@sema-agent/server 7.142.0 → 7.143.0

package/dist/rule-entry-list.d.ts

@@ -2,11 +2,12 @@
  * **规则条目表在本仓受理口的判** —— 一份,四张表同调(core 7.42.0 起「这个调用不用问」只有一个去处:引擎的 allow 层;条目的文法、匹配、
  * 名字、读成空的通告都归引擎,本仓不写第二套):
  *  · 请求自带技能的 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代 `agents[].skills[]` 两处受理口,`spec-fields.ts` / `http/admission.ts`);
- *  · 请求的 `settings.permissions.allow`(整份原样投 `TaskSpec.allowedTools`,`task-settings.ts`);
+ *  · 请求的 `settings.permissions.allow`(整份按位置投 `TaskSpec.allowedTools`,`task-settings.ts`;条目也可以是设置层的 `{ rule, layer }`,本文件按它的规则原文读,层只选锚);
  *  · 运维的 `APPROVAL_GRANT`(整份投 `RunnerDeps.allowedTools`,`config.ts` 启动校验)。
  *
  * 本仓在这些表上只剩下面几问(内容形、`*`、写路径形、名字引擎怎么读就怎么算):
- *  ① **形**({@link ruleEntryListShapeOk}):字符串数组。引擎逐条迭代;一个裸字符串会被逐字符读成几条(deny 侧 = 意图静默落空)。
+ *  ① **形**({@link ruleEntryListShapeOk}):字符串数组。引擎逐条迭代;一个裸字符串会被逐字符读成几条(deny 侧 = 意图静默落空)。请求的 allow 桶的形另由桶门判
+ *     (`task-settings.ts` 的 `settingsPermissionBucketIssue`:串或带层条目),它进下面 ③ 时带层条目读成规则原文({@link toolListsOf})。
  *     本谓词不带条数帽(引擎的 `screenAllowedToolsValue` 只判形);条数帽是另一只函数 {@link allowLayerEntryCountIssue}(`MAX_ALLOW_LAYER_ENTRIES`,
  *     请求 allow 桶、技能两只清单、运维表四张表同一只、同一句)。
  *  ② (7.116.0–7.122.x 的「引擎读不到的一形」—— 工具段为空的协议名 `mcp__srv__` 四张表都拒 —— 随 core 7.48.0 [ref] 退役:引擎判官给它判词

package/dist/rule-entry-list.js

@@ -3,6 +3,7 @@ import { displayListEntry } from "./list-entry-display.js";
 import { limitRefusal } from "./limit-refusal.js";
 import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
 import { NOT_IN_ROSTER, entryProblem, entryProblemsFacts } from "./entry-problems.js";
+import { layeredRuleOk } from "./permission-rule-list.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
 const ALLOW_LAYER_OVER_CAP_TAIL = "Refused rather than truncated: a truncated list silently drops the entries past the cap. Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list";
@@ -162,7 +163,10 @@ function* toolListsOf(body) {
     const settings = body["settings"];
     const permissions = isPlainRecord(settings) ? settings["permissions"] : undefined;
     if (isPlainRecord(permissions))
-        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: permissions["allow"] };
+        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: ruleTextsOfBucket(permissions["allow"]) };
+}
+function ruleTextsOfBucket(list) {
+    return Array.isArray(list) ? list.map((x) => (layeredRuleOk(x) ? x.rule : x)) : list;
 }
 function inertReadingOfList(l) {
     const face = TOOL_LIST_FACES[l.layer];

package/dist/rules-consent.d.ts

@@ -219,16 +219,24 @@ export type LocalImportIndeterminateCode =
 /** 兑付走本身没走完(本层抛出/中断)⇒ 这一条连走都没走到。 */
  | "walk_failed";
 /** prepare 面的一行。判别式联合:被收下的行**没有**拒因字段可读,被拒的行**必然**带拒因 ——
- *  「admitted 却带 reason」这种矛盾态在类型上不可表达。 */
+ *  「admitted 却带 reason」这种矛盾态在类型上不可表达。
+ *  收下的**收紧**(deny / ask)在 prepare 当场经直写接缝落店,行带它的结局 `outcome`(`persisted` = 这次写了 / `no-op` = 等价规则已在店);
+ *  收下的**放行**没有 `outcome` —— 它的结局在 redeem 回执里(放行要同意,收紧不等同意;见 `prepareLocalImport`)。 */
 export type LocalImportPreviewMember = {
     key: LocalImportRuleKey;
     admitted: true;
+} | {
+    key: LocalImportRuleKey;
+    admitted: true;
+    outcome: LocalImportTighteningOutcome;
 } | {
     key: LocalImportRuleKey;
     admitted: false;
     reason: LocalImportRefusalCode;
     detail: string;
 };
+/** 一条收紧在 prepare 当场落店的结局(与兑付回执的 `persisted` / `no-op` 同词同义;直写接缝 `addPersistedRule` 的 `added` / `no-op`)。 */
+export type LocalImportTighteningOutcome = "persisted" | "no-op";
 /** 兑付回执的一行。 */
 export interface LocalImportOutcomeMember {
     key: LocalImportRuleKey;
@@ -266,6 +274,14 @@ export type LocalImportPrepared = {
     ok: false;
     reason: "batch-too-large";
     bytes: number;
+}
+/** 一条收紧写不进店(直写接缝答 `failed`)⇒ 这一批的放行全部扣下(不铸记录、不铸票)。`committed` 原样是 core 的两词闭集,
+ *  wire 上与 `POST /v1/rules` 的写失败同一码同一键;此前已落的收紧留着(收紧方向),同一批重发即幂等(已落的答 `no-op`)。 */
+ | {
+    ok: false;
+    reason: "tightening-write-failed";
+    committed: RuleWriteCommitted;
+    detail: string;
 };
 /** A7 redeem 的结果。 */
 export type LocalImportRedeemed = 
@@ -456,13 +472,20 @@ export type CardRulePersisted = {
      *  🔴 不 switch、不翻译、不折叠:词表属主是 core,本仓照转。 */
     code?: string;
 };
-/** 一层用户交上来的 settings(HTTP 载荷已 zod 校验过的形)。 */
-export interface RuleImportLayerInput {
-    layer: ImportedSettingsLayer;
+/**
+ * 一层用户交上来的 settings(HTTP 载荷已 zod 校验过的形)—— 按 `layer` 的联合,与引擎的 `CcImportLayer` 同形:
+ * 用户层**没有** `root`(它的 `/x` 在它自己的配置目录读,引擎不把它带进店;交了 root 的体在边界 400),项目层与本地层带 `root`(规则的作用域根)。
+ */
+export type RuleImportLayerInput = {
+    layer: "userSettings";
+    path: string;
+    content: string;
+} | {
+    layer: Exclude<ImportedSettingsLayer, "userSettings">;
     path: string;
     root: string;
     content: string;
-}
+};
 /**
  * scope 的 **wire 形**:`global` | `project:<root>` 的判别式串([ref] v2 §6 F5「显式成文」)。
  *

package/dist/rules-consent.js

@@ -232,25 +232,14 @@ function buildLocalImportLayers(candidates) {
     const byRoot = new Map();
     for (const c of candidates) {
         const key = c.scope.kind === "global" ? "" : c.scope.root;
-        let bucket = byRoot.get(key);
-        if (bucket === undefined) {
-            bucket = { deny: [], ask: [], allow: [] };
-            byRoot.set(key, bucket);
-        }
-        bucket[c.behavior].push(c.rule);
+        const bucket = byRoot.get(key) ?? [];
+        bucket.push(c.rule);
+        byRoot.set(key, bucket);
     }
-    return [...byRoot].map(([root, lists]) => ({
-        layer: root === "" ? "userSettings" : "projectSettings",
-        path: root === "" ? LOCAL_IMPORT_LAYER_PATH : `${LOCAL_IMPORT_LAYER_PATH}:${root}`,
-        root: root === "" ? "/" : root,
-        readFile: async () => JSON.stringify({
-            permissions: {
-                ...(lists.deny.length > 0 ? { deny: lists.deny } : {}),
-                ...(lists.ask.length > 0 ? { ask: lists.ask } : {}),
-                ...(lists.allow.length > 0 ? { allow: lists.allow } : {}),
-            },
-        }),
-    }));
+    return [...byRoot].map(([root, allow]) => {
+        const readFile = async () => JSON.stringify({ permissions: { allow } });
+        return root === "" ? { layer: "userSettings", path: LOCAL_IMPORT_LAYER_PATH, readFile } : { layer: "projectSettings", path: `${LOCAL_IMPORT_LAYER_PATH}:${root}`, root, readFile };
+    });
 }
 function buildLocalImportMembers(members) {
     return members.map((m) => {
@@ -367,12 +356,10 @@ export function createRuleConsentLane(stores, opts) {
             return { ok: true, kind: "single", rule: redeemed.rule, rev: redeemed.rev, alreadyRedeemed: redeemed.alreadyRedeemed };
         },
         async prepareImport(principal, layers) {
-            const ccLayers = layers.map((l) => ({
-                layer: l.layer,
-                path: l.path,
-                root: l.root,
-                readFile: async () => l.content,
-            }));
+            const ccLayers = layers.map((l) => {
+                const readFile = async () => l.content;
+                return l.layer === "userSettings" ? { layer: l.layer, path: l.path, readFile } : { layer: l.layer, path: l.path, root: l.root, readFile };
+            });
             const { preview, approvalId } = await prepareCcImport({ layers: ccLayers, principal, deps });
             if (approvalId === undefined) {
                 return { ok: true, preview };
@@ -494,16 +481,41 @@ export function createRuleConsentLane(stores, opts) {
                     continue;
                 }
                 seen.add(dedupKey);
+                admitted.push({ at: members.length, row: screened });
                 members.push({ key, admitted: true });
-                admitted.push(screened);
             }
-            if (admitted.length === 0)
+            const allows = [];
+            for (const { at, row: c } of admitted) {
+                const key = members[at].key;
+                const behavior = c.behavior;
+                if (!isDirectWritableRuleBehavior(behavior)) {
+                    allows.push({ ...c, behavior });
+                    continue;
+                }
+                const added = await addPersistedRule({ behavior, rule: c.rule, scope: c.scope, principal, provider: stores.provider });
+                switch (added.status) {
+                    case "added":
+                        members[at] = { key, admitted: true, outcome: "persisted" };
+                        break;
+                    case "no-op":
+                        members[at] = { key, admitted: true, outcome: "no-op" };
+                        break;
+                    case "failed":
+                        localImportLogger.warn("local_import_tightening_write_failed", { behavior, scope: key.scope, committed: added.committed, note: "a deny / ask of this batch did not land — the batch's allows are withheld (no import record, no ticket); sending the same batch again is idempotent" });
+                        return { ok: false, reason: "tightening-write-failed", committed: added.committed, detail: added.error };
+                    default: {
+                        const unknown = added;
+                        throw new Error(`unknown addPersistedRule outcome: ${JSON.stringify(unknown)}`);
+                    }
+                }
+            }
+            if (allows.length === 0)
                 return { ok: true, preview: { members } };
-            const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(admitted), principal, deps });
+            const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(allows), principal, deps });
             const engineKeys = new Set(preview.candidates.map((c) => `${c.behavior}${LOCAL_IMPORT_KEY_SEP}${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
             for (let i = 0; i < members.length; i++) {
                 const m = members[i];
-                if (m === undefined || !m.admitted)
+                if (m === undefined || !m.admitted || "outcome" in m)
                     continue;
                 if (engineKeys.has(`${m.key.behavior}${LOCAL_IMPORT_KEY_SEP}${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
                     continue;

package/dist/run-local.js

@@ -19,7 +19,7 @@ import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
-import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, isRosterGateArmed, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, createConfigProvider } from "./config-provider.js";
@@ -28,6 +28,7 @@ import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-a
 import { composeExecutionLane, settleHostLaneShell, warnReadDenyFloorUnkept } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { logEnvModelsMigration, runEnvModelsMigration } from "./config-root-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
@@ -42,7 +43,7 @@ import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryLayersNamedBy, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemoryScopeStores } from "./memory-scope-stores.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
@@ -52,7 +53,7 @@ import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createPeerDesk } from "./peer-seat.js";
-import { createGovernanceSeams } from "./boot/governance-seams.js";
+import { assertGovernanceAssemblable, createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
 import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { assembleDeploymentMods } from "./boot/deployment-mods.js";
@@ -362,6 +363,8 @@ export async function runLocal(argv, deps = {}) {
         printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
+    const envModelsMigration = { root, env: process.env, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) };
+    logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
     logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     try {
         await composeExecutionLane(config, { configSource: "local", localRoot: root, logger, drivesFromFile: ["host"] });
@@ -393,7 +396,7 @@ export async function runLocal(argv, deps = {}) {
                 for (const d of r.droppedEntries ?? [])
                     logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
                 applying = true;
-                applyEffective(config, r.effective, logger, { leg: "boot" });
+                applyEffective(config, r.effective, logger, { leg: "boot", catalogSource: r.catalogSource });
                 effective = r.effective;
                 candidatePrompts = verdict.prompts;
                 if (effective?.mcp)
@@ -487,7 +490,7 @@ export async function runLocal(argv, deps = {}) {
     const engineDataRoot = fileMemoryEngineRoot(config, root);
     const fileEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     const memoryEngine = fileEngine !== undefined
-        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy({ ...config, memoryScope: args.user ?? "local" }), onIncident: memoryEngineIncident })
+        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, onIncident: memoryEngineIncident })
         : undefined;
     try {
         judgeConsolidationValve({ config, memoryEngine });
@@ -582,6 +585,7 @@ export async function runLocal(argv, deps = {}) {
         ],
         retentionExecutor: null,
     });
+    assertGovernanceAssemblable(config);
     const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
         metrics,

package/dist/runs.d.ts

@@ -4,6 +4,7 @@ import { type EntryProblem } from "./entry-problems.js";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
+import type { RunSkillEntry } from "./capabilities/skills.js";
 import { type RunAbort } from "./run-cancel-context.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import type { ElicitationCoordinator } from "./elicitation.js";
@@ -39,16 +40,15 @@ import type { UserInputLedger } from "./user-input-ledger.js";
  * first-marker-wins guards live inside the seam.
  */
 /** [ref]③(b) + codex R2: the bg agent-handle OUTPUT read, kind-gated BEFORE any poll. `pollTask` is the
- *  generic registry face and polling is NOT side-effect-free for other kinds — a terminal workflow poll
- *  fires `onServedTerminal` (acknowledges the completion as served → suppresses its notification) and a
- *  bash poll advances the output cursor. `getAccessibleTask` is a pure lookup: resolve + access-check +
+ *  generic registry face and polling is NOT side-effect-free for other kinds — a bash poll advances the
+ *  output cursor (and a workflow's read face is its journal, not this one). `getAccessibleTask` is a pure lookup: resolve + access-check +
  *  type-check FIRST; only a `background_agent` row is ever polled (non-blocking). Everything else returns
  *  the registry's own not_found shape, indistinguishable from an unknown handle (the route 404s it).
  *
  *  1.250 durable arm (core 1.364, [ref] follow-up delivered): a FULL in-process miss (`!row`) falls
  *  through to `pollTask(…, { agentStore })` — core's durable arm only fires for `a*`-shaped handles
  *  (DURABLE_AGENT_HANDLE_RE) behind `canAccessAgentRecord`, and with NO in-process handle the live
- *  workflow/bash branches are unreachable, so the kind-gate's reason (onServedTerminal / cursor advance)
+ *  workflow/bash branches are unreachable, so the kind-gate's reason (cursor advance / the journal owning workflow reads)
  *  cannot trigger. Terminal rows serve the durable snapshot cross-instance/post-restart; a foreign-writer
  *  running row answers the honest "outcome unknown here"; anything else is core's own not_found (byte-same
  *  route 404 as today). A row that IS in-process but of the wrong type stays a hard 404 — the process
@@ -372,9 +372,8 @@ approval?: {
     executionLane: import("./execution-lane-caps.js").ExecutionLane;
 }, 
 /** 本腿结算用的 checkpoint 店(`deps.checkpointStore`),两件事:①[ref] park 投影腿的读口 —— 在场时 durable park 的
- *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②验证门结算时作废验证器自己的停驻卡
- *  ({@link voidVerifierPauseCard}:本服务兑现不了的卡不留在待决面上);③停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
- *  缺席 ⇒ ①旧字节逐字不变;②③带凭据的停驻响亮留痕、卡由兜底收割。 */
+ *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
+ *  缺席 ⇒ ①旧字节逐字不变;②带凭据的停驻响亮留痕、卡由兜底收割。(验证器自己的停驻卡不经本店:结算时交本腿的 Runner 动词,见 {@link voidVerifierPauseCard}。) */
 checkpointCards?: ParkCheckpointReader & CardVoidPort, 
 /** [ref]:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
  *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
@@ -412,7 +411,12 @@ acceptance?: RunAcceptance,
  * 会话行的位置与项目那一格的记录座(`session-workspace.ts`;唯一写者):普通流形逐帧喂(这条腿自己的 `workspace_changed` 排一次写),
  * `done` 时等写落定再落终局。只回结果的 verify / cascade 形宿主手里没有流 ⇒ 不记。缺席 ⇒ 不记行(与本参数存在之前逐字相同)。
  */
-workspaceRecorder?: SessionWorkspaceRecorder): Promise<void>;
+workspaceRecorder?: SessionWorkspaceRecorder, 
+/**
+ * 这条 run 交给引擎的技能名册(`wiring_manifest.skills` 段;部署事实 `LegFacts.skills`,`leg-facts.ts`:受理漏斗在复制之前读出)。
+ * 缺席 = 嵌入方自带的装配器没铸 ⇒ 账本行不带技能段。
+ */
+runSkills?: readonly RunSkillEntry[]): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -9,7 +9,6 @@ import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
 import { withModelReachScope } from "./model-reach-scope.js";
-import { runSkillsOf } from "./capabilities/skills.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
@@ -18,7 +17,7 @@ import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
 import { buildCancelledLedgerRow, CANCELLED_CODE, createRunAbort, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
-import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
+import { fleetRunResiduals } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { isParkLedgerEventType } from "./trace/ledger-events.js";
@@ -93,6 +92,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.memory_project_marker": 409,
     "config.memory_project_marker_nested": 409,
     "config.read_deny_floor_unkept": 409,
+    "config.mcp_server_name_collision": 409,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
@@ -277,7 +277,7 @@ export async function voidHeldParkCard(held, hostSessionId, cards, leg) {
         return;
     await voidPendingCard({ token: held.terminal.token, sessionId: hostSessionId }, cards, "server.park.held-card-void-failed", `leg=${leg}`);
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder, runSkills) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -375,7 +375,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         acceptance?.settle(safe);
     };
     const instructionLeg = createInstructionSelectionLeg();
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(spec) }), usage: { modelUsage, taskId } });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkills }), usage: { modelUsage, taskId } });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     const flushModelUsage = () => appendModelUsageDelta(append, modelUsage, taskId);
@@ -430,9 +430,8 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                         defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                     }
-                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPublisher?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                     const parked = !legLive && Boolean(workflowCompletionInbox && spec.sessionId);
-                    completionDiagLog?.("task_notification_observed", { route: "bg-run-start", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive, parkedDurable: parked });
+                    completionDiagLog?.("task_notification_observed", { route: "bg-run-start", taskId: n.task_id, taskType: n.task_type, status: n.status, legLive, parkedDurable: parked });
                     if (parked) {
                         void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
@@ -467,7 +466,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 const result = await compositeLeg();
                 observedDone = result;
                 causeAtDone = cancelCtrl.cause();
-                await voidVerifierPauseCard(result, checkpointCards);
+                await voidVerifierPauseCard(result, runner);
                 await flush();
                 await flushPromptManifest();
                 await settleLegResult(result);

package/dist/runtime-governance.d.ts

@@ -230,7 +230,7 @@ export interface GovernancePosture {
  * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
  * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
  * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)、`parentToolCallId` 与这一问的
- * 类集([ref]);前两维从 checkpoint 行推不出来,类集在 park 行上老行缺席、续跑不补 —— 二腿/子代/老行形上会算出一个
+ * 类集([ref])与展示的动作(工具名 + 入参摘要,7.143.0);前两维从 checkpoint 行推不出来,类集在 park 行上老行缺席、续跑不补 —— 二腿/子代/老行形上会算出一个
  * **错**的 id —— 在「等的谁」这条通道上,错 id 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
  */
 export declare function governanceOriginOf(gate: {

package/dist/server-secret-env.d.ts

@@ -76,6 +76,10 @@ export declare function serverCredentialValueSources(modelApiKeyEnv?: ModelApiKe
  *    `holdOwnCredentialValues` 同一姿势:不收 + 说一次),经留痕座结构化点名那个变量一次 —— `warn` 行 `own_credential_value_not_withheld { name, reason }`
  *    ({@link recordOwnCredentialValueNotWithheld};`reason` 是引擎拒句原文,从不回显值;起服第一步还没有 logger 时当拍经进程默认的 JSON 行日志器写 stderr,不缓冲),能力位 `inherit_env.own_credential_values_withheld`
  *    因此答 false(位真 ⇔ 值臂真扣)。引擎拒一个值时声明保持上一份,所以逐个交表的中间态都是上一份的超集。
+ *    🔴 **这一行是本服务唯一的写者**:值是网关密钥(`MODEL_API_KEY` / `ANTHROPIC_API_KEY`)时,进程输出里另有一行**引擎**的裸 `console.warn`(`a credential the engine was handed is …`)——
+ *    它写在 `createOpenAIBrain` / `createAnthropicBrain` 的收值口,那个口没有通告席(适配器配置没有 `onNotice`;`holdOwnCredentialValues` 不在 core 根导出),core 把这一形记为已知限制。
+ *    本仓不在引擎外面吞 console、也不拿声明口去抢引擎的「每进程每值说一次」账(下游不改上游座的语义);等 core 给席或让声明口的拒收记作已说。读数与翻面条件:
+ *    `test/own-credential-value-boot-lines.test.ts`(真主进程;零裸行的期望以 `it.fails` 立着,core 改形那天转红再翻成常规钉)。
  * 返回声明的名单(只名、不值)。
  */
 export declare function declareServerWithheldEnv(modelApiKeyEnv?: ModelApiKeyEnvTable): readonly string[];

package/dist/session-error-wire.d.ts

@@ -102,6 +102,18 @@ export declare class StampedSessionArchiveError extends SessionError {
     readonly sessionId: string;
     constructor(sessionId: string);
 }
+/**
+ * local 店的具名拒(唯一铸点 `plugins/local-session-store.ts` 的 `metaRead`):这只会话的**属主读不出**。会话的行事实(属主 / 化身)只住在会话元数据边档的那一格;
+ * 7.104.0 之前写下、此后从没被读过的会话没有这一格,要从存档补铸它(第一次读时的惯例),存档又用不了(会话头坏 / 截断 / 日志结构走不通)——
+ * 于是没有任何一位调用方能被判成它的属主。要读它的行事实的店方法(`headOf` / 执行席的读 / 会话元数据读口)抛本错。
+ *
+ * 码与句子**就是**那只存档故障的(`cause` = 它;码不另铸 —— 只会是 `corrupt_session` / `invalid_session`,读不出而说不出在不在的 I/O 级故障不换型):
+ * 不认识本型的站点看到的与此前逐字相同(`sessionErrorHttp` 按码映射,wire 与运维日志不变)。认识本型的站点 —— 会话读面的属主读
+ * (`http/owner-access.ts` 的 `foldOwnerUnreadable`)—— 把它读成「没有这一行」:与对非属主、对不存在的会话同一只 404,原故障进运维日志。
+ */
+export declare class SessionOwnerUnreadableError extends SessionError {
+    constructor(code: "corrupt_session" | "invalid_session", fault: SessionError);
+}
 /** {@link StampedSessionArchiveError} 的 wire 固定句(fork 与改日志的推送同一句;不点名会话 id;出路在句里 —— 从头再同步照样撞)。 */
 export declare const STAMPED_SESSION_ARCHIVE_SENTENCE = "this session's stored archive still carries an owner stamp written by an earlier server version, so it cannot be forked or have its log replaced; nothing was written \u2014 delete the session and push it again";
 /**

package/dist/session-error-wire.js

@@ -13,6 +13,12 @@ export class StampedSessionArchiveError extends SessionError {
         this.name = "StampedSessionArchiveError";
     }
 }
+export class SessionOwnerUnreadableError extends SessionError {
+    constructor(code, fault) {
+        super(code, fault.message, fault);
+        this.name = "SessionOwnerUnreadableError";
+    }
+}
 export const STAMPED_SESSION_ARCHIVE_SENTENCE = "this session's stored archive still carries an owner stamp written by an earlier server version, so it cannot be forked or have its log replaced; nothing was written — delete the session and push it again";
 const CORRUPT_SESSION = { status: 500, errorCode: "corrupt_session" };
 const STORED_LOG_INVALID = { status: 500, errorCode: "invalid_session" };

package/dist/session-incarnation.d.ts

@@ -11,7 +11,7 @@
  *    所以化身与属主不是同一条律(读法分三种,见下「两读」)。删除随行消失,同 id 重新登记铸新的。
  *  · **两读(住客的三种问法,各读各的格,不混用)**:
  *    K1 **住客自己的记录**(工作区、记忆、空间分区……按「这一位住客」落的东西)只按化身绑 —— 同一位住客的属主换代(推送重戳 / 认领)不换住客,记录照落;
- *    K2 **以「这一行的这一代」为条件的写**(执行放置的换绑 / 收回、执行上下文的复核)比属主与化身整对,判官 = core 的行期望判官 `sessionRowMatches`
+ *    K2 **以「这一行的这一代」为条件的写**(执行放置的换绑 / 收回、执行上下文的复核、会话通知门投递前的复核 —— 条目按属主排空)比属主与化身整对,判官 = core 的行期望判官 `sessionRowMatches`
  *    (`execution-placement.ts` 的 `sameOccupant`,SQL `incarnation = ? AND owner <=> ?` 的对位)—— 读与写之间属主换了一代 ⇒ 不是判过的那一行;
  *    K0 **只问属主的门**(授权门、暂存提交的属主 CAS)只读属主那一格。三种都读会话**行**;local 店的行 = 会话元数据边档那一格(引擎仓里的存档是匿名内容仓,
  *    存档头上的属主不是行事实 —— `plugins/local-session-store.ts` 头注)。

package/dist/session-notify-door.d.ts

@@ -0,0 +1,106 @@
+/**
+ * 🔴 **会话通知门 —— 一只会话外的事件进一只会话,只有这一处,两臂**。
+ *
+ * ## 门
+ *  · **目标** = 会话 + 调用方判过的那一位住客(那一次头读的属主与化身令牌)+ 那一位无主时条目盖谁。门**不**替调用方判授权(属主门在调用方);门只保证交到的是那一位。
+ *  · **活**:这只会话在本副本有活流 —— 判据一读:`runStore.getActiveTaskId(会话)` 交回的 run 在本副本的活流登记簿里(`steerableRuns`,属主是 HTTP 服务)
+ *    ⇒ core `TaskStream.notify(事件, { priority: "next" })`。core 铸 `task_type: "external"`(外来的事件穿不上引擎内部车道的类型),载荷校验 / 消毒 / 围栏全在
+ *    core;档位**写死** `"next"`(最早边界投递;core 的无参缺省是收官座 `"later"`,不写就静默推迟到 run 收尾)。core 的明确拒(码以 `notify.` 开头)原样交回;
+ *    别的抛 = 活流刚收尾的竞态 ⇒ 落空闲臂。
+ *  · **空闲**:这只会话的完成收件箱(`externalNotificationInboxEntry`,external 键域;脱敏 / 限长在入箱口内)⇒ 下次开流排空成 `task_notification` 帧。
+ *    部署没有收件箱 ⇒ 如实交回 `no_inbox`(调用方各自答:HTTP 门 501,引擎完成告警)。
+ *  · **复核住客**:两臂的投递动作(注入 / 入箱)之前**紧邻**一次头读,与目标的住客比 —— 判官是仓里那一只 `sameOccupant`(`execution-placement.ts`:属主 ∧ 化身,
+ *    写口与执行上下文解析器判的也是它):不在 ⇒ `withdrawn: gone`;两样里任一样变了 ⇒ `withdrawn: replaced`。会话店不铸化身(嵌入方自建的店)时两侧都没有令牌,
+ *    判官只剩属主那一半:属主没变 ⇒ 投,变了 ⇒ 撤回。这一读是动作之前的最后一次让出:判活读(及活臂刚收尾时的那次注入)都在它前面 ——
+ *    令牌永不复用,此刻还是那一位 ⇒ 判活读那一刻也是那一位 ⇒ 判出的 run 是它的 run。
+ *  · **条目属主** = 目标住客的属主(调用方判过的那一读;复核放行 ⇒ 与这一读的属主逐字相等);那一位无主 ⇒ `ownerlessEntryOwner`(调用方交)。
+ *
+ * ## 竞态(两个调用方同一句话,只写在这里)
+ *  · 判活之后、注入之前活流收尾:core 对已收尾的 run 不抛,按会话暂存、本进程同一会话的下一个 run 开轮时投递(core `notify` 契约);抛了 ⇒ 空闲臂(入箱前再复核一次)。
+ *  · 判空闲之后、入箱之前同一会话开了新流:新腿开流那一拍的排空可能已读过收件箱 ⇒ 这一条在**再下一次**开流排空(至少一次,晚一次开流)。
+ *  · 跨副本:活流在别的副本 ⇒ 本副本判空闲 ⇒ 入箱(收件箱随 run 店同一后端,哪个副本开流都排得到)。
+ *  · 复核之后、入箱写落库之前别的副本删了这只会话并同 id 重新登记:条目带的是判过那一位的属主 —— 排空时按属主比开流者,另一位属主排不到;
+ *    同一属主重新登记的那一只会排到它(余窗 = 一次入箱写的时长;这一形不再收窄)。
+ *
+ * ## 调用方(两只,都经 {@link SessionNotifyDoor.deliver},不各写一份臂)
+ *  · `POST /v1/sessions/:id/notify`(`http/routes/notify-wake.ts`):入站鉴权、验型、属主门在路由;属主 = 会话行的属主。
+ *  · **Runner 之外的后台子代完成**({@link createBackgroundCompletionRelay}):停驻赎回腿的复活、操作员 `handle.resume` —— 这些续跑不是哪一次 run 内的调用,
+ *    没有调用车道(`ToolExecuteContext.onTaskNotification`),引擎把完成交给委派工具挂载期的 `background.notify`;那只 sink 在 `capabilities/scenarios.ts` 接一次,
+ *    交到委派树根会话的这只门。Runner 之内的调用照旧走调用车道(引擎 `resolveCompletionSink` = 调用 ?? 挂载),这只门不经手。
+ */
+import type { ExternalNotificationInput, SessionHead, SubagentToolOptions, TaskStream } from "@sema-agent/core";
+import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
+import type { DelegationRootWitness } from "./delegated-session-owner.js";
+import type { HeadRead } from "./session-incarnation.js";
+import type { Logger } from "./observability/logger.js";
+/** 门的一次投递结局(闭集;调用方 `switch` 穷尽)。 */
+export type SessionNotifyOutcome = {
+    readonly delivery: "live";
+} | {
+    readonly delivery: "parked";
+}
+/** core 的明确拒(`notify.invalid_payload` 等):码与句原样。 */
+ | {
+    readonly delivery: "refused";
+    readonly code: string;
+    readonly message: string;
+}
+/** 会话空闲而部署没有收件箱:这一条无处可放。 */
+ | {
+    readonly delivery: "no_inbox";
+}
+/** 投递动作之前的复核:会话不在(`gone`)/ 住客不是目标那一位(`replaced`)⇒ 没交。 */
+ | {
+    readonly delivery: "withdrawn";
+    readonly reason: "gone" | "replaced";
+};
+/** 投递目标。 */
+export interface SessionNotifyTarget {
+    readonly sessionId: string;
+    /** 调用方判过的那一位住客:那一次头读的属主与化身令牌(化身缺席 = 那一读里没有令牌;复核见头注)。它的属主也是收件箱条目的属主(排空时与开流者比对)。 */
+    readonly occupant: Pick<SessionHead, "owner" | "incarnation">;
+    /** 那一位无主(`occupant.owner === null`)时条目盖的属主(`null` = 无主条目,谁开流都排)。 */
+    readonly ownerlessEntryOwner: string | null;
+}
+export interface SessionNotifyDoor {
+    deliver(target: SessionNotifyTarget, event: ExternalNotificationInput): Promise<SessionNotifyOutcome>;
+}
+/** 门要读的四样(都由 HTTP 服务交:活流登记簿是它的,run 店、会话店与收件箱是它的依赖)。 */
+export interface SessionNotifyDoorIo {
+    /** 会话 → 它的在飞 run(run 店的单活认领读)。部署没有 run 店 ⇒ 交 `undefined` ⇒ 恒判空闲。读失败按空闲。 */
+    readonly activeTaskIdOf: (sessionId: string) => Promise<string | null | undefined>;
+    /** 本副本持活 core 流的腿(taskId → 流)。 */
+    readonly liveRuns: ReadonlyMap<string, Pick<TaskStream, "notify">>;
+    readonly inbox: WorkflowCompletionInbox | undefined;
+    /** 会话店的按 id 头读(复核住客的那一读)。店没有 ⇒ `undefined`:调用方先判(路由 501;后台完成 relay 照交,门响亮抛 ⇒ relay 告警)。 */
+    readonly headOf: HeadRead | undefined;
+}
+export declare function createSessionNotifyDoor(io: SessionNotifyDoorIo): SessionNotifyDoor;
+/** 委派工具挂载期的完成 sink 的型(取自 core 的选项型,不手抄)。 */
+export type BackgroundCompletionSink = NonNullable<NonNullable<SubagentToolOptions["background"]>["notify"]>;
+/** 把一只委派树根见证变成挂载期 sink 的工厂(`ScenarioDeps.backgroundCompletionSinkFor` 的型)。 */
+export type BackgroundCompletionSinkFor = (root: DelegationRootWitness) => BackgroundCompletionSink;
+export interface BackgroundCompletionRelayIo {
+    /** 会话通知门。门的属主是 HTTP 服务、场景层先于它装配 ⇒ 晚绑取值;未绑 ⇒ 交不出去(告警)。 */
+    readonly door: () => SessionNotifyDoor | undefined;
+    /** 交不出去的那一行告警写到这里(本仓的 `Logger`:写口自己吞掉输出故障、不抛 —— relay 的收尾臂依赖这一条)。 */
+    readonly logger: Pick<Logger, "warn">;
+}
+/** 交不出去的成因(闭集;告警 `background_completion_undelivered` 的 `reason`)。 */
+export type BackgroundCompletionUndelivered = "root_gone" | "root_replaced" | "door_unbound" | "refused" | "no_inbox" | "relay_failed";
+/**
+ * **Runner 之外的后台子代完成 → 委派树根会话的会话通知门**(挂载期 `background.notify` 的唯一实现)。
+ *
+ *  · **地址** = 场景层交出的委派树根见证(`ScenarioContext.delegationRoot`:会话 id + 判断那一刻的根住客)—— 停驻赎回面按行上的 `rootSessionId`
+ *    与赎回腿写口放行的那一位住客交,请求腿按本请求会话与受理时那一读交;不读完成帧上的任何键定址。一层行的根就是父会话;更深的行(孙代)报给根 ——
+ *    委派终态的受众是整棵委派树的根会话(孙代的父是一只没人开流的委派会话,交给它等于没交)。
+ *  · **目标住客 = 见证的那一位**(属主与化身,见证铸点那一读):门在投递动作之前紧邻地复核(头注「复核住客」)—— 不在 ⇒ 不交(`root_gone`);
+ *    不是见证的那一位(删了、同 id 被重新登记、属主变了)⇒ 不交(`root_replaced`):这棵树的结果不交给同 id 的下一位住客。条目属主 = 见证的属主;
+ *    根无主 ⇒ 无主条目(relay 不是谁的请求,没有请求主体可落)。见证那一读里根行不在(化身 `null`)⇒ 目标住客 = 「无主、无令牌」,只有不铸化身的店上
+ *    此刻也无主的根与它同(铸化身的店上它恒不同 ⇒ 不交,与停驻挂点「见证不在而根在 ⇒ 否决」同向)。
+ *  · **事件** = 完成帧的 `task_id` / `status` / `summary` / `result` / `seq`(后台子代的 `seq` = 停驻周期号,同一只子代两次复活的完成在收件箱折叠键上不相撞)。
+ *    帧上别的键不过门:门的事件型只有这几位(活臂 core 铸 external,空闲臂入箱同一形),两臂一个形。
+ *  · 交不出去一律一行 warn(`background_completion_undelivered`,带成因),不抛回引擎(sink 是 fire-and-forget)。
+ */
+export declare function createBackgroundCompletionRelay(io: BackgroundCompletionRelayIo): BackgroundCompletionSinkFor;
+//# sourceMappingURL=session-notify-door.d.ts.map