@sema-agent/server 7.138.0 → 7.140.0

package/dist/plugins/workflow-run-store-sql.js

@@ -57,8 +57,8 @@ export class SqlWorkflowRunStore {
         this.db = db;
         this.onWarn = onWarn;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async put(id, run) {
         const stored = { ...withRedactedError(run), id, rev: run.rev ?? 0 };
@@ -73,7 +73,7 @@ export class SqlWorkflowRunStore {
         }
     }
     async get(id) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "run")}, rev FROM workflow_run WHERE id = ?`, `SELECT ${jsonColumnText("pg", "run")}, rev FROM workflow_run WHERE id = $1`), [id]);
+        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("mysql", "run")}, rev FROM workflow_run WHERE id = ?`, `SELECT ${jsonColumnText("pg", "run")}, rev FROM workflow_run WHERE id = $1`), [id]);
         const r = rows[0];
         if (!r)
             return null;
@@ -100,7 +100,7 @@ export class SqlWorkflowRunStore {
         const params = [scope];
         let where;
         let limit = "";
-        if (this.db.dialect === "tidb") {
+        if (this.db.dialect === "mysql") {
             where = "scope = ?";
             if (opts?.status !== undefined) {
                 where += " AND status = ?";
@@ -160,9 +160,9 @@ export class SqlWorkflowRunStore {
         }
         if (doomed.length === 0)
             return 0;
-        const res = await this.db.query(this.q(`DELETE FROM workflow_run WHERE scope = ? AND id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_run WHERE scope = $1 AND id = ANY($2::text[])"), this.db.dialect === "tidb" ? [scope, ...doomed] : [scope, doomed]);
-        await this.db.query(this.q(`DELETE FROM workflow_agent_session WHERE scope = ? AND run_id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_agent_session WHERE scope = $1 AND run_id = ANY($2::text[])"), this.db.dialect === "tidb" ? [scope, ...doomed] : [scope, doomed]);
-        await this.db.query(this.q(`DELETE FROM workflow_park_decision WHERE run_id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_park_decision WHERE run_id = ANY($1::text[])"), this.db.dialect === "tidb" ? [...doomed] : [doomed]);
+        const res = await this.db.query(this.q(`DELETE FROM workflow_run WHERE scope = ? AND id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_run WHERE scope = $1 AND id = ANY($2::text[])"), this.db.dialect === "mysql" ? [scope, ...doomed] : [scope, doomed]);
+        await this.db.query(this.q(`DELETE FROM workflow_agent_session WHERE scope = ? AND run_id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_agent_session WHERE scope = $1 AND run_id = ANY($2::text[])"), this.db.dialect === "mysql" ? [scope, ...doomed] : [scope, doomed]);
+        await this.db.query(this.q(`DELETE FROM workflow_park_decision WHERE run_id IN (${doomed.map(() => "?").join(",")})`, "DELETE FROM workflow_park_decision WHERE run_id = ANY($1::text[])"), this.db.dialect === "mysql" ? [...doomed] : [doomed]);
         return res.affected;
     }
 }
@@ -175,8 +175,8 @@ export class SqlWorkflowCompletionInbox {
         this.db = db;
         this.onWarn = onWarn;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async sweepFences(now) {
         await this.db.query(this.q("DELETE FROM workflow_inbox_fence WHERE until_ms < ?", "DELETE FROM workflow_inbox_fence WHERE until_ms < $1"), [now]);
@@ -213,7 +213,7 @@ export class SqlWorkflowCompletionInbox {
         }
         const over = await this.db.query(this.q("SELECT seq, run_id FROM workflow_completion_inbox WHERE session_id = ? ORDER BY seq DESC LIMIT 100000 OFFSET ?", "SELECT seq, run_id FROM workflow_completion_inbox WHERE session_id = $1 ORDER BY seq DESC OFFSET $2"), [entry.sessionId, MAX_PENDING_PER_SESSION]);
         if (over.rows.length > 0) {
-            await this.db.query(this.q(`DELETE FROM workflow_completion_inbox WHERE session_id = ? AND seq IN (${over.rows.map(() => "?").join(",")})`, "DELETE FROM workflow_completion_inbox WHERE session_id = $1 AND seq = ANY($2::bigint[])"), this.db.dialect === "tidb" ? [entry.sessionId, ...over.rows.map((r) => r.seq)] : [entry.sessionId, over.rows.map((r) => r.seq)]);
+            await this.db.query(this.q(`DELETE FROM workflow_completion_inbox WHERE session_id = ? AND seq IN (${over.rows.map(() => "?").join(",")})`, "DELETE FROM workflow_completion_inbox WHERE session_id = $1 AND seq = ANY($2::bigint[])"), this.db.dialect === "mysql" ? [entry.sessionId, ...over.rows.map((r) => r.seq)] : [entry.sessionId, over.rows.map((r) => r.seq)]);
             for (const r of over.rows)
                 this.onWarn?.("workflow_completion_inbox_overflow", { sessionId: entry.sessionId, droppedRunId: String(r.run_id) });
         }
@@ -243,7 +243,7 @@ export class SqlWorkflowCompletionInbox {
         await this.sweepFences(now);
         await this.db.query(this.q("INSERT INTO workflow_inbox_fence (session_id, kind, run_id, owner, owner_known, until_ms) VALUES (?,?,?,?,?,?) " +
             "ON DUPLICATE KEY UPDATE owner = VALUES(owner), owner_known = VALUES(owner_known), until_ms = VALUES(until_ms)", "INSERT INTO workflow_inbox_fence (session_id, kind, run_id, owner, owner_known, until_ms) VALUES ($1,$2,'',$3,$4,$5) " +
-            "ON CONFLICT (session_id, kind, run_id) DO UPDATE SET owner = EXCLUDED.owner, owner_known = EXCLUDED.owner_known, until_ms = EXCLUDED.until_ms"), this.db.dialect === "tidb"
+            "ON CONFLICT (session_id, kind, run_id) DO UPDATE SET owner = EXCLUDED.owner, owner_known = EXCLUDED.owner_known, until_ms = EXCLUDED.until_ms"), this.db.dialect === "mysql"
             ? [sessionId, KIND_PURGE, "", purgedOwner ?? null, purgedOwner !== undefined ? 1 : 0, now + PURGE_FENCE_MS]
             : [sessionId, KIND_PURGE, purgedOwner ?? null, purgedOwner !== undefined ? 1 : 0, now + PURGE_FENCE_MS]);
         await this.db.query(this.q("DELETE FROM workflow_completion_inbox WHERE session_id = ?", "DELETE FROM workflow_completion_inbox WHERE session_id = $1"), [sessionId]);
@@ -263,8 +263,8 @@ export class SqlWorkflowNotifyJournalStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async record(input) {
         await this.db.query(this.q("INSERT IGNORE INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at_ms) VALUES (?,?,0,?,?,?)", "INSERT INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at_ms) VALUES ($1,$2,0,$3,$4,$5) ON CONFLICT (run_id) DO NOTHING"), [input.runId, input.scope, input.sourceTaskId ?? null, input.principal ?? null, input.createdAt]);
@@ -308,8 +308,8 @@ export class SqlWorkflowAgentSessionIndex {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async ensurePointers(_runId, rows) {
         for (const r of rows) {
@@ -335,8 +335,8 @@ export class SqlWorkflowParkDecisionStore {
     constructor(claims) {
         this.claims = claims;
     }
-    q(tidb, pg) {
-        return this.claims.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.claims.db.dialect === "mysql" ? mysql : pg;
     }
     async record(d) {
         const fenced = await this.claims.whileHoldingClaim(d.hostSessionId, d.deliveredTaskId, async (tx) => {
@@ -347,12 +347,12 @@ export class SqlWorkflowParkDecisionStore {
         return fenced.held;
     }
     async get(token) {
-        const { rows } = await this.claims.db.query(this.q(`SELECT token, run_id, host_session_id, ${jsonColumnText("tidb", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE token = ?`, `SELECT token, run_id, host_session_id, ${jsonColumnText("pg", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE token = $1`), [token]);
+        const { rows } = await this.claims.db.query(this.q(`SELECT token, run_id, host_session_id, ${jsonColumnText("mysql", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE token = ?`, `SELECT token, run_id, host_session_id, ${jsonColumnText("pg", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE token = $1`), [token]);
         const r = rows[0];
         return r ? rowToParkDecision(r) : null;
     }
     async listByHostSession(hostSessionId) {
-        const { rows } = await this.claims.db.query(this.q(`SELECT token, run_id, host_session_id, ${jsonColumnText("tidb", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE host_session_id = ?`, `SELECT token, run_id, host_session_id, ${jsonColumnText("pg", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE host_session_id = $1`), [hostSessionId]);
+        const { rows } = await this.claims.db.query(this.q(`SELECT token, run_id, host_session_id, ${jsonColumnText("mysql", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE host_session_id = ?`, `SELECT token, run_id, host_session_id, ${jsonColumnText("pg", "outcome")}, fingerprint, delivered_task_id, accepted_at_ms FROM workflow_park_decision WHERE host_session_id = $1`), [hostSessionId]);
         return rows.map(rowToParkDecision);
     }
 }

package/dist/plugins/write-behind-counter.d.ts

@@ -34,6 +34,7 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type AlignedWindow } from "../observability/cost-quota.js";
+import type { SqlDialect } from "./sql-driver.js";
 export interface CounterTable {
     /** Table name; must have columns (<keyCol>, window_bucket BIGINT, <valCol>, updated_at). */
     table: string;
@@ -56,7 +57,6 @@ export type CounterDegradeHook = (info: CounterDegradeInfo) => void;
  *  flush round forever; the stalled watchdog can then only report, not recover). The rejection lands in
  *  the existing flush/refresh catch → the S9 streak telemetry counts it; the round ENDS and retries. */
 export declare const DEFAULT_COUNTER_QUERY_TIMEOUT_MS = 30000;
-type CounterDialect = "tidb" | "pg";
 /** Dual-dialect write-behind aggregating counter. See the file header for the dialect-delta ledger. */
 export declare class SqlWriteBehindCounter {
     private readonly dialect;
@@ -73,7 +73,7 @@ export declare class SqlWriteBehindCounter {
     private flushing;
     private flushStartedAt;
     private failStreak;
-    constructor(dialect: CounterDialect, pool: MySqlPool | PgPool, t: CounterTable, 
+    constructor(dialect: SqlDialect, pool: MySqlPool | PgPool, t: CounterTable, 
     /** 🔴 不再 `readonly`([ref]):`costQuotaWindowSec` 热更新经 {@link setWindowMs} 换代,语义见那里。 */
     windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook | undefined, // S9: observability tap — never affects counting
     queryTimeoutMs?: number);
@@ -135,5 +135,4 @@ export declare class WriteBehindCounter extends SqlWriteBehindCounter {
 export declare class PgWriteBehindCounter extends SqlWriteBehindCounter {
     constructor(pool: PgPool, t: CounterTable, windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook, queryTimeoutMs?: number);
 }
-export {};
 //# sourceMappingURL=write-behind-counter.d.ts.map

package/dist/plugins/write-behind-counter.js

@@ -25,7 +25,7 @@ export class SqlWriteBehindCounter {
         this.queryTimeoutMs = queryTimeoutMs;
     }
     async exec(sql, params) {
-        if (this.dialect === "tidb") {
+        if (this.dialect === "mysql") {
             const [r] = (await this.pool.query({ sql, timeout: this.queryTimeoutMs }, params));
             if (Array.isArray(r))
                 return { rows: r, affected: 0 };
@@ -92,7 +92,7 @@ export class SqlWriteBehindCounter {
     }
     async flushOnce() {
         const { table, keyCol, valCol } = this.t;
-        const sql = this.dialect === "tidb"
+        const sql = this.dialect === "mysql"
             ? `INSERT INTO ${table} (${keyCol}, window_bucket, ${valCol}, updated_at) VALUES (?,?,?,?) ` +
                 `ON DUPLICATE KEY UPDATE ${valCol} = ${valCol} + VALUES(${valCol}), updated_at = VALUES(updated_at)`
             : `INSERT INTO ${table} (${keyCol}, window_bucket, ${valCol}, updated_at) VALUES ($1,$2,$3,$4) ` +
@@ -129,7 +129,7 @@ export class SqlWriteBehindCounter {
         const { table, keyCol, valCol } = this.t;
         const b = this.bucket();
         try {
-            const { rows } = await this.exec(this.dialect === "tidb"
+            const { rows } = await this.exec(this.dialect === "mysql"
                 ? `SELECT ${keyCol}, ${valCol} FROM ${table} WHERE window_bucket = ?`
                 : `SELECT ${keyCol}, ${valCol} FROM ${table} WHERE window_bucket = $1`, [b]);
             const next = new Map();
@@ -145,7 +145,7 @@ export class SqlWriteBehindCounter {
     }
     async reap() {
         try {
-            const { affected } = await this.exec(this.dialect === "tidb"
+            const { affected } = await this.exec(this.dialect === "mysql"
                 ? `DELETE FROM ${this.t.table} WHERE window_bucket < ?`
                 : `DELETE FROM ${this.t.table} WHERE window_bucket < $1`, [this.bucket()]);
             this.bump("reap", false);
@@ -175,7 +175,7 @@ export class SqlWriteBehindCounter {
 }
 export class WriteBehindCounter extends SqlWriteBehindCounter {
     constructor(pool, t, windowMs, now, onDegraded, queryTimeoutMs) {
-        super("tidb", pool, t, windowMs, now, onDegraded, queryTimeoutMs);
+        super("mysql", pool, t, windowMs, now, onDegraded, queryTimeoutMs);
     }
 }
 export class PgWriteBehindCounter extends SqlWriteBehindCounter {

package/dist/project-memory.d.ts

@@ -1,14 +1,8 @@
 import { type PlatformPath } from "node:path";
-import type { ProjectMemoryLoad } from "@sema-agent/core";
+import type { ProjectMemoryLoad, RunnerDeps } from "@sema-agent/core";
 import { type InstructionSourceSeat } from "./instruction-source-notice.js";
-interface ProjectMemoryCtx {
-    cwd: string;
-    handsEnabled: boolean;
-    isSubagent: boolean;
-    agentName?: string;
-    sessionId?: string;
-    phase?: "fresh" | "resume" | "post-compact" | "post-clear";
-}
+/** The engine's loader ctx, read from its seat type (one source: a hand-copied twin kept a phase word the engine had retired). */
+type ProjectMemoryCtx = Parameters<NonNullable<RunnerDeps["loadProjectMemory"]>>[0];
 /** The instruction-file name chain: the CLAUDE family first, the AGENTS family only when no CLAUDE file is
  *  present. The FIRST hit is the single declared instruction source.
  *
@@ -37,17 +31,17 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
     rel: InstructionChainMember;
 } | null;
 /**
- * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
- * directory. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
+ * Build a `loadProjectMemory` for the host lane. Answers `{ content: null }` (skip) unless hands are enabled AND cwd is a
+ * local directory — every answer is a `ProjectMemoryLoad`, the one form the engine reads. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
  * `git log -5` / `git status`, redacts secrets, and caps the total. A subagent gets a trimmed instruction file and
- * no git narrative (cost control, H7). When an instruction file is hit the return is a `ProjectMemoryLoad`
- * declaring it in `instructionSources` (path + sha256 over the raw bounded-read window) so core's
+ * no git narrative (cost control, H7). When an instruction file is hit the answer also declares it in
+ * `instructionSources` (path + sha256 over the raw bounded-read window) so core's
  * instructions-change lane can probe it mid-run.
  *
  * Session snapshot cache (S-2): keyed on ctx.sessionId — a session keeps ONE stable instruction snapshot
  * (mid-run file edits surface via the probe as tail attachments, never a silently re-rendered prefix).
  * `phase: "post-compact"` forces a re-read (core re-renders the prefix there anyway). No entry for
- * sessionless one-shot runs. (post-clear never arrives from core — [ref] — so it is not a cache key here.)
+ * sessionless one-shot runs.
  *
  * [ref] — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
  * instruction chain hands the chain member it selected (`null` = none) to {@link announceInstructionSource}, which
@@ -72,7 +66,7 @@ export declare function makeLoadProjectMemory(opts: {
     cacheMax?: number;
     /** [ref]: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
     instructionSource?: InstructionSourceSeat;
-}): (ctx: ProjectMemoryCtx) => Promise<string | null | ProjectMemoryLoad>;
+}): (ctx: ProjectMemoryCtx) => Promise<ProjectMemoryLoad>;
 /**
  * ② The `RunnerDeps.probeInstructionSources` seam: re-fingerprint the declared instruction files mid-run so
  * core's instructions-change lane can append a tail attachment when one changes. Same read posture as the

package/dist/project-memory.js

@@ -42,7 +42,8 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
-const NOT_APPLICABLE = { walked: false, answer: null };
+const NOTHING_TO_INJECT = Object.freeze({ content: null });
+const NOT_APPLICABLE = { walked: false, answer: NOTHING_TO_INJECT };
 export function instructionChainCoordinates(absPath, p = hostPath) {
     const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
     for (const rel of candidates) {
@@ -218,12 +219,12 @@ export function makeLoadProjectMemory(opts) {
         if (gitNarrative)
             sections.push(gitNarrative);
         if (sections.length === 0)
-            return { walked: true, answer: null, instructionFile };
+            return { walked: true, answer: NOTHING_TO_INJECT, instructionFile };
         const redacted = redactSecrets(sections.join("\n\n"));
         const capped = capUtf8(redacted, totalCap);
         opts.logger?.debug?.("project_memory_loaded", { cwd: root, bytes: Buffer.byteLength(capped, "utf8"), isSubagent: ctx.isSubagent, gitOk, ...(gitDropReason ? { gitDropReason } : {}), claudeTruncated, ...(hitFile ? { instructionFile: hitFile } : {}), ...(ctx.phase ? { phase: ctx.phase } : {}), cacheSize: cache.size });
         if (!capped)
-            return { walked: true, answer: null, instructionFile };
+            return { walked: true, answer: NOTHING_TO_INJECT, instructionFile };
         if (hitFile && hitHash) {
             return {
                 walked: true,
@@ -237,7 +238,7 @@ export function makeLoadProjectMemory(opts) {
                 instructionFile,
             };
         }
-        return { walked: true, answer: capped, instructionFile };
+        return { walked: true, answer: { content: capped }, instructionFile };
     }
 }
 export function makeProbeInstructionSources() {

package/dist/request-key-closure.js

@@ -28,7 +28,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
     "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
-    "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
+    "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
     "userAttachments", "userInvokedSkills", "verify", "verifyRounds",
 ];

package/dist/request-value-closure.d.ts

@@ -67,18 +67,17 @@ export declare const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must b
  * 判据:{@link fileHistoryRestoreConflict}。**只在 fresh 受理门**(`http/admission.ts`);续跑腿不过这道门(RESUME 重放不过受理门,
  * 同律 —— 且续跑腿重建时整族剥掉一次性历史动作,矛盾在盘上的体里本就留不下来)。wire 可见、字节冻结。
  */
-export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) \u2014 the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
+export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles or rewindFilesTo) \u2014 the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 /**
- * 「关断词 ∧ 还原」这一对的判据(纯函数,只看体)。还原 = 三个键里任一个在请求:`restoreFiles: true`、非空串 `rewindFilesTo`
- * (与 `boot/resolve-spec.ts` 的读法同:空串 / 非串按缺席)、退役拼法 `rewindFiles: true`(restore 义要一次还原;capture 义要的
- * 正是这个词关掉的记录 —— 两义都与关断词矛盾)。调用前值形已由上面的单成员表与既有布尔门判过。
+ * 「关断词 ∧ 还原」这一对的判据(纯函数,只看体)。还原 = 两个键里任一个在请求:`restoreFiles: true`、非空串 `rewindFilesTo`
+ * (与 `boot/resolve-spec.ts` 的读法同:空串 / 非串按缺席)。调用前值形已由上面的单成员表与既有布尔门判过。
  */
-export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFiles" | "rewindFilesTo">): boolean;
+export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFilesTo">): boolean;
 /**
- * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo` · 退役的 `rewindFiles`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
+ * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
  * 判据只有这一份,拒体的 `detail.fields` 点名的也是它(判与点名不会各读各的)。
  */
-export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo" | "rewindFiles">;
+export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo">;
 /**
  * **单成员闭集键表** —— 每键合法值只有它自己那一个关断词(`word`),缺席=照常,没有「开」的拼法。
  *

package/dist/request-value-closure.js

@@ -2,7 +2,7 @@ export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string
 export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
 export const PROJECT_MEMORY_OFF_SPELLING_MESSAGE = "projectMemory must be the string 'disabled' when present (the request-level declaration that this run reads none of the deployment's project context — no project instruction files and no project layer; absent = the deployment's project context as usual — there is no 'on' spelling)";
-export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
+export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles or rewindFilesTo) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
     return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
 }
@@ -12,8 +12,6 @@ export function fileHistoryRestoreKeysInBody(body) {
         out.push("restoreFiles");
     if (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0)
         out.push("rewindFilesTo");
-    if (body.rewindFiles === true)
-        out.push("rewindFiles");
     return out;
 }
 const SINGLE_MEMBER_OFF_FIELDS = [

package/dist/resource-suspend.d.ts

@@ -5,24 +5,26 @@
  * task opts in, a budget/turns/walltime limit OR a scheduler preempt durably SUSPENDS the task (resumable via
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
- * 🔴 EXCLUDE verify/cascade tasks. Core runs their implementation via `runWithVerification`/`runCascade`, which
- * map an inner durable suspend to a FAILED result (`errorCode: "unexpected.suspended"`,内层 status
- * "needs_review" 时铸 `"unexpected.needs_review"` —— 真源是 core `agents/suspend-guard.js` 的
- * `mapNestedSuspend`;`suspended.*` 三码是 bg 子代/委派报告面的词,不落在这条 TaskResult 腿上). The service would then
- * `setTerminal(failed)` while core had already minted a pending `resource_limit` checkpoint + suspended the
- * remote VM — ORPHANING both (the run row is terminal, so nothing resumes them). So a resource-limit hit on a
- * verify/cascade task must FAIL CLEANLY (no suspend), exactly as before the flag. This exclusion is the SAME
- * boundary the `preemptSignal` wiring enforces in runs.ts (stream-path only), so eligibility and the signal stay
- * aligned. (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended
- * VM + checkpoint on every verify/cascade task that hits a resource limit.)
+ * 🔴 EXCLUDE cascade tasks. Core runs a cascade through `runCascade`, which maps a rung's durable suspend to a FAILED
+ * result carrying the pause (`errorCode: "unexpected.suspended"`, 内层 status "needs_review" 时铸 `"unexpected.needs_review"`,
+ * 停驻因由在 `terminal.nestedPause` —— 真源是 core `agents/suspend-guard.js` 的 `mapNestedSuspend`;`suspended.*` 三码是 bg
+ * 子代/委派报告面的词,不落在这条 TaskResult 腿上). A rung's pause lands on the rung's own engine-minted session, which the
+ * host-boundary judge (`atHostBoundary`, src/terminal.ts) leaves terminal: the service would `setTerminal(failed)` while core
+ * had already minted a pending `resource_limit` checkpoint + suspended the remote VM — ORPHANING both (the run row is
+ * terminal, so nothing resumes them). A resource-limit hit on a cascade task must FAIL CLEANLY (no suspend).
+ * (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended VM + checkpoint on every
+ * cascade task that hits a resource limit.) The arm is the judge's session cell seen from the opt-in side: the day the engine
+ * lets a rung's pause land on a session the host's resume chain reaches (core [ref]), the judge's answer flips and this arm goes.
+ * Every other task — a verify task included — opts in alike. A verify task's implementation leg and fix rounds run on the
+ * run's own session, so the judge lifts their pause into a park of the run row (resumable through
+ * `POST /v1/assistant/tasks/:id/resume`); the verifier's own leg is built by the engine without an opt-in, so a limit there
+ * still fails that leg.
  */
 export declare function resourceSuspendOptIn(opts: {
     /** `RESOURCE_SUSPEND=true` (the worker-level switch). */
     enabled: boolean;
     /** `RESOURCE_SUSPEND_TTL_SEC` — 0 ⇒ core default (30d) by omitting `ttlMs`. */
     ttlSec: number;
-    /** This task requested the developer-mode verify gate (`body.verify === true`). */
-    isVerify: boolean;
     /** This task requested the cascade ladder (`body.cascade === true`). */
     isCascade: boolean;
     /** Multi-tenant isolation key — the SAME key durableApproval uses (the principal; "_" when auth is off). */

package/dist/resource-suspend.js

@@ -1,5 +1,5 @@
 export function resourceSuspendOptIn(opts) {
-    if (!opts.enabled || opts.isVerify || opts.isCascade)
+    if (!opts.enabled || opts.isCascade)
         return undefined;
     return {
         scope: opts.scope,

package/dist/resource-window.d.ts

@@ -9,7 +9,7 @@
  * 【两半各自的真源(刻意不自建第三本账)】
  *  · **上限半**:本模块的进程内登记册 —— 记的是**这条 run 真正铸给 core 的那只 `resourceSuspend`**
  *    (装配点 `boot/resolve-spec.ts` 的 `resourceSuspendOptIn`),不是读时现取 env。差别是承重的:
- *    ① verify/cascade 腿被 `resourceSuspendOptIn` **整只排除**(opt-in 不成立)⇒ 登记册里没有它 ⇒
+ *    ① cascade 腿被 `resourceSuspendOptIn` **整只排除**(opt-in 不成立)⇒ 登记册里没有它 ⇒
  *       整键缺席,绝不显示一个没人执行的天花板;② 滚动改 env 之后,已在跑的 run 报的仍是它自己那份。
  *  · **已耗半**:run 自己的 durable 账本行 `model_usage`(`trace/project.ts` 的 `aggregateModelUsage`)——
  *    与 `TaskStats.modelUsage` 回声**同一份账**,append-only、跨 slice、跨进程(每条腿只追加自己的
@@ -21,7 +21,8 @@
  * core 的 `spentTokens` 轴 = 每片 `TaskStats.tokens`(= Σ 每次调用 `usage.totalTokens`,**不含**委派子代,
  * 子代在 `stats.nested`),而 `model_usage` 行正是同一批 `brain.call` 的逐 turn delta、同样只收顶层 run。
  * 已知差:① **滞后至多一个 turn**(delta 在 turn 边界 drain,进行中的那一 turn 还没入账);② 账本行
- * 写失败(F 类)会少计。⇒ 本投影是**分诊/预警**读面,**不是**任何门/CAS/resume 判定的输入。
+ * 写失败(F 类)会少计;③ 只回结果的组合腿(verify)没有逐 turn 落账的流,`model_usage` 行只在停驻 / 终局那一拍写 ⇒
+ * running 期读到的是上一次停驻时的量,滞后**一整片**(钉:`test/resource-suspend.test.ts` 的 🚧 格)。⇒ 本投影是**分诊/预警**读面,**不是**任何门/CAS/resume 判定的输入。
  *
  * 【登记册的语义边界(与 `turn-activity.ts` 的 `msSinceLastActivity` 逐字同族)】
  *  · **同副本 best-effort**:只活在本进程。跨副本 poll(run 跑在别的副本)或本副本重启后 ⇒ 读不到 ⇒
@@ -34,7 +35,7 @@
  * 【已声明的代价:每次 poll 一次全量账本读(codex 交叉复审 R2-[medium],如实登记、本批不修)】
  * {@link buildCrossSliceUsage} 要对**全部** `model_usage` 行求和 ⇒ 调用点(`routes/runs.ts` 的 poll)在
  * 窗已登记时每拍读一次 `getEvents(taskId, 0)`,工作量随「轮询次数 × 已积累事件数」增长。三条限幅是**结构性**
- * 的,不是「应该很少见」:① **只有登记过窗的 run 才读**(没开三旋钮的部署、以及 verify/cascade 腿,一次都不读);
+ * 的,不是「应该很少见」:① **只有登记过窗的 run 才读**(没开三旋钮的部署、以及 cascade 腿,一次都不读);
  * ② 只在 `running` 且非 stale 时读;③ 同一条路上早已存在同形读(终局 + 配了 infra 价目表时的 `needCost` 臂,
  * 同样是 `getEvents(taskId, 0)`)—— 本批加的是**跑动期**这一档,不是新病种。
  * 🔴 真正的收口在**存储面**(不在本模块):给 run store 加一条「累计用量 + resource_limit park 计数」的

package/dist/run-local.d.ts

@@ -196,6 +196,12 @@ export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, s
  * or whose approval no person could answer, see {@link unfinishedStopOf} — / a fatal error, 2 = bad usage / unmet env). Pure of
  * `process.exit` so a test can assert the code; `main()` applies it.
  */
+/**
+ * 本入口拒 `CONFIG_PROVIDER=remote` 的那一句(配置源的词要么兑现、要么拒)。本入口只装本地配置源:中心拉取的那一套 —— 凭据续签、托管模型钥解封、
+ * 名册门、LKG —— 只在 HTTP 服务里装配。修前它在 remote 的词下照读本地 `config.d`(判官对「没递中心」回落 local),零句。
+ * 配没配中心地址都是这一句:出路(不设词 / 写 `local` / 改跑 HTTP 服务)在本入口照做都兑现得了。
+ */
+export declare const RUN_LOCAL_CONFIG_SOURCE_REFUSAL: string;
 export declare function runLocal(argv: string[], deps?: RunLocalDeps): Promise<number>;
 /** {@link installRunLocalExitBoundary} 的把手(同进程内反复装配的调用方=测试必须用它收尾)。 */
 export interface RunLocalExitBoundary {

package/dist/run-local.js

@@ -19,19 +19,19 @@ import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
-import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
-import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
+import { configLocalRoot, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
-import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
+import { composeExecutionLane, settleHostLaneShell, warnReadDenyFloorUnkept } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
-import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
+import { buildLaneHomeClaim, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
@@ -42,12 +42,13 @@ import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryLayersNamedBy, memorySpecForRequest } from "./memory-scope.js";
+import { createMemoryScopeStores } from "./memory-scope-stores.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
-import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
+import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createPeerDesk } from "./peer-seat.js";
@@ -62,7 +63,6 @@ import { installProcessExitBoundary } from "./boot/exit-boundary.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { createHostLspManager } from "./host-lsp-manager.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { installOutboundDispatcher } from "./outbound-dispatcher.js";
 import { provisionSemaConfigDir } from "./sema-config-dir.js";
 import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "./server-secret-env.js";
@@ -315,6 +315,9 @@ function buildUnfinishedStopFooter(stop, sessionId) {
         }
     }
 }
+export const RUN_LOCAL_CONFIG_SOURCE_REFUSAL = "CONFIG_PROVIDER=remote: run-local reads its configuration from the local config directory only — it does not pull a web-admin center " +
+    "(center credential renewal, sealed model keys and the roster gate are assembled by the HTTP service). Unset CONFIG_PROVIDER or set " +
+    "CONFIG_PROVIDER=local for this command, or run the HTTP service to use the center.";
 export async function runLocal(argv, deps = {}) {
     const print = deps.print ?? ((l) => console.log(l));
     const printErr = deps.printErr ?? ((l) => console.error(l));
@@ -329,7 +332,12 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    if (!process.env.CONFIG_PROVIDER)
+    const configWord = parseConfigProvider();
+    if (configWord === "remote") {
+        printErr(RUN_LOCAL_CONFIG_SOURCE_REFUSAL);
+        return 2;
+    }
+    if (configWord === undefined)
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
@@ -346,20 +354,17 @@ export async function runLocal(argv, deps = {}) {
     logConfigDiagnostics(logger);
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
-    const providerInput = { provider: config.configProvider ?? "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
-    const configSource = configProviderKind(providerInput);
-    if (configSource === "local") {
-        try {
-            await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
-        }
-        catch (err) {
-            printErr(err instanceof Error ? err.message : String(err));
-            return 2;
-        }
-        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
+    const providerInput = { provider: "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
+    try {
+        await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
     }
+    catch (err) {
+        printErr(err instanceof Error ? err.message : String(err));
+        return 2;
+    }
+    logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     try {
-        await composeExecutionLane(config, { configSource, localRoot: root, logger, drivesFromFile: ["host"] });
+        await composeExecutionLane(config, { configSource: "local", localRoot: root, logger, drivesFromFile: ["host"] });
     }
     catch (err) {
         printErr(err instanceof Error ? err.message : String(err));
@@ -468,17 +473,22 @@ export async function runLocal(argv, deps = {}) {
     const hostRx = config.remoteExec?.provider === "host" ? config.remoteExec : undefined;
     const workspaceDir = args.workspace ?? hostRx?.workspaceBase ?? process.cwd();
     await settleHostLaneShell(config, logger);
+    warnReadDenyFloorUnkept(config, logger);
+    const homeDirSeat = buildLaneHomeClaim(config);
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
-            ...((h) => (h === undefined ? {} : { homeDir: h }))(executionLaneHomeDir(config)),
+            ...homeDirSeat,
             backgroundShell: config.requirePrincipal !== true,
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
     const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager(config, (event, fields) => logger.info(event, fields)) : undefined;
-    const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     const engineDataRoot = fileMemoryEngineRoot(config, root);
+    const fileEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
+    const memoryEngine = fileEngine !== undefined
+        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy({ ...config, memoryScope: args.user ?? "local" }), onIncident: memoryEngineIncident })
+        : undefined;
     try {
         judgeConsolidationValve({ config, memoryEngine });
     }
@@ -490,17 +500,7 @@ export async function runLocal(argv, deps = {}) {
     }
     let memorySync;
     if (config.memorySync && memoryEngine) {
-        memorySync = createMemorySyncRunner({
-            backend: memoryEngine.backend,
-            scope: config.memorySync.scope,
-            memoryRoot: memoryEngine.root,
-            transport: createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token }),
-            log: logger,
-            ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
-            ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
-        });
-        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPathFor(config.memorySync.scope) });
-        memorySync.trigger("boot");
+        memorySync = startMemorySyncRunner({ sync: config.memorySync, stores: memoryEngine, log: logger });
     }
     else if (config.memorySync) {
         logger.warn("memory_sync_configured_but_memory_dark", { note: "MEMORY_SYNC_URL is set but the file memory engine is dark (MEMORY_ENGINE=off / remote exec lane) — no sync rounds will run" });
@@ -564,7 +564,6 @@ export async function runLocal(argv, deps = {}) {
     }
     assertRetentionLaneWirable({
         intervalSec: config.retentionSweep.intervalSec,
-        policy: config.retentionPolicy,
         executor: undefined,
         stores: [
             { name: "sessionStore", store: sessionStore },
@@ -683,7 +682,7 @@ export async function runLocal(argv, deps = {}) {
         }
     }
     const projectKey = memoryEngine
-        ? await createMemoryProjectLayers({ backend: memoryEngine.backend, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
+        ? await createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
         : undefined;
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false);