@sema-agent/server 7.99.0 → 7.101.0

package/dist/run-local.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
+import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
 import { buildDurableAbsenceNote, createCorruptReadSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { homedir } from "node:os";
@@ -8,8 +9,8 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
-import { hasOperatorGateIntent } from "./approval.js";
+import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -25,6 +26,7 @@ import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario,
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
+import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
@@ -48,6 +50,7 @@ import { fatalExit } from "./boot/fatal-exit.js";
 import { installProcessExitBoundary } from "./boot/exit-boundary.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
+import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 export function parseArgs(argv) {
     let objective;
@@ -121,22 +124,81 @@ export function missingGatewayRequirements(config) {
     }
     return missing;
 }
+const RUN_LOCAL_APPROVAL_SEAT = { kind: "live" };
 export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot) {
-    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
+    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
 }
 export function createLocalApprover(io) {
+    let tail = Promise.resolve();
     return async (req, signal) => {
         if (!io.isTty) {
-            io.printErr(`denied "${req.toolName}" (${req.message}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
-                `The gate comes from this deployment's governance knobs: AUTONOMY, MANUAL_MODE_SHELL_GATE, ` +
-                `runtime.commandPolicy (config.d/governance.json). Run it in a terminal to answer interactively, or relax the knob.`);
+            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
+                `The gate comes from this deployment's governance knobs: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (the approval lists; ` +
+                `APPROVAL_DENY refuses outright without asking), AUTONOMY, MANUAL_MODE_SHELL_GATE, runtime.commandPolicy (config.d/governance.json). ` +
+                `Run it in a terminal to answer interactively, or relax the knob (APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls; ` +
+                `a separate .env for this CLI keeps a server's lists off it).`);
             return false;
         }
-        return io.askYesNo(`approve "${req.toolName}"? ${req.message} [y/N] `, signal);
+        const argsShown = argsDisplayOf(req.args);
+        if (!argsShown.ok) {
+            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — its arguments cannot be displayed ` +
+                `(${terminalSafeText(argsShown.reason)}), so there is nothing a person could review; refusing instead of asking.`);
+            return false;
+        }
+        const prior = tail;
+        let release;
+        const mine = new Promise((resolve) => {
+            release = resolve;
+        });
+        tail = prior.then(() => mine);
+        try {
+            if (!(await priorSettledUnlessAborted(prior, signal)))
+                return false;
+            return await io.askYesNo(buildLocalAskPrompt(req, argsShown.text), signal);
+        }
+        finally {
+            release();
+        }
     };
 }
-export async function promptYesNoOnTty(prompt, signal, streams = { input: process.stdin, output: process.stderr }) {
+function priorSettledUnlessAborted(prior, signal) {
     if (signal?.aborted)
+        return Promise.resolve(false);
+    if (signal === undefined)
+        return prior.then(() => true);
+    return new Promise((resolve) => {
+        const onAbort = () => resolve(false);
+        signal.addEventListener("abort", onAbort, { once: true });
+        void prior.then(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(!signal.aborted);
+        });
+    });
+}
+function argsDisplayOf(args) {
+    let json;
+    try {
+        json = JSON.stringify(args);
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+    if (json === undefined)
+        return { ok: false, reason: "the arguments serialize to nothing" };
+    return { ok: true, text: terminalSafeText(json) };
+}
+function buildLocalAskPrompt(req, argsShown) {
+    return `approve "${terminalSafeText(req.toolName)}"? ${terminalSafeText(req.message)}\n  ${argsShown}\n[y/N] `;
+}
+function terminalSafeText(text) {
+    return text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function inputAlreadyEnded(input) {
+    const state = input;
+    return state.readableEnded === true || state.destroyed === true;
+}
+export async function promptYesNoOnTty(prompt, signal, streams = { input: process.stdin, output: process.stderr }) {
+    if (signal?.aborted || inputAlreadyEnded(streams.input))
         return false;
     const rl = createInterface({ input: streams.input, output: streams.output });
     try {
@@ -157,6 +219,27 @@ export async function promptYesNoOnTty(prompt, signal, streams = { input: proces
         rl.close();
     }
 }
+function personStopOf(result) {
+    if (result.terminal.kind !== "completed")
+        return undefined;
+    if (result.haltedOnUserRejection === true)
+        return "haltedOnUserRejection";
+    if (result.haltedByUser === true)
+        return "haltedByUser";
+    return undefined;
+}
+function buildPersonStopFooter(stop, sessionId) {
+    switch (stop) {
+        case "haltedOnUserRejection":
+            return `task stopped (haltedOnUserRejection): a tool call was refused, so the run did not finish its work — continue it with --session ${sessionId}`;
+        case "haltedByUser":
+            return `task stopped (haltedByUser): the run was halted before it finished its work — continue it with --session ${sessionId}`;
+        default: {
+            const unhandled = stop;
+            throw new Error(`person-stop marker "${String(unhandled)}" has no footer`);
+        }
+    }
+}
 export async function runLocal(argv, deps = {}) {
     const print = deps.print ?? ((l) => console.log(l));
     const printErr = deps.printErr ?? ((l) => console.error(l));
@@ -194,8 +277,10 @@ export async function runLocal(argv, deps = {}) {
         if (r) {
             for (const de of r.domainErrors ?? [])
                 logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
+            for (const d of r.droppedEntries ?? [])
+                logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
             effective = r.effective;
-            applyEffective(config, r.effective, logger);
+            applyEffective(config, r.effective, logger, { leg: "boot" });
             if (effective?.mcp)
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
@@ -207,6 +292,9 @@ export async function runLocal(argv, deps = {}) {
     catch (err) {
         logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
+    const noDefaultModel = defaultModelRefusal(config, "env");
+    if (noDefaultModel !== undefined)
+        throw new Error(noDefaultModel);
     const endpointRefusal = modelRouteEndpointRefusal(config);
     if (endpointRefusal !== undefined)
         throw new Error(endpointRefusal);
@@ -241,8 +329,8 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const ungatedCompensation = buildOnlySensitiveBaselineWarning(config, {
-        durableEnabled: false,
-        singleUserAutoAcceptBaseline: config.requirePrincipal !== true && !hasOperatorGateIntent(config),
+        approvalSeat: RUN_LOCAL_APPROVAL_SEAT.kind,
+        singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
     if (ungatedCompensation)
         logger.warn(ungatedCompensation.event, ungatedCompensation.fields);
@@ -285,7 +373,7 @@ export async function runLocal(argv, deps = {}) {
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
-    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) }) : undefined;
+    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager(config, (event, fields) => logger.info(event, fields)) : undefined;
     const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     let memorySync;
     if (config.memorySync && memoryEngine) {
@@ -416,7 +504,10 @@ export async function runLocal(argv, deps = {}) {
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled
-            ? { loadProjectMemory: makeLoadProjectMemory({ logger }), probeInstructionSources: makeProbeInstructionSources() }
+            ? {
+                loadProjectMemory: makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) }),
+                probeInstructionSources: makeProbeInstructionSources(),
+            }
             : {}),
     };
     const runner = new Runner(runnerDeps);
@@ -459,7 +550,14 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    const mention = parseModelMention(args.objective, Object.keys(config.models));
+    const mention = resolveTaskModel(undefined, args.objective, config.models, undefined, config.modelRefusals);
+    if (mention.unavailable !== undefined) {
+        const { requested, name, refusal } = mention.unavailable;
+        printErr(`cannot run: ${modelUnavailableMessage("@-mention", requested, name, refusal)}`);
+        void lspManager?.dispose();
+        await fileBackend.dispose();
+        return 2;
+    }
     const scope = args.user ?? "local";
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "discuss");
@@ -473,13 +571,13 @@ export async function runLocal(argv, deps = {}) {
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
     const spec = applyLocalGovernance({
-        objective: mention.cleanedText || args.objective,
+        objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",
         oneShot: true,
         principal: scope,
         ...(memoryEngine ? { memory: memorySpecForRequest(scope, memoryProjectKeyFor(config, scope, workspaceDir), undefined) } : {}),
-        model: mention.model ?? "default",
+        model: mention.model,
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
@@ -526,11 +624,14 @@ export async function runLocal(argv, deps = {}) {
         await fileBackend.dispose();
         return 1;
     }
+    const personStop = personStopOf(result);
     if (args.json) {
         print(JSON.stringify(result, null, 2));
     }
     else if (result.terminal.kind === "completed") {
         print(result.result);
+        if (personStop !== undefined)
+            printErr(buildPersonStopFooter(personStop, sessionId));
     }
     else {
         const plane = outwardPlane(result.terminal);
@@ -539,7 +640,7 @@ export async function runLocal(argv, deps = {}) {
             print(salvage);
         printErr(`task ${plane.status}${plane.errorCode ? ` (${plane.errorCode})` : ""}${plane.errorMessage ? `: ${plane.errorMessage}` : ""}`);
     }
-    if (result.terminal.kind !== "completed")
+    if (result.terminal.kind !== "completed" || personStop !== undefined)
         exitCode = 1;
     if (memorySync) {
         try {

package/dist/runs.js

@@ -1,4 +1,4 @@
-import { runWithVerification, runCascade, defaultTaskRegistry, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
+import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
@@ -12,7 +12,7 @@ import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { errorText as errText } from "./observability/err-text.js";
 import { LIVENESS_HEARTBEAT_MS } from "./config-invariants.js";
@@ -256,8 +256,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             const { type, ...rest } = frame;
             const f = frame;
             const write = append(type, rest);
-            if (f.type === "task_notification" && f.task_id)
-                notifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+            const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+            if (fKey !== undefined)
+                notifiedKeys.set(fKey, write.then(() => true, () => false));
             return write;
         }, completionDiagLog ? { route: "bg-run-start", connection: "durable-append", log: completionDiagLog } : undefined);
         const runBody = async () => {
@@ -285,7 +286,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
                     else if (legLive) {
-                        const key = taskNotificationStreamKey(n);
+                        const key = taskNotificationDedupKey(n);
                         if (notifiedKeys.get(key) === undefined) {
                             notifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                         }

package/dist/runtime-governance.d.ts

@@ -23,7 +23,7 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
@@ -142,13 +142,60 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  *    并不要求 always),之后运维把 autonomy 热改成 `ask`,那条老行会被标成治理出身 —— 五个前提要**同时**
  *    成立,且该行仍未决。
  * 根治要**在 mint 那一刻把出身写进行里**(core 的 `CheckpointGate` 属主面,不是本仓能单方面做的);
- * 在那之前这一位的定位是**分诊提示**,不是裁决输入 —— 它不参与任何门/CAS/resume 判定,消费端也只拿它
- * 渲染徽标。登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
+ * 在那之前这一位的定位是**分诊提示**,不参与任何门/CAS/resume 判定 —— 唯一的例外是**只收窄**的那一个读者:
+ * 耐久 `/decide` 腿的会话级 remember 可记性(NP-1,7.100.0,`tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 在那里两个失真方向的代价都不越过修前:在场向 ⇒ 一次 `remember:"session"` 只放行本次、不铸会话免询问(安全
+ * 方向,代价 = 下一次再问一遍);缺席向 ⇒ 照旧可记(= NP-1 之前的行为)。它从不**放宽**任何裁决。
+ * 登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
  */
 export declare function governanceMandatesShellGateAlways(governance: {
     autonomy?: Autonomy;
     manualModeShellGate?: "always" | "classify";
 }): boolean;
+/** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 {@link governanceMandatesShellGateAlways})。 */
+export interface GovernancePosture {
+    autonomy?: Autonomy;
+    manualModeShellGate?: "always" | "classify";
+}
+/**
+ * [ref]:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
+ *
+ *   行上的取证格 `gate.riskDescriptor.shellGateDoctrine === "always"`
+ *   ∧ 本部署的治理层本来就要求 always({@link governanceMandatesShellGateAlways},那里写着为什么单看行不够 ——
+ *     SUP 路由姿态同样产 `"always"`)
+ *
+ * 第一半:core 在 mint 这道门时把「当时活着的 doctrine」如实写进 `riskDescriptor.shellGateDoctrine`
+ * (2026-08-05 取证裁定;`prepare-task` 只在**被 shell 门铸**的 ask 上写它),所以持久行自己带着证据 ——
+ * park 腿天然跨副本、跨重启,活卡腿那张 ALS 标记表在这里结构上够不着。
+ * 第二半:把「有效档 always」收窄到「治理层是真成因」,否则一条 SUP 路由出来的门会被谎报成治理强制。
+ *
+ * ⚠️ 残留(双向失真的窄在场向 + 根治路径)与「只收窄」的那一个裁决读者,都登记在
+ * {@link governanceMandatesShellGateAlways} 的顶注,别在这里复述。
+ *
+ * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
+ * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ *
+ * 🔴 **单一属主,四个读者**(不在任何读面另写一份判据 —— 这一位恰恰是靠「行上取证 ∧ 部署姿态」的合取才不
+ * 谎报的,两份必漂):409 体的待批门材料(`http/active-run-conflict.ts`)、两条 durable 读面
+ * `GET /v1/approvals` / `/v1/approvals/stream` 的 `projectPendingForWire`([ref]②)、耐久 `/decide` 腿的
+ * remember 可记性(NP-1,经 `tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 住在本文件而不是 `http/active-run-conflict.ts` 的理由:它的另一半判据属主就在这里,而第四个读者
+ * (`tool-approval.ts`)从 `http/` 那侧值引会闭合一条 ESM 值环(`active-run-conflict` → `checkpoint-store-sql` →
+ * `tool-approval`),本文件是三者共同的叶。
+ *
+ * ⚠️ **askId 为什么不在这里**([ref] 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
+ * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
+ * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
+ * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
+ * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
+ * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
+ * 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
+ */
+export declare function governanceOriginOf(gate: {
+    riskDescriptor?: {
+        shellGateDoctrine?: ShellGateDoctrine;
+    };
+} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** spec 序里的秩(0 起,越大越严)。入参收 `string`(fail-loud 边界:schema `trustRank` 同款姿势)——词表外 ⇒
  *  RangeError,绝不 undefined/NaN 让比较静默成 false。导出只为对表钉(test/safety-merge-spec-consumption.test.ts,
  *  [ref] 件4)——运行时消费仍走上表(键类型闭集)。 */

package/dist/runtime-governance.js

@@ -116,6 +116,11 @@ export function autonomyOverrides(autonomy) {
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }
+export function governanceOriginOf(gate, governance) {
+    if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
+        return undefined;
+    return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
+}
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");

package/dist/sealed-key.d.ts

@@ -23,8 +23,11 @@ export interface SealedKeyStore extends SealedKeyOpener {
         createdAt: string;
     };
 }
-/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). */
-export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "unsupported_alg" | "no_key_store";
+/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). CUSTODY failures only:
+ *  a sealedApiKey that is malformed (alg other than the pinned v1 SEALED_KEY_ALG, non-base64 ciphertext) makes the whole
+ *  catalog entry unavailable instead (S-704 `config.model_entry_invalid`, settings-schema `SealedApiKey` is the shape
+ *  owner) — the former `unsupported_alg` reason was retired with that move (it could no longer be reached). */
+export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
 /**
  * Poison-pill entry for the per-model key map (`config.modelApiKeys`): planted by applyEffective when
  * a model CARRIES `sealedApiKey` but the ciphertext cannot be unsealed. We deliberately do NOT drop

package/dist/server-secret-env.d.ts

@@ -11,12 +11,28 @@
  * ## 规则(一句)
  * 本仓**知道**哪些 env 键是凭据 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,
  * 不手抄第二份名单 —— 这些键按名剥;其余照旧交 core 按形剥。{@link scrubServerSecrets} = 目录派生剥除 ∘ core
- * `scrubSecretEnv`,两条腿都只调它。core 形状规则的缺口由 core 源头修(另案);本层不改 core 的判据,也不自造
- * 第二份形状规则。目录里加一个 secret 型键,两条腿当场就剥它。
+ * `scrubSecretEnv`,本仓三条子进程腿(host shell / git 子进程 / 本地语言服务器,后者见 `host-lsp-manager.ts`)都只调它。
+ * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 已补 `KEYS|TOKENS|PASSWORDS`(S-616 提货),目录臂独担的只剩
+ * `OTEL_EXPORTER_OTLP_HEADERS`(`*_HEADERS` 不在形状规则射程,是边界不是缺陷票)与三只名单型旋钮 `LSP_ENV_ALLOW`(S-699)/
+ * `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(S-713):原文可能夹着一枚被错展开进来的令牌,按凭据类登记 —— 形状规则按名判,本来就不该
+ * 认它们)。本层不改 core 的判据,也不自造
+ * 第二份形状规则。目录里加一个 secret 型键,三条腿当场就剥它。
  *
  * ## 不变的面
  * `inheritEnv:"all"`(显式全继承)与显式 allowlist 两形不经本函数,行为逐字不变;调用方显式传入的 env
  * (`cfg.env` / 单次命令的 `env`)照旧原样覆盖在剥除结果之上。
+ *
+ * ## 点名放行(S-699 / S-713,一只谓词三处用)
+ * {@link allowlistedEnv} 是本仓「一张名单点到哪些 env 键,就把它们从源 env **原样**交给子进程」的唯一实现。三处调用:
+ * host shell 的 `inheritEnv:[names]`(`plugins/remote-env-host.ts`)、本地语言服务器的 `LSP_ENV_ALLOW`(`host-lsp-manager.ts`)、
+ * 沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(`config.ts`,S-713 起;此前那里是第三份自写的循环)。三只名单型
+ * 旋钮的**名单**另由 `config.ts` 的同一只解析器 `parseEnvNameAllowlist` 判形(形错拒启 / 源里没有的名按序号 warn),本函数只管取值。
+ * 「点名」在三处同义:点到的键原样带值(空串值照带),密钥形也照过(点名 = 部署方显式承担);源里没有的名不产生条目。
+ * 沙箱两腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
+ * host shell 与语言服务器**只在没点到的键上**不同,这是有意保留的差别:host shell 的 `string[]` 形是 hermetic 白名单(与 core
+ * `NodeExecutionEnv` 同名选项同义,没点到的一律不继承);语言服务器在 {@link scrubServerSecrets} 的结果之上放回点名键
+ * (没点到的照缺省剥,`PATH` / `HOME` 这类非密钥键照常在 —— hermetic 形会让语言服务器当场找不到自己的工具链)。
+ * 两处都不放宽对方:把 host shell 改成「剥后放回」= 在模型可驱动的 shell 上放宽,把语言服务器改成 hermetic = 功能当场失灵。
  */
 import { type SecretEnvFinding } from "@sema-agent/core";
 /** 目录派生臂的一条剥除记录(形同 core 的 `SecretEnvFinding`:键名 / 规则 / 置信度 / 来源;值永不携带)。
@@ -38,4 +54,12 @@ export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
  * 目录臂的计数恰好就是 core 形状规则的缺口读数。
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
+/**
+ * S-699 —— **点名放行**的唯一谓词:从 `env` 里把 `names` 点到的键**原样**取出(值逐字,空串照带;源里没有的名不产生
+ * 条目)。密钥形的键点到了也照取 —— 点名即部署方显式承担;要不要在这之上再叠别的基底,是调用方的事(见文件头「点名放行」节)。
+ * 纯函数,不留痕:点名放回的键不是剥除,不进 `secret_env_scrubbed` 的键表与计数。
+ * 返回形 `Record<string, string>`(S-713):只装源里在的键,值恒是字符串 —— 沙箱两腿(`sandboxEnv` / docker `env`)要的正是这个形,
+ * 不必在调用点再过滤一遍 `undefined`。
+ */
+export declare function allowlistedEnv(names: readonly string[], env: NodeJS.ProcessEnv): Record<string, string>;
 //# sourceMappingURL=server-secret-env.d.ts.map

package/dist/server-secret-env.js

@@ -15,4 +15,13 @@ export function scrubServerSecrets(env, findings) {
     }
     return out;
 }
+export function allowlistedEnv(names, env) {
+    const out = {};
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined)
+            out[name] = value;
+    }
+    return out;
+}
 //# sourceMappingURL=server-secret-env.js.map

package/dist/task-settings.d.ts

@@ -264,7 +264,7 @@ export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
  *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
- *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明