@sema-agent/server 7.118.0 → 7.120.0

package/dist/plugins/store-backend.d.ts

@@ -398,8 +398,11 @@ export declare function createStoreBackend(config: ServiceConfig, onWarn?: BootL
  *  而 LocalBackend 的 `ensureSchema` 是**空实现**,真正会抛的 mkdir + 数据根 BootLock 在构造函数里、
  *  落在 try 之外。于是那条降级臂对 local 形从来没生效过,注释宣称的行为与代码真做的事撕裂。
  *
- *  降级条件不变(两形同一姿势):`sessionBackend=auto`(配置的 DB 不可达,S5 原形)或**默认推导**的
- *  local(`dbBackend=local && !dbBackendExplicit`)。**显式** DB_BACKEND=local / tidb 仍 fail-loud——
+ *  **降级臂只有一条:缺省推导的 local**(`dbBackend=local && !dbBackendExplicit`)。🔴 **SQL 族没有降级臂** —— 配了 DSN 就是要这只库:
+ *  `SESSION_BACKEND=auto` 与显式 `DB_BACKEND=mysql|pg` 同一待遇,库当下打不开 ⇒ 在 `STORE_LOCK_WAIT_MS` 的窗内重试
+ *  ({@link openWithinWait}),到窗仍打不开 ⇒ 拒启(拒句 {@link buildSqlStoreOpenRefusal} 点名后端与库的显示安全形)。修前 `auto` 在这里
+ *  静默落内存(只留一行 warn):会话 / 停驻 / run 账本进进程内存、重启即丢,而 `/health` 照样 200 —— [ref] P 类 fail-open。
+ *  零 DSN 的内存是配置说的(`config.ts` 的 `auto` 在无坐标时就不探测),不经过本函数。**显式** DB_BACKEND=local 仍 fail-loud——
  *  operator 要了 durable,静默丢=丢数据。 */
 export declare function openStoreBackendWithFallback(config: ServiceConfig, logger: {
     warn: (msg: string, meta?: Record<string, unknown>) => void;
@@ -409,9 +412,17 @@ export declare function openStoreBackendWithFallback(config: ServiceConfig, logg
     degradedReason: StoreDegradedReason | undefined;
 }>;
 /**
- * S-866 ⑤c / G4 —— SQL 族「显式要了持久而店打不开」的拒启句(唯一铸点)。点名 `DB_BACKEND=<引擎>`,给三条出路:修坐标 / 连通性;
- * `SESSION_BACKEND=auto`(尽力而为:店不可达时以内存起服,什么都不持久);`DB_BACKEND=memory`(显式内存部署)。驱动原文只取 message
- * (与修前 `fatalExit` 打出的同一句),凭据不在其中(驱动不回显口令)。
+ * 已配置的 SQL 库坐标 → 一条只含 `scheme://host:port` 的 URL 串,**交给**配置型 URL 的唯一显示铸点 {@link buildDisplaySafeUrl}
+ * (出口处写 `buildDisplaySafeUrl(sqlStoreCoordinatesAsUrl(config))`)。它**不是**一份显示投影:显示形只有铸点一只;这里只做「结构化坐标 → URL 串」的拼装
+ * (`config.tidb` / `config.pg` 本来就是结构化坐标,没有 DSN 字符串),user / password / database 一概不进产物。
+ * host 过不了闭字符集(拼进 URL 会把 `/` `@` `?` 之类带成别的成分)或无坐标 ⇒ 交出一个不是 URL 的串,铸点答它的占位 `«redacted:url»`。
+ * scheme 只是引擎名(`postgres` / `mysql`),不对应任何连接。
  */
-export declare function buildSqlStoreOpenRefusal(engine: "mysql" | "pg", err: unknown): string;
+export declare function sqlStoreCoordinatesAsUrl(config: Pick<ServiceConfig, "dbBackend" | "tidb" | "pg">): string;
+/**
+ * SQL 族「配了 DSN 而店打不开(窗内重试过了)」的拒启句(唯一铸点)。点名 `DB_BACKEND=<引擎>`、库的显示安全形(`postgres://host:port` / `mysql://host:port`,经 {@link sqlStoreCoordinatesAsUrl} 拼出、再过 {@link buildDisplaySafeUrl},
+ * 不带口令)、等了多久,出路两条:修坐标 / 连通性(窗是 `STORE_LOCK_WAIT_MS`);或**显式**内存部署(`DB_BACKEND=memory`)。🔴 没有第三条
+ * 「`SESSION_BACKEND=auto` 内存起服」—— 那一条就是被删掉的静默降级。驱动原文只取 message(与修前 `fatalExit` 打出的同一句),凭据不在其中(驱动不回显口令)。
+ */
+export declare function buildSqlStoreOpenRefusal(engine: "mysql" | "pg", endpoint: string, waitedMs: number, err: unknown): string;
 //# sourceMappingURL=store-backend.d.ts.map

package/dist/plugins/store-backend.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
 import { createCorruptReadFailOpenSeat, createDurableAbsenceSeat } from "../observability/corrupt-read-seat.js";
+import { createLogger } from "../observability/logger.js";
 import { join } from "node:path";
-import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
+import { AdoptionError, FileStorageBackend } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { fileSessionCaptureRecordStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
@@ -12,8 +13,7 @@ import { StoreBootRefusalError } from "./store-contracts.js";
 import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
-import { LocalSessionStore } from "./local-session-store.js";
-import { noteReplayInSessionOpenScope } from "../session-records-skipped-notice.js";
+import { LocalSessionStore, createLocalSessionRepo } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
@@ -30,6 +30,7 @@ import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-s
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { fileMemoryControlDirFor } from "../memory-scope.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
@@ -55,6 +56,7 @@ import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { storeDegradedReasonFor } from "../store-posture.js";
+import { openWithinWait } from "./store-open-wait.js";
 function historyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
@@ -240,9 +242,7 @@ class LocalBackend {
             throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
                 (tail === undefined ? "" : ` ${tail}`));
         }
-        this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root, {
-            onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInSessionOpenScope),
-        }), this.fileBackend.root);
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.fileBackend.root, { log: createLogger(config.logLevel) });
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
@@ -344,21 +344,41 @@ export function createStoreBackend(config, onWarn, onError) {
     return new TiDBBackend(createTidbPool(config), config);
 }
 export async function openStoreBackendWithFallback(config, logger) {
-    const mayFallback = config.dbBackend === "local" ? !config.dbBackendExplicit : config.sessionBackend === "auto";
+    const sqlEngine = config.dbBackend === "mysql" || config.dbBackend === "pg" ? config.dbBackend : undefined;
+    const mayFallback = config.dbBackend === "local" && !config.dbBackendExplicit;
     let backend;
+    let inFlight;
     try {
-        backend = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
-        if (backend)
-            await backend.ensureSchema();
+        const attempt = async () => {
+            let built;
+            try {
+                built = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
+                inFlight = built;
+                if (built)
+                    await built.ensureSchema();
+                inFlight = undefined;
+                return built;
+            }
+            catch (err) {
+                inFlight = undefined;
+                await built?.close().catch(() => undefined);
+                throw err;
+            }
+        };
+        backend =
+            sqlEngine === undefined
+                ? await attempt()
+                : await openWithinWait(attempt, config.storeLockWaitMs, (w) => logger.warn("store_sql_open_wait", { engine: sqlEngine, endpoint: buildDisplaySafeUrl(sqlStoreCoordinatesAsUrl(config)), waitMs: w.waitMs, error: w.error }));
     }
     catch (err) {
+        void inFlight?.close().catch(() => undefined);
         if (err instanceof AdoptionError)
             throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
         if (!mayFallback) {
-            if (config.dbBackend === "mysql" || config.dbBackend === "pg")
-                throw new Error(buildSqlStoreOpenRefusal(config.dbBackend, err), { cause: err });
+            if (sqlEngine !== undefined)
+                throw new Error(buildSqlStoreOpenRefusal(sqlEngine, buildDisplaySafeUrl(sqlStoreCoordinatesAsUrl(config)), config.storeLockWaitMs, err), { cause: err });
             throw err;
         }
         logger.warn("store_db_unreachable_fallback_memory", {
@@ -370,11 +390,21 @@ export async function openStoreBackendWithFallback(config, logger) {
     }
     return { backend, degradedReason: undefined };
 }
-export function buildSqlStoreOpenRefusal(engine, err) {
+const SQL_HOST = /^(?:[A-Za-z0-9._-]{1,253}|\[[0-9A-Fa-f:.]{2,45}\])$/;
+const SQL_COORDINATES_UNPRINTABLE = "<unprintable-coordinates>";
+export function sqlStoreCoordinatesAsUrl(config) {
+    const coords = config.dbBackend === "pg" ? config.pg : config.tidb;
+    if (coords === undefined || !SQL_HOST.test(coords.host))
+        return SQL_COORDINATES_UNPRINTABLE;
+    return `${config.dbBackend === "pg" ? "postgres" : "mysql"}://${coords.host}:${coords.port}`;
+}
+export function buildSqlStoreOpenRefusal(engine, endpoint, waitedMs, err) {
     const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
     const detail = err instanceof Error ? err.message : String(err);
-    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store (${detail}) — refusing to boot, because DB_BACKEND asks for a durable store and SESSION_BACKEND does not allow running without it. ` +
-        `Next: fix the ${coords} coordinates or the store's reachability; or set SESSION_BACKEND=auto to boot in memory while the store is unreachable (best effort — nothing persists, and /health reports storeDegraded); ` +
-        `or set DB_BACKEND=memory for an explicitly in-memory deployment.`);
+    const waited = waitedMs > 0 ? `after retrying for ${waitedMs}ms (STORE_LOCK_WAIT_MS)` : "on the first attempt (STORE_LOCK_WAIT_MS=0: no wait)";
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
+        `(SESSION_BACKEND=auto included: sessions, parked runs and every durable record would silently live in memory and vanish on restart). ` +
+        `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); ` +
+        `or run explicitly in memory with DB_BACKEND=memory (and remove the ${coords} coordinates).`);
 }
 //# sourceMappingURL=store-backend.js.map

package/dist/plugins/store-open-wait.d.ts

@@ -0,0 +1,33 @@
+/** 进入等待腿时的**一次性**披露(结构上只在第一次失败时调一次,不是靠一个 flag 挡刷屏)。 */
+export type StoreOpenWaitSink = (fields: {
+    readonly waitMs: number;
+    readonly error: string;
+}) => void;
+/** 时钟三面(异步形:`sleep` 返回 Promise)。三面都是形参,判据不靠真时间。`deadline` = 一只可取消的到点信号(窗尾打断挂起的尝试用)。 */
+export interface StoreOpenWaitClock {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    deadline(ms: number): {
+        readonly expired: Promise<void>;
+        cancel(): void;
+    };
+}
+/** {@link openWithinWait} 抛出的是不是「到窗仍未返回、且从没有过一次真失败」那一形(调用方据此区分「没有证据」与「有一次确定的失败」)。 */
+export declare function isStoreOpenWindowExpired(err: unknown): boolean;
+/**
+ * 跑 `open`;失败且窗为正 ⇒ 在窗内每 {@link STORE_LOCK_POLL_MS} 重试。
+ *
+ * 🔴 **窗尾只有一条规则**:到窗时手上有一次**完成了的**真失败 ⇒ **原样**抛最近那一次(同一个对象,不重铸 —— 库的拒句读驱动原文,桶的拒句读
+ * 「缺桶」那只错);**从头到尾一次真失败都没有**(每次尝试都挂着)⇒ 抛 {@link StoreOpenWindowExpired}(「到窗仍未返回」,{@link isStoreOpenWindowExpired} 判别)。
+ *  · 窗从**第一次尝试开始**算,每次尝试与**剩余**窗赛跑 —— 挂起的尝试到窗尾也被打断(库接受了 TCP 却永不回握手、DDL 被长期锁住);被打断的那次尝试
+ *    不再有人等它:它迟到的结局被吞掉(没人接 = 未处理拒绝会杀进程),它手上的资源由调用方的 `open` 自己收(见 `openStoreBackendWithFallback` 的在飞登记)。
+ *  · 剩余窗 ≤ 0 **不再起新一次尝试**:一次失败之后的等待吃完了窗,就抛那次失败 —— 不起一次注定跟 0 ms 的到点赛跑、又几乎总是输的尝试
+ *    (那一形会把一次确定的失败换成「到窗仍未返回」:口令错读成库挂住、缺桶读成没有证据)。
+ * 窗为 0 ⇒ **只试一次、不设界**(与 7.118.x 同形:一次尝试挂多久由驱动自己的超时决定 —— 本腿不替它造一个)。
+ *
+ * @param open    一次完整尝试(造后端 + `ensureSchema()` / 一次桶探针);**失败时必须自己把这次造出的池还回去**,窗内会被再调用。
+ * @param waitMs  `config.storeLockWaitMs`。`> 0` 才等;`0` / 非数 ⇒ 只试一次(`!(waitMs > 0)` 同时盖住「键缺席」的手搓 config)。
+ * @param onWait  进入等待腿的一次性披露口(第一次完成的失败时调一次)。
+ */
+export declare function openWithinWait<T>(open: () => Promise<T>, waitMs: number, onWait: StoreOpenWaitSink, clock?: StoreOpenWaitClock): Promise<T>;
+//# sourceMappingURL=store-open-wait.d.ts.map

package/dist/plugins/store-open-wait.js

@@ -0,0 +1,73 @@
+import { STORE_LOCK_POLL_MS } from "./store-lock-wait.js";
+const REAL_CLOCK = {
+    now: () => performance.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    deadline: (ms) => {
+        let timer;
+        const expired = new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        });
+        return { expired, cancel: () => clearTimeout(timer) };
+    },
+};
+class StoreOpenWindowExpired extends Error {
+    constructor(waitMs) {
+        super(`the open attempt was still pending when the ${waitMs}ms window ended`);
+    }
+}
+export function isStoreOpenWindowExpired(err) {
+    return err instanceof StoreOpenWindowExpired;
+}
+export async function openWithinWait(open, waitMs, onWait, clock = REAL_CLOCK) {
+    if (!(waitMs > 0))
+        return await open();
+    const startedAt = clock.now();
+    let lastFailure;
+    for (;;) {
+        const remainingMs = waitMs - (clock.now() - startedAt);
+        if (lastFailure !== undefined && remainingMs <= 0)
+            throw lastFailure.error;
+        const deadline = clock.deadline(Math.max(remainingMs, 0));
+        let outcome;
+        try {
+            outcome = await Promise.race([
+                attemptOnce(open).then((value) => ({ kind: "opened", value }), (error) => ({ kind: "failed", error })),
+                deadline.expired.then(() => ({ kind: "window_ended" })),
+            ]);
+        }
+        finally {
+            deadline.cancel();
+        }
+        switch (outcome.kind) {
+            case "opened":
+                return outcome.value;
+            case "window_ended":
+                if (lastFailure !== undefined)
+                    throw lastFailure.error;
+                throw new StoreOpenWindowExpired(waitMs);
+            case "failed": {
+                if (lastFailure === undefined)
+                    onWait({ waitMs, error: outcome.error instanceof Error ? outcome.error.message : String(outcome.error) });
+                lastFailure = { error: outcome.error };
+                const left = waitMs - (clock.now() - startedAt);
+                if (left <= 0)
+                    throw outcome.error;
+                await clock.sleep(Math.min(STORE_LOCK_POLL_MS, left));
+                break;
+            }
+            default: {
+                const unhandled = outcome;
+                throw new Error(`unhandled open attempt outcome: ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
+}
+function attemptOnce(open) {
+    try {
+        return open();
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+}
+//# sourceMappingURL=store-open-wait.js.map

package/dist/rule-entry-list.d.ts

@@ -21,7 +21,6 @@
  */
 import { compileAllowList } from "@sema-agent/core";
 import { emptyToolSegmentOf } from "./namespaced-rule-name.js";
-export declare function presentRuleEntry(entry: string): string;
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
 export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
 /**

package/dist/rule-entry-list.js

@@ -1,11 +1,6 @@
 import { compileAllowList } from "@sema-agent/core";
+import { displayListEntry } from "./list-entry-display.js";
 import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES, ruleEntryToolName } from "./namespaced-rule-name.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-const PRESENTED_ENTRY_MAX = 160;
-export function presentRuleEntry(entry) {
-    const clean = entry.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return clean.length <= PRESENTED_ENTRY_MAX ? clean : `${clean.slice(0, PRESENTED_ENTRY_MAX)}…(${entry.length} chars)`;
-}
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
 export function describeAllowLayerOverCap(field, count) {
@@ -26,14 +21,14 @@ export function emptyToolSegmentEntryOf(list) {
     return undefined;
 }
 export function describeEmptyToolSegmentEntry(field, u) {
-    return `${field} names "${presentRuleEntry(u.entry)}", which can never match a tool (${describeEmptyToolSegment(u.ns)})`;
+    return `${field} names ${displayListEntry(u.entry)}, which can never match a tool (${describeEmptyToolSegment(u.ns)})`;
 }
 export function inertRuleEntriesOf(list, behavior) {
     return compileAllowList(list, behavior, NO_DECLARED_TOOL_NAMES).inert;
 }
 export function inertRuleEntryGuidance(i) {
     const reason = i.reason;
-    const write = i.currentName !== undefined ? ` — write "${presentRuleEntry(i.currentName)}"` : "";
+    const write = i.currentName !== undefined ? ` — write ${displayListEntry(i.currentName)}` : "";
     switch (reason) {
         case "tool_name":
             return `the tool name can never match a mounted tool (${i.verdict ?? "stale"})${write}`;
@@ -50,7 +45,7 @@ export function inertRuleEntryGuidance(i) {
         case "content_unsupported":
             return "this tool takes no content form here — name the tool itself, or use Bash(<command>) / Bash(<prefix>:*) for a shell command";
         case "grammar":
-            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name) — write the tool name exactly, with no padding";
+            return "the entry is not read as written (surrounding whitespace, an empty or unbalanced tool name, or an invisible or control character in the tool name) — write the tool name exactly, with no padding";
         default: {
             const unhandled = reason;
             throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);
@@ -58,7 +53,7 @@ export function inertRuleEntryGuidance(i) {
     }
 }
 export function describeInertRuleEntries(field, inert) {
-    return inert.map((i) => `${field} entry "${presentRuleEntry(i.entry)}" reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+    return inert.map((i) => `${field} entry ${displayListEntry(i.entry)} reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
 }
 const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function skillDenyInertSentence(skill) {

package/dist/rules-consent.d.ts

@@ -163,7 +163,7 @@ export interface LocalImportRuleKey {
  * 它在端点上先判、有自己的整句文案,而且判完就把类型收窄掉(`permission-rule-vocab.ts` 的
  * `DIRECT_RULE_WRITE_ADMITS`)⇒ 放宽态根本到不了本表所服务的那段代码。 */
 export type LocalImportRefusalCode = 
-/** scope 串读不出形(既不是 `global` 也不是 `project:<非空 root>`)。 */
+/** scope 串读不出形,或读出来的 scope 引擎的 durable 谓词不收(既不是 `global` 也不是 `project:<绝对 root>`;判据 = {@link parseRuleScope})。 */
 "scope_unreadable"
 /** scope 的 project root 里有 bidi 控制符([ref]② Trojan Source 族):人看到的射程与机器判据用的
  *  射程不是同一串 —— 一条规则的**作用范围**因此可以被伪装。 */
@@ -480,7 +480,7 @@ export declare function serializeRuleScope(scope: RuleScope): string;
  * 各挑各的」这件事本身,不是把某个数字调大一点)。
  *
  * 病:铸侧 `cardRuleScopeRoot` 对 root 长度零把关(入口尺 = `isValidCwd` 的 {@link MAX_CWD_CHARS}),
- * core 与两个店都只校验 `root.min(1)` ⇒ 写面全程无阻;而 `DELETE /v1/rules` 的体 schema 此前独立写死
+ * core 与两个店都不设 root 长度上限 ⇒ 写面全程无阻;而 `DELETE /v1/rules` 的体 schema 此前独立写死
  * `scope: max(1088)`,且 safeParse 排在 `parseRuleScope`/权限判据**之前** ⇒ 超限 root 的规则
  * `GET /v1/rules` **列得出**、按同一串 DELETE **恒 400**。全仓只有一个 `lane.removeRule` 调用点(直删
  * 店行是无墓碑硬删、会被 sync 的 join 复活),所以那是**一条已列出的常驻放行规则在受支持接口上不可撤**;
@@ -502,8 +502,17 @@ export type DurableRuleScope = Exclude<RuleScope, {
     kind: "session";
 }>;
 /** {@link serializeRuleScope} 的逆。读不出形 ⇒ `undefined`(调用方 400,绝不猜一个 global 出来 ——
- *  猜 global 会把一次「删项目内规则」的请求变成一次删不掉任何东西的 no-op,或者更糟)。 */
+ *  猜 global 会把一次「删项目内规则」的请求变成一次删不掉任何东西的 no-op,或者更糟)。
+ *
+ *  🔴 **收不收只有一只判据:core 的 `isValidDurableScope`**(引擎 7.46.0 起 project root 必须是完整绝对路径:`/…`、`X:\…` /
+ *  `X:/…`、`\\host\…`)。四个 wire 入口(`/v1/rules` 写 / 撤 / 列举过滤、local-import 的行)都经这里;cc-import 的层 root 调同一只
+ *  谓词(`http/routes/rules.ts`)。修前这里手抄了一份「root 非空」:`project:myproj` 本仓收、引擎写臂拒(写口答 503「再发一次」——
+ *  客户端会无限重试)、引擎读侧丢(撤销口删不动),一条规则在两侧是两种命运。存量的那种行由一次性迁移 M11 删
+ *  (`plugins/one-time-migrations.ts` 登记表)。 */
 export declare function parseRuleScope(text: string): DurableRuleScope | undefined;
+/** 引擎不收的 scope(或 cc-import 层 root)的**唯一一句**拒句:写 / 撤 / 列举过滤三个路由口、cc-import 预览的层 root、local-import 的成员拒因
+ *  `scope_unreadable` 都出站这一只(各口的码照旧各自的),不在读点各抄一份。 */
+export declare const RULE_SCOPE_REFUSAL_SENTENCE = "scope must be 'global' or 'project:<root>' with an absolute root";
 /** 一条规则在 wire 上的行 = 一个逻辑 (rule, scope) 对([ref] v2 §6 F5)。
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */

package/dist/rules-consent.js

@@ -5,7 +5,7 @@ import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -57,9 +57,10 @@ export function parseRuleScope(text) {
         return { kind: "global" };
     if (!text.startsWith("project:"))
         return undefined;
-    const root = text.slice("project:".length);
-    return root === "" ? undefined : { kind: "project", root };
+    const scope = { kind: "project", root: text.slice("project:".length) };
+    return isValidDurableScope(scope) ? scope : undefined;
 }
+export const RULE_SCOPE_REFUSAL_SENTENCE = "scope must be 'global' or 'project:<root>' with an absolute root";
 export function sameWireRuleIdentity(row, identity) {
     return row.behavior === identity.behavior && row.rule === identity.rule && row.scope === identity.scope;
 }
@@ -163,7 +164,7 @@ function anchorBatchMembers(members, displayed) {
 function screenLocalImportRow(row) {
     const scope = parseRuleScope(row.scope);
     if (scope === undefined) {
-        return { reason: "scope_unreadable", detail: "scope must be 'global' or 'project:<root>' with a non-empty root" };
+        return { reason: "scope_unreadable", detail: RULE_SCOPE_REFUSAL_SENTENCE };
     }
     if (scope.kind === "project" && hasBidiControls(scope.root)) {
         return {

package/dist/run-local.js

@@ -33,7 +33,7 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildScenarios, gateScenarioRequest, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutExecutionEnv } from "./capabilities/hands-lane.js";
 import { HttpError } from "./security.js";
@@ -56,6 +56,7 @@ import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.
 import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { installOutboundDispatcher } from "./outbound-dispatcher.js";
+import { provisionSemaConfigDir } from "./sema-config-dir.js";
 export function parseArgs(argv) {
     let objective;
     let root;
@@ -139,6 +140,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     content_question: { remedy: "terminal_only", autoBudgetReleases: false },
     hook: { remedy: "terminal_only", autoBudgetReleases: false },
     ancestor: { remedy: "terminal_only", autoBudgetReleases: false },
+    dangerous_delete: { remedy: "terminal_only", autoBudgetReleases: false },
     unverifiable_delete: { remedy: "terminal_only", autoBudgetReleases: false },
     transcript_write: { remedy: "terminal_only", autoBudgetReleases: false },
     org_rule: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -324,6 +326,7 @@ export async function runLocal(argv, deps = {}) {
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     installSecretEnvScrubRecorder({ logger, metrics });
     logConfigDiagnostics(logger);
+    provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
     const providerInput = { provider: config.configProvider ?? "local", localDir: root };
     try {
@@ -592,11 +595,11 @@ export async function runLocal(argv, deps = {}) {
         const { overlay } = centerScenarios(scenarioDeps, effective.scenarios.scenarios, Object.keys(scenarios), logger);
         Object.assign(scenarios, overlay);
     }
-    const requested = args.scenario ?? config.defaultScenario;
-    const scenarioName = scenarios[requested] ? requested : "default";
+    let scenarioName = args.scenario ?? config.defaultScenario;
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
+        scenarioName = gateScenarioRequest(undefined, args.scenario, config.defaultScenario, Object.keys(scenarios), logger);
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {

package/dist/security.d.ts

@@ -72,9 +72,11 @@ export declare const LEGACY_UNOWNED_AMNESTY_TENANT = "default";
  *  · `runOwnerOk` 三读面(head / audit 单读 / events):`owner === null` 那一支**本来就放行**
  *    (判据是 `owner !== null && principal !== owner`),不需要本臂。[ref] 帖文里「单读 404」一句
  *    经亲读实现行**不成立**,已加现状钉(session-head-probe.test.ts)锁住这个事实。
- *  · `PUT /v1/sessions/:id/policy` 的 `owner === null ⇒ 409 conflict.session_ownerless`:那是**有意的
- *    fail-closed** —— 无主会话没有稳定的 run-principal,存下去的规则读不到、静默失效。放宽它等于制造
- *    一条 fail-open,不在本臂辖域。
+ *  · `GET|PUT /v1/sessions/:id/policy` 的 `owner === null ⇒ 409 conflict.session_ownerless`:那是**有意的
+ *    fail-closed** —— 规则按「会话 × principal」存、按 run 的 principal 读,而规则路由的存储键就是会话的属主;无主会话没有
+ *    这把键,替它读写规则只能**猜**一个 principal(猜错 = 200 说已生效,其实没有哪条 run 读它)。已经存下的规则不受影响:
+ *    它们存在当初那个属主的键下,那个 principal 的 run 照读照生效(7.119.0 前 local 后端重启即把属主忘掉,于是那些规则
+ *    在跑、却读不到也删不掉 —— 修在属主落盘,不在放宽本门)。放宽它等于制造一条 fail-open,不在本臂辖域。
  *  · `…/sync/*`(PULL/PUSH/import):PULL 虽是只读、形同 workspace,但这一族**带一条破坏性 import 腿**
  *    (`isDestructiveSessionWrite` 明列),而 [ref]/[ref] 裁的是会话**读面与生命周期**四门。放宽一个
  *    写面族超出裁定射程 —— 要做另立一次表态,不在本臂里顺手带过。

package/dist/security.js

@@ -75,6 +75,10 @@ export function createAuthorizer(config, sessionStore) {
                         throw new HttpError(403, "cannot claim a caller-supplied sessionId on a multi-tenant deployment: this worker's session store cannot record session ownership, so the id would stay unowned and the next caller could attach to it. Configure a durable session backend (SESSION_BACKEND), or omit sessionId to start a new session.");
                     }
                 }
+                else if (owner === null && principal !== undefined && !config.requirePrincipal && register) {
+                    await register(requested, principal);
+                    owner = await ownerOf(requested);
+                }
                 const legacyShellOwner = !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
                 if (!legacyShellOwner && owner != null && owner !== principal) {
                     throw principal

package/dist/sema-config-dir.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from "./observability/logger.js";
+/** 部署声明的配置根(绝对路径);没声明 ⇒ `undefined`;空串 ⇒ 抛(起服拒,句子点名变量与出路)。纯读 env,不碰文件。**只有 `loadConfig` 调它**
+ *  (结果 = 配置席 `agentConfigDir`);别的读者读那一席。 */
+export declare function declaredSemaConfigDir(env?: NodeJS.ProcessEnv): string | undefined;
+/** 配置根:配置席 `agentConfigDir`(`loadConfig` 铸,声明了的根)在 ⇒ 它;缺席 ⇒ `~/.sema`(与引擎读字面 `~/.sema` 同一处)。不读 env。 */
+export declare function configRootOf(config: {
+    readonly agentConfigDir?: string;
+}): string;
+/**
+ * 起服的**供给动作**(每个入口一次:HTTP 服务第 1 段、`run-local`,都在 logger 建起来之后、任何 Runner 之前):声明了配置根 ⇒ 确保目录在
+ * (不在就建,`0700` —— 本服务本来就往里写 LKG / 缓存 / 店)。没声明 ⇒ 什么都不做(`~/.sema` 由各写者首次写时自建,同 7.119.x)。
+ *
+ * **建不出来不在这里拒**:能不能用由引擎判(`new Runner` 对不是已存在目录的根拒 `config.agent_config_dir_invalid`,起服随之拒),本服务
+ * 只把建目录这件事的失败如实说一行(`sema_config_dir_unprovisioned`,点名变量与 errno)—— 运维在引擎的拒句之前就看到是哪根旋钮、为什么建不出。
+ */
+export declare function provisionSemaConfigDir(config: {
+    readonly agentConfigDir?: string;
+}, logger: Pick<Logger, "warn">): void;
+//# sourceMappingURL=sema-config-dir.d.ts.map

package/dist/sema-config-dir.js

@@ -0,0 +1,33 @@
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+export function declaredSemaConfigDir(env = process.env) {
+    const raw = env.SEMA_CONFIG_DIR;
+    if (raw === undefined)
+        return undefined;
+    if (raw === "") {
+        throw new Error('env SEMA_CONFIG_DIR="" is empty — refusing to start rather than moving the configuration files: up to 7.119.x an empty value meant the process ' +
+            "working directory (the last-known-good config, the skill cache and the scheduler store were kept there), and reading it as unset would move them " +
+            "to ~/.sema without a word. Unset the variable to use ~/.sema, or set it to the directory you mean (to keep the old place, the working directory's path).");
+    }
+    return resolve(raw);
+}
+export function configRootOf(config) {
+    return config.agentConfigDir ?? join(homedir(), ".sema");
+}
+export function provisionSemaConfigDir(config, logger) {
+    const dir = config.agentConfigDir;
+    if (dir === undefined)
+        return;
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    catch (e) {
+        logger.warn("sema_config_dir_unprovisioned", {
+            dir,
+            err: e instanceof Error ? e.message : String(e),
+            note: "SEMA_CONFIG_DIR names a directory this server could not create — the engine refuses a configuration root that is not an existing directory when the first Runner is built, so the boot stops there with the engine's refusal: create the directory, point the variable at one, or unset it (the default is ~/.sema)",
+        });
+    }
+}
+//# sourceMappingURL=sema-config-dir.js.map

package/dist/session-policy-wire.js

@@ -1,5 +1,6 @@
-import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, judgeRuleToolName } from "@sema-agent/core";
-import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
+import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent } from "@sema-agent/core";
+import { displayListEntry } from "./list-entry-display.js";
+import { describeEmptyToolSegment, emptyToolSegmentOf } from "./namespaced-rule-name.js";
 const RULE_FIELDS = {
     toolAllow: true,
     toolDeny: true,
@@ -99,22 +100,17 @@ export function describeSessionPermissionRulesProblem(p) {
     }
 }
 function describeUnreachableSessionRuleName(u) {
-    return `${u.field} names "${u.name}", which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
+    return `${u.field} names ${displayListEntry(u.name)}, which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
 }
 function describeLegacyToolName(r) {
+    const why = r.guidance !== undefined ? ` (${r.guidance})` : "";
     switch (r.verdict) {
-        case "retired": {
-            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
-            const guidance = v.kind === "retired" ? v.guidance : `renamed "${r.currentName ?? "?"}"`;
-            return `${r.field} names "${r.name}", a retired tool name (${guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` ("${r.currentName}")` : ""}`;
-        }
+        case "retired":
+            return `${r.field} names ${displayListEntry(r.name)}, a retired tool name${why}; with that rule in place this session could not start another run, so nothing was written — use the current tool name${r.currentName !== undefined ? ` (${displayListEntry(r.currentName)})` : ""}`;
         case "unprefixed_namespace":
-            return `${r.field} names "${r.name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
-        case "unmintable_segment": {
-            const v = judgeRuleToolName(r.name, NO_DECLARED_TOOL_NAMES);
-            const guidance = v.kind === "unmintable_segment" ? v.guidance : "a protocol name whose peer segment the engine never mints";
-            return `${r.field} names "${r.name}", which can never match a tool (${guidance}), so nothing was written`;
-        }
+            return `${r.field} names ${displayListEntry(r.name)}, which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
+        case "unmintable_segment":
+            return `${r.field} names ${displayListEntry(r.name)}, which can never match a tool${why}, so nothing was written`;
         default: {
             const unhandled = r.verdict;
             throw new Error(`unhandled legacy tool name verdict: ${JSON.stringify(unhandled)}`);

package/dist/spec-fields.d.ts

@@ -65,8 +65,13 @@ export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
- *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
- *  core 只对 allowTools 未知项 fail-loud,denyTools 未知项(如 typo)静默失效 —— 已上板请 core 镜像。
+ *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
+ *  **名字归引擎一只判**(core 7.45.0 #1377 / #1385,开跑前,三来源同判):没有工具能是的拼法(带空白 / 括号形坏 / 不可见字符)、非字符串条目 ⇒ 整 run 拒
+ *  `config.agent.unknown_tool`;无人挂的名 ⇒ 不拒、经 `onError`(phase `"config"`)告一次(本仓汇点 `runner_config_advisory`);大小写孪生 / 退役名(`bash` / `BASH`)
+ *  ⇒ 开跑前拒 `config.agent.unknown_tool` —— 主车道的委派工具带 extraTools 工厂,本仓在同一处声明它的名册(core 7.46.0 `extraToolNames`;工厂与名册读同一批工具对象,
+ *  `capabilities/builtin-tools.ts` `createSubagentExtraTools`),引擎因此列得出子代工具池。两张表管子代手里的**全部**工具:委派池与 hands 内建(`Read` / `Edit` / `Write` /
+ *  `Bash` …,core #1430)—— `denyTools:["Write"]` ⇒ 子代没有 `Write`;`allowTools` 只点了调用方工具 ⇒ 子代一只 hands 工具都没有。hands 行之外的引擎工具
+ *  (`Monitor` 等)仍不受这两张表管(引擎已知限制)。`denyTools` 的 `Tool(content)` ⇒ 整只工具对该子代藏起并告。本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;