@sema-agent/settings-schema 14.6.0 → 14.8.0

package/dist/safety-merge-spec.d.ts

@@ -92,8 +92,8 @@ export declare const MIN_TRUST_WORDS: readonly ["local", "session", "project", "
 export declare const MinTrust: z.ZodEnum<{
     local: "local";
     session: "session";
-    project: "project";
     global: "global";
+    project: "project";
     managed: "managed";
     task: "task";
 }>;
@@ -151,8 +151,8 @@ export declare const MemberAdmission: z.ZodObject<{
     minTrust: z.ZodOptional<z.ZodEnum<{
         local: "local";
         session: "session";
-        project: "project";
         global: "global";
+        project: "project";
         managed: "managed";
         task: "task";
     }>>;
@@ -161,8 +161,8 @@ export declare const MemberAdmission: z.ZodObject<{
         minTrust: z.ZodEnum<{
             local: "local";
             session: "session";
-            project: "project";
             global: "global";
+            project: "project";
             managed: "managed";
             task: "task";
         }>;
@@ -264,8 +264,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
     minTrust: z.ZodEnum<{
         local: "local";
         session: "session";
-        project: "project";
         global: "global";
+        project: "project";
         managed: "managed";
         task: "task";
     }>;
@@ -314,8 +314,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
         minTrust: z.ZodOptional<z.ZodEnum<{
             local: "local";
             session: "session";
-            project: "project";
             global: "global";
+            project: "project";
             managed: "managed";
             task: "task";
         }>>;
@@ -324,8 +324,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
             minTrust: z.ZodEnum<{
                 local: "local";
                 session: "session";
-                project: "project";
                 global: "global";
+                project: "project";
                 managed: "managed";
                 task: "task";
             }>;

package/dist/safety-merge-spec.js

@@ -66,8 +66,8 @@
  */
 import { z } from "zod";
 import { MAX_HASH_DEPTH, stableStringify } from "./hash.js";
-import { captureStringArray, dataDescriptor } from "./definition-copy.js";
-import { isJsonArray, isPlainJsonObject } from "./plain-json-object.js";
+import { captureStringArray, dataDescriptor, isAccessorDescriptor, isolatedObject } from "./own-key-read.js";
+import { jsonShapeOf } from "./plain-json-object.js";
 /** How values from different layers/principals combine for a category. */
 export const MergeShape = z.enum(["denyFirst", "replace", "runAll", "overrideByName", "concat"]);
 /** The trust-tier VOCABULARY as a RUNTIME VALUE — the ONE source of the ladder's words, in the same form as
@@ -183,10 +183,11 @@ function orderVerdict(diff) {
     return diff > 0 ? "stricter" : diff < 0 ? "looser" : "equal";
 }
 /** A string list as a set (order and duplicates do not count); `undefined` when the value is not an array of strings
- *  — a sparse array, an accessor that throws, a proxy that cannot be read (revoked, a trap that throws) is not one: all through the package's one string-array
- *  reading ({@link captureStringArray}), so the comparator never throws on them and never splits a string. */
+ *  — a sparse array, an accessor or non-enumerable element (the verdict is about the caller's own value: an accessor is not a stored value, it may answer
+ *  differently on the next read — the `none` rule's domain says the same; no getter is called), a proxy that cannot be read (revoked, a trap that throws) is not one:
+ *  all through the package's one string-array reading, strict ({@link captureStringArray}), so the comparator never throws on them and never splits a string. */
 function stringSetOf(v) {
-    const list = captureStringArray(v);
+    const list = captureStringArray(v, "strict");
     return list === undefined ? undefined : new Set(list);
 }
 /** `superset ⇒ stricter` for setUnion, the mirror for setNarrower. */
@@ -213,45 +214,57 @@ const NOT_STRICT_JSON = { ok: false };
 function strictJsonCopy(v, depth = 0) {
     if (depth > MAX_HASH_DEPTH)
         return NOT_STRICT_JSON;
-    if (v === null || typeof v === "string" || typeof v === "boolean")
-        return { ok: true, value: v };
-    if (typeof v === "number")
-        return Number.isFinite(v) ? { ok: true, value: v } : NOT_STRICT_JSON;
-    if (typeof v !== "object")
-        return NOT_STRICT_JSON; // undefined / function / symbol / bigint
-    if (isJsonArray(v)) {
-        const length = v.length;
-        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
-            return NOT_STRICT_JSON;
-        const out = [];
-        for (let i = 0; i < length; i++) {
-            const member = strictJsonStored(Object.getOwnPropertyDescriptor(v, i), depth);
-            if (!member.ok)
+    const shape = jsonShapeOf(v); // the shape is asked ONCE, of the seat (total): no `typeof` split, no second prototype read
+    switch (shape) {
+        case "null":
+            return { ok: true, value: v };
+        case "primitive":
+            if (typeof v === "string" || typeof v === "boolean")
+                return { ok: true, value: v };
+            return typeof v === "number" && Number.isFinite(v) ? { ok: true, value: v } : NOT_STRICT_JSON; // undefined / symbol / bigint / NaN / ±Infinity
+        case "array": {
+            const array = v;
+            const length = array.length;
+            if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0)
                 return NOT_STRICT_JSON;
-            Object.defineProperty(out, i, dataDescriptor(member.value));
+            const out = [];
+            for (let i = 0; i < length; i++) {
+                const member = strictJsonStored(Object.getOwnPropertyDescriptor(array, i), depth);
+                if (!member.ok)
+                    return NOT_STRICT_JSON;
+                Object.defineProperty(out, i, dataDescriptor(member.value));
+            }
+            return { ok: true, value: out };
         }
-        return { ok: true, value: out };
-    }
-    if (!isPlainJsonObject(v))
-        return NOT_STRICT_JSON; // Date / Map / class instance
-    const out = Object.create(null);
-    for (const key of Reflect.ownKeys(v)) {
-        if (typeof key === "symbol")
-            continue; // never serialized
-        const desc = Object.getOwnPropertyDescriptor(v, key);
-        if (desc !== undefined && desc.enumerable !== true)
-            continue; // never serialized (what `Object.keys` leaves out)
-        const member = strictJsonStored(desc, depth);
-        if (!member.ok)
+        case "plain": {
+            const record = v;
+            const out = isolatedObject();
+            for (const key of Reflect.ownKeys(record)) {
+                if (typeof key === "symbol")
+                    continue; // never serialized
+                const desc = Object.getOwnPropertyDescriptor(record, key);
+                if (desc !== undefined && desc.enumerable !== true)
+                    continue; // never serialized (what `Object.keys` leaves out)
+                const member = strictJsonStored(desc, depth);
+                if (!member.ok)
+                    return NOT_STRICT_JSON;
+                Object.defineProperty(out, key, dataDescriptor(member.value));
+            }
+            return { ok: true, value: out };
+        }
+        case "non_plain_object": // function / Date / Map / class instance
+        case "uninspectable": // a proxy that cannot be inspected: outside the domain
             return NOT_STRICT_JSON;
-        Object.defineProperty(out, key, dataDescriptor(member.value));
+        default: {
+            const unhandled = shape;
+            throw new Error(`strictJsonCopy: unhandled shape ${String(unhandled)}`);
+        }
     }
-    return { ok: true, value: out };
 }
 /** One member, judged by the descriptor read ONCE: a stored value (a hole has no descriptor; an accessor has no `value`) that is itself strict JSON. */
 function strictJsonStored(desc, depth) {
-    if (desc === undefined || !Object.hasOwn(desc, "value"))
-        return NOT_STRICT_JSON; // 描述符本身也只读自有键:`Object.prototype.value` 被污染时访问器描述符不会「有 value」
+    if (desc === undefined || isAccessorDescriptor(desc))
+        return NOT_STRICT_JSON; // 访问器不是存着的值(描述符的字段只认自有的,见内核)
     return strictJsonCopy(desc.value, depth + 1);
 }
 /** `none`: compares the DESCRIPTOR VIEW, read once ({@link strictJsonCopy}), and serializes only the copies — member values never go through `[[Get]]`. The ONE guard around the

package/dist/sandbox-git.d.ts

@@ -0,0 +1,64 @@
+/**
+ * 沙箱 git 平面的 **origin 形** 与 **有效配置块 `sandboxGit`**(14.7.0)。纯、浏览器安全。
+ *
+ * ## 律(一条)
+ * **一个 origin 就是它自己的 WHATWG origin**:串等于 `new URL(串).origin`,且 scheme ∈ {http, https}。规范形 ——
+ * 小写 host、去缺省端口(https 的 443、http 的 80)、无尾斜杠、无 userinfo / 路径 / 查询 / 片段 —— 不是一张手写规则表,而是这一个等式的推论:
+ * 凡 WHATWG 会改写的串(大写、缺省端口、IPv4 简写、百分号编码的 host、串内制表符、前后空白、反斜杠……)都不等于自己的 origin,所以都不是规范形。
+ * 判官只有 {@link isSandboxGitOrigin} 一只;请求体的 `origins`、应答行的 `origin`、有效配置块的 `origin` 全读它(经 {@link SandboxGitOrigin})。
+ * 「这个串是不是 http(s) URL」归包内唯一的 URL 形判官 `httpUrlFlaws`(`./url-shape`),本模块只加「等于自己的 origin」这一格。
+ * origin 不表达子路径部署(`https://host/gitea` 不是 origin)—— 规范化器不存在:把带路径的串静默削成 origin 会把凭据送到运维没写的地方。
+ *
+ * ## 有效配置块 `sandboxGit`
+ * `/effective` 载荷上的**非域顶层键**(web-admin 按部署登记册投影,不是存储域):可选、无默认 —— 缺席 = 这个部署没有投影这一块。
+ * `readEffectiveWire` 对它走 open-world 逐字承运(从不校验、从不丢,`EffectiveWire.sandboxGit` 是 `unknown`);**判它的座位只有 {@link SandboxGitConfig}**,由消费方在用之前判。
+ *
+ *  · `origins[i].origin` —— 本部署代理哪些 origin(规范形,见上);≤ {@link SANDBOX_GIT_MAX_ORIGINS} 项、两两不同。
+ *  · `origins[i].connectUrl` —— 控制台「连接 Gitea(git)」页的绝对 https URL(非秘密:{@link SandboxGitConnectUrl})。
+ *
+ * 🔴 **块里 http origin 可读**:它为什么送不出凭据(传输不加密)是逐 origin 应答里的一个词(`insecure_transport`,`./api/credentials` 的判定序表第 1 行)
+ * 与能力读数里的一个词,不是块的校验拒。块若因一个 http origin 整块不可读,同块里的 https origin 一并失效,「逐 origin 说拒因」就无从谈起;
+ * http origin 只配路由、永不取值,是消费方的事。
+ *
+ * 解析剥未知键(与 `SessionMirrorPolicy` 同律:加字段恒为加性)。
+ */
+import { z } from "zod";
+/** 一次最多代理的 origin 数(请求体、应答、有效配置块同一个上界)。 */
+export declare const SANDBOX_GIT_MAX_ORIGINS = 16;
+/**
+ * 判:`raw` 是不是规范形的 http(s) origin。合格 ⇔ 它是层级式 http(s) URL 且**逐字等于**自己的 WHATWG origin。
+ * 纯函数、不抛;非串由 {@link SandboxGitOrigin} 的 zod 形先拒。
+ */
+export declare function isSandboxGitOrigin(raw: string): boolean;
+/** 一个规范形的 origin(`scheme://host[:port]`,scheme ∈ {http, https})。判官 {@link isSandboxGitOrigin};拒句是定句,不回显值。 */
+export declare const SandboxGitOrigin: z.ZodString;
+export type SandboxGitOrigin = z.infer<typeof SandboxGitOrigin>;
+/**
+ * 一张 origin 表:每项是规范形、两两不同、至多 {@link SANDBOX_GIT_MAX_ORIGINS} 项。**空表合法**(有效配置块可以没有 origin);要求至少一项的座位(申领请求)自己 `.min(1)`。
+ * 重复的那一项被点名(坐标 = 第二次出现的下标)。
+ */
+export declare const SandboxGitOriginList: z.ZodArray<z.ZodString>;
+export type SandboxGitOriginList = z.infer<typeof SandboxGitOriginList>;
+/**
+ * 控制台「连接 Gitea(git)」页的绝对 URL:**https**,且是 {@link NON_SECRET_URL_NO_MIGRATION} 那一类(层级式 URL、无 userinfo、无片段、路径与查询里没有秘密形的值)。
+ * 它是 wire 输入,不是存量文档里的值,所以走「无迁移指路」那一只。
+ */
+export declare const SandboxGitConnectUrl: z.ZodString;
+export type SandboxGitConnectUrl = z.infer<typeof SandboxGitConnectUrl>;
+/** 有效配置块里的一个 origin 条目。 */
+export declare const SandboxGitOriginEntry: z.ZodObject<{
+    origin: z.ZodString;
+    connectUrl: z.ZodString;
+}, z.core.$strip>;
+export type SandboxGitOriginEntry = z.infer<typeof SandboxGitOriginEntry>;
+/**
+ * 有效配置块 `sandboxGit`(`/effective` 载荷的非域顶层键,可选、无默认)。判它的**唯一座位**:消费方在用之前对 `wire.sandboxGit` 跑 `safeParse`。
+ * `origins` ≤ {@link SANDBOX_GIT_MAX_ORIGINS} 项,按 `origin` 两两不同(重复的那一项的 `origin` 字段被点名);空表合法。
+ */
+export declare const SandboxGitConfig: z.ZodObject<{
+    origins: z.ZodArray<z.ZodObject<{
+        origin: z.ZodString;
+        connectUrl: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SandboxGitConfig = z.infer<typeof SandboxGitConfig>;

package/dist/sandbox-git.js

@@ -0,0 +1,89 @@
+/**
+ * 沙箱 git 平面的 **origin 形** 与 **有效配置块 `sandboxGit`**(14.7.0)。纯、浏览器安全。
+ *
+ * ## 律(一条)
+ * **一个 origin 就是它自己的 WHATWG origin**:串等于 `new URL(串).origin`,且 scheme ∈ {http, https}。规范形 ——
+ * 小写 host、去缺省端口(https 的 443、http 的 80)、无尾斜杠、无 userinfo / 路径 / 查询 / 片段 —— 不是一张手写规则表,而是这一个等式的推论:
+ * 凡 WHATWG 会改写的串(大写、缺省端口、IPv4 简写、百分号编码的 host、串内制表符、前后空白、反斜杠……)都不等于自己的 origin,所以都不是规范形。
+ * 判官只有 {@link isSandboxGitOrigin} 一只;请求体的 `origins`、应答行的 `origin`、有效配置块的 `origin` 全读它(经 {@link SandboxGitOrigin})。
+ * 「这个串是不是 http(s) URL」归包内唯一的 URL 形判官 `httpUrlFlaws`(`./url-shape`),本模块只加「等于自己的 origin」这一格。
+ * origin 不表达子路径部署(`https://host/gitea` 不是 origin)—— 规范化器不存在:把带路径的串静默削成 origin 会把凭据送到运维没写的地方。
+ *
+ * ## 有效配置块 `sandboxGit`
+ * `/effective` 载荷上的**非域顶层键**(web-admin 按部署登记册投影,不是存储域):可选、无默认 —— 缺席 = 这个部署没有投影这一块。
+ * `readEffectiveWire` 对它走 open-world 逐字承运(从不校验、从不丢,`EffectiveWire.sandboxGit` 是 `unknown`);**判它的座位只有 {@link SandboxGitConfig}**,由消费方在用之前判。
+ *
+ *  · `origins[i].origin` —— 本部署代理哪些 origin(规范形,见上);≤ {@link SANDBOX_GIT_MAX_ORIGINS} 项、两两不同。
+ *  · `origins[i].connectUrl` —— 控制台「连接 Gitea(git)」页的绝对 https URL(非秘密:{@link SandboxGitConnectUrl})。
+ *
+ * 🔴 **块里 http origin 可读**:它为什么送不出凭据(传输不加密)是逐 origin 应答里的一个词(`insecure_transport`,`./api/credentials` 的判定序表第 1 行)
+ * 与能力读数里的一个词,不是块的校验拒。块若因一个 http origin 整块不可读,同块里的 https origin 一并失效,「逐 origin 说拒因」就无从谈起;
+ * http origin 只配路由、永不取值,是消费方的事。
+ *
+ * 解析剥未知键(与 `SessionMirrorPolicy` 同律:加字段恒为加性)。
+ */
+import { z } from "zod";
+import { buildQuotedIssue } from "./quoted-issue.js";
+import { NON_SECRET_URL_NO_MIGRATION } from "./types.js";
+import { httpUrlFlaws } from "./url-shape.js";
+/** 一次最多代理的 origin 数(请求体、应答、有效配置块同一个上界)。 */
+export const SANDBOX_GIT_MAX_ORIGINS = 16;
+/**
+ * 判:`raw` 是不是规范形的 http(s) origin。合格 ⇔ 它是层级式 http(s) URL 且**逐字等于**自己的 WHATWG origin。
+ * 纯函数、不抛;非串由 {@link SandboxGitOrigin} 的 zod 形先拒。
+ */
+export function isSandboxGitOrigin(raw) {
+    if (httpUrlFlaws(raw, []).length > 0)
+        return false;
+    return new URL(raw).origin === raw;
+}
+/** 一个规范形的 origin(`scheme://host[:port]`,scheme ∈ {http, https})。判官 {@link isSandboxGitOrigin};拒句是定句,不回显值。 */
+export const SandboxGitOrigin = z
+    .string()
+    .refine(isSandboxGitOrigin, buildQuotedIssue `must be a canonical http(s) origin — scheme://host[:port] equal to its own WHATWG origin: lowercase host, no default port, no userinfo, path, query, fragment or trailing slash`);
+/** 给定下标的 origin 在它之前已经出现过 ⇒ 下标。重复判在**规范形**之上(两个都是规范形的串,相等即同一个 origin)。 */
+function repeatedAt(origins) {
+    const seen = new Set();
+    const repeats = [];
+    origins.forEach((o, i) => {
+        if (seen.has(o))
+            repeats.push(i);
+        seen.add(o);
+    });
+    return repeats;
+}
+/**
+ * 一张 origin 表:每项是规范形、两两不同、至多 {@link SANDBOX_GIT_MAX_ORIGINS} 项。**空表合法**(有效配置块可以没有 origin);要求至少一项的座位(申领请求)自己 `.min(1)`。
+ * 重复的那一项被点名(坐标 = 第二次出现的下标)。
+ */
+export const SandboxGitOriginList = z
+    .array(SandboxGitOrigin)
+    .max(SANDBOX_GIT_MAX_ORIGINS)
+    .superRefine((origins, ctx) => {
+    for (const i of repeatedAt(origins))
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate origin`, path: [i] });
+});
+/**
+ * 控制台「连接 Gitea(git)」页的绝对 URL:**https**,且是 {@link NON_SECRET_URL_NO_MIGRATION} 那一类(层级式 URL、无 userinfo、无片段、路径与查询里没有秘密形的值)。
+ * 它是 wire 输入,不是存量文档里的值,所以走「无迁移指路」那一只。
+ */
+export const SandboxGitConnectUrl = NON_SECRET_URL_NO_MIGRATION.refine((u) => URL.canParse(u) && new URL(u).protocol === "https:", buildQuotedIssue `must be an https URL — the connect page is opened by a person and carries their session`);
+/** 有效配置块里的一个 origin 条目。 */
+export const SandboxGitOriginEntry = z.object({
+    /** 本部署代理的 origin(规范形)。http 在这里可读(见模块头注)。 */
+    origin: SandboxGitOrigin,
+    /** 该 origin 的「连接」页,绝对 https URL。 */
+    connectUrl: SandboxGitConnectUrl,
+});
+/**
+ * 有效配置块 `sandboxGit`(`/effective` 载荷的非域顶层键,可选、无默认)。判它的**唯一座位**:消费方在用之前对 `wire.sandboxGit` 跑 `safeParse`。
+ * `origins` ≤ {@link SANDBOX_GIT_MAX_ORIGINS} 项,按 `origin` 两两不同(重复的那一项的 `origin` 字段被点名);空表合法。
+ */
+export const SandboxGitConfig = z
+    .object({
+    origins: z.array(SandboxGitOriginEntry).max(SANDBOX_GIT_MAX_ORIGINS),
+})
+    .superRefine((block, ctx) => {
+    for (const i of repeatedAt(block.origins.map((e) => e.origin)))
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate origin`, path: ["origins", i, "origin"] });
+});

package/dist/scheduler-store.js

@@ -1,22 +1,30 @@
-import { isPlainJsonObject } from './plain-json-object.js';
+import { ownDeclaredValueOf } from './own-key-read.js';
+import { isJsonArray, isPlainJsonObject } from './plain-json-object.js';
 import { isSessionLifetime } from './scheduler-lifetime.js';
 import { migrateSchedulerRecords } from './scheduler-store-migration.js';
 /** Structural validation of one record (required fields + a well-formed `when`). Unknown fields are allowed. */
 export function isSchedulerRecord(v) {
     if (!isPlainJsonObject(v))
         return false;
-    const r = v;
-    if (typeof r.id !== 'string' || typeof r.scope !== 'string' || typeof r.prompt !== 'string' || typeof r.createdMs !== 'number')
+    // a type guard, so every field is read STRICTLY from the record's own keys (own, enumerable, data — the kernel's `ownDeclaredValueOf`): an inherited field is absent
+    // (a polluted `Object.prototype.prompt` is not a prompt the record carries); an accessor / hidden field, or one that cannot be read ⇒ not a record — no getter is called,
+    // so what the caller reads from the record next is what was judged
+    const field = (o, key) => {
+        const read = ownDeclaredValueOf(o, key);
+        return read.ok ? read.value : undefined;
+    };
+    if (typeof field(v, 'id') !== 'string' || typeof field(v, 'scope') !== 'string' || typeof field(v, 'prompt') !== 'string' || typeof field(v, 'createdMs') !== 'number')
         return false;
-    const w = r.when;
+    const w = field(v, 'when');
     if (!isPlainJsonObject(w))
         return false;
-    if (w.kind === 'cron')
-        return typeof w.expr === 'string';
-    if (w.kind === 'at')
-        return typeof w.atMs === 'number';
-    if (w.kind === 'delay')
-        return typeof w.delaySec === 'number';
+    const kind = field(w, 'kind');
+    if (kind === 'cron')
+        return typeof field(w, 'expr') === 'string';
+    if (kind === 'at')
+        return typeof field(w, 'atMs') === 'number';
+    if (kind === 'delay')
+        return typeof field(w, 'delaySec') === 'number';
     return false;
 }
 /** 一条会话链上的记录过期多久算「永驻孤儿」:`lifetime: "session"` ∧ `sessionId` 在场 ∧ `nextRunMs` 已过去这么久 ⇒ 读口丢弃并告警(7 天)。 */
@@ -38,7 +46,7 @@ export function parseSchedulerStore(text, opts) {
     catch {
         return { records: [], warnings: [{ kind: 'unreadable-file', why: 'not-json' }] };
     }
-    if (!Array.isArray(parsed))
+    if (!isJsonArray(parsed))
         return { records: [], warnings: [{ kind: 'unreadable-file', why: 'not-an-array' }] };
     const warnings = [];
     const kept = [];

package/dist/settings-units.js

@@ -42,6 +42,7 @@
  * the engine's env catalog, whose one implementation is the server's.
  */
 import { classifyHooksConfig } from "./hooks-config.js";
+import { captureJson, captureStringArray, ownEntriesOf } from "./own-key-read.js";
 import { isPlainJsonObject } from "./plain-json-object.js";
 import { SAFETY_MERGE_SPEC, resolveMemberTighten, tightenVerdict } from "./safety-merge-spec.js";
 /** The settings-document units (see the file header). `path` is the unit's place in a settings document. */
@@ -98,20 +99,17 @@ const UNREADABLE = { ok: false, reason: "unreadable" };
 const LAUNCH_ONLY = { ok: false, reason: "launch_only" };
 /** `stringList`: an array whose every element is a non-empty string (a hole reads as `undefined`, so a sparse array is not one). */
 function isNonEmptyStringList(v) {
-    if (!Array.isArray(v))
-        return false;
-    for (let i = 0; i < v.length; i++) {
-        const x = v[i];
-        if (typeof x !== "string" || x.length === 0)
-            return false;
-    }
-    return true;
+    const list = captureStringArray(v, "strict"); // the package's one string-array reading, strict: the value is handed back as is, so an accessor / hidden index ⇒ not a list (no getter is called)
+    return list !== undefined && list.every((x) => x.length > 0);
 }
-/** `envMap`: a plain object (prototype `Object.prototype` or `null`), non-empty keys, string values. */
+/** `envMap`: a plain object (prototype `Object.prototype` or `null`), non-empty keys, string values. The value is handed back AS IS, so its members are read strictly —
+ *  the package's one whole-container read, strict (`ownEntriesOf`: one `ownKeys`, each own string key's descriptor asked once — symbol keys never; never `[[Get]]`, never a
+ *  proxy's `get` trap): an accessor member or a non-enumerable member ⇒ not an env map (no getter is called — what the caller reads next is what was judged); unreadable ⇒ not one. */
 function isEnvMap(v) {
     if (!isPlainJsonObject(v))
         return false;
-    return Object.keys(v).every((k) => k.length > 0 && typeof v[k] === "string");
+    const members = ownEntriesOf(v);
+    return members.ok && members.value.every(([k, x]) => k.length > 0 && typeof x === "string");
 }
 /** What a declared member's value class adds on top of its comparator's domain — read through the comparator
  *  {@link resolveMemberTighten} derived from the row, so the seat is interpreted in one place: `list` ⇒ setUnion / setNarrower,
@@ -144,8 +142,12 @@ function shapedReading(unit, row, rule, raw) {
         case "killSwitch":
             // CC spells ON "disable"; the boolean itself is the member comparator's domain
             return { ok: true, value: raw === "disable" ? true : raw };
-        case "hooks":
-            return classifyHooksConfig({ hooks: raw }).outcome === "loaded" ? { ok: true, value: raw } : UNREADABLE;
+        case "hooks": {
+            // the value is handed back AS IS, so it is read strictly (as every unit is): the whole tree is snapshotted by the kernel's strict whole-container read first —
+            // an accessor anywhere or a non-enumerable member ⇒ not readable (no getter is called) — and the classifier judges the snapshot, not the caller's object
+            const snapshot = captureJson(raw);
+            return snapshot.ok && classifyHooksConfig({ hooks: snapshot.value }).outcome === "loaded" ? { ok: true, value: raw } : UNREADABLE;
+        }
         case "envMap":
             return isEnvMap(raw) ? { ok: true, value: raw } : UNREADABLE;
         case "nonEmptyString":

package/dist/tier-words.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 档位词(纯、零 I/O、浏览器安全;**包内叶子模块,不出包**):引擎的档序与 CC 档位别名、从某档起向低档的梯,与「一个目录词在档位展开之后落到哪条条目」。
+ * 本包里档位词的唯一一处:default 角色的档梯(`./default-model`)与写者计划助手的落点(`./env-model-table`)都从这里取。
+ * 镜像 core(`DEFAULT_TIER_ORDER` / `CC_MODEL_TIER_ALIASES` / `expandTiers`):`test/tier-words-parity-14.8.0` 对 devDependency 里精确钉住的那一版 core 对拍。
+ */
+/** 引擎的档序(高 → 低)。 */
+export declare const TIER_ORDER: readonly ["ultra", "max", "pro", "flash", "lite"];
+/** 一个档位词。 */
+export type TierWord = (typeof TIER_ORDER)[number];
+/** CC 档位词 → 引擎档位。 */
+export declare const CC_TIER_ALIASES: {
+    readonly fable: "max";
+    readonly mythos: "max";
+    readonly opus: "pro";
+    readonly sonnet: "flash";
+    readonly haiku: "lite";
+};
+/** 档序里从 `S` 起(含)向低档的那一段,字面元组型。 */
+type LadderFrom<S extends TierWord, T extends readonly TierWord[] = typeof TIER_ORDER> = T extends readonly [infer H, ...infer R extends readonly TierWord[]] ? H extends S ? Readonly<T> : LadderFrom<S, R> : readonly [];
+/** 一档的梯:档序里从它起(含)向低档的那一段(没绑的档沿它往下落)。 */
+export declare function tierLadderFrom<S extends TierWord>(tier: S): LadderFrom<S>;
+/**
+ * 一个目录词(条目名 / 档位词 / CC 档位别名 / `best`)在**档位展开之后**落到哪条目录条目名 —— 与引擎装配档位表的两步同答:
+ * 先摘掉活跃组里绑定目标不可服务的档(引擎的生效装配在交给 core 之前做这一步,并 warn 点名),再按 core `expandTiers` 展开
+ * (对拍 devDependency 那一版 core 的「摘后表」)。所以这里只有一条绑定规则:**一档的绑定只在它点名一条可服务条目时算数**,否则当作没绑。展开规则:
+ *  · 目录自己的键先赢(`has(word)`;一条就叫 `flash` 的条目遮住档位词);
+ *  · 档位词 ⇒ 它的梯({@link tierLadderFrom})上第一个有绑定的档;摘完没有任何绑定 ⇒ 只认目录键;
+ *  · CC 档位别名 ⇒ 经它对应的档位;`best` ⇒ 档序里第一个有绑定的档;别的词 ⇒ 落不到。
+ * `has` = 调用方的「这个名是目录里一条可服务(启用)的条目」;`tiers` = `resolveActiveTiers` 的读数(原表,未摘)—— 它的键只有五个档位词
+ * (档位组的绑定表在 schema 里只收这五个键,别的键被剥掉),所以只按档位词读表。
+ */
+export declare function landCatalogWord(word: string, has: (name: string) => boolean, tiers: Readonly<Partial<Record<TierWord, string>>> | undefined): string | undefined;
+export {};

package/dist/tier-words.js

@@ -0,0 +1,43 @@
+/**
+ * 档位词(纯、零 I/O、浏览器安全;**包内叶子模块,不出包**):引擎的档序与 CC 档位别名、从某档起向低档的梯,与「一个目录词在档位展开之后落到哪条条目」。
+ * 本包里档位词的唯一一处:default 角色的档梯(`./default-model`)与写者计划助手的落点(`./env-model-table`)都从这里取。
+ * 镜像 core(`DEFAULT_TIER_ORDER` / `CC_MODEL_TIER_ALIASES` / `expandTiers`):`test/tier-words-parity-14.8.0` 对 devDependency 里精确钉住的那一版 core 对拍。
+ */
+/** 引擎的档序(高 → 低)。 */
+export const TIER_ORDER = ["ultra", "max", "pro", "flash", "lite"];
+/** CC 档位词 → 引擎档位。 */
+export const CC_TIER_ALIASES = { fable: "max", mythos: "max", opus: "pro", sonnet: "flash", haiku: "lite" };
+/** 一档的梯:档序里从它起(含)向低档的那一段(没绑的档沿它往下落)。 */
+export function tierLadderFrom(tier) {
+    return TIER_ORDER.slice(TIER_ORDER.indexOf(tier));
+}
+const isTierWord = (word) => TIER_ORDER.includes(word);
+/**
+ * 一个目录词(条目名 / 档位词 / CC 档位别名 / `best`)在**档位展开之后**落到哪条目录条目名 —— 与引擎装配档位表的两步同答:
+ * 先摘掉活跃组里绑定目标不可服务的档(引擎的生效装配在交给 core 之前做这一步,并 warn 点名),再按 core `expandTiers` 展开
+ * (对拍 devDependency 那一版 core 的「摘后表」)。所以这里只有一条绑定规则:**一档的绑定只在它点名一条可服务条目时算数**,否则当作没绑。展开规则:
+ *  · 目录自己的键先赢(`has(word)`;一条就叫 `flash` 的条目遮住档位词);
+ *  · 档位词 ⇒ 它的梯({@link tierLadderFrom})上第一个有绑定的档;摘完没有任何绑定 ⇒ 只认目录键;
+ *  · CC 档位别名 ⇒ 经它对应的档位;`best` ⇒ 档序里第一个有绑定的档;别的词 ⇒ 落不到。
+ * `has` = 调用方的「这个名是目录里一条可服务(启用)的条目」;`tiers` = `resolveActiveTiers` 的读数(原表,未摘)—— 它的键只有五个档位词
+ * (档位组的绑定表在 schema 里只收这五个键,别的键被剥掉),所以只按档位词读表。
+ */
+export function landCatalogWord(word, has, tiers) {
+    if (has(word))
+        return word;
+    if (tiers === undefined)
+        return undefined;
+    /** 一档的绑定:只在它点名一条可服务条目时算数(否则引擎已摘掉它)。 */
+    const bound = (tier) => {
+        const target = Object.hasOwn(tiers, tier) ? tiers[tier] : undefined;
+        return target !== undefined && has(target) ? target : undefined;
+    };
+    const firstBound = (ladder) => ladder.map(bound).find((landed) => landed !== undefined);
+    if (isTierWord(word))
+        return firstBound(tierLadderFrom(word));
+    if (Object.hasOwn(CC_TIER_ALIASES, word))
+        return firstBound(tierLadderFrom(CC_TIER_ALIASES[word]));
+    if (word === "best")
+        return firstBound(TIER_ORDER);
+    return undefined;
+}

package/dist/types.d.ts

@@ -1830,11 +1830,11 @@ export interface SkillsManifest {
  *  legal hash scheme. */
 export declare const SkillsManifestSchema: z.ZodObject<{
     skills: z.ZodPrefault<z.ZodArray<z.ZodObject<{
+        description: z.ZodDefault<z.ZodString>;
         name: z.ZodString;
         enabled: z.ZodDefault<z.ZodBoolean>;
         notes: z.ZodOptional<z.ZodString>;
         rosters: z.ZodPrefault<z.ZodArray<z.ZodString>>;
-        description: z.ZodDefault<z.ZodString>;
         scenarios: z.ZodPrefault<z.ZodArray<z.ZodString>>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1885,6 +1885,8 @@ export declare const McpServerSpec: z.ZodObject<{
         local: "local";
         execution: "execution";
     }>>;
+    sessionMetaKey: z.ZodOptional<z.ZodUnknown>;
+    startupTimeoutMs: z.ZodOptional<z.ZodUnknown>;
     source: z.ZodOptional<z.ZodUnknown>;
     toolFaces: z.ZodOptional<z.ZodUnknown>;
     toolAxes: z.ZodOptional<z.ZodUnknown>;
@@ -1918,6 +1920,8 @@ export declare const McpConfig: z.ZodObject<{
             local: "local";
             execution: "execution";
         }>>;
+        sessionMetaKey: z.ZodOptional<z.ZodUnknown>;
+        startupTimeoutMs: z.ZodOptional<z.ZodUnknown>;
         source: z.ZodOptional<z.ZodUnknown>;
         toolFaces: z.ZodOptional<z.ZodUnknown>;
         toolAxes: z.ZodOptional<z.ZodUnknown>;
@@ -2520,6 +2524,8 @@ export declare const DOMAIN_SCHEMAS: {
                 local: "local";
                 execution: "execution";
             }>>;
+            sessionMetaKey: z.ZodOptional<z.ZodUnknown>;
+            startupTimeoutMs: z.ZodOptional<z.ZodUnknown>;
             source: z.ZodOptional<z.ZodUnknown>;
             toolFaces: z.ZodOptional<z.ZodUnknown>;
             toolAxes: z.ZodOptional<z.ZodUnknown>;
@@ -3219,10 +3225,14 @@ export type EffectiveKey = z.infer<typeof EffectiveKey>;
  *  `prompts` is the second wire divergence: on the wire it is {@link EffectivePromptsWire} (`{schemaVersion: 2, artifact}` — the one
  *  artifact {@link promptArtifactFor} selected for the pulling worker, stamped with its publish provenance), carried verbatim by the
  *  read leg and judged by the consumer (that shape, then the engine's verify) — optional (absent = nothing published, or the publish
- *  gate is closed), never the storage shape. */
+ *  gate is closed), never the storage shape.
+ *  `sandboxGit` (14.7.0) is the third wire-only key and the third carried verbatim: the sandbox git plane's origin block — web-admin projects it from the
+ *  deployment's registry, it is NOT a stored domain, so `buildEffective` never produces it and `readEffectiveWire` neither validates nor drops it. Optional with
+ *  no default (absent = the deployment projects no such block); the ONE seat that judges it is `SandboxGitConfig` (`./sandbox-git`), run by the consumer before use. */
 export type EffectiveWire = Omit<EffectiveConfig, "skills" | "prompts"> & {
     skills: SkillsManifest;
     prompts?: unknown;
+    sandboxGit?: unknown;
 };
 /** Reserved audit "domain" for RBAC/user-management events (not a config domain → no snapshot, not
  *  rollback-able). Lets user changes share the one audit stream the Audit page already renders. */