@sema-agent/server 7.138.0 → 7.140.0

package/dist/plugins/remote-shell.d.ts

@@ -1,8 +1,8 @@
 /**
- * Shared shell/path helpers for the SSH + ADB `RemoteExecutionEnv` adapters. Kept in ONE place so the
- * security-sensitive quoting can't drift between adapters (council design/#4, #5).
+ * Shared shell/path helpers for the remote `RemoteExecutionEnv` adapters (ssh / adb / k8s / local-docker, and e2b where it
+ * shells out). Kept in ONE place so the security-sensitive quoting can't drift between adapters (council design/#4, #5).
  */
-import { ExecutionError, type FileError, type FileInfo, type RemoteExecutionError, type Result, type SymlinkChain } from "@sema-agent/core";
+import { ExecutionError, FileError, type FileInfo, type RemoteExecutionError, type Result, type SymlinkChain } from "@sema-agent/core";
 import type { ChildProcess } from "node:child_process";
 /**
  * D5 pipe-destroy grace (parity with core's vendored `EXEC_FORCE_SETTLE_GRACE_MS`, harness/env/nodejs.js):
@@ -204,4 +204,101 @@ export type ShellChainRun = (cmd: string) => Promise<Result<{
  *    三条远端腿的文件面探针不带 cwd(车PL 验修 ③)⇒ 这条命令不会因为某个工作目录不可用而不跑。
  */
 export declare function runSymlinkChain(absPath: string, run: ShellChainRun): Promise<Result<SymlinkChain, FileError>>;
+/**
+ * 脚本删一只私有目录没删掉时写到 **stdout** 的那一条记录的头:`<头> <目录路径>\0`(NUL 收尾 —— 路径里可以有换行)。
+ * 残留记录走 stdout、错误走 stderr:两条通道不混,分类器读到的 stderr 里没有路径文本。记录不改脚本的退出码:写照它自己的结局答,残留另行留痕。
+ */
+export declare const STAGE_DIR_LEFT_MARK = "sema: staging directory left behind:";
+/** 一次远端写的暂存位置(纯数据):`dir` = 目标目录下的私有目录,`file` = 其中那只暂存文件。 */
+export interface StagingPaths {
+    readonly dir: string;
+    readonly file: string;
+}
+/**
+ * 远端写的暂存位置(纯数据 ⇒ `build*`):私有目录在**目标同目录**(替换的提交是同一文件系统内的 rename),名 = `.<目标名>.stage-<12 位十六进制>`;
+ * 目标名已贴着 NAME_MAX 时逐码点截短到放得下 —— 一个目录装不下的暂存名会把一次就地形本来接得住的写拒掉。这只名字铸一次、用到底:
+ * 提交脚本跟一跳链接到别的目录里重新暂存时,用的仍是这只名字(已在上限之内,放到哪个目录都装得下)。`nonce` 只给测试钉序用。
+ */
+export declare function buildStagingPaths(abs: string, nonce?: string): StagingPaths;
+/**
+ * 准备脚本(纯数据 ⇒ `build*`):建目标的父目录(`mkdir -p`,失败 ⇒ 退出 1),再建私有目录({@link privateMkdir};失败 ⇒ 退出 {@link STAGE_DIR_REFUSED_EXIT}),
+ * 再收紧({@link hardenPrivate};不成 ⇒ 放弃这只目录({@link abandonPrivate})、写 {@link STAGE_DIR_UNSEALED_MESSAGE}、退出 {@link STAGE_DIR_UNSEALED_EXIT} —— 编排退到直接写目标),
+ * 再核里面没有 `data`({@link emptyPrivate};不成 ⇒ 放弃这只目录、写明原因、退出 1 —— 响亮答错,不退;原因句不带路径:stderr 只给分类器读)。
+ * 非零退出之后目标机上没有这次写的私有目录(删不掉的那一只由 {@link STAGE_DIR_LEFT_MARK} 记录点名)。**退出 0 ⇔ 目录是读回核实过的私有的、且是空的。**
+ */
+export declare function buildStagingPrepareCommand(stage: StagingPaths): string;
+/**
+ * 整文件替换的提交脚本(POSIX sh,纯数据 ⇒ `build*`)。一次往返,**整条命令只有一个退出状态**(`{ …; }`,理由同
+ * {@link buildSymlinkChainCommand} 头注)。`d` = 私有目录,`s` = 其中的暂存件,`t` = 目标。
+ *
+ *  1. 叶是符号链接 ⇒ 读**一跳**(`readlink`,不带 `-f`;相对目标锚在链接自己的目录,不折 `..`,与链视图同一词法;
+ *     链接文本的结尾换行原样保留 —— `-n` 不加换行,`$(…)` 会吞掉结尾换行,所以输出后垫一个 `.` 再剥掉;`-n` 不被认 ⇒ 读不出一跳 ⇒ 第 3 步经链接就地写):那一跳是常规文件或还不存在
+ *     ⇒ 提交落到那一跳上(链接保持是链接);否则(链 / 非常规)⇒ 走第 3 步就地写。
+ *  2. 目标是常规文件或不存在 ⇒ 私有目录不在目标的目录里(跟了一跳)⇒ 先在目标目录里用**同一只私有目录名**、同样生来 0700、同样收紧过地**重新暂存**一份
+ *     (目标机本地拷贝,不过网络;拷成了就改用新的那只、删原私有目录;拷不成就删掉新建的那只、收紧不成就放弃它,用原暂存件 ——
+ *     删不掉的都写一条 {@link STAGE_DIR_LEFT_MARK} 记录),
+ *     让 rename 不跨文件系统(与 core 把暂存放在最终目标旁边同形);
+ *     已有文件的权限位带到暂存件上(`stat -c %a`,BSD 退到 `stat -f %Lp`;带不过去不拦)—— **在 `mv` 之前**,换上去的那一刻权限位已是目标的;
+ *     `mv -f` 换上去,成功 ⇒ 删私有目录(删不掉 ⇒ 一条 {@link STAGE_DIR_LEFT_MARK} 记录,仍 `exit 0`:目标已是新件)。
+ *  3. 其余(链接链 / FIFO / 设备 / 目录 / `mv` 被拒,如单文件绑定挂载的 EBUSY)⇒ 已落定的暂存件就地拷进目标(与 core 的回落同形:
+ *     非原子,但不再经过网络传输),见 {@link takeAndWrite}:先把暂存件**打开**(读不了 ⇒ 先补上属主读位,仍读不了 ⇒ 非零退出、目标未碰),
+ *     再**删掉暂存名**(删不掉 ⇒ 非零退出、目标未碰,残留目录由脚本点名),然后才从已打开的那份拷进目标,最后关 fd、删私有目录(删不掉只记录)。于是
+ *     「目标被动过」⇒「暂存名已不在」,残留至多是一只空目录(或文件系统为打开着的文件留的隐藏项)。退出码 = 拷入那一步的退出码
+ *     (目录 ⇒ `Is a directory` 经 {@link classifyFsStderr} 归 `is_directory`)。
+ */
+export declare function buildStagedCommitCommand(stage: StagingPaths, target: string): string;
+/**
+ * 追加的提交脚本(纯数据 ⇒ `build*`):取走暂存件并写目标({@link takeAndWrite},次序同 {@link buildStagedCommitCommand} 第 3 步:先开、再删暂存名、后写、再关 fd 删私有目录),
+ * 一次 `cat >>` 加到目标尾(跟随链接、不换 inode、不碰已有字节)。暂存名删不掉 ⇒ 目标一个字节没加。
+ */
+export declare function buildStagedAppendCommand(stage: StagingPaths, target: string): string;
+/** 清掉一次写的私有目录({@link removalOf}:只删 `data` 与这只目录;不在 ⇒ 什么都不做;退出 0 ⇔ 不在了)。纯数据 ⇒ `build*`。 */
+export declare function buildStagingDiscardCommand(stage: StagingPaths): string;
+/**
+ * 一次暂存写交给 {@link writeFileStaged} / {@link appendFileStaged} 的两只面 —— 各腿的传输留在腿上,规则在这里。
+ * 🔴 **`upload` 与 `run` 必须是同一个身份、在同一台机器上**:私有目录由 `run` 建(0700,属写入方),`upload` 要进得去;提交由 `run` 做,
+ * 要拿得走、清得掉 `upload` 落下的东西。一条腿的传输若以别的身份落盘(例如容器守护进程以 root 拷入、而命令以镜像用户跑),那条腿必须改走
+ * 与 `run` 同一身份的传输,不能让编排迁就它。
+ */
+export interface StagedWriteLane {
+    /** 把**整份**字节放到 `dest`(新建;`dest` 的目录已在且是写入方的私有目录)—— 腿自己的传输(sftp / adb push / 容器内 `cat` 收 stdin / 分块 exec / provider 文件 API)。 */
+    upload(dest: string, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    /** 目标机上的一次 shell 往返(腿的文件面探针 exec:只用绝对路径,不进工作目录)。`abortSignal` 只有准备那一步带(提交一旦发出不再听取消)。 */
+    run(cmd: string, abortSignal?: AbortSignal): ReturnType<ShellChainRun>;
+}
+/**
+ * 退路拿到的两样(编排为每一次退路造一只,见 {@link createDirectContext}):`signal` = 这次写的取消信号;`inPlace(step)` = 把**写目标的那一步**包起来
+ * (连同那一步自己的通道准备:ssh 在步内拿 sftp 通道)。取消的读法只看那一步有没有被包住:包住的那一步**答了** `aborted` ⇒ 改写成 `unknown`(可能已有字节到了目标,
+ * 保守;通道准备里被取消也算在内);那一步开始之前取消已发生 ⇒ `aborted`、那一步不跑;那一步不收取消、照样写完(ssh 的 sftp)⇒ 结果照实(成功);
+ * 没包的步骤(读旧)答的 `aborted` 原样透出(目标未碰)。编排不猜退路走到了哪儿。
+ */
+export interface StagedDirectContext {
+    readonly signal: AbortSignal | undefined;
+    inPlace<T>(step: (abortSignal?: AbortSignal) => Promise<Result<T, FileError>>): Promise<Result<T, FileError>>;
+}
+/**
+ * 不暂存时的退路 —— 目录不收新名字(建私有目录被 `permission_denied` 拒)或私有目录收不成私有:腿直接对目标做的那一步(core 同一条回落:文件本身可能可写)。
+ * 两只文件面、五条腿**必传**:写面 = 腿的上传直落目标;追加面 = 能追加写的腿(ssh / local-docker / k8s)直接追加到目标,只能把整份文件落到一个路径上的腿
+ * (e2b 的 `files.write`、adb 的 push)读旧 + 拼 + 整份写目标(adb 的这一形就是 7.138.x 的追加)。字节流向目标的那一步必须经 `ctx.inPlace`(读旧不包)。
+ */
+export type StagedWriteDirect = (ctx: StagedDirectContext) => Promise<Result<void, FileError>>;
+/**
+ * 只能把整份文件落到一个路径上的腿(e2b 的 `files.write`、adb 的 push)在退路里的追加 —— 两腿共用这一只,各自只给读与写:
+ * 读旧(`not_found` ⇒ 按空;别的读错原样透出、不写)+ 按字节拼(二进制安全)+ 整份写目标。读旧**不**经 `ctx.inPlace`(取消落在这里 ⇒ `aborted`、目标未碰),
+ * 整份写经 `ctx.inPlace`(见 {@link StagedDirectContext})。adb 的这一形就是 7.138.x 的追加。
+ */
+export declare function rewriteAppend(read: (abortSignal?: AbortSignal) => Promise<Result<Uint8Array, FileError>>, write: (bytes: Uint8Array, abortSignal?: AbortSignal) => Promise<Result<void, FileError>>, add: string | Uint8Array, ctx: StagedDirectContext): Promise<Result<void, FileError>>;
+/**
+ * 远端整文件替换(ssh / adb / local-docker / k8s / e2b 五条腿调同一只;父目录由准备那一步建)。契约:成功 ⇒ 目标整份是新内容;传输失败 ⇒ 目标整份是旧内容;
+ * `aborted` ⇒ 目标未碰。私有目录清不掉 ⇒ 错误消息点名残留的目录。目录不收新名字、或私有目录收不成私有 ⇒ 不暂存,腿的上传直接落目标一次(旧形,core 同一条回落;非原子)。
+ * 提交往返本身断了(传输层错误)⇒ 答 `unknown`,消息写明提交跑没跑不可知。
+ */
+export declare function writeFileStaged(lane: StagedWriteLane, abs: string, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+/**
+ * 远端追加(五条腿调同一只;`lane.upload` 上传的是**要加的那几个字节**)。暂存那条路的契约:成功 ⇒ 目标 = 旧内容 + 新字节;传输失败 / `aborted` ⇒
+ * 目标未碰;已有字节从不被重写、inode 不换。`direct` = 目录不收新名字 / 私有目录收不成私有时腿直接写目标的那一步(必传,见 {@link StagedWriteDirect}),
+ * 不在上面的契约里:非原子 —— 中途断 ⇒ 目标可能只加上了一部分(整份写目标的 e2b / adb:已有字节被重写,目标可能没了或只剩半份);取消落在**写目标那一步开始之前**
+ * (读旧)⇒ `aborted`、目标未碰;写目标那一步因取消中断 ⇒ `unknown`、目标可能只写了一半,那一步自己的通道准备算在步内(保守,见头注与 {@link StagedDirectContext})。
+ */
+export declare function appendFileStaged(lane: StagedWriteLane, abs: string, abortSignal: AbortSignal | undefined, direct: StagedWriteDirect): Promise<Result<void, FileError>>;
 //# sourceMappingURL=remote-shell.d.ts.map

package/dist/plugins/remote-shell.js

@@ -1,5 +1,6 @@
-import { ExecutionError, SYMLINK_CHAIN_MAX_HOPS } from "@sema-agent/core";
-import { classifyFsStderr, fileErrorFromExec } from "./remote-env-file-error.js";
+import { ExecutionError, FileError, SYMLINK_CHAIN_MAX_HOPS } from "@sema-agent/core";
+import { NAME_MAX_BYTES, classifyFsStderr, fileErrorFromExec } from "./remote-env-file-error.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 import { randomBytes } from "node:crypto";
 export const EXEC_FORCE_SETTLE_GRACE_MS = 3000;
 export function armPipeDestroyGrace(child) {
@@ -153,4 +154,167 @@ export async function runSymlinkChain(absPath, run) {
         return { ok: false, error: classifyFsStderr(r.value.stderr, absPath, "unknown") };
     return { ok: true, value: { hops: symlinkChainHopsFromStdout(r.value.stdout, absPath) } };
 }
+const STAGED_FILE = "data";
+const STAGE_DIR_REFUSED_EXIT = 3;
+const STAGE_DIR_UNSEALED_EXIT = 4;
+const STAGE_DIR_UNSEALED_MESSAGE = "sema: the private staging directory could not be made private (chmod 700 failed or did not take effect, or the mode or owner read back differently — the filesystem ignores permission bits or the parent directory carries a default ACL); nothing was staged";
+export const STAGE_DIR_LEFT_MARK = "sema: staging directory left behind:";
+export function buildStagingPaths(abs, nonce = randomBytes(6).toString("hex")) {
+    const cut = abs.lastIndexOf("/");
+    const parent = abs.slice(0, cut + 1);
+    const suffix = `.stage-${nonce}`;
+    const name = Array.from(abs.slice(cut + 1));
+    while (name.length > 0 && Buffer.byteLength(`.${name.join("")}${suffix}`, "utf8") > NAME_MAX_BYTES)
+        name.pop();
+    const dir = `${parent}.${name.join("")}${suffix}`;
+    return { dir, file: `${dir}/${STAGED_FILE}` };
+}
+function privateMkdir(dir) {
+    return `(umask 077 && mkdir -- ${dir})`;
+}
+function hardenPrivate(dir) {
+    const statOf = (gnu, bsd) => `$(stat -c ${gnu} -- ${dir} 2>/dev/null || stat -f ${bsd} -- ${dir} 2>/dev/null)`;
+    return `( chmod -- 700 ${dir} 2>/dev/null && m=${statOf("%a", "%Lp")} && u=${statOf("%u", "%u")} && case "$m" in 700|[1-7]700) [ "$u" = "$(id -u)" ];; *) false;; esac )`;
+}
+function emptyPrivate(dir) {
+    return `[ ! -e ${dir}/${STAGED_FILE} ] && [ ! -L ${dir}/${STAGED_FILE} ]`;
+}
+function sealPrivate(dir) {
+    return `${hardenPrivate(dir)} && ${emptyPrivate(dir)}`;
+}
+function removalOf(dir) {
+    return `{ [ ! -L ${dir} ] && rm -f -- ${dir}/${STAGED_FILE} && { rmdir -- ${dir} 2>/dev/null || [ ! -e ${dir} ]; }; }`;
+}
+function leftMark(dir) {
+    return `printf '%s %s\\0' ${shellQuote(STAGE_DIR_LEFT_MARK)} ${dir}`;
+}
+function removePrivate(dir) {
+    return `{ ${removalOf(dir)} || ${leftMark(dir)}; }`;
+}
+function abandonPrivate(dir) {
+    return `{ rmdir -- ${dir} 2>/dev/null || ${leftMark(dir)}; }`;
+}
+export function buildStagingPrepareCommand(stage) {
+    const parent = stage.dir.slice(0, stage.dir.lastIndexOf("/")) || "/";
+    const dir = shellQuote(stage.dir);
+    return (`{ mkdir -p -- ${shellQuote(parent)} || exit 1; ${privateMkdir(dir)} || exit ${STAGE_DIR_REFUSED_EXIT}; ` +
+        `${hardenPrivate(dir)} || { ${abandonPrivate(dir)}; printf '%s\\n' ${shellQuote(STAGE_DIR_UNSEALED_MESSAGE)} >&2; exit ${STAGE_DIR_UNSEALED_EXIT}; }; ` +
+        `${emptyPrivate(dir)} || { ${abandonPrivate(dir)}; printf '%s\\n' ${shellQuote("sema: the private staging directory gained an entry before it was made private; not used")} >&2; exit 1; }; }`);
+}
+function takeAndWrite(redirect) {
+    return (`[ -r "$s" ] || chmod -- u+r "$s" 2>/dev/null; exec 3< "$s" || exit 1; { [ ! -L "$d" ] && rm -f -- "$s"; } || { ${leftMark(`"$d"`)}; exit 1; }; ` +
+        `cat <&3 ${redirect} "$t"; w=$?; exec 3<&-; ${removePrivate(`"$d"`)}; exit $w; `);
+}
+export function buildStagedCommitCommand(stage, target) {
+    return (`{ d=${shellQuote(stage.dir)}; s="$d/${STAGED_FILE}"; t=${shellQuote(target)}; ` +
+        `if [ -L "$t" ]; then h=$(readlink -n -- "$t" && printf .) || h=; h=\${h%.}; ` +
+        `case "$h" in "") ;; /*) ;; *) l="\${t%/*}"; case "$l" in "") h="/$h" ;; */) h="$l$h" ;; *) h="$l/$h" ;; esac ;; esac; ` +
+        `if [ -n "$h" ] && [ ! -L "$h" ] && { [ ! -e "$h" ] || [ -f "$h" ]; }; then t="$h"; fi; fi; ` +
+        `if [ ! -L "$t" ] && { [ ! -e "$t" ] || [ -f "$t" ]; }; then ` +
+        `if [ "\${t%/*}" != "\${d%/*}" ]; then e="\${t%/*}/\${d##*/}"; ` +
+        `if { ${privateMkdir(`"$e"`)}; } 2>/dev/null; then ` +
+        `if { ${sealPrivate(`"$e"`)}; } 2>/dev/null; then ` +
+        `if cat -- "$s" > "$e/${STAGED_FILE}" 2>/dev/null; then o="$d"; d="$e"; s="$e/${STAGED_FILE}"; ${removePrivate(`"$o"`)}; else ${removePrivate(`"$e"`)}; fi; ` +
+        `else ${abandonPrivate(`"$e"`)}; fi; fi; fi; ` +
+        `if [ -f "$t" ]; then m=$(stat -c %a -- "$t" 2>/dev/null || stat -f %Lp -- "$t" 2>/dev/null) && chmod "$m" "$s" 2>/dev/null; fi; ` +
+        `if mv -f -- "$s" "$t" 2>/dev/null; then ${removePrivate(`"$d"`)}; exit 0; fi; fi; ` +
+        `${takeAndWrite(">")}}`);
+}
+export function buildStagedAppendCommand(stage, target) {
+    return `{ d=${shellQuote(stage.dir)}; s="$d/${STAGED_FILE}"; t=${shellQuote(target)}; ${takeAndWrite(">>")}}`;
+}
+export function buildStagingDiscardCommand(stage) {
+    return removalOf(shellQuote(stage.dir));
+}
+async function discardStaged(lane, stage) {
+    const r = await lane.run(buildStagingDiscardCommand(stage));
+    if (!r.ok)
+        return r.error.message;
+    return r.value.exitCode === 0 ? undefined : r.value.stderr.trim() || "it holds something this write did not put there, or it was replaced by a link";
+}
+function withResidue(e, stage, why) {
+    return why === undefined ? e : new FileError(e.code, `${e.message} (the staging directory ${stage.dir} could not be removed: ${why})`, e.path, e);
+}
+async function landStaged(lane, abs, abortSignal, commitOf, direct) {
+    if (abortSignal?.aborted)
+        return { ok: false, error: new FileError("aborted", "aborted before the write started; the target was not touched", abs) };
+    const stage = buildStagingPaths(abs);
+    const prep = await lane.run(buildStagingPrepareCommand(stage), abortSignal);
+    if (!prep.ok) {
+        const left = await discardStaged(lane, stage);
+        return { ok: false, error: withResidue(fileErrorFromExec(prep.error, abs), stage, left) };
+    }
+    if (prep.value.exitCode !== 0) {
+        noteLeftDirs(prep.value.stdout);
+        if (abortSignal?.aborted)
+            return { ok: false, error: new FileError("aborted", "aborted before the write started; the target was not touched", abs) };
+        const e = classifyFsStderr(prep.value.stderr, abs, "unknown");
+        if (prep.value.exitCode === STAGE_DIR_REFUSED_EXIT && e.code === "permission_denied")
+            return direct(createDirectContext(abs, abortSignal, "the directory does not accept new names"));
+        if (prep.value.exitCode === STAGE_DIR_UNSEALED_EXIT) {
+            recordFailOpen("server.remote-write.stage-seal-fallback", `${abs}: ${prep.value.stderr.trim()}`);
+            return direct(createDirectContext(abs, abortSignal, "the private staging directory could not be made private"));
+        }
+        return { ok: false, error: e };
+    }
+    if (abortSignal?.aborted) {
+        const left = await discardStaged(lane, stage);
+        return { ok: false, error: withResidue(new FileError("aborted", "aborted before the write started; the target was not touched", abs), stage, left) };
+    }
+    const up = await lane.upload(stage.file, abortSignal);
+    if (!up.ok) {
+        const left = await discardStaged(lane, stage);
+        return { ok: false, error: withResidue(up.error, stage, left) };
+    }
+    if (abortSignal?.aborted) {
+        const left = await discardStaged(lane, stage);
+        return { ok: false, error: withResidue(new FileError("aborted", "aborted before the commit; the target was not touched", abs), stage, left) };
+    }
+    const c = await lane.run(commitOf(stage));
+    if (!c.ok) {
+        const left = await discardStaged(lane, stage);
+        const e = fileErrorFromExec(c.error, abs);
+        return { ok: false, error: withResidue(new FileError("unknown", `${e.message} (the commit's round trip failed, so whether it ran is unknown — re-read the target before retrying)`, abs, e), stage, left) };
+    }
+    noteLeftDirs(c.value.stdout);
+    if (c.value.exitCode !== 0) {
+        const left = await discardStaged(lane, stage);
+        return { ok: false, error: withResidue(classifyFsStderr(c.value.stderr, abs, "unknown"), stage, left) };
+    }
+    return { ok: true, value: undefined };
+}
+function noteLeftDirs(stdout) {
+    const head = `${STAGE_DIR_LEFT_MARK} `;
+    for (const rec of stdout.split("\0")) {
+        const at = rec.indexOf(head);
+        if (at >= 0)
+            recordFailOpen("server.remote-write.staging-dir-left", rec.slice(at + head.length));
+    }
+}
+function createDirectContext(abs, abortSignal, why) {
+    return {
+        signal: abortSignal,
+        inPlace: async (step) => {
+            if (abortSignal?.aborted)
+                return { ok: false, error: new FileError("aborted", `aborted before the in-place write started (${why}); the target was not touched`, abs) };
+            const r = await step(abortSignal);
+            if (r.ok || r.error.code !== "aborted")
+                return r;
+            return { ok: false, error: new FileError("unknown", `cancelled during an in-place write (${why}, so the bytes went straight to the target); the target may be partially written — re-read it before retrying`, abs, r.error) };
+        },
+    };
+}
+export async function rewriteAppend(read, write, add, ctx) {
+    const existing = await read(ctx.signal);
+    if (!existing.ok && existing.error.code !== "not_found")
+        return existing;
+    const merged = Buffer.concat([existing.ok ? existing.value : new Uint8Array(0), typeof add === "string" ? Buffer.from(add, "utf8") : add]);
+    return ctx.inPlace((signal) => write(merged, signal));
+}
+export function writeFileStaged(lane, abs, abortSignal) {
+    return landStaged(lane, abs, abortSignal, (stage) => buildStagedCommitCommand(stage, abs), (ctx) => ctx.inPlace((signal) => lane.upload(abs, signal)));
+}
+export function appendFileStaged(lane, abs, abortSignal, direct) {
+    return landStaged(lane, abs, abortSignal, (stage) => buildStagedAppendCommand(stage, abs), direct);
+}
 //# sourceMappingURL=remote-shell.js.map

package/dist/plugins/resume-anchor-store-sql.js

@@ -4,8 +4,8 @@ export class SqlResumeAnchorStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async put(sessionId, eventId, entryId, owner) {
         await this.db.query(this.q("INSERT INTO resume_anchor (session_id, event_id, entry_id, owner, created_at) VALUES (?,?,?,?,?) " +

package/dist/plugins/retention-lane-store-sql.d.ts

@@ -118,7 +118,7 @@ export declare class SqlRetentionLaneStore implements RetentionLaneStore {
     protected readonly db: SqlDriver;
     constructor(db: SqlDriver);
     /** 方言取文(两条语句都写在调用点;A12 判据)。 */
-    protected q(tidb: string, pg: string): string;
+    protected q(mysql: string, pg: string): string;
     /**
      * 抢/续租一次(单行 CAS)。抢到 ⇒ `{held:true, fencingToken}`;别人正持着 ⇒ `{held:false}`,调用方
      * **本 tick 零写静默跳过**。

package/dist/plugins/retention-lane-store-sql.js

@@ -7,8 +7,8 @@ export class SqlRetentionLaneStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async acquire(holder, ttlMs, nowMs) {
         const conn = await this.db.connect();

package/dist/plugins/retention-store-sql.d.ts

@@ -183,7 +183,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
     readonly retention: RetentionDeclaration;
     constructor(db: SqlDriver, opts: SqlRetentionStoreOptions);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE (A12 判据)。 */
-    protected q(tidb: string, pg: string): string;
+    protected q(mysql: string, pg: string): string;
     /**
      * 域谓词。**四种写法逐条写出来**(方言 × 有主/无主):
      *  · 有主:`col = ?` / `col = $n`;
@@ -404,6 +404,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      *   ① `retention_hold` 哨兵行的**锁读** —— `held=1` ⇒ 零删、全 skip 返回;锁持有到 COMMIT;
      *   ② **一条**加锁读同时完成「候选 + 活引用重查」(谓词下推 + `FOR UPDATE`,见
      *      {@link SqlRetentionStore.sessionCandidates});
+     *   ②′ 读写序律的写者半:锁住候选行之后,逐只用**本事务的连接、新语句**锁定读一次认领(`lockRootAndReadClaim`);有认领的树整棵跳过;
      *   ③ 按 E21 顺序逐表删 → 墓碑 → 审计行(同事务)→ COMMIT。
      *
      * 🔴 活引用重查为什么是**候选查询本身**而不是第二条查询(codex 交叉复审 R1 的两条 high 合并采纳):
@@ -411,12 +412,14 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      *  · `FOR UPDATE` 让这些会话行在本事务期间不可被 `touch()` 拉回视界、也不可被 session-sync 改写属主 ——
      *    旧形(不加锁 + 尾部无条件删 `session_event`)可以在属主被并发改写后,把**别的租户**的历史删掉;
      *  · 旧形还在删完 `task_active` **之后**才去复核它,那道复核因此恒真(自己刚把证据删了)—— 一段恒真的
-     *    "防护"比没有更坏。现在删除前的最后一次判据就是候选查询,删除后不再假装复核。
-     * ⚠️ **残余**(如实成文,不假装消灭):`createRun` 只写 `task_active`(亲读 run-store-sql 坐实,它不碰
-     *  `session_meta`),所以本事务的会话行锁**不**与它构成互斥。一次恰好在候选查询之后、本事务提交之前
-     *  提交的新 claim 仍会被这一轮删掉。窗口 = 级联本身的耗时,且与**在线** purge 协调器的同款窗口一模一样
-     *  (它那条 `SELECT … FOR UPDATE task_active` 同样锁不住缺席行)。真正的收口是让 `createRun` 也去锁
-     *  `session_meta` 那一行(共同锁序)—— 那是在线热路径的改动,归属另一次裁定,已进交接清单。
+     *    "防护"比没有更坏。删除之前的判据是候选查询 + ②′ 那一读,删除后不再假装复核。
+     * 与认领的互斥(共同锁序,读写序律两半):
+     *  · 认领半:`createRun` 在认领事务里**先锁根会话行**(`session_meta … FOR UPDATE`)再插 `task_active`(`run-store-sql.ts` 的 `createRun` 顶注)
+     *    ⇒ 候选查询锁住会话行之后才来的认领等在那一行上,本事务提交后它锁定读到零行 ⇒ `sessionAbsent`,不建行;
+     *  · 写者半(②′):候选查询开始时**已经持着**会话行锁、尚未提交的认领 —— 候选查询等它提交后才拿到行锁,而那条 `NOT EXISTS task_active`
+     *    读的是语句开始时的快照(PG 读已提交下非目标表按语句快照读),看不见刚提交的认领;②′ 是行锁之后的**新语句**锁定读(PG 新快照、TiDB 当前读),
+     *    认领已提交就读得到 ⇒ 这棵树跳过。被锁住的根行上不会再有新认领(认领先锁根行),所以 ②′ 之后到提交之间没有窗。
+     *    `skipped` 仍由 {@link SqlRetentionStore.countProtectedSessions} 独立测得(非锁定读:PG 新语句看得见这一只,TiDB 读事务快照可能少计它一只 —— 回执的计数口径,不是删除判据)。
      *
      * 活引用的四条腿(与设计稿 §2 的清单对表,并如实标注一条**结构上不存在**的边):
      *   · `task_active` —— 活跑 claim(在线协调器的第一道门,同一张表同一条判据);

package/dist/plugins/retention-store-sql.js

@@ -3,6 +3,7 @@ import { TASK_LIST_ITEM_TABLE, TASK_LIST_META_TABLE, taskListKeyFor } from "./ta
 import { USER_INPUT_ACCEPTANCE_TABLE } from "./user-input-ledger-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { incarnationFromCell } from "../session-incarnation.js";
+import { lockRootAndReadClaim, rowsOnSqlExec } from "./execution-placement-sql.js";
 export const MANAGED_RETENTION = "managed";
 export const UNMANAGED_RETENTION = "none";
 export function retentionSweepRuns(sweep) {
@@ -154,8 +155,8 @@ export class SqlRetentionStore {
         this.db = db;
         this.opts = opts;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     domainWhere(col, domain, pgIndex) {
         return domain === ""
@@ -163,7 +164,7 @@ export class SqlRetentionStore {
             : { sql: this.q(`${col} = ?`, `${col} = $${pgIndex}`), params: [domain] };
     }
     idSet(col, ids, pgIndex) {
-        return this.db.dialect === "tidb"
+        return this.db.dialect === "mysql"
             ? { sql: `${col} IN (${ids.map(() => "?").join(",")})`, params: [...ids] }
             : { sql: `${col} = ANY($${pgIndex}::text[])`, params: [ids] };
     }
@@ -209,7 +210,7 @@ export class SqlRetentionStore {
         if (keys.length === 0)
             return 0;
         const now = Date.now();
-        if (this.db.dialect === "tidb") {
+        if (this.db.dialect === "mysql") {
             const params = [];
             for (const k of keys)
                 params.push(domain, kind, k, now);
@@ -266,7 +267,7 @@ export class SqlRetentionStore {
         }
     }
     horizonArms(pgFirst) {
-        return this.db.dialect === "tidb"
+        return this.db.dialect === "mysql"
             ? `((c.deadline IS NOT NULL AND c.deadline <= ?) OR (c.deadline IS NULL AND c.created_at_ms <= ?))`
             : `((c.deadline IS NOT NULL AND c.deadline <= $${pgFirst}) OR (c.deadline IS NULL AND c.created_at_ms <= $${pgFirst + 1}))`;
     }
@@ -286,7 +287,7 @@ export class SqlRetentionStore {
         return Number(rows[0]?.n ?? 0);
     }
     liveReferenceExists() {
-        const workflow = this.db.dialect === "tidb"
+        const workflow = this.db.dialect === "mysql"
             ? `EXISTS (SELECT 1 FROM workflow_run wr WHERE wr.status = 'running' AND JSON_UNQUOTE(JSON_EXTRACT(wr.run, '$.originatingSessionId')) = sm.session_id)`
             : `EXISTS (SELECT 1 FROM workflow_run wr WHERE wr.status = 'running' AND wr.run::json->>'originatingSessionId' = sm.session_id)`;
         return (`(sm.placement_kind IS NOT NULL` +
@@ -336,7 +337,12 @@ export class SqlRetentionStore {
                     skippedOnAbort = (await this.sessionCandidates(conn, input)).length + (await this.countProtectedSessions(conn, input));
                     throw new RetentionAborted("hold_in_force");
                 }
-                const doomed = await this.sessionCandidates(conn, input, true);
+                const candidates = await this.sessionCandidates(conn, input, true);
+                const rowsOn = rowsOnSqlExec(conn);
+                const doomed = [];
+                for (const c of candidates)
+                    if ((await lockRootAndReadClaim(rowsOn, this.db.dialect, c.id)).activeTaskId === null)
+                        doomed.push(c);
                 const skipped = await this.countProtectedSessions(conn, input);
                 skippedOnAbort = doomed.length + skipped;
                 let deleted = 0;

package/dist/plugins/run-store-sql.d.ts

@@ -42,6 +42,14 @@ export declare class SqlRunStore {
      * `task_id` ⇒ `{ ok:false, existing }` (no new row; the submission surface renders the receipt); otherwise the
      * session claim was the collision ⇒ `{ ok:false, activeTaskId }`. A dup on the ROW insert that names no
      * observable row is not attributable to either key ⇒ rethrown (loud), never reported as a busy session.
+     *
+     * 🔴 **根会话行锁(读写序律)**:认领之前,同一事务先锁根会话行(`session_meta … FOR UPDATE`,两方言同一句)。改根行住客 / 放置的写者
+     * (删除 / 换装 / 留存 …)也在自己的事务里先锁这一行 ⇒ 认领与它们在根行上按同一锁序串行:写者持锁期间认领等锁,写者提交后认领读到的是新行。
+     * **锁定读零行**(根行在受理之后被删)⇒ 不插认领、不建行,答 `{ ok:false, sessionAbsent:true }` —— 否则认领会挂在一只没有会话行的根上,
+     * 随后同 id 登记的新住客就带着别人的认领出生。全局锁序:根 `session_meta` → `task_active` / `task_run`(删除 / 留存同序;认领持有者的
+     * `whileHoldingClaim` 只取 `task_run` → `task_active`,从不碰 `session_meta` —— 它的回调**不许**写 `session_meta`:回调持 `task_active`
+     * 等根行、认领持根行等 `task_active`,即成环;初始放置写走自己的事务、按全局锁序取锁)。fresh 根行由 authorizer 在受理时登记(唯一铸点即登记点),
+     * 续跑与 wake 复用 checkpoint 的会话 —— 所以零行只在「受理之后被删」这一种竞争里出现。
      */
     createRun(taskId: string, sessionId: string, owner: string | null, instanceId: string, meta?: NewRunMeta): Promise<CreateRunOutcome>;
     /** Request cancel of a RUNNING run (durable, cross-replica). Sets the flag the owning instance's heartbeat
@@ -165,10 +173,12 @@ export declare class SqlRunStore {
      *  ① 锁读这条 run 行且它在跑(`task_run … FOR UPDATE`);② 锁读会话的认领行且它是这条 run 的(`task_active … FOR UPDATE`);
      *  ③ 刷新这条 run 的活性戳;④ `write` 在**同一个事务连接**上跑;提交即放锁。任一没读到 ⇒ 不持有,不刷新、`write` 不调。`write` 抛或提交失败 ⇒ 整只抛。
      * 🔴 **取锁序 = task_run → task_active**,与 `setTerminal` / `reapStale` / `reapSuspended` 同序(它们先改 run 行、再删认领行):两行用两条语句按序锁,
-     *    不用连表锁读(那一形的先后由计划器定,与终局 / 收割相反时两只事务各攥一行成环)。`createRun` 只插认领行、`deleteBySession` 见认领行在就中止,
-     *    都不与本序成环。锁住之后:收割的改行 / 终局与收割的删认领 / 别人的建行都排在本事务之后,收割器提交后重判 `updated_at` 看到的是刚刷的。
+     *    不用连表锁读(那一形的先后由计划器定,与终局 / 收割相反时两只事务各攥一行成环)。`createRun` 先锁根会话行再插认领行(本序从不碰 `session_meta`)、
+     *    `deleteBySession` 先锁根会话行、见认领行在就中止,都不与本序成环。锁住之后:收割的改行 / 终局与收割的删认领 / 别人的建行都排在本事务之后,收割器提交后重判 `updated_at` 看到的是刚刷的。
      *    锁读没命中时 InnoDB 可能取一把间隙锁;本事务此后不往这两张表插任何行(见 space-commit 那条锁形注)。
      * 担保止于提交:判出「持有」的是这只事务;提交确认在路上迟到、这一跑随后失去认领,不在本栅栏的射程里(调用方的已知边界)。
+     * 🔴 **`write` 不许写 `session_meta`**:本事务持着 `task_active`,而 `createRun` 与改根行的写者都先锁根会话行再碰 `task_*`(全局锁序见 {@link createRun})——
+     *    回调去锁根行就是反序,与等着本会话认领的 `createRun` 各攥一行成环。门:`test/submission-root-contract.test.ts` 扫每个调用点的回调体。
      */
     whileHoldingClaim<T>(sessionId: string, taskId: string, write: (tx: SqlTxConn) => Promise<T>): Promise<ClaimFenced<T>>;
     /** The active run's taskId for a session (the `task_active` claim) — lets resume find the suspended run row. */
@@ -187,7 +197,7 @@ export declare class SqlRunStore {
      *  `uq_task_run_idem` makes it at most one row. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
     /** Undo THIS submission's binding (`idem_key` + `idem_body_fingerprint` → NULL) — called only where the submit surface refuses
-     *  the submission before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement
+     *  the submission before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, an execution-placement
      *  reject): the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
      *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;

package/dist/plugins/run-store-sql.js

@@ -47,8 +47,8 @@ export class SqlRunStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     isDupKey(err) {
         return isDupKeyError(this.db.dialect, err);
@@ -81,6 +81,11 @@ export class SqlRunStore {
         let stage = "claim";
         try {
             await conn.begin();
+            const { rows: root } = await conn.query(this.q("SELECT session_id FROM session_meta WHERE session_id = ? FOR UPDATE", "SELECT session_id FROM session_meta WHERE session_id = $1 FOR UPDATE"), [sessionId]);
+            if (root.length === 0) {
+                await conn.rollback();
+                return { ok: false, sessionAbsent: true };
+            }
             const now = new Date();
             try {
                 await conn.query(this.q("INSERT INTO task_active (session_id, task_id, since) VALUES (?,?,?)", "INSERT INTO task_active (session_id, task_id, since) VALUES ($1,$2,$3)"), [sessionId, taskId, now]);
@@ -98,7 +103,7 @@ export class SqlRunStore {
                     cells.identitySource,
                     cells.identityScope,
                     cells.identityPrincipalInc,
-                    this.db.dialect === "tidb"
+                    this.db.dialect === "mysql"
                         ? meta.objectivePreview ?? null
                         : meta.objectivePreview == null
                             ? null
@@ -176,8 +181,8 @@ export class SqlRunStore {
                 const w = await conn.query(this.q("UPDATE task_run SET status = ?, result = ?, error = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended','needs_review')", "UPDATE task_run SET status = $1, result = $2::jsonb, error = $3, error_code = $4, updated_at = $5 WHERE task_id = $6 AND status IN ('running','suspended','needs_review')"), [
                     status,
                     result == null ? null : this.json(result),
-                    this.db.dialect === "tidb" ? error : error == null ? null : pgSanitizeText(error),
-                    this.db.dialect === "tidb" ? errorCode : errorCode == null ? null : pgSanitizeText(errorCode),
+                    this.db.dialect === "mysql" ? error : error == null ? null : pgSanitizeText(error),
+                    this.db.dialect === "mysql" ? errorCode : errorCode == null ? null : pgSanitizeText(errorCode),
                     new Date(),
                     taskId,
                 ]);
@@ -248,7 +253,7 @@ export class SqlRunStore {
     }
     async claimSpaceCommitIn(conn, spaceKey, taskId, state, claim) {
         if (!claim.requireOwn) {
-            await conn.query(this.q(`INSERT INTO workspace_space_commit (space_key, task_id, state, expires_at_ms) VALUES (?,?,?,${SQL_DB_NOW_MS.tidb} + ?) ON DUPLICATE KEY UPDATE space_key = space_key`, `INSERT INTO workspace_space_commit (space_key, task_id, state, expires_at_ms) VALUES ($1,$2,$3,${SQL_DB_NOW_MS.pg} + $4::bigint) ON CONFLICT (space_key) DO UPDATE SET space_key = EXCLUDED.space_key`), [spaceKey, taskId, state, claim.boundMs]);
+            await conn.query(this.q(`INSERT INTO workspace_space_commit (space_key, task_id, state, expires_at_ms) VALUES (?,?,?,${SQL_DB_NOW_MS.mysql} + ?) ON DUPLICATE KEY UPDATE space_key = space_key`, `INSERT INTO workspace_space_commit (space_key, task_id, state, expires_at_ms) VALUES ($1,$2,$3,${SQL_DB_NOW_MS.pg} + $4::bigint) ON CONFLICT (space_key) DO UPDATE SET space_key = EXCLUDED.space_key`), [spaceKey, taskId, state, claim.boundMs]);
         }
         const row = await this.readSpaceCommitIn(conn, spaceKey, true);
         switch (decideSpaceCommitClaim(row, taskId, claim)) {
@@ -257,7 +262,7 @@ export class SqlRunStore {
             case "insert":
                 throw new Error("workspace_space_commit: a space's row vanished under this transaction's own lock");
             case "update": {
-                const w = await conn.query(this.q(`UPDATE workspace_space_commit SET task_id = ?, state = ?, expires_at_ms = ${SQL_DB_NOW_MS.tidb} + ? WHERE space_key = ? AND task_id = ?`, `UPDATE workspace_space_commit SET task_id = $1, state = $2, expires_at_ms = ${SQL_DB_NOW_MS.pg} + $3::bigint WHERE space_key = $4 AND task_id = $5`), [taskId, state, claim.boundMs, spaceKey, row.taskId]);
+                const w = await conn.query(this.q(`UPDATE workspace_space_commit SET task_id = ?, state = ?, expires_at_ms = ${SQL_DB_NOW_MS.mysql} + ? WHERE space_key = ? AND task_id = ?`, `UPDATE workspace_space_commit SET task_id = $1, state = $2, expires_at_ms = ${SQL_DB_NOW_MS.pg} + $3::bigint WHERE space_key = $4 AND task_id = $5`), [taskId, state, claim.boundMs, spaceKey, row.taskId]);
                 return w.affected > 0;
             }
         }
@@ -313,20 +318,20 @@ export class SqlRunStore {
         };
     }
     async getRun(taskId) {
-        const { rows } = await this.db.query(this.q(`SELECT ${runRowCols("tidb")} FROM task_run WHERE task_id = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE task_id = $1`), [taskId]);
+        const { rows } = await this.db.query(this.q(`SELECT ${runRowCols("mysql")} FROM task_run WHERE task_id = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE task_id = $1`), [taskId]);
         return rows[0] ? this.rowToRun(rows[0]) : undefined;
     }
     async observeSubmittedRow(conn, taskId, idemKey) {
         if (idemKey !== null) {
-            const { rows } = await conn.query(this.q(`SELECT ${runRowCols("tidb")} FROM task_run WHERE idem_key = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE idem_key = $1`), [idemKey]);
+            const { rows } = await conn.query(this.q(`SELECT ${runRowCols("mysql")} FROM task_run WHERE idem_key = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE idem_key = $1`), [idemKey]);
             if (rows[0])
                 return this.rowToRun(rows[0]);
         }
-        const { rows } = await conn.query(this.q(`SELECT ${runRowCols("tidb")} FROM task_run WHERE task_id = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE task_id = $1`), [taskId]);
+        const { rows } = await conn.query(this.q(`SELECT ${runRowCols("mysql")} FROM task_run WHERE task_id = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE task_id = $1`), [taskId]);
         return rows[0] ? this.rowToRun(rows[0]) : undefined;
     }
     async getRunByIdem(idemKey) {
-        const { rows } = await this.db.query(this.q(`SELECT ${runRowCols("tidb")} FROM task_run WHERE idem_key = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE idem_key = $1`), [idemKey]);
+        const { rows } = await this.db.query(this.q(`SELECT ${runRowCols("mysql")} FROM task_run WHERE idem_key = ?`, `SELECT ${runRowCols("pg")} FROM task_run WHERE idem_key = $1`), [idemKey]);
         return rows[0] ? this.rowToRun(rows[0]) : undefined;
     }
     async releaseIdemKey(taskId) {
@@ -341,7 +346,7 @@ export class SqlRunStore {
     async listRuns(opts) {
         if (opts.cursor && Number.isNaN(Date.parse(opts.cursor.createdAt)))
             return [];
-        if (this.db.dialect === "tidb") {
+        if (this.db.dialect === "mysql") {
             const where = [];
             const params = [];
             if (opts.status) {
@@ -367,7 +372,7 @@ export class SqlRunStore {
                 where.push("(created_at < ? OR (created_at = ? AND task_id < ?))");
                 params.push(new Date(opts.cursor.createdAt), new Date(opts.cursor.createdAt), opts.cursor.taskId);
             }
-            const sql = `SELECT ${runRowCols("tidb")} FROM task_run` +
+            const sql = `SELECT ${runRowCols("mysql")} FROM task_run` +
                 (where.length ? " WHERE " + where.join(" AND ") : "") +
                 " ORDER BY created_at DESC, task_id DESC LIMIT ?";
             params.push(opts.limit);
@@ -408,7 +413,7 @@ export class SqlRunStore {
         return r === undefined ? undefined : { taskId: String(r.task_id), owner: r.owner ?? null, createdAt: iso(r.created_at) };
     }
     async listSessions(opts) {
-        if (this.db.dialect === "tidb") {
+        if (this.db.dialect === "mysql") {
             const params = [];
             let innerWhere = "";
             if (opts.owner !== undefined) {
@@ -528,7 +533,7 @@ export class SqlRunStore {
         return m == null ? 0 : Number(m);
     }
     async getEvents(taskId, afterSeq) {
-        const { rows } = await this.db.query(this.q(`SELECT seq, type, ${jsonColumnText("tidb", "data")}, ts FROM task_event WHERE task_id = ? AND seq > ? ORDER BY seq ASC`, `SELECT seq, type, ${jsonColumnText("pg", "data")}, ts FROM task_event WHERE task_id = $1 AND seq > $2 ORDER BY seq ASC`), [taskId, afterSeq]);
+        const { rows } = await this.db.query(this.q(`SELECT seq, type, ${jsonColumnText("mysql", "data")}, ts FROM task_event WHERE task_id = ? AND seq > ? ORDER BY seq ASC`, `SELECT seq, type, ${jsonColumnText("pg", "data")}, ts FROM task_event WHERE task_id = $1 AND seq > $2 ORDER BY seq ASC`), [taskId, afterSeq]);
         return rows.map((r) => ({
             seq: Number(r.seq),
             type: String(r.type),