@sema-agent/server 7.112.0 → 7.114.0

package/dist/orchestration/workflow-notify-journal.js

@@ -177,12 +177,12 @@ export class FileWorkflowNotifyJournalStore {
     ledgerPath;
     entries = new Map();
     log;
-    constructor(root, fsyncEnabled = true, warn) {
+    constructor(root, fsyncEnabled = true) {
         this.fsyncEnabled = fsyncEnabled;
         const dir = join(root, "workflow-notify");
         ensureDir(dir);
         this.ledgerPath = join(dir, "journal.jsonl");
-        for (const ev of replayJsonlSkipping(this.ledgerPath, "workflow-notify-journal", JOURNAL_ENTRY_SHAPE, warn).records)
+        for (const ev of replayJsonlSkipping(this.ledgerPath, "workflow-notify-journal", JOURNAL_ENTRY_SHAPE).records)
             this.entries.set(ev.runId, ev);
     }
     commit(entry) {

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,4 +1,3 @@
-import type { Logger } from "../observability/logger.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /** 数据根下的目录名。**按店命名**,与兄弟 File 店同规(`approval-nonces` / `approval-ask-audit` /
@@ -121,9 +120,7 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      *
      * @param root local 数据根(= `LocalBackend` 的 `FileStorageBackend.root`,零新 env)。
      */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     /**
      * 内核的钟。窗口外读 ⇒ **抛**(不静默回落 `Date.now()`):窗口外的读数按定义不在账本上,重放会得出
      * 另一个时间戳 —— 那是一条**静默**的重放分岔,而本店的全部价值就是重放等价。今天内核的五个读钟点

package/dist/plugins/approval-ask-store-file.js

@@ -54,7 +54,7 @@ export class FileApprovalAskStore {
     replayRejectedCount = 0;
     corruptLineCount = 0;
     corruptQuarantinePath;
-    constructor(root, opts) {
+    constructor(root) {
         const dir = join(root, APPROVAL_ASK_DIR);
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
@@ -62,7 +62,7 @@ export class FileApprovalAskStore {
         this.path = join(dir, APPROVAL_ASK_JOURNAL_FILE);
         this.core = new InMemoryApprovalAskStore({ now: () => this.clockRead() });
         const tornTail = existsSync(this.path) && !endsAtRecordBoundary(this.path);
-        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE, opts?.warn);
+        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE);
         this.corruptLineCount = skipped;
         for (const rec of records)
             this.replayRecord(rec);

package/dist/plugins/file-resume-anchor-store.d.ts

@@ -1,15 +1,10 @@
-import type { Logger } from "../observability/logger.js";
 export declare class FileResumeAnchorStore {
     private readonly dir;
     /** sessionId → (eventId → {entryId, owner}) — the same in-memory shape MemoryResumeAnchorStore holds, hydrated on ctor. */
     private readonly bySession;
     /** sessionId → the open append log (one O_APPEND fd per session, lazily opened on first put, held for lifetime). */
     private readonly logs;
-    private readonly warn;
-    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     /** `<dir>/<sanitizePathComponent(sessionId)>.jsonl` — the per-session log path (sessionId is uuidv7, already safe). */
     private pathFor;
     /** Replay every session log into the in-memory index on boot (torn-tail-safe via the replay owner; last-wins upsert

package/dist/plugins/file-resume-anchor-store.js

@@ -16,10 +16,8 @@ export class FileResumeAnchorStore {
     dir;
     bySession = new Map();
     logs = new Map();
-    warn;
-    constructor(root, opts) {
+    constructor(root) {
         this.dir = join(root, "resume-anchors");
-        this.warn = opts?.warn;
         ensureDir(this.dir);
         this.hydrate();
     }
@@ -38,7 +36,7 @@ export class FileResumeAnchorStore {
             if (!name.endsWith(".jsonl"))
                 continue;
             const key = name.slice(0, -".jsonl".length);
-            const { records } = replayJsonlSkipping(join(this.dir, name), "resume-anchor", ANCHOR_RECORD_SHAPE, this.warn);
+            const { records } = replayJsonlSkipping(join(this.dir, name), "resume-anchor", ANCHOR_RECORD_SHAPE);
             if (!records.length)
                 continue;
             const m = this.bySession.get(key) ?? new Map();

package/dist/plugins/file-run-store.d.ts

@@ -1,6 +1,5 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import type { Logger } from "../observability/logger.js";
 import { StoreBootRefusalError, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
@@ -46,12 +45,9 @@ export declare class FileRunStore {
     /** [ref] 件B(census 第 29 行终局):`RUN_STORE_STRICT_HYDRATE` 的**部署级**表态。
      *  `true` ⇒ hydrate 的 readdir 失败拒启;缺席/`false` ⇒ 件6 的记债腿,行为字节不变。 */
     private readonly strictHydrate;
-    /** S-582:三个盘面坏行的腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 重放属主退回 `console.warn`)。 */
-    private readonly corruptReadWarn;
     constructor(root: string, opts?: {
         error?(msg: string, fields?: Record<string, unknown>): void;
         strictHydrate?: boolean;
-        warn?: Logger["warn"];
     });
     private runDir;
     private runJsonPath;

package/dist/plugins/file-run-store.js

@@ -62,11 +62,9 @@ export class FileRunStore {
     claimLocks = new Map();
     logger;
     strictHydrate;
-    corruptReadWarn;
     constructor(root, opts) {
         this.logger = opts;
         this.strictHydrate = opts?.strictHydrate === true;
-        this.corruptReadWarn = opts?.warn;
         this.runsDir = join(root, "runs");
         this.activeDir = join(root, "runs", "active");
         this.tmpDir = join(root, "tmp");
@@ -137,7 +135,7 @@ export class FileRunStore {
         }
     }
     readRecords(path, shape) {
-        return replayJsonlSkipping(path, "run-store", shape, this.corruptReadWarn);
+        return replayJsonlSkipping(path, "run-store", shape);
     }
     refuseIfUnreadable(jsonPath, dir) {
         try {

package/dist/plugins/remote-env-host.d.ts

@@ -419,39 +419,4 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
  */
 export declare function hostExecutionEnvFactory(config?: HostEnvConfig): ExecutionEnvFactory;
 export { localDockerExecutionEnvFactory, type LocalDockerEnvConfig, type LocalDockerEnvDeps, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-import { type LocalDockerEnvConfig, type LocalDockerEnvDeps } from "./remote-env-local-docker.js";
-/**
- * Config for the `remote-docker` provider: run each task in a container on a REMOTE docker daemon
- * (DUAL-MODE-DESIGN §5 — "a user-specified REMOTE host's docker"; registry-core `RemoteExecSpec`).
- *
- * It is {@link LocalDockerEnvConfig} with the endpoint made REQUIRED — that is the whole difference, by design:
- * the container adapter is already daemon-agnostic (workspace `mkdir`'d INSIDE the container, never a host
- * bind-mount; bytes over `docker cp` / `docker exec cat`, which stream through the daemon API), and the endpoint
- * rides as `-H <dockerHost>` on every invocation. So every local-docker knob (memory/cpus/pidsLimit/dropAllCaps/
- * network/timeouts/env/dockerPath) applies unchanged to the remote lane.
- */
-export interface RemoteDockerEnvConfig extends Omit<LocalDockerEnvConfig, "dockerHost" | "providerLabel"> {
-    /** Remote docker daemon endpoint (e.g. `tcp://host:2376` or `ssh://user@host`). REQUIRED for remote-docker. */
-    dockerHost: string;
-}
-/**
- * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
- * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
- * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
- *
- * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
- * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
- * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
- * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
- * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
- * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
- * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
- * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
- * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
- * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
- *
- * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
- * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
- */
-export declare function remoteDockerExecutionEnvFactory(config: RemoteDockerEnvConfig, deps?: LocalDockerEnvDeps): ExecutionEnvFactory;
 //# sourceMappingURL=remote-env-host.d.ts.map

package/dist/plugins/remote-env-host.js

@@ -1373,12 +1373,4 @@ export function hostExecutionEnvFactory(config = {}) {
     });
 }
 export { localDockerExecutionEnvFactory, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
-import { localDockerExecutionEnvFactory } from "./remote-env-local-docker.js";
-export function remoteDockerExecutionEnvFactory(config, deps = {}) {
-    const dockerHost = config.dockerHost?.trim();
-    if (!dockerHost) {
-        throw new RemoteExecutionError("connect_failed", "remoteExec provider 'remote-docker' requires a non-empty dockerHost (the remote daemon endpoint, e.g. tcp://host:2376 or ssh://user@host) — use provider 'local-docker' for THIS machine's daemon");
-    }
-    return localDockerExecutionEnvFactory({ ...config, dockerHost, providerLabel: "remote-docker" }, deps);
-}
 //# sourceMappingURL=remote-env-host.js.map

package/dist/plugins/remote-env-local-docker.d.ts

@@ -27,19 +27,13 @@ export interface LocalDockerEnvConfig {
      * DOCKER_HOST override for the docker CLI (e.g. a non-default socket). Passed as `-H <value>` on EVERY docker
      * invocation (not the process env) so it can't leak / drift. Absent = the daemon DOCKER_HOST points at.
      *
-     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is exactly the DUAL-MODE-DESIGN §5
-     * **`remote-docker`** provider — see {@link remoteDockerExecutionEnvFactory} (remote-env-host.ts), which is
-     * this adapter with the endpoint required. Nothing else about the class is host-local: the workspace is
-     * `mkdir`'d INSIDE the container (never a bind-mount of a host path) and bytes move by `docker cp` /
-     * `docker exec cat`, which stream over the daemon API.
+     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is how a REMOTE docker daemon is used — the
+     * lane stays `local-docker` (`REMOTE_EXEC=local-docker` + `DOCKER_HOST`; the settings-schema lane table lists
+     * `DOCKER_HOST` as this lane's optional coordinate, and there is no separate `remote-docker` lane since 7.0.0).
+     * Nothing about the class is host-local: the workspace is `mkdir`'d INSIDE the container (never a bind-mount of a
+     * host path) and bytes move by `docker cp` / `docker exec cat`, which stream over the daemon API.
      */
     dockerHost?: string;
-    /**
-     * Provider NAME reported on the {@link WorkspaceHandle}. Default `"local-docker"`; the `remote-docker` arm
-     * passes `"remote-docker"` so a handle never mislabels which lane it is (the CLASS is shared — `remote-docker`
-     * IS this adapter aimed at a remote daemon). Cosmetic/observability only: it selects no behavior.
-     */
-    providerLabel?: string;
     /** Container memory limit (docker `--memory`, e.g. "2g"). Absent = no limit. */
     memory?: string;
     /** Container CPU limit (docker `--cpus`, e.g. 1.5). Absent = no limit. */
@@ -88,8 +82,6 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     private readonly spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     private readonly containerName;
-    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
-    private readonly providerName;
     /** Set once the container is up + the workspace dir created. */
     private containerId?;
     private handle?;

package/dist/plugins/remote-env-local-docker.js

@@ -24,7 +24,6 @@ export class RemoteLocalDockerExecutionEnv {
     cfg;
     spawnFn;
     containerName;
-    providerName;
     containerId;
     handle;
     destroyed = false;
@@ -47,7 +46,6 @@ export class RemoteLocalDockerExecutionEnv {
         const id = config.id ?? randomBytes(6).toString("hex");
         const suffix = randomBytes(4).toString("hex");
         this.containerName = `sema-docker-${sanitizeId(id)}-${suffix}`;
-        this.providerName = config.providerLabel?.trim() || PROVIDER;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
@@ -113,7 +111,7 @@ export class RemoteLocalDockerExecutionEnv {
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env destroyed during connect") };
         }
         this.containerId = run.value.stdout.trim() || this.containerName;
-        this.handle = { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+        this.handle = { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
         if (config?.secrets?.length) {
         }
         return ok(this.handle);
@@ -136,7 +134,7 @@ export class RemoteLocalDockerExecutionEnv {
         const insp = await this.docker(["inspect", "-f", "{{.State.Running}}", this.containerName], { timeoutMs: this.cfg.controlTimeoutMs });
         if (insp.ok && insp.value.exitCode === 0 && insp.value.stdout.trim() === "true") {
             this.containerId = this.containerName;
-            this.handle ??= { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+            this.handle ??= { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
             return ok(this.handle);
         }
         return { ok: false, error: new RemoteExecutionError("connect_failed", `container '${this.containerName}' is not running (gone or stopped) — no managed snapshot to resume`) };

package/dist/plugins/send-file-ledger.d.ts

@@ -1,7 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import type { IssuedFileLink } from "./send-user-file.js";
-import type { Logger } from "../observability/logger.js";
 /** Ledger scope sentinel for single-user issuance (no principal) — mirrors scopeSegment's "_" key segment. */
 export declare const SENDFILE_SINGLE_USER_SCOPE = "_";
 export interface SendFileLedgerEntry {
@@ -48,10 +47,7 @@ export declare class FileSendFileLedger implements SendFileLedger {
     private readonly path;
     private readonly mem;
     private log;
-    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     record(entry: SendFileLedgerEntry): Promise<void>;
     listByScope(scope: string, limit: number, beforeId?: string): Promise<SendFileLedgerEntry[]>;
     /** Release the append-log fd (LocalBackend.close → graceful-restart re-open). */

package/dist/plugins/send-file-ledger.js

@@ -80,11 +80,11 @@ export class FileSendFileLedger {
     path;
     mem = new MemorySendFileLedger();
     log;
-    constructor(root, opts) {
+    constructor(root) {
         const dir = join(root, "sendfile-ledger");
         ensureDir(dir);
         this.path = join(dir, "links.jsonl");
-        for (const r of replayJsonlSkipping(this.path, "send-file-ledger", LEDGER_ROW_SHAPE, opts?.warn).records)
+        for (const r of replayJsonlSkipping(this.path, "send-file-ledger", LEDGER_ROW_SHAPE).records)
             void this.mem.record(r);
     }
     async record(entry) {

package/dist/plugins/store-backend.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { buildDurableAbsenceNote, createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
+import { createCorruptReadFailOpenSeat, createDurableAbsenceSeat } from "../observability/corrupt-read-seat.js";
 import { join } from "node:path";
 import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
@@ -230,7 +230,7 @@ class LocalBackend {
             this.fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
                 root,
                 ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-                onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "file_store_corrupt_read", buildDurableAbsenceNote("file-history = a rewind boundary or scope read as missing")),
+                onCorruptRead: createDurableAbsenceSeat((msg, fields) => this.discloseWarn(msg, fields), root, "file-history = a rewind boundary or scope read as missing"),
             }), config.storeLockWaitMs, (fields) => this.onWarn?.("store_dir_lock_wait", { ...fields }));
         }
         catch (e) {
@@ -241,22 +241,21 @@ class LocalBackend {
                 (tail === undefined ? "" : ` ${tail}`));
         }
         this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root, {
-            onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "session_repo_corrupt_read", undefined, noteReplayInSessionOpenScope),
+            onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInSessionOpenScope),
         }), this.fileBackend.root);
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
-            warn: corruptReadWarn,
         });
-        this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root, { warn: corruptReadWarn });
+        this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
         this.approvalExemptionStore = new FileApprovalExemptionStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.approvalNonceStore = new FileApprovalNonceStore(this.fileBackend.root, { warn: corruptReadWarn });
-        this.approvalAskStore = new FileApprovalAskStore(this.fileBackend.root, { warn: corruptReadWarn });
-        this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root, { warn: corruptReadWarn });
-        this.userInputLedgerStore = new FileUserInputLedgerStore(this.fileBackend.root, { warn: corruptReadWarn });
+        this.approvalAskStore = new FileApprovalAskStore(this.fileBackend.root);
+        this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root);
+        this.userInputLedgerStore = new FileUserInputLedgerStore(this.fileBackend.root);
         this.workflowJournalStore = new FileWorkflowJournalStore(this.fileBackend.root, undefined, {
-            onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "workflow_journal_corrupt_read"),
+            onCorruptRead: createCorruptReadFailOpenSeat("server.workflow-journal.corrupt-record-skipped"),
         });
         this.outcomeSinkInst = new FileOutcomeSink(this.fileBackend.root);
         const ownControlDir = fileMemoryControlDirFor(config);

package/dist/plugins/user-input-ledger-file.d.ts

@@ -1,4 +1,3 @@
-import type { Logger } from "../observability/logger.js";
 import { UserInputLedgerFold, type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerRecord, type UserInputLedgerStore } from "../user-input-ledger.js";
 /** 账本文件名(取证按文件字节对账 —— 崩溃语义的真源是文件)。 */
 export declare const USER_INPUT_LEDGER_FILE = "ledger.jsonl";
@@ -24,10 +23,7 @@ export declare class FileUserInputLedgerStore extends MemoryUserInputLedgerStore
     /** 账本绝对路径。 */
     readonly path: string;
     private log;
-    /** @param opts.warn 腐读披露座(缺席 ⇒ 重放属主退回 `console.warn`)。 */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     protected persist(rec: UserInputLedgerRecord): void;
     /** 收追加口(LocalBackend.close → 优雅重启重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
     dispose(): void;

package/dist/plugins/user-input-ledger-file.js

@@ -88,12 +88,12 @@ const RECORD_SHAPE = {
 export class FileUserInputLedgerStore extends MemoryUserInputLedgerStore {
     path;
     log;
-    constructor(root, opts) {
+    constructor(root) {
         super();
         const dir = join(root, USER_INPUT_LEDGER_DIR);
         ensureDir(dir);
         this.path = join(dir, USER_INPUT_LEDGER_FILE);
-        for (const rec of replayJsonlSkipping(this.path, "user-input-ledger", RECORD_SHAPE, opts?.warn).records)
+        for (const rec of replayJsonlSkipping(this.path, "user-input-ledger", RECORD_SHAPE).records)
             this.fold.apply(rec);
     }
     persist(rec) {

package/dist/run-local.d.ts

@@ -142,7 +142,7 @@ export interface LocalApproverIo {
  *  · **人答 N**(TTY 臂)⇒ 裸 `false` —— core 契约里这就是「一个人拒了」(`human_refused` / `who.party:"person"`,模型读「用户不想继续,
  *    停下来等他」,run 以 `haltedOnUserRejection` 停批);
  *  · **没有人被问**(无 TTY 臂 / 参数展示不出臂)⇒ 部署政策拒对象 {@link UnattendedPolicyRefusal}(经与协调器 deny 政策臂**同一只**构造
- *    `buildUnattendedPolicyRefusal`;core 7.37.1 `readApproverOutcomeObject` ⇒ `policy_refused` / `who.party:"none"`,模型读 core 的
+ *    `buildUnattendedPolicyRefusal`;core `readApproverOutcomeObject` ⇒ `policy_refused` / `who.party:"policy"`(core 7.39.0 #1265 起;此前 `"none"`),模型读 core 的
  *    策略句 + 本席的拒因,不停批)。修前两臂交裸 `false` ⇒ 机器的拒被记成人拒、模型被告知去等一个不存在的人。
  *  两臂的拒都经 `io.noteRefusedWithoutPerson` 报一次 —— 「活没干完」(退 1)此前搭的是 core 人拒标记的便车,S-956 之后由本席的事实给。
  */

package/dist/run-local.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
-import { buildDurableAbsenceNote, createCorruptReadSeat } from "./observability/corrupt-read-seat.js";
+import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
@@ -351,7 +351,7 @@ export async function runLocal(argv, deps = {}) {
         fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
             root,
             ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-            onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "file_store_corrupt_read", buildDurableAbsenceNote("file-snapshot = a snapshot or scope read as missing")),
+            onCorruptRead: createDurableAbsenceSeat(logger.warn.bind(logger), root, "file-snapshot = a snapshot or scope read as missing"),
         }), config.storeLockWaitMs, (fields) => logger.warn("store_dir_lock_wait", { ...fields }));
     }
     catch (e) {

package/dist/runs.js

@@ -369,6 +369,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     causeAtDone = cancelCtrl.cause();
                 }
                 fleetPublisher?.onEvent(ev);
+                await userInputLedger?.observeLegEvent(stream, ev);
                 await flushPromptManifest();
                 switch (ev.type) {
                     case "text_delta":

package/dist/spec-fields.js

@@ -37,7 +37,6 @@ export function normalizeAttachments(v) {
     const out = {
         ...(o.todoReminder === true ? { todoReminder: true } : {}),
         ...(changedFiles !== undefined ? { changedFiles } : {}),
-        ...(o.planModeReminder === true ? { planModeReminder: true } : {}),
         ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
         ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
         ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),

package/dist/store-posture.d.ts

@@ -12,7 +12,7 @@
  * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
  * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
  */
-import { type DbBackendWord } from "./config-types.js";
+import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
@@ -25,23 +25,23 @@ import { type SqlEngineCapability } from "./sql-engine-posture.js";
 export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
 export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
 /** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
-export declare function storeDegradedReasonFor(declared: DbBackendWord): StoreDegradedReason;
+export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
 /** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
 export interface StorePosture {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly degradedReason?: StoreDegradedReason;
 }
 /** `build*`(纯数据)。`assembled` = 装配出的 `StoreBackend.kind`;缺席 = 没装出后端 ⇒ `memory`。 */
 export declare function buildStorePosture(a: {
-    readonly declared: DbBackendWord;
+    readonly declared: StoreBackendWord;
     readonly assembled: StoreBackend["kind"] | undefined;
     readonly degradedReason: StoreDegradedReason | undefined;
 }): StorePosture;
 /** caps `store` 的形。 */
 export interface StoreCapability {
-    readonly declared: DbBackendWord;
-    readonly backend: DbBackendWord;
+    readonly declared: StoreBackendWord;
+    readonly backend: StoreBackendWord;
     readonly durable: boolean;
     readonly degradedReason?: StoreDegradedReason;
     /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出

package/dist/store-posture.js

@@ -1,4 +1,3 @@
-import {} from "./config-types.js";
 import { projectSqlEngineCapability } from "./sql-engine-posture.js";
 export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
 export function storeDegradedReasonFor(declared) {

package/dist/task-settings.d.ts

@@ -298,6 +298,19 @@ export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["addit
  *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
  */
 export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | null;
+/**
+ * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
+ * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
+ * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
+ *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
+ *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
+ * `test/hooks-alias-matcher-s995.test.ts` R5g 钉「三处都调它、没有内联判据」。
+ */
+export declare function taskHooksHonored(config: {
+    readonly requirePrincipal?: boolean;
+}): boolean;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
  * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE

package/dist/task-settings.js

@@ -158,6 +158,9 @@ export function taskSettingsKeyIssue(raw) {
         unsupportedKeys: unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+export function taskHooksHonored(config) {
+    return config.requirePrincipal !== true;
+}
 export function parseTaskSettings(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };

package/dist/tool-approval.d.ts

@@ -821,7 +821,7 @@ export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
 export type UnattendedApprovalPolicy = "park" | "deny";
 /**
  * S-689 —— `deny` 政策下「无人可答」交给 core 的形:core `AskOutcome` 对象臂的**部署政策拒**
- * (`settledBy:"policy"` ⇒ core 结算 `policy_refused`、`who.party:"none"`,模型读的是策略句)。
+ * (`settledBy:"policy"` ⇒ core 结算 `policy_refused`、`who.party:"policy"`(core 7.39.0 #1265 起;此前 `"none"`),模型读的是策略句)。
  *
  * 修前这里交**裸 `false`** —— 而在 core 的 onAsk 契约里裸 `false` 就是「一个人拒了」:结算记
  * `human_refused` / `who.party:"person"`,模型被告知「用户不想继续,停下来等他」,run 以

package/dist/trace/core-keyset-guard.d.ts

@@ -146,7 +146,7 @@ type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueue
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, isPersistedRuleMandate, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, isPersistedRuleMandate, isSettlementParty, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -221,11 +221,10 @@ export function screenedStoredEventData(type, data) {
     }
     return { ...d, gate };
 }
-const SETTLEMENT_PARTIES = new Set(["person", "engine", "host", "none"]);
 function projectSettlement(st) {
     const whoV = st.who;
     const partyV = whoV === null || typeof whoV !== "object" ? undefined : whoV.party;
-    if (typeof partyV !== "string" || !SETTLEMENT_PARTIES.has(partyV))
+    if (!isSettlementParty(partyV))
         return undefined;
     const who = whoV;
     return {

package/dist/trace/redact.d.ts

@@ -133,6 +133,24 @@ export declare function redactSecretsWithArms(text: string, opts?: {
     text: string;
     arms: ReadonlySet<RedactionArm>;
 };
+/**
+ * 🧪 **跨度出口 —— 只给测试**(车 UH 脱敏基线门 `test/redaction-baseline-gate.test.ts`:判「必隐字节**每一个**都被盖住」,
+ * 而不是「必隐串整串不在」—— 后者对截断式脱敏(值的前缀被洗、尾段留着)恒判已藏,gpt-6 腿 r1-F1 [high])。
+ *
+ * 同一只 {@link runRedaction}、同一遍扫描,原样交出池已经算好的 `kept` 跨度(S-497 那一份;坐标在**归一化视图**上),
+ * 不是第二只脱敏器、不改任何判据、不喂观察者(`observe:false`,与影子重扫同口);`opts.json` 与 {@link redactSecrets} 的同名选项
+ * 逐字同义(JSON 模式,`redactedPreview` 走的那一条)。生产代码不调用它:
+ * 问「有没有凭据形」的消费方走 {@link redactSecretsWithArms}。
+ */
+export declare function redactionSpansForTest(text: string, opts?: {
+    json?: boolean;
+}): {
+    text: string;
+    spans: ReadonlyArray<{
+        readonly start: number;
+        readonly end: number;
+    }>;
+};
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是
  * **最不可信的边界**:`toolStart`/`toolEnd` 把工具的 `args`/`output`/`structured` 直接喂进来。后果两条:

package/dist/trace/redact.js

@@ -1791,6 +1791,10 @@ export function redactSecretsWithArms(text, opts) {
     const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true, "free-text");
     return { text: r.text, arms: new Set(r.hits.map((h) => h.arm)) };
 }
+export function redactionSpansForTest(text, opts) {
+    const r = runRedaction(text, false, opts?.json === true, false, "free-text");
+    return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
+}
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
     return redactDeepInner(value, 0, new WeakSet());