@sema-agent/server 3.21.0 → 3.23.0

package/dist/lsp/e2b-manager.js

@@ -12,19 +12,28 @@ import { randomUUID } from "node:crypto";
 import { connectWsLspTransport } from "./ws-transport.js";
 import { E2bLspManager } from "./manager.js";
 import { BRIDGE_DIR, BRIDGE_SOURCE, lspInstallCommand, lspStartCommand, portForLanguage, SERVER_CMD } from "./e2b-bridge.js";
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect. */
-export async function openE2bLspTransport(language, env, opts) {
-    if (!SERVER_CMD[language])
-        return undefined; // no server for this language → graceful degrade
-    const connect = opts?.connect ?? connectWsLspTransport;
-    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
-    const port = portForLanguage(language);
+/** Write bridge.cjs + (foreground) install the language server, then start the bridge as a TRUE background
+ *  command. Returns whether the bridge is now up-or-starting (`false` only when the foreground install failed).
+ *  A single-shot primitive: it does NOT check whether a bridge is already listening on `port` — a caller that
+ *  can have two languages share one port (`createE2bLspManager`, since `portForLanguage` maps typescript AND
+ *  javascript onto 8123 off the same `SERVER_CMD`) MUST call this at most ONCE per env+port itself. A second
+ *  `node bridge.cjs` on an already-bound port surfaces as an EADDRINUSE `wss` 'error' (e2b-bridge.ts D6
+ *  hardening keeps that from crashing the sandbox, but the second attempt still fails and wastes a sandbox
+ *  round-trip for nothing — HRD-LSP-4). */
+async function startE2bBridge(language, env, port, token) {
     await env.writeFile(`${BRIDGE_DIR}/bridge.cjs`, BRIDGE_SOURCE).catch(() => undefined);
     const installed = await env.exec(lspInstallCommand(language)).catch(() => undefined);
     if (!installed || !installed.ok)
-        return undefined;
-    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+        return false;
     await env.startBackground(lspStartCommand(language, port, token)).catch(() => undefined);
+    return true;
+}
+/** Connect (with retry) to an already-started bridge. Each call opens its OWN WS connection — the bridge spawns
+ *  a FRESH child language-server process per connection (e2b-bridge.ts `wss.on('connection', …)`), so two
+ *  languages sharing one bridge port each still get an isolated language-server instance. */
+async function connectE2bLspBridge(env, port, token, opts) {
+    const connect = opts?.connect ?? connectWsLspTransport;
+    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
     const root = env.workspaceHandle().mountPath;
     // the bridge starts as a background command → retry the WS connect (with the auth token) while it comes up
     const scheme = opts?.scheme ?? "wss";
@@ -39,26 +48,49 @@ export async function openE2bLspTransport(language, env, opts) {
     }
     return undefined;
 }
+/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
+ *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
+ *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
+export async function openE2bLspTransport(language, env, opts) {
+    if (!SERVER_CMD[language])
+        return undefined; // no server for this language → graceful degrade
+    const port = portForLanguage(language);
+    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+    const started = await startE2bBridge(language, env, port, token);
+    if (!started)
+        return undefined;
+    return connectE2bLspBridge(env, port, token, opts);
+}
 /** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
 export function createE2bLspManager(opts) {
-    // One bridge token per env+language, pinned across re-opens (heal after an idle-killed WS): the original
-    // bridge keeps listening with the first token, so the reconnect must present the SAME one. WeakMap → a
-    // destroyed task's tokens are collectible with its env.
-    const tokens = new WeakMap();
+    // One bridge PROCESS + token per env+PORT — not per env+language. `portForLanguage` maps typescript and
+    // javascript onto the SAME port (they share `SERVER_CMD`): keying by language minted two auth tokens for the
+    // one listening bridge (HRD-LSP-4) and re-invoked `startBackground` on an already-bound port on every open.
+    // WeakMap → a destroyed task's bridge bookkeeping is collectible with its env.
+    const bridges = new WeakMap();
     return new E2bLspManager({
         log: opts?.log,
-        transportFactory: (language, env) => {
-            let perLang = tokens.get(env);
-            if (!perLang) {
-                perLang = new Map();
-                tokens.set(env, perLang);
+        transportFactory: async (language, env) => {
+            if (!SERVER_CMD[language])
+                return undefined; // no server for this language → graceful degrade (mirrors
+            // openE2bLspTransport's own guard; MUST run before touching `bridges` — `portForLanguage` falls back to
+            // port 8123 for an unmapped language, which would otherwise silently borrow typescript's live bridge)
+            const port = portForLanguage(language);
+            let perPort = bridges.get(env);
+            if (!perPort) {
+                perPort = new Map();
+                bridges.set(env, perPort);
             }
-            let token = perLang.get(language);
-            if (!token) {
-                token = opts?.token ?? randomUUID();
-                perLang.set(language, token);
+            let bridge = perPort.get(port);
+            if (!bridge) {
+                const token = opts?.token ?? randomUUID();
+                bridge = { token, ready: startE2bBridge(language, env, port, token) };
+                perPort.set(port, bridge); // synchronous — no await above (run-to-completion dedupe guard, see E2bBridgeHandle.ready doc)
             }
-            return openE2bLspTransport(language, env, { ...opts, token });
+            const started = await bridge.ready;
+            if (!started)
+                return undefined;
+            return connectE2bLspBridge(env, port, bridge.token, opts);
         },
     });
 }

package/dist/main.js

@@ -24,7 +24,7 @@ import { createRegistryJwtVerifier } from "./auth-bridge.js";
 import { createMetrics } from "./observability/metrics.js";
 import { setRedactionObserver, redactSecrets } from "./trace/redact.js";
 import { RateLimiter } from "./observability/rate-limit.js";
-import { createHttpServer, explicitOperator } from "./http/server.js";
+import { createHttpServer, explicitOperatorOk } from "./http/server.js";
 import { exportMemoryScope } from "./memory-export.js";
 import { performMemorySync } from "./memory-sync.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
@@ -421,7 +421,7 @@ async function main() {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperator(principal, config.operatorPrincipals), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config.operatorPrincipals), tenantId: principal ?? null }),
         })
         : undefined;
     // Sandbox-image-pool BAKE control plane (IMAGE-API-DESIGN.md §P2): enables /v1/images/bakes* when a pool exists

package/dist/parked-decide.js

@@ -135,7 +135,10 @@ export async function decideParkedAgent(deps, req) {
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
         ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
-        ...(req.reason ? { reason: req.reason } : {}),
+        // B10:存在性判定,不是真值判定 —— reason 可以是空串("运维显式选择不写理由"),这与"没传 reason"
+        // 是两件不同的事(姊妹 approval-hmac.ts `env.reason ?? null` 同判据:`??` 只在 null/undefined 时落
+        // null,空串照样入签名载荷)。真值判定会把显式 "" 与缺席折成同一个结果,审计/签名面丢了这个区分。
+        ...(req.reason !== undefined ? { reason: req.reason } : {}),
     };
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,

package/dist/plugins/file-run-store.js

@@ -363,9 +363,9 @@ export class FileRunStore {
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId ? r.jobId === opts.jobId : true))
-            .filter((r) => (opts.source ? r.source === opts.source : true))
-            .filter((r) => (opts.owner ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): a set owner excludes null-owner rows
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
@@ -379,8 +379,8 @@ export class FileRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`)
+            if (opts.owner !== undefined && r.owner !== opts.owner)
+                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);

package/dist/plugins/host-platform.d.ts

@@ -1,27 +1,3 @@
-/**
- * Host-lane PLATFORM seam (DESIGN-windows-native.md, FINAL r3) — the ONE place the host exec adapter's
- * POSIX/win32 differences live, so `remote-env-host.ts` stays a single code path with platform-gated leaves.
- *
- * 🔴 Iron invariant (design §4.1): the POSIX path is BYTE-IDENTICAL to the pre-Windows code — every helper is
- * `win32 ? new : exactly-what-the-inline-code-did` (same syscall, same throw behavior). Never "improve" POSIX
- * here; the existing full test suite is the regression net.
- *
- * win32 semantics (design D1-D4):
- *  - shell   = Git Bash via core 1.224 `getShellConfig` (WSL-launcher-filtered — the `System32\bash.exe`
- *              trap). Fail-LOUD when absent; never silently degrade to cmd (D1).
- *  - kill    = core 1.224 `signalProcessTree` (taskkill /T, /F for hard). Soft is a no-op for console trees
- *              (taskkill errors "can only be terminated forcefully") — the SIGTERM→grace→SIGKILL ladder is
- *              effectively delay→hard-kill on win32; accepted, CC-identical (D2).
- *  - spawn   = `detached:false` + `windowsHide:true` (no console window; no POSIX process group — the kill
- *              side uses the tree, not the group) (D3).
- *  - env     = case-insensitive key collapse before spawn (win32 env keys are case-insensitive; a `Path`+`PATH`
- *              pair from case-sensitive Object.assign reaches CreateProcess as ONE undefined-which
- *              entry). Canonical casing = the first-seen key (process.env's native casing wins since the
- *              inherit base is spread first).
- *
- * ⚠️ The win32 branches are UNVERIFIED on a real machine until S5 (Windows CI runner) — design D5 discipline:
- * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
- */
 import { killProcessTree } from "@sema-agent/core";
 export declare const IS_WIN32: boolean;
 export interface HostShell {
@@ -82,6 +58,17 @@ export { killProcessTree };
  * POSIX: returns the input UNTOUCHED (case-sensitive env is real there — `Path` and `PATH` are distinct).
  */
 export declare function collapseWin32EnvKeys(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Conventional exit-code mapping for a process killed by a signal (128 + signal number). Single pattern-home
+ * construction point for every exec adapter that must turn a `close` event's external-kill case
+ * (`code===null`, `signal` set) into an exit code instead of silently reporting a fake success 0 — the host
+ * lane, ssh, adb, and local-docker all consume THIS function; none of them may hand-write their own signal
+ * table. Uses Node's authoritative platform table (`os.constants.signals`) rather than a hand-written list —
+ * a hand-written table has previously missed `SIGABRT`/`SIGPIPE` (`kill -ABRT` reported 137, impersonating
+ * `SIGKILL`). Callers keep a `?? 9` fallback for a name the platform table doesn't define, matching core's
+ * `SIGNUM[signal] ?? 9`.
+ */
+export declare function signalNumber(signal: NodeJS.Signals): number | undefined;
 /** The platform-free collapse algorithm (exported so the mac/Linux suite can pin the win32 behavior — design
  *  D5: structural verification everywhere, behavioral bite on the Windows runner). */
 export declare function collapseEnvKeysCaseInsensitive(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/plugins/host-platform.js

@@ -22,6 +22,7 @@
  * ⚠️ The win32 branches are UNVERIFIED on a real machine until S5 (Windows CI runner) — design D5 discipline:
  * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
  */
+import os from "node:os";
 import { getShellConfig, killProcessTree, signalProcessTree } from "@sema-agent/core";
 export const IS_WIN32 = process.platform === "win32";
 /** S1([1870] test AI 全归因,2026-07-27):POSIX 不再硬编码 `/bin/sh`——Debian/Ubuntu 的 /bin/sh 是
@@ -135,6 +136,19 @@ export function collapseWin32EnvKeys(env) {
         return env;
     return collapseEnvKeysCaseInsensitive(env);
 }
+/**
+ * Conventional exit-code mapping for a process killed by a signal (128 + signal number). Single pattern-home
+ * construction point for every exec adapter that must turn a `close` event's external-kill case
+ * (`code===null`, `signal` set) into an exit code instead of silently reporting a fake success 0 — the host
+ * lane, ssh, adb, and local-docker all consume THIS function; none of them may hand-write their own signal
+ * table. Uses Node's authoritative platform table (`os.constants.signals`) rather than a hand-written list —
+ * a hand-written table has previously missed `SIGABRT`/`SIGPIPE` (`kill -ABRT` reported 137, impersonating
+ * `SIGKILL`). Callers keep a `?? 9` fallback for a name the platform table doesn't define, matching core's
+ * `SIGNUM[signal] ?? 9`.
+ */
+export function signalNumber(signal) {
+    return os.constants.signals[signal];
+}
 /** The platform-free collapse algorithm (exported so the mac/Linux suite can pin the win32 behavior — design
  *  D5: structural verification everywhere, behavioral bite on the Windows runner). */
 export function collapseEnvKeysCaseInsensitive(env) {

package/dist/plugins/memory-engine-tidb.js

@@ -23,6 +23,7 @@
 //     (`${name ?? slug} ${description} ${body}`——memoryBackendContract 的 search 等价断言依赖)。
 import { jaccardDistance, termSet } from "./memory-engine-vector-util.js";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
+import { pgHasUnstorable } from "./pg-safe-json.js";
 /** Table names (single source) — SAME names as PG_MEMORY_ENGINE_TABLES (the two dialects never share
  *  one database), deliberately DISJOINT from the legacy `agent_memory*` MemoryStore plane. */
 export const TIDB_MEMORY_ENGINE_TABLES = {
@@ -224,6 +225,15 @@ export class TiDBMemoryEngineBackend {
                 report.conflicts.push({ op: "add", id: patch.id, reason: "add patch without an entry" });
                 return;
             }
+            // Reject-not-rewrite for bytes SQL cannot store(Pg 版 applyOne add 分支同一守卫,复用同一
+            // pgHasUnstorable——不是重派生一份近似正则):NUL / 孤立 UTF-16 代理不是 PG 独有的病,mysql2/
+            // utf8mb4 对同样的字节没有 PG 的 22P05 fail-loud 报错,驱动或服务端会静默 mangle(丢字节/替换为
+            // U+FFFD 视驱动版本而定),写入侧不炸、读回侧才发现内容偏离——这比 PG 的写时报错更隐蔽。三后端
+            // (pg/tidb/local)必须对同一输入给出同一行为,否则同一份 sync 数据在不同部署形态下悄悄分叉。
+            if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+                report.conflicts.push({ op: "add", id: entry.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+                return;
+            }
             // Cross-scope add refusal (opus 审 C3,Pg 版同注): an add whose id already lives in a DIFFERENT
             // scope must not silently MOVE the row; same-scope re-add stays the idempotent overwrite.
             // One probe serves BOTH the E-02 guard and the cross-scope refusal (File/Pg parity).
@@ -369,6 +379,12 @@ export class TiDBMemoryEngineBackend {
             report.conflicts.push({ op: "update", id: patch.id, reason: "update patch without an entry" });
             return;
         }
+        // Same reject-not-rewrite guard as the add leg above(Pg 版 applyOne update 分支同一守卫)—
+        // an update carrying unstorable bytes must refuse before the CAS write, not mangle silently.
+        if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+            report.conflicts.push({ op: "update", id: patch.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+            return;
+        }
         const rev = computeEntryRev(entry);
         const res = await this.write(`UPDATE ${T} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND rev = ?`, [entry.scope, entry.slug, JSON.stringify(entry.frontmatter), entry.body, rev, this.clock(), Buffer.byteLength(serializeEntryFile(entry), "utf8"), entry.id, currentRev]);
         if (res.affectedRows === 0) {

package/dist/plugins/memory-run-store.js

@@ -191,9 +191,9 @@ export class MemoryRunStore {
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId ? r.jobId === opts.jobId : true))
-            .filter((r) => (opts.source ? r.source === opts.source : true))
-            .filter((r) => (opts.owner ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): a set owner excludes null-owner rows
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
@@ -207,8 +207,8 @@ export class MemoryRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`)
+            if (opts.owner !== undefined && r.owner !== opts.owner)
+                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);

package/dist/plugins/remote-env-adb.js

@@ -29,6 +29,7 @@ import os from "node:os";
 import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -234,13 +235,15 @@ export class RemoteAdbExecutionEnv {
             finished = true;
             signalReady();
         });
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
             if ((code ?? 0) !== 0 && isAdbTransportLost(stderrTail) && !failure) {
                 // device transport died mid-stream — typed retryable, not a fake exit ([R78]#1)
                 this.connected = false;
                 failure = new RemoteExecutionError("transport_lost", `adb transport lost mid-stream: ${stderrTail.trim().slice(0, 200)}`);
             }
-            exitCode = code ?? 0;
+            // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) — conventional
+            // 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped before this fix).
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
             finished = true;
             signalReady();
         });
@@ -483,19 +486,23 @@ export class RemoteAdbExecutionEnv {
                 opts?.onStderr?.(d.toString());
             });
             child.on("error", (e) => finish({ ok: false, error: new ExecutionError("spawn_error", `adb spawn failed (is '${this.cfg.adbPath}' installed?): ${e.message}`, e) }));
-            child.on("close", (code) => {
+            child.on("close", (code, signal) => {
                 if (forceSettleTimer)
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
+                // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) —
+                // conventional 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped
+                // before this fix).
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
                 if (binary) {
                     // byte-exact: readBinaryFile decodes stdoutBytes; never truncate.
                     const stdoutBytes = Buffer.concat(outBufs);
-                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode: code ?? 0, stdoutBytes: new Uint8Array(stdoutBytes) }));
+                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode, stdoutBytes: new Uint8Array(stdoutBytes) }));
                 }
                 else {
                     const out = outTail.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode: code ?? 0 }));
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode }));
                 }
             });
         });

package/dist/plugins/remote-env-local-docker.js

@@ -42,6 +42,7 @@ import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -290,7 +291,7 @@ export class RemoteLocalDockerExecutionEnv {
         child.on("close", (code, signal) => {
             if (finished)
                 return;
-            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
             finished = true;
             signalReady();
         });
@@ -586,7 +587,7 @@ export class RemoteLocalDockerExecutionEnv {
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 // A signal-killed process (external SIGKILL/OOM) has code===null → derive the conventional 128+signo
                 // (parity with execStream + the host adapter); NEVER report a killed command as a success exitCode 0.
-                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 if (binary) {
@@ -664,11 +665,6 @@ function sanitizeId(id) {
 function errMsg(e) {
     return e instanceof Error ? e.message : String(e);
 }
-/** Conventional exit code for a process killed by a signal (128 + signal number); falls back to undefined. */
-function signalNumber(signal) {
-    const table = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15, SIGSEGV: 11 };
-    return table[signal];
-}
 /**
  * `ExecutionEnvFactory` for the TOC `local-docker` backend (DUAL-MODE-DESIGN §5). Wiring this onto a deployment
  * makes its agent run each task in a per-task container on the worker's OWN docker daemon (isolation:true,

package/dist/plugins/remote-env-ssh.js

@@ -22,6 +22,7 @@
 import path from "node:path";
 import { Client } from "ssh2";
 import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -31,6 +32,13 @@ const unsupported = (op) => ({
     ok: false,
     error: new RemoteExecutionError("unsupported", `${op} is not supported on an SSH target (real machine — not snapshotable; capabilities.suspendable=false)`),
 });
+/** ssh2's ClientChannel "close" event gives the killing signal's BARE POSIX name (e.g. "KILL"), unlike Node's
+ *  own `child.on("close")` which gives `NodeJS.Signals` names (e.g. "SIGKILL") — re-prefix before looking it
+ *  up in the shared, authoritative signal table (host-platform.ts `signalNumber`; single pattern-home, no
+ *  hand-written table here). `?? 9` matches the convention every other exec adapter uses for an unmapped name. */
+function exitCodeForSignalKill(signal) {
+    return 128 + (signalNumber(`SIG${signal}`) ?? 9);
+}
 export class RemoteSshExecutionEnv {
     capabilities = { isolation: false, suspendable: false };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
@@ -341,7 +349,12 @@ export class RemoteSshExecutionEnv {
                     }
                     const out = outBuf.result();
                     const err = errBuf.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode: code ?? 0 }));
+                    // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                    // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix). The `: 1`
+                    // arm is unreachable (the transport_lost return above already covers code==null && !signal) but
+                    // keeps the type honest without a non-null assertion.
+                    const exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 1);
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode }));
                 })
                     .stderr.on("data", (d) => {
                     errBuf.push(d);
@@ -445,7 +458,9 @@ export class RemoteSshExecutionEnv {
                     // channel died without an exit status (transport drop) — typed retryable, not a fake exit 0 ([R78]#1)
                     failure = new RemoteExecutionError("transport_lost", "ssh channel closed without exit status (transport lost)");
                 }
-                exitCode = code ?? 0;
+                // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix).
+                exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 0);
                 finished = true;
                 signalReady();
             })

package/dist/plugins/run-store-sql.js

@@ -289,16 +289,16 @@ export class SqlRunStore {
                 where.push("status = ?");
                 params.push(opts.status);
             }
-            if (opts.jobId) {
+            if (opts.jobId !== undefined) {
                 where.push("job_id = ?");
                 params.push(opts.jobId);
             }
-            if (opts.source) {
+            if (opts.source !== undefined) {
                 where.push("source = ?");
                 params.push(opts.source);
             }
-            if (opts.owner) {
-                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own)
+            if (opts.owner !== undefined) {
+                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own); "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             if (opts.cursor) {
@@ -320,12 +320,12 @@ export class SqlRunStore {
         const where = [];
         if (opts.status)
             where.push(`status = ${p(opts.status)}`);
-        if (opts.jobId)
+        if (opts.jobId !== undefined)
             where.push(`job_id = ${p(opts.jobId)}`);
-        if (opts.source)
-            where.push(`source = ${p(opts.source)}`);
-        if (opts.owner)
-            where.push(`owner = ${p(opts.owner)}`);
+        if (opts.source !== undefined)
+            where.push(`source = ${p(opts.source)}`); // "" exact-matches (B10, same family as owner)
+        if (opts.owner !== undefined)
+            where.push(`owner = ${p(opts.owner)}`); // "" is a valid exact owner, not "no filter" (B10)
         if (opts.cursor) {
             const a = p(new Date(opts.cursor.createdAt));
             const b = p(new Date(opts.cursor.createdAt));
@@ -348,8 +348,8 @@ export class SqlRunStore {
         if (this.db.dialect === "tidb") {
             const params = [];
             let innerWhere = "";
-            if (opts.owner) {
-                innerWhere = " WHERE owner = ?";
+            if (opts.owner !== undefined) {
+                innerWhere = " WHERE owner = ?"; // "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             const outer = ["rn = 1"];
@@ -381,7 +381,7 @@ export class SqlRunStore {
             params.push(v);
             return `$${params.length}`;
         };
-        const innerWhere = opts.owner ? ` WHERE owner = ${p(opts.owner)}` : "";
+        const innerWhere = opts.owner !== undefined ? ` WHERE owner = ${p(opts.owner)}` : ""; // "" is a valid exact owner, not "no filter" (B10)
         const outer = ["rn = 1"];
         // `?q=` — the PG twin of the TiDB EXISTS predicate above.
         if (opts.q)

package/dist/plugins/store-backend.d.ts

@@ -144,7 +144,7 @@ export interface StoreBackend {
     /** P1 (fleet failover): durable cross-replica WorkflowRunStore + completion-inbox twins. OPTIONAL —
      *  SQL backends only (local keeps the File pair: single box, no cross-replica surface). main.ts prefers
      *  these under WORKFLOW_RUN_STORE=auto (the default). */
-    workflowRun?(): import("@sema-agent/core").WorkflowRunStore;
+    workflowRun?(onWarn?: InboxWarn): import("@sema-agent/core").WorkflowRunStore;
     completionInbox?(onWarn?: InboxWarn): import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox;
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */

package/dist/plugins/store-backend.js

@@ -113,7 +113,7 @@ class TiDBBackend {
     fileSnapshot() { return new TiDBFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "tidb", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new TiDBWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
@@ -147,7 +147,7 @@ class PgBackend {
     fileSnapshot() { return new PgFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "pg", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new PgWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }

package/dist/plugins/tool-result-store-sql.d.ts

@@ -29,7 +29,13 @@ export declare class SqlToolResultStore implements ToolResultStore {
         offset?: number;
         limit?: number;
     }): Promise<ToolResultSlice | undefined>;
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     reapOlderThan(cutoffMs: number): Promise<number>;
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/tool-result-store-sql.js

@@ -123,15 +123,16 @@ export class SqlToolResultStore {
             return undefined; // unknown ref (e.g. reaped) → core reports "no longer available"
         return { content: String(rows[0].slice ?? ""), offset, totalChars: Number(rows[0].total) };
     }
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     async reapOlderThan(cutoffMs) {
-        try {
-            const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
-            return affected;
-        }
-        catch {
-            return 0; // best-effort reaper — never throw into the loop
-        }
+        const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
+        return affected;
     }
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -79,10 +79,13 @@ export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;
 }, maxBytes: number): string | null;
-/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger. */
+/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger.
+ *  `onWarn` (optional, same shape as the completion-inbox's {@link InboxWarn}) is the C5 trace channel for
+ *  `update`'s oversize-slim degrade (see there) — omit it and construction/behavior is unchanged (additive). */
 export declare class SqlWorkflowRunStore implements WorkflowRunStore {
     protected readonly db: SqlDriver;
-    constructor(db: SqlDriver);
+    private readonly onWarn?;
+    constructor(db: SqlDriver, onWarn?: InboxWarn | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     put(id: string, run: WorkflowRun): Promise<void>;
@@ -145,9 +148,10 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
-/** MySQL-protocol (TiDB) bindings — historical class names + ctor shapes preserved. */
+/** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
+ *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, onWarn?: InboxWarn);
 }
 export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: MySqlPool, onWarn?: InboxWarn);
@@ -155,9 +159,10 @@ export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionIn
 export declare class TiDBWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: MySqlPool);
 }
-/** PostgreSQL bindings — historical class names + ctor shapes preserved. */
+/** PostgreSQL bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd ctor arg
+ *  (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class PgWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, onWarn?: InboxWarn);
 }
 export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: PgPool, onWarn?: InboxWarn);