@sema-agent/server 7.117.0 → 7.119.0

package/dist/bake-runner/main.js

@@ -73,12 +73,7 @@ function makeApiClient(env, log) {
                 body: JSON.stringify(frame),
                 signal: AbortSignal.timeout(BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS),
             });
-            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
-            return {
-                accepted: res.ok && body.accepted !== false,
-                cancelRequested: body.cancelRequested === true,
-                leaseValid: res.status !== 409,
-            };
+            await res.arrayBuffer().catch(() => undefined);
         },
         async heartbeat(bakeId, ingestSecret) {
             const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {

package/dist/bake-runner/protocol.d.ts

@@ -78,6 +78,11 @@ export declare function dockerBuildTickFrame(lineOrd: number, elapsedSec: number
 export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "timeout", detail?: {
     error?: string;
 }): IngestFrame;
+/**
+ * 失败尾巴的行数 —— **唯一**常量:缓冲({@link createStderrTail})保留这么多行,终局句({@link exitDoneFrame})取这么多行。
+ * 两处读同一个数,所以缓冲里「保留的」恒等于消费方「要的」:既没有消费方想要而已被丢掉的行,也没有永远用不上的行占内存。
+ */
+export declare const STDERR_TAIL_LINES = 12;
 /**
  * The runner-side terminal `done` for a build.sh CHILD that exited non-zero WITHOUT printing its own `done` (build.sh
  * normally dies via `die()` which DOES print a `done:FAILED`, but a SIGKILL or a crash before the trap can leave the
@@ -87,6 +92,19 @@ export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "tim
 export declare function exitDoneFrame(lineOrd: number, exitCode: number, stderrTail: string): IngestFrame;
 /** Keep only the last `n` lines of a (possibly long) stderr tail — bounds the error string we forward. */
 export declare function lastLines(text: string, n: number): string;
+/** 有界的 stderr 尾部缓冲:只保留**末** {@link STDERR_TAIL_LINES} 行(环形:新行进来、最老的出去)。 */
+export interface StderrTail {
+    /** 收一行(spawner 已按换行切好;这里仍按 {@link contentLines} 判据过一遍,空行不入)。 */
+    push(raw: string): void;
+    /** 当前保留的行,`\n` 连接;空缓冲 = 空串。可直接交 {@link exitDoneFrame}。 */
+    text(): string;
+}
+/**
+ * 修前缓冲是 `if (stderrTail.length < 80) push` —— 留的是**首** 80 行,而消费方({@link exitDoneFrame})要的是**末** 12 行:
+ * 超过 80 行的失败里,「尾巴」是前 80 行的末 12 行,真正的最后一行(失败原因所在)一个字也进不来。
+ * 现在留末 N 行;N = {@link STDERR_TAIL_LINES}。
+ */
+export declare function createStderrTail(): StderrTail;
 /**
  * The profile-aware HARD DEADLINE (§P2.7/§P2.11) the runner enforces by killing the process group. flutter/full are
  * the heavy profiles (~60min); everything else ~45min. A bands build ("custom") is treated as heavy if it includes

package/dist/bake-runner/protocol.js

@@ -33,6 +33,7 @@ export function synthDoneFrame(lineOrd, kind, detail) {
     }
     return { event: "done", lineOrd, status: "FAILED", exitCode: 124, error: detail?.error ?? "bake hard-deadline exceeded (killed)" };
 }
+export const STDERR_TAIL_LINES = 12;
 export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
     const tail = stderrTail.trim();
     return {
@@ -40,13 +41,32 @@ export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
         lineOrd,
         status: "FAILED",
         exitCode,
-        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, 12)}` : `build.sh exited ${exitCode}`,
+        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, STDERR_TAIL_LINES)}` : `build.sh exited ${exitCode}`,
     };
 }
+function contentLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((l) => l.replace(/\r$/, ""))
+        .filter((l) => l.length > 0);
+}
 export function lastLines(text, n) {
-    const lines = text.split(/\r?\n/).filter((l) => l.length > 0);
+    const lines = contentLines(text);
     return lines.slice(Math.max(0, lines.length - n)).join("\n");
 }
+export function createStderrTail() {
+    const lines = [];
+    return {
+        push(raw) {
+            for (const l of contentLines(raw)) {
+                lines.push(l);
+                if (lines.length > STDERR_TAIL_LINES)
+                    lines.shift();
+            }
+        },
+        text: () => lines.join("\n"),
+    };
+}
 export function deadlineMsForProfile(profile, bands) {
     const HEAVY_MS = 60 * 60 * 1000;
     const NORMAL_MS = 45 * 60 * 1000;

package/dist/bake-runner/runner.d.ts

@@ -11,10 +11,12 @@ export interface ClaimedBake {
     profile?: string | null;
     bands?: string[] | null;
 }
-/** The ingest/heartbeat response — image-api echoes whether a cancel was requested so the runner kills the group. */
-export interface IngestAck {
+/** The heartbeat response (a no-frame `…/ingest` POST) — image-api echoes whether a cancel was requested so the runner
+ *  kills the group, and whether the lease is still ours. The heartbeat is the ONE place these two bits are read
+ *  ({@link BakeRunner.runOne}'s supervisor); a frame ingest's ack has no reader, so `ingest` returns nothing. */
+export interface HeartbeatAck {
     accepted: boolean;
-    /** The durable cancel flag (§P2.11) — polled off EVERY ingest/heartbeat response (≤heartbeat-interval lag). */
+    /** The durable cancel flag (§P2.11) — read off each HEARTBEAT response (≤ heartbeat-interval lag). */
     cancelRequested?: boolean;
     /** False when the lease was lost/stolen (the runner aborts + kills the child — it no longer owns the build). */
     leaseValid?: boolean;
@@ -51,10 +53,11 @@ export interface ChildSpawner {
 export interface ImageApiClient {
     /** Long-poll for + claim the next queued bake; null when none is claimable right now. */
     claimNext(): Promise<ClaimedBake | null>;
-    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header); returns the ack (cancel/lease). */
-    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<IngestAck>;
-    /** Heartbeat the lease forward (also surfaces cancel/lease state) — distinct from a frame ingest. */
-    heartbeat(bakeId: string, ingestSecret: string): Promise<IngestAck>;
+    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header). Resolves with nothing: the runner reads no
+     *  ack off a frame ingest (the cancel / lease bits are read off {@link ImageApiClient.heartbeat} only). */
+    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<void>;
+    /** Heartbeat the lease forward and surface the cancel / lease state — the only call whose response the runner reads. */
+    heartbeat(bakeId: string, ingestSecret: string): Promise<HeartbeatAck>;
 }
 /** Host-side ops the runner needs that are NOT image-api calls (fs + a thin docker-push wrapper for the big-blob
  *  retry — NOT a build.sh --replay). All injected so the orchestration is testable off build-host. */
@@ -208,7 +211,8 @@ export declare class BakeRunner {
      *  reaper + a mid-build fill guard still protect the host). */
     private freeGbOrNull;
     /** Ingest one frame, swallowing transient errors (the buffered-retry of unsent lines is the real-runner's job;
-     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). */
+     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). Returns nothing:
+     *  the cancel / lease bits are read off the heartbeat response only, never off a frame ingest's ack. */
     private safeIngest;
 }
 /** Allocate the next per-bake lineOrd (monotonic from 1) — the at-least-once ingest dedupe key (§P2.10). */

package/dist/bake-runner/runner.js

@@ -1,5 +1,5 @@
 import { resolve as resolvePath } from "node:path";
-import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, } from "./protocol.js";
+import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, createStderrTail, } from "./protocol.js";
 const DEFAULT_HEARTBEAT_MS = 30_000;
 const DEFAULT_IDLE_POLL_MS = 5_000;
 const DEFAULT_MIN_FREE_GB = 20;
@@ -137,7 +137,7 @@ export class BakeRunner {
             await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), 1, `recipe checkout failed: ${String(err)}`));
             return;
         }
-        const stderrTail = [];
+        const stderrTail = createStderrTail();
         let lastManifestPath = null;
         let lastImageTag = null;
         let sawDone = false;
@@ -166,10 +166,7 @@ export class BakeRunner {
                 }
                 enqueueIngest(lineToFrame(raw, nextOrd(ord)));
             },
-            onStderrLine: (raw) => {
-                if (stderrTail.length < 80)
-                    stderrTail.push(raw);
-            },
+            onStderrLine: (raw) => stderrTail.push(raw),
         });
         inFlight.child = child;
         const deadlineMs = deadlineMsForProfile(bake.profile ?? "custom", bake.bands ?? null);
@@ -230,7 +227,7 @@ export class BakeRunner {
             return;
         }
         const code = exit.code ?? (exit.signal ? 137 : 1);
-        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.join("\n")));
+        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.text()));
     }
     async forwardDone(bake, ord, doneLine, lastManifestPath, lastImageTag) {
         let line = doneLine;
@@ -309,11 +306,10 @@ export class BakeRunner {
     }
     async safeIngest(bake, frame) {
         try {
-            return await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
+            await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
         }
         catch (err) {
             this.o.log.warn("bake_ingest_error", { bakeId: bake.bakeId, lineOrd: frame.lineOrd, err: String(err) });
-            return null;
         }
     }
 }

package/dist/boot/config-center.js

@@ -624,7 +624,7 @@ export async function createConfigCenterRuntime(ctx) {
             if (effective?.skills && config.configCenter) {
                 skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
             }
-            if (effective?.plugins) {
+            if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,

package/dist/boot/coordinators.js

@@ -1,6 +1,7 @@
 import { ElicitationCoordinator } from "../elicitation.js";
 import { QuestionCoordinator } from "../question.js";
 import { ToolApprovalCoordinator, resolveStreamApprovalGate } from "../tool-approval.js";
+import { deploymentListAsks } from "../approval.js";
 import { FileApprovalAskAuditStore } from "../approval-ask-audit-store.js";
 import { SendUserFileEmitter, SEND_USER_FILE_MAX_BYTES, sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { createSandboxFileSend, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
@@ -58,7 +59,9 @@ export function createLiveCoordinators(ctx) {
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(getParkedRedeem !== undefined ? { parkedRedeem: getParkedRedeem } : {}),
             ...(approvalAskAudit !== undefined ? { askAudit: approvalAskAudit } : {}),
-            ...(approvalExemptionStore !== undefined ? { sessionGrants: approvalExemptionStore } : {}),
+            ...(approvalExemptionStore !== undefined
+                ? { sessionGrants: approvalExemptionStore, deploymentListAsks: (call) => deploymentListAsks(config, call) }
+                : {}),
             ...(parkCommits !== undefined ? { parkCommits } : {}),
         })
         : undefined;

package/dist/boot/device-lane.d.ts

@@ -59,9 +59,9 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * `boot/leader.ts` 的 `assertLeaderDurableStore`)。
  *
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
- * 拿到**了店吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto` 下(🔴 S-866 注改真:`auto` **不是**缺省 ——
- * 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动。那次启动里 device lane 的四表整个不在,
+ * 拿到**了店吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto` 下,SQL 连不上 /
+ * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,见 `plugins/store-open-wait.ts`;
+ * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的四表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。
  * 那正是 [ref]「执行车道禁静默降级」点名的样板病,也正是 A-1 那条临时门当初要拦的东西 —— 换执法点,

package/dist/boot/device-lane.js

@@ -40,8 +40,7 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
         return;
     if (!lane) {
         throw new Error("REMOTE_EXEC=device but the device lane could not be wired at boot [device-lane-unwired]: the SQL backend is " +
-            "configured yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback " +
-            "when SESSION_BACKEND=auto), so the device registry / session↔device binding / audit tables are absent. " +
+            "configured yet this replica did not get one, so the device registry / session↔device binding / audit tables are absent. " +
             "Refusing to serve a lane that would silently fall back to the in-process stub env — a worker claiming to " +
             "execute on the employee's device while actually running inside its own process (#157). Fix the database " +
             "(or unset REMOTE_EXEC) and restart (device-executor-lane-v2 §4.7)");

package/dist/boot/leader.d.ts

@@ -64,10 +64,10 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  * [ref] 车4 件2 的**能力面**门(codex 交叉复审 R1-high①,验真后修)。
  *
  * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
- * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`
- * 下(🔴 S-866 注改真:`auto` **不是**缺省 —— 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
- * `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
+ * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto`
+ * 下,SQL 连不上 / 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,
+ * 见 `plugins/store-open-wait.ts`)。仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`(声明 pg、刻意不持久 ⇒ 不开店)。
+ * 那次启动里 `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
  * 跨副本 GET 404、重启失忆 —— 而这条腿的产物是**真 git push**。
  *
  * ⇒ 判据锚**真拿到了没有**。纯谓词、只吃两个原语(与 {@link leaderK8sMinioGap} 同姿势),便于单测。

package/dist/boot/leader.js

@@ -15,8 +15,7 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
     if (!leaderEnabled || hasLeaderRunStore)
         return;
     throw new Error("LEADER_ENABLED=true but no durable leader-run store is available at boot — the SQL backend is configured " +
-        "yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback when " +
-        "SESSION_BACKEND=auto). Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
+        "yet this replica did not get one. Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
         "the `leader_run` table is what makes a retried submit idempotent and a cross-replica GET answerable, and " +
         "without it a retry starts a SECOND real git push. Fix the database (or unset LEADER_ENABLED) and restart " +
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");

package/dist/boot/parked-revive-gate.d.ts

@@ -3,6 +3,7 @@ import type { ServiceConfig } from "../config.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
 import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
     readonly remoteExec?: ServiceConfig["remoteExec"];
@@ -11,10 +12,6 @@ export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigVi
     /** host 腿裁决 env 的 cwd 占位根(见下方 `hostGateCwd`)。 */
     readonly localDataRoot?: ServiceConfig["localDataRoot"];
 }
-/** 会话豁免探针店的所需切面(canonical toolName 键空间;`StoreBackend.approvalExemption()` 结构满足)。 */
-export interface ApprovalExemptionProbe {
-    has(sessionId: string, toolName: string): Promise<boolean>;
-}
 export interface ParkedReviveGateDeps {
     /** ⚠️ **活引用**:热改字段(autonomy/commandPolicy/守卫集/审批四旋钮)每次赎回现读,见下方「禁 memoize」。 */
     readonly config: ParkedReviveGateConfigView;
@@ -47,7 +44,8 @@ export interface ParkedReviveGateDeps {
      *    headless auto-deny,比「再问人一次」严且哑。交了之后最坏也是 park,方向 fail-safe。
      */
     readonly approverSeat: RunnerDepsOnAsk | undefined;
-    readonly approvalExemptionStore: ApprovalExemptionProbe | undefined;
+    /** 会话豁免店(部署名单那一问的「本会话放行」读面;`StoreBackend.approvalExemption()` 结构满足)。缺席 = 部署没有 store backend ⇒ 名单照问。 */
+    readonly approvalExemptionStore: Pick<ApprovalExemptionStore, "has"> | undefined;
     /**
      * [ref] —— core `RunnerDeps.runtimeCapsResolver` 的**同一只**(main.ts 的 `runtimeCapsResolver`,
      * 单一属主同 `boot/runtime-caps.ts`)。重建条目的第三位决议链元数据 `autoModeArmed` 的唯一判据是
@@ -96,7 +94,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * 赎回腿的父约束链重建([ref] 件二)。
  *
  * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(durable question 门 + F4 高危写
- * 审批门 + 会话豁免探针)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
+ * 审批门 + 部署名单那一问的豁免读面)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
  * (→ core `tightenTaskSpec`)叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE /
  * 守卫集),取其 `toolPolicy` 装进单层 `parentConstraints`。
  *

package/dist/boot/parked-revive-gate.js

@@ -6,6 +6,7 @@ import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { createDeploymentListExemption } from "../approval.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
@@ -30,12 +31,7 @@ export function createParkedReviveInheritedGate(deps) {
         const baseline = createApprovalBaselinePolicy(config, {
             kind: "durable",
             question,
-            ...(approvalExemptionStore && rootSessionId
-                ? {
-                    exempt: (toolName) => approvalExemptionStore.has(rootSessionId, toolName),
-                    onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: rootSessionId, toolName, rawToolName, leg: "parked_revive" }),
-                }
-                : {}),
+            ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, rootSessionId, logger, "parked_revive") } : {}),
         });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngineRoot }));
         return {

package/dist/boot/resolve-spec.js

@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -27,7 +27,7 @@ import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../rou
 import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, encodeCheckpointScope } from "../security.js";
+import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
@@ -65,6 +65,9 @@ export function createResolveSpec(ctx) {
     if (approvalGrantNotice)
         logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
+        const seatRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
+        if (seatRefusal !== undefined)
+            throw createCodedHttpError(501, "capability.checkpoint_store_required", seatRefusal);
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
@@ -134,9 +137,8 @@ export function createResolveSpec(ctx) {
         return stamped;
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
-        const requested = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger);
+        const scenarioName = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger, auth?.principal);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const scenarioName = scenarios[requested] ? requested : "default";
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
         const centerDecls = getCenterPrompts()?.declarations;
         const appendLessPack = centerDecls
@@ -320,7 +322,7 @@ export function createResolveSpec(ctx) {
             return false;
         if (headerStr(req?.headers["x-detach-on-disconnect"]) === "true")
             return false;
-        const askForm = resolveAskSeamForm({}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
+        const askForm = resolveAskSeamForm(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
@@ -369,6 +371,7 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
             ...(typeof body.interactiveTools === "boolean" ? { interactiveTools: body.interactiveTools } : {}),
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
+            ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
@@ -459,12 +462,7 @@ export function createResolveSpec(ctx) {
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
                     question: liveQuestionFace,
-                    ...(approvalExemptionStore && auth?.sessionId
-                        ? {
-                            exempt: (toolName) => approvalExemptionStore.has(auth.sessionId, toolName),
-                            onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: auth.sessionId, toolName, rawToolName }),
-                        }
-                        : {}),
+                    ...(approvalExemptionStore !== undefined && auth?.sessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, auth.sessionId, logger) } : {}),
                 })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })

package/dist/boot/runner-deps.js

@@ -16,7 +16,7 @@ import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
 import { createPeerDirectory } from "../peer-directory.js";
-import { targetOutsideStoreInIncident } from "../memory-store-refusal.js";
+import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 export function createRunnerDepsOnAsk(toolApproval) {
@@ -197,7 +197,7 @@ export function createRunnerDeps(ctx) {
                 if (report.patches)
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
                 if (report.incident) {
-                    const code = targetOutsideStoreInIncident(report.incident);
+                    const code = storeFormRefusalInIncident(report.incident);
                     logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase, ...(code !== undefined ? { code } : {}) });
                 }
                 const byCode = new Map();

package/dist/boot/stage-07-capability-layer.js

@@ -10,7 +10,7 @@ import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntent
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
-import { buildScenarios, builtinScenarioDetails } from "../capabilities/scenarios.js";
+import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from "../capabilities/scenarios.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -64,7 +64,7 @@ export async function runStage07(ctx) {
                 newId: uuidv7,
             });
             if (converged > 0)
-                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained) and GET /v1/sessions/:id lists them under userInputUndrained" });
+                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained, or task.user_followup_undrained for steers queued with priority later) and GET /v1/sessions/:id lists them under userInputUndrained" });
             return ledger;
         })()
         : undefined;
@@ -166,9 +166,10 @@ export async function runStage07(ctx) {
     const parkedReviveSurface = checkpointStore && backgroundAgentStore && builtinDefaultScenario ? createParkedReviveSurface(builtinDefaultScenario) : undefined;
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
-            config, question, approvalExemptionStore, logger, localRoot,
+            config, question, logger, localRoot,
             memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
+            approvalExemptionStore,
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,
         })
@@ -176,6 +177,9 @@ export async function runStage07(ctx) {
     const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps);
     const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
+    const defaultScenarioRefusal = danglingScenarioRefusal(config.defaultScenario, "deployment", Object.keys(scenarios));
+    if (defaultScenarioRefusal !== undefined)
+        throw new Error(defaultScenarioRefusal);
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
     return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveSurface, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, taskLimitCaps, taskTimeoutSec, userInputLedger, userInputLedgerStore, webSearchProvider: webSearchCfg?.provider };
 }

package/dist/boot/stage-10-http-server.js

@@ -12,6 +12,7 @@ import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs
 import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
+import { sessionStoreLabelOf } from "../store-posture.js";
 import { startFleetClientFromEnv } from "../fleet-client.js";
 import { createCenterWiringReader } from "../capabilities/center-wiring.js";
 import { readinessOf } from "../http/readiness.js";
@@ -133,7 +134,7 @@ export async function runStage10(ctx) {
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
     const deployment = {
-        sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        sessionStoreLabel: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         modelReady: () => configCenter.modelReady(),
         scenarioDetails,
         workflowsCapable,
@@ -269,7 +270,7 @@ export async function runStage10(ctx) {
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
-        session: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        session: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         memory: memoryEngine ? `engine(${memoryEngine.root})` : "off",
         instanceId,
         rateLimitPerMin: config.rateLimitPerMin,

package/dist/boot/stores.js

@@ -9,6 +9,7 @@ import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugin
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
+import { ensureSnapshotBucket } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -48,9 +49,12 @@ export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
     let storeDegradedReason;
+    const dsnConfigured = !!(config.tidb || config.pg);
+    if (config.snapshotBlobStore)
+        await ensureSnapshotBucket(config.snapshotBlobStore, config.storeLockWaitMs, logger);
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
-        (config.sessionBackend === "auto" && !!(config.tidb || config.pg));
+        (config.sessionBackend === "auto" && dsnConfigured);
     if (wantDb) {
         const opened = await openStoreBackendWithFallback(config, logger);
         backend = opened.backend;
@@ -111,7 +115,7 @@ export async function openStores(ctx) {
         metrics.setGauge("snapshot_blob_backend", 1, { backend: config.snapshotBlobStore ? "minio" : "sql" });
     }
     if (config.sessionBackend === "auto")
-        config.sessionBackend = backend ? "tidb" : "memory";
+        config.sessionBackend = dsnConfigured ? "tidb" : "memory";
     if (config.dbBackend === "local" && backend)
         config.sessionBackend = "tidb";
     let memoryEngine;
@@ -414,11 +418,12 @@ export async function openStores(ctx) {
     }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {
-        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): session/run CONTENT is " +
-            "durable there, but OWNER attribution is process-local and lost on restart (store-backend.ts §0.5 — durable " +
-            "owners = P1), so it cannot durably enforce multi-tenant session ownership. Use a SQL backend " +
-            "(DB_BACKEND=mysql|pg) for multi-tenant, or run local single-user with REQUIRE_PRINCIPAL=false (a BFF may " +
-            "still inject x-agent-principal per request for memory scoping and audit attribution).");
+        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): the lane is single-user " +
+            "by construction — a session created before owners were recorded is claimed by the FIRST principal that submits " +
+            "to it during the upgrade window, and the lane's mutual-recognition arms assume one user — so it cannot enforce " +
+            "a multi-tenant session boundary. Use a SQL backend (DB_BACKEND=mysql|pg) for multi-tenant, or run local " +
+            "single-user with REQUIRE_PRINCIPAL=false (a BFF may still inject x-agent-principal per request for memory " +
+            "scoping and audit attribution).");
     }
     if (backend)
         assertCloudSnapshotBlobPosture(backend.kind, config);

package/dist/capabilities/center-plugins.d.ts

@@ -97,6 +97,8 @@ export declare function materializablePlugins(eff: {
     url: string;
     sha?: string;
 }>;
+/** 总入口(条款 3/7/8):逐条物化 + 装载 + 让位合并。materialize 盘位 = `<cacheRoot>/<name>/live`
+ *  (成功后原子 rename 替换,失败保留旧盘位 = LKG)。 */
 export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {
     plugins?: unknown;
 }, opts: {

package/dist/capabilities/center-plugins.js

@@ -108,21 +108,39 @@ export function resolvePluginSkillsRoot(cloneRoot) {
     }
     return { ok: true, dir: candidate };
 }
+const PLUGINS_DOMAIN_FAILURE_NAME = "(plugins domain)";
 function declaredPlugins(eff) {
-    if (Array.isArray(eff.plugins))
-        return eff.plugins;
-    const wrapped = eff.plugins?.plugins;
-    return Array.isArray(wrapped) ? wrapped : [];
+    const domain = eff.plugins;
+    if (domain === undefined)
+        return { ok: true, decls: [] };
+    if (Array.isArray(domain))
+        return { ok: true, decls: domain };
+    if (typeof domain === "object" && domain !== null) {
+        const inner = domain.plugins;
+        if (Array.isArray(inner))
+            return { ok: true, decls: inner };
+        return { ok: false, reason: `plugins domain shape rejected: expected an array or { plugins: [...] }, got an object whose plugins member is ${wireTypeWord(inner)}` };
+    }
+    return { ok: false, reason: `plugins domain shape rejected: expected an array or { plugins: [...] }, got ${wireTypeWord(domain)}` };
 }
 export function materializablePlugins(eff, allowHosts) {
-    return declaredPlugins(eff).flatMap((decl) => {
+    const shape = declaredPlugins(eff);
+    if (!shape.ok)
+        return [];
+    return shape.decls.flatMap((decl) => {
         const v = validatePluginDecl(decl, allowHosts);
         return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
     });
 }
 export async function applyCenterPlugins(baseline, eff, opts) {
-    const declared = declaredPlugins(eff);
+    const shape = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
+    if (!shape.ok) {
+        opts.logger?.warn("center_plugins_domain_rejected", { reason: shape.reason });
+        out.failures.push({ plugin: PLUGINS_DOMAIN_FAILURE_NAME, reason: shape.reason });
+        return out;
+    }
+    const declared = shape.decls;
     if (declared.length === 0)
         return out;
     const runGit = opts.runGit ?? (async (args) => {