@sema-agent/server 7.145.0 → 7.147.0

package/dist/capabilities/execution-lane.d.ts

@@ -1,6 +1,6 @@
-import { type ExecutionLane, type RemoteExecProvider } from "../execution-lane-caps.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 export interface ExecutionLaneCapability {
-    /** 本部署的执行车道词(闭集 = {@link ExecutionLane} 八词;`REMOTE_EXEC` 未设 ⇒ `"in-process"`,见头注 [ref] 段)。 */
+    /** 本部署的执行车道词(闭集 = {@link ExecutionLane} 八词;合成之后恒是部署声明的那一条;无手 = 声明的 `"none"`,见头注)。 */
     readonly provider: ExecutionLane;
     /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
      *  属主 = 部署形表行 `toolsOnThisHost`,与 `skills[].baseDir` 的铸点同一行。 */
@@ -11,13 +11,13 @@ export interface ExecutionLaneCapability {
 }
 /**
  * 部署席 → 消费端窄投影。形照 `projectWebSearchCapability` / `projectSqlEngineCapability`:
- * 不碰 config.ts(只从车道表模块取词与归一读口,那是叶),于是本模块是叶。
+ * 不碰 config.ts(只从车道表模块取能力位,那是叶),于是本模块是叶。
  *
- * 🔴 本处**不写**任何缺席折词([ref] 门 D):缺席归一只在 {@link executionLaneOf} 一处。
+ * 🔴 本处**不写**任何缺席折词([ref] 门 D):入参是已合成的配置,车道必在(没有声明的部署在合成步拒启)。
  */
 export declare function projectExecutionLaneCapability(config: {
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
-    } | undefined;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
+    };
 }): ExecutionLaneCapability;
 //# sourceMappingURL=execution-lane.d.ts.map

package/dist/capabilities/execution-lane.js

@@ -1,7 +1,7 @@
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 export function projectExecutionLaneCapability(config) {
-    const lane = executionLaneOf(config.remoteExec?.provider);
+    const lane = config.remoteExec.provider;
     const handsWired = laneWiresExecutionEnv(lane);
     return {
         provider: lane,

package/dist/capabilities/hands-lane.d.ts

@@ -42,7 +42,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
 /**
  * 一个场景在一台部署上起的 run **有没有工作区** —— core prepare 的 `handsEnabled`(`ownedEnv || deps.executionEnv`)在本仓的镜像,**唯一一只判官**。
  * 两个条件缺一不可:场景挂手({@link pickHandsRunner} 选有手 Runner,即带 `executionEnvFactory` 的那只)∧ 这台部署的执行车道有手
- * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`in-process` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
+ * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`none` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
  * (`config.user_attachment_invalid`「this run has no workspace」)与场景详情读面的 `attachmentSupplies` 都落在这一只的答案上。
  * **穷举 switch**:`ScenarioHands` 加词而此处不表态 = 编译红(与 {@link pickHandsRunner} 同一条纪律)。
  */

package/dist/capabilities/scenarios.d.ts

@@ -73,10 +73,9 @@ export declare function buildExcludeToolsSeat(scenarioExcludes: readonly string[
  */
 export interface ScenarioContext {
     /**
-     * 本请求的会话 id。属主 = `boot/resolve-spec.ts` 的 `auth.sessionId`(authorizer 解析 + 归属校验
-     * 过的那一只),**绝不是 `body.sessionId`** —— 后者是调用方自报串,拿它当会话级设施的分区键
-     * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「sessionId comes from `auth`, NEVER the
-     * body」的逐字纪律)。
+     * 本请求的会话 id。属主 = `boot/resolve-spec.ts` 的 `root`(= `opts.execution.root`:authorizer 解析 + 归属校验
+     * 过的那一只,续跑 = checkpoint 的会话),**绝不是 `body.sessionId`** —— 后者是调用方自报串,拿它当会话级设施的分区键
+     * 等于让一个租户读另一个租户的清单(同 spec 组装处那条「根来自执行上下文,绝不来自请求体」的逐字纪律)。
      *
      * 缺席 = 这条调用形本来就没有会话(`parked-revive-surface.ts` 对不交座的行、boot 期那一次 Agent 工具探针、
      * `builtinScenarioDetails` 的工具名探针)。此时会话级设施退化为 per-call 实例 —— 不为它发明
@@ -105,7 +104,7 @@ export interface ScenarioDeps {
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
     /**
-     * [ref]:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;`REMOTE_EXEC` 未设 = `in-process` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
+     * [ref]:这台部署的执行车道**有没有手**(`laneWiresExecutionEnv`;声明 `REMOTE_EXEC=none` = 没有)。场景详情读面据它与场景自己的 `hands` 表态一起答
      * 「这个场景的 run 有没有工作区」({@link runHasWorkspace}),进而给出附件可受理供给集。**缺席按没有手读**(宁少说不多说:不广告一个会撞 400 的 `path`)。
      */
     handsLane?: boolean;
@@ -157,8 +156,8 @@ export interface ScenarioDeps {
     }) => Promise<void>;
     /**
      * **Runner 之外的后台子代完成**交给哪里 —— 按委派树根见证({@link ScenarioContext.delegationRoot})造委派工具挂载期的 `background.notify`。
-     * 停驻赎回腿的复活、操作员 `handle.resume` 都不是哪一次 run 内的调用,没有调用车道;引擎只在能解出一只完成 sink(调用 ?? 挂载)时才起后台续跑,
-     * 解不出 ⇒ 拒(`revive.no_background`)。sink = 委派树根会话的会话通知门(`session-notify-door.ts` 的 `createBackgroundCompletionRelay`;律与地址、
+     * 操作员 `handle.resume` 与停驻落在别的进程的停驻赎回腿复活都不是哪一次 run 内的调用,本进程也没有它们欠账的车道;引擎只在能解出一只完成 sink
+     * (调用 ?? 停驻车道 ?? 挂载)时才起后台续跑,解不出 ⇒ 拒(`revive.no_background`)。本进程持有停驻的赎回(core 7.63.0)完成回停驻车道,不调这只 sink。sink = 委派树根会话的会话通知门(`session-notify-door.ts` 的 `createBackgroundCompletionRelay`;律与地址、
      * 竞态、条目形都写在那里)。Runner 之内的调用照旧走调用车道,这只 sink 不被调。缺席(没有门的装配:run-local)⇒ 不接 ——
      * 不接一只空 sink(接了 = 引擎起续跑、完成没人收)。
      */
@@ -350,6 +349,16 @@ export interface ScenarioRuling {
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */
     allowlist: string[];
 }
+/**
+ * 一次中心裁定读数(`principalCaps.scenarioRuling` / `peekScenarioRuling` 的答)—— **三态,各恰一条出路**({@link gateScenarioRequest} 逐态判):
+ *  · {@link ScenarioRuling} —— 中心答了治理两键 ⇒ 按它执法(指派为缺省、白名单限点名);
+ *  · `undefined`(**缺席**)—— 这一问没有中心可问,或中心答了但不管场景:部署没接中心(无中心 / 干跑 / `run-local` / 嵌入方不给)、
+ *    匿名运行(无 principal,零中心往返)、旧中心不发治理两键 ⇒ 无治理,请求名或部署缺省;
+ *  · `"unavailable"`(**故障**)—— 部署接了中心、请求带 principal,而这一问答不出来:不可达 / 超时 / 答复读不出(非 2xx、体判坏、
+ *    回声不符、在飞期间凭据身份换了)/ 治理两键形不对 ⇒ 该 run 拒。这位主体此刻的指派与白名单不可知:缺省链可能比他的指派更宽,点名也判不了白名单。
+ * 缺席与故障的界画在「有没有中心可问」:读数的客户端只在部署接了中心时存在,没接中心的部署走不到故障态。
+ */
+export type ScenarioRulingRead = ScenarioRuling | "unavailable" | undefined;
 /**
  * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
  *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
@@ -373,17 +382,21 @@ export declare function danglingScenarioRefusal(name: string, source: ScenarioNa
 /**
  * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
  * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
+ * 读数 `ruling` 三态各一条出路({@link ScenarioRulingRead}),判序:
+ *
+ *   1. body.scenario 显式给出而不在册 ⇒ typed 400 `scenario_unknown`(调用方的错;词表面先于治理面,不等中心)。
+ *   2. 读数 `"unavailable"`(中心配了却答不出)⇒ 503 `state.scenario_assignment_unavailable`(体 `permanence: "transient"`:这一拍答不出,
+ *      不是准入策略 —— 续跑腿据它不折成 409 `resume_blocked_by_policy`,见 `http/checkpoint-ctx.ts` 的 `resumeAssemblyRefusalAnswer`),点名与不点名同拒 ——
+ *      这位主体的指派与白名单此刻不可知,缺省链不能替他答,点名也判不了白名单。运维日志一行 `scenario_assignment_unavailable`(`principal`;
+ *      取数失败本身由主体客户端的 `onError` 另记一行)。
+ *   3. body.scenario 显式给出(在册):白名单非空且集外 ⇒ typed 400 `scenario_not_allowed`(附 allowlist —— 机器码归 wire、人话归壳 / web);
+ *      集内,或白名单为空(缺席 / 中心答了「无指派」)⇒ 用户主动切换赢。
+ *   4. body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者(缺席 / `scenario: null`)⇒ defaultScenario。链上的名字不在册 ⇒ 503
+ *      `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default({@link danglingScenarioRefusal})。
  *
- *   - body.scenario 显式给出:不在册 ⇒ typed 400 `scenario_unknown`(调用方的错);allowlist 非空且集外 ⇒ typed 拒绝
- *     (400 `scenario_not_allowed`,附 allowlist ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空
- *     (无 ruling / 该 principal 三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
- *     不收紧,恒不比没有治理时更宽;caps 故障不把用户锁死在 default——场景切换不是权限放大面,fail-open
- *     到现状,与 workflows 面的 fail-closed 是刻意的 posture 差异,见 runtime-caps-resolver)。
- *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。链上的名字不在册 ⇒ 503
- *     `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default
- *     ({@link danglingScenarioRefusal})。`principal` 只进那一行运维日志,不参与判定。
+ * `principal` 只进运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
+export declare function gateScenarioRequest(ruling: ScenarioRulingRead, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
 /**
  * 一条请求的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
  *
@@ -395,7 +408,8 @@ export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined,
  *
  * 契约:`(principal, requested) => 在册的场景名`(返回值一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
  * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。
- * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 无 ruling,门退回「请求名或部署缺省」那条现状链。
+ * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 读数恒缺席,门走「请求名或部署缺省」那条链;
+ * 在场 ⇒ 它的读数三态({@link ScenarioRulingRead})原样交门,故障态由门拒。
  */
 export interface ScenarioGateSources {
     readonly config: {
@@ -404,8 +418,8 @@ export interface ScenarioGateSources {
     /** 场景表(活引用):词表按调用时的自有键取,与表同生同灭。 */
     readonly scenarios: Readonly<Record<string, unknown>>;
     readonly principalCaps: {
-        scenarioRuling(principal: string | undefined): Promise<ScenarioRuling | undefined>;
-        peekScenarioRuling(principal: string | undefined): Promise<ScenarioRuling | undefined>;
+        scenarioRuling(principal: string | undefined): Promise<ScenarioRulingRead>;
+        peekScenarioRuling(principal: string | undefined): Promise<ScenarioRulingRead>;
     } | undefined;
     readonly logger?: Logger;
 }
@@ -413,7 +427,7 @@ export type ScenarioGate = (principal: string | undefined, requested: unknown) =
 /**
  * 门问中心裁定走哪条腿(闭集;新增一词 ⇒ 下面的穷尽 `switch` 编译红)—— 与 `resolveRuntimeCaps` / `peekRuntimeCaps` 是同一对:
  *  · `enforce` —— 任务提交腿:中心裁定走执法腿,center 硬失败铸下的 fail-closed 降级项两腿都认;
- *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份 fail-open 判决,但硬失败铸的降级项只对读面自己算数,
+ *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份读数(中心答不出 ⇒ 读面同拒),但硬失败铸的降级项只对读面自己算数,
  *    不替这个主体的真提交留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面不许成为别人被拒的原因)。
  */
 export type ScenarioGateLeg = "enforce" | "peek";

package/dist/capabilities/scenarios.js

@@ -285,6 +285,7 @@ export function buildRunSkills(args, logger) {
         logger?.warn("user_skills_dropped", { reason: "name reserved by scenario (or duplicate)", names: dropped });
     return { specs, roster };
 }
+const SCENARIO_ASSIGNMENT_UNAVAILABLE_REFUSAL = "this principal's scenario assignment could not be read — the configuration center did not answer (unreachable, timed out, or an unreadable reply), so no scenario was assigned and nothing ran — retry once the center answers again (the operator restores the link from this deployment to its configuration center)";
 function registeredScenariosClause(known) {
     return `this deployment's scenarios are: ${known.join(", ")}`;
 }
@@ -303,22 +304,25 @@ export function danglingScenarioRefusal(name, source, known) {
     }
 }
 export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known, logger, principal) {
+    if (typeof bodyScenario === "string" && !known.includes(bodyScenario)) {
+        throw new HttpError(400, `unknown scenario "${bodyScenario}" — ${registeredScenariosClause(known)}`, {
+            code: "scenario_unknown",
+            extra: { known: [...known] },
+        });
+    }
+    if (ruling === "unavailable") {
+        logger?.warn("scenario_assignment_unavailable", principal !== undefined ? { principal } : {});
+        throw createCodedHttpError(503, "state.scenario_assignment_unavailable", SCENARIO_ASSIGNMENT_UNAVAILABLE_REFUSAL, { permanence: "transient" });
+    }
     if (typeof bodyScenario === "string") {
-        const requested = bodyScenario;
-        if (!known.includes(requested)) {
-            throw new HttpError(400, `unknown scenario "${bodyScenario}" — ${registeredScenariosClause(known)}`, {
-                code: "scenario_unknown",
-                extra: { known: [...known] },
-            });
-        }
         const allowed = ruling?.allowlist ?? [];
-        if (allowed.length > 0 && !allowed.includes(requested)) {
+        if (allowed.length > 0 && !allowed.includes(bodyScenario)) {
             throw new HttpError(400, `scenario "${bodyScenario}" is not in this principal's assigned allowlist`, {
                 code: "scenario_not_allowed",
                 extra: { allowlist: allowed },
             });
         }
-        return requested;
+        return bodyScenario;
     }
     const [name, source] = ruling?.scenario != null ? [ruling.scenario, "ruling"] : [defaultScenario, "deployment"];
     const refusal = danglingScenarioRefusal(name, source, known);

package/dist/capabilities/settings-contract.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `GET /v1/capabilities` 的 `settingsContract` 位 —— **本服务内嵌的设置契约是哪一版、它的读者对每一型 hook 条目携带哪些字段**(版本位:恒在场,不随部署形变)。
+ *
+ * ## 病
+ * 一个键会不会被本服务的读者当契约外键剥掉(续跑重放腿)/ 在新提交面 400(键闭集门),今天消费方只能靠自己维护的「哪一版服务端认哪些键」代际表猜 ——
+ * 契约包一升版(例:19.0.0 起 command 条目承运 `args` / `onFailure`、http 条目承运 `onFailure`),那张表就漂。答案的真源在读者这一侧,所以由读者说。
+ *
+ * ## 形
+ * `{ version: string, hookEntryFields: { command | prompt | agent | http | mcp_tool: string[] } }`:
+ *  · `version` —— 已装 `@sema-agent/settings-schema` 的 package.json 版本号,读口唯一(`web-admin-client/center-request.ts` 的 {@link SETTINGS_SCHEMA_VERSION},对中心协商的 major 也由它派生);
+ *  · `hookEntryFields` —— 契约条目字段表按型的投影,**只投键名,不投取值类**;列序 = 契约分类器装上的条目的键序(判别位 `type` 不在列里)。
+ *    值源 = 契约包导出的字段表 {@link HOOK_ENTRY_FIELDS}(深冻结;本仓零镜像)—— 本模块不手抄、不另持。
+ * 「读者携带 ≠ 本服务执行」:本服务只跑 command / http / prompt / agent 四型(`mcp_tool` 整份拒,见 `hooks/hook-runner.ts` 的 `HOOK_ENTRY_TYPE_RUNS`),
+ * 列里也有本服务如实带、不执行的键(command 的 `rewakeMessage` / `rewakeSummary` / `cloud`、http 的 `cloud`、prompt 的 `continueOnBlock`);
+ * hooks 整只是否被采纳看 `taskSettings.hooks`;本位只答「契约面上这一型有哪些字段」。
+ */
+import { type HookEntryFields, type HookEntryType } from "@sema-agent/settings-schema/hooks";
+/** 一型的契约字段名(导出字段表那一行的键;判别位 `type` 不在表里)。 */
+export type HookContractEntryField<T extends HookEntryType> = Extract<keyof HookEntryFields[T], string>;
+/** 能力位 `settingsContract` 的形。 */
+export interface SettingsContractCapability {
+    readonly version: string;
+    readonly hookEntryFields: {
+        readonly [T in HookEntryType]: readonly HookContractEntryField<T>[];
+    };
+}
+/** 能力位的值(纯数据;进程内不变,装载时投影一次)。列的顺序随导出表的型序。 */
+export declare const SETTINGS_CONTRACT_CAPABILITY: SettingsContractCapability;
+//# sourceMappingURL=settings-contract.d.ts.map

package/dist/capabilities/settings-contract.js

@@ -0,0 +1,14 @@
+import { HOOK_ENTRY_FIELDS } from "@sema-agent/settings-schema/hooks";
+import { SETTINGS_SCHEMA_VERSION } from "../web-admin-client/center-request.js";
+const columnOf = (type) => Object.keys(HOOK_ENTRY_FIELDS[type]);
+export const SETTINGS_CONTRACT_CAPABILITY = {
+    version: SETTINGS_SCHEMA_VERSION,
+    hookEntryFields: {
+        command: columnOf("command"),
+        prompt: columnOf("prompt"),
+        agent: columnOf("agent"),
+        http: columnOf("http"),
+        mcp_tool: columnOf("mcp_tool"),
+    },
+};
+//# sourceMappingURL=settings-contract.js.map

package/dist/capabilities/skills.d.ts

@@ -1,5 +1,5 @@
 import type { SkillSpec } from "@sema-agent/core";
-import type { RemoteExecProvider } from "../execution-lane-caps.js";
+import type { ExecutionLane } from "../execution-lane-caps.js";
 import { type Logger } from "../observability/logger.js";
 /**
  * Built-in skills baked into the image, loaded ONCE at startup (no per-task disk IO). A skill is a
@@ -79,13 +79,13 @@ export declare function loadSkills(dir: string, opts: LoadSkillsOptions): Loaded
  * 各写一遍 `loadSkills(config.skillsDir, { toolsShareThisFilesystem: <车道判据>(config) })`,测试只能
  * 直传布尔去证 `loadSkills`(`baked-skills.test.ts`),证不到「config → 装配腿 → baseDir」这一段;收成一只
  * 之后,联合格从 config 走到 `baseDir`(`test/capabilities-http.test.ts` [ref] 段)证的就是两处装配点本人。
- * 判据属主:部署形表行 `toolsOnThisHost`([ref];[ref] 起 in-process ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
+ * 判据属主:部署形表行 `toolsOnThisHost`([ref];无手车道 `none` ⇒ 假 ⇒ 目录形技能不带 `baseDir`)。
  */
 export declare function loadDeploymentSkills(config: {
     readonly skillsDir: string;
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
-    } | undefined;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
+    };
 }, logger?: Logger): LoadedSkill[];
 /** 一个技能范围交进 `TaskSpec` 的技能(场景工厂的 `skills`)。范围从哪来见 `scenarios.ts` 的 `BUILTIN_SCENARIO_SKILL_SCOPE`(center 场景 = 它自己的名字)。 */
 export declare function skillsForScenario(loaded: readonly LoadedSkill[], scope: string): SkillSpec[];

package/dist/capability-facts.d.ts

@@ -25,6 +25,8 @@ import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/sto
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
+import type { ResumeAnchorStore } from "./plugins/store-backend.js";
+import type { EngineHandoverDoor } from "./boot/engine-lease.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
 export declare const CAPABILITY_FACT_WHY: {
     readonly run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)";
@@ -43,6 +45,11 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_policy_store_absent: "no session policy store is wired";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
     readonly file_history_store_absent: "no file-history store is wired";
+    readonly resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through)";
+    readonly execution_lane_handless: "the execution lane mounts no execution environment (REMOTE_EXEC=none), so a session has no working tree to rewind";
+    readonly workspace_rebuilt_per_task: "each task's workspace is rebuilt when the task starts on this deployment (a fresh directory, container or sandbox, or a restore from the workspace snapshot store that a rewind cannot yet take part in), so a rewind would not land in the tree the next task starts from";
+    readonly session_store_shared: "the session store is shared by several server instances (DB_BACKEND=mysql|pg) and no durable claim spans an out-of-run rewind yet, so a rewind could interleave with a run or another rewind started on another instance";
+    readonly file_history_preview_absent: "the file-history store implements no diffStats preview (the SQL backends)";
     readonly session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)";
     readonly session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)";
     readonly policy_purge_absent: "the session policy store has no deleteBySession purge verb";
@@ -80,6 +87,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
+    readonly project_registry_absent: "no project registry is served here: projects are published only by the configuration center (settings-schema does not read the projects domain from the local config.d), and no center configuration is applied (SEMA_WEB_ADMIN_URL unset, or SEMA_WEB_ADMIN_DRY_RUN on)";
     readonly workflow_engine_absent: "the workflow engine is not available on this worker";
     readonly entitlement_resolver_absent: "self-orchestration is on for a multi-tenant worker with no per-principal entitlement source";
     readonly workflow_run_store_absent: "no workflow run store is wired (SELF_ORCHESTRATION_ENABLED)";
@@ -91,6 +99,8 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly workspace_snapshot_store_absent: "no workspace snapshot store is configured (MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY)";
     readonly workspace_cache_off: "the build-cache volume per workspace space is off (WORKSPACE_CACHE=off, the default)";
     readonly deployment_mod_packages_absent: "no operator-declared mod package was loaded at boot (MODS_ROOT / MODS_PACKAGES)";
+    readonly engine_handover_lane_absent: "the attachment lease has no handover lane here: the lease is not armed (neither ENGINE_AUTO_EXIT nor SEMA_PARENT_PID), or the deployment is multi-tenant (REQUIRE_PRINCIPAL=true)";
+    readonly engine_lease_stopped: "the attachment lease has stopped observing (this engine is shutting down)";
 };
 export type CapabilityFactWhy = keyof typeof CAPABILITY_FACT_WHY;
 /** 不可用臂。 */
@@ -198,6 +208,29 @@ export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessio
     historyStore: ServiceFileHistoryStore;
     blobExchange: ServiceBlobExchange;
 }>;
+type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" | "resume_anchor_store_absent" | "execution_lane_handless" | "workspace_rebuilt_per_task" | "session_store_shared";
+/**
+ * run 外的「只恢复代码」口(`POST /v1/sessions/:id/rewind-files`,[ref])这台部署**解不解得出** —— 能力位 `sessionRewindFiles` 与该口的 501 读这一只。
+ * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(引擎 `Runner.rewindFiles` 读的同一只;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、不摘店,
+ * 所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店(`to` 手柄经它翻成 entry id,`history-anchor.ts`)∧ 执行车道有手
+ * (无手车道上引擎恒拒 `rewind.files_env_unsupported`:没有工作区可回退 —— 位说有而口恒拒不许发生)∧ 即时回退的工作区活过一次执行(部署形表行 `rewindableWorkspace`;
+ * 否则恢复的结果到不了下一次执行)∧ 会话店由本进程独占(local 后端:数据根被一个活进程锁住 ⇒ 引擎的进程内会话锁就是全局互斥;
+ * SQL 后端被多副本共用,而 run 外回退还没有一只跨副本的持久认领 —— 「先查认领再交引擎」只是检查不是互斥,所以在共享店上位为假、口 501,不留「检查即放行」)。
+ * 动词本身是引擎 `Runner` 的必有成员(型上必在),不是一格。
+ * 见证 = 判过在场的三只设施;路由在拒臂之后只读见证。
+ */
+export declare function sessionRewindFiles(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy, {
+    historyStore: ServiceFileHistoryStore;
+    anchors: ResumeAnchorStore;
+    sessionStorage: HeadReadingSessionStore;
+}>;
+/**
+ * 同一口的 `dryRun` **带不带改动统计** —— 能力位 `sessionRewindFilesPreview`。= 立即回退可用 ∧ 店实现了 core 契约的可选座 `diffStats`
+ * (引擎在 `dryRun` 上读的就是这一座:缺座 ⇒ 应答 `preview: null`)。逐后端如实:core 的文件店有,SQL 双生没有(那一座要的逐文件预览判官
+ * `previewFileDelta` 不在 core 包根导出面上,本仓不另写一份 —— 等 core 导出它,SQL 店补这一座、本位随之转真,路由零改)。本位为假**不是**口不收 `dryRun`:口照收,答 `preview: null`
+ * (「这台给不出统计」≠「什么都不会变」);所以本事实没有 501 拒点,只有能力位读它。
+ */
+export declare function sessionRewindFilesPreview(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
 /** 持久审批底座(checkpoint 店)在场 —— `/v1/approvals/*` 与 `/v1/assistant/*` 整条车道、会话 wake 都站在它上面。 */
 export declare function checkpointPark(d: Pick<Deps, "checkpointStore">): Fact<"checkpoint_store_absent", {
     checkpointStore: Store<"checkpointStore">;
@@ -267,6 +300,14 @@ export declare function imagePool(d: Pick<Deps, "imageIndex">): Fact<"image_inde
 export declare function agentRoster(d: Pick<Deps, "backgroundAgentStore">): Fact<"background_agent_store_absent", {
     store: Store<"backgroundAgentStore">;
 }>;
+/**
+ * 项目登记簿在不在(`GET /v1/projects*` 的 501 与 `capabilities.projects` 同读)。登记簿只由配置中心下发(settings-schema 的本地读取集不收
+ * `projects` 域)⇒ 在场 ⟺ 中心腿在应用配置(配了中心 ∧ 非 dry-run)。这条判据住在 `centerEntitlementSourceWired`(同一件事:中心的配置
+ * 在这台部署上生效),这里读它,不写第二份条件。见证 = 登记簿那张表(`config.projects`,applyEffective 就地换代,引用恒定)。
+ */
+export declare function projectRegistry(d: Pick<Deps, "config">): Fact<"project_registry_absent", {
+    registry: ServiceConfig["projects"];
+}>;
 export declare function sendFileLedger(d: Pick<Deps, "sendFileLedger">): Fact<"sendfile_ledger_absent", {
     ledger: Store<"sendFileLedger">;
 }>;
@@ -302,6 +343,11 @@ export declare function sessionMemorySync(d: Pick<Deps, "memorySyncLeg" | "runSt
 export declare function principalInboxDelivery(d: Pick<Deps, "orgDeliveryGate">): Fact<"org_delivery_gate_absent", {
     gate: Store<"orgDeliveryGate">;
 }>;
+/** [ref]([ref] v3):附着租约的交接车道在场且腿还在观察 —— `POST /v1/engine/handover` · `POST /v1/engine/attach` 的 501 与能力位 `engine.handover`
+ *  同读这一只。交接门只在「租约腿已装配 ∧ 非多租户」时进盒子(`boot/shutdown.ts`);腿停了(停机中)⇒ 门还在但不再观察。 */
+export declare function engineHandover(d: Pick<Deps, "drainState">): Fact<"engine_handover_lane_absent" | "engine_lease_stopped", {
+    door: EngineHandoverDoor;
+}>;
 /** 这台部署有运维名册(名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk` 对任何身份恒假
  *  ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
  *
@@ -316,6 +362,15 @@ type AdoptionCapableBackend = Store<"backend"> & {
 export declare function adoption(d: Pick<Deps, "config" | "backend">): Fact<"operator_principals_empty" | "adoption_store_absent", {
     backend: AdoptionCapableBackend;
 }>;
+type AdoptionImportSessionStore = WithMethods<OwnerAwareSessionStore, "beginImportStaging">;
+/**
+ * 收编批量导入(`POST /v1/adoption/:id/sessions`)与能力位 `adoptionImport` 的部署半:收编日志 ∧ 会话店的暂存导入面(派生 id 那一格占没占由提交的属主判答,不另要头读面)。
+ * **不判运维名册**:这扇门不是 operator 面 —— 调用者是那条收编行的源主体本人(名单空了,已收编的行照样在)。
+ */
+export declare function adoptionSessionImport(d: Pick<Deps, "backend" | "sessionStorage">): Fact<"adoption_store_absent" | "session_import_staging_absent", {
+    backend: AdoptionCapableBackend;
+    sessionStorage: AdoptionImportSessionStore;
+}>;
 export declare function memoryBundle(d: Pick<Deps, "config" | "memoryBundleExport" | "memoryBundleImport">): Fact<"operator_principals_empty" | "memory_bundle_faces_absent", {
     exportScopes: Store<"memoryBundleExport">;
     importBundle: Store<"memoryBundleImport">;
@@ -334,7 +389,7 @@ export declare function memoryOptOutGrant(d: Pick<Deps, "config" | "memoryOptOut
     store: Store<"memoryOptOutGrant">;
 }>;
 type QueryableOutcomeSink = WithMethods<Store<"outcomeSink">, "summary">;
-/** 可查询的 outcome 账面 ∧(单用户 ∨ operator 名单非空)—— 单用户形唯一的用户就是 operator,这一口不判名单。 */
+/** 有运维名册(`operatorLane`)∧ 可查询的 outcome 账面。operator 族同序:先判名册、再判设施;部署形不进判据(单用户形要当运维显式声明)。 */
 export declare function outcomeLedger(d: Pick<Deps, "config" | "outcomeSink">): Fact<"operator_principals_empty" | "outcome_ledger_unqueryable", {
     sink: QueryableOutcomeSink;
 }>;

package/dist/capability-facts.js

@@ -4,9 +4,11 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
 import { headReadOf } from "./session-incarnation.js";
+import { laneWiresExecutionEnv } from "./execution-lane-caps.js";
 export const CAPABILITY_FACT_WHY = {
     run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)",
     subagent_registry_absent: "the sub-agent steer registry is not wired",
@@ -24,6 +26,11 @@ export const CAPABILITY_FACT_WHY = {
     session_policy_store_absent: "no session policy store is wired",
     store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)",
     file_history_store_absent: "no file-history store is wired",
+    resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through)",
+    execution_lane_handless: "the execution lane mounts no execution environment (REMOTE_EXEC=none), so a session has no working tree to rewind",
+    workspace_rebuilt_per_task: "each task's workspace is rebuilt when the task starts on this deployment (a fresh directory, container or sandbox, or a restore from the workspace snapshot store that a rewind cannot yet take part in), so a rewind would not land in the tree the next task starts from",
+    session_store_shared: "the session store is shared by several server instances (DB_BACKEND=mysql|pg) and no durable claim spans an out-of-run rewind yet, so a rewind could interleave with a run or another rewind started on another instance",
+    file_history_preview_absent: "the file-history store implements no diffStats preview (the SQL backends)",
     session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)",
     session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)",
     policy_purge_absent: "the session policy store has no deleteBySession purge verb",
@@ -61,6 +68,7 @@ export const CAPABILITY_FACT_WHY = {
     read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
+    project_registry_absent: `no project registry is served here: projects are published only by the configuration center (settings-schema does not read the projects domain from the local config.d), and no center configuration is applied (${WEB_ADMIN_ENV.url} unset, or ${WEB_ADMIN_ENV.dryRun} on)`,
     workflow_engine_absent: "the workflow engine is not available on this worker",
     entitlement_resolver_absent: "self-orchestration is on for a multi-tenant worker with no per-principal entitlement source",
     workflow_run_store_absent: "no workflow run store is wired (SELF_ORCHESTRATION_ENABLED)",
@@ -72,6 +80,8 @@ export const CAPABILITY_FACT_WHY = {
     workspace_snapshot_store_absent: "no workspace snapshot store is configured (MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY)",
     workspace_cache_off: "the build-cache volume per workspace space is off (WORKSPACE_CACHE=off, the default)",
     deployment_mod_packages_absent: "no operator-declared mod package was loaded at boot (MODS_ROOT / MODS_PACKAGES)",
+    engine_handover_lane_absent: "the attachment lease has no handover lane here: the lease is not armed (neither ENGINE_AUTO_EXIT nor SEMA_PARENT_PID), or the deployment is multi-tenant (REQUIRE_PRINCIPAL=true)",
+    engine_lease_stopped: "the attachment lease has stopped observing (this engine is shutting down)",
 };
 const no = (why) => ({ available: false, why });
 const yes = (w) => ({ available: true, ...w });
@@ -193,6 +203,28 @@ export function sessionSyncFileHistory(d) {
     const blobExchange = blobExchangeOf(sync.historyStore);
     return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
 }
+export function sessionRewindFiles(d) {
+    if (d.fileHistoryStore === undefined)
+        return no("file_history_store_absent");
+    const owned = sessionOwnership(d);
+    if (!owned.available)
+        return owned;
+    if (d.resumeAnchorStore === undefined)
+        return no("resume_anchor_store_absent");
+    if (!laneWiresExecutionEnv(d.config.remoteExec.provider))
+        return no("execution_lane_handless");
+    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(d.config))
+        return no("workspace_rebuilt_per_task");
+    if (d.backend?.kind !== "local")
+        return no("session_store_shared");
+    return yes({ historyStore: d.fileHistoryStore, anchors: d.resumeAnchorStore, sessionStorage: owned.sessionStorage });
+}
+export function sessionRewindFilesPreview(d) {
+    const rewind = sessionRewindFiles(d);
+    if (!rewind.available)
+        return rewind;
+    return rewind.historyStore.diffStats !== undefined ? YES : no("file_history_preview_absent");
+}
 export function checkpointPark(d) {
     return d.checkpointStore !== undefined ? yes({ checkpointStore: d.checkpointStore }) : no("checkpoint_store_absent");
 }
@@ -279,6 +311,9 @@ export function imagePool(d) {
 export function agentRoster(d) {
     return d.backgroundAgentStore !== undefined ? yes({ store: d.backgroundAgentStore }) : no("background_agent_store_absent");
 }
+export function projectRegistry(d) {
+    return centerEntitlementSourceWired(d.config) ? yes({ registry: d.config.projects }) : no("project_registry_absent");
+}
 export function sendFileLedger(d) {
     return d.sendFileLedger !== undefined ? yes({ ledger: d.sendFileLedger }) : no("sendfile_ledger_absent");
 }
@@ -312,15 +347,33 @@ export function sessionMemorySync(d) {
 export function principalInboxDelivery(d) {
     return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");
 }
+export function engineHandover(d) {
+    const door = d.drainState?.engineHandover;
+    if (door === undefined)
+        return no("engine_handover_lane_absent");
+    return door.observing ? yes({ door }) : no("engine_lease_stopped");
+}
 export function operatorLane(d) {
     return operatorRosterPresent(d.config) ? YES : no("operator_principals_empty");
 }
+function adoptionLogStore(d) {
+    const b = d.backend;
+    return b !== undefined && typeof b.adoptionLog === "function" ? yes({ backend: b }) : no("adoption_store_absent");
+}
 export function adoption(d) {
     const lane = operatorLane(d);
     if (!lane.available)
         return lane;
-    const b = d.backend;
-    return b !== undefined && typeof b.adoptionLog === "function" ? yes({ backend: b }) : no("adoption_store_absent");
+    return adoptionLogStore(d);
+}
+export function adoptionSessionImport(d) {
+    const log = adoptionLogStore(d);
+    if (!log.available)
+        return log;
+    const s = d.sessionStorage;
+    if (s?.beginImportStaging === undefined)
+        return no("session_import_staging_absent");
+    return yes({ backend: log.backend, sessionStorage: s });
 }
 export function memoryBundle(d) {
     const lane = operatorLane(d);
@@ -355,11 +408,9 @@ export function memoryOptOutGrant(d) {
     return d.memoryOptOutGrant !== undefined ? yes({ store: d.memoryOptOutGrant }) : no("memory_optout_grant_absent");
 }
 export function outcomeLedger(d) {
-    if (d.config.requirePrincipal === true) {
-        const lane = operatorLane(d);
-        if (!lane.available)
-            return lane;
-    }
+    const lane = operatorLane(d);
+    if (!lane.available)
+        return lane;
     const sink = d.outcomeSink;
     return sink?.summary !== undefined ? yes({ sink: sink }) : no("outcome_ledger_unqueryable");
 }
@@ -438,7 +489,7 @@ export function hostScheduler(c) {
         return no("scheduler_disabled");
     if (c.requirePrincipal === true)
         return no("multi_tenant_deployment");
-    if (c.remoteExec?.provider !== "host")
+    if (c.remoteExec.provider !== "host")
         return no("not_host_lane");
     return YES;
 }

package/dist/center-credential-renewer.js

@@ -4,6 +4,7 @@ import { basename, dirname, join } from "node:path";
 import { WEB_ADMIN_ENV, WebAdminCredentialEnvelope, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 import { ACCESS_TOKEN_TTL_SECONDS, OAuthErrorResponse, TokenGrantResponse } from "@sema-agent/settings-schema/api/auth";
 import { CENTER_PULL_TIMEOUT_MS, CenterRedirectRefusedError, centerTokenRefresh } from "./web-admin-client/center-request.js";
+import { OWNER_ONLY_FILE_MODE } from "./plugins/owner-only-file-mode.js";
 export const CENTER_CREDENTIAL_RENEW_LEAD_KEY = "CENTER_CREDENTIAL_RENEW_LEAD_MS";
 export const CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS = 5 * 60_000;
 export const CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS = CENTER_PULL_TIMEOUT_MS;
@@ -51,10 +52,10 @@ const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const tmpResiduePattern = (path) => new RegExp(`^\\.${escapeRegExp(basename(path))}\\.\\d+\\.[0-9a-f]{${TMP_RANDOM_BYTES * 2}}\\.tmp$`);
 function prepareTmp(path, envelope, discard, onCleanupFailure) {
     const tmp = join(dirname(path), tmpNameFor(path));
-    const fd = openSync(tmp, "wx", 0o600);
+    const fd = openSync(tmp, "wx", OWNER_ONLY_FILE_MODE);
     let written = false;
     try {
-        fchmodSync(fd, 0o600);
+        fchmodSync(fd, OWNER_ONLY_FILE_MODE);
         writeFileSync(fd, `${JSON.stringify(envelope)}\n`, "utf8");
         fsyncSync(fd);
         written = true;

package/dist/checkpoint-ctx-seal-m28.d.ts

@@ -14,7 +14,7 @@
  */
 import { type CheckpointCtxSealer } from "./http/checkpoint-ctx.js";
 import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
-import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-sql.js";
+import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-face.js";
 /** M28 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。 */
 export interface CheckpointCtxSealM28Report {
     readonly window: "open" | "closed";