@sema-agent/server 7.137.0 → 7.139.0

package/dist/plugins/tool-result-store-sql.js

@@ -1,8 +1,10 @@
 import { MAX_MINTED_TOOL_RESULT_REF_CHARS, assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance } from "@sema-agent/core";
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { MANAGED_RETENTION } from "./retention-store-sql.js";
+import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "./retention-store-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
+import { describeProbedTableDrift, schemaWaysOut } from "./schema-drift-sentence.js";
+import { isMissingColumnError } from "./sql-errors.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
      ref              VARCHAR(518) COLLATE "C" NOT NULL,
@@ -28,30 +30,37 @@ export async function assertToolResultProvenanceSchema(query, dialect) {
     const width = Number(widthRow.rows[0]?.len ?? NaN);
     if (Number.isFinite(width) && width < MAX_MINTED_TOOL_RESULT_REF_CHARS) {
         throw new Error(`tool_result.ref is VARCHAR(${width}) but core 5.26.0 mints refs up to ${MAX_MINTED_TOOL_RESULT_REF_CHARS} characters ` +
-            `(#119 made the ref injective: four \`~\`-separated segments). A truncating primary key aliases two distinct refs onto ` +
-            `one row — one run's tool output reads back from another run's ref. This repository ships no ALTER TABLE migrations: ` +
-            `run \`DROP TABLE tool_result;\` on the ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and restart ` +
-            `(the schema is recreated at boot; offloaded results are a recoverable-window cache, inline previews are unaffected).`);
+            `(#119 made the ref injective: four \`~\`-separated segments) — refusing to start. A truncating primary key aliases two distinct refs onto ` +
+            `one row — one run's tool output reads back from another run's ref. ` +
+            `The ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} database is behind this build on that key column; offloaded results are a recoverable-window cache, ` +
+            `inline previews in transcripts are unaffected.\n\n` +
+            `  table tool_result: column ref is VARCHAR(${width}); this build needs at least VARCHAR(${MAX_MINTED_TOOL_RESULT_REF_CHARS}) — the database is OLDER than this build.\n\n` +
+            schemaWaysOut({
+                when: "a key column is narrower than this build declares",
+                action: "run an ALTER TABLE that widens tool_result.ref to this build's definition yourself",
+            }).join("\n"));
     }
     try {
         await query("SELECT owner_session_id, owner_task_id FROM tool_result WHERE 1=0");
     }
     catch (err) {
+        if (!isMissingColumnError(err, dialect))
+            throw err;
         throw new Error(`tool_result is missing the #119 provenance columns (owner_session_id / owner_task_id) — refusing to start. ` +
             `This release picks up @sema-agent/core 5.26.0, which changed how an offloaded tool result is addressed ` +
-            `(the ref grew past the old VARCHAR(190) key) and made the store record who wrote each row. This repository ` +
-            `ships no ALTER TABLE migrations, so the table must be recreated: run \`DROP TABLE tool_result;\` on the ` +
-            `${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and restart — the schema is recreated at boot. ` +
-            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected), ` +
-            `so the cost is at most the full text of results from runs still in flight. ` +
-            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+            `(the ref grew past the old VARCHAR(190) key) and made the store record who wrote each row. Without the columns every offload write ` +
+            `fails with unknown column and core's failure arm turns it into an inline placeholder — the service keeps running and the tool output is lost. ` +
+            `Offloaded tool results are a recoverable-window cache (the inline previews in transcripts are unaffected).\n` +
+            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
+            (await describeProbedTableDrift(query, dialect, ["tool_result"])));
     }
 }
 export class SqlToolResultStore {
     db;
-    retention = MANAGED_RETENTION;
-    constructor(db) {
+    retention;
+    constructor(db, opts = {}) {
         this.db = db;
+        this.retention = opts.retention ?? UNMANAGED_RETENTION;
     }
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
@@ -128,13 +137,13 @@ export class SqlToolResultStore {
     }
 }
 export class TiDBToolResultStore extends SqlToolResultStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, opts) {
+        super(mysqlDriver(pool), opts);
     }
 }
 export class PgToolResultStore extends SqlToolResultStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, opts) {
+        super(pgDriver(pool), opts);
     }
 }
 //# sourceMappingURL=tool-result-store-sql.js.map

package/dist/plugins/worktree-isolation.d.ts

@@ -54,8 +54,9 @@ export declare function withWorktreeIsolation(baseFactory: ExecutionEnvFactory,
  * post-kill Runner hook). NEVER throws (a prune failure is logged, never fatal).
  *
  * NOTE: `git worktree prune` only deregisters worktrees whose DIRECTORY is missing. A crashed run that left
- * the dir intact is NOT reaped by prune alone — that is acceptable for v1 (the worktree lives under the known
- * `.sema-worktrees/` parent and is human-/script-reapable; a stricter age-based sweep is a follow-on).
+ * the dir intact is NOT reaped by prune alone — that is acceptable for v1 (the worktree lives under core's known
+ * managed parent `<repoRoot>/<WORKTREE_PARENT>/` on its own `sema/<name>` branch and is human-/script-reapable;
+ * a stricter age-based sweep is a follow-on).
  */
 export declare function reapOrphanWorktrees(baseEnvForGit: ExecutionEnv, repoRoot: string, logger?: WorktreeIsolationLogger): Promise<void>;
 //# sourceMappingURL=worktree-isolation.d.ts.map

package/dist/plugins/worktree-isolation.js

@@ -31,7 +31,7 @@ export function withWorktreeIsolation(baseFactory, opts) {
             return baseFactory(ctx);
         }
         let innerDestroy;
-        const { env, worktreeDir } = await serialize(() => addWorktree(opts.baseEnvForGit, {
+        const { env, worktreeDir, baseSha } = await serialize(() => addWorktree(opts.baseEnvForGit, {
             repoRoot,
             sessionId: ctx.sessionId,
             rootEnvAt: async (dir) => {
@@ -43,12 +43,6 @@ export function withWorktreeIsolation(baseFactory, opts) {
             },
             ...(opts.commit ? { commit: opts.commit } : {}),
         }));
-        let baseSha;
-        {
-            const r = await opts.baseEnvForGit.exec("git rev-parse HEAD", { cwd: worktreeDir });
-            if (r.ok && r.value.exitCode === 0)
-                baseSha = r.value.stdout.trim();
-        }
         const isChanged = async () => {
             const status = await opts.baseEnvForGit.exec("git status --porcelain", { cwd: worktreeDir });
             if (!status.ok || status.value.exitCode !== 0)

package/dist/project-identity.d.ts

@@ -4,19 +4,6 @@ import { type ProjectLayerIdentity } from "./project-layer-key.js";
 export type { MemoryProjectKey };
 /** 本仓会说的缺席词。`not_git` 刻意排除:裁 D 起非 git 目录按目录键控,不是缺席(core 闭集仍收它,本仓不铸)。 */
 export type ProjectIdentityAbsentReason = Exclude<MemoryProjectKeyAbsentReason, "not_git">;
-/** 一个任务根的项目身份:canonical 项目根,或说得出理由的缺席。 */
-export type ProjectIdentity = {
-    readonly root: string;
-} | {
-    readonly absent: ProjectIdentityAbsentReason;
-};
-/**
- * 任务根 → 项目身份([ref] 四例;见文件头)。纯文件系统读,零子进程。
- * `taskRoot` 必须是**本进程读得到**的路径(调用方按车道判:根在沙箱/设备盘上就别调,直接给 `unreadable`)。
- *
- * 一次向上走,规则三条按优先序:最近的 `.git`(① ② ③)> 链上最近的裸仓布局(④ bare)> 非 git 按目录键控(④)。
- */
-export declare function resolveProjectIdentity(taskRoot: string): ProjectIdentity;
 /**
  * 退役 `repo:` 键的**唯一**铸点([ref] ①:`repo:` + sha256 hex 前 24;`root` 为 realpath 字符串,不加尾斜杠、不折大小写)。
  * [ref] 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
@@ -39,7 +26,7 @@ export declare function assertProjectLayerOwnable(scope: string, envName: string
 export declare function normalizeGitRemoteUrl(url: string): string | undefined;
 /**
  * 任务根 → 项目层身份([ref]):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
- * 缺席形与 {@link resolveProjectIdentity} 同;git 配置在而读不了 ⇒ `unreadable`。
+ * 缺席形 = 找根的缺席词(`bare` / `unreadable`);git 配置在而读不了 ⇒ `unreadable`。
  */
 export declare function projectLayerIdentityOf(taskRoot: string): {
     readonly root: string;

package/dist/project-identity.js

@@ -87,10 +87,6 @@ function canonicalTaskRoot(taskRoot) {
         p = parent;
     }
 }
-export function resolveProjectIdentity(taskRoot) {
-    const located = locateProject(taskRoot);
-    return "root" in located ? { root: located.root } : located;
-}
 function locateProject(taskRoot) {
     const root = canonicalTaskRoot(taskRoot);
     if (root === "unreadable")

package/dist/project-memory.d.ts

@@ -1,14 +1,8 @@
 import { type PlatformPath } from "node:path";
-import type { ProjectMemoryLoad } from "@sema-agent/core";
+import type { ProjectMemoryLoad, RunnerDeps } from "@sema-agent/core";
 import { type InstructionSourceSeat } from "./instruction-source-notice.js";
-interface ProjectMemoryCtx {
-    cwd: string;
-    handsEnabled: boolean;
-    isSubagent: boolean;
-    agentName?: string;
-    sessionId?: string;
-    phase?: "fresh" | "resume" | "post-compact" | "post-clear";
-}
+/** The engine's loader ctx, read from its seat type (one source: a hand-copied twin kept a phase word the engine had retired). */
+type ProjectMemoryCtx = Parameters<NonNullable<RunnerDeps["loadProjectMemory"]>>[0];
 /** The instruction-file name chain: the CLAUDE family first, the AGENTS family only when no CLAUDE file is
  *  present. The FIRST hit is the single declared instruction source.
  *
@@ -37,17 +31,17 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
     rel: InstructionChainMember;
 } | null;
 /**
- * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
- * directory. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
+ * Build a `loadProjectMemory` for the host lane. Answers `{ content: null }` (skip) unless hands are enabled AND cwd is a
+ * local directory — every answer is a `ProjectMemoryLoad`, the one form the engine reads. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
  * `git log -5` / `git status`, redacts secrets, and caps the total. A subagent gets a trimmed instruction file and
- * no git narrative (cost control, H7). When an instruction file is hit the return is a `ProjectMemoryLoad`
- * declaring it in `instructionSources` (path + sha256 over the raw bounded-read window) so core's
+ * no git narrative (cost control, H7). When an instruction file is hit the answer also declares it in
+ * `instructionSources` (path + sha256 over the raw bounded-read window) so core's
  * instructions-change lane can probe it mid-run.
  *
  * Session snapshot cache (S-2): keyed on ctx.sessionId — a session keeps ONE stable instruction snapshot
  * (mid-run file edits surface via the probe as tail attachments, never a silently re-rendered prefix).
  * `phase: "post-compact"` forces a re-read (core re-renders the prefix there anyway). No entry for
- * sessionless one-shot runs. (post-clear never arrives from core — [ref] — so it is not a cache key here.)
+ * sessionless one-shot runs.
  *
  * [ref] — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
  * instruction chain hands the chain member it selected (`null` = none) to {@link announceInstructionSource}, which
@@ -72,7 +66,7 @@ export declare function makeLoadProjectMemory(opts: {
     cacheMax?: number;
     /** [ref]: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
     instructionSource?: InstructionSourceSeat;
-}): (ctx: ProjectMemoryCtx) => Promise<string | null | ProjectMemoryLoad>;
+}): (ctx: ProjectMemoryCtx) => Promise<ProjectMemoryLoad>;
 /**
  * ② The `RunnerDeps.probeInstructionSources` seam: re-fingerprint the declared instruction files mid-run so
  * core's instructions-change lane can append a tail attachment when one changes. Same read posture as the

package/dist/project-memory.js

@@ -42,7 +42,8 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
-const NOT_APPLICABLE = { walked: false, answer: null };
+const NOTHING_TO_INJECT = Object.freeze({ content: null });
+const NOT_APPLICABLE = { walked: false, answer: NOTHING_TO_INJECT };
 export function instructionChainCoordinates(absPath, p = hostPath) {
     const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
     for (const rel of candidates) {
@@ -218,12 +219,12 @@ export function makeLoadProjectMemory(opts) {
         if (gitNarrative)
             sections.push(gitNarrative);
         if (sections.length === 0)
-            return { walked: true, answer: null, instructionFile };
+            return { walked: true, answer: NOTHING_TO_INJECT, instructionFile };
         const redacted = redactSecrets(sections.join("\n\n"));
         const capped = capUtf8(redacted, totalCap);
         opts.logger?.debug?.("project_memory_loaded", { cwd: root, bytes: Buffer.byteLength(capped, "utf8"), isSubagent: ctx.isSubagent, gitOk, ...(gitDropReason ? { gitDropReason } : {}), claudeTruncated, ...(hitFile ? { instructionFile: hitFile } : {}), ...(ctx.phase ? { phase: ctx.phase } : {}), cacheSize: cache.size });
         if (!capped)
-            return { walked: true, answer: null, instructionFile };
+            return { walked: true, answer: NOTHING_TO_INJECT, instructionFile };
         if (hitFile && hitHash) {
             return {
                 walked: true,
@@ -237,7 +238,7 @@ export function makeLoadProjectMemory(opts) {
                 instructionFile,
             };
         }
-        return { walked: true, answer: capped, instructionFile };
+        return { walked: true, answer: { content: capped }, instructionFile };
     }
 }
 export function makeProbeInstructionSources() {

package/dist/request-key-closure.js

@@ -28,7 +28,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
     "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
-    "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
+    "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
     "userAttachments", "userInvokedSkills", "verify", "verifyRounds",
 ];

package/dist/request-value-closure.d.ts

@@ -67,18 +67,17 @@ export declare const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must b
  * 判据:{@link fileHistoryRestoreConflict}。**只在 fresh 受理门**(`http/admission.ts`);续跑腿不过这道门(RESUME 重放不过受理门,
  * 同律 —— 且续跑腿重建时整族剥掉一次性历史动作,矛盾在盘上的体里本就留不下来)。wire 可见、字节冻结。
  */
-export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) \u2014 the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
+export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles or rewindFilesTo) \u2014 the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 /**
- * 「关断词 ∧ 还原」这一对的判据(纯函数,只看体)。还原 = 三个键里任一个在请求:`restoreFiles: true`、非空串 `rewindFilesTo`
- * (与 `boot/resolve-spec.ts` 的读法同:空串 / 非串按缺席)、退役拼法 `rewindFiles: true`(restore 义要一次还原;capture 义要的
- * 正是这个词关掉的记录 —— 两义都与关断词矛盾)。调用前值形已由上面的单成员表与既有布尔门判过。
+ * 「关断词 ∧ 还原」这一对的判据(纯函数,只看体)。还原 = 两个键里任一个在请求:`restoreFiles: true`、非空串 `rewindFilesTo`
+ * (与 `boot/resolve-spec.ts` 的读法同:空串 / 非串按缺席)。调用前值形已由上面的单成员表与既有布尔门判过。
  */
-export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFiles" | "rewindFilesTo">): boolean;
+export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFilesTo">): boolean;
 /**
- * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo` · 退役的 `rewindFiles`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
+ * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
  * 判据只有这一份,拒体的 `detail.fields` 点名的也是它(判与点名不会各读各的)。
  */
-export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo" | "rewindFiles">;
+export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo">;
 /**
  * **单成员闭集键表** —— 每键合法值只有它自己那一个关断词(`word`),缺席=照常,没有「开」的拼法。
  *

package/dist/request-value-closure.js

@@ -2,7 +2,7 @@ export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string
 export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
 export const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must be the string 'disabled' when present (the request-level declaration that this run reads none of the deployment's project context — no project instruction files and no project layer; absent = the deployment's project context as usual — there is no 'on' spelling)";
-export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
+export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles or rewindFilesTo) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
     return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
 }
@@ -12,8 +12,6 @@ export function fileHistoryRestoreKeysInBody(body) {
         out.push("restoreFiles");
     if (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0)
         out.push("rewindFilesTo");
-    if (body.rewindFiles === true)
-        out.push("rewindFiles");
     return out;
 }
 const SINGLE_MEMBER_OFF_FIELDS = [

package/dist/rules-consent.js

@@ -5,7 +5,7 @@ import { createLogger } from "./observability/logger.js";
 import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, readRuleOwner, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, readRuleOwner, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -87,7 +87,7 @@ function storeForBucket(provider, ref) {
         }
     }
 }
-function isSupportedRuleMatch(match) {
+function isCommandRuleMatch(match) {
     switch (match) {
         case "exact":
         case "prefix":
@@ -104,6 +104,8 @@ function isSupportedRuleMatch(match) {
         case "host":
         case "subdomain":
             return false;
+        case "tool":
+            return false;
         default: {
             const unknown = match;
             void unknown;
@@ -205,7 +207,7 @@ function screenLocalImportRow(row) {
     const written = parseRuleText(row.rule, row.behavior);
     if ("reject" in written)
         return { reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
-    if (ruleToolGrammarOf(written.rule.tool) !== "command")
+    if (!isCommandRuleMatch(written.rule.match))
         return consistent(written.rule);
     if (written.rule.behavior !== "allow") {
         if (!ruleReachesProgramRun(written.rule, row.command)) {
@@ -354,7 +356,7 @@ export function createRuleConsentLane(stores, opts) {
                 if ("reject" in canonical) {
                     return { ok: false, reason: "edit-rejected", detail: `the canonical spelling the engine minted does not re-parse: ${canonical.reject.message}` };
                 }
-                if (!isSupportedRuleMatch(canonical.rule.match)) {
+                if (!isCommandRuleMatch(canonical.rule.match)) {
                     return { ok: false, reason: "edit-rejected", detail: `the edited rule resolves to an unsupported match form (${String(canonical.rule.match)})` };
                 }
                 ticket = minted.ticket;

package/dist/run-local.d.ts

@@ -196,6 +196,12 @@ export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, s
  * or whose approval no person could answer, see {@link unfinishedStopOf} — / a fatal error, 2 = bad usage / unmet env). Pure of
  * `process.exit` so a test can assert the code; `main()` applies it.
  */
+/**
+ * 本入口拒 `CONFIG_PROVIDER=remote` 的那一句(配置源的词要么兑现、要么拒)。本入口只装本地配置源:中心拉取的那一套 —— 凭据续签、托管模型钥解封、
+ * 名册门、LKG —— 只在 HTTP 服务里装配。修前它在 remote 的词下照读本地 `config.d`(判官对「没递中心」回落 local),零句。
+ * 配没配中心地址都是这一句:出路(不设词 / 写 `local` / 改跑 HTTP 服务)在本入口照做都兑现得了。
+ */
+export declare const RUN_LOCAL_CONFIG_SOURCE_REFUSAL: string;
 export declare function runLocal(argv: string[], deps?: RunLocalDeps): Promise<number>;
 /** {@link installRunLocalExitBoundary} 的把手(同进程内反复装配的调用方=测试必须用它收尾)。 */
 export interface RunLocalExitBoundary {

package/dist/run-local.js

@@ -19,10 +19,10 @@ import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
-import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
-import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
+import { configLocalRoot, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
@@ -45,14 +45,16 @@ import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
 import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
+import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
-import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
+import { buildMemorySyncEnabledFields, createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createPeerDesk } from "./peer-seat.js";
 import { createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
-import { assertDeploymentModsAdmitted, createDeploymentMods } from "./boot/deployment-mods.js";
+import { assembleDeploymentMods } from "./boot/deployment-mods.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { fatalExit } from "./boot/fatal-exit.js";
@@ -60,7 +62,6 @@ import { installProcessExitBoundary } from "./boot/exit-boundary.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { createHostLspManager } from "./host-lsp-manager.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { installOutboundDispatcher } from "./outbound-dispatcher.js";
 import { provisionSemaConfigDir } from "./sema-config-dir.js";
 import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "./server-secret-env.js";
@@ -121,7 +122,7 @@ export function missingGatewayRequirements(config) {
     if (config.gatewayBaseUrl === undefined)
         return missing;
     const perModelEnvs = Object.values(config.modelApiKeyEnv ?? {});
-    const haveGatewayKey = !!config.gatewayApiKey;
+    const haveGatewayKey = declaredCredential(config.gatewayApiKey) !== undefined;
     const catalogModelNames = new Set(Object.values(config.models ?? {}).map((m) => m.name));
     const allModelsHaveOwnKey = catalogModelNames.size > 0 &&
         [...catalogModelNames].every((n) => {
@@ -164,6 +165,7 @@ export const NO_TTY_ASK_CLASS_ROW = {
     shell_floor: { remedy: "shell_gate", autoBudgetReleases: false },
     target_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
     probe: { remedy: "terminal_only", autoBudgetReleases: false },
+    write_protection_on_disk: { remedy: "terminal_only", autoBudgetReleases: false },
     write_protection: { remedy: "terminal_only", autoBudgetReleases: false },
     tool_marks_mcp: { remedy: "terminal_only", autoBudgetReleases: false },
     tool_marks_a2a: { remedy: "terminal_only", autoBudgetReleases: false },
@@ -312,6 +314,9 @@ function buildUnfinishedStopFooter(stop, sessionId) {
         }
     }
 }
+export const RUN_LOCAL_CONFIG_SOURCE_REFUSAL = "CONFIG_PROVIDER=remote: run-local reads its configuration from the local config directory only — it does not pull a web-admin center " +
+    "(center credential renewal, sealed model keys and the roster gate are assembled by the HTTP service). Unset CONFIG_PROVIDER or set " +
+    "CONFIG_PROVIDER=local for this command, or run the HTTP service to use the center.";
 export async function runLocal(argv, deps = {}) {
     const print = deps.print ?? ((l) => console.log(l));
     const printErr = deps.printErr ?? ((l) => console.error(l));
@@ -326,7 +331,12 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    if (!process.env.CONFIG_PROVIDER)
+    const configWord = parseConfigProvider();
+    if (configWord === "remote") {
+        printErr(RUN_LOCAL_CONFIG_SOURCE_REFUSAL);
+        return 2;
+    }
+    if (configWord === undefined)
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
@@ -343,26 +353,25 @@ export async function runLocal(argv, deps = {}) {
     logConfigDiagnostics(logger);
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
-    const providerInput = { provider: config.configProvider ?? "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
-    const configSource = configProviderKind(providerInput);
-    if (configSource === "local") {
-        try {
-            await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
-        }
-        catch (err) {
-            printErr(err instanceof Error ? err.message : String(err));
-            return 2;
-        }
-        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
+    const providerInput = { provider: "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
+    try {
+        await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
+    }
+    catch (err) {
+        printErr(err instanceof Error ? err.message : String(err));
+        return 2;
     }
+    logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     try {
-        await composeExecutionLane(config, { configSource, localRoot: root, logger, drivesFromFile: ["host"] });
+        await composeExecutionLane(config, { configSource: "local", localRoot: root, logger, drivesFromFile: ["host"] });
     }
     catch (err) {
         printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
     const configProvider = createConfigProvider(providerInput);
+    const peerDesk = createPeerDesk({ log: logger });
+    const rosterLease = peerDesk.lease("roster");
     let effective;
     let candidatePrompts;
     let applying = false;
@@ -387,9 +396,9 @@ export async function runLocal(argv, deps = {}) {
                 effective = r.effective;
                 candidatePrompts = verdict.prompts;
                 if (effective?.mcp)
-                    config.mcpServers = resolveMcpServers(effective.mcp, logger);
+                    config.mcpServers = resolveMcpServers(effective.mcp, peerDesk, rosterLease, logger);
                 if (effective?.a2a)
-                    config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
+                    config.a2aPeers = resolveA2aPeers(effective.a2a, peerDesk, rosterLease, logger);
                 applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
                 logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
             }
@@ -485,16 +494,17 @@ export async function runLocal(argv, deps = {}) {
     }
     let memorySync;
     if (config.memorySync && memoryEngine) {
+        const transport = createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token });
         memorySync = createMemorySyncRunner({
             backend: memoryEngine.backend,
             scope: config.memorySync.scope,
             memoryRoot: memoryEngine.root,
-            transport: createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token }),
+            transport,
             log: logger,
             ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
             ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
         });
-        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPathFor(config.memorySync.scope) });
+        logger.info("memory_sync_enabled", buildMemorySyncEnabledFields(transport.peer, config.memorySync.scope, memorySync.cursorPathFor(config.memorySync.scope)));
         memorySync.trigger("boot");
     }
     else if (config.memorySync) {
@@ -559,7 +569,6 @@ export async function runLocal(argv, deps = {}) {
     }
     assertRetentionLaneWirable({
         intervalSec: config.retentionSweep.intervalSec,
-        policy: config.retentionPolicy,
         executor: undefined,
         stores: [
             { name: "sessionStore", store: sessionStore },
@@ -576,9 +585,9 @@ export async function runLocal(argv, deps = {}) {
             { name: "checkpointStore", store: fileBackend.checkpointStore },
             { name: "toolResultStore", store: fileBackend.toolResultStore },
         ],
+        retentionExecutor: null,
     });
-    const deploymentMods = createDeploymentMods({ metrics, brandIdentity: true });
-    await assertDeploymentModsAdmitted(deploymentMods);
+    const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,
         config,
@@ -603,6 +612,7 @@ export async function runLocal(argv, deps = {}) {
         orgMemoryAdmission,
         sharedMemoryStores: undefined,
         mcpRevocations: undefined,
+        peerDesk,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,

package/dist/runs.d.ts

@@ -11,6 +11,7 @@ import { type ApprovalFrameFamily, type ToolApprovalCoordinator } from "./tool-a
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { RunAcceptance } from "./run-acceptance.js";
+import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
@@ -331,7 +332,8 @@ approval?: {
     streamApprovalOn: boolean;
     windowMs: number | undefined;
     windowMarginMs: number;
-    declaredFamilies: ReadonlySet<ApprovalFrameFamily>;
+    declaredFamilies: ReadonlySet<ApprovalFrameFamily>; /** 出处带车道:这条执行上下文的车道(装配点 `durable-run-leg.ts` 写 `ctx.lane`)。 */
+    executionLane: import("./execution-lane-caps.js").ExecutionLane;
 }, 
 /** [ref]:park 投影腿的 checkpoint 读口(`deps.checkpointStore`)。在场时,durable park 的
  *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});缺席=旧字节逐字不变。 */
@@ -374,7 +376,12 @@ userInputLedger?: UserInputLedger,
  * 这次提交的受理座(`src/run-acceptance.ts`):标题器只在引擎受理之后起。普通流形逐帧喂;只回结果的 verify / cascade 形(以及终局写口的
  * 重试腿)终局落行之后收尾一次。缺席 ⇒ 不起标题(起标题此前由路由层在建行时做)。
  */
-acceptance?: RunAcceptance): Promise<void>;
+acceptance?: RunAcceptance, 
+/**
+ * 会话行的位置与项目那一格的记录座(`session-workspace.ts`;唯一写者):普通流形逐帧喂(这条腿自己的 `workspace_changed` 排一次写),
+ * `done` 时等写落定再落终局。只回结果的 verify / cascade 形宿主手里没有流 ⇒ 不记。缺席 ⇒ 不记行(与本参数存在之前逐字相同)。
+ */
+workspaceRecorder?: SessionWorkspaceRecorder): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -84,6 +84,10 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.legacy_tool_name": 400,
     "config.memory_capture_unsupported": 409,
     "prompt.assembled_role_refused": 400,
+    "config.project_id_invalid": 400,
+    "config.project_identity_mismatch": 409,
+    "config.memory_project_marker": 409,
+    "config.memory_project_marker_nested": 409,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -253,7 +257,7 @@ export async function graftParkToolCallId(result, cs) {
     const id = await parkToolCallId(result, cs);
     return id === undefined ? result : { ...result, toolCallId: id };
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger, acceptance) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -292,11 +296,12 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.unattended
-            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}) }, approvalLeg.unattended)
+            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), executionLane: approval.executionLane }, approvalLeg.unattended)
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,
                 ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
+                executionLane: approval.executionLane,
                 ...(approvalLeg.active ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
             });
     }
@@ -453,6 +458,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 fleetPublisher?.onEvent(ev);
                 await userInputLedger?.observeLegEvent(stream, ev);
                 acceptance?.observe(ev);
+                await workspaceRecorder?.observe(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
                     case "text_delta":
@@ -526,6 +532,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     owner: elicitOwner ?? owner,
                     abortSignal: cancelCtrl.signal,
                     ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
+                    executionLane: approval.executionLane,
                     emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
                     emitRevoke: (f) => approvalEmit(f),
                     legKey: "",