@sema-agent/server 7.139.0 → 7.140.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/MIGRATION.md +181 -0
- package/USAGE.md +19 -13
- package/dist/adoption/runner.js +1 -1
- package/dist/adoption/sql.js +1 -1
- package/dist/approval-card.d.ts +6 -6
- package/dist/bench/s1/live-deps.js +3 -2
- package/dist/bench/s1/row.d.ts +5 -2
- package/dist/bench/s1/row.js +2 -22
- package/dist/boot/adoption.js +1 -1
- package/dist/boot/execution-env.js +12 -10
- package/dist/boot/execution-lane.d.ts +8 -0
- package/dist/boot/execution-lane.js +6 -1
- package/dist/boot/memory-boundary.d.ts +14 -51
- package/dist/boot/memory-boundary.js +10 -20
- package/dist/boot/memory-consolidation.d.ts +15 -11
- package/dist/boot/memory-consolidation.js +23 -12
- package/dist/boot/resolve-spec.d.ts +3 -5
- package/dist/boot/resolve-spec.js +2 -4
- package/dist/boot/runner-deps.d.ts +3 -3
- package/dist/boot/runner-deps.js +1 -0
- package/dist/boot/stage-03-store-backend.d.ts +2 -6
- package/dist/boot/stage-03-store-backend.js +2 -3
- package/dist/boot/stage-04-stores.d.ts +2 -6
- package/dist/boot/stage-04-stores.js +5 -5
- package/dist/boot/stage-05-execution-env.d.ts +2 -6
- package/dist/boot/stage-06-runners.d.ts +2 -6
- package/dist/boot/stage-06-runners.js +2 -2
- package/dist/boot/stage-07-capability-layer.d.ts +2 -6
- package/dist/boot/stage-08-reapers.d.ts +2 -6
- package/dist/boot/stage-09-leader.d.ts +2 -6
- package/dist/boot/stage-10-http-server.d.ts +2 -6
- package/dist/boot/stage-10-http-server.js +5 -4
- package/dist/boot/stores.d.ts +3 -6
- package/dist/boot/stores.js +27 -40
- package/dist/boot/task-list-lane.d.ts +1 -1
- package/dist/boot/task-list-lane.js +1 -1
- package/dist/boot/web-admin.js +35 -9
- package/dist/capabilities/execution-lane.d.ts +2 -2
- package/dist/config-catalog.js +2 -1
- package/dist/config-provider.d.ts +14 -13
- package/dist/config-provider.js +24 -18
- package/dist/config-types.d.ts +11 -2
- package/dist/config.js +2 -1
- package/dist/delegated-session-owner.d.ts +2 -1
- package/dist/delegated-session-owner.js +1 -1
- package/dist/deployment-shape.d.ts +9 -8
- package/dist/deployment-shape.js +4 -4
- package/dist/execution-lane-caps.d.ts +97 -106
- package/dist/execution-lane-caps.js +67 -83
- package/dist/http/memory-compliance-failure-reply.d.ts +3 -1
- package/dist/http/memory-compliance-failure-reply.js +5 -0
- package/dist/http/memory-layer-reply.d.ts +30 -0
- package/dist/http/memory-layer-reply.js +24 -0
- package/dist/http/resume-legs.js +13 -16
- package/dist/http/retired-service-deps.d.ts +1 -1
- package/dist/http/retired-service-deps.js +1 -1
- package/dist/http/routes/adoption.js +1 -1
- package/dist/http/routes/memory-bundle.js +3 -0
- package/dist/http/routes/memory-compliance.js +8 -1
- package/dist/http/routes/memory-consolidation.js +12 -1
- package/dist/http/routes/memory-origin.js +14 -2
- package/dist/http/routes/memory-policy.js +5 -0
- package/dist/http/routes/sessions.js +28 -11
- package/dist/http/routes/tasks.js +4 -2
- package/dist/http/server.d.ts +5 -25
- package/dist/http/server.js +2 -2
- package/dist/identity-source.d.ts +1 -1
- package/dist/identity-source.js +1 -1
- package/dist/lane-home-probe.d.ts +68 -42
- package/dist/lane-home-probe.js +53 -30
- package/dist/leader/wire.js +5 -4
- package/dist/memory-bundle-engine.d.ts +16 -9
- package/dist/memory-bundle-engine.js +29 -6
- package/dist/memory-operator-faces.d.ts +85 -30
- package/dist/memory-operator-faces.js +136 -30
- package/dist/memory-project-layer.d.ts +3 -21
- package/dist/memory-project-layer.js +11 -8
- package/dist/memory-scope-stores.d.ts +73 -0
- package/dist/memory-scope-stores.js +86 -0
- package/dist/memory-scope.d.ts +29 -5
- package/dist/memory-scope.js +16 -4
- package/dist/memory-sync-client.d.ts +20 -7
- package/dist/memory-sync-client.js +31 -13
- package/dist/plugins/adoption-log-sql.js +4 -4
- package/dist/plugins/approval-ask-store-sql.js +14 -14
- package/dist/plugins/approval-nonce-store.js +4 -4
- package/dist/plugins/blob-backend.d.ts +4 -4
- package/dist/plugins/blob-backend.js +7 -7
- package/dist/plugins/breaker-state-sql.js +2 -2
- package/dist/plugins/checkpoint-index-columns.js +2 -2
- package/dist/plugins/checkpoint-store-sql.js +16 -16
- package/dist/plugins/device-store-sql.js +19 -19
- package/dist/plugins/ensure-index.d.ts +1 -2
- package/dist/plugins/execution-placement-sql.d.ts +8 -8
- package/dist/plugins/execution-placement-sql.js +8 -8
- package/dist/plugins/file-history-store-sql.d.ts +2 -2
- package/dist/plugins/file-history-store-sql.js +4 -4
- package/dist/plugins/image-bake-store-sql.js +9 -9
- package/dist/plugins/image-index-sql.js +11 -11
- package/dist/plugins/leader-run-store-sql.js +4 -4
- package/dist/plugins/mailbox-store-sql.d.ts +2 -1
- package/dist/plugins/mailbox-store-sql.js +4 -4
- package/dist/plugins/memory-engine-tidb.js +5 -5
- package/dist/plugins/memory-optout-grant-store-sql.js +1 -1
- package/dist/plugins/memory-sync-store-tidb.js +3 -3
- package/dist/plugins/one-time-migrations.d.ts +10 -9
- package/dist/plugins/one-time-migrations.js +36 -36
- package/dist/plugins/org-delivery-quota-store.js +2 -2
- package/dist/plugins/outcome-ledger-sql.js +2 -2
- package/dist/plugins/permission-rule-store-sql.d.ts +4 -4
- package/dist/plugins/permission-rule-store-sql.js +16 -16
- package/dist/plugins/remote-env-adb.d.ts +7 -24
- package/dist/plugins/remote-env-adb.js +22 -5
- package/dist/plugins/remote-env-device.d.ts +2 -28
- package/dist/plugins/remote-env-device.js +2 -1
- package/dist/plugins/remote-env-e2b.d.ts +18 -26
- package/dist/plugins/remote-env-e2b.js +51 -4
- package/dist/plugins/remote-env-file-error.d.ts +1 -1
- package/dist/plugins/remote-env-file-error.js +8 -2
- package/dist/plugins/remote-env-host.d.ts +19 -35
- package/dist/plugins/remote-env-host.js +26 -3
- package/dist/plugins/remote-env-k8s.d.ts +3 -14
- package/dist/plugins/remote-env-k8s.js +3 -2
- package/dist/plugins/remote-env-local-docker.d.ts +4 -15
- package/dist/plugins/remote-env-local-docker.js +5 -4
- package/dist/plugins/remote-env-ssh.d.ts +4 -24
- package/dist/plugins/remote-env-ssh.js +4 -3
- package/dist/plugins/resume-anchor-store-sql.js +2 -2
- package/dist/plugins/retention-lane-store-sql.d.ts +1 -1
- package/dist/plugins/retention-lane-store-sql.js +2 -2
- package/dist/plugins/retention-store-sql.d.ts +1 -1
- package/dist/plugins/retention-store-sql.js +6 -6
- package/dist/plugins/run-store-sql.js +15 -15
- package/dist/plugins/schema-consistency.d.ts +6 -6
- package/dist/plugins/schema-consistency.js +1 -1
- package/dist/plugins/schema-ensure-legs.d.ts +2 -3
- package/dist/plugins/schema-ensure-legs.js +2 -2
- package/dist/plugins/schema-live-columns.d.ts +1 -1
- package/dist/plugins/session-capture-record-store-sql.js +1 -1
- package/dist/plugins/session-rules-column.d.ts +1 -1
- package/dist/plugins/session-rules-column.js +1 -1
- package/dist/plugins/session-workspace-cell.d.ts +1 -1
- package/dist/plugins/session-workspace-cell.js +1 -1
- package/dist/plugins/shared-memory-store-sql.js +2 -2
- package/dist/plugins/sql-driver.d.ts +10 -5
- package/dist/plugins/sql-driver.js +6 -6
- package/dist/plugins/sql-errors.js +1 -1
- package/dist/plugins/store-backend.d.ts +4 -6
- package/dist/plugins/store-backend.js +6 -6
- package/dist/plugins/task-list-store-sql.js +11 -11
- package/dist/plugins/tidb-pool.js +5 -5
- package/dist/plugins/tidb-session-storage.js +4 -4
- package/dist/plugins/tidb-session-store.js +13 -13
- package/dist/plugins/tool-result-store-sql.d.ts +2 -2
- package/dist/plugins/tool-result-store-sql.js +3 -3
- package/dist/plugins/user-input-ledger-sql.js +2 -2
- package/dist/plugins/workflow-journal-store-sql.js +5 -5
- package/dist/plugins/workflow-run-store-sql.js +19 -19
- package/dist/plugins/write-behind-counter.d.ts +2 -3
- package/dist/plugins/write-behind-counter.js +5 -5
- package/dist/resource-suspend.d.ts +14 -12
- package/dist/resource-suspend.js +1 -1
- package/dist/resource-window.d.ts +4 -3
- package/dist/run-local.js +14 -19
- package/dist/runs.d.ts +8 -4
- package/dist/runs.js +49 -65
- package/dist/session-incarnation.d.ts +1 -1
- package/dist/session-incarnation.js +1 -1
- package/dist/session-policy-wire.d.ts +1 -1
- package/dist/sql-engine-posture.d.ts +1 -1
- package/dist/sql-engine-posture.js +1 -1
- package/dist/{plugins → stores-sql}/background-agent-store-sql.d.ts +2 -2
- package/dist/{plugins → stores-sql}/background-agent-store-sql.js +8 -8
- package/dist/{plugins → stores-sql}/session-policy-store-sql.d.ts +7 -5
- package/dist/{plugins → stores-sql}/session-policy-store-sql.js +12 -12
- package/dist/{plugins → stores-sql}/usage-window-store-sql.d.ts +1 -1
- package/dist/{plugins → stores-sql}/usage-window-store-sql.js +3 -3
- package/dist/task-a2a.js +5 -6
- package/dist/task-mcp.d.ts +20 -7
- package/dist/task-mcp.js +17 -9
- package/dist/terminal.d.ts +27 -0
- package/dist/terminal.js +6 -0
- package/dist/trace/redact.d.ts +3 -1
- package/dist/trace/redact.js +80 -28
- package/dist/trace/self-minted-wire.d.ts +58 -0
- package/dist/trace/self-minted-wire.js +16 -0
- package/dist/web-admin-client/candidate-gate.d.ts +11 -7
- package/dist/web-admin-client/candidate-gate.js +1 -1
- package/dist/web-admin-client/http-client.d.ts +5 -4
- package/dist/web-admin-client/http-client.js +2 -2
- package/dist/web-admin-client/read-warnings.d.ts +7 -17
- package/dist/web-admin-client/read-warnings.js +5 -9
- package/package.json +2 -2
- package/wire-changes/server@7.140.0.json +184 -0
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { loadRemoteExec } from "@sema-agent/settings-schema/node";
|
|
2
2
|
import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
|
|
3
3
|
import { crossInvariant } from "../config-invariants.js";
|
|
4
|
-
import { executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
|
|
4
|
+
import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
|
|
5
5
|
import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
|
|
6
6
|
import { settleHostShellAtBoot } from "../plugins/host-platform.js";
|
|
7
7
|
export const FILE_SOURCED_LANES = ["host", "local-docker"];
|
|
@@ -23,6 +23,11 @@ export async function settleHostLaneShell(config, logger) {
|
|
|
23
23
|
return;
|
|
24
24
|
await settleHostShellAtBoot(logger);
|
|
25
25
|
}
|
|
26
|
+
export function warnReadDenyFloorUnkept(config, logger) {
|
|
27
|
+
const note = buildReadDenyFloorUnkeptNote(config);
|
|
28
|
+
if (note !== undefined)
|
|
29
|
+
logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec?.provider, note });
|
|
30
|
+
}
|
|
26
31
|
export function assertExecutionLaneInvariants(config) {
|
|
27
32
|
const judge = (id) => crossInvariant(id).check({ live: config, next: config });
|
|
28
33
|
const leader = judge("leader-host-lane");
|
|
@@ -56,35 +56,6 @@
|
|
|
56
56
|
*/
|
|
57
57
|
import { type ExecutionLane, type RemoteExecProvider } from "../execution-lane-caps.js";
|
|
58
58
|
import type { MemoryEngineBackend } from "@sema-agent/settings-schema/execution-lanes";
|
|
59
|
-
/**
|
|
60
|
-
* [ref] A3 源头修(黑板 [ref]/[ref]/[ref],[ref])—— `memoryPersistenceCapable` 的**装配层有效值**:
|
|
61
|
-
* operator 显式 env 恒赢;env 缺席时,`REMOTE_EXEC=host` 腿自动补 `true`;其余一律缺席(现行为)。
|
|
62
|
-
*
|
|
63
|
-
* ## 为什么 host 腿可以自动声明(而且只有 host 腿)
|
|
64
|
-
* core r13/r14 的 withhold 判据是「执行环境暴露 remote 面」——它对 host 腿是**误伤**:host 腿的文件
|
|
65
|
-
* 工具就跑在**这台机器**的 fs 上(`hostSemanticsLane`,与 core 的 remote 判决是两根轴,见下方 facts 注),
|
|
66
|
-
* 记忆根也在这台机器上,「执行车道与记忆根共享文件平面」这个 capable=true 所断言的**车道级事实**由
|
|
67
|
-
* 构造成立。剩下的围栏维(记忆根是否落在该次任务的 fs 授权边界内)在 in-process 上**同样存在**而 core
|
|
68
|
-
* 并不 withhold——它由本模块的 ② 号 warn、fs 门的 `path_not_in_root` 拒绝、以及 core 准入席自动放行写家
|
|
69
|
-
* ([ref])这套既有处置管,不归 withhold 判据管。所以 host 腿自动 true 与 in-process 的默认行为**同等诚实**。
|
|
70
|
-
* 沙箱腿(e2b/k8s/ssh/local-docker)文件平面在沙箱盘,withhold 是对的,恒不自动。
|
|
71
|
-
*
|
|
72
|
-
* ## 为什么不是「围栏覆盖记忆根」的更严合取
|
|
73
|
-
* boot 期对 host 腿**算不出**围栏根(host factory 每任务另铸 `sema-host-*` 子目录、per-session cwd 可整个
|
|
74
|
-
* 换掉 workspaceBase——见 boot/stores.ts 的 codex 已核注释),那个合取在恰恰需要它的腿上永不可满足;
|
|
75
|
-
* 而且它断言的是 per-task 事实,不是本键的车道级语义。
|
|
76
|
-
*
|
|
77
|
-
* ## 位置与纪律
|
|
78
|
-
* 单源:resolve-spec 的 spec 直通(引擎据它判「本会话没有持久记忆」的披露与四只记忆面臂)、boot 审计的 declared 位
|
|
79
|
-
* 两处都必须读本函数,禁各自重算(operator-knob 律:显式 env 的优先权在这一个函数里执法一次)。
|
|
80
|
-
* 自动补位在 boot 日志上必须可见(stores.ts 的 info 行),部署方随时可用显式 env 覆盖。
|
|
81
|
-
*/
|
|
82
|
-
export declare function effectiveMemoryPersistenceCapable(config: {
|
|
83
|
-
remoteExec?: {
|
|
84
|
-
provider?: string;
|
|
85
|
-
};
|
|
86
|
-
memoryPersistenceCapable?: boolean;
|
|
87
|
-
}): boolean | undefined;
|
|
88
59
|
/** boot 期可知的全部事实。每一位都必须由调用点从真配置/真装配结果取,禁在本模块内重算(重算=第二真源)。 */
|
|
89
60
|
export interface MemoryWriteBoundaryFacts {
|
|
90
61
|
/** 引擎的**挂载平面**根 —— 引擎真正读写条目的那棵树,由 `memoryMountRootOf(backend, root)` 单铸点取
|
|
@@ -97,16 +68,9 @@ export interface MemoryWriteBoundaryFacts {
|
|
|
97
68
|
memoryRoot: string | undefined;
|
|
98
69
|
/** 执行车道名,只进文案(归一读口 `executionLaneOf` 的答案;[ref] 起不在调用点手写 `?? "in-process"`)。 */
|
|
99
70
|
lane: ExecutionLane;
|
|
100
|
-
/**
|
|
101
|
-
*
|
|
102
|
-
* [medium] 就是把它们当成一根轴的后果):`host` 车道的文件平面就是本机(这一位 true),但 core 眼里它
|
|
103
|
-
* 仍是 remote(那一位也 true)。 */
|
|
71
|
+
/** 该车道的路径是不是本机的文件(执行环境块 `hostLocalPaths`:in-process 的桩块 / `REMOTE_EXEC=host` 为真)。false = 沙箱 / 远端 / 设备盘,
|
|
72
|
+
* 与记忆根分平面 —— 引擎在这一形上不教 `# Memory` 写指令(除非部署声明 `memoryPersistenceCapable: true`),判的是同一键。 */
|
|
104
73
|
hostSemanticsLane: boolean;
|
|
105
|
-
/** core 的 `isRemoteExecutionEnv` 对本部署执行环境的判决 —— 判别位 = `REMOTE_EXEC` 有没有设(**含
|
|
106
|
-
* `host`**:core 的判别是鸭子类型,`remote-env-host.ts` 把那几件全实现了,亲验坐实)。
|
|
107
|
-
* 5.26.0 的 r13/r14 收窄按的是**这一位**,不是文件平面:凡 core 判 remote,`# Memory` 写指令一律撤,
|
|
108
|
-
* 除非声明 `memoryPersistenceCapable: true`。 */
|
|
109
|
-
coreRemoteExecutionEnv: boolean;
|
|
110
74
|
/** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。两极都让本模块闭嘴,但理由不同 —— 见各臂注释。 */
|
|
111
75
|
declaredCapable: boolean | undefined;
|
|
112
76
|
/** 本部署的记忆引擎后端(`config.memoryEngineBackend`)。**只进文案**,不参与任何判决 —— 它在这里的
|
|
@@ -119,31 +83,30 @@ export interface MemoryWriteBoundaryFacts {
|
|
|
119
83
|
containmentRoots: readonly string[];
|
|
120
84
|
}
|
|
121
85
|
/**
|
|
122
|
-
*
|
|
123
|
-
*
|
|
124
|
-
*
|
|
125
|
-
* · `
|
|
126
|
-
*
|
|
127
|
-
* 读数逐车道不变(对账:`test/execution-lane-caps.test.ts` 的真装配点联合覆盖格)。`processCwd` 由调用点传
|
|
128
|
-
* (stores 传 `process.cwd()`),本函数保持纯。
|
|
86
|
+
* 审计的**车道三位**由本函数派生(boot/stores.ts 的装配点只调它,不就地手写):
|
|
87
|
+
* · `lane` ⇐ 归一读口 `executionLaneOf`;
|
|
88
|
+
* · `hostSemanticsLane` ⇐ 执行环境块 `hostLocalPaths`(唯一作者 `capabilitiesFor`;引擎撤不撤写指令读的是同一键);
|
|
89
|
+
* · `containmentRoots` ⇐ 只有 in-process 给得出(见下)。
|
|
90
|
+
* `processCwd` 由调用点传(stores 传 `process.cwd()`),本函数保持纯。
|
|
129
91
|
*/
|
|
130
92
|
export declare function buildMemoryBoundaryLaneFacts(config: {
|
|
131
93
|
readonly remoteExec?: {
|
|
132
94
|
readonly provider: RemoteExecProvider;
|
|
95
|
+
readonly s3Snapshot?: unknown;
|
|
133
96
|
} | undefined;
|
|
134
|
-
}, processCwd: string): Pick<MemoryWriteBoundaryFacts, "lane" | "hostSemanticsLane" | "
|
|
97
|
+
}, processCwd: string): Pick<MemoryWriteBoundaryFacts, "lane" | "hostSemanticsLane" | "containmentRoots">;
|
|
135
98
|
/** 一条启动告警:`tag` 进日志事件名(可被运维按名过滤/告警),`detail` 是给人读的整句(含恢复路径)。 */
|
|
136
99
|
export interface MemoryWriteBoundaryWarning {
|
|
137
100
|
tag: "memory_root_outside_write_boundary" | "memory_remote_lane_write_instruction_dropped";
|
|
138
101
|
detail: string;
|
|
139
102
|
}
|
|
140
103
|
/**
|
|
141
|
-
* 判两件事,互斥(
|
|
104
|
+
* 判两件事,互斥(路径不是本机的车道上不叠围栏话 —— 围栏根本不在这台机器上,说了是噪音):
|
|
142
105
|
*
|
|
143
|
-
* ①
|
|
144
|
-
*
|
|
145
|
-
*
|
|
146
|
-
* ②
|
|
106
|
+
* ① **路径不是本机的车道**(块 `hostLocalPaths` 为假:沙箱 / 远端 / 设备;记忆引擎在这里只可能因为 `MEMORY_ENGINE_REMOTE_LANE=allow`
|
|
107
|
+
* 或 DB 记忆面才在):引擎不教 `# Memory` 写指令(手带够不着本机的记忆根),官方恢复路径是声明 `memoryPersistenceCapable: true`。
|
|
108
|
+
* 未声明 ⇒ 点名 warn,把恢复旋钮写进句子里。
|
|
109
|
+
* ② **路径是本机的车道**(in-process / host):记忆根不在任何一个已知围栏根内 ⇒ 模型被教着往一个 fs 工具够不到的路径写。
|
|
147
110
|
*
|
|
148
111
|
* 两极声明都让本模块闭嘴,但理由不同,别合并:
|
|
149
112
|
* · `true` = operator 自证有推断看不见的持久通道(共享挂载 / 自定义 writer),我们的结构判断本就不该
|
|
@@ -1,17 +1,10 @@
|
|
|
1
1
|
import { resolve } from "node:path";
|
|
2
|
-
import {
|
|
3
|
-
export function effectiveMemoryPersistenceCapable(config) {
|
|
4
|
-
if (config.memoryPersistenceCapable !== undefined)
|
|
5
|
-
return config.memoryPersistenceCapable;
|
|
6
|
-
return config.remoteExec?.provider === "host" ? true : undefined;
|
|
7
|
-
}
|
|
2
|
+
import { capabilitiesFor, executionLaneOf } from "../execution-lane-caps.js";
|
|
8
3
|
export function buildMemoryBoundaryLaneFacts(config, processCwd) {
|
|
9
4
|
const lane = executionLaneOf(config.remoteExec?.provider);
|
|
10
|
-
const caps = executionLaneCaps(lane);
|
|
11
5
|
return {
|
|
12
6
|
lane,
|
|
13
|
-
hostSemanticsLane:
|
|
14
|
-
coreRemoteExecutionEnv: laneWiresExecutionEnv(lane),
|
|
7
|
+
hostSemanticsLane: capabilitiesFor(config).hostLocalPaths,
|
|
15
8
|
containmentRoots: lane === "in-process" ? [processCwd] : [],
|
|
16
9
|
};
|
|
17
10
|
}
|
|
@@ -21,25 +14,22 @@ function isInside(child, root) {
|
|
|
21
14
|
return c === r || c.startsWith(r === "/" ? "/" : `${r}/`);
|
|
22
15
|
}
|
|
23
16
|
export function buildMemoryWriteBoundaryAudit(facts) {
|
|
24
|
-
const { memoryRoot, lane, hostSemanticsLane,
|
|
17
|
+
const { memoryRoot, lane, hostSemanticsLane, declaredCapable, containmentRoots, engineBackend } = facts;
|
|
25
18
|
if (memoryRoot === undefined)
|
|
26
19
|
return { warnings: [] };
|
|
27
20
|
if (declaredCapable !== undefined)
|
|
28
21
|
return { warnings: [] };
|
|
29
|
-
if (
|
|
30
|
-
const plane = hostSemanticsLane
|
|
31
|
-
? `the model's file tools DO run on this worker's filesystem, but core classifies this execution environment as ` +
|
|
32
|
-
`remote (it exposes the remote-env surface), so the instruction is withheld anyway`
|
|
33
|
-
: `the model's file tools write the SANDBOX filesystem while the memory root (${memoryRoot}) lives on this worker`;
|
|
22
|
+
if (!hostSemanticsLane) {
|
|
34
23
|
return {
|
|
35
24
|
warnings: [
|
|
36
25
|
{
|
|
37
26
|
tag: "memory_remote_lane_write_instruction_dropped",
|
|
38
|
-
detail: `the memory engine is wired over the "${lane}" execution lane and
|
|
39
|
-
`
|
|
40
|
-
`
|
|
41
|
-
`the
|
|
42
|
-
`MEMORY_PERSISTENCE_CAPABLE=
|
|
27
|
+
detail: `the memory engine is wired over the "${lane}" execution lane and the model's file tools write the SANDBOX filesystem ` +
|
|
28
|
+
`while the memory root (${memoryRoot}) lives on this worker. The engine withholds the "# Memory" WRITE instruction when ` +
|
|
29
|
+
`the execution environment's paths are not this worker's files, so this deployment reads memory but does not teach ` +
|
|
30
|
+
`the model how to save into it. If this lane genuinely reaches the memory root, declare it: ` +
|
|
31
|
+
`MEMORY_PERSISTENCE_CAPABLE=true restores the write instruction. If it does not, MEMORY_PERSISTENCE_CAPABLE=false ` +
|
|
32
|
+
`makes the read-only state explicit to the model instead of leaving it silent.`,
|
|
43
33
|
},
|
|
44
34
|
],
|
|
45
35
|
};
|
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
import { type LaneHomeDeployment } from "../execution-lane-caps.js";
|
|
2
|
+
import { type MemoryScopeStores } from "../memory-scope-stores.js";
|
|
3
|
+
import type { SessionCaptureRecordSource } from "../plugins/store-backend.js";
|
|
2
4
|
import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
|
|
3
5
|
import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
|
|
4
|
-
import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type
|
|
6
|
+
import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryConsolidationDriverDeps, type PermissionRuleStoreProvider } from "@sema-agent/core";
|
|
5
7
|
/**
|
|
6
8
|
* 座解析的 options 形 = core 解析器交回的那只(core 7.50.0 起它**不含** `writeJudge`:判官不是模型席的一部分,由调用方在动词上带)。
|
|
7
9
|
* 取解析器的返回型而不是自己写 `Omit<…>`:形的属主是 core 的解析器,本仓不持第二份。
|
|
@@ -462,14 +464,19 @@ export interface MemoryConsolidationFaces {
|
|
|
462
464
|
lastRun(scope: string): ConsolidationDriverRunRow | undefined;
|
|
463
465
|
}
|
|
464
466
|
/**
|
|
465
|
-
*
|
|
467
|
+
* 在**记忆作用域店**上建 consolidation 操作面。命名照 CLAUDE.md 工厂律:返回带行为的活对象 ⇒ `create*`。
|
|
468
|
+
*
|
|
469
|
+
* ## 引擎建在哪只店上:被整理的那一层住的那只
|
|
470
|
+
* 整理一层 = 读这一层的库、把产物写回这一层 —— 店只问记忆作用域店(`memoryStoreForRequest(stores, [scope])`;读不出的层键 ⇒ `request.memory_layer`)。
|
|
471
|
+
* 一只店一只引擎,`lastRun` 读那只引擎的控制面(run 账住在被整理的那只店的控制面里)。修前恒在部署的店上建:目录钉住的部署上,
|
|
472
|
+
* 类型化个人层(`user:` / `userproj:` / `org:`)的库在个人挂载上的另一只店里,整理读到的是空库、产物落在会话不读的店。
|
|
466
473
|
*
|
|
467
474
|
* ## 为什么这里现构一只引擎(与 `createMemoryComplianceFaces` / `createMemoryBundleFaces` 同一条理由)
|
|
468
475
|
*
|
|
469
476
|
* 本仓**没有**一个长命的 `MemoryEngine` 实例:`boot/stores.ts` 装配出来的 `memoryEngine` 是
|
|
470
|
-
*
|
|
471
|
-
*
|
|
472
|
-
*
|
|
477
|
+
* 记忆作用域店,真引擎由 core 的 Runner **每任务现构**。HTTP 面要一个引擎就得自己构。
|
|
478
|
+
* 两只引擎不会各说各话:控制面由店写死(`backend.controlPlaneRoot`),gate / run 账 / plan 归档
|
|
479
|
+
* 全住在那里,所以操作面引擎与每任务引擎在同一只店上看的是**同一本**账。
|
|
473
480
|
*
|
|
474
481
|
* ## `consolidation: {}` = 出厂缺省,**显式在场**
|
|
475
482
|
*
|
|
@@ -481,10 +488,7 @@ export interface MemoryConsolidationFaces {
|
|
|
481
488
|
* `multiNode` 也**刻意不声明**:声明它就必须注入一只全局租约,而本仓今天没有(见顶注「v1 没有周期腿」
|
|
482
489
|
* 那一段的同一条理由)——不声明 = 单机 plan-seat CAS 是唯一互斥,core 的契约原话如此,不是偷偷降级。
|
|
483
490
|
*/
|
|
484
|
-
export declare function createMemoryConsolidationFaces(
|
|
485
|
-
backend: MemoryBackend;
|
|
486
|
-
root: string;
|
|
487
|
-
}, input: {
|
|
491
|
+
export declare function createMemoryConsolidationFaces(stores: MemoryScopeStores, input: {
|
|
488
492
|
seat: ConsolidationDriverSeat;
|
|
489
493
|
scopes: readonly string[];
|
|
490
494
|
/** 部署的 provenance 姿态,原样交给引擎(缺席 ⇒ core 缺省 `carry`)。 */
|
|
@@ -496,13 +500,13 @@ export declare function createMemoryConsolidationFaces(store: {
|
|
|
496
500
|
/** 停因自由文本的**运维日志**座(缺席 = 没人听,不影响任何行为)。载荷由 {@link buildStopDetailAudit}
|
|
497
501
|
* 铸,调用点在单飞回调**之内** ⇒ 一轮真 run 一行,并入的等待者不各落一行。 */
|
|
498
502
|
onStopDetail?: (audit: ReturnType<typeof buildStopDetailAudit>) => void;
|
|
499
|
-
/** [ref]②(383 §2.1b):capture opt-out
|
|
503
|
+
/** [ref]②(383 §2.1b):capture opt-out 记录的按平面取用源(main.ts 取一次,与 Runner 同源;每只引擎按它那只店的控制面取)。
|
|
500
504
|
* 🔴 这只引擎是四只 operator 面里**真读名册**的那只:`consolidationEligibility` 第四臂
|
|
501
505
|
* (engine.js `listCaptureOptOutSessions`)拿它筛掉 opt-out 会话的贡献条目 —— SQL 部署上漏喂
|
|
502
506
|
* = 驱动器读文件空名册 ⇒ 蒸馏器放大用户明说不要记的内容(S-5 真实失效形;全站同批注入律,
|
|
503
507
|
* 机器钉 capture-optout-lane ②)。[ref] 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
|
|
504
508
|
* 缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
|
|
505
|
-
|
|
509
|
+
captureRecords?: SessionCaptureRecordSource;
|
|
506
510
|
/** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:
|
|
507
511
|
* 早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
|
|
508
512
|
writeJudge: ConsolidationWriteJudge;
|
|
@@ -4,7 +4,8 @@ import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
|
|
|
4
4
|
import { memoryMountRootOf } from "../memory-scope.js";
|
|
5
5
|
import { executionLaneHomeDir } from "../execution-lane-caps.js";
|
|
6
6
|
import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
|
|
7
|
-
import { backendOwnsControlPlane } from "../memory-operator-faces.js";
|
|
7
|
+
import { backendOwnsControlPlane, captureRecordStoreOf } from "../memory-operator-faces.js";
|
|
8
|
+
import { memoryStoreForRequest } from "../memory-scope-stores.js";
|
|
8
9
|
import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
|
|
9
10
|
export function resolveConsolidationDriverSeat(deps) {
|
|
10
11
|
let options;
|
|
@@ -333,22 +334,32 @@ export function createOperatorValveWriteJudge(facts) {
|
|
|
333
334
|
return judge(target);
|
|
334
335
|
};
|
|
335
336
|
}
|
|
336
|
-
export function createMemoryConsolidationFaces(
|
|
337
|
-
const
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
337
|
+
export function createMemoryConsolidationFaces(stores, input) {
|
|
338
|
+
const engines = new Map();
|
|
339
|
+
const engineOf = (scope) => {
|
|
340
|
+
const store = memoryStoreForRequest(stores, [scope]);
|
|
341
|
+
const known = engines.get(store);
|
|
342
|
+
if (known !== undefined)
|
|
343
|
+
return known;
|
|
344
|
+
const records = captureRecordStoreOf(input.captureRecords, store);
|
|
345
|
+
const engine = new MemoryEngine({
|
|
346
|
+
backend: store,
|
|
347
|
+
memoryDir: memoryMountRootOf(store, stores.root),
|
|
348
|
+
consolidation: {},
|
|
349
|
+
...(input.provenance !== undefined ? { provenance: input.provenance } : {}),
|
|
350
|
+
...(input.onIncident !== undefined ? { onIncident: input.onIncident } : {}),
|
|
351
|
+
...(records !== undefined ? { captureRecordStore: records } : {}),
|
|
352
|
+
});
|
|
353
|
+
engines.set(store, engine);
|
|
354
|
+
return engine;
|
|
355
|
+
};
|
|
345
356
|
const flight = createPerScopeSingleFlight();
|
|
346
357
|
return {
|
|
347
358
|
seat: input.seat.seat,
|
|
348
359
|
model: input.seat.model,
|
|
349
360
|
scopes: input.scopes,
|
|
350
361
|
run: (scope) => flight(scope, async () => {
|
|
351
|
-
const receipt = await runMemoryConsolidationDriver(
|
|
362
|
+
const receipt = await runMemoryConsolidationDriver(engineOf(scope), scope, {
|
|
352
363
|
...input.seat.options,
|
|
353
364
|
writeJudge: input.writeJudge,
|
|
354
365
|
...(input.onNotice !== undefined ? { onNotice: input.onNotice } : {}),
|
|
@@ -361,7 +372,7 @@ export function createMemoryConsolidationFaces(store, input) {
|
|
|
361
372
|
}
|
|
362
373
|
return receipt;
|
|
363
374
|
}),
|
|
364
|
-
lastRun: (scope) => readConsolidationDriverRun(
|
|
375
|
+
lastRun: (scope) => readConsolidationDriverRun(engineOf(scope).controlPlaneRoot, scope),
|
|
365
376
|
};
|
|
366
377
|
}
|
|
367
378
|
//# sourceMappingURL=memory-consolidation.js.map
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import { type MemoryBackend } from "@sema-agent/core";
|
|
2
1
|
import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
|
|
3
2
|
import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
|
|
4
3
|
import { selectScenario } from "../capabilities/scenarios.js";
|
|
@@ -17,6 +16,7 @@ import type { StoreBackend } from "../plugins/store-backend.js";
|
|
|
17
16
|
import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
|
|
18
17
|
import type { createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
|
|
19
18
|
import { type OwnerAwareSessionStore } from "../security.js";
|
|
19
|
+
import type { MemoryScopeStores } from "../memory-scope-stores.js";
|
|
20
20
|
import type { MemorySyncRunner } from "../memory-sync-client.js";
|
|
21
21
|
import type { PeerDesk } from "../peer-seat.js";
|
|
22
22
|
import type { RunnerDepsOnAsk } from "./runner-deps.js";
|
|
@@ -55,10 +55,8 @@ export interface ResolveSpecCtx {
|
|
|
55
55
|
taskTimeoutSec: number;
|
|
56
56
|
selectEnvTool: ReturnType<typeof selectEnvironmentTool> | undefined;
|
|
57
57
|
sendUserFileToolSpec: ReturnType<typeof sendUserFileTool> | undefined;
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
root: string;
|
|
61
|
-
} | undefined;
|
|
58
|
+
/** 记忆引擎对象 = 记忆作用域店(`memory-scope-stores.ts`;项目层准备一步按层问它的店)。 */
|
|
59
|
+
memoryEngine: MemoryScopeStores | undefined;
|
|
62
60
|
/** [ref]:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
|
|
63
61
|
memorySyncRunner: MemorySyncRunner | undefined;
|
|
64
62
|
durableEnabled: boolean;
|
|
@@ -51,7 +51,6 @@ import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagen
|
|
|
51
51
|
import { redactSecrets } from "../trace/redact.js";
|
|
52
52
|
import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
|
|
53
53
|
import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
|
|
54
|
-
import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
|
|
55
54
|
import { withUnattendedLeg } from "../unattended-permission-mode.js";
|
|
56
55
|
import { fieldConflictFacts } from "../field-conflict.js";
|
|
57
56
|
function unrooted(spec) {
|
|
@@ -75,7 +74,7 @@ export function createResolveSpec(ctx) {
|
|
|
75
74
|
const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
|
|
76
75
|
return sessionCwd ?? (executionLaneOf(config.remoteExec?.provider) === "in-process" ? process.cwd() : undefined);
|
|
77
76
|
};
|
|
78
|
-
const memoryProjectLayers = createMemoryProjectLayers({
|
|
77
|
+
const memoryProjectLayers = createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySyncRunner, log: logger });
|
|
79
78
|
if (onlySensitiveBaseline)
|
|
80
79
|
logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
|
|
81
80
|
const approvalGrantNotice = buildApprovalGrantNotice(config);
|
|
@@ -493,7 +492,7 @@ export function createResolveSpec(ctx) {
|
|
|
493
492
|
memory: memoryEngine
|
|
494
493
|
? memorySpecForRequest(auth?.memoryScope, projectKey, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
|
|
495
494
|
: undefined,
|
|
496
|
-
...(
|
|
495
|
+
...(config.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: config.memoryPersistenceCapable } : {}),
|
|
497
496
|
tools: ((base) => {
|
|
498
497
|
const extra = [...(selectEnvTool ? [selectEnvTool] : []), ...(sendUserFileToolSpec ? [sendUserFileToolSpec] : [])];
|
|
499
498
|
const merged = extra.length > 0 ? [...(base ?? []), ...extra] : base;
|
|
@@ -524,7 +523,6 @@ export function createResolveSpec(ctx) {
|
|
|
524
523
|
...((rs) => (rs ? { resourceSuspend: rs } : {}))(resourceSuspendOptIn({
|
|
525
524
|
enabled: config.resourceSuspend,
|
|
526
525
|
ttlSec: config.resourceSuspendTtlSec,
|
|
527
|
-
isVerify: body.verify === true,
|
|
528
526
|
isCascade: body.cascade === true,
|
|
529
527
|
scope: encodeCheckpointScope(auth?.principal),
|
|
530
528
|
totalTokens: config.resourceSuspendTotalTokens,
|
|
@@ -183,7 +183,7 @@ export interface RunnerDepsCtx {
|
|
|
183
183
|
* (`backend.sessionCaptureRecords()`,main.ts 取**一次**、与四只 operator 面引擎同一只源 —— 全站同批
|
|
184
184
|
* 注入律,机器钉 = test/memory-capture-optout-lane.test.ts ②)。在场 ⇒ `capture:"off"` 声明与中途翻转
|
|
185
185
|
* verb 真持久;缺席 ⇒ core 读作「无店」,而 core 的 `captureCarrierUnsupported` 判据是**席位在不在**
|
|
186
|
-
* (不是「文件形能不能用」)
|
|
186
|
+
* (不是「文件形能不能用」),叠上执行环境块 `hostLocalPaths` 为假(沙箱 / 远端 / 设备车道)⇒ 两条 ingress 都拒
|
|
187
187
|
* `config.memory_capture_unsupported`。[ref] 起三条车道都供(SQL 双方言 twin / local 的控制面文件三腿),
|
|
188
188
|
* 所以缺席今天只剩一个成因:**记忆面暗**的 local 部署(那时 core 的 capture 腿本就不参与)。 */
|
|
189
189
|
sessionCaptureRecords: SessionCaptureRecordSource | undefined;
|
|
@@ -247,7 +247,7 @@ export interface RunnerDepsCtx {
|
|
|
247
247
|
}
|
|
248
248
|
/** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
|
|
249
249
|
* 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
|
|
250
|
-
export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
|
|
250
|
+
export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
|
|
251
251
|
/**
|
|
252
252
|
* [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
|
|
253
253
|
* `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
|
|
@@ -322,7 +322,7 @@ export declare function createEngineNoticeSeat(logger: {
|
|
|
322
322
|
* 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
|
|
323
323
|
* CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
|
|
324
324
|
*/
|
|
325
|
-
export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir" | "crossBoundaryPosture">;
|
|
325
|
+
export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "agentConfigDir" | "crossBoundaryPosture">;
|
|
326
326
|
/** 本族读的配置切面:席名与 config 键同名的那几席 + 运维 allow 表(席 `allowedTools` ← config `approvalGrant`,env 名 `APPROVAL_GRANT` 不改)
|
|
327
327
|
* + LKG 覆写路径(`readDenyPatterns` 席并入它派生的读拒行,`lkgReadDenyRows`)+ 主体门(席 `crossBoundaryPosture` ← config `requirePrincipal`)。 */
|
|
328
328
|
export type DeploymentPostureConfig = Pick<ServiceConfig, Exclude<keyof DeploymentPostureSeats, "allowedTools" | "crossBoundaryPosture"> | "approvalGrant" | "configLkgPath" | "requirePrincipal">;
|
package/dist/boot/runner-deps.js
CHANGED
|
@@ -79,6 +79,7 @@ export function buildDeploymentPostureSeats(config) {
|
|
|
79
79
|
readDenyPatterns: readDenyAdditions ? readDenyAdditions : undefined,
|
|
80
80
|
readDenyBuiltinTiers: config.readDenyBuiltinTiers ?? undefined,
|
|
81
81
|
readDenyBuiltinExclude: config.readDenyBuiltinExclude ?? undefined,
|
|
82
|
+
readDenyFloorRequired: config.readDenyFloorRequired,
|
|
82
83
|
agentConfigDir: config.agentConfigDir ?? undefined,
|
|
83
84
|
memoryDelegationEvidence: config.memoryDelegationEvidence ?? undefined,
|
|
84
85
|
memoryProvenance: config.memoryProvenance ?? undefined,
|
|
@@ -7,16 +7,12 @@ export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>):
|
|
|
7
7
|
instanceId: string;
|
|
8
8
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
9
9
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
10
|
-
memoryEngine:
|
|
11
|
-
|
|
12
|
-
root: string;
|
|
13
|
-
} | undefined;
|
|
14
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
10
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
11
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
15
12
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
16
13
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
17
14
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
18
15
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
19
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
20
16
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
21
17
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
22
18
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|
|
@@ -2,10 +2,9 @@ import { uuidv7 } from "@sema-agent/core";
|
|
|
2
2
|
import { openStores } from "./stores.js";
|
|
3
3
|
export async function runStage03(ctx) {
|
|
4
4
|
const { config, localRoot, logger, metrics } = ctx;
|
|
5
|
-
const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle,
|
|
5
|
+
const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportStores, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, } = await openStores({ config, logger, metrics, localRoot });
|
|
6
6
|
const instanceId = uuidv7();
|
|
7
7
|
const sessionCaptureRecords = backend?.sessionCaptureRecords();
|
|
8
|
-
|
|
9
|
-
return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
|
|
8
|
+
return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportStores, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
|
|
10
9
|
}
|
|
11
10
|
//# sourceMappingURL=stage-03-store-backend.js.map
|
|
@@ -37,16 +37,12 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
|
|
|
37
37
|
instanceId: string;
|
|
38
38
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
39
39
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
40
|
-
memoryEngine:
|
|
41
|
-
|
|
42
|
-
root: string;
|
|
43
|
-
} | undefined;
|
|
44
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
40
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
41
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
45
42
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
46
43
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
47
44
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
48
45
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
49
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
50
46
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
51
47
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
52
48
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|
|
@@ -7,22 +7,22 @@ import { createBudgetAndTracing } from "./budget-tracing.js";
|
|
|
7
7
|
import { createRuleConsentLane } from "../rules-consent.js";
|
|
8
8
|
import { createConsolidationValve } from "./memory-consolidation.js";
|
|
9
9
|
export async function runStage04(ctx) {
|
|
10
|
-
const { backend, breakerState, config, logger, memoryEngine, metrics,
|
|
11
|
-
const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(
|
|
10
|
+
const { backend, breakerState, config, logger, memoryEngine, metrics, sessionCaptureRecords } = ctx;
|
|
11
|
+
const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}) }) : undefined;
|
|
12
12
|
const memoryComplianceFaces = memoryEngine
|
|
13
13
|
? createMemoryComplianceFaces(memoryEngine, {
|
|
14
14
|
onIncident: (err) => logger.warn("memory_compliance_incident", { code: err.code ?? null, detail: err.message }),
|
|
15
|
-
...(
|
|
15
|
+
...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
|
|
16
16
|
})
|
|
17
17
|
: undefined;
|
|
18
18
|
const memoryOriginFaces = memoryEngine
|
|
19
19
|
? createMemoryOriginFaces(memoryEngine, {
|
|
20
20
|
onIncident: (err) => logger.warn("memory_origin_incident", { code: err.code ?? null, detail: err.message }),
|
|
21
|
-
...(
|
|
21
|
+
...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
|
|
22
22
|
})
|
|
23
23
|
: undefined;
|
|
24
24
|
const sessionMemoryStatusFace = memoryEngine
|
|
25
|
-
? createSessionMemoryStatusFace(memoryEngine, { ...(
|
|
25
|
+
? createSessionMemoryStatusFace(memoryEngine, { ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}) })
|
|
26
26
|
: undefined;
|
|
27
27
|
const { valve: consolidationValve, watch: consolidationSeatWatch } = createConsolidationValve({ config, memoryEngine, logger });
|
|
28
28
|
const adoptionBoot = await runAdoptionBootScan({ backend, logger });
|
|
@@ -56,16 +56,12 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
|
|
|
56
56
|
instanceId: string;
|
|
57
57
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
58
58
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
59
|
-
memoryEngine:
|
|
60
|
-
|
|
61
|
-
root: string;
|
|
62
|
-
} | undefined;
|
|
63
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
59
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
60
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
64
61
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
65
62
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
66
63
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
67
64
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
68
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
69
65
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
70
66
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
71
67
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|
|
@@ -119,16 +119,12 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
|
|
|
119
119
|
instanceId: string;
|
|
120
120
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
121
121
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
122
|
-
memoryEngine:
|
|
123
|
-
|
|
124
|
-
root: string;
|
|
125
|
-
} | undefined;
|
|
126
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
122
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
123
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
127
124
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
128
125
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
129
126
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
130
127
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
131
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
132
128
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
133
129
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
134
130
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|
|
@@ -30,7 +30,7 @@ import { parkedAskRedeem, runStore } from "./late-binds.js";
|
|
|
30
30
|
import { withInternalRunEnvs } from "../internal-run-env.js";
|
|
31
31
|
import { retentionSweepRuns } from "../plugins/retention-store-sql.js";
|
|
32
32
|
export async function runStage06(ctx) {
|
|
33
|
-
const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs,
|
|
33
|
+
const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
|
|
34
34
|
const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
|
|
35
35
|
const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
|
|
36
36
|
const checkpointStore = parkCommitted?.store;
|
|
@@ -94,7 +94,7 @@ export async function runStage06(ctx) {
|
|
|
94
94
|
...(config.memoryProvenance !== undefined ? { provenance: config.memoryProvenance } : {}),
|
|
95
95
|
onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
|
|
96
96
|
onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
|
|
97
|
-
...(
|
|
97
|
+
...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
|
|
98
98
|
writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
|
|
99
99
|
onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
|
|
100
100
|
})
|
|
@@ -135,16 +135,12 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
|
|
|
135
135
|
instanceId: string;
|
|
136
136
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
137
137
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
138
|
-
memoryEngine:
|
|
139
|
-
|
|
140
|
-
root: string;
|
|
141
|
-
} | undefined;
|
|
142
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
138
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
139
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
143
140
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
144
141
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
145
142
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
146
143
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
147
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
148
144
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
149
145
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
150
146
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|
|
@@ -148,16 +148,12 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
|
|
|
148
148
|
instanceId: string;
|
|
149
149
|
mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
|
|
150
150
|
mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
|
|
151
|
-
memoryEngine:
|
|
152
|
-
|
|
153
|
-
root: string;
|
|
154
|
-
} | undefined;
|
|
155
|
-
memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
|
|
151
|
+
memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
152
|
+
memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
|
|
156
153
|
memoryPosture: import("../memory-posture.js").MemoryPosture;
|
|
157
154
|
memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
|
|
158
155
|
memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
|
|
159
156
|
rosterStore: import("@sema-agent/core").RosterStore | undefined;
|
|
160
|
-
sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
|
|
161
157
|
sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
|
|
162
158
|
sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
|
|
163
159
|
sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
|