@sema-agent/server 3.19.0 → 3.21.0

package/dist/boot/stores.js

@@ -304,12 +304,14 @@ export async function openStores(ctx) {
         }
     }
     const sessionStore = createSessionStore(config, backend, metrics); // S25: stale-affinity evict fingerprint
-    // S6 startup guard: multi-tenant isolation needs an owner-aware (TiDB) store. Refuse to start with
-    // REQUIRE_PRINCIPAL on an in-memory store that can't enforce session ownership.
-    if (config.requirePrincipal && !sessionStore.ownerOf) {
-        throw new Error("REQUIRE_PRINCIPAL=true needs an owner-aware session store (SESSION_BACKEND=tidb); " +
-            "the in-memory store cannot enforce session ownership.");
-    }
+    // 🪦 S6 启动门(旧):判据曾是 `!sessionStore.ownerOf`,core 2.11.0 给 TtlSessionStore 补了 owner 面后**恒假**。
+    //    2026-08-01 复审一度把判据改成「归属能否跨重启存活」以复活它 —— **那是错的,已撤**(cli [C46] 的
+    //    多租真机围栏当场证伪:`REQUIRE_PRINCIPAL=true` + 内存店必须**起得来**且真隔离)。
+    //    错在威胁模型:内存店重启后**会话数据本身也没了**,"先到者认领 session id" 认领到的是空壳,
+    //    alice 的历史随进程消失 —— 归属丢失 ≠ 数据泄露。真正危险的是**数据留存而归属丢失**的 file 形,
+    //    那一形由下面那道 local 门拦住(它的论证里 "session/run CONTENT is durable there" 正是这个区别)。
+    //    ⇒ 这道门防的威胁(store 没有归属能力)已被 core 2.11.0 消除,补偿该撤,不该换个判据续命。
+    //    判据跟目的走、不跟补偿走(cli [C46] 的原话,我抄下)。反向钉见 test/security.test.ts。
     // The local in-memory backend HAS an ownerOf (LocalSessionStore), so the guard above passes — but its owner map is
     // process-local + lost on restart, so it cannot DURABLY enforce multi-tenant ownership (post-restart a session id is
     // re-claimable by whoever attaches first). Refuse REQUIRE_PRINCIPAL on it: a real multi-tenant

package/dist/capabilities/scenarios.d.ts

@@ -1,4 +1,4 @@
-import { type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
+import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
 import type { Metrics } from "../observability/metrics.js";
 import type { Logger } from "../observability/logger.js";
 import { GiteaClient } from "./repo-tools.js";
@@ -42,7 +42,7 @@ export interface ScenarioDeps {
      *  main.ts 构造一次注入)。在场 ⇒ 装配实参携 `webFetch.summarize`——带 prompt 的 WebFetch 走 cheap
      *  模型摘要而非整页灌上下文([1870] L1 的 ~660× 放大就是这缝);缺席 ⇒ `webFetch` 键不铸(修前
      *  字节形,core 落「summarization unavailable」诚实兜底)。 */
-    webFetchSummarize?: (content: string, prompt: string, signal?: AbortSignal) => Promise<string>;
+    webFetchSummarize?: NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
     metrics?: Metrics;
     logger?: Logger;
     /** OA backend coordinates for the `oa` scenario (read /api/v1, write /api/assets). */

package/dist/config.d.ts

@@ -11,6 +11,20 @@ export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat
  *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
+/** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
+ *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
+export declare function numEnv(name: string, fallback: string): number;
+/**
+ * 数值 env 的核心判据,**接受 raw 值**(而非自己去读 process.env),这样注入式配置也能复用同一条判据。
+ *
+ * 提出来的理由(2026-08-01 gap-sweep):`leader/wire.ts` 的四个资源旋钮各自手写了
+ * `Number(x) || default`,因为 numEnv 只会读 process.env、够不到它们注入进来的 env 对象。
+ * 结果是同一个失败模式在另一处复发,而且**回落方向更坏**:那边落到的是慷慨的默认值,
+ * 症状从「设了没生效」变成「想收紧却被松绑」。判据只有一份,谁都能调,才不会各写各的。
+ *
+ * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
+ */
+export declare function parseNumOrFail(name: string, raw: string | undefined): number;
 export declare function drainConfigWarnings(): Array<{
     env: string;
     raw: string;

package/dist/config.js

@@ -73,8 +73,22 @@ function env2(primary, alias, fallback) {
 }
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
-function numEnv(name, fallback) {
-    const raw = env(name, fallback);
+export function numEnv(name, fallback) {
+    return parseNumOrFail(name, env(name, fallback));
+}
+/**
+ * 数值 env 的核心判据,**接受 raw 值**(而非自己去读 process.env),这样注入式配置也能复用同一条判据。
+ *
+ * 提出来的理由(2026-08-01 gap-sweep):`leader/wire.ts` 的四个资源旋钮各自手写了
+ * `Number(x) || default`,因为 numEnv 只会读 process.env、够不到它们注入进来的 env 对象。
+ * 结果是同一个失败模式在另一处复发,而且**回落方向更坏**:那边落到的是慷慨的默认值,
+ * 症状从「设了没生效」变成「想收紧却被松绑」。判据只有一份,谁都能调,才不会各写各的。
+ *
+ * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
+ */
+export function parseNumOrFail(name, raw) {
+    if (raw === undefined)
+        return NaN;
     const n = Number(raw);
     if (!Number.isFinite(n))
         throw new Error(`env ${name}="${raw}" must be a number`);

package/dist/fleet/fleet-bus.d.ts

@@ -291,6 +291,8 @@ export declare class FleetEventBus {
     releaseBackgroundChildLane(scope: string | undefined, childUuid: string): void;
     /** run-leg 车道:该子代是否已有 BCE 真行(有 ⇒ 让位,不铸复合 id 行)。 */
     backgroundChildLaneRow(scope: string | undefined, childUuid: string): string | undefined;
+    /** [2268] 让位迁移料的读面:迁移「只补缺席位」需要看得见存活行现有什么(BCE 是权威车道,不覆盖)。 */
+    taskRow(id: string): Readonly<FleetTaskRow> | undefined;
     /** Upsert a workflow row (MERGE by `id`) + fan out. */
     publishWorkflow(delta: Partial<FleetWorkflowRow> & {
         id: string;

package/dist/fleet/fleet-bus.js

@@ -86,6 +86,10 @@ export class FleetEventBus {
     backgroundChildLaneRow(scope, childUuid) {
         return this.bceClaims.get(FleetEventBus.bceKey(scope, childUuid));
     }
+    /** [2268] 让位迁移料的读面:迁移「只补缺席位」需要看得见存活行现有什么(BCE 是权威车道,不覆盖)。 */
+    taskRow(id) {
+        return this.tasks.get(id);
+    }
     // └────────────────────────────────────────────────────────────────────────────────────────────────┘
     /** Upsert a workflow row (MERGE by `id`) + fan out. */
     publishWorkflow(delta) {
@@ -172,20 +176,43 @@ export function fleetRunPublisher(bus, run) {
      * registry ⇒ 永远没有 BCE 真行,让位就等于让这些 agent 从面板消失。那一形保留复合行,并在帧上带
      * `sourceLane:"run-leg"` 明示这是过渡形——消费端不必再自己发明集合级去重判据。
      */
-    const yieldToBackgroundChildLane = (childTaskId, cid) => {
-        if (bus.backgroundChildLaneRow(run.scope, childTaskId) === undefined)
+    const yieldToBackgroundChildLane = (childTaskId, cid, tickName) => {
+        const bceRowId = bus.backgroundChildLaneRow(run.scope, childTaskId);
+        if (bceRowId === undefined)
             return false;
         if (children.has(cid)) {
             // 我们早于 claim 铸过一行 —— 清场(BCE 侧的后缀扫是同一意图的反应式兜底,两者幂等叠加无害)
             bus.removeTask(cid);
             children.delete(cid);
-            childStartedAt.delete(cid);
+            // ⚠️ childStartedAt 故意不删 —— 它是下面 elapsed 供给的计时基准([2268])
             for (const [k, v] of childByToolCall)
                 if (v === cid)
                     childByToolCall.delete(k);
         }
+        // 🔴 [2268] 迁移料([2269] 认领「迁移」臂):此前让位=删「有名的 run-leg 行」留「无名的 BCE 行」
+        // ((unnamed)/0s/详情空白三症状同源)。tick 手上的显示料补给存活行,**只补缺席位** —— BCE 是权威
+        // 车道,它已有的 name/真 elapsed 一律不碰。elapsed 供给是持续的(本闸每拍都过),不是一次性冻结;
+        // elapsedDonor 记住「这行的 elapsed 是我们供的」,避免把 BCE 自己的真 elapsed 误当缺席重置。
+        // transcriptId 不在 run-leg tick 手上,迁不了(诚实范围;那半归 BCE 行自身后续 tick)。
+        const row = bus.taskRow(bceRowId);
+        if (row) {
+            const donorName = row.name === undefined && tickName !== undefined ? redactSecrets(tickName) : undefined;
+            if (!childStartedAt.has(cid))
+                childStartedAt.set(cid, Date.now());
+            if (elapsedDonor.has(cid) || row.elapsedMs === undefined || row.elapsedMs === 0)
+                elapsedDonor.add(cid);
+            const elapsed = elapsedDonor.has(cid) ? Date.now() - childStartedAt.get(cid) : undefined;
+            if (donorName !== undefined || elapsed !== undefined) {
+                bus.publishTask({
+                    id: bceRowId,
+                    ...(donorName !== undefined ? { name: donorName, agentType: donorName } : {}),
+                    ...(elapsed !== undefined ? { elapsedMs: elapsed } : {}),
+                });
+            }
+        }
         return true;
     };
+    const elapsedDonor = new Set(); // [2268] 我们在为哪些 cid 供 elapsed(见上)
     const sumTokens = (usage) => {
         const u = usage;
         if (!u)
@@ -219,8 +246,8 @@ export function fleetRunPublisher(bus, run) {
             else if (ev.type === "task_progress" && ev.taskId) {
                 // core 1.147 subagent usage tick (per-turn, cumulative) → a CHILD fleet row nested under the run.
                 const cid = childId(ev.taskId);
-                if (yieldToBackgroundChildLane(ev.taskId, cid))
-                    return; // [2070]① BCE 真行在场 ⇒ 让位不铸
+                if (yieldToBackgroundChildLane(ev.taskId, cid, ev.name))
+                    return; // [2070]① BCE 真行在场 ⇒ 让位不铸([2268] 随迁显示料)
                 children.add(cid);
                 // BC-2 (core 1.151): use the subagent's sanitized display `name` (taskName/agent-type) for the child row.
                 // [2070]③:name 缺席时**不铸**(此前回落 taskId=子代 uuid,人眼乱码)——行 IDENTITY 一直是 `cid`
@@ -273,8 +300,8 @@ export function fleetRunPublisher(bus, run) {
             if (ev.type !== "task_progress" || !ev.taskId)
                 return;
             const cid = childId(ev.taskId);
-            if (yieldToBackgroundChildLane(ev.taskId, cid))
-                return; // [2070]① BCE 真行在场 ⇒ 让位不铸
+            if (yieldToBackgroundChildLane(ev.taskId, cid, ev.name))
+                return; // [2070]① BCE 真行在场 ⇒ 让位不铸([2268] 随迁显示料)
             children.add(cid);
             const parentId = ev.parentTaskId && ev.parentTaskId !== run.rootTaskId ? childId(ev.parentTaskId) : run.runId;
             // [WF2-A] redact the forwarded subagent name for parity with the top-level run name (see onEvent above).

package/dist/http/active-run-conflict.d.ts

@@ -0,0 +1,68 @@
+/**
+ * [2252]/[2255]①/[2257] 追加件:409 `conflict.session_active_run` 的**真出路材料**装配(单源)。
+ *
+ * 事故形:park(suspended/needs_review)占着 session claim,客户端每条新提交吃 409,而旧文案只教
+ * cancel(毁灭当前 run)。对 parked 会话,「继续」的唯一合法动作是去**对的** resume 入口决议——但四条
+ * resume 入口各认各的 gate.kind,客户端不知道等的是哪种门,只能试错。本模块把答案放进 409 响应体:
+ *   activeTaskStatus(区分「插话/取消」与「决议/取消」两族出路)
+ *   pendingGate { kind, decidePath }(parked 且真有 pending checkpoint 时)
+ *
+ * 🔴 token 永不上 wire(approvals-assistant 纪律:resume 寻址=sessionId,checkpoint token 是秘密能力)。
+ * 🔴 失败方向:材料是 best-effort 增强——store 面任何失败都不得挡 409 本体,退化为旧形状,绝不 throw。
+ * 🔴 gateKind→入口映射是**这张表在仓里的唯一函数形**;它的知识此前散在 server.ts 三处 guard 文案里
+ *    (`gate_not_tool_approval`/`gate_not_resumable`/`wake.gate_pending` 的指路句)。三处文案与本表若漂移,
+ *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
+ */
+/** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
+export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
+export interface ActiveRunConflictBody {
+    error: string;
+    errorCode: "conflict.session_active_run";
+    activeTaskId: string | null;
+    activeTaskStatus?: string;
+    pendingGate?: {
+        kind: string;
+        decidePath: string;
+    };
+}
+/** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
+export declare function resumeEntryForGate(kind: string, ids: {
+    sessionId: string;
+    taskId: string;
+}): string | null;
+/** token 泛型:真身是 branded CheckpointToken(秘密能力,只在本函数内部流转,绝不进响应体)。 */
+/**
+ * SSE 车道的 done 帧 result(拒绝形)。与 409 body **同一铸体处** —— 此前 tasks.ts 在 res.write 里
+ * 手搓内联对象挑键,形状没有名字、没有类型、只活在那一行字符串里(conditional-spread 死键的老坑形)。
+ * 这里铸,SDK 的 done 帧 result 类型与本形同车对齐(sdk-api-guarantee-duty),live-contract 套件对已发包真跑。
+ */
+export interface ActiveRunConflictDoneResult {
+    status: "failed";
+    errorMessage: string;
+    activeTaskId: string | null;
+    activeTaskStatus?: string;
+    pendingGate?: {
+        kind: string;
+        decidePath: string;
+    };
+}
+export declare function toDoneFrameResult(body: ActiveRunConflictBody): ActiveRunConflictDoneResult;
+interface ConflictProbeDeps<TToken> {
+    runStore?: {
+        getRun?: (id: string) => Promise<{
+            status?: string;
+        } | null | undefined>;
+    } | undefined;
+    checkpointStore?: {
+        peekPendingScope?: (sessionId: string) => Promise<string | null | undefined>;
+        findPendingTokenBySession?: (sessionId: string, scope?: string) => Promise<TToken | null | undefined>;
+        get?: (token: TToken) => Promise<{
+            gate?: {
+                kind?: string;
+            };
+        } | null | undefined>;
+    } | undefined;
+}
+export declare function buildActiveRunConflict<TToken>(deps: ConflictProbeDeps<TToken>, sessionId: string, activeTaskId: string | null | undefined): Promise<ActiveRunConflictBody>;
+export {};
+//# sourceMappingURL=active-run-conflict.d.ts.map

package/dist/http/active-run-conflict.js

@@ -0,0 +1,89 @@
+/**
+ * [2252]/[2255]①/[2257] 追加件:409 `conflict.session_active_run` 的**真出路材料**装配(单源)。
+ *
+ * 事故形:park(suspended/needs_review)占着 session claim,客户端每条新提交吃 409,而旧文案只教
+ * cancel(毁灭当前 run)。对 parked 会话,「继续」的唯一合法动作是去**对的** resume 入口决议——但四条
+ * resume 入口各认各的 gate.kind,客户端不知道等的是哪种门,只能试错。本模块把答案放进 409 响应体:
+ *   activeTaskStatus(区分「插话/取消」与「决议/取消」两族出路)
+ *   pendingGate { kind, decidePath }(parked 且真有 pending checkpoint 时)
+ *
+ * 🔴 token 永不上 wire(approvals-assistant 纪律:resume 寻址=sessionId,checkpoint token 是秘密能力)。
+ * 🔴 失败方向:材料是 best-effort 增强——store 面任何失败都不得挡 409 本体,退化为旧形状,绝不 throw。
+ * 🔴 gateKind→入口映射是**这张表在仓里的唯一函数形**;它的知识此前散在 server.ts 三处 guard 文案里
+ *    (`gate_not_tool_approval`/`gate_not_resumable`/`wake.gate_pending` 的指路句)。三处文案与本表若漂移,
+ *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
+ */
+/** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
+export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
+/** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
+export function resumeEntryForGate(kind, ids) {
+    switch (kind) {
+        case "tool_approval":
+        case "human":
+        case "irreversible_ask":
+        case "policy_ask":
+            return `/v1/approvals/${ids.sessionId}/decide`;
+        case "plan_review":
+            return `/v1/assistant/tasks/${ids.taskId}/plan_review`;
+        case "resource_limit":
+            return `/v1/assistant/tasks/${ids.taskId}/resume`;
+        case "task_done":
+            return `/v1/sessions/${ids.sessionId}/wake`;
+        default:
+            return null; // 未知门型:宁缺毋假 —— 客户端仍有 activeTaskStatus + cancel 这条保底真路
+    }
+}
+export function toDoneFrameResult(body) {
+    return {
+        status: "failed",
+        errorMessage: body.error,
+        activeTaskId: body.activeTaskId,
+        ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),
+        ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
+    };
+}
+export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
+    const base = {
+        error: ACTIVE_RUN_CONFLICT_BASE_TEXT,
+        errorCode: "conflict.session_active_run",
+        activeTaskId: activeTaskId ?? null,
+    };
+    if (!activeTaskId)
+        return base;
+    try {
+        const row = await deps.runStore?.getRun?.(activeTaskId);
+        const status = row?.status;
+        if (status !== "running" && status !== "suspended" && status !== "needs_review")
+            return base;
+        if (status === "running") {
+            return {
+                ...base,
+                error: "session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)",
+                activeTaskStatus: status,
+            };
+        }
+        // parked:找 pending checkpoint 的门型,指到它的那一个 resume 入口
+        const cs = deps.checkpointStore;
+        let pendingGate;
+        if (cs?.findPendingTokenBySession) {
+            const scope = (await cs.peekPendingScope?.(sessionId)) ?? undefined;
+            const token = scope === null ? null : await cs.findPendingTokenBySession(sessionId, scope);
+            const kind = token ? (await cs.get?.(token))?.gate?.kind : undefined;
+            const decidePath = kind ? resumeEntryForGate(kind, { sessionId, taskId: activeTaskId }) : null;
+            if (kind && decidePath)
+                pendingGate = { kind, decidePath };
+        }
+        return {
+            ...base,
+            error: pendingGate
+                ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
+                : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`,
+            activeTaskStatus: status,
+            ...(pendingGate ? { pendingGate } : {}),
+        };
+    }
+    catch {
+        return base; // 材料装配的任何失败都退化为旧形状 —— 增强绝不成为新故障点
+    }
+}
+//# sourceMappingURL=active-run-conflict.js.map

package/dist/http/routes/runs.js

@@ -10,6 +10,7 @@ import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
+import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 // server.ts 侧的 routeLabel / isBillableSubmitPath 仍要用下面这些正则,故本模块导出(方向恒为 server.ts → routes/*)。
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
@@ -161,7 +162,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 if (clientTaskId && created.activeTaskId === clientTaskId) {
                     return { status: 202, body: { taskId: clientTaskId, sessionId, status: "running" } };
                 }
-                return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId } };
+                // [2255]① 真出路材料:activeTaskStatus + parked 时 pendingGate{kind,decidePath}(best-effort,失败退旧形)
+                return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore }, sessionId, created.activeTaskId) };
             }
             // Durable F4: persist the resume rebuild inputs (sessionId-keyed) so an operator can resume from any
             // replica even after this worker is gone — core's checkpoint blob can't carry service scenario context.

package/dist/http/routes/tasks.js

@@ -10,6 +10,7 @@ import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEve
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
+import { buildActiveRunConflict, toDoneFrameResult } from "../active-run-conflict.js";
 import { headerStr, gatedPrincipal } from "../principal-gate.js";
 export async function handleTasks(req, res, url, ctx) {
     const miss = { fell: false };
@@ -216,10 +217,11 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     if (created.ok)
                         deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget; in-titler dedupe;model 跟 turn([1992]②)
                     if (!created.ok) {
-                        const conflict = { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId };
+                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore }, prepared.spec.sessionId, created.activeTaskId); // [2255]① 真出路材料
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
                         // the returned resp is for a deduplicated concurrent caller (and is never idem-cached).
-                        res.write(`data: ${JSON.stringify({ type: "done", result: { status: "failed", errorMessage: conflict.error, activeTaskId: conflict.activeTaskId } })}\n\n`);
+                        // done 帧 additive 携带同一份材料 —— 形状铸在 toDoneFrameResult(有名字有类型),不在这行内联挑键。
+                        res.write(`data: ${JSON.stringify({ type: "done", result: toDoneFrameResult(conflict) })}\n\n`);
                         return { status: 409, body: conflict };
                     }
                     durableTaskId = tid;
@@ -971,7 +973,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const tid = uuidv7();
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
                     if (!created.ok)
-                        return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId } };
+                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore }, prepared.spec.sessionId, created.activeTaskId) }; // [2255]① 真出路材料
                     deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
                     durableTaskId = tid;
                 }

package/dist/http/server.js

@@ -5,7 +5,7 @@ import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, Checkpoin
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof } from "../security.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof, isDestructiveSessionWrite } from "../security.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
@@ -533,32 +533,16 @@ export function createHttpServer(rawDeps) {
             sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
             return;
         }
-        // E6 (review): the operator session-policy PUT is a mutating operator-gated write — apply the SAME fail-closed
-        // no-service-token guard as the POST submit paths (an un-authed worker must not accept policy writes from anything
-        // in-cluster; without it a forged principal header alone could tighten/DoS a session's tools).
-        if (req.method === "PUT" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            /^\/v1\/sessions\/[^/]+\/policy$/.test(url)) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting session-policy writes");
-            return;
-        }
-        // 🔴 E6 的**兄弟路径**(2026-08-01 缝合审):上面那道门只挂在 policy 的 PUT 腿上,而 session-sync 的
-        // import 提交腿(`routes/session-sync.ts` 的 ② policy 段)对**同一个 sessionPolicyStore** 调 `putRules`。
-        // 该腿的授权门是 `sessionOwnerScopeForWrite`,在「无 service token + 未开 ALLOW_UNAUTHED_WRITES +
-        // 未开 REQUIRE_PRINCIPAL」这一形下是 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 走两阶段
-        // import,顺带重写它的 policy 规则。`operatorOk` 走 explicitOperatorOk(无 operator 名单时为 false)
-        // ⇒ 只能 tighten 不能放宽 —— 但上面那道门自己写明的威胁就是「forged principal 可以 **tighten/DoS**
-        // 一个会话的工具」,严丝合缝落在同一句话上。
+        // E6 fail-closed:对**既有会话**的破坏性写,在「无 service token + 未开 ALLOW_UNAUTHED_WRITES」
+        // 这一形下一律拒。此形下 `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内任意调用方可对任意
+        // session 动手;policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」。
         //
-        // 拦在 **Phase A**(建 staging 之前),不是 Phase B:否则会先落一半状态再拒。
-        // 辖域取整条 import 而非只跳过 policy 段 —— 同一个理由:这一形下不信任调用方写 policy,就没有道理
-        // 信任它整段替换会话的 entries(import 的破坏面比 policy 更大)。
-        if (req.method === "POST" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            /^\/v1\/sessions\/[^/]+\/sync\/import$/.test(url)) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting a session-sync import");
+        // 🔴 2026-08-01 复审:这里原本是**逐条路由白名单**(PUT …/policy 与 POST …/sync/import 两块),
+        //    而 `DELETE /v1/sessions/:id`(删整条会话)**不在其中** —— 同一威胁形、爆炸半径更大却没门。
+        //    改成族判定(`isDestructiveSessionWrite`),新增破坏性会话路由自动落进门内。
+        //    import 腿仍拦在 **Phase A**(建 staging 之前),因为族判据匹配的就是那个 URL,不是 Phase B。
+        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
         // design/158 A9:能力/场景/模型目录域(routes/capabilities.ts)。位置=全局 service-credential 门之后、

package/dist/leader/wire.js

@@ -11,6 +11,7 @@
  * network; the MVP seeds the base from the Coordinator (no worker→remote net). MVP Planner = caller-provided
  * `subtasks` (an LLM DAG-planner is a follow-up).
  */
+import { parseNumOrFail } from "../config.js";
 import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -104,14 +105,19 @@ export async function stageWorkerEnv(env, opts) {
  * (URL) silently killed long autonomous builds or expired the diff upload mid-run. core's turn cap is now a
  * high net (10000), so the leader gives each worker an explicit triple bound; a sub-task's own limits override.
  */
+// 🔴 2026-08-01 gap-sweep:四个旋钮原为 `Number(x) || default` —— 非法值(`"20usd"`/`"1800000ms"`)
+// 得 NaN 后**静默落到慷慨的默认值**,方向是**松绑**:运维想把 worker 预算从 $100 收到 $20,实际拿到
+// $100(5 倍);想把寿命从 24h 收到 30min,实际拿到 24h,而 leaderTimeoutMs 还级联 presignTtlSec
+// ⇒ diff 上传预签名 URL 的暴露窗口一起放大。改走与 numEnv 同源的 parseNumOrFail:非法值当场报错。
+// 刻意**零行为变更**:`|| default` 保留,所以未设与显式 0 的既有语义一个没动。
 export function leaderResourceConfig(env = process.env) {
-    const leaderTimeoutMs = Math.max(600_000, Math.floor(Number(env.LEADER_TIMEOUT_MS ?? "0")) || 86_400_000); // default 24h (was 10min)
-    const workerMaxTurns = Math.floor(Number(env.LEADER_WORKER_MAX_TURNS ?? "0")) || 10_000;
-    const workerBudgetUsd = Number(env.LEADER_WORKER_BUDGET_USD ?? "0") || 100;
+    const leaderTimeoutMs = Math.max(600_000, Math.floor(parseNumOrFail("LEADER_TIMEOUT_MS", env.LEADER_TIMEOUT_MS) || 0) || 86_400_000); // default 24h (was 10min)
+    const workerMaxTurns = Math.floor(parseNumOrFail("LEADER_WORKER_MAX_TURNS", env.LEADER_WORKER_MAX_TURNS) || 0) || 10_000;
+    const workerBudgetUsd = (parseNumOrFail("LEADER_WORKER_BUDGET_USD", env.LEADER_WORKER_BUDGET_USD) || 0) || 100;
     const resourceSuspendOn = String(env.LEADER_RESOURCE_SUSPEND ?? "").toLowerCase() === "true";
     // Per-slice window: a fraction of the total so a worker suspends+resumes several times across its budget
     // (default = total/4, min $1). Smaller window ⇒ more, shorter slices ⇒ progress saved more often.
-    const sliceMaxCostUsd = Number(env.LEADER_WORKER_SLICE_BUDGET_USD ?? "0") || Math.max(1, workerBudgetUsd / 4);
+    const sliceMaxCostUsd = (parseNumOrFail("LEADER_WORKER_SLICE_BUDGET_USD", env.LEADER_WORKER_SLICE_BUDGET_USD) || 0) || Math.max(1, workerBudgetUsd / 4);
     return {
         leaderTimeoutMs,
         workerMaxTurns,

package/dist/main.js

@@ -7,7 +7,7 @@ import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
 import { subagentSendUserFileExtraTools } from "./capabilities/send-user-file-tool.js";
 import { brainSummary } from "./brain.js";
-import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv } from "./config.js";
+import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv, numEnv } from "./config.js";
 import { isPricingConfigured } from "./budget.js"; // 缝合审 M3:capabilities.pricingConfigured 的单一真源判据
 import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
 import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
@@ -362,7 +362,12 @@ async function main() {
     // Per-task wall-clock override (seconds). 0/absent = keep the built-in 600 (1500 council/debate/team) —
     // the override only ever RAISES (Math.max at the use site), so a misconfigured low value cannot shrink
     // the council budget.
-    const taskTimeoutSec = Math.max(0, Math.floor(Number(process.env.TASK_TIMEOUT_SEC ?? "0")) || 0);
+    // 🔴 2026-08-01 env fail-loud 族:原为 `Math.max(0, Math.floor(Number(env ?? "0")) || 0)` ——
+    // `TASK_TIMEOUT_SEC="3600s"`(带单位后缀,运维最常见的写法)得 NaN,再被 `|| 0` 折成 0,
+    // 而 0 在这里的语义是**无超时**。运维以为设了一小时上限,实际把超时关掉了,方向恰好相反,
+    // 且启动期零提示。改走 numEnv:非法值当场 fail-loud 并指名键与实际值。
+    // (numEnv 的注释早就预言了这个失败模式,只是它没 export、跨文件够不到,于是这两处手写了。)
+    const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
     // [854]④ per-request 配速的运营方上限旋钮(可选;缺省不设=不封顶):body.limits 每键各自被对应旋钮
     // Math.min 封顶(normalizeLimits)。多租部署想约束 caller 自报配速时才设;单用户 turnkey 通常留空。
     // ⚠️ 语义=只钳「显式请求值」,不是全队默认限额:body 缺席(或重放体里的非法值被 defensive DROP)⇒ 该键
@@ -552,6 +557,9 @@ async function main() {
     //  ② **fail-soft**:core resolveTaskModel 在无可解析角色时 throw,这是全仓唯一 boot 期裸调用;
     //     center 发一张既无 summarize 又无 default 的 roles 表就会拒启。解析失败 ⇒ 本次不摘要
     //     (core 的 summarize 抛错是 fail-open:回退原文+note),绝不崩 boot。
+    // core 2.13.0:返回形放宽为 additive union(`string | { text, truncated? }`)—— 这里**原样转发**
+    // core summarizer 的返回值,不在本仓收窄成 string(收窄会把 core 的截断披露 `truncated` 吃掉,
+    // 让「内容被截断」这个事实在 fence 外消失)。
     const webFetchSummarize = async (content, prompt, signal) => {
         const model = (() => {
             try {

package/dist/plugins/file-run-store.js

@@ -293,8 +293,17 @@ export class FileRunStore {
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     async setTerminal(taskId, status, result, error) {
         const r = this.runs.get(taskId);
-        if (!r)
+        if (!r) {
+            // [2255]③ claim 孤儿修:行不在(跨进程窗 —— claim 落盘、行未落/已失;R9 只兜同进程写失败)时,
+            // 终局动词仍必须能放锁:cancel 是文案承诺的用户自救路,它对孤儿失效=会话钉死到 reaper/boot。
+            // 反查 active 索引找持有该 taskId 的 session(O(claims),claims 数=活跃会话数,小)。
+            for (const [sessionId, tid] of this.active)
+                if (tid === taskId) {
+                    this.releaseClaim(sessionId);
+                    break;
+                }
             return;
+        }
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
@@ -535,8 +544,10 @@ export class FileRunStore {
      */
     async reapSuspended(olderThanMs) {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.sweepClaims();
             return 0;
+        } // [2255]③:时间腿无 probe=诚实 NO-OP,但 claim 不变式维护不跟 probe 走
         const cutoff = Date.now() - olderThanMs;
         let reaped = 0;
         for (const r of this.runs.values()) {
@@ -566,8 +577,10 @@ export class FileRunStore {
      */
     async failSuspendedWithExpiredCheckpoint() {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.sweepClaims();
             return 0;
+        } // [2255]③ 同上
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status !== "suspended" && r.status !== "needs_review")

package/dist/plugins/memory-run-store.js

@@ -127,8 +127,15 @@ export class MemoryRunStore {
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     async setTerminal(taskId, status, result, error) {
         const r = this.runs.get(taskId);
-        if (!r)
+        if (!r) {
+            // [2255]③ file 孪生同判据(parity oracle):行缺席时终局动词仍放锁(反查 active)。
+            for (const [sessionId, tid] of this.active)
+                if (tid === taskId) {
+                    this.active.delete(sessionId);
+                    break;
+                }
             return;
+        }
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
@@ -328,8 +335,10 @@ export class MemoryRunStore {
      */
     async reapSuspended(olderThanMs) {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.releaseTerminalClaims();
             return 0;
+        } // [2255]③ claim 不变式维护不跟 probe 走
         const cutoff = Date.now() - olderThanMs;
         let reaped = 0;
         for (const r of this.runs.values()) {
@@ -358,8 +367,10 @@ export class MemoryRunStore {
      */
     async failSuspendedWithExpiredCheckpoint() {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.releaseTerminalClaims();
             return 0;
+        } // [2255]③ claim 不变式维护不跟 probe 走
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status !== "suspended" && r.status !== "needs_review")

package/dist/plugins/run-store-sql.js

@@ -520,6 +520,12 @@ export class SqlRunStore {
             // claim — the session stays locked until an operator resumes it or reapSuspended expires it. (Was
             // `<> 'running'`, which would have prematurely unlocked a parked suspended session.)
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+            // [2255]③ 孤儿 claim 清扫(纵深防御):claim 无对应 task_run 行时,三处 INNER JOIN 释放腿永远碰不到
+            // 它。正常路径不产孤儿(createRun 单事务、setTerminal 无条件 DELETE、deleteBySession 同事务对称)——
+            // 这形只来自带外(手工 SQL/半截迁移),但一旦出现该 session 只剩 cancel 一条自救路。挂在 reapStale
+            // (每 tick 无条件跑)一处即可。同文双方言(关联 NOT EXISTS 指向**另一张**表,两引擎都合法);
+            // 无竞态:createRun 的 claim+row 同事务提交,已提交的 claim 必有行。
+            await conn.query(this.q("DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)", "DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)"));
         });
         return reaped;
     }

package/dist/plugins/web-search.d.ts

@@ -90,6 +90,20 @@ export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) =
  * stays captured in this closure — it is never surfaced to the model or the tool args.
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
+/**
+ * `WEB_SEARCH_SEARXNG_PARAMS` / `settings.webSearch.searxngParams` 的解析 —— SearXNG 实例侧参数
+ * (`engines=` / `language=` 等)。
+ *
+ * 🔴 [2240] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
+ * 两条门都没有位置填它,于是我在 [2239] 说的「这条是给你们的」是句空话。单测直接构造
+ * `WebSearchBackendConfig` 传进去,**天然绕过了配置入口这一层**,于是「能力在」与「配得进」之间
+ * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
+ *
+ * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,
+ * 所以分隔符取 `;` 而不是 `,`。整串解析不出任何一对 ⇒ **返回 undefined,键整个不铸**
+ * (不产出空对象:空对象会让下游以为「配了但是空的」,与本仓「缺席就要缺席得干净」同源)。
+ */
+export declare function parseSearxngParams(raw: unknown): Record<string, string> | undefined;
 /**
  * #81④ 探活门控 —— **默认 OFF**,显式开才探。
  *

package/dist/plugins/web-search.js

@@ -152,11 +152,17 @@ async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
  * ⚠️ core adapter **不管**这三样,必须留在外层(换真源最容易丢的就是它们,已上红先钉):
  *   ① `maxResults` 截断 ② 统一形状 `{title,url,snippet}` ③ 坏 payload 观测器。
  */
-async function searxngSearch(fetchImpl, cfg, query, max, signal, opts) {
+async function searxngSearch(fetchImpl, cfg, query, max, signal, timeoutMs, opts) {
     if (!cfg.endpoint)
         throw new Error("WEB_SEARCH_ENDPOINT (the SearXNG instance URL) is required for the searxng provider");
+    // 🔴 timeoutMs 必须显式传:core 的 adapter 内部是 `options.timeoutMs ?? 10_000`,不传就用它自己的
+    //    10 秒。外层 createWebSearchBackend 那道 withTimeout 只在**更短**时先到 —— 部署方把
+    //    WEB_SEARCH_TIMEOUT_MS 设成大于 10s 的值(慢实例/自建 SearXNG 的常见需要)会被**静默封顶在 10s**,
+    //    而 3.18.0 的 CHANGELOG 还把 core「自带 timeout」当纯收益卖(见 3.20.0 的更正段)。
+    //    两层同值不冲突:内层是 adapter 自己的 AbortSignal.any,外层是本文件的 withTimeout。
     const search = createSearxngSearchBackend(cfg.endpoint, {
         fetchImpl,
+        timeoutMs,
         ...(cfg.searxngParams ? { extraParams: cfg.searxngParams } : {}),
     });
     let rows;
@@ -196,7 +202,7 @@ export function createWebSearchBackend(cfg) {
             switch (cfg.provider) {
                 case "brave": return await braveSearch(fetchImpl, cfg, q, maxResults, sig);
                 case "tavily": return await tavilySearch(fetchImpl, cfg, q, maxResults, sig, opts);
-                case "searxng": return await searxngSearch(fetchImpl, cfg, q, maxResults, sig, opts);
+                case "searxng": return await searxngSearch(fetchImpl, cfg, q, maxResults, sig, timeoutMs, opts);
             }
         }
         finally {
@@ -205,6 +211,41 @@ export function createWebSearchBackend(cfg) {
     };
     return { search, maxResults };
 }
+/**
+ * `WEB_SEARCH_SEARXNG_PARAMS` / `settings.webSearch.searxngParams` 的解析 —— SearXNG 实例侧参数
+ * (`engines=` / `language=` 等)。
+ *
+ * 🔴 [2240] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
+ * 两条门都没有位置填它,于是我在 [2239] 说的「这条是给你们的」是句空话。单测直接构造
+ * `WebSearchBackendConfig` 传进去,**天然绕过了配置入口这一层**,于是「能力在」与「配得进」之间
+ * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
+ *
+ * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,
+ * 所以分隔符取 `;` 而不是 `,`。整串解析不出任何一对 ⇒ **返回 undefined,键整个不铸**
+ * (不产出空对象:空对象会让下游以为「配了但是空的」,与本仓「缺席就要缺席得干净」同源)。
+ */
+export function parseSearxngParams(raw) {
+    if (typeof raw === "object" && raw !== null) {
+        // settings 门传的是已解析的表;只收「字符串→字符串」,任一值非字符串 ⇒ 整表不铸(不半吞)。
+        const entries = Object.entries(raw);
+        if (entries.length === 0 || entries.some(([, v]) => typeof v !== "string"))
+            return undefined;
+        return Object.fromEntries(entries);
+    }
+    if (typeof raw !== "string")
+        return undefined;
+    const out = {};
+    for (const pair of raw.split(";")) {
+        const i = pair.indexOf("=");
+        if (i <= 0)
+            continue;
+        const k = pair.slice(0, i).trim();
+        const v = pair.slice(i + 1).trim();
+        if (k && v)
+            out[k] = v;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 /**
  * #81④ 探活门控 —— **默认 OFF**,显式开才探。
  *
@@ -224,12 +265,14 @@ export function webSearchConfigFromEnv(env = process.env) {
     const provider = env.WEB_SEARCH_PROVIDER?.trim().toLowerCase();
     if (provider !== "brave" && provider !== "tavily" && provider !== "searxng")
         return undefined;
+    const searxngParams = parseSearxngParams(env.WEB_SEARCH_SEARXNG_PARAMS); // [2240] 部署 env 门
     const maxRaw = Number(env.WEB_SEARCH_MAX_RESULTS ?? "");
     const timeoutRaw = Number(env.WEB_SEARCH_TIMEOUT_MS ?? "");
     return {
         provider,
         ...(env.WEB_SEARCH_API_KEY ? { apiKey: env.WEB_SEARCH_API_KEY } : {}),
         ...(env.WEB_SEARCH_ENDPOINT ? { endpoint: env.WEB_SEARCH_ENDPOINT } : {}),
+        ...(searxngParams ? { searxngParams } : {}), // [2240] 解析不出任何一对 ⇒ 键整个不铸(不产出空对象)
         ...(Number.isFinite(maxRaw) && maxRaw > 0 ? { maxResults: Math.floor(maxRaw) } : {}),
         ...(Number.isFinite(timeoutRaw) && timeoutRaw > 0 ? { timeoutMs: Math.floor(timeoutRaw) } : {}),
     };
@@ -253,6 +296,12 @@ export function webSearchConfigFromSettings(raw) {
         provider,
         ...(typeof s.apiKey === "string" && s.apiKey ? { apiKey: s.apiKey } : {}),
         ...(typeof s.endpoint === "string" && s.endpoint ? { endpoint: s.endpoint } : {}),
+        // [2240]:与 endpoint **同门同辖域** —— 安全边界不在字段粒度,而在调用方把整条门 gate 到
+        // 单用户 host lane(见本函数头注的 SSRF 段)。单独把它挡在门外是个没有理由的例外。
+        ...(() => {
+            const p = parseSearxngParams(s.searxngParams);
+            return p ? { searxngParams: p } : {};
+        })(),
         ...(max ? { maxResults: max } : {}),
     };
 }

package/dist/run-local.js

@@ -31,7 +31,7 @@ import { createBrain } from "./brain.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
-import { loadConfig, logConfigDiagnostics } from "./config.js";
+import { loadConfig, logConfigDiagnostics, numEnv } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -440,7 +440,12 @@ export async function runLocal(argv, deps = {}) {
     // wins with its raise-only floor (team 1500s — a multi-agent coordinator legitimately exceeds 600s).
     // [854]④ 不落此腿:per-request body.limits 是 HTTP body 车道(resolveTaskLimits,main.ts resolveSpec);
     // run-local 无 body,配速仍走 env(要 CLI flag 时另开件,别在这里半做)。
-    const taskTimeoutSec = Math.max(0, Math.floor(Number(process.env.TASK_TIMEOUT_SEC ?? "0")) || 0);
+    // 🔴 2026-08-01 env fail-loud 族:原为 `Math.max(0, Math.floor(Number(env ?? "0")) || 0)` ——
+    // `TASK_TIMEOUT_SEC="3600s"`(带单位后缀,运维最常见的写法)得 NaN,再被 `|| 0` 折成 0,
+    // 而 0 在这里的语义是**无超时**。运维以为设了一小时上限,实际把超时关掉了,方向恰好相反,
+    // 且启动期零提示。改走 numEnv:非法值当场 fail-loud 并指名键与实际值。
+    // (numEnv 的注释早就预言了这个失败模式,只是它没 export、跨文件够不到,于是这两处手写了。)
+    const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "team");
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
     const spec = {

package/dist/security.d.ts

@@ -23,6 +23,23 @@ export interface SessionListItem {
 /** A SessionStore that may additionally expose tenant-ownership ops (the TiDB store does) AND the
  *  `SessionRepo` enumeration/lifecycle seam (§0.5: list/fork/delete homed on the session abstraction's own
  *  tables, not the `task_run` runs ledger). All optional — an in-memory dev store implements none. */
+/**
+ * E6 fail-closed 守卫的辖域判据:**这个请求是不是一次「破坏性会话写」**。
+ *
+ * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
+ * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一威胁形、爆炸半径**更大**,却没门。
+ *
+ * 威胁形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
+ * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
+ *
+ * ⇒ 枚举改**族判定**:新增一条破坏性会话路由时自动落进门内,不必记得回来加白名单。
+ * 这是本仓「同一条论证只在枚举到的路径上执行」这一族的第 N 次,修法统一为把判据提成函数。
+ *
+ * 辖域**只含**对**既有会话**的破坏性写:改规则 / 整段替换 / 删除 / 分叉(读源会话全历史)。
+ * 不含读面,也不含 `POST /v1/tasks` 那条提交腿 —— 它有自己的同族门(别重复拦,双拦会让错误归因变糊)。
+ */
+export declare function isDestructiveSessionWrite(method: string, url: string): boolean;
 export type OwnerAwareSessionStore = SessionStore & {
     ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
     register?: (sessionId: string, owner: string | null) => Promise<void>;

package/dist/security.js

@@ -11,6 +11,34 @@ import { memoryScopeFor } from "./memory-scope.js"; // design/158 N17: see re-ex
 // `verifiedPrincipal` still calls verifyPrincipalJwt for the direct-door branch (value import below); every
 // symbol from both groups is re-exported near the bottom of this file so existing importers keep working.
 import { verifyPrincipalJwt } from "./principal-jwt.js";
+/** A SessionStore that may additionally expose tenant-ownership ops (the TiDB store does) AND the
+ *  `SessionRepo` enumeration/lifecycle seam (§0.5: list/fork/delete homed on the session abstraction's own
+ *  tables, not the `task_run` runs ledger). All optional — an in-memory dev store implements none. */
+/**
+ * E6 fail-closed 守卫的辖域判据:**这个请求是不是一次「破坏性会话写」**。
+ *
+ * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
+ * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一威胁形、爆炸半径**更大**,却没门。
+ *
+ * 威胁形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
+ * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
+ *
+ * ⇒ 枚举改**族判定**:新增一条破坏性会话路由时自动落进门内,不必记得回来加白名单。
+ * 这是本仓「同一条论证只在枚举到的路径上执行」这一族的第 N 次,修法统一为把判据提成函数。
+ *
+ * 辖域**只含**对**既有会话**的破坏性写:改规则 / 整段替换 / 删除 / 分叉(读源会话全历史)。
+ * 不含读面,也不含 `POST /v1/tasks` 那条提交腿 —— 它有自己的同族门(别重复拦,双拦会让错误归因变糊)。
+ */
+export function isDestructiveSessionWrite(method, url) {
+    if (method === "DELETE")
+        return /^\/v1\/sessions\/[^/]+$/.test(url);
+    if (method === "PUT")
+        return /^\/v1\/sessions\/[^/]+\/policy$/.test(url);
+    if (method === "POST")
+        return /^\/v1\/sessions\/[^/]+\/(sync\/import|fork)$/.test(url);
+    return false;
+}
 /** The shape core's `uuidv7()` mints: canonical 8-4-4-4-12 lowercase hex with version nibble `7` and the RFC-4122
  *  variant (`8`/`9`/`a`/`b`). Used to shape-validate a caller-supplied session id on the §0.5 fork/delete routes so
  *  a crafted id (LIKE metacharacters, over-long, non-canonical) is rejected up front — a SECOND layer behind the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.19.0",
+  "version": "3.21.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^2.12.0",
+    "@sema-agent/core": "^2.13.0",
     "@sema-agent/registry-core": "^0.11.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^2.2.0",
+    "@sema-agent/sdk": "^2.3.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",