@sema-agent/server 7.118.0 → 7.119.0

package/deploy/sema-up/sema-up.sh

@@ -34,6 +34,8 @@ unset _self _hops _dir
 . "$HERE/lib/shell-access.sh"
 # 取值旗的形(S-621):判据与词表(--profile / --users / --region / --git / --kube)的唯一定义;--help 的词表也从这里渲。
 . "$HERE/lib/flagshape.sh"
+# 对象存储桶的唯一表(kube-up.sh / cluster-up.sh / smoke.sh 同读这一张)。
+. "$HERE/lib/buckets.sh"
 # 日志一律打到 stderr(stdout 留给 --interactive=json 的协议行)。定义在最前面:参数一解析完就要判形,那时下面的函数都还没定义。
 log() { printf '[sema-up] %s\n' "$*" >&2; }
 # 执行车道表的唯一读者(S-599)。定义在**最前面**:`--help` 的词表也从表渲(手抄的词表会在加一条
@@ -647,7 +649,7 @@ if $DRY_RUN; then
     [ "$GIT_MODE" = "provision" ] && echo "   2. 先起 Gitea → 引导管理员+access token$([ "$REGISTRY_ENABLED" = "true" ] && printf '+OAuth app(接 registry 登录)')"
     [ -n "$PG_URL$S3_ENDPOINT" ] && echo "   2b. 外接端点连接检测(PG=真 select 1;S3=兼容协议 ls+建桶;证书不校验)"
     echo "   3. docker compose up -d --wait(profiles=$COMPOSE_PROFILES)$([ -n "$DATA_ROOT" ] && printf ';数据卷 bind → %s' "$DATA_ROOT")"
-    case ",$COMPOSE_PROFILES," in *,s3,*) echo "   4. MinIO 建桶 workspaces/blobs/backups(幂等)" ;; esac
+    case ",$COMPOSE_PROFILES," in *,s3,*) echo "   4. MinIO 建桶 ${SEMA_UP_ENGINE_BUCKETS// //}(幂等)" ;; esac
     [ "$GIT_MODE" = "connect" ] && echo "   +. 验证 $GIT_URL 连通(Gitea→GitHub→通用 git 探测链,证书不校验;Gitea=自动建 OAuth app,其余=打印待人工项)"
     echo "   5. 装后即验(PG/S3$([ "$PROFILE" != "data-center" ] && printf '/引擎 health')$([ "$REGISTRY_ENABLED" = "true" ] && printf '/registry healthz')$([ "$GIT_MODE" = "provision" ] && printf '/gitea healthz'))+ 一屏 summary"
     echo " 端口: $PF_PORTS(bind:数据面 $([ "$PROFILE" = "data-center" ] && echo 0.0.0.0 || echo 127.0.0.1);服务/registry/git 0.0.0.0)"
@@ -874,9 +876,9 @@ fi
 if [ -n "$S3_ENDPOINT" ]; then
   log "外接 S3 连接检测($S3_ENDPOINT)"
   S3OK=$(docker run --rm --entrypoint sh -e MC_HOST_x="$(printf '%s' "$S3_ENDPOINT" | sed "s#://#://$S3_ACCESS_KEY:$S3_SECRET_KEY@#")" \
-    "${MC_IMAGE:-minio/mc:latest}" -c 'mc --insecure ls x/ >/dev/null 2>&1 && mc --insecure mb --ignore-existing x/workspaces x/blobs x/backups >/dev/null 2>&1 && echo S3_OK' 2>/dev/null | tail -1)
+    "${MC_IMAGE:-minio/mc:latest}" -c "mc --insecure ls x/ >/dev/null 2>&1 && mc --insecure mb --ignore-existing $(buckets_prefixed x/ $SEMA_UP_ENGINE_BUCKETS) >/dev/null 2>&1 && echo S3_OK" 2>/dev/null | tail -1)
   [ "$S3OK" = "S3_OK" ] || { log "⛔ 外接 S3 连不上或建桶失败。下一步:核对 endpoint/密钥;需要 S3 兼容协议(MinIO/OSS/COS/R2 等);证书问题已用 --insecure 忽略,若还不通多半是网络/密钥"; exit 1; }
-  log "外接 S3 就绪(workspaces/blobs/backups 已确保)"
+  log "外接 S3 就绪(${SEMA_UP_ENGINE_BUCKETS// //} 已确保)"
 fi
 
 # ── git=provision:先起 Gitea 并引导(OAuth app 的 client id/secret 要在 registry 起来之前
@@ -1005,13 +1007,16 @@ fi
 # D(S-618):up 之前先 `compose config` 渲染对账 —— 容器真正拿到的决策键与本次决策逐值对齐才 up。
 reconcile_render
 log "装配:docker compose profiles=$COMPOSE_PROFILES project=$PROJECT"
-COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait --remove-orphans \
-  || { log "⛔ compose up 失败。下一步:docker compose -p $PROJECT logs(常见:镜像拉取失败→检查镜像引用/docker login;端口占用→--port 换口)"; exit 1; }
-# 建桶(幂等,一次性动作归 Layer 0;只对本地 MinIO——外接 S3 已在连接检测时确保)
+# 建桶(幂等,一次性动作归 Layer 0;只对本地 MinIO——外接 S3 已在连接检测时确保)。🔴 排在**全栈 up 之前**:引擎起服会核快照桶在不在
+# (缺则拒启),而 `up --wait` 要等引擎健康 —— 桶建在 up 之后,新数据卷上就是引擎等桶、compose 等引擎的互等。所以先只起 MinIO(`--wait` 等它健康)、建桶,再起全栈。
 envf_load MINIO_PASSWORD   # A:回读生成的 MinIO 口令(建桶用),不 source .env
 case ",$COMPOSE_PROFILES," in *,s3,*)
-  docker run --rm --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" mb --ignore-existing x/workspaces x/blobs x/backups >/dev/null || { log "⛔ MinIO 建桶失败。下一步:docker compose -p $PROJECT logs minio"; exit 1; } ;;
+  COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait minio \
+    || { log "⛔ MinIO 启动失败。下一步:docker compose -p $PROJECT logs minio(常见:镜像拉取失败→检查镜像引用/docker login)"; exit 1; }
+  docker run --rm --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" mb --ignore-existing $(buckets_prefixed x/ $SEMA_UP_ENGINE_BUCKETS) >/dev/null || { log "⛔ MinIO 建桶失败。下一步:docker compose -p $PROJECT logs minio"; exit 1; } ;;
 esac
+COMPOSE_PROFILES="$COMPOSE_PROFILES" compose up -d --wait --remove-orphans \
+  || { log "⛔ compose up 失败。下一步:docker compose -p $PROJECT logs(常见:镜像拉取失败→检查镜像引用/docker login;端口占用→--port 换口)"; exit 1; }
 
 # ── 验证(装后即验,§3d smoke 的子集;全量随时可跑 smoke.sh --project=$PROJECT)──────────────
 # A:回读验证 / 汇总要用的凭据与登记值(不 source .env);缺的键回读成空,由下游 :- 缺省处置。
@@ -1066,9 +1071,9 @@ else
     esac
     [ -n "$PG_URL" ] && echo " PG(外接) $EXT_PG_HOST:$EXT_PG_PORT/$EXT_PG_DB(连接检测已过;凭据在 .env)"
     case ",$COMPOSE_PROFILES," in *,s3,*)
-      echo " S3/MinIO  http://$HOSTIP:$MINIO_PORT(console :$MINIO_CONSOLE_PORT,桶×$V_BK:workspaces/blobs/backups)" ;;
+      echo " S3/MinIO  http://$HOSTIP:$MINIO_PORT(console :$MINIO_CONSOLE_PORT,桶×$V_BK:${SEMA_UP_ENGINE_BUCKETS// //})" ;;
     esac
-    [ -n "$S3_ENDPOINT" ] && echo " S3(外接) $S3_ENDPOINT(连接检测+三桶已确保;密钥在 .env)"
+    [ -n "$S3_ENDPOINT" ] && echo " S3(外接) $S3_ENDPOINT(连接检测+引擎桶已确保;密钥在 .env)"
     case ",$COMPOSE_PROFILES," in *,agent,*)
       echo " 引擎      http://$HOSTIP:$SERVER_PORT(/health: $V_HEALTH;API 凭据=SERVICE_AUTH_TOKEN)"
       compose_shell_access_text "$SERVER_PORT" ;;

package/deploy/sema-up/smoke.sh

@@ -22,6 +22,10 @@ unset _self _hops _dir
 . "$HERE/lib/envf.sh"
 # 取值旗的形(S-621):判据同 sema-up.sh 一处定义。
 . "$HERE/lib/flagshape.sh"
+# 引擎 /health 体里「落在哪个后端」的读法与期望值(kube-up / cluster-up 的验收同一只)。
+. "$HERE/lib/health.sh"
+# 对象存储桶的唯一表(sema-up.sh / kube-up.sh / cluster-up.sh 的建桶清单同读这一张)。
+. "$HERE/lib/buckets.sh"
 log() { printf '[smoke] %s\n' "$*" >&2; }
 
 PROJECT="" URL="" TOKEN=""
@@ -68,9 +72,10 @@ if [ -n "$PROJECT" ]; then
   # 哨兵判定(cat 回读值核对后 echo),不依赖各 mc 子命令的输出行为
   S3RT=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'echo smoke > /tmp/s && mc cp /tmp/s x/blobs/_smoke >/dev/null && [ "$(mc cat x/blobs/_smoke)" = smoke ] && mc rm x/blobs/_smoke >/dev/null && echo S3_ROUNDTRIP_OK' 2>/dev/null | tail -1)
   [ "$S3RT" = "S3_ROUNDTRIP_OK" ] && ok "S3 put/get/rm 往返" || fail "S3" "对象读写失败" "docker compose -p $PROJECT logs minio"
-  # ③b 三个约定桶逐个点名(data-center 验收:ls 行数≠桶名对——错桶也会凑数)
-  BKTS=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c 'for b in workspaces blobs backups; do mc ls "x/$b" >/dev/null 2>&1 && printf "%s " "$b"; done' 2>/dev/null)
-  [ "$BKTS" = "workspaces blobs backups " ] && ok "桶就绪(workspaces/blobs/backups)" || fail "桶" "缺桶:应有 workspaces/blobs/backups,实有 ${BKTS:-无}" "重跑 sema-up.sh(建桶幂等)"
+  # ③b 引擎桶逐个点名(data-center 验收:ls 行数≠桶名对——错桶也会凑数;清单 = lib/buckets.sh 那一张表)
+  BKTS=$(docker run --rm --entrypoint sh --network "${PROJECT}_default" -e MC_HOST_x="http://sema:${MINIO_PASSWORD}@minio:9000" "${MC_IMAGE:-minio/mc:latest}" -c "for b in $SEMA_UP_ENGINE_BUCKETS; do mc ls \"x/\$b\" >/dev/null 2>&1 && printf \"%s \" \"\$b\"; done" 2>/dev/null)
+  BKTS_WANT="$(printf '%s ' $SEMA_UP_ENGINE_BUCKETS)"
+  [ "$BKTS" = "$BKTS_WANT" ] && ok "桶就绪(${SEMA_UP_ENGINE_BUCKETS// //})" || fail "桶" "缺桶:应有 ${SEMA_UP_ENGINE_BUCKETS// //},实有 ${BKTS:-无}" "重跑 sema-up.sh(建桶幂等)"
   fi
   # 外接数据面(--pg-url/--s3-endpoint):有 endpoint 就远程直验(证书不校验)
   if [ -n "${AGENT_PG_HOST:-}" ] && ! $HAS_PG && [ "${DEPLOY_PROFILE:-}" != "local-plus" ]; then
@@ -100,9 +105,14 @@ except Exception: print("")' 2>/dev/null)
 fi
 
 if [ -n "$URL" ]; then
-  # ④ /health
-  H=$(curl -m5 -s "$URL/health" | head -c 200)
-  case "$H" in *'"status":"ok"'*) ok "/health($URL)" ;; *) fail "/health" "无响应或非 ok:${H:-空}" "服务没起/端口不对/防火墙;docker logs 或 systemctl 看进程" ;; esac
+  # ④ /health(整体取回:后端位在体的中后段,截断读会丢它)
+  H=$(curl -m5 -s "$URL/health")
+  case "$H" in *'"status":"ok"'*) ok "/health($URL)" ;; *) fail "/health" "无响应或非 ok:$(printf '%s' "${H:-空}" | head -c 200)" "服务没起/端口不对/防火墙;docker logs 或 systemctl 看进程" ;; esac
+  # ④′ 后端位:/health 200 ≠ 数据落了库 —— 引擎的 sessionBackend 必须是期望的持久后端(durable(pg)),`memory` = 内存里跑、重启即丢
+  case "$H" in *'"status":"ok"'*)
+    if BK_WHY=$(health_backend_check "$H"); then ok "引擎后端(sessionBackend=$SEMA_UP_EXPECT_SESSION_BACKEND)"
+    else fail "引擎后端" "$BK_WHY" "库没连上时引擎不会再退内存起服(拒启);读到 memory 多半是旧镜像或手工起的引擎 —— 看 docker logs / kubectl logs 的 store_sql_open_wait 与拒启句"; fi ;;
+  esac
   if [ -n "$TOKEN" ]; then
     # ⑤ auth 门:无 token 必须 401(部署安全底线)
     C=$(curl -m5 -s -o /dev/null -w '%{http_code}' -X POST "$URL/v1/tasks" -H "Content-Type: application/json" -d '{}')

package/deploy/sema-up/stack/compose.yaml

@@ -33,7 +33,7 @@ services:
       retries: 20
 
   minio:
-    image: ${MINIO_IMAGE:-minio/minio:latest}
+    image: ${MINIO_IMAGE:-minio/minio:RELEASE.2025-09-07T16-13-09Z}
     profiles: ["data", "s3"]
     restart: unless-stopped
     # 单机=单盘模式(§3c:显式无冗余;集群形态才上 EC)

package/deploy/sema-up/stack/sema-stack-cluster.yaml

@@ -77,7 +77,8 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+          imagePullPolicy: IfNotPresent
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - { name: MINIO_ROOT_USER, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
@@ -155,6 +156,8 @@ spec:
           env:
             - { name: PORT, value: "8090" }
             - { name: DB_BACKEND, value: pg }
+            # 引擎 boot 期等库的窗(ms):CNPG 与 server Pod 同时起,库初始化常慢于 server 就绪 —— 窗内重试、到窗仍连不上才拒启(chart 的 server.storeWaitMs 同值)
+            - { name: STORE_LOCK_WAIT_MS, value: "300000" }
             - { name: SESSION_BACKEND, value: auto }
             - { name: PG_HOST, value: sema-pg-rw.sema.svc }
             - { name: PG_PORT, value: "5432" }

package/dist/approval-ask-audit-store.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { AppendLog, ensureDir } from "@sema-agent/core";
+import { AppendLog, ensureDir, isHostDecider } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { replayJsonlSkipping } from "./observability/corrupt-read-seat.js";
 export const APPROVAL_ASK_AUDIT_DIR = "approval-ask-audit";
@@ -10,11 +10,6 @@ export const AUDIT_SHUTDOWN_CAUSE_WORDS = { shutdown_before_park: true };
 export function buildCheckpointAnchorHash(token) {
     return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
 }
-const HOST_DECIDED_BY_WORDS = ["person", "sla_timeout", "policy"];
-const HOST_DECIDED_BY = new Set(HOST_DECIDED_BY_WORDS);
-function isHostDecidedBy(v) {
-    return typeof v === "string" && HOST_DECIDED_BY.has(v);
-}
 function isAuditShutdownCause(v) {
     return typeof v === "string" && Object.hasOwn(AUDIT_SHUTDOWN_CAUSE_WORDS, v);
 }
@@ -123,7 +118,7 @@ function readLedgerRecord(u, noteOutOfSetSeat) {
             const decidedByV = o.decidedBy;
             const legacySettledByV = decidedByV === undefined ? o.settledBy : undefined;
             const legacySettledBy = legacySettledByV === "human" || legacySettledByV === "timeout" || legacySettledByV === "aborted" ? legacySettledByV : undefined;
-            const decidedBy = isHostDecidedBy(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
+            const decidedBy = isHostDecider(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
             const approver = s("approver");
             const settledAtMs = num("settledAtMs");
             const sessionId = s("sessionId");

package/dist/approval-card.d.ts

@@ -695,8 +695,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -825,8 +825,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -1001,7 +1001,7 @@ export declare function buildRevokeFrame(batchId: string, askIds: readonly strin
 export declare function buildReplayFrame(row: AskRow, nowMs: number): ApprovalRequestFrame | undefined;
 /**
  * S-1154 —— 持久行上那张卡**要不要人**:卡面 `risk.requiresRealApproval`(铸卡时取自引擎在 `AskRequest` 上盖的同一位,
- * {@link buildApprovalCard} 第三参)。读者 = 耐久 ask 回决口在裁决之前判「策略的放行」(`host-decision.ts` 的 `policyCannotAllow`)。
+ * {@link buildApprovalCard} 第三参)。读者 = 耐久 ask 回决口在裁决之前交给引擎判官 `policyCannotAnswer` 的那一问(`host-decision.ts` 的 `heldAskOf`)。
  * 🔴 读不出卡(`card_json` 形不合)⇒ **按要人读**(fail-closed):这一位只用来**拒**策略的放行,读坏的行上拒一次可以改成人答 / 策略拒
  * 再来;反方向(读坏当不要人)会让一次引擎终将拒掉的放行先落成一条宣称 approve 的行。
  */

package/dist/approval.d.ts

@@ -3,9 +3,10 @@
  * (createOaApprovalPolicy + ApprovalStore pending 行轮询)整体退役;唯一门形 = durable checkpoint
  * suspend/resume,见 createDurableAskPolicy 与 /v1/approvals 的 checkpointStore 腿)。
  */
-import { type ToolPolicy } from "@sema-agent/core";
+import { type ToolCallRequest, type ToolPolicy } from "@sema-agent/core";
 import { type PostureSource } from "./posture-source.js";
 import { type ExecutionLane } from "./execution-lane-caps.js";
+import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
 /**
  * 门意图判据读的五个量(`ServiceConfig` 结构满足)。单独成型是为了让**热路径**能拿「候选视图」来判
  * (S-668 波 2:`{ ...config, approvalRequire: 候选名单 }`)—— 判据只有一份,输入可以是活配置也可以是候选。
@@ -132,11 +133,56 @@ export declare function buildForceDurableGateInertNotice(input: {
  * replica. (The former poll-lane
  * twin, createOaApprovalPolicy, was retired in 5.0.0 — durable is the only gate.)
  */
-export interface DurableAskOptions {
-    requireApproval: string[];
-    deny?: string[];
+export interface DurableAskOptions extends ApprovalListsView {
     autoBudget?: number;
-    neverAuto?: string[];
+    /** 本会话的「本会话放行」读面(server 的会话豁免店,键 = 会话 × wire 工具名)。缺席 = 这条腿没有会话 / 没有店 ⇒ 名单门照问。 */
+    exemption?: DeploymentListExemption;
 }
+/** 三张运维名单(一只调用由哪一张说话)的入参 —— 名单门与「问的属主」读法同读这一份。 */
+export interface ApprovalListsView {
+    readonly requireApproval: readonly string[];
+    readonly deny?: readonly string[];
+    readonly neverAuto?: readonly string[];
+}
+/**
+ * 三张运维名单对**一只调用**的判词(deny 先于 never-auto 先于 require),`hit` = 命中的那个名(规则归因写运维名单里的那个)。
+ * 名单门按它出 deny / 恒问人 / 名单的问;「这张卡上有没有名单自己的问」也按它读(见 {@link deploymentListAsks})—— 一份读法,两个读者。
+ */
+export type ApprovalListVerdict = {
+    readonly list: "deny";
+} | {
+    readonly list: "never_auto" | "require";
+    readonly hit: string;
+} | {
+    readonly list: "none";
+};
+/** 铸一只判词函数(名单的命中集与 covering 规则只解一次)。名字读法 = {@link heldRuleName}(收紧臂读调用答得上的全部名字)。 */
+export declare function createApprovalListVerdict(lists: ApprovalListsView): (call: Pick<ToolCallRequest, "toolName" | "face">) => ApprovalListVerdict;
+/**
+ * **「问的属主」的读法**:部署名单门对这只调用出不出它**自己的**那一问(`APPROVAL_REQUIRE` 臂)—— 读的是铸点本身(同一只判词),
+ * 不另造一张表。读者:审批席(活卡的提示位 / 回决写侧)、耐久 `/decide` 腿与运维队列行(停驻行上只有工具名,按 wire 名读)。
+ * 名单是热换的(中心下发),读者每次现读活配置。答 `true` 只说「名单门问这只调用」;这张卡是不是名单的那一问,还要看卡上的类
+ * (`tool-approval.ts` 的 `StandingAnswerFacts.deploymentListQuestion`)。
+ */
+export declare function deploymentListAsks(config: Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">, call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
+/**
+ * 名单门的「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。名单的问是 server 铸的,它的站着的答案记在 server 的
+ * 会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),名单门在出问**之前**读它。
+ */
+export interface DeploymentListExemption {
+    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 ⇒ `false`(照问,人多看一张卡)。 */
+    readonly has: (toolName: string) => Promise<boolean>;
+    /** 名单门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
+    readonly onExempted: (toolName: string) => void;
+}
+/**
+ * 名单门豁免读面的**唯一**铸点(HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` 两处装配都经它):键 = 会话 × wire 工具名
+ * (与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位
+ * `seat: "deployment_list"`(审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值。
+ */
+export declare function createDeploymentListExemption(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
+    info(event: string, fields?: Record<string, unknown>): void;
+    warn(event: string, fields?: Record<string, unknown>): void;
+}, leg?: "parked_revive"): DeploymentListExemption;
 export declare function createDurableAskPolicy(opts: DurableAskOptions): ToolPolicy;
 //# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -4,6 +4,8 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { DURABLE_CONVERGE_READ_TIMEOUT_MS, policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
+import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 export function hasApprovalListIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
@@ -67,6 +69,49 @@ export function buildForceDurableGateInertNotice(input) {
         },
     };
 }
+export function createApprovalListVerdict(lists) {
+    const require = createNameSetMatcher(lists.requireApproval);
+    const deny = createNameSetMatcher(lists.deny ?? []);
+    const neverAuto = createNameSetMatcher(lists.neverAuto ?? []);
+    return (call) => {
+        if (heldRuleName(call, deny) !== undefined)
+            return { list: "deny" };
+        const neverAutoHit = heldRuleName(call, neverAuto);
+        if (neverAutoHit !== undefined)
+            return { list: "never_auto", hit: neverAutoHit };
+        const requireHit = heldRuleName(call, require);
+        if (requireHit !== undefined)
+            return { list: "require", hit: requireHit };
+        return { list: "none" };
+    };
+}
+export function deploymentListAsks(config, call) {
+    return createApprovalListVerdict({ requireApproval: config.approvalRequire, deny: config.approvalDeny, neverAuto: config.approvalNeverAuto })(call).list === "require";
+}
+export function createDeploymentListExemption(store, sessionId, logger, leg) {
+    const where = { sessionId, ...(leg !== undefined ? { leg } : {}) };
+    return {
+        has: async (toolName) => {
+            let timer;
+            try {
+                const deadline = new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error(`exemption read timed out after ${DURABLE_CONVERGE_READ_TIMEOUT_MS}ms`)), DURABLE_CONVERGE_READ_TIMEOUT_MS);
+                    timer.unref?.();
+                });
+                return (await Promise.race([store.has(sessionId, toolName), deadline])) === true;
+            }
+            catch (err) {
+                logger.warn("session_grant_read_failed", { ...where, toolName, seat: "deployment_list", error: String(err).slice(0, 200) });
+                return false;
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            }
+        },
+        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat: "deployment_list" }),
+    };
+}
 function createNameSetMatcher(names) {
     const exact = new Set(names);
     const covering = names.filter(isNamespacedCoveringRuleName);
@@ -78,30 +123,48 @@ function grantedByRule() {
     return { action: "allow", decisionReason: "rule" };
 }
 export function createDurableAskPolicy(opts) {
-    const require = createNameSetMatcher(opts.requireApproval);
-    const deny = createNameSetMatcher(opts.deny ?? []);
-    const neverAuto = createNameSetMatcher(opts.neverAuto ?? []);
+    const verdictOf = createApprovalListVerdict(opts);
     const budget = Math.max(0, Math.floor(opts.autoBudget ?? 0));
     let autoApproved = 0;
     const isQuestionTool = (name) => name === ASK_USER_QUESTION_TOOL_NAME;
     return {
         check: (req) => {
-            if (heldRuleName(req, deny) !== undefined)
-                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
-            const neverAutoHit = heldRuleName(req, neverAuto);
-            if (neverAutoHit !== undefined)
-                return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${neverAutoHit})`, `human approval required to run "${req.toolName}"`);
-            const requireHit = heldRuleName(req, require);
-            if (requireHit !== undefined)
-                return decideRequired(req, operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`));
-            return { action: "allow" };
+            const verdict = verdictOf(req);
+            switch (verdict.list) {
+                case "deny":
+                    return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
+                case "never_auto":
+                    return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${verdict.hit})`, `human approval required to run "${req.toolName}"`);
+                case "require":
+                    return decideRequired(req, verdict.hit);
+                case "none":
+                    return { action: "allow" };
+                default: {
+                    const unreachable = verdict;
+                    throw new Error(`unhandled approval-list verdict: ${JSON.stringify(unreachable)}`);
+                }
+            }
         },
     };
-    function decideRequired(req, ask) {
+    function decideRequired(req, requireHit) {
         const rem = req.budget?.resourceRemainingMicroUsd;
         if (rem !== undefined && rem <= 0) {
             return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
         }
+        const ask = operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`);
+        if (opts.exemption !== undefined && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, true))) {
+            const exemption = opts.exemption;
+            return (async () => {
+                if (await exemption.has(req.toolName)) {
+                    exemption.onExempted(req.toolName);
+                    return { action: "allow" };
+                }
+                return budgetOrAsk(req, ask);
+            })();
+        }
+        return budgetOrAsk(req, ask);
+    }
+    function budgetOrAsk(req, ask) {
         if (heldRuleName(req, isQuestionTool) === undefined && budget > 0 && autoApproved < budget) {
             autoApproved++;
             return grantedByRule();

package/dist/audit.d.ts

@@ -16,7 +16,9 @@ export interface SessionAudit {
         provider: string;
         modelId: string;
     } | null;
-    /** Current model context: prior messages with older history collapsed into a summary message. */
+    /** Current model context: prior messages with older history collapsed into a summary message.
+     *  🔴 **存档原形**(store 里怎么写就怎么回)—— 不是 wire 形。HTTP 读面一律过 {@link redactSessionViewForRead}(次序 = 选窗 → 脱敏 → 截断)
+     *  再回给调用方;直接消费本视图的宿主(`buildSessionAudit` 是包根导出)自己负责同一道脱敏。 */
     messages: unknown[];
     /** [ref]① web 观测切片 B: the session's prompt-epoch pin, core contract verbatim (core 1.304
      *  `session.getPromptEpoch()` — first-class `prompt_epoch` entry, compaction restatement, [ref] anchor
@@ -36,10 +38,19 @@ export declare function buildSessionAudit(pool: Pool, sessionId: string): Promis
  *  (its storage seam has no wake-equivalent yet — may turn out to be a core gap). */
 export declare function buildSessionAuditPg(pool: PgPool, sessionId: string): Promise<SessionAudit | undefined>;
 /** The LOCAL (File) leg — web session area on DB_BACKEND=local.
+ *  repo 取自 `createLocalSessionRepo`(与 `LocalSessionStore` 同一只工厂):坏记录的披露座(F 类 `server.session-repo.corrupt-record-skipped`)
+ *  因此在视图口同样在场 —— 视图照常返回、跳过的记录有计数 + 探针行(修前自建一只不带座的 repo,零披露)。
  *  实现姿势:`FileSessionRepo.exportEntries`(纯读、torn-tail 恢复、missing→not_found)→
  *  `boundedTail`(纯函数切 floor)→ InMemorySessionStorage → 同一 auditFromStorage 内核。零写面、
  *  零新 seam;createdAt 从 repo.list() 的 metadata 取(File 形态 meta 与 entries 分储)。 */
 export declare function buildSessionAuditLocal(root: string, sessionId: string): Promise<SessionAudit | undefined>;
+/**
+ * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
+ * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;
+ * `blobCap` 的截断会切字符串(预览切在密钥中间,半截密钥认不出来)⇒ 截断恒在脱敏之后。
+ * `messages` 缺席 ⇒ 不铸键;非数组 ⇒ 深扫;其余键(`owner` / `promptEpoch` / `model` …)逐字。字节没变 ⇒ **同一引用**。
+ */
+export declare function redactSessionViewForRead<V extends object>(view: V): V;
 /** Window `messages` — `tail=N` (last N) or `before=<offset>&limit=N` ([max(0,before-N), before)).
  *  Returns the window + its {offset,total} so the web can page upward. */
 export declare function windowMessages(messages: unknown[], opts: {

package/dist/audit.js

@@ -1,6 +1,9 @@
-import { StoredSession, FileSessionRepo, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
+import { StoredSession, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 import { PgSessionStorage } from "./plugins/pg-session-storage.js";
+import { createLocalSessionRepo } from "./plugins/local-session-store.js";
+import { redactModelText } from "./observability/run-terminal.js";
+import { redactDeepWith } from "./trace/redact.js";
 export async function buildSessionAudit(pool, sessionId) {
     return auditFromStorage(await TiDBSessionStorage.wake(pool, sessionId), sessionId);
 }
@@ -8,7 +11,7 @@ export async function buildSessionAuditPg(pool, sessionId) {
     return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId);
 }
 export async function buildSessionAuditLocal(root, sessionId) {
-    const repo = new FileSessionRepo(root);
+    const repo = createLocalSessionRepo(root);
     let entries;
     try {
         entries = await repo.exportEntries(sessionId);
@@ -40,6 +43,63 @@ async function auditFromStorage(storage, sessionId) {
         ...(promptEpoch ? { promptEpoch } : {}),
     };
 }
+const deepScrub = (v) => redactDeepWith(v, redactModelText);
+const textSlot = (v) => (typeof v === "string" ? redactModelText(v) : deepScrub(v));
+function scrubSlot(p, key, scan) {
+    const v = p[key];
+    if (v === undefined)
+        return p;
+    const next = scan(v);
+    return next === v ? p : { ...p, [key]: next };
+}
+const PART_READ_TREATMENT = {
+    text: (p) => scrubSlot(p, "text", textSlot),
+    thinking: (p) => scrubSlot(p, "thinking", textSlot),
+    toolCall: (p) => scrubSlot(p, "arguments", deepScrub),
+    image: (p) => p,
+    document: (p) => p,
+};
+function readParts(content) {
+    if (!Array.isArray(content))
+        return textSlot(content);
+    const next = content.map((part) => {
+        if (part !== null && typeof part === "object" && !Array.isArray(part)) {
+            const type = part.type;
+            if (typeof type === "string" && Object.hasOwn(PART_READ_TREATMENT, type)) {
+                return PART_READ_TREATMENT[type](part);
+            }
+        }
+        return deepScrub(part);
+    });
+    return next.every((x, i) => x === content[i]) ? content : next;
+}
+const readContent = (m) => scrubSlot(m, "content", readParts);
+const MESSAGE_READ_TREATMENT = {
+    user: (m) => m,
+    custom: (m) => m,
+    assistant: (m) => readContent(m),
+    toolResult: (m) => scrubSlot(readContent(m), "details", deepScrub),
+    bashExecution: (m) => scrubSlot(scrubSlot(m, "command", textSlot), "output", textSlot),
+    compactionSummary: (m) => scrubSlot(m, "summary", textSlot),
+};
+function readMessage(m) {
+    if (m !== null && typeof m === "object" && !Array.isArray(m)) {
+        const role = m.role;
+        if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
+            return MESSAGE_READ_TREATMENT[role](m);
+        }
+    }
+    return deepScrub(m);
+}
+export function redactSessionViewForRead(view) {
+    const { messages } = view;
+    if (messages === undefined)
+        return view;
+    const next = Array.isArray(messages)
+        ? (() => { const out = messages.map(readMessage); return out.every((x, i) => x === messages[i]) ? messages : out; })()
+        : deepScrub(messages);
+    return next === messages ? view : { ...view, messages: next };
+}
 export function windowMessages(messages, opts) {
     const total = messages.length;
     if (opts.before !== undefined) {

package/dist/auto-mode-face.d.ts

@@ -42,8 +42,7 @@
  * `entitlementSource`(既有位)说的是「center 源在不在」;`armed` 说的是「按三态谓词此刻会不会武装」。
  * 两者刻意并存:前者告诉壳有没有组织面,后者告诉壳这台机器上 auto 到底是不是 default 的别名。
  */
-import { type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
-import type { SettingsPermissionMode } from "./task-settings.js";
+import { type PermissionMode, type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
 /**
  * 分类器席的模型 —— **调 core 的单一解析器** `classifierSeatModel({deps, main})`(core 7.20.0 / [ref],
  * 本仓 [ref] 的跨仓诉求兑现;契约句 `classifier.seat.one_resolver` 逐字:引擎的武装点与**显示这个席**
@@ -123,7 +122,7 @@ export type AutoModeVerdict = {
  * 走到这里还在抛 = 装配缺陷,读面 500 比一句编出来的 reason 诚实。
  */
 export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
-    readonly requestedMode: SettingsPermissionMode | undefined;
+    readonly requestedMode: PermissionMode | undefined;
     readonly principal: string | undefined;
     /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
      *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */

package/dist/bake-runner/main.js

@@ -73,12 +73,7 @@ function makeApiClient(env, log) {
                 body: JSON.stringify(frame),
                 signal: AbortSignal.timeout(BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS),
             });
-            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
-            return {
-                accepted: res.ok && body.accepted !== false,
-                cancelRequested: body.cancelRequested === true,
-                leaseValid: res.status !== 409,
-            };
+            await res.arrayBuffer().catch(() => undefined);
         },
         async heartbeat(bakeId, ingestSecret) {
             const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {

package/dist/bake-runner/protocol.d.ts

@@ -78,6 +78,11 @@ export declare function dockerBuildTickFrame(lineOrd: number, elapsedSec: number
 export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "timeout", detail?: {
     error?: string;
 }): IngestFrame;
+/**
+ * 失败尾巴的行数 —— **唯一**常量:缓冲({@link createStderrTail})保留这么多行,终局句({@link exitDoneFrame})取这么多行。
+ * 两处读同一个数,所以缓冲里「保留的」恒等于消费方「要的」:既没有消费方想要而已被丢掉的行,也没有永远用不上的行占内存。
+ */
+export declare const STDERR_TAIL_LINES = 12;
 /**
  * The runner-side terminal `done` for a build.sh CHILD that exited non-zero WITHOUT printing its own `done` (build.sh
  * normally dies via `die()` which DOES print a `done:FAILED`, but a SIGKILL or a crash before the trap can leave the
@@ -87,6 +92,19 @@ export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "tim
 export declare function exitDoneFrame(lineOrd: number, exitCode: number, stderrTail: string): IngestFrame;
 /** Keep only the last `n` lines of a (possibly long) stderr tail — bounds the error string we forward. */
 export declare function lastLines(text: string, n: number): string;
+/** 有界的 stderr 尾部缓冲:只保留**末** {@link STDERR_TAIL_LINES} 行(环形:新行进来、最老的出去)。 */
+export interface StderrTail {
+    /** 收一行(spawner 已按换行切好;这里仍按 {@link contentLines} 判据过一遍,空行不入)。 */
+    push(raw: string): void;
+    /** 当前保留的行,`\n` 连接;空缓冲 = 空串。可直接交 {@link exitDoneFrame}。 */
+    text(): string;
+}
+/**
+ * 修前缓冲是 `if (stderrTail.length < 80) push` —— 留的是**首** 80 行,而消费方({@link exitDoneFrame})要的是**末** 12 行:
+ * 超过 80 行的失败里,「尾巴」是前 80 行的末 12 行,真正的最后一行(失败原因所在)一个字也进不来。
+ * 现在留末 N 行;N = {@link STDERR_TAIL_LINES}。
+ */
+export declare function createStderrTail(): StderrTail;
 /**
  * The profile-aware HARD DEADLINE (§P2.7/§P2.11) the runner enforces by killing the process group. flutter/full are
  * the heavy profiles (~60min); everything else ~45min. A bands build ("custom") is treated as heavy if it includes