@sema-agent/server 2.0.1 → 3.1.0

package/dist/http/server.js

@@ -281,7 +281,7 @@ export function createHttpServer(rawDeps) {
             // 4xx, not a 500. Everything else is a genuine internal error: log the cause, never echo it (info disclosure).
             if (err instanceof HttpError) {
                 if (!res.headersSent)
-                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
+                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
                 else
                     res.end();
                 return;
@@ -1091,7 +1091,7 @@ export function createHttpServer(rawDeps) {
             if (err instanceof HttpError) {
                 // Typed rejection: echo the stable `code` + any structured extras (e.g. the scenario
                 // allowlist) beside the human message — machine code on the wire, prose stays with the shell/web.
-                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
+                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
                 return null;
             }
             throw err;
@@ -1181,6 +1181,27 @@ export function createHttpServer(rawDeps) {
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        // 🔴 GATE-KIND GUARD ([1995]①,`gate_not_resumable` / `gate_not_plan_review` 的**反方向镜像**):这条腿
+        // 只解 TOOL 审批门(core gateMatch:`human` / `irreversible_ask` ↔ outcome.gate "policy_ask")。此前它无
+        // 条件铸 outcome{gate:"policy_ask"} 交给 core —— 一个 plan_review / resource_limit / task_done park 被误
+        // 路由到 /decide(而 /v1/approvals 把它们与工具审批**混在同一个队列**里、toolName 同为 null)就会深入到
+        // core 的 `checkpoint.gate_mismatch`。那是 core 的 **pre-CAS** 拒绝(checkpoint 仍 pending),但 server 的
+        // CheckpointError 分类表把 gate_mismatch 归为 TERMINAL ⇒ 行被 setTerminal 成 failed + 释放 task_active,
+        // 于是「行说这活死了、park 却还活着」:claim 泄漏(同 session 可并发起第二个 run)、事后用正确的腿救能
+        // 200 真跑完却拿不到 taskId、run 行永停 failed(账本与现实分叉)。这里 pre-CAS 纯拒绝:不动 checkpoint、
+        // 不动 run 行、不烧模型腿,与另外两条腿的守卫同姿势(core 的 gate-match 仍是 fail-closed 兜底)。
+        // ⚠️ 门放在 parked 赎回腿**之前**:赎回腿同样只铸 policy_ask outcome,错门 cp 在那条链上只会更深地炸。
+        // D-D SLA deny-sweep 不受影响:它的取行查询本就只选 gate_kind IN ('human','irreversible_ask')。
+        const decideGateKind = cp.gate?.kind;
+        if (decideGateKind !== "human" && decideGateKind !== "irreversible_ask") {
+            return {
+                status: 409,
+                body: {
+                    error: `task is suspended on a '${decideGateKind ?? "unknown"}' gate, not a tool approval — a plan_review gate is resolved via POST /v1/assistant/tasks/:id/plan_review, a resource_limit suspension via POST /v1/assistant/tasks/:id/resume`,
+                    errorCode: "gate_not_tool_approval",
+                },
+            };
+        }
         // design/153 件3d parked 赎回腿([1574]/[1584]/[1588] core 裁定;src/parked-decide.ts):该 pending
         // checkpoint 若属于一个 parked 后台子代,decide 必须走 claim→裸 execute(reviveClaim) 链——legacy 腿的
         // resumeStream 会绕开 bg registry(无 consumeParkedFlip、行永 parked、生命周期分叉),故 parked-first。
@@ -1243,7 +1264,7 @@ export function createHttpServer(rawDeps) {
             if (e instanceof HttpError) {
                 return {
                     status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, code: "resume_blocked_by_policy", errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
                 };
             }
             throw e;
@@ -1871,7 +1892,6 @@ export function createHttpServer(rawDeps) {
                     status,
                     body: {
                         error: e.message,
-                        code: e.code,
                         // invalid_outcome means DIFFERENT things per gate: for policy_ask it IS the D-1 action-binding
                         // mismatch; for plan_review/dry_run_review it is a content-sanitize reject (editedPlan/reason carried a
                         // forbidden tag) — give those a gate-appropriate code so the UI routes to the right recovery, not the
@@ -2210,7 +2230,7 @@ export function createHttpServer(rawDeps) {
         res.setHeader("retry-after", String(adm.retryAfterSec));
         // E4 定稿:429 带 typed code + center 结构化字段 verbatim 透传(windowType/remaining/resetAt/
         // isEstimate/pool)——人话文案归壳/web(契约如此),error 串保留旧消费者兼容。
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { code: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
     /** Apply the per-principal rate limit; responds 429 and returns true when the caller is over. */

package/dist/http/sse-log.js

@@ -55,7 +55,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         if (Date.now() - start > MAX_MS) {
             // BL-16: cap reached but the run continues — emit a terminal reconnect signal (not a silent close, which
             // a client couldn't distinguish from a completed run). Distinct from the `failed`/`done` run events.
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {

package/dist/main.js

@@ -237,7 +237,7 @@ async function main() {
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
             redact: redactSecrets, // audit 2026-07-13: scrub a model-echoed secret before persist/list/log
-            llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs }),
+            llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs, model: o.model }),
             logger,
             metrics,
         })

package/dist/model-select.d.ts

@@ -10,7 +10,7 @@
  * untrusted body/text can pick WHICH configured model but can never inject a baseUrl/apiKey (parseModelMention
  * only ever returns an allow-listed catalog name).
  *
- * [865]②(clay 生产实锤:onboard 选 kimi 实跑 Qwen):
+ * [865]②(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个):
  *  - explicit ref 走 name+id 双键索引({@link matchCatalogModel})——壳 boot 回读的 mainLoopModel 是 **id 形**,
  *    目录键是 **name 形**,单键索引把 id 形请求当「未知」静默落 default = session 中途静默换模型(最恶性的
  *    上下文污染路径)。

package/dist/model-select.js

@@ -11,7 +11,7 @@ import { parseModelMention } from "@sema-agent/core";
  * untrusted body/text can pick WHICH configured model but can never inject a baseUrl/apiKey (parseModelMention
  * only ever returns an allow-listed catalog name).
  *
- * [865]②(clay 生产实锤:onboard 选 kimi 实跑 Qwen):
+ * [865]②(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个):
  *  - explicit ref 走 name+id 双键索引({@link matchCatalogModel})——壳 boot 回读的 mainLoopModel 是 **id 形**,
  *    目录键是 **name 形**,单键索引把 id 形请求当「未知」静默落 default = session 中途静默换模型(最恶性的
  *    上下文污染路径)。

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type Checkpoint, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointGate, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor } from "@sema-agent/core";
 import { type SqlDriver } from "./sql-driver.js";
 /**
  * design/80 D-1 (§3 invariant #3 — crash-safe reaper backstop): an ABSOLUTE upper bound on a pending
@@ -38,10 +38,18 @@ export interface PendingCheckpoint {
      *  resume binds to the EXACT action they saw (a stale view is then rejected fail-closed PRE-CAS). `boundCallId`
      *  === `toolCallId` (the pending tool call); `boundInputHash` is the server-minted opaque hash of the shown
      *  input (NEVER recomputed by the portal — echoed verbatim). Surfacing them here is what makes the D-1 TOCTOU
-     *  guard REACHABLE by the portal (without it the portal can only do the unbound legacy fallback). `null` on a
-     *  pre-D-1 / legacy-deserialized checkpoint ⇒ the consumer falls back to the unbound resolve. */
-    boundCallId: string | null;
-    boundInputHash: string | null;
+     *  guard REACHABLE by the portal (without it the portal can only do the unbound legacy fallback).
+     *  🔴 [1995]②: ABSENT (key omitted, never `null`) on a park with no tool action (plan_review /
+     *  resource_limit / task_done) or a pre-D-1 legacy row ⇒ the consumer falls back to the unbound resolve.
+     *  The wire contract (§1) is "an absent nullable field is OMITTED, not null" — a `null` here invited a
+     *  consumer to treat the key's PRESENCE as "there is a binding" and echo `null` back into /decide. */
+    boundCallId?: string;
+    boundInputHash?: string;
+    /** 🔴 [1995]③ (additive): the checkpoint's gate kind — the operator queue mixes tool approvals with
+     *  plan_review / resource_limit / task_done parks (all of which carry `toolName: null`), so a durable-recovery
+     *  consumer needs this to ROUTE a row to the right wire (`/decide` vs `/plan_review` vs `/resume`). Absent
+     *  only for a legacy SQL row suspended before the `gate_kind` column existed. */
+    gateKind?: CheckpointGate["kind"];
     /** The suspended run's taskId (task_active join) — the key to the run/trace ("view task context"). */
     taskId: string | null;
     /** The pending tool call's args (post-hook), redacted + bounded — for tool_approval the write payload, for a

package/dist/plugins/checkpoint-store-sql.js

@@ -305,13 +305,15 @@ export class SqlCheckpointStore {
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */
     async listPending(scope) {
-        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, ta.task_id " +
+        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, c.gate_kind, ta.task_id " +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at ASC`, [scope])
             : await this.db.query(`${base} ORDER BY c.created_at ASC`);
         const out = rows.map((r) => {
             const toolCallId = r.tool_call_id ?? null;
+            const boundInputHash = r.bound_input_hash ?? null;
+            const gateKind = r.gate_kind ?? null;
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
@@ -319,8 +321,13 @@ export class SqlCheckpointStore {
                 toolCallId,
                 // D-1: boundCallId === the pending tool call id; boundInputHash is the server-minted opaque hash. The
                 // portal echoes BOTH on /decide so the resume binds to the exact action shown (TOCTOU guard reachable).
-                boundCallId: toolCallId,
-                boundInputHash: r.bound_input_hash ?? null,
+                // [1995]②: a park with no tool action (plan_review / resource_limit / task_done — both columns NULL)
+                // OMITS the keys entirely; the wire contract says absent, never `null` (LOCAL twin does the same).
+                ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
+                ...(boundInputHash !== null ? { boundInputHash } : {}),
+                // [1995]③ additive: the gate kind the row is parked on (NULL only on a pre-`gate_kind` legacy row) —
+                // lets a durable-recovery consumer route plan / tool / resource off this ONE queue.
+                ...(gateKind !== null ? { gateKind } : {}),
                 taskId: r.task_id ?? null,
                 // Both drivers return the JSON column already parsed; null for pre-migration rows. PG 库内恒干净
                 // (拒绝式)——直读即审阅面=执行面。

package/dist/plugins/local-checkpoint-store.js

@@ -192,8 +192,14 @@ export class LocalCheckpointStore {
                 scope: cp.scope,
                 toolName: pa?.toolName ?? null,
                 toolCallId,
-                boundCallId: toolCallId,
-                boundInputHash: pa?.boundInputHash ?? null,
+                // [1995]②: the D-1 binding fields are OMITTED when the park has no tool action (plan_review /
+                // resource_limit / task_done) — the wire contract says an absent nullable field is ABSENT, not `null`
+                // (a consumer branching on "key present ⇒ there is a binding" would echo `null` back into /decide).
+                ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
+                ...(pa?.boundInputHash !== undefined ? { boundInputHash: pa.boundInputHash } : {}),
+                // [1995]③ additive: which gate this row is parked on, so a durable-recovery consumer can route
+                // plan / tool / resource off the SAME queue (toolName is null for every non-tool gate).
+                ...(gate?.kind !== undefined ? { gateKind: gate.kind } : {}),
                 taskId: (await this.opts.getActiveTaskId?.(cp.sessionId)) ?? null,
                 input: boundedToolInput(pa?.args),
                 createdAt: cp.createdAt,

package/dist/plugins/remote-env-host.d.ts

@@ -43,7 +43,8 @@ export interface HostEnvConfig {
      *  reports `supported:false` → INERT (no scheduler tools). Injected at boot only on the single-user host lane. */
     scheduler?: SchedulerCapability;
     /** design/103 background shell: `false` → INERT (multi-tenant host lane gate). Default (undefined) = on for the
-     *  single-user TOC host lane. `HOST_BG_ENABLED=false` is an additional global kill switch(旧名 HOST_BG_DISABLED=true 兼容期内仍认)。 */
+     *  single-user TOC host lane. `HOST_BG_ENABLED=false` is an additional global kill switch(🪦 旧名
+     *  `HOST_BG_DISABLED` 自 server 3.0.0 起是 fail-loud 墓碑:设了即拒启并指路新名,不再被读取)。 */
     backgroundShell?: boolean;
 }
 export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, SchedulerCapability, BackgroundShellCapability {
@@ -279,22 +280,40 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
  * `ctx.sessionId` into the workspace dir id so two concurrent tasks never share a working directory.
  */
 export declare function hostExecutionEnvFactory(config?: HostEnvConfig): ExecutionEnvFactory;
-export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-/** Config for the (not-yet-implemented) `remote-docker` provider: run each task in a container on a REMOTE
- *  docker daemon (e.g. over a TLS docker endpoint). Fast-follow per DUAL-MODE-DESIGN §5. */
-export interface RemoteDockerEnvConfig {
-    /** Container image to run the task in. */
-    image: string;
-    /** Workspace mount path inside the container. */
-    mountPath?: string;
-    /** Remote docker daemon endpoint (e.g. tcp://host:2376 or ssh://user@host). Required for remote-docker. */
+export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, type LocalDockerEnvDeps, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
+import { type LocalDockerEnvConfig, type LocalDockerEnvDeps } from "./remote-env-local-docker.js";
+/**
+ * Config for the `remote-docker` provider: run each task in a container on a REMOTE docker daemon
+ * (DUAL-MODE-DESIGN §5 — "a user-specified REMOTE host's docker"; registry-core `RemoteExecSpec`).
+ *
+ * It is {@link LocalDockerEnvConfig} with the endpoint made REQUIRED — that is the whole difference, by design:
+ * the container adapter is already daemon-agnostic (workspace `mkdir`'d INSIDE the container, never a host
+ * bind-mount; bytes over `docker cp` / `docker exec cat`, which stream through the daemon API), and the endpoint
+ * rides as `-H <dockerHost>` on every invocation. So every local-docker knob (memory/cpus/pidsLimit/dropAllCaps/
+ * network/timeouts/env/dockerPath) applies unchanged to the remote lane.
+ */
+export interface RemoteDockerEnvConfig extends Omit<LocalDockerEnvConfig, "dockerHost" | "providerLabel"> {
+    /** Remote docker daemon endpoint (e.g. `tcp://host:2376` or `ssh://user@host`). REQUIRED for remote-docker. */
     dockerHost: string;
-    /** Out-of-band env injected into the container (secrets resolved by the control plane). */
-    env?: Record<string, string>;
 }
 /**
- * `remote-docker` factory entry point — wired but an explicit TODO (DUAL-MODE-DESIGN §5 fast-follow). Throws
- * at factory-BUILD time so selecting it before it exists fails loud rather than degrading isolation silently.
+ * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
+ * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
+ * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
+ *
+ * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
+ * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
+ * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
+ * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
+ * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
+ * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
+ * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
+ * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
+ * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
+ * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
+ *
+ * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
+ * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
  */
-export declare function remoteDockerExecutionEnvFactory(_config: RemoteDockerEnvConfig): ExecutionEnvFactory;
+export declare function remoteDockerExecutionEnvFactory(config: RemoteDockerEnvConfig, deps?: LocalDockerEnvDeps): ExecutionEnvFactory;
 //# sourceMappingURL=remote-env-host.d.ts.map

package/dist/plugins/remote-env-host.js

@@ -28,8 +28,9 @@
  * (`{ ok:true, exitCode }`), never an error.
  *
  * Platforms: macOS + Linux (POSIX shell). Forward-compatible with the `remoteExec` superset: this file also
- * scaffolds the `local-docker` / `remote-docker` providers' factory entry points (typed stubs that throw a
- * clear "not yet implemented" — explicit fast-follow per DUAL-MODE-DESIGN §5; NOT faked green).
+ * hosts the `local-docker` / `remote-docker` providers' factory entry points — both now IMPLEMENTED by the
+ * container adapter in remote-env-local-docker.ts (the two providers differ only in whether the `-H` daemon
+ * endpoint is off-box and required), re-exported/wrapped here so the discriminator has one canonical site.
  */
 import { spawn } from "node:child_process";
 import os from "node:os";
@@ -1647,19 +1648,38 @@ export function hostExecutionEnvFactory(config = {}) {
 // ─────────────────────────────── remoteExec superset: docker providers ───────────────────────────────
 //
 // DUAL-MODE-DESIGN §5 defines a `remoteExec.provider` superset. `host` (above) is implemented; `local-docker`
-// is NOW IMPLEMENTED (the isolation lane) — it lives in its own module (remote-env-local-docker.ts) and is
-// re-exported here so the discriminator entry point + the historical import site stay stable. `remote-docker`
-// (a REMOTE docker daemon over TLS/SSH) is still an explicit fast-follow stub — it throws a clear "not yet
-// implemented" so selecting it fails loud at wiring time instead of silently degrading isolation. NOT faked green.
+// (the isolation lane) and `remote-docker` (that same container lane aimed at a REMOTE daemon) are BOTH
+// implemented by remote-env-local-docker.ts and re-exported / wrapped here so the discriminator entry points +
+// the historical import sites stay stable.
 // `local-docker` (the isolation lane): real implementation moved to remote-env-local-docker.ts. Re-export the
 // factory + config from here so existing wiring (`import { localDockerExecutionEnvFactory } from "./remote-env-host"`)
 // keeps working and the provider discriminator has one canonical entry point.
 export { localDockerExecutionEnvFactory, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
+import { localDockerExecutionEnvFactory } from "./remote-env-local-docker.js";
 /**
- * `remote-docker` factory entry point — wired but an explicit TODO (DUAL-MODE-DESIGN §5 fast-follow). Throws
- * at factory-BUILD time so selecting it before it exists fails loud rather than degrading isolation silently.
+ * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
+ * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
+ * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
+ *
+ * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
+ * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
+ * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
+ * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
+ * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
+ * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
+ * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
+ * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
+ * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
+ * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
+ *
+ * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
+ * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
  */
-export function remoteDockerExecutionEnvFactory(_config) {
-    throw new RemoteExecutionError("unsupported", "remoteExec provider 'remote-docker' is not yet implemented (DUAL-MODE-DESIGN §5 fast-follow) — use 'host', 'local-docker', or 'e2b' until it ships");
+export function remoteDockerExecutionEnvFactory(config, deps = {}) {
+    const dockerHost = config.dockerHost?.trim();
+    if (!dockerHost) {
+        throw new RemoteExecutionError("connect_failed", "remoteExec provider 'remote-docker' requires a non-empty dockerHost (the remote daemon endpoint, e.g. tcp://host:2376 or ssh://user@host) — use provider 'local-docker' for THIS machine's daemon");
+    }
+    return localDockerExecutionEnvFactory({ ...config, dockerHost, providerLabel: "remote-docker" }, deps);
 }
 //# sourceMappingURL=remote-env-host.js.map

package/dist/plugins/remote-env-local-docker.d.ts

@@ -17,8 +17,20 @@ export interface LocalDockerEnvConfig {
     /**
      * DOCKER_HOST override for the docker CLI (e.g. a non-default socket). Passed as `-H <value>` on EVERY docker
      * invocation (not the process env) so it can't leak / drift. Absent = the daemon DOCKER_HOST points at.
+     *
+     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is exactly the DUAL-MODE-DESIGN §5
+     * **`remote-docker`** provider — see {@link remoteDockerExecutionEnvFactory} (remote-env-host.ts), which is
+     * this adapter with the endpoint required. Nothing else about the class is host-local: the workspace is
+     * `mkdir`'d INSIDE the container (never a bind-mount of a host path) and bytes move by `docker cp` /
+     * `docker exec cat`, which stream over the daemon API.
      */
     dockerHost?: string;
+    /**
+     * Provider NAME reported on the {@link WorkspaceHandle}. Default `"local-docker"`; the `remote-docker` arm
+     * passes `"remote-docker"` so a handle never mislabels which lane it is (the CLASS is shared — `remote-docker`
+     * IS this adapter aimed at a remote daemon). Cosmetic/observability only: it selects no behavior.
+     */
+    providerLabel?: string;
     /** Container memory limit (docker `--memory`, e.g. "2g"). Absent = no limit. */
     memory?: string;
     /** Container CPU limit (docker `--cpus`, e.g. 1.5). Absent = no limit. */
@@ -65,6 +77,8 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     private readonly spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     private readonly containerName;
+    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
+    private readonly providerName;
     /** Set once the container is up + the workspace dir created. */
     private containerId?;
     private handle?;

package/dist/plugins/remote-env-local-docker.js

@@ -66,6 +66,8 @@ export class RemoteLocalDockerExecutionEnv {
     spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     containerName;
+    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
+    providerName;
     /** Set once the container is up + the workspace dir created. */
     containerId;
     handle;
@@ -92,6 +94,7 @@ export class RemoteLocalDockerExecutionEnv {
         const id = config.id ?? randomBytes(6).toString("hex");
         const suffix = randomBytes(4).toString("hex"); // always-unique tail so a reused id never collides
         this.containerName = `sema-docker-${sanitizeId(id)}-${suffix}`;
+        this.providerName = config.providerLabel?.trim() || PROVIDER;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
@@ -165,7 +168,7 @@ export class RemoteLocalDockerExecutionEnv {
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env destroyed during connect") };
         }
         this.containerId = run.value.stdout.trim() || this.containerName;
-        this.handle = { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+        this.handle = { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
         if (config?.secrets?.length) {
             // Secrets are injected per-command via cfg.env (resolved by the control plane), not at connect — record only.
         }
@@ -197,7 +200,7 @@ export class RemoteLocalDockerExecutionEnv {
             // re-run `docker run --name <same>` → name conflict → the failure path rm -f's the very container we just
             // re-attached to (destroying the running workspace). The name IS our exec/handle target.
             this.containerId = this.containerName;
-            this.handle ??= { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+            this.handle ??= { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
             return ok(this.handle);
         }
         return { ok: false, error: new RemoteExecutionError("connect_failed", `container '${this.containerName}' is not running (gone or stopped) — no managed snapshot to resume`) };
@@ -609,7 +612,11 @@ export class RemoteLocalDockerExecutionEnv {
             return;
         this.containerShellProbed = true;
         try {
-            const r = await this.docker(this.withHostFlag(["exec", this.containerName, "/bin/sh", "-c", "command -v bash"]), { timeoutMs: this.cfg.controlTimeoutMs });
+            // 🔴 NO withHostFlag here — `docker()` already prepends it. A second `-H` is not a harmless repeat: the
+            // docker CLI rejects the whole command (`invalid argument … specify only one -H`), so on every
+            // REMOTE-daemon container (`dockerHost` set — always, on the `remote-docker` arm) the probe used to fail
+            // and silently degrade the user shell to /bin/sh for a reason unrelated to the image.
+            const r = await this.docker(["exec", this.containerName, "/bin/sh", "-c", "command -v bash"], { timeoutMs: this.cfg.controlTimeoutMs });
             if (r.ok && r.value.exitCode === 0 && r.value.stdout.trim().length > 0)
                 this.containerShell = "bash";
         }

package/dist/plugins/run-store-sql.d.ts

@@ -126,9 +126,14 @@ export declare class SqlRunStore {
      * suspend, an INTENTIONAL durable pause" (design/76 §2.5) — the service MUST park it the same way, else the run is
      * terminalized + its lock released and the plan_review/dry_run_review resume can never run (it gets
      * taskId=undefined and drives the model unprotected on an unlocked session). CAS on `running`/`needs_review`
-     * (reaper-revert guard, mirrors setSuspended). 🔴 The store SQL here is exercised by mocked unit tests only — a
-     * real-TiDB integration test of the park→resume→claim invariant is a required-before-GA TODO (the lesson from the
-     * P2 lease-SQL + this needs_review-park bug: mocked tests hide store-SQL defects).
+     * (reaper-revert guard, mirrors setSuspended). The park→resume→claim invariant is pinned on BOTH REAL engines by
+     * `test/run-store-reaper-integration.test.ts` (`inv#1` row ownership across park→resume→handover, `inv#2` two
+     * replicas racing one session ⇒ exactly one claim wins, `inv#3`/`inv#3'` stale-claim takeover vs fresh/parked
+     * claims), closing the former required-before-GA gap. Keep it that way: the P2 lease-SQL bug and this
+     * needs_review-park bug were both born from store SQL that mocked unit tests pass — measured, not asserted, when
+     * the invariant set was built: an upserting (non-exclusive) claim reddened all four real-DB cases while all 111
+     * mocked run-store unit tests stayed green. A mock cannot observe a unique-key claim race, a rolled-back loser,
+     * or a multi-table reaper DELETE.
      */
     setNeedsReview(taskId: string): Promise<void>;
     /**

package/dist/plugins/run-store-sql.js

@@ -206,9 +206,14 @@ export class SqlRunStore {
      * suspend, an INTENTIONAL durable pause" (design/76 §2.5) — the service MUST park it the same way, else the run is
      * terminalized + its lock released and the plan_review/dry_run_review resume can never run (it gets
      * taskId=undefined and drives the model unprotected on an unlocked session). CAS on `running`/`needs_review`
-     * (reaper-revert guard, mirrors setSuspended). 🔴 The store SQL here is exercised by mocked unit tests only — a
-     * real-TiDB integration test of the park→resume→claim invariant is a required-before-GA TODO (the lesson from the
-     * P2 lease-SQL + this needs_review-park bug: mocked tests hide store-SQL defects).
+     * (reaper-revert guard, mirrors setSuspended). The park→resume→claim invariant is pinned on BOTH REAL engines by
+     * `test/run-store-reaper-integration.test.ts` (`inv#1` row ownership across park→resume→handover, `inv#2` two
+     * replicas racing one session ⇒ exactly one claim wins, `inv#3`/`inv#3'` stale-claim takeover vs fresh/parked
+     * claims), closing the former required-before-GA gap. Keep it that way: the P2 lease-SQL bug and this
+     * needs_review-park bug were both born from store SQL that mocked unit tests pass — measured, not asserted, when
+     * the invariant set was built: an upserting (non-exclusive) claim reddened all four real-DB cases while all 111
+     * mocked run-store unit tests stayed green. A mock cannot observe a unique-key claim race, a rolled-back loser,
+     * or a multi-table reaper DELETE.
      */
     async setNeedsReview(taskId) {
         await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', updated_at = $1 WHERE task_id = $2 AND status IN ('running','needs_review')"), [new Date(), taskId]);

package/dist/run-local.js

@@ -291,7 +291,8 @@ export async function runLocal(argv, deps = {}) {
     // TOC local LSP (core 1.190): run-local IS the pure-local host lane, so mount core's `NodeLspManager` (local
     // child_process language servers over stdio, CC `services/lsp` parity) on the host lane. Default ON (degrades
     // gracefully to grep/read if a server binary is absent); `LSP_HOST_ENABLED=false` opts out (design/158 B4 split
-    // this lane off `LSP_ENABLED`, which still works as a back-compat opt-out). `requirePrincipal !== true`
+    // this lane off `LSP_ENABLED`; 🪦 server 3.0.0 起 `LSP_ENABLED=false` 是 fail-loud 墓碑,拒启指路新名,
+    // 不再是可用的 opt-out)。`requirePrincipal !== true`
     // keeps it uniform with main.ts (a no-op here — run-local is single-user — but never relies on that). Both runners.
     const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) }) : undefined;
     // Long-term memory (design/138 S1): run-local IS the single-user lane, so the file-based memory ENGINE is

package/dist/sema-registry.d.ts

@@ -10,9 +10,23 @@
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
  *
  * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
- * core brain honors model.baseUrl, absent = "" = boot-env endpoint). TODO remaining: hot-reload
- * of models/roles needs Runner support — today teams hot-reload via the registry, while a models/roles
- * change is logged as "restart to apply".
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
  *
  * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
  * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /
@@ -21,7 +35,7 @@
  */
 export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
 export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
-export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSignal, } from "./config-center/restart-signal.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./config-center/restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
 export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./config-center/types.js";
 //# sourceMappingURL=sema-registry.d.ts.map

package/dist/sema-registry.js

@@ -10,9 +10,23 @@
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
  *
  * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
- * core brain honors model.baseUrl, absent = "" = boot-env endpoint). TODO remaining: hot-reload
- * of models/roles needs Runner support — today teams hot-reload via the registry, while a models/roles
- * change is logged as "restart to apply".
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
  *
  * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
  * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /

package/dist/session-titler.d.ts

@@ -29,6 +29,7 @@ export interface SessionTitlerDeps {
     llm(opts: {
         prompt: string;
         timeoutMs: number;
+        model?: string;
     }): Promise<{
         ok: true;
         text: string;
@@ -47,7 +48,8 @@ export interface SessionTitlerDeps {
 }
 export interface SessionTitler {
     /** Fire-and-forget: maybe generate + persist a title for this session. Never throws, never blocks the caller. */
-    maybeTitle(sessionId: string, objective: string): void;
+    /** `model`([1992]②)= 本 turn 真实驱动的模型——带上则标题 hook 同链路,不再裸落 env 缺省。 */
+    maybeTitle(sessionId: string, objective: string, model?: string): void;
 }
 export declare const TITLE_MAX_CHARS = 80;
 /** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */

package/dist/session-titler.js

@@ -65,7 +65,7 @@ export function createSessionTitler(deps) {
         deps.logger?.warn?.("session_title_failed", { ...meta, note: "同 cause 后续降为 debug 级" });
     };
     return {
-        maybeTitle(sessionId, objective) {
+        maybeTitle(sessionId, objective, model) {
             if (!sessionId || !objective.trim())
                 return;
             if (seen.has(sessionId))
@@ -93,7 +93,7 @@ export function createSessionTitler(deps) {
                     deps.metrics?.inc("session_title_total", { outcome: "already_titled" });
                     return;
                 }
-                const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS });
+                const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model });
                 if (!r.ok) {
                     deps.metrics?.inc("session_title_total", { outcome: "llm_failed" });
                     logFailure(sessionId, r.error);

package/dist/trace/project.js

@@ -510,7 +510,10 @@ export function mapTraceEvent(type, seq, data) {
         case "failed":
             // BL-13: redact at the read boundary too (defense-in-depth) — covers any errorMessage that reached the
             // log un-redacted via another write path; idempotent on the BL-12-redacted catch-path message.
-            return { event: "error", data: { code: "WORKER_DOWN", message: redactSecrets(String(data.errorMessage ?? "run failed")) } };
+            // A1/A6/B(复审 2026-07-29):error 帧统一为 `{ type:"error", errorCode, message }` —— 与 sse-log /
+            // approvals 的帧同形。这一处是 3.0.0 摘 legacy `code` 键时的漏网:帧在 src/trace/ 铸,而当时的门只扫
+            // src/http/,于是"SSE error 帧机器键统一为 errorCode"的公开声明与 wire 上跑的东西不一致(门是绿的)。
+            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactSecrets(String(data.errorMessage ?? "run failed")) } };
         default:
             return null; // compacted etc. — not a client trace event
     }