@sema-agent/server 7.119.0 → 7.121.0

package/dist/boot/fatal-exit.d.ts

@@ -1,4 +1,10 @@
-/** `err` 的 fatal 日志文本:`String(err)` 过形状律一次。纯函数,零副作用。 */
+/**
+ * `err` 的 fatal 日志文本:标题过形状律一次。纯函数,零副作用。
+ *
+ * 标题 = `String(err)`;异常**自带机器码**(`err.code` 是串 —— 引擎的构造期拒因都带,如 `config.agent_config_dir_invalid`)⇒ 按 Node 给自家
+ * 带码异常的写法 `<name> [<code>]: <message>` 把码写进标题(`String(err)` 不带 `code`,修前拒启行里看不到引擎的码)。一条规则,不分谁铸的:
+ * 多数 Node 自己的 `ERR_*` 异常本来就印成这一形(逐字不变),系统调用异常(`EEXIST` 等)标题里多一次码。
+ */
 export declare function buildFatalErrorText(err: unknown): string;
 /**
  * 进程级 fatal 出口的**唯一一只腿**:同一只 {@link buildFatalErrorText} 产物写两个面,然后按崩溃码退。

package/dist/boot/fatal-exit.js

@@ -1,7 +1,8 @@
 import { redactSecrets } from "../trace/redact.js";
 import { createLogger } from "../observability/logger.js";
 export function buildFatalErrorText(err) {
-    return redactSecrets(String(err));
+    const code = err instanceof Error ? err.code : undefined;
+    return redactSecrets(typeof code === "string" && err instanceof Error ? `${err.name} [${code}]: ${err.message}` : String(err));
 }
 export function fatalExit(err) {
     const text = buildFatalErrorText(err);

package/dist/boot/resolve-spec.js

@@ -331,6 +331,7 @@ export function createResolveSpec(ctx) {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
             systemPrompt: typeof body.systemPrompt === "string" ? body.systemPrompt : undefined,
             appendSystemPrompt: acceptedAppend,
+            ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             sessionId: auth?.sessionId,
             principal: auth?.principal,
             images: body.images,

package/dist/boot/runner-deps.d.ts

@@ -311,9 +311,10 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools">;
-/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)。 */
-export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant">;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir">;
+/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)
+ *  + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)。 */
+export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools"> | "approvalGrant" | "configLkgPath">;
 export declare function buildDeploymentPostureSeats(config: DeploymentPostureConfig): DeploymentPostureSeats;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;

package/dist/boot/runner-deps.js

@@ -1,6 +1,7 @@
 import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
+import { lkgReadDenyRows } from "../config-lkg.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { createMemorySessionIncarnationSeat, sessionFaceReaderOf } from "./session-incarnation-seat.js";
@@ -9,7 +10,7 @@ import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
-import { defaultEngineNoticeRouter, presentNoticeDetail } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
@@ -41,7 +42,7 @@ const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUS
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
-        const detail = presentNoticeDetail(notice.code, notice.detail);
+        const detail = redactNoticeRuleText(notice.code, notice.detail);
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(detail !== undefined ? { detail } : {}) });
         if (metrics !== undefined && notice.code === "task.interrupt_unconsumed") {
             const origin = notice.detail?.origin;
@@ -57,11 +58,14 @@ export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRoute
 }
 export function buildDeploymentPostureSeats(config) {
     const crossSessionLayers = buildCrossSessionInboundLayers(config);
+    const lkgRows = lkgReadDenyRows(config.configLkgPath);
+    const readDenyAdditions = lkgRows.length === 0 ? config.readDenyPatterns : [...(config.readDenyPatterns ?? []), ...lkgRows];
     const seats = {
         readFace: config.readFace ? config.readFace : undefined,
-        readDenyPatterns: config.readDenyPatterns ? config.readDenyPatterns : undefined,
+        readDenyPatterns: readDenyAdditions ? readDenyAdditions : undefined,
         readDenyBuiltinTiers: config.readDenyBuiltinTiers ?? undefined,
         readDenyBuiltinExclude: config.readDenyBuiltinExclude ?? undefined,
+        agentConfigDir: config.agentConfigDir ?? undefined,
         memoryDelegationEvidence: config.memoryDelegationEvidence ?? undefined,
         memoryProvenance: config.memoryProvenance ?? undefined,
         memoryCapturePolicy: config.memoryCapturePolicy ?? undefined,

package/dist/boot/shutdown.d.ts

@@ -26,11 +26,12 @@ import type { Logger } from "../observability/logger.js";
 import type { startOtlpExporter } from "../observability/otel-exporter.js";
 import type { CostQuota } from "../observability/cost-quota.js";
 import type { RateLimiter } from "../observability/rate-limit.js";
-import type { startFleetClientFromEnv } from "../fleet-client.js";
+import type { startFleetClientFromConfig } from "../fleet-client.js";
 import type { BreakerStateStore, CostQuotaStore, RateLimiterStore, StoreBackend } from "../plugins/store-backend.js";
 import type { WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type DrainState } from "../fleet/drain-entry.js";
 export interface ShutdownCtx {
     config: ServiceConfig;
     /** [ref]①:崩溃遗言的 version 键(与 /v1/capabilities.version 同源=main 的 serviceVersion())。 */
@@ -61,16 +62,10 @@ export interface ShutdownCtx {
     subRunner: Runner;
     lspManager: RunnerDeps["lspManager"];
     workflowNotifyJournal: WorkflowNotifyJournalStore | undefined;
-    fleetClient: ReturnType<typeof startFleetClientFromEnv>;
+    fleetClient: ReturnType<typeof startFleetClientFromConfig>;
     backend: StoreBackend | undefined;
-    drainState: {
-        draining: boolean;
-        since?: number;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    /** 编排器片 2 件 2:共享排空盒子(`fleet/drain-entry.ts`)—— 本函数往上装**唯一**入口 `enter`。 */
+    drainState: DrainState;
     /** [ref]-2:store 活体探针(main 建)——不停的话 hardShutdown 后仍对正在关闭的池发探针,刷假
      *  store_probe_dead 告警(文件头契约 3 的同族漏网)。缺席 = 该部署形没建探针。 */
     storeLiveProbe: {
@@ -95,6 +90,10 @@ export interface ShutdownCtx {
     /** S-929 F1:checkpoint 店的 park 提交观察层(`plugins/park-commit-watch.ts`;在场 ⇔ 本部署有 checkpoint 店)。hardShutdown 在
      *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
     parkCommits: ParkCommitWatch | undefined;
+    /** 编排器片 2 件 3:服务租约客户端(在场 ⇔ fleet 成员 ∧ 中心车道配齐)。hardShutdown 起点停它的续租定时器(文件头契约 3 同族)。 */
+    servingLease?: {
+        stop(): void;
+    } | undefined;
 }
 /**
  * 受控退的**后台宽限**还要等多久(ms)—— hardShutdown 软停后台 shell 之后、`process.exit` 之前,给软停过的行**一次**

package/dist/boot/shutdown.js

@@ -8,14 +8,16 @@ import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
+import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID } from "../fleet/drain-entry.js";
 const HARD_STOP_GRACE_MS = 10_000;
+const FINAL_EXIT_MS = 15_000;
 export function backgroundGraceRemainingMs(a) {
     if (a.softStopped <= 0)
         return 0;
     return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
 }
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, } = ctx;
+    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, servingLease, } = ctx;
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -69,12 +71,14 @@ export function installShutdownHandlers(ctx) {
     };
     process.on("unhandledRejection", onUnhandledRejection);
     let closing = false;
+    let closingAt = 0;
     let parentWatch;
     let engineLease;
     const hardShutdown = () => {
         if (closing)
             return;
         closing = true;
+        closingAt = Date.now();
         if (dataRoot)
             clearCrashLast(dataRoot);
         const graceDeadlineMs = Date.now() + HARD_STOP_GRACE_MS;
@@ -101,6 +105,7 @@ export function installShutdownHandlers(ctx) {
         parentWatch?.stop();
         engineLease?.stop();
         storeLiveProbe?.stop();
+        servingLease?.stop();
         void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: String(err) }));
         configCenter?.stopRefreshLoop();
         otelExporter?.stop();
@@ -133,7 +138,7 @@ export function installShutdownHandlers(ctx) {
                 .finally(() => backgroundGrace)
                 .finally(() => process.exit(0));
         });
-        const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: 15_000 }); process.exit(0); }, 15_000);
+        const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: FINAL_EXIT_MS }); process.exit(0); }, FINAL_EXIT_MS);
         finalExit.unref?.();
         server.closeIdleConnections?.();
         const forceClose = setTimeout(() => server.closeAllConnections?.(), HARD_STOP_GRACE_MS);
@@ -141,36 +146,67 @@ export function installShutdownHandlers(ctx) {
     };
     let draining = false;
     let drainStartedAt = 0;
+    let firstStopSignalAt;
     let drainTick;
-    const drainThenShutdown = () => {
-        if (closing || draining)
-            return;
+    let current;
+    const enterDrain = (entry, bySignal = false, at = Date.now()) => {
+        if (current !== undefined)
+            return { ...current, state: "already_draining" };
+        if (closing)
+            return { actionId: HARD_STOP_ACTION_ID, since: closingAt, deadlineAt: closingAt + FINAL_EXIT_MS, state: "already_draining" };
         draining = true;
         drainStartedAt = performance.now();
+        firstStopSignalAt = bySignal ? drainStartedAt : undefined;
+        const since = at;
+        current = { actionId: entry.actionId, since, deadlineAt: entry.deadlineAt };
         drainState.draining = true;
-        deviceHub?.beginDrain({ graceMs: () => config.drainGraceMs });
-        drainState.since = Date.now();
+        drainState.since = since;
+        drainState.actionId = entry.actionId;
+        drainState.deadlineAt = entry.deadlineAt;
+        const windowMs = Math.max(0, entry.deadlineAt - since);
+        const deadlineMono = drainStartedAt + windowMs;
+        deviceHub?.beginDrain({ graceMs: () => windowMs });
+        drainState.yieldInflight?.();
+        toolApproval?.beginDrain();
         void fleetClient?.announceNow();
         const inflight = drainState.inflight?.() ?? 0;
-        logger.info("draining_started", { inflight, graceMs: config.drainGraceMs });
+        logger.info("draining_started", { actionId: entry.actionId, inflight, deadlineAt: entry.deadlineAt, windowMs });
         if (inflight === 0) {
             hardShutdown();
-            return;
+            return { ...current, state: "draining" };
         }
         const tick = setInterval(() => {
             const n = drainState.inflight?.() ?? 0;
-            const elapsed = Math.round(performance.now() - drainStartedAt);
-            if (n === 0 || elapsed >= config.drainGraceMs) {
+            const now = performance.now();
+            if (n === 0 || now >= deadlineMono) {
                 clearInterval(tick);
                 drainTick = undefined;
-                logger.info("drain_complete", { inflight: n, elapsedMs: elapsed, timedOut: n > 0 });
+                logger.info("drain_complete", { actionId: entry.actionId, inflight: n, elapsedMs: Math.round(now - drainStartedAt), timedOut: n > 0 });
                 hardShutdown();
             }
         }, 1_000);
         drainTick = tick;
+        return { ...current, state: "draining" };
+    };
+    const drainOnCause = (cause) => {
+        const at = Date.now();
+        enterDrain({ actionId: cause, deadlineAt: at + config.drainGraceMs }, DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL[cause], at);
     };
+    const enterByRequest = (entry) => enterDrain(entry);
+    drainState.enter = enterByRequest;
     const onStopSignalWhileDraining = (signal) => {
-        const sinceFirst = performance.now() - drainStartedAt;
+        const now = performance.now();
+        if (firstStopSignalAt === undefined) {
+            firstStopSignalAt = now;
+            logger.info("drain_signal_after_request_drain_ignored", {
+                signal,
+                actionId: current?.actionId,
+                deadlineAt: current?.deadlineAt,
+                note: "this drain was entered by a drain request / lease denial / self-exit and its deadline is fixed — the first stop signal does not shorten it; a second stop signal at least DRAIN_SECOND_SIGNAL_MIN_GAP_MS later hard-stops",
+            });
+            return;
+        }
+        const sinceFirst = now - firstStopSignalAt;
         const minGapMs = config.drainSecondSignalMinGapMs;
         if (sinceFirst < minGapMs) {
             logger.info("drain_duplicate_signal_ignored", { signal, sinceFirstMs: Math.floor(sinceFirst), minGapMs });
@@ -180,7 +216,7 @@ export function installShutdownHandlers(ctx) {
         hardShutdown();
     };
     const firstStopSignal = {
-        SIGTERM: drainThenShutdown,
+        SIGTERM: () => drainOnCause("signal:SIGTERM"),
         SIGINT: hardShutdown,
     };
     const onStopSignal = (signal) => {
@@ -200,7 +236,7 @@ export function installShutdownHandlers(ctx) {
         inflight: () => drainState.inflight?.() ?? 0,
         lastActivityAt: () => drainState.lastActivityAt?.() ?? 0,
         isStopped: () => closing || draining,
-        escalate: drainThenShutdown,
+        escalate: () => drainOnCause("signal:SIGHUP"),
         shutdown: hardShutdown,
         idleGraceMs: config.sighupIdleGraceMs,
         log: (event, fields) => logger.info(event, fields),
@@ -231,7 +267,7 @@ export function installShutdownHandlers(ctx) {
             selfExit: (report) => {
                 if (dataRoot)
                     writeExitLast(dataRoot, { version, ...report });
-                drainThenShutdown();
+                drainOnCause("self-exit:attachment");
             },
             lingerMs: config.engineAutoExit ? config.engineLingerMs : Number.POSITIVE_INFINITY,
             ...(config.parentPid !== undefined
@@ -259,6 +295,8 @@ export function installShutdownHandlers(ctx) {
             }
             parentWatch?.stop();
             engineLease?.stop();
+            if (drainState.enter === enterByRequest)
+                drainState.enter = undefined;
         },
     };
 }

package/dist/boot/stage-01-config.js

@@ -13,6 +13,7 @@ import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub
 import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
+import { provisionSemaConfigDir } from "../sema-config-dir.js";
 export function runStage01() {
     const config = loadConfig();
     const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
@@ -44,6 +45,7 @@ export function runStage01() {
         else
             logger.info("run_failed", fields);
     });
+    provisionSemaConfigDir(config, logger);
     const localRoot = configLocalRoot(config);
     const rootsSplit = splitLocalRoots({
         localDataRoot: config.localDataRoot,

package/dist/boot/stage-09-leader.d.ts

@@ -1,14 +1,7 @@
 import type { runStage08 } from "./stage-08-reapers.js";
+import type { DrainState } from "../fleet/drain-entry.js";
 export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>): {
-    drainState: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState: DrainState;
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };

package/dist/boot/stage-10-http-server.d.ts

@@ -1,14 +1,6 @@
 import type { runStage09 } from "./stage-09-leader.js";
 export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>): Promise<{
-    drainState: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState: import("../fleet/drain-entry.js").DrainState;
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };

package/dist/boot/stage-10-http-server.js

@@ -13,9 +13,11 @@ import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
-import { startFleetClientFromEnv } from "../fleet-client.js";
+import { startFleetClientFromConfig } from "../fleet-client.js";
 import { createCenterWiringReader } from "../capabilities/center-wiring.js";
-import { readinessOf } from "../http/readiness.js";
+import { mintEngineSignal } from "../fleet/engine-signal.js";
+import { createServingLeaseClient } from "../fleet/serving-lease.js";
+import { fleetFenceLaneOf } from "../config.js";
 import { createResolveSpec } from "./resolve-spec.js";
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { startFleetReconciler } from "../fleet/fleet-reconciler.js";
@@ -133,6 +135,24 @@ export async function runStage10(ctx) {
     const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
+    const fenceLane = fleetFenceLaneOf(config);
+    const servingLease = fenceLane !== undefined
+        ? createServingLeaseClient({
+            center: fenceLane.center,
+            generation: fenceLane.generation,
+            instanceId,
+            dataRoot: config.localDataRoot,
+            outageMaxMs: config.fleetLeaseOutageMaxMs,
+            drain: (entry) => {
+                const enter = drainState.enter;
+                if (enter === undefined)
+                    throw new Error("serving lease denied before the drain entry was installed — refusing to keep serving without a drain");
+                enter(entry);
+            },
+            drainWindowMs: () => config.drainGraceMs,
+            logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}), error: (m, d) => logger.error(m, d ?? {}) },
+        })
+        : undefined;
     const deployment = {
         sessionStoreLabel: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         modelReady: () => configCenter.modelReady(),
@@ -154,15 +174,16 @@ export async function runStage10(ctx) {
             },
         },
         restartState: () => configCenter.restartState(),
-        planeDeferredState: () => configCenter.planeDeferredState(),
         configApplyState: () => configCenter.configApplyState(),
         centerCredentialState: () => configCenter.centerCredentialState(),
         modelRefusalsState: () => configCenter.modelRefusalsState(),
+        configHandoffState: () => configCenter.configHandoffState(),
         mcpRevocations,
         mcpRevocationState: () => configCenter.mcpRevocationState(),
         configRefreshNow: () => configCenter.refreshNow(),
         configCenterManagedKeys: () => configCenter.centerManagedKeys(),
         drainState,
+        servingLease: servingLease ? () => servingLease.view() : undefined,
         storePosture,
         centerWiring: createCenterWiringReader({ config, pullState: () => configCenter.centerPullState(), fleetLease, usageReport: fleetUsage !== undefined }),
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
@@ -244,19 +265,19 @@ export async function runStage10(ctx) {
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
-    const fleetClient = startFleetClientFromEnv(config, {
+    const fleetClient = startFleetClientFromConfig(config, {
         instanceId,
         version: serviceVersion(),
-        readiness: () => readinessOf(deployment),
-        restart: () => deployment.restartState?.(),
+        signal: () => mintEngineSignal({ ...deployment, config }),
         modelRefusals: () => deployment.modelRefusalsState?.(),
+        ...(servingLease ? { onCenterCapabilities: (caps) => servingLease.noteCenterCapabilities(caps) } : {}),
         ...(fleetUsage ? { usage: fleetUsage } : {}),
         logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}) },
     });
     configCenter.onSelfReportChange(() => void fleetClient?.announceNow());
     if (fleetClient) {
-        const advertised = process.env.FLEET_ADVERTISE_ADDRESS ?? "";
-        logger.info("fleet_client_started", { worker: config.configCenter?.worker, usageReport: fleetUsage !== undefined, announce: advertised !== "", ...(advertised !== "" ? { address: buildDisplaySafeUrl(advertised) } : {}) });
+        const advertised = config.fleetAdvertiseAddress;
+        logger.info("fleet_client_started", { worker: config.configCenter?.worker, usageReport: fleetUsage !== undefined, announce: advertised !== undefined, ...(advertised !== undefined ? { address: buildDisplaySafeUrl(advertised) } : {}) });
     }
     const failoverFirstByte = buildFailoverFirstByteNotice(config);
     if (failoverFirstByte)
@@ -310,7 +331,9 @@ export async function runStage10(ctx) {
         deviceHub: deviceLane?.hub,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,
+        servingLease,
     });
+    servingLease?.resumeStickyDenial();
     return { ...ctx };
 }
 //# sourceMappingURL=stage-10-http-server.js.map

package/dist/capabilities/builtin-tools.d.ts

@@ -1,19 +1,42 @@
-import type { SubagentSpawnContext, ToolSpec } from "@sema-agent/core";
+import type { SubagentSpawnContext, SubagentToolOptions, ToolSpec } from "@sema-agent/core";
 /** Current time — the model has no clock; OA/most tasks need it. No side effects. CC-parity tool name `Now`
  *  (PascalCase, core 1.176 first-party rename wrap-up — the SERVICE owns this one; `nowTool` is not a core tool).
  *  effect:"read" so it never suspends → no durable-resume rename strand (no pending-tool checkpoint to canonicalize). */
 export declare function nowTool(): ToolSpec;
 /**
- * #1110(core 7.32.0)—— 委派子代的**逐次注入**工厂(`SubagentToolOptions.extraTools`):`Now` + 部署的 extra tools(今天 = SendUserFile)。
+ * 委派子代逐次注入的**一组**工具:`tools` 是这组**可能**注入的全部工具对象,`forSpawn` 只在这些对象里选「这一次 spawn 拿不拿」(缺席 = 每次都拿)。
+ * 名册与工厂读的是同一张 `tools` —— 工厂只能交出名册里那几只对象,结构上交不出名册外的东西(core 7.46.0 #1432 的「声明不说谎」在本仓由形状保证,
+ * 不靠两张表对拍)。
+ */
+export interface SubagentExtraToolSet {
+    readonly tools: readonly ToolSpec[];
+    readonly forSpawn?: (ctx: SubagentSpawnContext) => boolean;
+}
+/** 委派工具上与逐次注入相关的两键(core `SubagentToolOptions` 的 `extraTools` / `extraToolNames`):工厂(本仓的恒同步)+ 它的名册。 */
+export interface SubagentExtraToolOptions {
+    readonly extraTools: (ctx: SubagentSpawnContext) => ToolSpec[];
+    readonly extraToolNames: NonNullable<SubagentToolOptions["extraToolNames"]>;
+}
+/**
+ * #1110(core 7.32.0)—— 委派子代的**逐次注入**:`Now` + 部署的 extra tools(今天 = SendUserFile)。
  *
  * 为什么 `Now` 走这条通道:core 7.32.0 起子代按**身份**继承场景层 bundle 的工具(`assembleCodeTools` 交给 Agent 的
  * `inheritedTools` ∩ 父 run 真挂载),而 `Now` 是本仓在 bundle **旁边**组的宿主工具(scenarios.ts),宿主工具**从不**被继承
  * (core:继承整张 `spec.tools` 会把宿主工具带过宿主自己的逐次门)—— 逐次注入是它到达子代的唯一通道。一个工厂、两个产地:
- * 部署工厂的门(SendUserFile 的审批面预判 / 只读内建排除)原样在它自己那只函数里,这里只做合成。
- * ⚠️ 工厂恒在场 ⇒ core 不再给 Agent 工具铸静态 `agentToolPool`(core:工厂可在 spawn 时注入身份未知的工具 ⇒ 池不可静态知 ⇒
- * 记忆内容来源读者按「外部」读,fail-closed)。本仓 default bundle 的继承面本来就含 WebFetch(外部),这一翻面只在
- * 「子代面恰好不含任何外部工具」的窄形上把委派结果多判一次外部,方向是收紧。
- * 工厂**不抛**:`nowTool()` 是纯构造;部署工厂的抛由 core 收成「这一 spawn 什么都不继承 + 模型面披露句」(onExtraToolsError 记 warn)。
+ * 部署那一组的门(只读内建排除)在它自己的 `forSpawn` 里,这里只做合成。
+ *
+ * core 7.46.0 #1432 —— **工厂与名册一个来源**:返回委派工具的两键,`extraTools`(每次 spawn 交出 `forSpawn` 选中的那几只)与
+ * `extraToolNames`(全部可能交出的那几只的名字 / 别名 / 内容来源,从同一批 `ToolSpec` 读出)。名册在场 ⇒ 引擎重新能列出子代的工具池:
+ * 定义级 / 工具级 / `TaskSpec.agents` 清单里的退役拼法与大小写孪生回到开跑前拒(`config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
+ * 修前(core 7.32.0–7.45.x)工厂恒在场 ⇒ 池不可静态知 ⇒ 那一族拼法只告不拒、委派结果一律按「外部」读。
+ * 工厂**不抛**:各组的 `tools` 是装配期就建好的对象;部署 `forSpawn` 的抛由 core 收成「这一 spawn 什么都不继承 + 模型面披露句」(onExtraToolsError 记 warn)。
+ * 一种拼法出现在两只工具上(部署工具与 `Now` 撞名 / 别名撞)⇒ core 在建委派工具处抛 `config.extra_tool_names`(`shape`),不静默取其一。
+ */
+export declare function createSubagentExtraTools(deployment?: SubagentExtraToolSet): SubagentExtraToolOptions;
+/**
+ * `onExtraToolsError` 收到的错误 → 运维行 `subagent_extra_tools_error` 的字段:句子,加上错误**自带**的码与 `detail.reason`(在场才铸)。
+ * core 7.46.0 #1432 被拒的 spawn(产物不在名册里)带 `config.extra_tool_names` + `undeclared_name` / `undeclared_origin`;部署工厂自己抛的错多半两位都不带。
+ * 本仓不按码分支、不重铸 —— 只把错误说的话原样过境到运维面(修前只记句子,码与原因词丢在这一跳)。
  */
-export declare function createSubagentExtraTools(deployment?: (ctx: SubagentSpawnContext) => ToolSpec[]): (ctx: SubagentSpawnContext) => ToolSpec[];
+export declare function extraToolsErrorFields(err: unknown): Record<string, unknown>;
 //# sourceMappingURL=builtin-tools.d.ts.map

package/dist/capabilities/builtin-tools.js

@@ -9,6 +9,27 @@ export function nowTool() {
     };
 }
 export function createSubagentExtraTools(deployment) {
-    return (ctx) => [nowTool(), ...(deployment?.(ctx) ?? [])];
+    const sets = [{ tools: [nowTool()] }, ...(deployment !== undefined ? [deployment] : [])];
+    return {
+        extraTools: (ctx) => sets.flatMap((s) => (s.forSpawn === undefined || s.forSpawn(ctx) ? [...s.tools] : [])),
+        extraToolNames: sets.flatMap((s) => s.tools).map((t) => ({
+            name: t.name,
+            ...(t.aliases !== undefined ? { aliases: [...t.aliases] } : {}),
+            ...(t.contentOrigin !== undefined ? { contentOrigin: t.contentOrigin } : {}),
+        })),
+    };
+}
+export function extraToolsErrorFields(err) {
+    const fields = { err: err instanceof Error ? err.message : String(err) };
+    if (err === null || typeof err !== "object")
+        return fields;
+    const code = Reflect.get(err, "code");
+    if (typeof code === "string")
+        fields.code = code;
+    const detail = Reflect.get(err, "detail");
+    const reason = detail !== null && typeof detail === "object" ? Reflect.get(detail, "reason") : undefined;
+    if (typeof reason === "string")
+        fields.reason = reason;
+    return fields;
 }
 //# sourceMappingURL=builtin-tools.js.map

package/dist/capabilities/composite-members.d.ts

@@ -39,7 +39,7 @@ import type { NamedKeysOf } from "../request-key-closure.js";
  */
 export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"];
-    readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"];
+    readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"];
     readonly memoryEngine: readonly ["backend", "vectorMode"];
     readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"];

package/dist/capabilities/composite-members.js

@@ -1,6 +1,6 @@
 export const COMPOSITE_CAPABILITY_MEMBERS = {
     deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"],
-    fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"],
+    fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
     store: ["declared", "backend", "durable", "degradedReason", "sql"],
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"],

package/dist/capabilities/scenarios.d.ts

@@ -1,6 +1,7 @@
-import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type TaskListStore, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
+import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type TaskListStore, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
 import type { Metrics } from "../observability/metrics.js";
 import type { Logger } from "../observability/logger.js";
+import { type SubagentExtraToolSet } from "./builtin-tools.js";
 import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
@@ -90,12 +91,13 @@ export interface ScenarioDeps {
      * core 1.287 `SubagentToolOptions.extraTools` seam wire-through — per-SPAWN dynamic tool injection into the
      * delegated (Agent-tool) child roster. Deployment-injected per-task tools (today: SendUserFile — its instance is
      * execute-time late-bound via ctx.taskId → TaskEnvRegistry, so ONE spec serves every spawn) cannot ride the
-     * ASSEMBLY-time static `subagent.tools` pool; this factory is evaluated by core at each spawn and its product is
-     * merged into the pool, then goes through core's `resolveToolSubset` whitelist like any other tool (agent-def
-     * allowTools/denyTools still govern — no extra gate needed on our side). Absent ⇒ no dynamic injection (children
-     * see exactly the static full-body roster, the pre-1.287 behavior).
+     * ASSEMBLY-time static `subagent.tools` pool; core evaluates the factory at each spawn and merges its product into the
+     * pool, then it goes through core's `resolveToolSubset` whitelist like any other tool (agent-def allowTools/denyTools
+     * still govern — no extra gate needed on our side). A SET, not a bare factory (core 7.46.0 #1432): its `tools` are both
+     * what a spawn can be handed and the roster the delegation tool declares (`extraToolNames`), so the factory cannot hand
+     * out a tool the roster does not name. Absent ⇒ the delegation tool injects `Now` alone.
      */
-    subagentExtraTools?: (ctx: SubagentSpawnContext) => ToolSpec[];
+    subagentExtraTools?: SubagentExtraToolSet;
     /**
      * core 1.364 durable background agents([ref] S1,[ref] 提货单②写半场):后台子代 `a*` 行的
      * durable 执行记录 store。**必须与 `RunnerDeps.backgroundAgentStore` 同实例**(读写双点配对,engine

package/dist/capabilities/scenarios.js

@@ -1,6 +1,6 @@
 import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError, createCodedHttpError } from "../security.js";
-import { createSubagentExtraTools, nowTool } from "./builtin-tools.js";
+import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { createCouncilTool, clampRounds } from "./code-review-council.js";
 import { stablePrompt } from "./prompt.js";
@@ -70,9 +70,9 @@ export function buildScenarios(deps) {
                             ...(deps.checkpointStore ? { checkpointStore: deps.checkpointStore } : {}),
                             ...(deps.ensureChildSessionDurable ? { ensureChildSessionDurable: deps.ensureChildSessionDurable } : {}),
                         },
-                        extraTools: createSubagentExtraTools(deps.subagentExtraTools),
+                        ...createSubagentExtraTools(deps.subagentExtraTools),
                         ...(deps.logger
-                            ? { onExtraToolsError: (err, info) => deps.logger?.warn?.("subagent_extra_tools_error", { ...info, err: err instanceof Error ? err.message : String(err) }) }
+                            ? { onExtraToolsError: (err, info) => deps.logger?.warn?.("subagent_extra_tools_error", { ...info, ...extraToolsErrorFields(err) }) }
                             : {}),
                     },
                     ...(webSearch ? { webSearch } : {}),

package/dist/capabilities/send-user-file-tool.d.ts

@@ -1,5 +1,6 @@
-import type { SubagentSpawnContext, ToolSpec } from "@sema-agent/core";
+import type { ToolSpec } from "@sema-agent/core";
 import type { IssuedFileLink } from "../plugins/send-user-file.js";
+import type { SubagentExtraToolSet } from "./builtin-tools.js";
 /** The frame the web/shell renders as a file card. Rides the durable events tail (replayable). */
 export interface FileLinkFrame {
     type: "file_link";
@@ -44,7 +45,9 @@ export declare function sendUserFileTool(deps: {
 }): ToolSpec;
 export declare const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
 /**
- * Build the `SubagentToolOptions.extraTools` factory that injects SendUserFile into delegated-child rosters.
+ * The deployment's group for the delegated-child injection (`createSubagentExtraTools` in `builtin-tools.ts` composes it with
+ * `Now` into the delegation tool's `extraTools` factory AND its `extraToolNames` roster — one list, read twice): SendUserFile,
+ * handed to every spawn except a read-only builtin agent's.
  *
  * F2 (MED, codex; a product judgment of this server, kept): read-only builtin agents (Explore/Plan) must NOT get
  * SendUserFile — a read-only agent that can read sensitive files AND mint public links off them breaks the read-only
@@ -59,5 +62,5 @@ export declare const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
  */
 export declare function subagentSendUserFileExtraTools(deps: {
     spec: ToolSpec;
-}): (ctx: SubagentSpawnContext) => ToolSpec[];
+}): SubagentExtraToolSet;
 //# sourceMappingURL=send-user-file-tool.d.ts.map