@sema-agent/server 7.118.0 → 7.120.0

package/dist/bake-runner/protocol.d.ts

@@ -78,6 +78,11 @@ export declare function dockerBuildTickFrame(lineOrd: number, elapsedSec: number
 export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "timeout", detail?: {
     error?: string;
 }): IngestFrame;
+/**
+ * 失败尾巴的行数 —— **唯一**常量:缓冲({@link createStderrTail})保留这么多行,终局句({@link exitDoneFrame})取这么多行。
+ * 两处读同一个数,所以缓冲里「保留的」恒等于消费方「要的」:既没有消费方想要而已被丢掉的行,也没有永远用不上的行占内存。
+ */
+export declare const STDERR_TAIL_LINES = 12;
 /**
  * The runner-side terminal `done` for a build.sh CHILD that exited non-zero WITHOUT printing its own `done` (build.sh
  * normally dies via `die()` which DOES print a `done:FAILED`, but a SIGKILL or a crash before the trap can leave the
@@ -87,6 +92,19 @@ export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "tim
 export declare function exitDoneFrame(lineOrd: number, exitCode: number, stderrTail: string): IngestFrame;
 /** Keep only the last `n` lines of a (possibly long) stderr tail — bounds the error string we forward. */
 export declare function lastLines(text: string, n: number): string;
+/** 有界的 stderr 尾部缓冲:只保留**末** {@link STDERR_TAIL_LINES} 行(环形:新行进来、最老的出去)。 */
+export interface StderrTail {
+    /** 收一行(spawner 已按换行切好;这里仍按 {@link contentLines} 判据过一遍,空行不入)。 */
+    push(raw: string): void;
+    /** 当前保留的行,`\n` 连接;空缓冲 = 空串。可直接交 {@link exitDoneFrame}。 */
+    text(): string;
+}
+/**
+ * 修前缓冲是 `if (stderrTail.length < 80) push` —— 留的是**首** 80 行,而消费方({@link exitDoneFrame})要的是**末** 12 行:
+ * 超过 80 行的失败里,「尾巴」是前 80 行的末 12 行,真正的最后一行(失败原因所在)一个字也进不来。
+ * 现在留末 N 行;N = {@link STDERR_TAIL_LINES}。
+ */
+export declare function createStderrTail(): StderrTail;
 /**
  * The profile-aware HARD DEADLINE (§P2.7/§P2.11) the runner enforces by killing the process group. flutter/full are
  * the heavy profiles (~60min); everything else ~45min. A bands build ("custom") is treated as heavy if it includes

package/dist/bake-runner/protocol.js

@@ -33,6 +33,7 @@ export function synthDoneFrame(lineOrd, kind, detail) {
     }
     return { event: "done", lineOrd, status: "FAILED", exitCode: 124, error: detail?.error ?? "bake hard-deadline exceeded (killed)" };
 }
+export const STDERR_TAIL_LINES = 12;
 export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
     const tail = stderrTail.trim();
     return {
@@ -40,13 +41,32 @@ export function exitDoneFrame(lineOrd, exitCode, stderrTail) {
         lineOrd,
         status: "FAILED",
         exitCode,
-        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, 12)}` : `build.sh exited ${exitCode}`,
+        error: tail.length > 0 ? `build.sh exited ${exitCode}: ${lastLines(tail, STDERR_TAIL_LINES)}` : `build.sh exited ${exitCode}`,
     };
 }
+function contentLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((l) => l.replace(/\r$/, ""))
+        .filter((l) => l.length > 0);
+}
 export function lastLines(text, n) {
-    const lines = text.split(/\r?\n/).filter((l) => l.length > 0);
+    const lines = contentLines(text);
     return lines.slice(Math.max(0, lines.length - n)).join("\n");
 }
+export function createStderrTail() {
+    const lines = [];
+    return {
+        push(raw) {
+            for (const l of contentLines(raw)) {
+                lines.push(l);
+                if (lines.length > STDERR_TAIL_LINES)
+                    lines.shift();
+            }
+        },
+        text: () => lines.join("\n"),
+    };
+}
 export function deadlineMsForProfile(profile, bands) {
     const HEAVY_MS = 60 * 60 * 1000;
     const NORMAL_MS = 45 * 60 * 1000;

package/dist/bake-runner/runner.d.ts

@@ -11,10 +11,12 @@ export interface ClaimedBake {
     profile?: string | null;
     bands?: string[] | null;
 }
-/** The ingest/heartbeat response — image-api echoes whether a cancel was requested so the runner kills the group. */
-export interface IngestAck {
+/** The heartbeat response (a no-frame `…/ingest` POST) — image-api echoes whether a cancel was requested so the runner
+ *  kills the group, and whether the lease is still ours. The heartbeat is the ONE place these two bits are read
+ *  ({@link BakeRunner.runOne}'s supervisor); a frame ingest's ack has no reader, so `ingest` returns nothing. */
+export interface HeartbeatAck {
     accepted: boolean;
-    /** The durable cancel flag (§P2.11) — polled off EVERY ingest/heartbeat response (≤heartbeat-interval lag). */
+    /** The durable cancel flag (§P2.11) — read off each HEARTBEAT response (≤ heartbeat-interval lag). */
     cancelRequested?: boolean;
     /** False when the lease was lost/stolen (the runner aborts + kills the child — it no longer owns the build). */
     leaseValid?: boolean;
@@ -51,10 +53,11 @@ export interface ChildSpawner {
 export interface ImageApiClient {
     /** Long-poll for + claim the next queued bake; null when none is claimable right now. */
     claimNext(): Promise<ClaimedBake | null>;
-    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header); returns the ack (cancel/lease). */
-    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<IngestAck>;
-    /** Heartbeat the lease forward (also surfaces cancel/lease state) — distinct from a frame ingest. */
-    heartbeat(bakeId: string, ingestSecret: string): Promise<IngestAck>;
+    /** POST one frame to `…/ingest` (carries the per-bake ingest secret header). Resolves with nothing: the runner reads no
+     *  ack off a frame ingest (the cancel / lease bits are read off {@link ImageApiClient.heartbeat} only). */
+    ingest(bakeId: string, ingestSecret: string, frame: Record<string, unknown>): Promise<void>;
+    /** Heartbeat the lease forward and surface the cancel / lease state — the only call whose response the runner reads. */
+    heartbeat(bakeId: string, ingestSecret: string): Promise<HeartbeatAck>;
 }
 /** Host-side ops the runner needs that are NOT image-api calls (fs + a thin docker-push wrapper for the big-blob
  *  retry — NOT a build.sh --replay). All injected so the orchestration is testable off build-host. */
@@ -208,7 +211,8 @@ export declare class BakeRunner {
      *  reaper + a mid-build fill guard still protect the host). */
     private freeGbOrNull;
     /** Ingest one frame, swallowing transient errors (the buffered-retry of unsent lines is the real-runner's job;
-     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). */
+     *  image-api's uq_line makes a re-send a no-op, so a dropped frame is recoverable, never a crash). Returns nothing:
+     *  the cancel / lease bits are read off the heartbeat response only, never off a frame ingest's ack. */
     private safeIngest;
 }
 /** Allocate the next per-bake lineOrd (monotonic from 1) — the at-least-once ingest dedupe key (§P2.10). */

package/dist/bake-runner/runner.js

@@ -1,5 +1,5 @@
 import { resolve as resolvePath } from "node:path";
-import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, } from "./protocol.js";
+import { lineToFrame, dockerBuildTickFrame, synthDoneFrame, exitDoneFrame, deadlineMsForProfile, parseDfFreeGb, parseBuildShLine, manifestPathFromLine, createStderrTail, } from "./protocol.js";
 const DEFAULT_HEARTBEAT_MS = 30_000;
 const DEFAULT_IDLE_POLL_MS = 5_000;
 const DEFAULT_MIN_FREE_GB = 20;
@@ -137,7 +137,7 @@ export class BakeRunner {
             await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), 1, `recipe checkout failed: ${String(err)}`));
             return;
         }
-        const stderrTail = [];
+        const stderrTail = createStderrTail();
         let lastManifestPath = null;
         let lastImageTag = null;
         let sawDone = false;
@@ -166,10 +166,7 @@ export class BakeRunner {
                 }
                 enqueueIngest(lineToFrame(raw, nextOrd(ord)));
             },
-            onStderrLine: (raw) => {
-                if (stderrTail.length < 80)
-                    stderrTail.push(raw);
-            },
+            onStderrLine: (raw) => stderrTail.push(raw),
         });
         inFlight.child = child;
         const deadlineMs = deadlineMsForProfile(bake.profile ?? "custom", bake.bands ?? null);
@@ -230,7 +227,7 @@ export class BakeRunner {
             return;
         }
         const code = exit.code ?? (exit.signal ? 137 : 1);
-        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.join("\n")));
+        await this.safeIngest(bake, exitDoneFrame(nextOrd(ord), code, stderrTail.text()));
     }
     async forwardDone(bake, ord, doneLine, lastManifestPath, lastImageTag) {
         let line = doneLine;
@@ -309,11 +306,10 @@ export class BakeRunner {
     }
     async safeIngest(bake, frame) {
         try {
-            return await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
+            await this.o.api.ingest(bake.bakeId, bake.ingestSecret, frame);
         }
         catch (err) {
             this.o.log.warn("bake_ingest_error", { bakeId: bake.bakeId, lineOrd: frame.lineOrd, err: String(err) });
-            return null;
         }
     }
 }

package/dist/boot/config-center.js

@@ -316,7 +316,7 @@ export async function createConfigCenterRuntime(ctx) {
     };
     let bootConfigPending;
     const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
-    const lkgPathFor = (identity) => process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker, identity);
+    const lkgPathFor = (identity) => config.configLkgPath ?? defaultLkgPath(config, cc?.worker, identity);
     const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
     let lkgBooted = false;
     let bootLkgCandidate;
@@ -335,10 +335,10 @@ export async function createConfigCenterRuntime(ctx) {
         const lkgPath = lkgPathFor(identity);
         try {
             if (effectiveObj.skills && config.configCenter) {
-                await applyCenterSkills([], effectiveObj.skills, config.configCenter, logger, undefined, defaultSkillCacheDir());
+                await applyCenterSkills([], effectiveObj.skills, config.configCenter, logger, undefined, defaultSkillCacheDir(config));
             }
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
-            const cacheDir = defaultSkillCacheDir();
+            const cacheDir = defaultSkillCacheDir(config);
             for (const m of enabledSkills) {
                 const hex = m.contentHash.replace(/^sha256:/, "").toLowerCase();
                 if (!SHA256_HEX_RE.test(hex))
@@ -375,7 +375,7 @@ export async function createConfigCenterRuntime(ctx) {
                 return null;
             }
             const lkgPath = lkgPathFor(identity);
-            const legacy = await migrateV1Lkg({ legacyPath: process.env.CONFIG_LKG_PATH ?? legacyV1LkgPath(cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
+            const legacy = await migrateV1Lkg({ legacyPath: config.configLkgPath ?? legacyV1LkgPath(config, cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
             switch (legacy.outcome) {
                 case "none":
                     break;
@@ -622,9 +622,9 @@ export async function createConfigCenterRuntime(ctx) {
         },
         async applyCenterCapabilities(skills) {
             if (effective?.skills && config.configCenter) {
-                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
+                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir(config) : undefined);
             }
-            if (effective?.plugins) {
+            if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,

package/dist/boot/coordinators.js

@@ -1,6 +1,7 @@
 import { ElicitationCoordinator } from "../elicitation.js";
 import { QuestionCoordinator } from "../question.js";
 import { ToolApprovalCoordinator, resolveStreamApprovalGate } from "../tool-approval.js";
+import { deploymentListAsks } from "../approval.js";
 import { FileApprovalAskAuditStore } from "../approval-ask-audit-store.js";
 import { SendUserFileEmitter, SEND_USER_FILE_MAX_BYTES, sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { createSandboxFileSend, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
@@ -58,7 +59,9 @@ export function createLiveCoordinators(ctx) {
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(getParkedRedeem !== undefined ? { parkedRedeem: getParkedRedeem } : {}),
             ...(approvalAskAudit !== undefined ? { askAudit: approvalAskAudit } : {}),
-            ...(approvalExemptionStore !== undefined ? { sessionGrants: approvalExemptionStore } : {}),
+            ...(approvalExemptionStore !== undefined
+                ? { sessionGrants: approvalExemptionStore, deploymentListAsks: (call) => deploymentListAsks(config, call) }
+                : {}),
             ...(parkCommits !== undefined ? { parkCommits } : {}),
         })
         : undefined;

package/dist/boot/device-lane.d.ts

@@ -59,9 +59,9 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * `boot/leader.ts` 的 `assertLeaderDurableStore`)。
  *
  * config 层的门①判的是「运维配没配 SQL 坐标」——那句话回答的是**意图**。它回答不了「这次启动**真的
- * 拿到**了店吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto` 下(🔴 S-866 注改真:`auto` **不是**缺省 ——
- * 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动。那次启动里 device lane 的四表整个不在,
+ * 拿到**了店吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto` 下,SQL 连不上 /
+ * 建表失败 ⇒ `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,见 `plugins/store-open-wait.ts`;
+ * 仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`,刻意不持久 ⇒ 不开店)。那次启动里 device lane 的四表整个不在,
  * 而 `boot/execution-env.ts` 的第七臂拿不到三件 ⇒ `executionEnvFactory` 落 `undefined` ⇒ core 拿
  * `StubExecutionEnv`:**一台自称在员工设备上执行的 worker 实际在自己进程里跑,而且回执同形**。
  * 那正是 [ref]「执行车道禁静默降级」点名的样板病,也正是 A-1 那条临时门当初要拦的东西 —— 换执法点,

package/dist/boot/device-lane.js

@@ -40,8 +40,7 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
         return;
     if (!lane) {
         throw new Error("REMOTE_EXEC=device but the device lane could not be wired at boot [device-lane-unwired]: the SQL backend is " +
-            "configured yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback " +
-            "when SESSION_BACKEND=auto), so the device registry / session↔device binding / audit tables are absent. " +
+            "configured yet this replica did not get one, so the device registry / session↔device binding / audit tables are absent. " +
             "Refusing to serve a lane that would silently fall back to the in-process stub env — a worker claiming to " +
             "execute on the employee's device while actually running inside its own process (#157). Fix the database " +
             "(or unset REMOTE_EXEC) and restart (device-executor-lane-v2 §4.7)");

package/dist/boot/execution-env.js

@@ -205,9 +205,10 @@ export function createExecutionEnv(ctx) {
     }
     else if (config.remoteExec?.provider === "host") {
         {
+            const schedulerStorePath = config.schedulerStorePath ?? defaultSchedulerStorePath(config);
             const hostScheduler = facts.hostScheduler(config).available
                 ? new FileSchedulerBackend({
-                    ...(config.schedulerStorePath ? { storePath: config.schedulerStorePath } : {}),
+                    storePath: schedulerStorePath,
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false
                         ? {
                             caps: {
@@ -219,7 +220,7 @@ export function createExecutionEnv(ctx) {
                 })
                 : undefined;
             if (hostScheduler)
-                logger.info(`R7: self-wake scheduler enabled (host lane), store=${config.schedulerStorePath ?? defaultSchedulerStorePath()}`);
+                logger.info(`R7: self-wake scheduler enabled (host lane), store=${schedulerStorePath}`);
             const hostCfg = {
                 ...homeDirSeat,
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),

package/dist/boot/fatal-exit.d.ts

@@ -1,4 +1,10 @@
-/** `err` 的 fatal 日志文本:`String(err)` 过形状律一次。纯函数,零副作用。 */
+/**
+ * `err` 的 fatal 日志文本:标题过形状律一次。纯函数,零副作用。
+ *
+ * 标题 = `String(err)`;异常**自带机器码**(`err.code` 是串 —— 引擎的构造期拒因都带,如 `config.agent_config_dir_invalid`)⇒ 按 Node 给自家
+ * 带码异常的写法 `<name> [<code>]: <message>` 把码写进标题(`String(err)` 不带 `code`,修前拒启行里看不到引擎的码)。一条规则,不分谁铸的:
+ * 多数 Node 自己的 `ERR_*` 异常本来就印成这一形(逐字不变),系统调用异常(`EEXIST` 等)标题里多一次码。
+ */
 export declare function buildFatalErrorText(err: unknown): string;
 /**
  * 进程级 fatal 出口的**唯一一只腿**:同一只 {@link buildFatalErrorText} 产物写两个面,然后按崩溃码退。

package/dist/boot/fatal-exit.js

@@ -1,7 +1,8 @@
 import { redactSecrets } from "../trace/redact.js";
 import { createLogger } from "../observability/logger.js";
 export function buildFatalErrorText(err) {
-    return redactSecrets(String(err));
+    const code = err instanceof Error ? err.code : undefined;
+    return redactSecrets(typeof code === "string" && err instanceof Error ? `${err.name} [${code}]: ${err.message}` : String(err));
 }
 export function fatalExit(err) {
     const text = buildFatalErrorText(err);

package/dist/boot/leader.d.ts

@@ -64,10 +64,10 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  * [ref] 车4 件2 的**能力面**门(codex 交叉复审 R1-high①,验真后修)。
  *
  * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
- * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`
- * 下(🔴 S-866 注改真:`auto` **不是**缺省 —— 缺省是 `memory`,`DB_BACKEND` 显式 mysql|pg 时缺省 `mysql`;`auto` 要显式写),SQL 连不上 /
- * 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动。那次启动里
- * `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
+ * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 曾在 `SESSION_BACKEND=auto`
+ * 下,SQL 连不上 / 建表失败 ⇒ 返回 `backend=undefined` + 一条 warn 就继续启动(那条降级臂已退役:配了 DSN 的库窗内重试、到窗拒启,
+ * 见 `plugins/store-open-wait.ts`)。仍走得到本门的形:`DB_BACKEND=mysql|pg` 声明了 SQL 而 `SESSION_BACKEND=memory`(声明 pg、刻意不持久 ⇒ 不开店)。
+ * 那次启动里 `leaderRun()` 缺席,leader 端点会静默落进单副本内存臂:多副本各自受理同一个 Idempotency-Key、
  * 跨副本 GET 404、重启失忆 —— 而这条腿的产物是**真 git push**。
  *
  * ⇒ 判据锚**真拿到了没有**。纯谓词、只吃两个原语(与 {@link leaderK8sMinioGap} 同姿势),便于单测。

package/dist/boot/leader.js

@@ -15,8 +15,7 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
     if (!leaderEnabled || hasLeaderRunStore)
         return;
     throw new Error("LEADER_ENABLED=true but no durable leader-run store is available at boot — the SQL backend is configured " +
-        "yet this replica did not get one (an unreachable DB / failed DDL degrades to the in-memory fallback when " +
-        "SESSION_BACKEND=auto). Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
+        "yet this replica did not get one. Refusing to serve the leader endpoint from a single-replica in-memory registry: " +
         "the `leader_run` table is what makes a retried submit idempotent and a cross-replica GET answerable, and " +
         "without it a retry starts a SECOND real git push. Fix the database (or unset LEADER_ENABLED) and restart " +
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");

package/dist/boot/parked-revive-gate.d.ts

@@ -3,6 +3,7 @@ import type { ServiceConfig } from "../config.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
 import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
     readonly remoteExec?: ServiceConfig["remoteExec"];
@@ -43,6 +44,8 @@ export interface ParkedReviveGateDeps {
      *    headless auto-deny,比「再问人一次」严且哑。交了之后最坏也是 park,方向 fail-safe。
      */
     readonly approverSeat: RunnerDepsOnAsk | undefined;
+    /** 会话豁免店(部署名单那一问的「本会话放行」读面;`StoreBackend.approvalExemption()` 结构满足)。缺席 = 部署没有 store backend ⇒ 名单照问。 */
+    readonly approvalExemptionStore: Pick<ApprovalExemptionStore, "has"> | undefined;
     /**
      * [ref] —— core `RunnerDeps.runtimeCapsResolver` 的**同一只**(main.ts 的 `runtimeCapsResolver`,
      * 单一属主同 `boot/runtime-caps.ts`)。重建条目的第三位决议链元数据 `autoModeArmed` 的唯一判据是
@@ -64,6 +67,7 @@ export interface ParkedReviveGateDeps {
      *  这一座可改读它 —— 接线不在本次提货单内,见 7.106.0 收车档「未闭环」。 */
     readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
+        info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;
     };
     /** host 腿 cwd 占位的落地根(main.ts 的 `localRoot`;`config.localDataRoot` 优先)。 */
@@ -90,7 +94,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * 赎回腿的父约束链重建([ref] 件二)。
  *
  * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(durable question 门 + F4 高危写
- * 审批门)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
+ * 审批门 + 部署名单那一问的豁免读面)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
  * (→ core `tightenTaskSpec`)叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE /
  * 守卫集),取其 `toolPolicy` 装进单层 `parentConstraints`。
  *

package/dist/boot/parked-revive-gate.js

@@ -6,11 +6,12 @@ import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { createDeploymentListExemption } from "../approval.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
+    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
@@ -26,7 +27,12 @@ export function createParkedReviveInheritedGate(deps) {
                 ...homeBase,
             }
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
-        const baseline = createApprovalBaselinePolicy(config, { kind: "durable", question });
+        const rootSessionId = row.rootSessionId;
+        const baseline = createApprovalBaselinePolicy(config, {
+            kind: "durable",
+            question,
+            ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, rootSessionId, logger, "parked_revive") } : {}),
+        });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngineRoot }));
         return {
             parentConstraints: [

package/dist/boot/resolve-spec.js

@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -137,9 +137,8 @@ export function createResolveSpec(ctx) {
         return stamped;
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
-        const requested = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger);
+        const scenarioName = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario, Object.keys(scenarios), logger, auth?.principal);
         gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const scenarioName = scenarios[requested] ? requested : "default";
         const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId } : {});
         const centerDecls = getCenterPrompts()?.declarations;
         const appendLessPack = centerDecls
@@ -460,7 +459,11 @@ export function createResolveSpec(ctx) {
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
-                ? createApprovalBaselinePolicy(config, { kind: "durable", question: liveQuestionFace })
+                ? createApprovalBaselinePolicy(config, {
+                    kind: "durable",
+                    question: liveQuestionFace,
+                    ...(approvalExemptionStore !== undefined && auth?.sessionId ? { exemption: createDeploymentListExemption(approvalExemptionStore, auth.sessionId, logger) } : {}),
+                })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),

package/dist/boot/runner-deps.d.ts

@@ -311,9 +311,10 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools">;
-/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)。 */
-export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant">;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir">;
+/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)
+ *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)。 */
+export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant" | "configLkgPath">;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;

package/dist/boot/runner-deps.js

@@ -1,6 +1,7 @@
 import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
+import { lkgReadDenyRows } from "../config-lkg.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { createMemorySessionIncarnationSeat, sessionFaceReaderOf } from "./session-incarnation-seat.js";
@@ -9,7 +10,7 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
-import { defaultEngineNoticeRouter, presentNoticeDetail } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
@@ -41,7 +42,7 @@ const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUS
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
-        const detail = presentNoticeDetail(notice.code, notice.detail);
+        const detail = redactNoticeRuleText(notice.code, notice.detail);
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(detail !== undefined ? { detail } : {}) });
         if (metrics !== undefined && notice.code === "task.interrupt_unconsumed") {
             const origin = notice.detail?.origin;
@@ -57,11 +58,14 @@ export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRoute
 }
 export function buildDeploymentPostureSeats(config) {
     const crossSessionLayers = buildCrossSessionInboundLayers(config);
+    const lkgRows = lkgReadDenyRows(config.configLkgPath);
+    const readDenyAdditions = lkgRows.length === 0 ? config.readDenyPatterns : [...(config.readDenyPatterns ?? []), ...lkgRows];
     const seats = {
         readFace: config.readFace ? config.readFace : undefined,
-        readDenyPatterns: config.readDenyPatterns ? config.readDenyPatterns : undefined,
+        readDenyPatterns: readDenyAdditions ? readDenyAdditions : undefined,
         readDenyBuiltinTiers: config.readDenyBuiltinTiers ?? undefined,
         readDenyBuiltinExclude: config.readDenyBuiltinExclude ?? undefined,
+        agentConfigDir: config.agentConfigDir ?? undefined,
         memoryDelegationEvidence: config.memoryDelegationEvidence ?? undefined,
         memoryProvenance: config.memoryProvenance ?? undefined,
         memoryCapturePolicy: config.memoryCapturePolicy ?? undefined,

package/dist/boot/stage-01-config.js

@@ -13,6 +13,7 @@ import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub
 import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
+import { provisionSemaConfigDir } from "../sema-config-dir.js";
 export function runStage01() {
     const config = loadConfig();
     const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
@@ -44,6 +45,7 @@ export function runStage01() {
         else
             logger.info("run_failed", fields);
     });
+    provisionSemaConfigDir(config, logger);
     const localRoot = configLocalRoot(config);
     const rootsSplit = splitLocalRoots({
         localDataRoot: config.localDataRoot,

package/dist/boot/stage-07-capability-layer.js

@@ -10,7 +10,7 @@ import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntent
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
-import { buildScenarios, builtinScenarioDetails } from "../capabilities/scenarios.js";
+import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from "../capabilities/scenarios.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -169,6 +169,7 @@ export async function runStage07(ctx) {
             config, question, logger, localRoot,
             memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
+            approvalExemptionStore,
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,
         })
@@ -176,6 +177,9 @@ export async function runStage07(ctx) {
     const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps);
     const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
+    const defaultScenarioRefusal = danglingScenarioRefusal(config.defaultScenario, "deployment", Object.keys(scenarios));
+    if (defaultScenarioRefusal !== undefined)
+        throw new Error(defaultScenarioRefusal);
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
     return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveSurface, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, taskLimitCaps, taskTimeoutSec, userInputLedger, userInputLedgerStore, webSearchProvider: webSearchCfg?.provider };
 }

package/dist/boot/stage-10-http-server.js

@@ -12,6 +12,7 @@ import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs
 import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
+import { sessionStoreLabelOf } from "../store-posture.js";
 import { startFleetClientFromEnv } from "../fleet-client.js";
 import { createCenterWiringReader } from "../capabilities/center-wiring.js";
 import { readinessOf } from "../http/readiness.js";
@@ -133,7 +134,7 @@ export async function runStage10(ctx) {
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
     const deployment = {
-        sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        sessionStoreLabel: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         modelReady: () => configCenter.modelReady(),
         scenarioDetails,
         workflowsCapable,
@@ -269,7 +270,7 @@ export async function runStage10(ctx) {
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
-        session: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        session: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         memory: memoryEngine ? `engine(${memoryEngine.root})` : "off",
         instanceId,
         rateLimitPerMin: config.rateLimitPerMin,

package/dist/boot/stores.js

@@ -9,6 +9,7 @@ import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugin
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
+import { ensureSnapshotBucket } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -48,9 +49,12 @@ export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
     let storeDegradedReason;
+    const dsnConfigured = !!(config.tidb || config.pg);
+    if (config.snapshotBlobStore)
+        await ensureSnapshotBucket(config.snapshotBlobStore, config.storeLockWaitMs, logger);
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
-        (config.sessionBackend === "auto" && !!(config.tidb || config.pg));
+        (config.sessionBackend === "auto" && dsnConfigured);
     if (wantDb) {
         const opened = await openStoreBackendWithFallback(config, logger);
         backend = opened.backend;
@@ -111,7 +115,7 @@ export async function openStores(ctx) {
         metrics.setGauge("snapshot_blob_backend", 1, { backend: config.snapshotBlobStore ? "minio" : "sql" });
     }
     if (config.sessionBackend === "auto")
-        config.sessionBackend = backend ? "tidb" : "memory";
+        config.sessionBackend = dsnConfigured ? "tidb" : "memory";
     if (config.dbBackend === "local" && backend)
         config.sessionBackend = "tidb";
     let memoryEngine;
@@ -414,11 +418,12 @@ export async function openStores(ctx) {
     }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {
-        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): session/run CONTENT is " +
-            "durable there, but OWNER attribution is process-local and lost on restart (store-backend.ts §0.5 — durable " +
-            "owners = P1), so it cannot durably enforce multi-tenant session ownership. Use a SQL backend " +
-            "(DB_BACKEND=mysql|pg) for multi-tenant, or run local single-user with REQUIRE_PRINCIPAL=false (a BFF may " +
-            "still inject x-agent-principal per request for memory scoping and audit attribution).");
+        throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): the lane is single-user " +
+            "by construction — a session created before owners were recorded is claimed by the FIRST principal that submits " +
+            "to it during the upgrade window, and the lane's mutual-recognition arms assume one user — so it cannot enforce " +
+            "a multi-tenant session boundary. Use a SQL backend (DB_BACKEND=mysql|pg) for multi-tenant, or run local " +
+            "single-user with REQUIRE_PRINCIPAL=false (a BFF may still inject x-agent-principal per request for memory " +
+            "scoping and audit attribution).");
     }
     if (backend)
         assertCloudSnapshotBlobPosture(backend.kind, config);