@sema-agent/server 7.141.0 → 7.142.0

package/dist/http/resume-legs.js

@@ -27,7 +27,7 @@ import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { runSkillsOf } from "../capabilities/skills.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
-import { modelTextEventData, parkEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, appendParkRow, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -876,9 +876,8 @@ export function createResumeLegs(ctx) {
                             const ap = vAppend;
                             await appendPromptManifest(ap, deps.promptManifests, taskId);
                             if (reSuspended || vrReopened) {
-                                await appendModelUsageDelta(ap, deps.modelUsage, taskId);
                                 const vrParkCallId = reSuspended ? await parkToolCallId(vr, deps.checkpointStore) : undefined;
-                                await ap(reParkEvent ?? reparkStatus, parkEventData({ terminal: vrPaused, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}) }, vrReopened ? (failureCodeOf(vr.terminal) ?? null) : undefined));
+                                await appendParkRow(ap, { modelUsage: deps.modelUsage, taskId }, reParkEvent ?? reparkStatus, { terminal: vrPaused, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}) }, vrReopened ? (failureCodeOf(vr.terminal) ?? null) : undefined);
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -1141,21 +1140,18 @@ export function createResumeLegs(ctx) {
                         heldPark = r;
                     const rPark = r.terminal.kind === "paused" ? outwardPlane(r.terminal).status : undefined;
                     if (rPark === "suspended") {
-                        await append("suspended", parkEventData(await graftParkToolCallId(r, deps.checkpointStore)));
-                        await appendModelUsageDelta(append, deps.modelUsage, taskId);
+                        await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, "suspended", await graftParkToolCallId(r, deps.checkpointStore));
                         return r;
                     }
                     if (rPark === "needs_review") {
-                        await append("needs_review", parkEventData(r));
-                        await appendModelUsageDelta(append, deps.modelUsage, taskId);
+                        await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, "needs_review", r);
                         return r;
                     }
                     const settledLeg = await reopenedAfterLeg(r, causeAtDone !== undefined);
                     if (settledLeg.reopened) {
                         reopenConfirmedPark = true;
                         try {
-                            await append(reparkStatus, parkEventData(r, failureCodeOf(r.terminal) ?? null));
-                            await appendModelUsageDelta(append, deps.modelUsage, taskId);
+                            await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, reparkStatus, r, failureCodeOf(r.terminal) ?? null);
                         }
                         catch {
                         }

package/dist/http/route-table.js

@@ -32,6 +32,7 @@ import { handleRunMemoryCapture, RUN_MEMORY_CAPTURE_ROUTES } from "./routes/run-
 import { handlePermissionMode, RUN_PERMISSION_MODE_ROUTES } from "./routes/run-permission-mode.js";
 import { handleMcpReconnect, MCP_RECONNECT_ROUTES } from "./routes/mcp-reconnect.js";
 import { handleBackground, BACKGROUND_ROUTES } from "./routes/background.js";
+import { handleSessionMemorySync, SESSION_MEMORY_SYNC_ROUTES } from "./routes/session-memory-sync.js";
 import { handleSideQuery, SIDE_QUERY_ROUTES } from "./routes/side-query.js";
 import { handleTasks, TASKS_ROUTES } from "./routes/tasks.js";
 import { handleLeader, LEADER_ROUTES } from "./routes/leader.js";
@@ -55,6 +56,7 @@ export const ROUTES = [
     row({ handler: handlePermissionMode, decls: RUN_PERMISSION_MODE_ROUTES, position: "post-credential", label: "permission-mode" }),
     row({ handler: handleMcpReconnect, decls: MCP_RECONNECT_ROUTES, position: "post-credential", label: "mcp-reconnect" }),
     row({ handler: handleBackground, decls: BACKGROUND_ROUTES, position: "post-credential", label: "background" }),
+    row({ handler: handleSessionMemorySync, decls: SESSION_MEMORY_SYNC_ROUTES, position: "post-credential", label: "session-memory-sync" }),
     row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader" }),
     row({ handler: handleImages, decls: IMAGES_ROUTES, position: "post-credential", label: "images" }),
     row({ handler: handleApprovalsAssistant, decls: APPROVALS_ASSISTANT_ROUTES, position: "post-credential", label: "approvals-assistant" }),

package/dist/http/routes/attachments.js

@@ -4,6 +4,7 @@ import { HttpError } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import { attachmentKindOf, readProjectBundle } from "../../project-bundle.js";
 export async function handleAttachments(req, res, match, ctx) {
     const { deps } = ctx;
     const { rateLimited, quotaExceeded, safeDecode, readRawBody } = ctx.helpers;
@@ -55,6 +56,23 @@ export async function handleAttachments(req, res, match, ctx) {
                         }
                         throw err;
                     }
+                    const kind = attachmentKindOf(mime);
+                    switch (kind) {
+                        case "project_bundle": {
+                            const reading = await readProjectBundle(body);
+                            if (!reading.ok) {
+                                sendError(res, 400, "attachment.bundle_invalid", `not a valid project bundle (${reading.reason}): ${reading.detail}`, { reason: reading.reason, ...(reading.path !== undefined ? { path: reading.path } : {}) });
+                                return;
+                            }
+                            break;
+                        }
+                        case "attachment":
+                            break;
+                        default: {
+                            const unreachable = kind;
+                            throw new Error(`unhandled attachment kind: ${String(unreachable)}`);
+                        }
+                    }
                     const rec = {
                         id: uuidv7(),
                         owner,

package/dist/http/routes/capabilities.js

@@ -124,6 +124,9 @@ export async function handleCapabilities(req, res, match, ctx) {
                 memoryOrigin: facts.memoryOrigin(deps).available,
                 memoryConsolidationDriver: facts.memoryConsolidation(deps).available,
                 memoryOptOutGrant: facts.memoryOptOutGrant(deps).available,
+                sessionMemorySync: facts.sessionMemorySync(deps).available,
+                memorySyncServe: ((f) => (f.available ? { identity: f.identity } : false))(facts.memorySyncServe(deps)),
+                memoryExport: facts.memoryExport(deps).available,
                 outcomeLedger: facts.outcomeLedger(deps).available,
                 permissionRules: rulesLaneForCaller,
                 permissionRulesWrite: rulesLaneForCaller,
@@ -142,7 +145,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), httpHookAllowlists: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
                 settings: { permissions: { allowGrant: true, allowLayer: true, layers: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
@@ -235,7 +238,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 configCatalog: facts.configCatalog(deps).available,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
                 workspaceSync: ((space, cache) => space.available || cache.available ? { ...(space.available ? space.policy : {}), ...(cache.available ? { cache: cache.cache } : {}) } : undefined)(facts.workspaceSpace(deps.config), facts.workspaceCache(deps.config)),
-                credentialPlane: { sandboxGit: deps.sandboxGitPlane ?? judgeSandboxGitPlane(sandboxGitPlanePremisesOf(deps.config, {})) },
+                credentialPlane: { sandboxGit: deps.sandboxGitPlane?.() ?? judgeSandboxGitPlane(sandboxGitPlanePremisesOf(deps.config, {})) },
             }));
             return;
         }

package/dist/http/routes/memory-policy.js

@@ -1,5 +1,7 @@
 import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
+import { memorySyncIdentityRule } from "../../memory-sync-identity.js";
+import * as facts from "../../capability-facts.js";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { parseProjectLayerKey } from "../../project-layer-key.js";
@@ -73,7 +75,8 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendUnauthorized(res, "identity");
                 return;
             }
-            if (deps.config.memoryEngineBackend === "file" || !deps.memoryExport) {
+            const exportFact = facts.memoryExport(deps);
+            if (!exportFact.available) {
                 sendError(res, 501, "capability.memory_store_required", "memory export requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|mysql)");
                 return;
             }
@@ -101,7 +104,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 return;
             }
             try {
-                const fence = buildOriginFence(await deps.memoryExport(scope), readOriginAware(new URLSearchParams(match.search)));
+                const fence = buildOriginFence(await exportFact.read(scope), readOriginAware(new URLSearchParams(match.search)));
                 const entries = fence.entries;
                 const withheld = fence.withheldOriginTagged !== undefined ? { withheldOriginTagged: fence.withheldOriginTagged } : {};
                 if (limitRaw === null) {
@@ -135,9 +138,18 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendUnauthorized(res, "identity");
                 return;
             }
-            if (deps.config.memoryEngineBackend === "file" || !deps.memorySync) {
-                sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|mysql)");
-                return;
+            const serve = facts.memorySyncServe(deps);
+            if (!serve.available) {
+                switch (serve.why) {
+                    case "memory_db_plane_absent":
+                        sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|mysql)");
+                        return;
+                    case "memory_sync_identity_undeclared":
+                        sendError(res, 501, "feature.memory_sync_serve_disabled", "this center serves no memory sync — it declares no sync identity: set MEMORY_SYNC_SERVE_IDENTITY to the base address clients reach this center at");
+                        return;
+                    default:
+                        return assertNever(serve.why);
+                }
             }
             const scope = safeDecode(match.params.scope);
             if (scope === null) {
@@ -153,11 +165,19 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
             const body = await readJson(req);
             const parsed = parseMemorySyncRequest(body, scope);
             if (!parsed.ok) {
+                if ("peerFlaw" in parsed) {
+                    sendError(res, 400, "request.field_invalid", `peer ${memorySyncIdentityRule(parsed.peerFlaw)} — it must be the sync identity this client reaches the center at (the center's GET /v1/capabilities memorySyncServe.identity)`, { field: "peer", reason: parsed.peerFlaw });
+                    return;
+                }
                 sendError(res, 422, "memory_sync_invalid_body", parsed.error);
                 return;
             }
+            if (parsed.value.peer !== serve.identity) {
+                sendError(res, 409, "config.memory_sync_target_mismatch", `this center's sync identity is ${JSON.stringify(serve.identity)} and the round names another peer — nothing was read or written: set the client's MEMORY_SYNC_URL to that address (the client reaches this center under another address — a different hostname, port or path)`);
+                return;
+            }
             try {
-                const out = await deps.memorySync(scope, parsed.value);
+                const out = await serve.perform(scope, parsed.value);
                 sendJson(res, 200, out);
             }
             catch (err) {

package/dist/http/routes/runs.js

@@ -16,7 +16,7 @@ import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSe
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
 import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, presentedApprovalFrameFamily, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "../../approval-ask-machine.js";
-import { causeOfAskRow } from "../../approval-deny-reasons.js";
+import { askRowEndingCause } from "../../approval-deny-reasons.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { invalidJsonError, sendJson, sendError, sendHttpError, sseHeaders } from "../send.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
@@ -1429,10 +1429,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     return;
                 case "DENIED":
                 case "VOID": {
-                    const rowCause = causeOfAskRow(row);
+                    const endingCause = askRowEndingCause(row);
                     sendError(res, 410, "gone.ask", "this ask reached a terminal state without a human decision (cause says why: a routing failure, a cancellation or batch withdrawal or abort, or the process that held it ended) and can no longer be decided", {
                         state: row.state,
-                        ...(rowCause?.kind === "ending" ? { cause: rowCause.cause } : {}),
+                        ...(endingCause !== undefined ? { cause: endingCause } : {}),
                     });
                     return;
                 }

package/dist/http/routes/session-memory-sync.d.ts

@@ -0,0 +1,63 @@
+/**
+ * [ref] —— **会话记忆同步触发口**:`POST /v1/sessions/:id/memory/sync`  body `{ target: string }`
+ *   → 200 引擎的同步报告(core `memorySyncReportOf` 的产物,原样)
+ *
+ * 一口一件事:让本机的记忆同步腿**现在**对会话要去的那台引擎同步一轮,只回报这个会话读的那几层。壳在把会话推上云(fork)之前调它。
+ *
+ * ── 规则(规则账只减)────────────────────────────────────────────────────────────────────────────
+ *  R1 一轮 = 同步腿的一轮(`MemorySyncRunner.syncOnce`):交回每层每次调用如它落定的那样,从不整轮 reject —— 部分层失败落在报告的逐层结局里。
+ *  R2 同步身份一只铸点(`memory-sync-identity.ts`):`target` 必须**就是**目标引擎能力面公开的 `memorySyncServe.identity`(规范形、不带凭据),
+ *     与本机腿的 `peer` 按串相等比。壳不拼、本口不规范化。
+ *  R4 门之后的一切答复都是 core 报告:200 带 `layers`(每层恰一个结局)或整轮 `refused`(目标不符 / 会话有在飞的 run)。
+ *     HTTP 错误只留给报告产生之前的门(能力 / 身份 / id / 属主 / 体)与「读集不可取得」。本口不铸汇总键、不加第五种结局。
+ *  R5 可用性 = 能力事实 `sessionMemorySync`(本机同步腿 ∧ 持久 run 账面 ∧ 会话头读),与能力位同读一只;不从后端名推。
+ *
+ * ── 读集(这个会话读哪几层)────────────────────────────────────────────────────────────────────
+ * = 会话**最近一条已结腿**结果里引擎铸的记忆观测(run 店 `latestMemoryObservationForSession`;规则属主 `store-contracts.ts` 的
+ * `SettledLegMemoryObservation`):`mounted` ⇒ `scopes[].scope` 按服务序;`memoryless` / `none` ⇒ `[]`(那一腿没挂上记忆 —— 是值)。
+ * 那一腿没有观测(prepare 没走完)/ 会话还没有已结腿 / 会话没有叶子 ⇒ 409 `conflict.session_memory_unobserved`(有在飞 run 时带 `activeTaskId`)。
+ * 路由不重铸 spec:spec 只在受理时铸、不落会话行,重铸 = 重启前后两种答案。
+ *
+ * ── 门序(编号即执行序)──────────────────────────────────────────────────────────────────────────
+ *  1. 事实 `sessionMemorySync` 为假 ⇒ 501(码按 why)。先于身份:「这台部署有没有这一口」本由能力位公开。
+ *  2. 多租户部署上没有验过的身份 ⇒ 401/403(`sendPrincipalRefusal`,会话面同一只)。
+ *  3. 限流(本口会向远端发请求)。
+ *  4. 会话 id 段解码不了 ⇒ 400 `request.path_malformed`。
+ *  5. 一次头读:没有这只会话 / 不是你的 ⇒ 404 `not_found.session`(同码同串,无存在性 oracle;属主判据 = 会话面唯一谓词 `sessionOwnerOk`);
+ *     同一次头读的叶子 = `sourceRevision`(与 `GET /v1/sessions/:id/head` 的 `leafId` 同一读法)。
+ *  6. 体:闭集一键 `{ target }`,否则 400 `request.body_shape`;`target` 不是声明的同步身份 ⇒ 400 `request.field_invalid`(`field` / `reason`,不回显值)。
+ *  7. 读集(上一节)。
+ *  8. 目标比对:`target` ≠ 本机腿的 `peer` ⇒ 报告 `refused: config.memory_sync_target_mismatch`(句由 core 铸;零请求零本地写)。先于空读集出口。
+ *  9. 收割栅栏(前检):会话**不静** ⇒ 报告 `refused: session_active`(句由本服务铸)。零请求。
+ *     **静** = 一只谓词,前检与后检同读,三格合取:会话没有认领 ∧ 最近受理的腿**就是**观测所在的那一条(读完观测之后没有新 run 被受理)∧ 会话叶子仍是 `sourceRevision`
+ *     (会话的记录没有前进)。次序 = 认领 → 最近受理的腿 → 叶子:run 行在受理时同步落库、消息在那之后才追加,所以认领读之后才受理的 run 在第二只读里看得见;
+ *     第三格不靠建行时刻 —— 「最近受理」按建行时刻排序,副本之间钟偏 / 时钟回拨时一条后受理的 run 可以排在观测腿之前,而它只要跑过就挪动了叶子。
+ * 10. 一轮:读集为空 ⇒ 空报告(同一只铸点);否则 `syncOnce("session-trigger", { reading })`,只挑读集里的层的调用交给引擎出报告。
+ * 11. 收割栅栏(后检):轮落定后会话不静 ⇒ 第 9 步的报告 —— 这一轮的请求与写已经发生(幂等,下次触发重放),报告只是不再为这份读集作保。
+ *     报告之后、fork 之前的源前进不由本口封闭:壳拿 `sourceRevision` 与它推上云的会话头比。
+ * 12. 引擎的报告铸点自己抛 `TypeError`(名字带凭据 / 空串)⇒ 500 + 运维 warn(拒句不引原值)。同步层名起服时已过同一只凭据判官(`config.ts`),这一臂按构造不可达。
+ *
+ * ── 并发 ───────────────────────────────────────────────────────────────────────────────────────
+ * 同一会话、同一 `sourceRevision`、同一观测腿、同一 `target` 的请求各自走完 1–9,再**并入**在飞的那一轮,拿同一份报告(只减少重复工作,不延长等待)。
+ * 别的会话 / 后台轮经腿的同一条串行链(`exclusive`):会话触发的轮起跑晚于本请求到达。请求方断开不取消轮。本口不设自己的截止(= 各调用的传输超时之和)。
+ *
+ * ── 计费 / 门 ──────────────────────────────────────────────────────────────────────────────────
+ * 零模型工作(不 billable、不吃 drain 503);写的是调用方自己的记忆到它自己配置的中心 ⇒ 属主门兜底,不进无凭据改写门(会话自助抹除同判)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import type { EffectiveMemoryScopes } from "../../plugins/store-contracts.js";
+/** 收割栅栏的句(本服务铸;码 `session_active` 是引擎报告闭集的成员)。 */
+export declare const SESSION_ACTIVE_SYNC_MESSAGE = "a run in this session is in flight, or the session moved on after the memory it reads was observed (a run was admitted or its transcript advanced) \u2014 wait for it to finish on its own, then sync again (do not cancel it to sync sooner)";
+/** 读集 = 最近一条已结腿的记忆观测(三态穷举;引擎加第四态 ⇒ 编译红)。 */
+export declare function sessionReadSetOf(observation: EffectiveMemoryScopes): readonly string[];
+export declare function handleSessionMemorySync(req: IncomingMessage, res: ServerResponse, match: RouteMatch<SessionMemorySyncRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const SESSION_MEMORY_SYNC_ROUTES: readonly [{
+    readonly id: "session-memory-sync";
+    readonly pattern: RegExp;
+    readonly label: "/v1/sessions/:id/memory/sync";
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type SessionMemorySyncRouteId = RouteIdsOf<typeof SESSION_MEMORY_SYNC_ROUTES>;
+//# sourceMappingURL=session-memory-sync.d.ts.map

package/dist/http/routes/session-memory-sync.js

@@ -0,0 +1,157 @@
+import { memorySyncReportOf } from "@sema-agent/core";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import {} from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
+import { leafOfAdmittedHead } from "../../session-incarnation.js";
+import { declaredMemorySyncIdentityFlaw, memorySyncIdentityRule } from "../../memory-sync-identity.js";
+export const SESSION_ACTIVE_SYNC_MESSAGE = "a run in this session is in flight, or the session moved on after the memory it reads was observed (a run was admitted or its transcript advanced) — wait for it to finish on its own, then sync again (do not cancel it to sync sooner)";
+export function sessionReadSetOf(observation) {
+    switch (observation.state) {
+        case "mounted":
+            return observation.scopes.map((s) => s.scope);
+        case "memoryless":
+        case "none":
+            return [];
+        default:
+            return assertNever(observation);
+    }
+}
+class ReportMintRefused extends Error {
+}
+function reportOf(round) {
+    try {
+        return memorySyncReportOf(round);
+    }
+    catch (err) {
+        if (err instanceof TypeError)
+            throw new ReportMintRefused(err.message);
+        throw err;
+    }
+}
+const inflightByLeg = new WeakMap();
+function mergedRound(leg, key, run) {
+    let table = inflightByLeg.get(leg);
+    if (table === undefined) {
+        table = new Map();
+        inflightByLeg.set(leg, table);
+    }
+    const inflight = table.get(key);
+    if (inflight !== undefined)
+        return inflight;
+    const owner = table;
+    const round = run().finally(() => {
+        if (owner.get(key) === round)
+            owner.delete(key);
+    });
+    table.set(key, round);
+    return round;
+}
+export async function handleSessionMemorySync(req, res, match, ctx) {
+    const { deps } = ctx;
+    switch (match.decl.id) {
+        case "session-memory-sync": {
+            const fact = facts.sessionMemorySync(deps);
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "memory_sync_leg_absent":
+                        sendError(res, 501, "feature.memory_sync_disabled", "session memory sync is not available on this deployment — it runs only where a file memory engine syncs to a center (MEMORY_SYNC_URL)");
+                        return;
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "session memory sync requires a durable run store (DB_BACKEND=mysql|pg|local) — the session's read set is the memory its latest settled run observed");
+                        return;
+                    case "session_head_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "session memory sync requires the session-ownership face (sessionStorage.headOf)");
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
+            }
+            const { leg, runStore, sessionStorage } = fact;
+            if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            if (ctx.helpers.rateLimited(req, res))
+                return;
+            const sessionId = ctx.helpers.safeDecode(match.params.sessionId);
+            if (sessionId === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
+            const readHead = () => sessionStorage.headOf(sessionId);
+            const head = await readHead();
+            if (head === undefined) {
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
+            }
+            if (!ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, head.owner)))
+                return;
+            const sourceRevision = leafOfAdmittedHead(head);
+            const body = await ctx.helpers.readJson(req);
+            if (body === null || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((k) => k !== "target") || typeof body.target !== "string") {
+                sendError(res, 400, "request.body_shape", "body must be { target: string } — the sync identity the target engine publishes (GET /v1/capabilities → memorySyncServe.identity), verbatim; no other key");
+                return;
+            }
+            const target = body.target;
+            const flaw = declaredMemorySyncIdentityFlaw(target);
+            if (flaw !== undefined) {
+                sendError(res, 400, "request.field_invalid", `target ${memorySyncIdentityRule(flaw)} — send the target engine's memorySyncServe.identity exactly as GET /v1/capabilities publishes it`, { field: "target", reason: flaw });
+                return;
+            }
+            const observed = await runStore.latestMemoryObservationForSession(sessionId);
+            if (observed?.effectiveMemoryScopes === undefined || sourceRevision === null) {
+                const activeTaskId = await runStore.getActiveTaskId(sessionId);
+                sendError(res, 409, "conflict.session_memory_unobserved", "this session has no settled run with a memory observation yet, so there is nothing to say about which memory it reads — run a task in it (or let the run in flight finish), then sync", activeTaskId !== undefined ? { activeTaskId } : undefined);
+                return;
+            }
+            const scopes = sessionReadSetOf(observed.effectiveMemoryScopes);
+            const quiet = async () => {
+                if ((await runStore.getActiveTaskId(sessionId)) !== undefined)
+                    return false;
+                if ((await runStore.latestRunForSession(sessionId))?.taskId !== observed.taskId)
+                    return false;
+                const now = await readHead();
+                return now !== undefined && leafOfAdmittedHead(now) === sourceRevision;
+            };
+            const fenced = () => reportOf({ target, sourceRevision, scopes, refused: { code: "session_active", message: SESSION_ACTIVE_SYNC_MESSAGE } });
+            let report;
+            try {
+                if (target !== leg.peer) {
+                    report = reportOf({ target, sourceRevision, scopes, refused: { code: "config.memory_sync_target_mismatch", reaches: leg.peer } });
+                }
+                else if (!(await quiet())) {
+                    report = fenced();
+                }
+                else if (scopes.length === 0) {
+                    report = reportOf({ target, sourceRevision, scopes, layers: [] });
+                }
+                else {
+                    report = await mergedRound(leg, JSON.stringify([sessionId, sourceRevision, observed.taskId, target]), async () => {
+                        const round = await leg.syncOnce("session-trigger", { reading: scopes });
+                        if (!(await quiet()))
+                            return fenced();
+                        return reportOf({ target, sourceRevision, scopes, layers: round.calls.filter((c) => scopes.includes(c.scope)) });
+                    });
+                }
+            }
+            catch (err) {
+                if (!(err instanceof ReportMintRefused))
+                    throw err;
+                deps.logger?.warn?.("session_memory_sync_report_refused", { sessionId, err: err.message });
+                sendError(res, 500, "internal.error", "memory sync failed");
+                return;
+            }
+            sendJson(res, 200, report);
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const SESSION_MEMORY_SYNC_ROUTES = [
+    { id: "session-memory-sync", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/memory\/sync$/, label: "/v1/sessions/:id/memory/sync", methods: ["POST"] },
+];
+//# sourceMappingURL=session-memory-sync.js.map

package/dist/http/routes/sessions-list.d.ts

@@ -16,7 +16,8 @@ export declare function handleSessionsList(req: IncomingMessage, res: ServerResp
  * 会话列表行的 **wire 投影** —— `GET /v1/sessions` 的每一行与 `PATCH /v1/sessions/:id` 的 200 回执是**同一只**(店行 → wire 行只有这一处)。
  *  · 预览:店行读的是 run 行预览列的事实位(`""` = 有记录、剥完没有用户正文;NULL = 没记录);本面只说「有没有可显示的预览」⇒ 两者都是 `null`。
  *  · `tempo`:见上方 [ref] 注(由 `lastStatus` 经唯一一张表派生;omit-when-absent)。
- *  · 其余键(含 `title` / `pinned`)零投影透传 —— 店行是唯一铸点。
+ *  · 其余键(含 `title` / `pinned` / `rowTag` / `unreadable`)零投影透传 —— 店行是唯一铸点(`unreadable` 的码出自 `session-error-wire.ts` 的那一张表,
+ *    与全局兜底对同一只会话答的码同读;SQL 孪生的叶子是行上一列 ⇒ 恒缺席)。
  */
 export declare function projectSessionListRow(r: SessionListItem): SessionListItem & {
     tempo?: ReturnType<typeof sessionTempoOfRunStatus>;

package/dist/http/routes/tasks.js

@@ -9,7 +9,7 @@ import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTermi
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
-import { createLedgerSink, createLedgerTwinEmit } from "../../trace/ledger-sink.js";
+import { createForwardAppendFailedNote, createLedgerSink, createLedgerTwinEmit } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../../run-cancel-context.js";
@@ -342,7 +342,7 @@ export async function handleTasks(req, res, match, ctx) {
                     if (durableTaskId && deps.runStore) {
                         const rs = deps.runStore;
                         const tid = durableTaskId;
-                        ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections });
+                        ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections, usage: { modelUsage: deps.modelUsage, taskId: tid } });
                         usageKey = tid;
                         deps.modelUsage?.register(tid);
                         const owner = principal ?? null;
@@ -400,7 +400,8 @@ export async function handleTasks(req, res, match, ctx) {
                         ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
                         live: (row) => {
                             if (res.writableEnded || res.destroyed) {
-                                recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
+                                if (noticeLedger === undefined)
+                                    recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
                                 return;
                             }
                             writeLiveFrame(res, { type: "engine_notice", ...row });
@@ -742,10 +743,11 @@ export async function handleTasks(req, res, match, ctx) {
                             ? deps.sendUserFile.runWithContext({
                                 taskId: askTaskId,
                                 emit: async (f) => {
-                                    void (await emitAsk(f));
+                                    if (ledgerSink === undefined || faceAlive())
+                                        void (await emitAsk(f));
                                     if (ledgerSink) {
                                         const { type, ...rest } = f;
-                                        await ledgerSink.append(type, rest).catch(() => undefined);
+                                        await ledgerSink.append(type, rest).catch(createForwardAppendFailedNote(type));
                                     }
                                 },
                             }, withApproval)

package/dist/http/run-read-face.d.ts

@@ -5,6 +5,13 @@ import type { ServiceConfig } from "../config-types.js";
 export interface RunFaceDeps {
     config: Pick<ServiceConfig, "runStaleSec" | "infraCostRates">;
 }
+/** 一条行是不是「看起来失联」:盘上 `running`、而最后一次心跳早于 `runStaleSec` —— 读面把它折成 `failed`(`run.stalled`)。读它的人只此一只判据(读面与同步重放回执同读)。 */
+export declare function runRowStale(deps: RunFaceDeps, run: RunRecord): boolean;
+/**
+ * 一条行上的结果**当作出口结果读**(封口 + 脱敏的读入口)—— 读面的 `result` 与同步提交的重放体读的是同一只:
+ * 终局行按 taskId+updatedAt 记忆的读入口,非终局行(停驻 / 在跑)走店入口那一套封口的读入口;行上没有结果 ⇒ `undefined`。
+ */
+export declare function runRowExitResult(run: RunRecord): import("../plugins/store-contracts.js").PersistedTaskResult | undefined;
 export declare function readRunFace(deps: RunFaceDeps, runStore: RunStore, run: RunRecord): Promise<{
     result: import("../plugins/store-contracts.js").PersistedTaskResult | undefined;
     supervisorCost: import("../observability/cost-taxonomy.js").SupervisorCostBreakdown | undefined;

package/dist/http/run-read-face.js

@@ -1,13 +1,19 @@
 import { persistedPlaneOf } from "../terminal.js";
-import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, sealRunRowResult } from "../observability/run-terminal.js";
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, sealStoredRunRowResult } from "../observability/run-terminal.js";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus } from "../plugins/store-contracts.js";
 import { composeSupervisorCost, infraCost, infraUsageFromEvents, hasInfraPricing } from "../observability/cost-taxonomy.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { readTurnActivityMs } from "../turn-activity.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../resource-window.js";
+export function runRowStale(deps, run) {
+    return run.status === "running" && Date.now() - new Date(run.updatedAt).getTime() > deps.config.runStaleSec * 1000;
+}
+export function runRowExitResult(run) {
+    return isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : (sealStoredRunRowResult(run.result ?? null, "run.result") ?? undefined);
+}
 export async function readRunFace(deps, runStore, run) {
     const taskId = run.taskId;
-    const stale = run.status === "running" && Date.now() - new Date(run.updatedAt).getTime() > deps.config.runStaleSec * 1000;
+    const stale = runRowStale(deps, run);
     const infraRates = deps.config.infraCostRates;
     const needCost = Boolean(run.result?.stats && !stale && infraRates && hasInfraPricing(infraRates));
     const needSuggestions = !stale && run.status === "completed";
@@ -53,7 +59,7 @@ export async function readRunFace(deps, runStore, run) {
         status: stale ? "failed" : run.status,
         ...(lastActivityAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastActivityAt) } : {}),
         ...(crossSliceUsage !== undefined ? { crossSliceUsage } : {}),
-        result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : (sealRunRowResult(run.result ?? null, "run.result") ?? undefined),
+        result: runRowExitResult(run),
         supervisorCost,
         suggestions,
         errorCode: stale ? RUN_HOLDER_DEATH_CODES.stalled : (persistedPlaneOf(run.result).errorCode ?? run.errorCode ?? undefined),

package/dist/http/send.d.ts

@@ -123,6 +123,11 @@ export declare function sendSessionPolicyError(res: ServerResponse, e: unknown,
  * (路径只进运维面:`server.session-repo.corrupt-record-skipped` 的探针行,[ref];SQL 两店走各自的拒绝句)。
  */
 export declare function sendSessionError(res: ServerResponse, e: unknown, face: SessionErrorFace): boolean;
+/**
+ * 全局兜底的 open 面一臂(`http/server.ts`:路由里逃出来的、不是 `HttpError` 的故障)—— 码经 {@link openFaceFaultWire}(会话列表行的 `unreadable` 同读这一只:
+ * 列表说的码就是读口答的码,`session-error-wire.ts` 头注「一张表、两个读者」)。有臂的 `SessionError` 同 {@link sendSessionError};其余落通用 500,固定句。
+ */
+export declare function sendOpenFaceFault(res: ServerResponse, e: unknown): void;
 export declare function msg(e: unknown): string;
 /**
  * 路由抛出的未归类错误的运维行 `request_error` —— **唯一写者**。外层兜底(`server.ts`)与「就地经映射下发」的站点(会话同步的暂存提交 catch)同调它:

package/dist/http/send.js

@@ -1,6 +1,6 @@
 import { SessionError, SessionPolicyError } from "@sema-agent/core";
 import { sessionPolicyErrorFacts, sessionPolicyErrorHttp, sessionPolicyErrorSentence } from "../session-policy-wire.js";
-import { sessionErrorWireOf } from "../session-error-wire.js";
+import { openFaceFaultWire, sessionErrorWireOf } from "../session-error-wire.js";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createCodedHttpError } from "../security.js";
 import { refusalBody } from "./refusal-body.js";
@@ -82,9 +82,16 @@ export function sendSessionError(res, e, face) {
     const wire = sessionErrorWireOf(e, face);
     if (wire === undefined)
         return false;
-    sendError(res, wire.status, wire.errorCode, wire.sentence ?? redactErrorMessage(e.message) ?? "session store error", wire.detail === undefined ? undefined : { detail: wire.detail });
+    sendSessionWire(res, e, wire);
     return true;
 }
+export function sendOpenFaceFault(res, e) {
+    sendSessionWire(res, e, openFaceFaultWire(e));
+}
+function sendSessionWire(res, e, wire) {
+    const sentence = wire.sentence ?? (e instanceof SessionError ? redactErrorMessage(e.message) : undefined) ?? "session store error";
+    sendError(res, wire.status, wire.errorCode, sentence, wire.detail === undefined ? undefined : { detail: wire.detail });
+}
 export function msg(e) {
     return e instanceof Error ? e.message : String(e);
 }