@sema-agent/server 7.99.0 → 7.100.0

package/dist/plugins/sql-json-column.d.ts

@@ -46,11 +46,24 @@ import type { SqlDialect } from "./sql-driver.js";
  *
  * 🔴 **别名是产物的一部分,不是调用点的自由**:MySQL 协议下 `CAST(rules AS CHAR)` 的回报字段名是
  * `CAST(rules AS CHAR)` 而不是 `rules` —— 把别名留给调用点写,就等于给每一处读腿留一个「忘了写别名,
- * 行上于是没有这个键、读回恒 `undefined`」的静默洞。别名在这里一次钉死,行的键恒等于列名。
+ * 行上于是没有这个键、读回恒 `undefined`」的静默洞。别名在这里一次钉死,行的键恒等于列名(成员形
+ * {@link JsonColumnMember}:恒等于声明的小写别名)。
  *
  * 🔴 **`CAST` 不影响索引**:投影不在 `WHERE` 里;大体量列多一次文本拷贝,量级与现状同(驱动本来也解一次)。
  */
-export declare function jsonColumnText(dialect: SqlDialect, column: string): string;
+export declare function jsonColumnText(dialect: SqlDialect, column: string, member?: JsonColumnMember): string;
+/**
+ * 一列 JSON 的**一个顶层成员**(NP-3,7.100.0)—— 读腿只要文档里的一棵子树时用它,整只文档不出引擎。
+ *  · `key` = 成员名(裸标识符;进 MySQL 路径 `'$.<key>'` 与 PG 字面 `'<key>'`,所以只认裸标识符,不转义不猜);
+ *  · `as` = 行上的键(**小写**裸标识符:PG 把不带引号的别名折成小写,别的拼法会让两方言的行键不同)。
+ * 产物仍是**文本**(同一条「按文本投影、恰好解一次」),成员缺席 / 文档不是对象 ⇒ SQL NULL(两引擎同答),
+ * 所以读腿用 {@link decodeNullableJsonColumn}:NULL = 「这份文档没有这棵子树」,JSON `null` 字面 = 一个值(交形读者判)。
+ * 首个读者:`checkpoint-store-sql.ts` 的 `listPending`(运维队列 / `/v1/approvals/stream` 热读)只取 `pendingAction`。
+ */
+export interface JsonColumnMember {
+    readonly key: string;
+    readonly as: string;
+}
 /**
  * 同一只投影的**裸表达式**(不带别名)—— 给 `WHERE` / `UPDATE … WHERE` 这种**没有别名位**的地方用。
  *
@@ -68,7 +81,7 @@ export declare function jsonColumnText(dialect: SqlDialect, column: string): str
  * 子树,本函数的插值对它是一个不透明表达式。所以「误用进 SELECT 投影且没给别名」这一形没有机器门 ——
  * 误用的落点是真库上当场的 `SqlJsonColumnError("not-text")` 响亮抛(行上没有那个键 ⇒ `undefined`),不是静默。
  */
-export declare function jsonColumnTextExpr(dialect: SqlDialect, column: string): string;
+export declare function jsonColumnTextExpr(dialect: SqlDialect, column: string, memberKey?: string): string;
 /**
  * 一次读回失败的**种别**(店层码,**闭集**;运行期词表在这里,类型从它推导 —— 一张词表只有一个写者):
  *  · `not-text` —— 拿到的不是串 = **读腿漏了投影**,那是**码的问题不是数据的问题** ⇒ 响亮的程序错,

package/dist/plugins/sql-json-column.js

@@ -1,13 +1,24 @@
 import { z } from "zod";
 const COLUMN_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-export function jsonColumnText(dialect, column) {
-    return `${jsonColumnTextExpr(dialect, column)} AS ${column}`;
+export function jsonColumnText(dialect, column, member) {
+    if (member === undefined)
+        return `${jsonColumnTextExpr(dialect, column)} AS ${column}`;
+    if (!MEMBER_ALIAS_RE.test(member.as)) {
+        throw new Error(`jsonColumnText: member alias ${JSON.stringify(member.as)} must be a lower-case bare identifier — PostgreSQL folds unquoted aliases to lower case, so any other spelling would give the two dialects different row keys`);
+    }
+    return `${jsonColumnTextExpr(dialect, column, member.key)} AS ${member.as}`;
 }
-export function jsonColumnTextExpr(dialect, column) {
+const MEMBER_ALIAS_RE = /^[a-z_][a-z0-9_]*$/;
+export function jsonColumnTextExpr(dialect, column, memberKey) {
     if (!COLUMN_NAME_RE.test(column)) {
         throw new Error(`jsonColumnTextExpr: ${JSON.stringify(column)} is not a bare column identifier — refusing to splice it into SQL text`);
     }
-    return dialect === "pg" ? `${column}::text` : `CAST(${column} AS CHAR)`;
+    if (memberKey === undefined)
+        return dialect === "pg" ? `${column}::text` : `CAST(${column} AS CHAR)`;
+    if (!COLUMN_NAME_RE.test(memberKey)) {
+        throw new Error(`jsonColumnTextExpr: member ${JSON.stringify(memberKey)} is not a bare identifier — refusing to splice it into a JSON path`);
+    }
+    return dialect === "pg" ? `(${column}::jsonb -> '${memberKey}')::text` : `CAST(JSON_EXTRACT(${column}, '$.${memberKey}') AS CHAR)`;
 }
 export const SQL_JSON_COLUMN_PROBLEMS = ["not-text", "not-json", "malformed"];
 export class SqlJsonColumnError extends Error {

package/dist/plugins/web-search.d.ts

@@ -4,7 +4,9 @@
  * backend here is what makes `assembleFullBodyTools({ webSearch })` actually mount the WebSearch tool.
  *
  * Multi-provider, picked by `WEB_SEARCH_PROVIDER`:
- *   - `brave`   — Brave Web Search API (GET, `X-Subscription-Token` header)
+ *   - `brave`   — Brave Web Search API (GET, `X-Subscription-Token` header); with `WEB_SEARCH_ENDPOINT` set to a
+ *                 Brave-compatible gateway's full search URL (e.g. a self-hosted Nólë gateway, S-669) the same leg
+ *                 serves that backend — no new provider word, `capabilities.webSearch.backend` still reads `brave`
  *   - `tavily`  — Tavily Search API (POST, `Authorization: Bearer`, native include/exclude_domains)
  *   - `searxng` — a self-hosted SearXNG instance (GET `?format=json`, no auth)
  *
@@ -140,20 +142,6 @@ export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) =
  * stays captured in this closure — it is never surfaced to the model or the tool args.
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
-/**
- * `WEB_SEARCH_SEARXNG_PARAMS` / `settings.webSearch.searxngParams` 的解析 —— SearXNG 实例侧参数
- * (`engines=` / `language=` 等)。
- *
- * 🔴 [ref] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
- * 两条门都没有位置填它,于是我在 [ref] 说的「这条是给你们的」是句空话。单测直接构造
- * `WebSearchBackendConfig` 传进去,**天然跳过了配置入口这一层**,于是「能力在」与「配得进」之间
- * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
- *
- * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,
- * 所以分隔符取 `;` 而不是 `,`。整串解析不出任何一对 ⇒ **返回 undefined,键整个不铸**
- * (不产出空对象:空对象会让下游以为「配了但是空的」,与本仓「缺席就要缺席得干净」同源)。
- */
-export declare function parseSearxngParams(raw: unknown): Record<string, string> | undefined;
 /**
  * #81④ 探活门控 —— **默认 OFF**,显式开才探。
  *
@@ -165,14 +153,46 @@ export declare function parseSearxngParams(raw: unknown): Record<string, string>
  * 而猜错的方向是「凭空出网」。缺席要缺席得干净,含糊也一样。
  */
 export declare function shouldProbeWebSearchOnBoot(env?: NodeJS.ProcessEnv): boolean;
-/** Parse the deployment env into a backend config; `undefined` when no provider is set (⇒ WebSearch not assembled). */
+/** env 载体形错的机读码(拼法随 `config.<族>_invalid` 既有族,如 `config.model_provider_invalid`)。码按**规则**
+ *  命名、不按键名 —— 键名逐字在拒因里。 */
+export declare const WEB_SEARCH_CONFIG_INVALID_CODE = "config.web_search_invalid";
+/**
+ * `WEB_SEARCH_PROVIDER` 这一格的判官(provider 字段的 env 载体):缺席 / 词表外 ⇒ `undefined`(= 不装配,缺席语义)。
+ *
+ * 🔴 **读面只问这一只**(codex R1-F2):`config-catalog` 的 `WEB_SEARCH_PROVIDER` 行要的是「装配了哪只后端」这一格,
+ * 不是整份配置。首版它调的是 {@link webSearchConfigFromEnv} —— 那只对旁的 `WEB_SEARCH_*` 形错**抛**(拒启);嵌入式
+ * `createHttpServer` 不走 stage-07,形错的环境可以活在一只跑着的 server 里,于是读 provider 这一格就把整张目录打成
+ * 500。形错拒启归装配点(stage-07 / run-local 调整份解析),读面不替装配点再判一遍。
+ */
+export declare function webSearchProviderFromEnv(env?: NodeJS.ProcessEnv): WebSearchProvider | undefined;
+/**
+ * 部署 env ⇒ 后端配置。`WEB_SEARCH_PROVIDER` 缺席 / 词表外 ⇒ `undefined`(WebSearch 不装配,**不**读其余旋钮 ——
+ * 不消费的键不判);其余 `WEB_SEARCH_*` 任一形错 ⇒ **抛**(拒启,见 {@link envValue})。
+ */
 export declare function webSearchConfigFromEnv(env?: NodeJS.ProcessEnv): WebSearchBackendConfig | undefined;
 /**
- * Parse an UNTRUSTED per-request `body.settings.webSearch` (the user's shell settings — `{provider, apiKey?, endpoint?,
- * maxResults?}`) into a backend config. Returns `undefined` for a missing/invalid provider — NEVER throws, so a bad
- * per-request config falls back to the deployment-env backend rather than failing the task. 🔒 The CALLER gates this to
- * the single-user host lane (a per-request `endpoint`/`apiKey` is a capability config; on multi-tenant a tenant could
- * point `searxng` at an internal URL = SSRF, so multi-tenant uses ONLY the deployment-env backend — [ref] axis).
+ * 每请求 `body.settings.webSearch` 的判决 —— 受理面与装配点**同问这一只**:
+ *  · `absent`    —— 没带(或 `null`)⇒ 用部署后端;
+ *  · `honored`   —— 每个字段形对,且 `provider` 点名了一只本部署会说的后端 ⇒ 这次调用用它;
+ *  · `malformed` —— 任一字段形错 ⇒ 受理面 400 `request.field_invalid`(`issue` 逐字点名字段)。
+ * **`provider` 缺席或不在词表里也是形错**(S-199 主会话改判,codex 验修 V1 [high]):一段 `settings.webSearch` 就是
+ * 调用方在点名目的地(`endpoint` / `apiKey` 都挂在它点名的那只后端上),认不出就拒,不静默换成部署后端 —— 改判前
+ * 这一形回落部署后端,`{provider:"searx", endpoint:<私有地址>}` 的查询于是发到了部署配的后端。env 腿的同一只
+ * {@link isWebSearchProvider} 守卫对**部署**的词表外答「不装配」,那是部署自己的缺席,不是换别人的目的地。
+ * 规则集因此只剩三态,没有「形对但不采纳」这一臂。
+ *
+ * 🔒 采纳与否是**调用方**的事:装配点把整条腿闸在单用户车道(每请求 `endpoint`/`apiKey` 是能力配置;多租上一个
+ * 租户把 `searxng` 指向内网地址就是 SSRF,所以多租只认部署 env 的后端)。受理面的形判**不分车道**(与
+ * `settings.hooks` 同姿势:形在受理面判,采不采纳在装配点决定)。
  */
-export declare function webSearchConfigFromSettings(raw: unknown): WebSearchBackendConfig | undefined;
+export type RequestWebSearchVerdict = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "honored";
+    readonly config: WebSearchBackendConfig;
+} | {
+    readonly kind: "malformed";
+    readonly issue: string;
+};
+export declare function judgeRequestWebSearch(raw: unknown): RequestWebSearchVerdict;
 //# sourceMappingURL=web-search.d.ts.map

package/dist/plugins/web-search.js

@@ -1,8 +1,10 @@
 import { createSearxngSearchBackend } from "@sema-agent/core";
+import { isHierarchicalUrl } from "../trace/redact.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
 function isWebSearchProvider(word) {
     return WEB_SEARCH_PROVIDERS.includes(word);
 }
+const providerWord = (raw) => raw.trim().toLowerCase();
 export function projectWebSearchCapability(provider) {
     return provider === undefined ? { backend: "none" } : { backend: provider };
 }
@@ -26,6 +28,10 @@ function withTimeout(signal, ms) {
 async function errorText(res) {
     return (await res.text().catch(() => "")).slice(0, 200);
 }
+async function httpFailure(provider, res) {
+    const body = await errorText(res);
+    return new Error(`${provider} search failed: HTTP ${res.status}${body ? ` — ${body}` : ""}`);
+}
 let onBadPayload;
 export function setWebSearchBadPayloadObserver(fn) {
     onBadPayload = fn;
@@ -62,7 +68,7 @@ async function braveSearch(fetchImpl, cfg, query, max, signal) {
     url.searchParams.set("count", String(Math.min(20, max)));
     const res = await fetchImpl(url, { headers: { Accept: "application/json", "X-Subscription-Token": cfg.apiKey }, signal });
     if (!res.ok)
-        throw new Error(`brave search failed (${res.status}): ${await errorText(res)}`);
+        throw await httpFailure("brave", res);
     const data = (await res.json());
     return normalize(data.web?.results, (r) => ({ title: r.title, url: r.url, snippet: r.description }), max, "brave");
 }
@@ -81,7 +87,7 @@ async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
         signal,
     });
     if (!res.ok)
-        throw new Error(`tavily search failed (${res.status}): ${await errorText(res)}`);
+        throw await httpFailure("tavily", res);
     const data = (await res.json());
     return normalize(data.results, (r) => ({ title: r.title, url: r.url, snippet: r.content }), max, "tavily");
 }
@@ -132,64 +138,150 @@ export function createWebSearchBackend(cfg) {
     };
     return { search, maxResults };
 }
-export function parseSearxngParams(raw) {
-    if (typeof raw === "object" && raw !== null) {
-        const entries = Object.entries(raw);
-        if (entries.length === 0 || entries.some(([, v]) => typeof v !== "string"))
-            return undefined;
-        return Object.fromEntries(entries);
-    }
-    if (typeof raw !== "string")
-        return undefined;
-    const out = {};
-    for (const pair of raw.split(";")) {
-        const i = pair.indexOf("=");
-        if (i <= 0)
-            continue;
-        const k = pair.slice(0, i).trim();
-        const v = pair.slice(i + 1).trim();
-        if (k && v)
-            out[k] = v;
-    }
-    return Object.keys(out).length > 0 ? out : undefined;
-}
 export function shouldProbeWebSearchOnBoot(env = process.env) {
     const raw = env.WEB_SEARCH_PROBE_ON_BOOT?.trim().toLowerCase();
     return raw === "true" || raw === "1";
 }
-export function webSearchConfigFromEnv(env = process.env) {
-    const provider = env.WEB_SEARCH_PROVIDER?.trim().toLowerCase();
-    if (provider === undefined || !isWebSearchProvider(provider))
-        return undefined;
-    const searxngParams = parseSearxngParams(env.WEB_SEARCH_SEARXNG_PARAMS);
-    const maxRaw = Number(env.WEB_SEARCH_MAX_RESULTS ?? "");
-    const timeoutRaw = Number(env.WEB_SEARCH_TIMEOUT_MS ?? "");
+const ABSENT = { ok: true };
+const valueOf = (j) => (j.ok ? j.value : undefined);
+const isBlank = (s) => s.trim() === "";
+function judgeText(raw) {
+    if (raw === undefined || raw === null)
+        return ABSENT;
+    if (typeof raw !== "string")
+        return { ok: false, issue: "must be a string" };
+    return isBlank(raw) ? ABSENT : { ok: true, value: raw };
+}
+const ENDPOINT_FORM = "must be an absolute URL with a scheme and a host, such as https://search.example.com (a bare host or host:port is not one)";
+function judgeEndpoint(raw) {
+    if (raw === undefined || raw === null)
+        return ABSENT;
+    if (typeof raw !== "string")
+        return { ok: false, issue: ENDPOINT_FORM };
+    if (isBlank(raw))
+        return ABSENT;
+    return isHierarchicalUrl(raw) ? { ok: true, value: raw } : { ok: false, issue: ENDPOINT_FORM };
+}
+const COUNT_FORM = "must be a number ≥ 1";
+function judgeCount(raw) {
+    if (raw === undefined || raw === null)
+        return ABSENT;
+    return typeof raw === "number" && Number.isFinite(raw) && raw >= 1 ? { ok: true, value: Math.floor(raw) } : { ok: false, issue: COUNT_FORM };
+}
+function envNumber(raw) {
+    return raw === undefined || isBlank(raw) ? undefined : Number(raw.trim());
+}
+const SEARXNG_PARAM_NAME = /^[A-Za-z0-9_.-]+$/;
+const SEARXNG_PARAMS_FORM = 'must be an object of parameter name → non-empty string, or a "name=value;name=value" string';
+function judgeSearxngParams(raw) {
+    if (raw === undefined || raw === null)
+        return ABSENT;
+    const pairs = [];
+    if (typeof raw === "string") {
+        const segments = raw.split(";");
+        for (const [i, seg] of segments.entries()) {
+            if (isBlank(seg))
+                continue;
+            const eq = seg.indexOf("=");
+            if (eq < 0)
+                return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — segment ${i + 1} has no "="` };
+            pairs.push([seg.slice(0, eq).trim(), seg.slice(eq + 1).trim()]);
+        }
+    }
+    else if (typeof raw === "object" && !Array.isArray(raw)) {
+        const entries = Object.entries(raw);
+        for (const [k, v] of entries) {
+            if (typeof v !== "string")
+                return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — the value of ${JSON.stringify(k)} is not a string` };
+            pairs.push([k, v.trim()]);
+        }
+    }
+    else {
+        return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — got ${Array.isArray(raw) ? "an array" : `a ${typeof raw}`}` };
+    }
+    const seen = new Set();
+    for (const [k, v] of pairs) {
+        if (!SEARXNG_PARAM_NAME.test(k))
+            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${JSON.stringify(k)} is not a parameter name (letters, digits, "_", "-", ".")` };
+        if (v === "")
+            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${k} has an empty value` };
+        if (seen.has(k))
+            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${k} is given more than once` };
+        seen.add(k);
+    }
+    return pairs.length === 0 ? ABSENT : { ok: true, value: Object.fromEntries(pairs) };
+}
+function assembleBackendConfig(provider, f) {
     return {
         provider,
-        ...(env.WEB_SEARCH_API_KEY ? { apiKey: env.WEB_SEARCH_API_KEY } : {}),
-        ...(env.WEB_SEARCH_ENDPOINT ? { endpoint: env.WEB_SEARCH_ENDPOINT } : {}),
-        ...(searxngParams ? { searxngParams } : {}),
-        ...(Number.isFinite(maxRaw) && maxRaw > 0 ? { maxResults: Math.floor(maxRaw) } : {}),
-        ...(Number.isFinite(timeoutRaw) && timeoutRaw > 0 ? { timeoutMs: Math.floor(timeoutRaw) } : {}),
+        ...(f.apiKey !== undefined ? { apiKey: f.apiKey } : {}),
+        ...(f.endpoint !== undefined ? { endpoint: f.endpoint } : {}),
+        ...(f.searxngParams !== undefined ? { searxngParams: f.searxngParams } : {}),
+        ...(f.maxResults !== undefined ? { maxResults: f.maxResults } : {}),
+        ...(f.timeoutMs !== undefined ? { timeoutMs: f.timeoutMs } : {}),
     };
 }
-export function webSearchConfigFromSettings(raw) {
-    if (!raw || typeof raw !== "object")
+export const WEB_SEARCH_CONFIG_INVALID_CODE = "config.web_search_invalid";
+function envValue(key, j) {
+    if (!j.ok) {
+        throw new Error(`env ${key} ${j.issue} [${WEB_SEARCH_CONFIG_INVALID_CODE}] — fix it or unset it (an empty value counts as unset). ` +
+            "WebSearch reads its WEB_SEARCH_* knobs only when WEB_SEARCH_PROVIDER names a backend, and every knob it reads must be well-formed: " +
+            "a malformed value used to be absorbed silently (garbage parameters sent to the search instance, or a quiet fall-back to a default nobody chose).");
+    }
+    return j.value;
+}
+export function webSearchProviderFromEnv(env = process.env) {
+    const raw = env.WEB_SEARCH_PROVIDER;
+    const word = raw === undefined ? undefined : providerWord(raw);
+    return word !== undefined && isWebSearchProvider(word) ? word : undefined;
+}
+export function webSearchConfigFromEnv(env = process.env) {
+    const provider = webSearchProviderFromEnv(env);
+    if (provider === undefined)
         return undefined;
+    return assembleBackendConfig(provider, {
+        apiKey: envValue("WEB_SEARCH_API_KEY", judgeText(env.WEB_SEARCH_API_KEY)),
+        endpoint: envValue("WEB_SEARCH_ENDPOINT", judgeEndpoint(env.WEB_SEARCH_ENDPOINT)),
+        searxngParams: envValue("WEB_SEARCH_SEARXNG_PARAMS", judgeSearxngParams(env.WEB_SEARCH_SEARXNG_PARAMS)),
+        maxResults: envValue("WEB_SEARCH_MAX_RESULTS", judgeCount(envNumber(env.WEB_SEARCH_MAX_RESULTS))),
+        timeoutMs: envValue("WEB_SEARCH_TIMEOUT_MS", judgeCount(envNumber(env.WEB_SEARCH_TIMEOUT_MS))),
+    });
+}
+const SETTINGS_WEB_SEARCH_FORM = "settings.webSearch must be an object { provider, apiKey?, endpoint?, searxngParams?, maxResults? }";
+function judgeRequestProvider(raw) {
+    const got = raw === undefined || raw === null ? "it is missing" : typeof raw === "string" ? `got ${JSON.stringify(raw.slice(0, 40))}` : `got a ${Array.isArray(raw) ? "array" : typeof raw}`;
+    const word = typeof raw === "string" ? providerWord(raw) : undefined;
+    return word !== undefined && isWebSearchProvider(word)
+        ? { ok: true, value: word }
+        : { ok: false, issue: `must name one of ${WEB_SEARCH_PROVIDERS.join(" | ")} (${got}) — it names where this request's searches go, so an unknown or missing provider is refused rather than replaced by this deployment's own backend` };
+}
+export function judgeRequestWebSearch(raw) {
+    if (raw === undefined || raw === null)
+        return { kind: "absent" };
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return { kind: "malformed", issue: SETTINGS_WEB_SEARCH_FORM };
     const s = raw;
-    const provider = typeof s.provider === "string" ? s.provider.trim().toLowerCase() : "";
-    if (!isWebSearchProvider(provider))
-        return undefined;
-    const max = typeof s.maxResults === "number" && Number.isFinite(s.maxResults) && s.maxResults > 0 ? Math.floor(s.maxResults) : undefined;
+    const provider = judgeRequestProvider(s.provider);
+    if (!provider.ok)
+        return { kind: "malformed", issue: `settings.webSearch.provider ${provider.issue}` };
+    const fields = {
+        apiKey: judgeText(s.apiKey),
+        endpoint: judgeEndpoint(s.endpoint),
+        searxngParams: judgeSearxngParams(s.searxngParams),
+        maxResults: judgeCount(s.maxResults),
+    };
+    for (const [field, j] of Object.entries(fields)) {
+        if (!j.ok)
+            return { kind: "malformed", issue: `settings.webSearch.${field} ${j.issue}` };
+    }
     return {
-        provider,
-        ...(typeof s.apiKey === "string" && s.apiKey ? { apiKey: s.apiKey } : {}),
-        ...(typeof s.endpoint === "string" && s.endpoint ? { endpoint: s.endpoint } : {}),
-        ...(() => {
-            const p = parseSearxngParams(s.searxngParams);
-            return p ? { searxngParams: p } : {};
-        })(),
-        ...(max ? { maxResults: max } : {}),
+        kind: "honored",
+        config: assembleBackendConfig(provider.value, {
+            apiKey: valueOf(fields.apiKey),
+            endpoint: valueOf(fields.endpoint),
+            searxngParams: valueOf(fields.searxngParams),
+            maxResults: valueOf(fields.maxResults),
+        }),
     };
 }
 //# sourceMappingURL=web-search.js.map

package/dist/run-local.js

@@ -8,8 +8,8 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
-import { hasOperatorGateIntent } from "./approval.js";
+import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -48,6 +48,7 @@ import { fatalExit } from "./boot/fatal-exit.js";
 import { installProcessExitBoundary } from "./boot/exit-boundary.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
+import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 export function parseArgs(argv) {
     let objective;
@@ -195,7 +196,7 @@ export async function runLocal(argv, deps = {}) {
             for (const de of r.domainErrors ?? [])
                 logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
             effective = r.effective;
-            applyEffective(config, r.effective, logger);
+            applyEffective(config, r.effective, logger, { leg: "boot" });
             if (effective?.mcp)
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
@@ -242,7 +243,7 @@ export async function runLocal(argv, deps = {}) {
     }
     const ungatedCompensation = buildOnlySensitiveBaselineWarning(config, {
         durableEnabled: false,
-        singleUserAutoAcceptBaseline: config.requirePrincipal !== true && !hasOperatorGateIntent(config),
+        singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
     if (ungatedCompensation)
         logger.warn(ungatedCompensation.event, ungatedCompensation.fields);
@@ -285,7 +286,7 @@ export async function runLocal(argv, deps = {}) {
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
-    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) }) : undefined;
+    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager((event, fields) => logger.info(event, fields)) : undefined;
     const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     let memorySync;
     if (config.memorySync && memoryEngine) {

package/dist/runs.js

@@ -1,4 +1,4 @@
-import { runWithVerification, runCascade, defaultTaskRegistry, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
+import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
@@ -12,7 +12,7 @@ import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { errorText as errText } from "./observability/err-text.js";
 import { LIVENESS_HEARTBEAT_MS } from "./config-invariants.js";
@@ -256,8 +256,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             const { type, ...rest } = frame;
             const f = frame;
             const write = append(type, rest);
-            if (f.type === "task_notification" && f.task_id)
-                notifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+            const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+            if (fKey !== undefined)
+                notifiedKeys.set(fKey, write.then(() => true, () => false));
             return write;
         }, completionDiagLog ? { route: "bg-run-start", connection: "durable-append", log: completionDiagLog } : undefined);
         const runBody = async () => {
@@ -285,7 +286,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
                     else if (legLive) {
-                        const key = taskNotificationStreamKey(n);
+                        const key = taskNotificationDedupKey(n);
                         if (notifiedKeys.get(key) === undefined) {
                             notifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                         }

package/dist/runtime-governance.d.ts

@@ -23,7 +23,7 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
@@ -142,13 +142,60 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  *    并不要求 always),之后运维把 autonomy 热改成 `ask`,那条老行会被标成治理出身 —— 五个前提要**同时**
  *    成立,且该行仍未决。
  * 根治要**在 mint 那一刻把出身写进行里**(core 的 `CheckpointGate` 属主面,不是本仓能单方面做的);
- * 在那之前这一位的定位是**分诊提示**,不是裁决输入 —— 它不参与任何门/CAS/resume 判定,消费端也只拿它
- * 渲染徽标。登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
+ * 在那之前这一位的定位是**分诊提示**,不参与任何门/CAS/resume 判定 —— 唯一的例外是**只收窄**的那一个读者:
+ * 耐久 `/decide` 腿的会话级 remember 可记性(NP-1,7.100.0,`tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 在那里两个失真方向的代价都不越过修前:在场向 ⇒ 一次 `remember:"session"` 只放行本次、不铸会话免询问(安全
+ * 方向,代价 = 下一次再问一遍);缺席向 ⇒ 照旧可记(= NP-1 之前的行为)。它从不**放宽**任何裁决。
+ * 登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
  */
 export declare function governanceMandatesShellGateAlways(governance: {
     autonomy?: Autonomy;
     manualModeShellGate?: "always" | "classify";
 }): boolean;
+/** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 {@link governanceMandatesShellGateAlways})。 */
+export interface GovernancePosture {
+    autonomy?: Autonomy;
+    manualModeShellGate?: "always" | "classify";
+}
+/**
+ * [ref]:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
+ *
+ *   行上的取证格 `gate.riskDescriptor.shellGateDoctrine === "always"`
+ *   ∧ 本部署的治理层本来就要求 always({@link governanceMandatesShellGateAlways},那里写着为什么单看行不够 ——
+ *     SUP 路由姿态同样产 `"always"`)
+ *
+ * 第一半:core 在 mint 这道门时把「当时活着的 doctrine」如实写进 `riskDescriptor.shellGateDoctrine`
+ * (2026-08-05 取证裁定;`prepare-task` 只在**被 shell 门铸**的 ask 上写它),所以持久行自己带着证据 ——
+ * park 腿天然跨副本、跨重启,活卡腿那张 ALS 标记表在这里结构上够不着。
+ * 第二半:把「有效档 always」收窄到「治理层是真成因」,否则一条 SUP 路由出来的门会被谎报成治理强制。
+ *
+ * ⚠️ 残留(双向失真的窄在场向 + 根治路径)与「只收窄」的那一个裁决读者,都登记在
+ * {@link governanceMandatesShellGateAlways} 的顶注,别在这里复述。
+ *
+ * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
+ * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ *
+ * 🔴 **单一属主,四个读者**(不在任何读面另写一份判据 —— 这一位恰恰是靠「行上取证 ∧ 部署姿态」的合取才不
+ * 谎报的,两份必漂):409 体的待批门材料(`http/active-run-conflict.ts`)、两条 durable 读面
+ * `GET /v1/approvals` / `/v1/approvals/stream` 的 `projectPendingForWire`([ref]②)、耐久 `/decide` 腿的
+ * remember 可记性(NP-1,经 `tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 住在本文件而不是 `http/active-run-conflict.ts` 的理由:它的另一半判据属主就在这里,而第四个读者
+ * (`tool-approval.ts`)从 `http/` 那侧值引会闭合一条 ESM 值环(`active-run-conflict` → `checkpoint-store-sql` →
+ * `tool-approval`),本文件是三者共同的叶。
+ *
+ * ⚠️ **askId 为什么不在这里**([ref] 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
+ * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
+ * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
+ * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
+ * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
+ * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
+ * 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
+ */
+export declare function governanceOriginOf(gate: {
+    riskDescriptor?: {
+        shellGateDoctrine?: ShellGateDoctrine;
+    };
+} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** spec 序里的秩(0 起,越大越严)。入参收 `string`(fail-loud 边界:schema `trustRank` 同款姿势)——词表外 ⇒
  *  RangeError,绝不 undefined/NaN 让比较静默成 false。导出只为对表钉(test/safety-merge-spec-consumption.test.ts,
  *  [ref] 件4)——运行时消费仍走上表(键类型闭集)。 */

package/dist/runtime-governance.js

@@ -116,6 +116,11 @@ export function autonomyOverrides(autonomy) {
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }
+export function governanceOriginOf(gate, governance) {
+    if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
+        return undefined;
+    return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
+}
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");

package/dist/server-secret-env.d.ts

@@ -11,8 +11,10 @@
  * ## 规则(一句)
  * 本仓**知道**哪些 env 键是凭据 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,
  * 不手抄第二份名单 —— 这些键按名剥;其余照旧交 core 按形剥。{@link scrubServerSecrets} = 目录派生剥除 ∘ core
- * `scrubSecretEnv`,两条腿都只调它。core 形状规则的缺口由 core 源头修(另案);本层不改 core 的判据,也不自造
- * 第二份形状规则。目录里加一个 secret 型键,两条腿当场就剥它。
+ * `scrubSecretEnv`,本仓三条子进程腿(host shell / git 子进程 / 本地语言服务器,后者见 `host-lsp-manager.ts`)都只调它。
+ * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 已补 `KEYS|TOKENS|PASSWORDS`(S-616 提货),目录臂独担的只剩
+ * `OTEL_EXPORTER_OTLP_HEADERS`(`*_HEADERS` 不在形状规则射程,是边界不是缺陷票)。本层不改 core 的判据,也不自造
+ * 第二份形状规则。目录里加一个 secret 型键,三条腿当场就剥它。
  *
  * ## 不变的面
  * `inheritEnv:"all"`(显式全继承)与显式 allowlist 两形不经本函数,行为逐字不变;调用方显式传入的 env

package/dist/task-settings.d.ts

@@ -264,7 +264,7 @@ export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
  *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
- *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明