@sema-agent/server 7.118.0 → 7.119.0

package/dist/plugins/store-backend.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
 import { createCorruptReadFailOpenSeat, createDurableAbsenceSeat } from "../observability/corrupt-read-seat.js";
+import { createLogger } from "../observability/logger.js";
 import { join } from "node:path";
-import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
+import { AdoptionError, FileStorageBackend } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { fileSessionCaptureRecordStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
@@ -12,8 +13,7 @@ import { StoreBootRefusalError } from "./store-contracts.js";
 import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
-import { LocalSessionStore } from "./local-session-store.js";
-import { noteReplayInSessionOpenScope } from "../session-records-skipped-notice.js";
+import { LocalSessionStore, createLocalSessionRepo } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
@@ -30,6 +30,7 @@ import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-s
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { fileMemoryControlDirFor } from "../memory-scope.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
@@ -55,6 +56,7 @@ import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { storeDegradedReasonFor } from "../store-posture.js";
+import { openWithinWait } from "./store-open-wait.js";
 function historyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
@@ -240,9 +242,7 @@ class LocalBackend {
             throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
                 (tail === undefined ? "" : ` ${tail}`));
         }
-        this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root, {
-            onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInSessionOpenScope),
-        }), this.fileBackend.root);
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.fileBackend.root, { log: createLogger(config.logLevel) });
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
@@ -344,21 +344,41 @@ export function createStoreBackend(config, onWarn, onError) {
     return new TiDBBackend(createTidbPool(config), config);
 }
 export async function openStoreBackendWithFallback(config, logger) {
-    const mayFallback = config.dbBackend === "local" ? !config.dbBackendExplicit : config.sessionBackend === "auto";
+    const sqlEngine = config.dbBackend === "mysql" || config.dbBackend === "pg" ? config.dbBackend : undefined;
+    const mayFallback = config.dbBackend === "local" && !config.dbBackendExplicit;
     let backend;
+    let inFlight;
     try {
-        backend = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
-        if (backend)
-            await backend.ensureSchema();
+        const attempt = async () => {
+            let built;
+            try {
+                built = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
+                inFlight = built;
+                if (built)
+                    await built.ensureSchema();
+                inFlight = undefined;
+                return built;
+            }
+            catch (err) {
+                inFlight = undefined;
+                await built?.close().catch(() => undefined);
+                throw err;
+            }
+        };
+        backend =
+            sqlEngine === undefined
+                ? await attempt()
+                : await openWithinWait(attempt, config.storeLockWaitMs, (w) => logger.warn("store_sql_open_wait", { engine: sqlEngine, endpoint: buildDisplaySafeUrl(sqlStoreCoordinatesAsUrl(config)), waitMs: w.waitMs, error: w.error }));
     }
     catch (err) {
+        void inFlight?.close().catch(() => undefined);
         if (err instanceof AdoptionError)
             throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
         if (!mayFallback) {
-            if (config.dbBackend === "mysql" || config.dbBackend === "pg")
-                throw new Error(buildSqlStoreOpenRefusal(config.dbBackend, err), { cause: err });
+            if (sqlEngine !== undefined)
+                throw new Error(buildSqlStoreOpenRefusal(sqlEngine, buildDisplaySafeUrl(sqlStoreCoordinatesAsUrl(config)), config.storeLockWaitMs, err), { cause: err });
             throw err;
         }
         logger.warn("store_db_unreachable_fallback_memory", {
@@ -370,11 +390,21 @@ export async function openStoreBackendWithFallback(config, logger) {
     }
     return { backend, degradedReason: undefined };
 }
-export function buildSqlStoreOpenRefusal(engine, err) {
+const SQL_HOST = /^(?:[A-Za-z0-9._-]{1,253}|\[[0-9A-Fa-f:.]{2,45}\])$/;
+const SQL_COORDINATES_UNPRINTABLE = "<unprintable-coordinates>";
+export function sqlStoreCoordinatesAsUrl(config) {
+    const coords = config.dbBackend === "pg" ? config.pg : config.tidb;
+    if (coords === undefined || !SQL_HOST.test(coords.host))
+        return SQL_COORDINATES_UNPRINTABLE;
+    return `${config.dbBackend === "pg" ? "postgres" : "mysql"}://${coords.host}:${coords.port}`;
+}
+export function buildSqlStoreOpenRefusal(engine, endpoint, waitedMs, err) {
     const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
     const detail = err instanceof Error ? err.message : String(err);
-    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store (${detail}) — refusing to boot, because DB_BACKEND asks for a durable store and SESSION_BACKEND does not allow running without it. ` +
-        `Next: fix the ${coords} coordinates or the store's reachability; or set SESSION_BACKEND=auto to boot in memory while the store is unreachable (best effort — nothing persists, and /health reports storeDegraded); ` +
-        `or set DB_BACKEND=memory for an explicitly in-memory deployment.`);
+    const waited = waitedMs > 0 ? `after retrying for ${waitedMs}ms (STORE_LOCK_WAIT_MS)` : "on the first attempt (STORE_LOCK_WAIT_MS=0: no wait)";
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
+        `(SESSION_BACKEND=auto included: sessions, parked runs and every durable record would silently live in memory and vanish on restart). ` +
+        `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); ` +
+        `or run explicitly in memory with DB_BACKEND=memory (and remove the ${coords} coordinates).`);
 }
 //# sourceMappingURL=store-backend.js.map

package/dist/plugins/store-open-wait.d.ts

@@ -0,0 +1,33 @@
+/** 进入等待腿时的**一次性**披露(结构上只在第一次失败时调一次,不是靠一个 flag 挡刷屏)。 */
+export type StoreOpenWaitSink = (fields: {
+    readonly waitMs: number;
+    readonly error: string;
+}) => void;
+/** 时钟三面(异步形:`sleep` 返回 Promise)。三面都是形参,判据不靠真时间。`deadline` = 一只可取消的到点信号(窗尾打断挂起的尝试用)。 */
+export interface StoreOpenWaitClock {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    deadline(ms: number): {
+        readonly expired: Promise<void>;
+        cancel(): void;
+    };
+}
+/** {@link openWithinWait} 抛出的是不是「到窗仍未返回、且从没有过一次真失败」那一形(调用方据此区分「没有证据」与「有一次确定的失败」)。 */
+export declare function isStoreOpenWindowExpired(err: unknown): boolean;
+/**
+ * 跑 `open`;失败且窗为正 ⇒ 在窗内每 {@link STORE_LOCK_POLL_MS} 重试。
+ *
+ * 🔴 **窗尾只有一条规则**:到窗时手上有一次**完成了的**真失败 ⇒ **原样**抛最近那一次(同一个对象,不重铸 —— 库的拒句读驱动原文,桶的拒句读
+ * 「缺桶」那只错);**从头到尾一次真失败都没有**(每次尝试都挂着)⇒ 抛 {@link StoreOpenWindowExpired}(「到窗仍未返回」,{@link isStoreOpenWindowExpired} 判别)。
+ *  · 窗从**第一次尝试开始**算,每次尝试与**剩余**窗赛跑 —— 挂起的尝试到窗尾也被打断(库接受了 TCP 却永不回握手、DDL 被长期锁住);被打断的那次尝试
+ *    不再有人等它:它迟到的结局被吞掉(没人接 = 未处理拒绝会杀进程),它手上的资源由调用方的 `open` 自己收(见 `openStoreBackendWithFallback` 的在飞登记)。
+ *  · 剩余窗 ≤ 0 **不再起新一次尝试**:一次失败之后的等待吃完了窗,就抛那次失败 —— 不起一次注定跟 0 ms 的到点赛跑、又几乎总是输的尝试
+ *    (那一形会把一次确定的失败换成「到窗仍未返回」:口令错读成库挂住、缺桶读成没有证据)。
+ * 窗为 0 ⇒ **只试一次、不设界**(与 7.118.x 同形:一次尝试挂多久由驱动自己的超时决定 —— 本腿不替它造一个)。
+ *
+ * @param open    一次完整尝试(造后端 + `ensureSchema()` / 一次桶探针);**失败时必须自己把这次造出的池还回去**,窗内会被再调用。
+ * @param waitMs  `config.storeLockWaitMs`。`> 0` 才等;`0` / 非数 ⇒ 只试一次(`!(waitMs > 0)` 同时盖住「键缺席」的手搓 config)。
+ * @param onWait  进入等待腿的一次性披露口(第一次完成的失败时调一次)。
+ */
+export declare function openWithinWait<T>(open: () => Promise<T>, waitMs: number, onWait: StoreOpenWaitSink, clock?: StoreOpenWaitClock): Promise<T>;
+//# sourceMappingURL=store-open-wait.d.ts.map

package/dist/plugins/store-open-wait.js

@@ -0,0 +1,73 @@
+import { STORE_LOCK_POLL_MS } from "./store-lock-wait.js";
+const REAL_CLOCK = {
+    now: () => performance.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    deadline: (ms) => {
+        let timer;
+        const expired = new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        });
+        return { expired, cancel: () => clearTimeout(timer) };
+    },
+};
+class StoreOpenWindowExpired extends Error {
+    constructor(waitMs) {
+        super(`the open attempt was still pending when the ${waitMs}ms window ended`);
+    }
+}
+export function isStoreOpenWindowExpired(err) {
+    return err instanceof StoreOpenWindowExpired;
+}
+export async function openWithinWait(open, waitMs, onWait, clock = REAL_CLOCK) {
+    if (!(waitMs > 0))
+        return await open();
+    const startedAt = clock.now();
+    let lastFailure;
+    for (;;) {
+        const remainingMs = waitMs - (clock.now() - startedAt);
+        if (lastFailure !== undefined && remainingMs <= 0)
+            throw lastFailure.error;
+        const deadline = clock.deadline(Math.max(remainingMs, 0));
+        let outcome;
+        try {
+            outcome = await Promise.race([
+                attemptOnce(open).then((value) => ({ kind: "opened", value }), (error) => ({ kind: "failed", error })),
+                deadline.expired.then(() => ({ kind: "window_ended" })),
+            ]);
+        }
+        finally {
+            deadline.cancel();
+        }
+        switch (outcome.kind) {
+            case "opened":
+                return outcome.value;
+            case "window_ended":
+                if (lastFailure !== undefined)
+                    throw lastFailure.error;
+                throw new StoreOpenWindowExpired(waitMs);
+            case "failed": {
+                if (lastFailure === undefined)
+                    onWait({ waitMs, error: outcome.error instanceof Error ? outcome.error.message : String(outcome.error) });
+                lastFailure = { error: outcome.error };
+                const left = waitMs - (clock.now() - startedAt);
+                if (left <= 0)
+                    throw outcome.error;
+                await clock.sleep(Math.min(STORE_LOCK_POLL_MS, left));
+                break;
+            }
+            default: {
+                const unhandled = outcome;
+                throw new Error(`unhandled open attempt outcome: ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
+}
+function attemptOnce(open) {
+    try {
+        return open();
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+}
+//# sourceMappingURL=store-open-wait.js.map

package/dist/rule-entry-list.js

@@ -50,7 +50,7 @@ export function inertRuleEntryGuidance(i) {
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":
-            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name) — write the tool name exactly, with no padding";
+            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name, or an invisible or control character in the tool name) — write the tool name exactly, with no padding";
         default: {
             const unhandled = reason;
             throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);

package/dist/run-local.js

@@ -33,7 +33,7 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildScenarios, gateScenarioRequest, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutExecutionEnv } from "./capabilities/hands-lane.js";
 import { HttpError } from "./security.js";
@@ -139,6 +139,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     content_question: { remedy: "terminal_only", autoBudgetReleases: false },
     hook: { remedy: "terminal_only", autoBudgetReleases: false },
     ancestor: { remedy: "terminal_only", autoBudgetReleases: false },
+    dangerous_delete: { remedy: "terminal_only", autoBudgetReleases: false },
     unverifiable_delete: { remedy: "terminal_only", autoBudgetReleases: false },
     transcript_write: { remedy: "terminal_only", autoBudgetReleases: false },
     org_rule: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -592,11 +593,11 @@ export async function runLocal(argv, deps = {}) {
         const { overlay } = centerScenarios(scenarioDeps, effective.scenarios.scenarios, Object.keys(scenarios), logger);
         Object.assign(scenarios, overlay);
     }
-    const requested = args.scenario ?? config.defaultScenario;
-    const scenarioName = scenarios[requested] ? requested : "default";
+    let scenarioName = args.scenario ?? config.defaultScenario;
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
+        scenarioName = gateScenarioRequest(undefined, args.scenario, config.defaultScenario, Object.keys(scenarios), logger);
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {

package/dist/security.d.ts

@@ -72,9 +72,11 @@ export declare const LEGACY_UNOWNED_AMNESTY_TENANT = "default";
  *  · `runOwnerOk` 三读面(head / audit 单读 / events):`owner === null` 那一支**本来就放行**
  *    (判据是 `owner !== null && principal !== owner`),不需要本臂。[ref] 帖文里「单读 404」一句
  *    经亲读实现行**不成立**,已加现状钉(session-head-probe.test.ts)锁住这个事实。
- *  · `PUT /v1/sessions/:id/policy` 的 `owner === null ⇒ 409 conflict.session_ownerless`:那是**有意的
- *    fail-closed** —— 无主会话没有稳定的 run-principal,存下去的规则读不到、静默失效。放宽它等于制造
- *    一条 fail-open,不在本臂辖域。
+ *  · `GET|PUT /v1/sessions/:id/policy` 的 `owner === null ⇒ 409 conflict.session_ownerless`:那是**有意的
+ *    fail-closed** —— 规则按「会话 × principal」存、按 run 的 principal 读,而规则路由的存储键就是会话的属主;无主会话没有
+ *    这把键,替它读写规则只能**猜**一个 principal(猜错 = 200 说已生效,其实没有哪条 run 读它)。已经存下的规则不受影响:
+ *    它们存在当初那个属主的键下,那个 principal 的 run 照读照生效(7.119.0 前 local 后端重启即把属主忘掉,于是那些规则
+ *    在跑、却读不到也删不掉 —— 修在属主落盘,不在放宽本门)。放宽它等于制造一条 fail-open,不在本臂辖域。
  *  · `…/sync/*`(PULL/PUSH/import):PULL 虽是只读、形同 workspace,但这一族**带一条破坏性 import 腿**
  *    (`isDestructiveSessionWrite` 明列),而 [ref]/[ref] 裁的是会话**读面与生命周期**四门。放宽一个
  *    写面族超出裁定射程 —— 要做另立一次表态,不在本臂里顺手带过。

package/dist/security.js

@@ -75,6 +75,10 @@ export function createAuthorizer(config, sessionStore) {
                         throw new HttpError(403, "cannot claim a caller-supplied sessionId on a multi-tenant deployment: this worker's session store cannot record session ownership, so the id would stay unowned and the next caller could attach to it. Configure a durable session backend (SESSION_BACKEND), or omit sessionId to start a new session.");
                     }
                 }
+                else if (owner === null && principal !== undefined && !config.requirePrincipal && register) {
+                    await register(requested, principal);
+                    owner = await ownerOf(requested);
+                }
                 const legacyShellOwner = !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
                 if (!legacyShellOwner && owner != null && owner !== principal) {
                     throw principal

package/dist/session-policy-wire.js

@@ -1,5 +1,5 @@
-import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, judgeRuleToolName } from "@sema-agent/core";
-import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
+import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent } from "@sema-agent/core";
+import { describeEmptyToolSegment, emptyToolSegmentOf } from "./namespaced-rule-name.js";
 const RULE_FIELDS = {
     toolAllow: true,
     toolDeny: true,
@@ -102,19 +102,14 @@ function describeUnreachableSessionRuleName(u) {
     return `${u.field} names "${u.name}", which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
 }
 function describeLegacyToolName(r) {
+    const why = r.guidance !== undefined ? ` (${r.guidance})` : "";
     switch (r.verdict) {
-        case "retired": {
-            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
-            const guidance = v.kind === "retired" ? v.guidance : `renamed "${r.currentName ?? "?"}"`;
-            return `${r.field} names "${r.name}", a retired tool name (${guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` ("${r.currentName}")` : ""}`;
-        }
+        case "retired":
+            return `${r.field} names "${r.name}", a retired tool name${why}; with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` ("${r.currentName}")` : ""}`;
         case "unprefixed_namespace":
             return `${r.field} names "${r.name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
-        case "unmintable_segment": {
-            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
-            const guidance = v.kind === "unmintable_segment" ? v.guidance : "a protocol name whose peer segment the engine never mints";
-            return `${r.field} names "${r.name}", which can never match a tool (${guidance}), so nothing was written`;
-        }
+        case "unmintable_segment":
+            return `${r.field} names "${r.name}", which can never match a tool${why}, so nothing was written`;
         default: {
             const unhandled = r.verdict;
             throw new Error(`unhandled legacy tool name verdict: ${JSON.stringify(unhandled)}`);

package/dist/spec-fields.d.ts

@@ -65,8 +65,12 @@ export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
- *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
- *  core 只对 allowTools 未知项 fail-loud,denyTools 未知项(如 typo)静默失效 —— 已上板请 core 镜像。
+ *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
+ *  **名字归引擎一只判**(core 7.45.0 #1377 / #1385,开跑前,三来源同判):没有工具能是的拼法(带空白 / 括号形坏 / 不可见字符)、非字符串条目 ⇒ 整 run 拒
+ *  `config.agent.unknown_tool`;无人挂的名 ⇒ 不拒、经 `onError`(phase `"config"`)告一次(本仓汇点 `runner_config_advisory`);大小写孪生 / 退役名(`bash`)
+ *  **在本仓部署形上也只告不拒** —— 主车道的委派工具带 extraTools 工厂(`capabilities/builtin-tools.ts`),引擎开跑前列不全子代工具池(`agentToolPool` 缺席)就不把
+ *  像 `Bash` 的名字判成拼错;引擎给宿主「声明可注入名册」的座后本仓声明名册、这两形回到开跑前拒;
+ *  `denyTools` 的 `Tool(content)` ⇒ 整只工具对该子代藏起并告。本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;

package/dist/store-posture.d.ts

@@ -8,24 +8,32 @@
  *
  * ## 形
  * `declared` = 运维的声明(`DB_BACKEND` 词,含缺省推导);`backend` = **装配出的**后端 kind(没装出后端 = `memory`);两者不等是合法的
- * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;auto 降级;缺省推导 local 起不来)—— 两位都上 wire,
+ * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;缺省推导 local 起不来)—— 两位都上 wire,
  * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
  * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
  */
 import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
+import type { ServiceConfig } from "./config-types.js";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
 /**
- * 降级词闭集(**按后端族**,不按失败发生在哪一步 —— SQL 池懒连,连接失败第一次就出现在 `ensureSchema` 里,与 DDL 失败同一个调用,
- * 按调用位置分不出「连不上」与「建表失败」):
- *  · `db_unreachable` —— SQL 族(`mysql` / `pg`)在 `SESSION_BACKEND=auto` 下打不开(连接或建表);
+ * 降级词闭集(**按后端族**,不按失败发生在哪一步):
  *  · `local_unwritable` —— **缺省推导**的 local 文件店构造期失败(mkdir / 数据根锁 / 权限 / 只读挂载 / 磁盘满)。
+ *
+ * 🔴 SQL 族**没有**降级词:配了 DSN 的库当下打不开 ⇒ 窗内重试、到窗拒启(`plugins/store-open-wait.ts` / `openStoreBackendWithFallback`),
+ * 从来不退成内存 —— 修前这里有第二个词 `db_unreachable`(`SESSION_BACKEND=auto` 下 SQL 族打不开 ⇒ 内存 + 本位置位),那是 [ref] P 类的静默 fail-open,随降级臂一并退役。
  */
-export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
+export declare const STORE_DEGRADED_REASONS: readonly ["local_unwritable"];
 export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
-/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
+/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。只有缺省推导的 `local` 走得到降级臂;`mysql` / `pg` / `memory` 走到这里 = 装配缺陷,响亮抛。 */
 export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
+/**
+ * `/health.sessionBackend` 与 `listening` 日志 `session` 位的**唯一读法**:装配后的 `config.sessionBackend`(`memory` | `tidb`;`tidb` = 「后端自己的 durable 店」的泛指标签)
+ * + 装配出的后端 kind ⇒ 对运维说人话的有效店 —— `durable(pg)` / `durable(mysql)` / `durable(local)` / `memory`。`sessionBackend` 缺 backend 的 `tidb`
+ * 不替它编一个后端名(那是装配缺陷,`createSessionStore` 会先拒)。部署侧的 smoke(`deploy/sema-up/lib/health.sh`)按这一形读同一位。
+ */
+export declare function sessionStoreLabelOf(sessionBackend: ServiceConfig["sessionBackend"], backendKind: StoreBackend["kind"] | undefined): string;
 /** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
 export interface StorePosture {
     readonly declared: StoreBackendWord;

package/dist/store-posture.js

@@ -1,12 +1,12 @@
 import { projectSqlEngineCapability } from "./sql-engine-posture.js";
-export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
+export const STORE_DEGRADED_REASONS = ["local_unwritable"];
 export function storeDegradedReasonFor(declared) {
     switch (declared) {
-        case "mysql":
-        case "pg":
-            return "db_unreachable";
         case "local":
             return "local_unwritable";
+        case "mysql":
+        case "pg":
+            throw new Error(`store posture: DB_BACKEND=${declared} never degrades to memory (a configured SQL store is retried then refused, never replaced) — this is a wiring defect`);
         case "memory":
             throw new Error("store posture: DB_BACKEND=memory never opens a backend, so it cannot degrade — this is a wiring defect");
         default: {
@@ -15,6 +15,9 @@ export function storeDegradedReasonFor(declared) {
         }
     }
 }
+export function sessionStoreLabelOf(sessionBackend, backendKind) {
+    return sessionBackend === "tidb" && backendKind !== undefined ? `durable(${backendKind})` : sessionBackend;
+}
 export function buildStorePosture(a) {
     return { declared: a.declared, backend: a.assembled ?? "memory", ...(a.degradedReason !== undefined ? { degradedReason: a.degradedReason } : {}) };
 }

package/dist/task-settings.d.ts

@@ -27,8 +27,8 @@
  *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
  *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
  *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
- *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
- *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
+ *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收 core `PERMISSION_MODES` **全集**
+ *    (default | acceptEdits | plan | auto | bypassPermissions | dontAsk),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
  *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[ref] 拍照。
  *
@@ -51,60 +51,32 @@ import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy,
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 /**
- * S-902(7.107.0,车QY 候裁 11 裁 A;[ref])—— core 的**每一个**权限模式词,本仓请求面收不收:`"request"` = 受理(顶层 `permissionMode` /
- * `settings.permissions.defaultMode` / `?permissionMode=` 查询串三处同读),`"excluded"` = 显式排除(不上请求面)。
- *
- * 🔴 这张表是**表态**,不是词表的第二份:词与词序只从 core `PERMISSION_MODES` 来(下面 {@link SETTINGS_PERMISSION_MODES} 按它过滤);
- * 表只对每个词说一句「收 / 不收」。`satisfies Record<PermissionMode, …>` 对 core 的词型**穷举**:core 加一个词 ⇒ 本表缺键 **编译红**
- * (新词必须被表态一次,不会被静默收进请求面、也不会被静默漏掉);core 删 / 改名一个词 ⇒ 本表多键编译红(残条目不留)。
- *
- * 今天的表态(与 7.106.0 逐字同行为):五词受理;`dontAsk`(CC 的「自动拒」档,core 7.34.0 起第六词)**排除** —— 它上不上请求面是一件
- * 新能力(未裁,本表不替它裁);不收它时提交面 400 `request.field_invalid`,续跑重放腿按 {@link coercePermissionMode} 的既有宽读折 `default`。
- * 语义沿革(为什么是这五个、`bypassPermissions` / `auto` 何时进来):[ref] / [ref] / [ref] —— CC 自己的全集是六词,CC 托管 / 远端形收四词
- * (= 本仓 − `bypassPermissions`),本仓 = {CC 远端四词} ∪ {`bypassPermissions`},登记过的偏离;生效模式原样过境 `TaskSpec.permissionMode`(S-877)。
+ * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
+ * `?permissionMode=` 查询串三处同读)。本仓不持有第二份词表,也不持有「收 / 不收」的表态:判据 = core 的 `isPermissionMode`,型 = core 的
+ * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它,它在派生腿上的去向由
+ * {@link deriveSettingsPolicy} 的穷举 `switch` 逼出来(缺一臂 ⇒ 编译红);core 删 / 改名一个词 ⇒ 本文件里按名写出它的那一臂编译红。
+ * 生效模式原样过境 `TaskSpec.permissionMode`(S-877):引擎自己解释模式 —— 含 `dontAsk`(CC 的「自动拒」档:凡是要问的一律由模式拒,零卡,
+ * 门记录 `deniedBy:"mode"`),本仓不另写判。
  */
-export declare const PERMISSION_MODE_REQUEST_FACE: {
-    readonly default: "request";
-    readonly acceptEdits: "request";
-    readonly plan: "request";
-    readonly auto: "request";
-    readonly bypassPermissions: "request";
-    readonly dontAsk: "excluded";
-};
-/** 请求面受理的模式词的型形 —— 从表态表派生(`"request"` 那几行的键)。 */
-export type SettingsPermissionMode = {
-    [M in PermissionMode]: (typeof PERMISSION_MODE_REQUEST_FACE)[M] extends "request" ? M : never;
-}[PermissionMode];
-/** 请求面受理的模式词(core 序)= core `PERMISSION_MODES` 过滤表态 `"request"`。wire 门、coerce 两族、两句 400 文案同读这一份。 */
-export declare const SETTINGS_PERMISSION_MODES: readonly SettingsPermissionMode[];
-/** 显式排除集(core 序)= core `PERMISSION_MODES` 过滤表态 `"excluded"`;今天恰是 `["dontAsk"]`。只作披露 / 钉读,不参与判定。 */
-export declare const SETTINGS_PERMISSION_MODES_EXCLUDED: readonly Exclude<PermissionMode, SettingsPermissionMode>[];
-/** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
-export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
-/** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */
-export declare function isSettingsPermissionMode(raw: unknown): raw is SettingsPermissionMode;
+/** 请求面闭集的 wire 文案形(`"a" | "b" | …`,core 序)—— 三处 400(顶层 / bundle / 查询串)的句子从这里取词,不再各抄一份。 */
+export declare const PERMISSION_MODE_WORDS: string;
 /**
- * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
- * CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
+ * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends
+ * the CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
  * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the mode only selects the CLIENT-derived
  * gate ({@link deriveSettingsPolicy}); it can never subtract from the deployment/operator policy (applyTaskSettings
- * folds via tightenTaskSpec, deny-wins). Post-[ref] the honored set is the five-word table above (NOT "CC verbatim" —
- * see the {@link SettingsPermissionMode} header for the three-set contrast; the earlier "five CC modes" wording here
- * was [ref] P2-1's finding: no CC set has five members). `acceptEdits`,
- * `bypassPermissions` and `auto` are HONORED as gate-shape choices (they no longer coerce to `default`, which
- * would FORCE the manual ask gate onto a caller that explicitly asked for less asking — with the gate live, the old
- * coercion would have been a behavior change for them, incl. a headless-deny regression for bypass callers). An
- * UNKNOWN string still coerces to `default` (fail-safe: the most-asking mode).
- * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-five-mode value
- * (server.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
+ * folds via tightenTaskSpec, deny-wins). The honored set is core's `PERMISSION_MODES` in full — every word passes
+ * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
+ * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
+ * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
+ * (admission.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
  * population the gate deliberately does not cover: RESUME replay of a persisted pre-gate body (outputStyle/model
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
-export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
-/** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
- *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠。
- *  S-496:词表单点已上移到 {@link SETTINGS_PERMISSION_MODES},本函数只是它的 `undefined` 形读者。 */
-export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
+export declare function coercePermissionMode(raw: unknown): PermissionMode | undefined;
+/** 闭集的**严格**读法(`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,不走上面那条给 resume 重放留的 `default` 宽臂)。
+ *  上面的宽读只是本函数外再包一层折叠;词表只有 core 的 `PERMISSION_MODES`(判据 `isPermissionMode`)。 */
+export declare function coercePermissionModeStrict(raw: unknown): PermissionMode | undefined;
 /**
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
  * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
@@ -116,8 +88,8 @@ export declare function coercePermissionModeStrict(raw: unknown): SettingsPermis
  * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
  * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
  *
- * 🔴 **不手抄词表**:`satisfies readonly SettingsPermissionMode[]` 让「本表的成员必须仍是本仓受理的
- * 模式词」成为**编译期**事实 —— 五词表某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
+ * 🔴 **不手抄词表**:`satisfies readonly PermissionMode[]` 让「本表的成员必须仍是 core 的模式词」成为**编译期**事实 ——
+ * core 某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
  */
 export declare const PLAN_APPROVE_PERMISSION_MODES_AFTER: readonly ["default", "acceptEdits"];
 /** {@link PLAN_APPROVE_PERMISSION_MODES_AFTER} 的类型形(值表单点,类型从值派生 —— 两处各写一份就会漂)。 */
@@ -139,7 +111,7 @@ export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is P
 export declare function storedBodyPermissionMode(body: {
     permissionMode?: unknown;
     settings?: unknown;
-}): SettingsPermissionMode | undefined;
+}): PermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
@@ -148,7 +120,7 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
 /** R4: fold a top-level `body.permissionMode` onto the parsed settings as `permissions.defaultMode` (the top-level
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
-export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
+export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: PermissionMode): ParsedTaskSettings;
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
@@ -161,7 +133,7 @@ export declare function withPermissionMode(settings: ParsedTaskSettings | undefi
  */
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
-}, settings: ParsedTaskSettings | undefined): SettingsPermissionMode | undefined;
+}, settings: ParsedTaskSettings | undefined): PermissionMode | undefined;
 /**
  * S-346 —— [ref] 技能清单预算两旋钮的**值域谓词**(一对具名单铸点)。
  *
@@ -187,7 +159,7 @@ export interface ParsedTaskSettings {
         deny?: string[];
         /** Carried for completeness; v1 folds `ask` into the gate via the deny-wins base (see {@link applyTaskSettings}). */
         ask?: string[];
-        defaultMode?: SettingsPermissionMode;
+        defaultMode?: PermissionMode;
         /** [ref] 件⑥([ref] §3.4,[ref];PM 裁 [ref]):CC settings 的 kill-switch `permissions.disableAutoMode`,cli 投影
          *  (settingsRulesWire.ts toWireSettings)而此前本白名单丢弃 ⇒ 用户/managed 层关 auto 到不了引擎。语义 = 只能关
          *  不能开(tighten-only):把生效模式 auto 折 default(座不写 ⇒ 不武装)。折叠单点 = {@link effectivePermissionMode}。