@sema-agent/server 7.144.0 → 7.146.0

package/dist/peer-directory.js

@@ -14,7 +14,9 @@ export function createPeerDirectory(ctx) {
         listPeerSessions: async (access) => {
             const scope = access.scope;
             const includeUnowned = legacyUnownedAmnestyOpen({ requirePrincipal }, scope);
-            const rows = await lister({ owner: scope, ...(includeUnowned ? { includeUnowned: true } : {}), limit: PEER_DIRECTORY_CAP + 1 });
+            const answers = await lister({ owner: scope, ...(includeUnowned ? { includeUnowned: true } : {}), limit: PEER_DIRECTORY_CAP + 1 });
+            const rows = answers.map((a) => a.row);
+            const occupantOf = new Map(answers.map((a) => [a.row.sessionId, a.occupant.incarnation ?? null]));
             const truncated = rows.length > PEER_DIRECTORY_CAP;
             if (truncated) {
                 logger.warn("peer_directory_truncated", {
@@ -88,6 +90,7 @@ export function createPeerDirectory(ctx) {
                     where: "hosted",
                     ...(tempo !== undefined ? { tempo } : {}),
                     inboundPosture: posture,
+                    occupant: occupantOf.get(r.sessionId) ?? null,
                 });
             }
             if (ungrammatical > 0) {
@@ -129,6 +132,7 @@ export function createPeerDirectory(ctx) {
                     where: "hosted",
                     diedAt: t.retiredAt,
                     inboundPosture: posture,
+                    occupant: null,
                 });
             }
             return out;

package/dist/plugins/approval-ask-store-file.d.ts

@@ -130,6 +130,11 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     private journalV1Records;
     /** 盘上还有 v1 信封记录(随 M34):重放到 v1 记录时置位,任何一次压实(整本重写成 v2)清位 —— 已被压实过的账本不再为升级重写第二次。 */
     private journalV1OnDisk;
+    /**
+     * 盘上还有删行记录({@link ROW_REMOVAL_OPS}):写下一条 / 重放到一条时置位,任何一次压实(整本重写成快照)清位 —— 与 {@link journalV1OnDisk} 同形。
+     * 置位期间压实到期(顶注「压实」段的起因 ②):同一拍压实;压实失败 ⇒ 位留着,下一次写(或下一次起服)再试。
+     */
+    private removalRecordsOnDisk;
     /** 本次启动隔离出去的原件路径(无坏字节 ⇒ `undefined`)。 */
     readonly corruptQuarantinePath: string | undefined;
     /**
@@ -159,11 +164,16 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      * 代价如实:不可编码的值(BigInt / 循环引用)在本形上**抛**,而 InMemory 形收得下 —— 那与 SQL 孪生
      * 同向(它也存不下),是**介质事实**,写进顶注的边界段。
      *
-     * 🔴 **压实失败不许落到调用方头上**(替补对抗复审 F3 [medium],实测后修):走到 `maybeCompact()` 时这
+     * 🔴 **压实失败不许落到调用方头上**(替补对抗复审 F3 [medium],实测后修):走到 {@link compactOrRecord} 时这
      * 一次写**已经 fsync 落盘、也已经翻进内存**,把一次纯管家动作的 I/O 错误抛给调用方 = 把一次已生效的
      * 人类批准报成失败(客户端重试会拿到 `ask_not_pending`)。压实是 F 类兜底:失败留痕、下一次写再试。
+     * 两个起因同一条:删行记录引起的压实失败,位({@link removalRecordsOnDisk})留着,下一次**任何**写(与下一次起服)再试 ——
+     * 不是等下一次真删了行的调用。三只删行动词的内核体全是同步前缀,所以走到这里时被删的行已经不在内存里,快照里没有它们。
      */
     private write;
+    /** 压实到期就压实;失败 ⇒ 登记过的 F 类兜底(计数 + 留痕),不上抛 —— `write()` 尾段与起服各调一次,同一句话。 */
+    private compactOrRecord;
+    /** 压实是否到期(顶注「压实」段两个起因)。到期 ⇒ 压实;失败原样抛给 {@link compactOrRecord}。 */
     private maybeCompact;
     /** 整本重写成行快照 + 原子替换。失败 ⇒ 原账本原样留着、`records` 不动(下一次写再试),日志由
      *  core 的 [ref] 惰性重开接住 —— 一次瞬时 I/O 错误绝不把这条日志变成砖。 */
@@ -193,8 +203,12 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     abortBatch(batchId: string): Promise<string[]>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
+    /** 删一个 run 名下的全部问行与批行。与两只留存动词同律:内核的纯读选择为空 ⇒ 不落账本、不压实;否则「先落账、再翻内存」并同拍压实(顶注「压实」段起因 ②)。 */
     deleteByTask(taskId: string): Promise<void>;
-    /** 留存律的问行半场(谓词在内核,见接口注)。空的一次(内核的纯读选择为空)不落账本、不碰内存;否则照常「先落账、再翻内存」。 */
+    /**
+     * 留存律的问行半场(谓词在内核,见接口注)。空的一次(内核的纯读选择为空)不落账本、不碰内存、不压实;否则照常「先落账、再翻内存」,
+     * 并在 `write()` 尾段同一拍压实(顶注「压实」段起因 ②)—— 选择非空 ⇒ 内核同步前缀里必删 ≥ 1 行,被删行的字节不留在盘上。
+     */
     reapSettledAsks(cutoffMs: number, limit: number, keepAnchors: ReadonlySet<string>): Promise<number>;
     /** 留存律的批行半场(同上)。 */
     reapEmptyBatches(cutoffMs: number, limit: number): Promise<number>;

package/dist/plugins/approval-ask-store-file.js

@@ -28,6 +28,7 @@ const JOURNAL_OPS = [
 ];
 const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
+const ROW_REMOVAL_OPS = new Set(["reapSettledAsks", "reapEmptyBatches", "deleteByTask"]);
 const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
 const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
 const JOURNAL_ENVELOPE = 2;
@@ -94,6 +95,7 @@ export class FileApprovalAskStore {
     corruptLineCount = 0;
     journalV1Records = 0;
     journalV1OnDisk = false;
+    removalRecordsOnDisk = false;
     corruptQuarantinePath;
     constructor(root) {
         const dir = join(root, APPROVAL_ASK_DIR);
@@ -117,6 +119,9 @@ export class FileApprovalAskStore {
                 `and rewrote the live journal from the replayed state. A dropped record is a LOST approval-ask transition: inspect the quarantined file.`);
             this.compact();
         }
+        else if (this.removalRecordsOnDisk) {
+            this.compactOrRecord();
+        }
     }
     clockRead() {
         const pinned = this.pinnedNow;
@@ -136,6 +141,8 @@ export class FileApprovalAskStore {
         const onDisk = { v: JOURNAL_ENVELOPE, k: "op", t, ...callToDisk(encoded) };
         this.logFor().append(onDisk, true);
         this.records += 1;
+        if (ROW_REMOVAL_OPS.has(call.op))
+            this.removalRecordsOnDisk = true;
         this.pinnedNow = t;
         let out;
         try {
@@ -144,15 +151,22 @@ export class FileApprovalAskStore {
         finally {
             this.pinnedNow = null;
         }
+        this.compactOrRecord();
+        return out;
+    }
+    compactOrRecord() {
         try {
             this.maybeCompact();
         }
         catch (e) {
             recordFailOpen("server.approval-ask-journal.compaction-failed", `path=${this.path} err=${e instanceof Error ? e.message : String(e)}`);
         }
-        return out;
     }
     maybeCompact() {
+        if (this.removalRecordsOnDisk) {
+            this.compact();
+            return;
+        }
         if (this.records < ASK_JOURNAL_COMPACT_MIN_RECORDS)
             return;
         const snapshot = this.core.exportRows();
@@ -168,6 +182,7 @@ export class FileApprovalAskStore {
         this.log?.closeForSwap();
         atomicWriteFile(this.tmpDir, this.path, lines.join(""));
         this.journalV1OnDisk = false;
+        this.removalRecordsOnDisk = false;
         this.records = lines.length;
     }
     replayRecord(disk) {
@@ -203,6 +218,8 @@ export class FileApprovalAskStore {
             refuse("unknown record kind");
         if (typeof probe.op !== "string" || !JOURNAL_OP_WORDS.has(probe.op))
             refuse("verb outside this build's closed set (a DOWNGRADE: a newer server wrote it)");
+        if (typeof probe.op === "string" && ROW_REMOVAL_OPS.has(probe.op))
+            this.removalRecordsOnDisk = true;
         if (typeof probe.t !== "number" || !Number.isFinite(probe.t))
             refuse("call record without a clock reading");
         if (probe.op === "claimTerminal" && !JOURNAL_V1_CLAIM_INTENT_WORDS.has(String(raw.intent)))
@@ -301,6 +318,9 @@ export class FileApprovalAskStore {
         return this.write({ op: "resolveProvisional", askId, from, to, patch }, (c) => this.core.resolveProvisional(c.askId, c.from, c.to, c.patch));
     }
     async deleteByTask(taskId) {
+        const plan = this.core.planDeleteByTask(taskId);
+        if (plan.askIds.length === 0 && plan.batchIds.length === 0)
+            return;
         return this.write({ op: "deleteByTask", taskId }, (c) => this.core.deleteByTask(c.taskId));
     }
     async reapSettledAsks(cutoffMs, limit, keepAnchors) {

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -16,8 +16,9 @@
  *  · {@link InMemoryApprovalAskStore.exportRows} / {@link InMemoryApprovalAskStore.importRows} —— 压实用的
  *    整本快照口(纯搬行,不经任何谓词)。压实要把「一串调用」折成「一串终局行」,没有这一对就只能在
  *    File 形里另写一套「哪些行还算数」的判据 —— 那才是第二份手抄。
- *  · {@link InMemoryApprovalAskStore.planReapSettledAsks} / {@link InMemoryApprovalAskStore.planReapEmptyBatches} —— 两只留存动词的
- *    **纯读选择**(删哪些行)。File 形据它判「这一次有没有东西可删」,空的一次不落账本;删除本身仍是接口动词,与选择共用这一只。
+ *  · {@link InMemoryApprovalAskStore.planReapSettledAsks} / {@link InMemoryApprovalAskStore.planReapEmptyBatches} /
+ *    {@link InMemoryApprovalAskStore.planDeleteByTask} —— 三只删行动词的**纯读选择**(删哪些行)。File 形据它判「这一次有没有东西可删」,空的一次不落账本;
+ *    删除本身仍是接口动词,与选择共用这一只。
  *  · {@link InMemoryApprovalAskStore.peekAsk} —— 一行的**同步**点读(纯读,零判定)。File 形在写口的同步前缀里据它判「这次决议在不在
  *    属主域内」(出域的一次不落账本)、重放时据它喂行自己的属主([ref],理由在 File 形的 `decideAsk`)。
  *
@@ -118,6 +119,11 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
     deleteByTask(taskId: string): Promise<void>;
+    /** {@link deleteByTask} 会删哪些行(纯读,零写;选择与删除共用这一只,没有第二份谓词)。 */
+    planDeleteByTask(taskId: string): {
+        readonly askIds: readonly string[];
+        readonly batchIds: readonly string[];
+    };
     getBatch(batchId: string): Promise<BatchRow | null>;
     /**
      * 留存律的问行半场(谓词见接口注,与 SQL twin 的 `DELETE … LIMIT` 同答)。方法体全同步(零 `await`)⇒ File 形把它当一次落账的调用

package/dist/plugins/approval-ask-store-memory.js

@@ -365,14 +365,17 @@ export class InMemoryApprovalAskStore {
         return true;
     }
     async deleteByTask(taskId) {
-        for (const [id, r] of this.asks) {
-            if (r.taskId === taskId)
-                this.asks.delete(id);
-        }
-        for (const [id, b] of this.batches) {
-            if (b.taskId === taskId)
-                this.batches.delete(id);
-        }
+        const plan = this.planDeleteByTask(taskId);
+        for (const id of plan.askIds)
+            this.asks.delete(id);
+        for (const id of plan.batchIds)
+            this.batches.delete(id);
+    }
+    planDeleteByTask(taskId) {
+        return {
+            askIds: [...this.asks.values()].filter((r) => r.taskId === taskId).map((r) => r.askId),
+            batchIds: [...this.batches.values()].filter((b) => b.taskId === taskId).map((b) => b.batchId),
+        };
     }
     async getBatch(batchId) {
         const b = this.batches.get(batchId);

package/dist/plugins/caching-session-store.d.ts

@@ -68,7 +68,9 @@ export declare class CachingSessionStore implements SessionStore {
         limit: number;
         q?: string;
     }) => Promise<SessionListItem[]>;
-    readonly fork?: (sourceId: string, owner: string | null) => Promise<string | null>;
+    /** 带住客的同一只列表面(原样转发;理由同 listSessions)。 */
+    readonly listSessionRows?: OwnerAwareSessionStore["listSessionRows"];
+    readonly fork?: OwnerAwareSessionStore["fork"];
     /** fork 续写的店契约(原样转发;与 fork 同理绕过暖缓存 —— 读写的是持久行,新 id 本来就不在缓存里)。 */
     readonly forkTo?: OwnerAwareSessionStore["forkTo"];
     /** 执行席(原样转发:放置是会话**行**上的一格,缓存只缓存会话日志的暖句柄,不缓存行格 —— 读与写都直达内层店)。 */
@@ -116,6 +118,9 @@ export declare class CachingSessionStore implements SessionStore {
      *  裸店、不经本包装,但 security.ts 的 OwnerAwareSessionStore 契约列了它 —— 经 sessionStorage 消费的
      *  未来调用方不该静默 no-op,与 beginImportStaging 同批补齐(同一类白名单缺口)。 */
     readonly sweepStagingSessions?: () => Promise<number>;
+    /** 带戳存档的早拒口(local 店独有;`OwnerAwareSessionStore.assertArchiveAnonymous`),读持久存档头、不经暖缓存。
+     *  🔴 必须转发(与 staging 族同一条教训):默认部署把真店包进本类,会话同步第一阶段的路由读到的是包装层 —— 不转发 = 这一口在默认部署上静默不发(第一阶段仍答通用冲突),没有任何一处报错。 */
+    readonly assertArchiveAnonymous?: (sessionId: string) => Promise<void>;
     /** 2c session-sync (§7/§8) — delegated IDEMPOTENT replace; like importEntries it writes durable state under
      *  `sessionId`, so a stale warm handle for that id is evicted on success (next acquire re-wakes from the new log). */
     readonly replaceEntries?: (sessionId: string, owner: string | null, entries: SessionTreeEntry[]) => Promise<void>;

package/dist/plugins/caching-session-store.js

@@ -10,6 +10,7 @@ export class CachingSessionStore {
     headOf;
     register;
     listSessions;
+    listSessionRows;
     fork;
     forkTo;
     executionPlacement;
@@ -29,6 +30,7 @@ export class CachingSessionStore {
     importEntries;
     beginImportStaging;
     sweepStagingSessions;
+    assertArchiveAnonymous;
     replaceEntries;
     retention;
     placements;
@@ -57,6 +59,8 @@ export class CachingSessionStore {
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.listSessions)
             this.listSessions = ownerAware.listSessions.bind(inner);
+        if (ownerAware.listSessionRows)
+            this.listSessionRows = ownerAware.listSessionRows.bind(inner);
         if (ownerAware.sessionSummaryOf)
             this.sessionSummaryOf = ownerAware.sessionSummaryOf.bind(inner);
         if (ownerAware.writeSessionRowCells)
@@ -85,6 +89,8 @@ export class CachingSessionStore {
             this.listEntryIds = ownerAware.listEntryIds.bind(inner);
         if (ownerAware.exportEntriesStream)
             this.exportEntriesStream = ownerAware.exportEntriesStream.bind(inner);
+        if (ownerAware.assertArchiveAnonymous)
+            this.assertArchiveAnonymous = ownerAware.assertArchiveAnonymous.bind(inner);
         this.forget = (sessionId) => {
             this.evict(sessionId);
             return inner.forget?.(sessionId);