
- * 多用户机器会把**全服无主会话**列进 `ListAgents`,并且把 hooks / shellEnv / cwd / 根围栏拓宽四条
- * 能力授予面一并对每个调用方打开(四条面的谓词各不相同,逐条在模块头注 —— 别照「都一样」读)。
- * 安全轴上的 fail-open 不许有安静的兜底臂([ref])。
- *
- * 🔴 **`settings.env` 那一条的射程要说准**(亲读 `plugins/remote-env-host.ts` 的 `mergeEnv`):适配器的
- * `env` 是**并**到 `process.env` 上的逐键覆盖(不是替),而 `task-settings.ts` 的 `cleanEnvMap` 只判
- * 类型/键长/值长/条数、**没有任何键名拒集** ⇒ `PATH` / `LD_PRELOAD` / `NODE_OPTIONS` 一视同仁。
- * 那条面唯一的防线就是上面那道闸;闸一漂,面全开。
- */
-export declare function hostedPrincipalRefusal(c: HostedPostureInput): string | undefined;
 /** 腿② 读的键集 = 射程判据 + 天花板旋钮。
  *  🔴 档位的**词表属主在 `config-types.ts`**(`TASK_WRITE_FACE_ESCALATIONS`)—— 本模块刻意**不留第二份**:
  *  施工期真犯过一次(两处各写一份 `["allow","refuse"]`,加词的那天两边会分家),[ref] 第一排查点。 */

package/dist/hosted-posture.js

@@ -1,45 +1,21 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { deviceCwdHonored } from "./task-cwd.js";
-export const HOSTED_EVIDENCE_WORDS = ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
     if (c.requirePrincipal === true)
         evidence.push("require-principal");
-    if (c.principalJwtPubkeys.length > 0 || c.principalJwtIss !== undefined || c.principalJwtAud !== undefined)
-        evidence.push("principal-jwt");
-    if (c.authBridgeIssuer !== undefined)
-        evidence.push("auth-bridge-issuer");
     return { hosted: evidence.length > 0, evidence };
 }
-export const HOSTED_EVIDENCE_ENV_KEYS = ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
-export function clearHostedEvidenceEnv() {
-    delete process.env.PRINCIPAL_JWT_PUBKEYS;
-    delete process.env.PRINCIPAL_JWT_ISS;
-    delete process.env.PRINCIPAL_JWT_AUD;
-    delete process.env.AUTH_BRIDGE_ISSUER;
-}
 export function hostedEvidenceNote(e) {
     switch (e) {
         case "require-principal":
             return "REQUIRE_PRINCIPAL=true (this deployment declares itself multi-tenant)";
-        case "principal-jwt":
-            return "PRINCIPAL_JWT_PUBKEYS/ISS/AUD is configured (principal identities are verified against an external issuer — a single-user turnkey box has no issuer)";
-        case "auth-bridge-issuer":
-            return "AUTH_BRIDGE_ISSUER is set explicitly (a second external SSO-JWT issuer; the registry-URL fallback is deliberately NOT read here — that fact is fleet management, not tenancy)";
     }
 }
 function hostedBecause(facts) {
     return facts.evidence.map(hostedEvidenceNote).join("; ");
 }
-export function hostedPrincipalRefusal(c) {
-    const facts = buildHostedPosture(c);
-    if (!facts.hosted || c.requirePrincipal === true)
-        return undefined;
-    return (`this deployment looks HOSTED/multi-tenant (${hostedBecause(facts)}) but REQUIRE_PRINCIPAL is not set — ` +
-        `an absent principal takes the single-user "default" amnesty, which would list every ownerless session to every caller ` +
-        `and open the single-user capability grants (settings.hooks / settings.env / cwd / additionalDirectories) to all of them. ` +
-        `Set REQUIRE_PRINCIPAL=true (and OPERATOR_PRINCIPALS for the operator-only routes), or remove the hosted-deployment configuration if this really is a single-user box.`);
-}
 export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
 function hostPostureDeclarationsHonored(c) {
     if (deviceCwdHonored(c))

package/dist/http/active-run-conflict.d.ts

@@ -13,15 +13,10 @@
  *    (`gate_not_tool_approval`/`gate_not_resumable`/`wake.gate_pending` 的指路句)。三处文案与本表若漂移,
  *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
  */
-import { type Autonomy } from "../runtime-governance.js";
+import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
 import { type RunRecord } from "../plugins/store-contracts.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-sql.js";
-/** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 `governanceMandatesShellGateAlways`)。 */
-export interface GovernancePosture {
-    autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
-}
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
 /**
@@ -123,11 +118,6 @@ export declare function resumeEntryForGate(kind: string, ids: {
     sessionId: string;
     taskId: string;
 }): string | null;
-export declare function governanceOriginOf(gate: {
-    riskDescriptor?: {
-        shellGateDoctrine?: ShellGateDoctrine;
-    };
-} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** token 泛型:真身是 branded CheckpointToken(秘密能力,只在本函数内部流转,绝不进响应体)。 */
 /**
  * SSE 车道的 done 帧 result(拒绝形)。与 409 body **同一铸体处** —— 此前 tasks.ts 在 res.write 里
@@ -177,7 +167,7 @@ interface ConflictProbeDeps<TToken> {
         findPendingTokenBySession?: (sessionId: string, scope?: string, binding?: PendingRowBinding) => Promise<TToken | null | undefined>;
         /** 结构形(不 import core 的 `Checkpoint`):只声明本模块**真读**的几格。`riskDescriptor` 是
          *  core 在 mint 时挂到升级门上的判读元数据(display/triage only),`shellGateDoctrine` 是 2026-08-05
-         *  裁定加的取证格 —— 见下方 `governanceOriginOf` 的推导论证。`checkpointId`([ref],core 5.42.0)
+         *  裁定加的取证格 —— 见 `runtime-governance.ts` 的 `governanceOriginOf` 推导论证。`checkpointId`([ref],core 5.42.0)
          *  是行的非秘密稳定身份,可选 —— legacy 行没有它(见 `PendingGateMaterial.checkpointId`)。 */
         get?: (token: TToken) => Promise<{
             checkpointId?: string;

package/dist/http/active-run-conflict.js

@@ -1,4 +1,4 @@
-import { governanceMandatesShellGateAlways } from "../runtime-governance.js";
+import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -27,11 +27,6 @@ function safeCheckpointIdOf(raw, token) {
         return undefined;
     return raw;
 }
-export function governanceOriginOf(gate, governance) {
-    if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
-        return undefined;
-    return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
-}
 export function toDoneFrameResult(body) {
     return {
         status: "failed",

package/dist/http/admission.js

@@ -7,6 +7,7 @@ import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
+import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
@@ -193,6 +194,13 @@ export function createAdmission(ctx) {
                     return null;
                 }
             }
+            {
+                const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
+                if (webSearchVerdict.kind === "malformed") {
+                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue);
+                    return null;
+                }
+            }
         }
         const skillsErr = validateUserSkills(body.skills);
         if (skillsErr) {

package/dist/http/resume-legs.d.ts

@@ -29,7 +29,7 @@ export declare function createResumeLegs(ctx: {
     routeCtxBase: RouteCtxBase;
     resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;

package/dist/http/resume-legs.js

@@ -1,6 +1,6 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
-import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
+import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
@@ -9,10 +9,10 @@ import { mintCancelledResult } from "../run-cancel-context.js";
 import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -198,11 +198,14 @@ export function createResumeLegs(ctx) {
             };
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
-        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME
+        const rememberableTool = paForGrant !== undefined &&
+            paForGrant.toolName &&
+            paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
-            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
+            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), rememberableToolName: rememberableTool })
             : undefined;
         const lateSettleSink = deps.approvalLateSettle;
         const lateSettleAnchor = lateSettleSink !== undefined && req !== undefined && token
@@ -496,8 +499,9 @@ export function createResumeLegs(ctx) {
                         const { type, ...rest } = frame;
                         const f = frame;
                         const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
-                        if (f.type === "task_notification" && f.task_id)
-                            resumeNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            resumeNotifiedKeys.set(fKey, write.then(() => true, () => false));
                         return write;
                     }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
@@ -544,7 +548,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -671,7 +675,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -780,7 +784,7 @@ export function createResumeLegs(ctx) {
                             case "task_notification": {
                                 await flush();
                                 const tnr = ev.notification;
-                                const tnrKey = tnr?.task_id ? taskNotificationStreamKey({ task_type: tnr.task_type, task_id: tnr.task_id, status: String(tnr.status), seq: tnr.seq }) : undefined;
+                                const tnrKey = taskNotificationStreamKeyOf(tnr);
                                 const tnrPrior = tnrKey !== undefined ? resumeNotifiedKeys.get(tnrKey) : undefined;
                                 if (tnrPrior === undefined || !(await tnrPrior)) {
                                     const write = append("task_notification", taskNotificationEventData(ev));

package/dist/http/route-ctx.d.ts

@@ -357,11 +357,11 @@ export interface RouteLegs {
     resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
-     *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`
+     *  载入 cp** 的可记工具名(`rememberableToolName`,非 tool_approval / AskUserQuestion / legacy null / S-663 强制卡 ⇒ `null`
      *  = 无可记)一并回传,路由只对这个逐字落店。`overrideSessionId` = parked 腿的 root/host 会话 grant 锚。 */
     onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, 
     /** [ref]:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/decide` 腿传 `true`;
      *  内部 D-D SLA deny-sweep 不传 —— 它没有在等响应的人,提前受理对它零收益而少一条同步失败面。 */

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
-import { type GovernancePosture } from "../active-run-conflict.js";
+import { type GovernancePosture } from "../../runtime-governance.js";
 import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 /**

package/dist/http/routes/approvals-assistant.js

@@ -16,7 +16,7 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
-import { governanceOriginOf } from "../active-run-conflict.js";
+import { governanceOriginOf } from "../../runtime-governance.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
@@ -689,7 +689,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             let pendingGrant;
             const grantOnCommit = remember && deps.approvalExemptionStore
                 ? async (grant) => {
-                    const canonical = grant.validatedToolName;
+                    const canonical = grant.rememberableToolName;
                     if (!canonical)
                         return;
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };

package/dist/http/routes/memory-compliance.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +36,10 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
+    if (face === "erase" && err instanceof MemoryLayerUnwritableError) {
+        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
+        return true;
+    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
         return true;

package/dist/http/routes/memory-origin.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
@@ -47,6 +48,10 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
+    if (face === "clear" && err instanceof MemoryLayerUnwritableError) {
+        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
+        return true;
+    }
     if (face === "clear") {
         const coreCode = codeOf(err);
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))