@sema-agent/server 7.145.0 → 7.147.0

package/dist/boot/stage-07-capability-layer.js

@@ -14,7 +14,7 @@ import { buildScenarios, builtinScenarioDetails, danglingScenarioRefusal } from
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { RateLimiter } from "../observability/rate-limit.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { buildOperatorUndeclaredNotice } from "../http/principal-gate.js";
+import { buildServiceTokenPostureNotice } from "../http/principal-gate.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { reclaimOrphansAtBoot } from "../boot-reclaim.js";
@@ -87,7 +87,7 @@ export async function runStage07(ctx) {
         })()
         : undefined;
     const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined;
-    const selectEnvTool = config.selectEnvironmentTool && config.remoteExec?.provider === "k8s" && imageIndex
+    const selectEnvTool = config.selectEnvironmentTool && config.remoteExec.provider === "k8s" && imageIndex
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
@@ -100,9 +100,9 @@ export async function runStage07(ctx) {
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
     {
-        const undeclared = buildOperatorUndeclaredNotice(config, durableEnabled);
-        if (undeclared)
-            logger.warn(undeclared.event, undeclared.fields);
+        const posture = buildServiceTokenPostureNotice(config);
+        if (posture)
+            logger.info(posture.event, posture.fields);
     }
     if (config.a2aServe) {
         const peer = facts.a2aServe({ config, runStore });
@@ -123,7 +123,7 @@ export async function runStage07(ctx) {
         }
     }
     for (const w of buildNoResponderBootWarns({
-        lane: executionLaneOf(config.remoteExec?.provider),
+        lane: config.remoteExec.provider,
         selfOrchestrationEnabled: config.selfOrchestrationEnabled,
         approvalFaceWired: toolApproval !== undefined || durableEnabled,
     }))
@@ -177,7 +177,7 @@ export async function runStage07(ctx) {
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
         runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
-        handsLane: laneWiresExecutionEnv(executionLaneOf(config.remoteExec?.provider)),
+        handsLane: laneWiresExecutionEnv(config.remoteExec.provider),
         webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,

package/dist/boot/stage-08-reapers.d.ts

@@ -60,7 +60,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
@@ -93,11 +93,13 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deploymentModsLoaded: readonly import("./deployment-mods.js").LoadedModPackage[];
+    belowTaskChainPatterns: readonly string[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
@@ -160,12 +162,13 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
+    storeSweep: import("../plugins/store-sweep.js").StoreSweep;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-08-reapers.js

@@ -6,11 +6,11 @@ import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 import { seatText } from "../trace/exit-seat.js";
 export function runStage08(ctx) {
-    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, sandboxPodReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, sandboxPodReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, runStore, runner, sqlWorkflowRunStore, storeSweep, subRunner, taskAttachmentStore, toolApproval, userInputLedger, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
-        rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
-        workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
+        rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
+        workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal,
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, userInputLedger, approvalAskAudit,
         ...(sandboxPodReaper !== undefined ? { sandboxPodReaper } : {}),
         getRunDenySweep: () => runDenySweep,

package/dist/boot/stage-09-leader.d.ts

@@ -18,6 +18,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
@@ -84,7 +85,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
@@ -117,11 +118,13 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deploymentModsLoaded: readonly import("./deployment-mods.js").LoadedModPackage[];
+    belowTaskChainPatterns: readonly string[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
@@ -184,12 +187,13 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
+    storeSweep: import("../plugins/store-sweep.js").StoreSweep;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-10-http-server.d.ts

@@ -17,6 +17,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
     sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
+        projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
         sessionId: string;
@@ -83,7 +84,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
@@ -116,11 +117,13 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     orgDeliveryGate: import("@sema-agent/core").OrgDeliveryGate | undefined;
     deploymentMods: readonly import("@sema-agent/core").ModRegistration<import("@sema-agent/core").EngineDollar>[];
     deploymentModsLoaded: readonly import("./deployment-mods.js").LoadedModPackage[];
+    belowTaskChainPatterns: readonly string[];
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
@@ -183,12 +186,13 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     storePosture: import("../store-posture.js").StorePosture;
+    storeSweep: import("../plugins/store-sweep.js").StoreSweep;
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-10-http-server.js

@@ -32,7 +32,7 @@ import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 export async function runStage10(ctx) {
-    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentMods, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -85,7 +85,7 @@ export async function runStage10(ctx) {
         sessionAudit,
         routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
-        bindSessionInheritEnv: executionLaneOf(config.remoteExec?.provider) === "host" ? setSessionInheritEnv : undefined,
+        bindSessionInheritEnv: config.remoteExec.provider === "host" ? setSessionInheritEnv : undefined,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
@@ -174,6 +174,7 @@ export async function runStage10(ctx) {
         sealedKeyPublic: webAdmin.sealedKeyPublic,
         sandboxGitPlane,
         deploymentModPackages: deploymentModsLoaded.length,
+        perSessionCwd,
         instanceId,
         capabilities: {
             version: serviceVersion(),
@@ -195,6 +196,7 @@ export async function runStage10(ctx) {
         configRefreshNow: () => webAdmin.refreshNow(),
         webAdminManagedKeys: () => webAdmin.centerManagedKeys(),
         drainState,
+        sessionResidentBackground,
         servingLease: servingLease ? () => servingLease.view() : undefined,
         storePosture,
         centerWiring: createCenterWiringReader({ config, pullState: () => webAdmin.centerPullState(), fleetLease, usageReport: fleetUsage !== undefined }),
@@ -208,7 +210,7 @@ export async function runStage10(ctx) {
         peerDesk,
         getKeyResolver: () => webAdmin.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
-        hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
+        hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
         checkpointStore, imageIndex, perTaskImage,
         sessionEnvSelection,

package/dist/boot/stores.d.ts

@@ -1,3 +1,4 @@
+import { sessionBoxMountVerdict } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { type MemorySyncRunner } from "../memory-sync-client.js";
 import type { Logger } from "../observability/logger.js";
@@ -20,6 +21,14 @@ export interface OpenStoresCtx {
  * 不在这里手抄一份,也不在别处再求一遍(手抄的判据会漂,漂的方向要么是拒启误伤、要么是该拒不拒;再求一遍的 park 设施位手上没有那只店)。本函数只做探:有 SQL 池就探,local 后端无池则无事。
  */
 export declare function assertApprovalAskRuleMaterialOnBackend(backend: StoreBackend | undefined): Promise<void>;
+/**
+ * 起服报告 `session_box_mount` 那一行(纯数据):引擎会话盒挂载判官的判决 → 级别与键集,唯一一处。挂得上 ⇒ info `{ peerLaneMountable: true }`;
+ * 挂不上 ⇒ warn `{ peerLaneMountable: false, peerLaneRefusal: <引擎的码>, reason: <引擎的句> }`。{@link openStores} 对本部署装的那一对店问一次、按它落行。
+ */
+export declare function buildSessionBoxMountLine(verdict: ReturnType<typeof sessionBoxMountVerdict>): {
+    readonly level: "info" | "warn";
+    readonly fields: Readonly<Record<string, unknown>>;
+};
 export declare function openStores(ctx: OpenStoresCtx): Promise<{
     backend: StoreBackend | undefined;
     storePosture: import("../store-posture.js").StorePosture;
@@ -43,5 +52,6 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
     taskListLane: import("./task-list-lane.js").TaskListLane;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;
     sessionCaptureRecords: import("../plugins/store-backend.js").SessionCaptureRecordSource | undefined;
+    storeSweep: import("../plugins/store-sweep.js").StoreSweep;
 }>;
 //# sourceMappingURL=stores.d.ts.map

package/dist/boot/stores.js

@@ -1,7 +1,8 @@
 import { join } from "node:path";
-import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
+import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, sessionBoxMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { startMemorySyncRunner } from "../memory-sync-client.js";
+import { errorCodeOf, errorKindOf } from "../observability/err-text.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
@@ -11,38 +12,39 @@ import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySch
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
-import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
+import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../stores-sql/mailbox-store-sql.js";
 import { recipientLifecycleOf } from "../plugins/mailbox-recipient-lifecycle.js";
 import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../stores-sql/usage-window-store-sql.js";
-import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterSchema } from "../plugins/roster-store-sql.js";
+import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterSchema } from "../stores-sql/roster-store-sql.js";
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
 import { buildSqlPoolMissingRefusal, missingSqlCoordinateKeys } from "../sql-engine-coordinates.js";
-import { runApprovalBatchKindlessCensus } from "../approval-batch-census.js";
 import { runAndLogOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
-import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
+import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback, workflowJournalOf } from "../plugins/store-backend.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
 import { createEngineNoticeForwarder } from "./runner-deps.js";
-import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
+import { buildMemoryRemoteLaneWarn, canonicalPathOf, judgeMemoryRootOutsideDataRoot, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { createMemoryScopeStores } from "../memory-scope-stores.js";
-import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
+import { assertToolResultProvenanceSchema } from "../stores-sql/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
 import { assertSchemaMatchesCode } from "../plugins/schema-consistency.js";
-import { SqlCheckpointStore, assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
-import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
+import { assertSessionExtCascadeOn } from "../plugins/session-ext-table.js";
+import { SqlCheckpointStore, assertCheckpointColumnSchema } from "../stores-sql/checkpoint-store-sql.js";
+import { assertFileHistorySchema } from "../stores-sql/file-history-store-sql.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
 import { seatText } from "../trace/exit-seat.js";
+import { buildStoreSweepBounds, createJournalSweepLeg, createStoreSweep } from "../plugins/store-sweep.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
     multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|mysql to light up)",
@@ -56,6 +58,11 @@ export async function assertApprovalAskRuleMaterialOnBackend(backend) {
     else if (mysqlPool)
         await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
 }
+export function buildSessionBoxMountLine(verdict) {
+    return verdict.ok
+        ? { level: "info", fields: { peerLaneMountable: true } }
+        : { level: "warn", fields: { peerLaneMountable: false, peerLaneRefusal: verdict.code, reason: verdict.reason } };
+}
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let backend;
@@ -97,13 +104,13 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
+        if (pgPool)
+            await assertSessionExtCascadeOn(pgDriver(pgPool));
+        else if (mysqlPool)
+            await assertSessionExtCascadeOn(mysqlDriver(mysqlPool));
     }
     if (backend)
         await runAndLogOneTimeMigrations(logger, backend);
-    {
-        const censusStore = backend !== undefined && backend.kind !== "local" ? backend.checkpoint?.() : undefined;
-        void runApprovalBatchKindlessCensus(censusStore instanceof SqlCheckpointStore ? censusStore : undefined, logger);
-    }
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",
@@ -162,7 +169,7 @@ export async function openStores(ctx) {
             });
             if (embedder !== undefined && config.memoryEmbedder !== undefined) {
                 await ensurePgMemoryEmbedderMetaSchema(q);
-                await reconcileEmbedderFingerprint(q, { model: config.memoryEmbedder.model, dimensions: config.memoryEmbedder.dimensions }, { log: logger });
+                await reconcileEmbedderFingerprint(q, { model: config.memoryEmbedder.model, dimensions: config.memoryEmbedder.dimensions }, { log: logger, reembedConfirmed: config.memoryEmbedder.reembedConfirmed === true });
             }
             else {
                 logger.info("memory_embedder_identity_absent", {
@@ -204,11 +211,15 @@ export async function openStores(ctx) {
         memoryEngine = fileEngine !== undefined ? scopeStoresOver(fileEngine.backend) : undefined;
         if (memoryEngine)
             announceLockedLegacyMemoryLayers(memoryMountRootOf(memoryEngine.backend, memoryEngine.root), createEngineNoticeForwarder(logger));
-        if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
-            logger.warn("memory_engine_dir_defaulted", {
-                root: memoryEngine.root,
-                hint: "LOCAL_DATA_ROOT is set but MEMORY_ENGINE_DIR is not — the memory engine is sharing the machine-wide default; set MEMORY_ENGINE_DIR to isolate it under your data root",
-            });
+        if (memoryEngine) {
+            try {
+                const outside = judgeMemoryRootOutsideDataRoot({ memoryRoot: memoryEngine.root, dataRoot: config.localDataRoot, canonical: canonicalPathOf });
+                if (outside)
+                    logger.warn("memory_engine_dir_outside_data_root", outside);
+            }
+            catch (err) {
+                logger.warn("memory_engine_dir_check_unavailable", { root: memoryEngine.root, dataRoot: config.localDataRoot, errorKind: errorKindOf(err), errorCode: errorCodeOf(err) });
+            }
         }
     }
     {
@@ -224,17 +235,22 @@ export async function openStores(ctx) {
             logger.warn(w.tag, { detail: w.detail, lane: laneFacts.lane, root: memoryMountRoot ?? null });
     }
     let rosterStore;
+    let rosterAged;
     {
         const mysqlPool = backend?.mysqlPool?.();
         const pgPool = backend?.pgPool?.();
         if (pgPool) {
             const q = async (text, params) => { const r = await pgPool.query(text, params); return { rows: r.rows }; };
             await ensurePgRosterSchema(q);
-            rosterStore = new PgRosterStore(q);
+            const store = new PgRosterStore(q);
+            rosterStore = store;
+            rosterAged = (nowMs, { maxAgeMs }) => store.reapOlderThan(nowMs - maxAgeMs);
         }
         else if (mysqlPool) {
             await ensureTiDBRosterSchema(mysqlPool);
-            rosterStore = new TiDBRosterStore(mysqlPool);
+            const store = new TiDBRosterStore(mysqlPool);
+            rosterStore = store;
+            rosterAged = (nowMs, { maxAgeMs }) => store.reapOlderThan(nowMs - maxAgeMs);
         }
         else if (backend?.kind === "local") {
             rosterStore = new FileRosterStore(join(config.localDataRoot ?? localRoot, "roster.json"), {
@@ -316,13 +332,10 @@ export async function openStores(ctx) {
         if (mailboxStore)
             mailboxRecipientLifecycle = recipientLifecycleOf(mailboxStore);
         if (mailboxStore) {
-            const laneVerdict = mailboxCrossProcessMountVerdict(mailboxStore);
             logger.info("mailbox_store_enabled", {
                 backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file",
                 crossProcessSafe: mailboxStore.crossProcessSafe,
                 recipientTombstones: pgPool !== undefined || mysqlPool !== undefined,
-                peerLaneMountable: laneVerdict.ok,
-                ...(laneVerdict.ok ? {} : { peerLaneRefusal: laneVerdict.code }),
             });
         }
     }
@@ -391,7 +404,7 @@ export async function openStores(ctx) {
             await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
         if (mysqlPool)
             await ensureTiDBDeviceSchema(mysqlPool);
-        if (config.remoteExec?.provider === "device") {
+        if (config.remoteExec.provider === "device") {
             if (pgPool)
                 await assertDeviceAuditRebindEventSchema(pgDriver(pgPool));
             else if (mysqlPool)
@@ -423,6 +436,10 @@ export async function openStores(ctx) {
         });
     }
     metrics.dynamicGauge("sessions_warm", "Sessions held in the warm cache", () => sessionStore.size);
+    if (mailboxStore !== undefined) {
+        const line = buildSessionBoxMountLine(sessionBoxMountVerdict(mailboxStore, sessionStore));
+        logger[line.level]("session_box_mount", line.fields);
+    }
     const breakerState = backend?.breaker && config.resilience.circuitBreaker
         ? backend
             .breaker((streak) => {
@@ -436,10 +453,20 @@ export async function openStores(ctx) {
         })
             .startRefresh()
         : undefined;
+    const toolResultsForSweep = backend?.toolResult?.();
+    const journalForSweep = workflowJournalOf(config, backend);
+    const storeSweep = createStoreSweep({
+        legs: {
+            "roster-aged": rosterAged,
+            "tool-results-aged": toolResultsForSweep?.reap?.bind(toolResultsForSweep),
+            "workflow-journal-expired": createJournalSweepLeg(journalForSweep),
+        },
+        bounds: () => buildStoreSweepBounds(config),
+    });
     return {
         backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
         taskAttachmentStore, mailboxStore, memoryExportStores, memorySyncRunner, sessionStore, breakerState,
-        usageWindowStore, memoryPosture, taskListLane, sqlEngine, sessionCaptureRecords,
+        usageWindowStore, memoryPosture, taskListLane, sqlEngine, sessionCaptureRecords, storeSweep,
     };
 }
 //# sourceMappingURL=stores.js.map

package/dist/boot/web-admin.js

@@ -7,7 +7,7 @@ import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
-import { applyCenterPlugins } from "../capabilities/center-plugins.js";
+import { applyCenterPlugins, pluginCacheRootFor } from "../capabilities/center-plugins.js";
 import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
@@ -213,7 +213,7 @@ export async function createWebAdminRuntime(ctx) {
         const domains = verdict.domains.join(",");
         if (candidateRejection?.version === r.effective.version && candidateRejection.domains.join(",") === domains)
             return;
-        admitArrival(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
+        admitArrival(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now(), localDirField.dir));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
     const noteSourceAtApplied = () => {
@@ -776,7 +776,7 @@ export async function createWebAdminRuntime(ctx) {
                 skills = await applySkillsManifest(skills, effective.skills, candidateSource(), logger);
             if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
-                    cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
+                    cacheRoot: pluginCacheRootFor(config.localDataRoot ?? join(homedir(), ".ai-agent")),
                     allowHosts: config.pluginsAllowHosts,
                     toolsShareThisFilesystem: DEPLOYMENT_SHAPE_PREDICATES.toolsOnThisHost.holds(config),
                     logger,

package/dist/boot/workflow-orchestration.d.ts

@@ -22,7 +22,7 @@ import { type WorkflowCompletionInbox } from "../orchestration/workflow-completi
 import { JournalingWorkflowRunStore, WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
-import type { StoreBackend } from "../plugins/store-backend.js";
+import { type StoreBackend } from "../plugins/store-backend.js";
 export interface WorkflowOrchestrationCtx {
     config: ServiceConfig;
     logger: Logger;

package/dist/boot/workflow-orchestration.js

@@ -7,6 +7,7 @@ import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, buildWork
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
+import { workflowJournalOf } from "../plugins/store-backend.js";
 import { seatText } from "../trace/exit-seat.js";
 export function createWorkflowOrchestration(ctx) {
     const { config, logger, metrics, localRoot, backend, getRunStore } = ctx;
@@ -70,7 +71,7 @@ export function createWorkflowOrchestration(ctx) {
         ...(replicaLocalNotifyJournal ? { finalizeStartedBeforeMs: workflowBootAtMs } : {}),
         ...(workflowRunStore ? { publishTerminalFleetRow: (id, run) => workflowRunStore.republishFleet(id, run) } : {}),
     };
-    const workflowJournalStore = config.selfOrchestrationEnabled && backend ? backend.workflowJournal() : undefined;
+    const workflowJournalStore = workflowJournalOf(config, backend);
     const outcomeSink = backend?.outcomeSink();
     const workflowAgentRegistry = config.selfOrchestrationEnabled ? new WorkflowAgentRegistry() : undefined;
     const subagentSteerRegistry = new SubagentSteerRegistry();

package/dist/capabilities/center-plugins.d.ts

@@ -97,6 +97,8 @@ export declare function materializablePlugins(eff: {
     url: string;
     sha?: string;
 }>;
+/** 中心 plugin 缓存根 `<数据根>/plugin-cache`(组合根传给 {@link applyCenterPlugins} 的 `cacheRoot` 与一次性迁移 M39 的名册同读这一只)。 */
+export declare function pluginCacheRootFor(dataRoot: string): string;
 /** 总入口(条款 3/7/8):逐条物化 + 装载 + 让位合并。materialize 盘位 = `<cacheRoot>/<name>/live`
  *  (成功后原子 rename 替换,失败保留旧盘位 = LKG)。 */
 export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {

package/dist/capabilities/center-plugins.js

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { promises as fsp, realpathSync, existsSync, readFileSync, lstatSync, statSync } from "node:fs";
 import { join, resolve, isAbsolute, sep } from "node:path";
+import { ensureDir } from "@sema-agent/core";
 import { assertConfined, loadSkills } from "./skills.js";
 import { buildDisplaySafeUrl, redactSecrets } from "../trace/redact.js";
 import { gitSubprocessEnv } from "../server-secret-env.js";
@@ -132,6 +133,9 @@ export function materializablePlugins(eff, allowHosts) {
         return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
     });
 }
+export function pluginCacheRootFor(dataRoot) {
+    return join(dataRoot, "plugin-cache");
+}
 export async function applyCenterPlugins(baseline, eff, opts) {
     const shape = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
@@ -165,12 +169,12 @@ export async function applyCenterPlugins(baseline, eff, opts) {
         let materialized = false;
         try {
             await fsp.rm(staging, { recursive: true, force: true });
-            await fsp.mkdir(staging, { recursive: true });
+            ensureDir(staging);
             const plan = gitClonePlan({ url: v.url, dest: staging, sha: v.sha });
             for (const step of plan.steps)
                 await runGit(step);
             await fsp.rm(liveDir, { recursive: true, force: true });
-            await fsp.mkdir(join(opts.cacheRoot, v.name), { recursive: true });
+            ensureDir(join(opts.cacheRoot, v.name));
             await fsp.rename(staging, liveDir);
             materialized = true;
         }

package/dist/capabilities/composite-members.d.ts

@@ -45,8 +45,9 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"];
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
-    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies"];
+    readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"];
     readonly settings: readonly ["permissions"];
+    readonly settingsContract: readonly ["version", "hookEntryFields"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];
@@ -57,6 +58,8 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly userAttachments: readonly ["entries", "kinds", "supplies", "limits"];
     readonly credentialPlane: readonly ["sandboxGit"];
     readonly memorySyncServe: readonly ["identity"];
+    readonly adoptionImport: readonly ["adoptionId", "maxSessions", "maxSessionBytes"];
+    readonly engine: readonly ["handover"];
 };
 type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
 /** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */

package/dist/capabilities/composite-members.js

@@ -6,8 +6,9 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
-    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies"],
+    taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"],
     settings: ["permissions"],
+    settingsContract: ["version", "hookEntryFields"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],
@@ -18,6 +19,8 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     userAttachments: ["entries", "kinds", "supplies", "limits"],
     credentialPlane: ["sandboxGit"],
     memorySyncServe: ["identity"],
+    adoptionImport: ["adoptionId", "maxSessions", "maxSessionBytes"],
+    engine: ["handover"],
 };
 export function gateCompositeMembers(body) {
     return body;