@sema-agent/server 7.145.0 → 7.147.0

package/dist/{plugins → stores-sql}/tool-result-store-sql.d.ts

@@ -1,9 +1,9 @@
 import type { ToolResultProvenance, ToolResultStore, ToolResultSlice, ToolResultDeletionReport } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool, PoolClient as PgPoolClient } from "pg";
-import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
+import { type SqlDriver, type SqlDialect } from "../plugins/sql-driver.js";
 import type { RetentionDeclaration } from "@sema-agent/core";
-import { type IndexSpec } from "./ensure-index.js";
+import { type IndexSpec } from "../plugins/ensure-index.js";
 /** PG schema for the tool_result table — the PG translation of tidb-pool.ts's tool_result DDL
  *  (LONGTEXT→TEXT, DATETIME(3)→TIMESTAMPTZ(3), inline KEY→separate CREATE INDEX). Disjoint from other stores'
  *  tables, so a self-contained ensureSchema is safe (central pg-pool aggregation is done separately). */
@@ -31,7 +31,7 @@ export declare function assertToolResultProvenanceSchema(query: (sql: string) =>
 export declare class SqlToolResultStore implements ToolResultStore {
     protected readonly db: SqlDriver;
     /** 托管留存声明 = 装配交给它的词(后端按扫车道开不开给;不给 ⇒ `"none"`)。读法与「为什么 SQL 店答 managed 而三方法的实现体在
-     *  `retention-store-sql.ts`」逐字见 {@link MANAGED_RETENTION}(扫车道开着时本店的 `tool_result` 行由那只聚合店按期清:随会话树删 + 孤儿腿)。 */
+     *  `retention-store-sql.ts`」逐字见 `plugins/retention-declaration.ts` 的 {@link MANAGED_RETENTION}(扫车道开着时本店的 `tool_result` 行由那只聚合店按期清:随会话树删 + 孤儿腿)。 */
     readonly retention: RetentionDeclaration;
     constructor(db: SqlDriver, opts?: {
         readonly retention?: RetentionDeclaration;

package/dist/{plugins → stores-sql}/tool-result-store-sql.js

@@ -1,10 +1,10 @@
 import { MAX_MINTED_TOOL_RESULT_REF_CHARS, assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance } from "@sema-agent/core";
-import { pgSanitizeText } from "./pg-safe-json.js";
-import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "./retention-store-sql.js";
-import { ensureIndexes } from "./ensure-index.js";
-import { describeProbedTableDrift, schemaWaysOut } from "./schema-drift-sentence.js";
-import { isMissingColumnError } from "./sql-errors.js";
+import { pgSanitizeText } from "../plugins/pg-safe-json.js";
+import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
+import { MANAGED_RETENTION, UNMANAGED_RETENTION } from "../plugins/retention-declaration.js";
+import { ensureIndexes } from "../plugins/ensure-index.js";
+import { describeProbedTableDrift, schemaWaysOut } from "../plugins/schema-drift-sentence.js";
+import { isMissingColumnError } from "../plugins/sql-errors.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
      ref              VARCHAR(518) COLLATE "C" NOT NULL,

package/dist/stores-sql/windowed-session-storage.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 两只 SQL 会话存储(`tidb-session-storage.ts` / `pg-session-storage.ts`)共用的**窗口视图** —— 一次唤醒读出的有界日志 `[floor .. leaf]`。
+ *
+ * ## 组合,不继承
+ * 会话树的读法(按 id 取、按类型找、标签、到根的路径、叶子、日志标记、地板、回放丢失)只有引擎那一份:本类把唤醒读出的窗口交给引擎的
+ * `InMemorySessionStorage`(组合),每个读都转给它;方言孪生只说两件 SQL 的事 —— 一笔写怎么落库({@link persist}),地板之下按 id 回读一条
+ * ({@link readBelowFloor})。不再 `extends` 引擎的存储基类:方言店继承引擎的店基类造第二份店,是依赖方向门 R5′ 拒的形。
+ *
+ * ## 写序
+ * 先落库(方言孪生在自己的事务里按叶子 CAS),落成才记进窗口 —— 与引擎存储「先判后记」同序;落库被拒(CAS 输)时窗口一个字节不动。
+ * 记进窗口走引擎存储的追加口(不带期望叶:CAS 已在库里判过,窗口只是跟上那一笔)。
+ *
+ * ## 叶子是行说的那一格
+ * 叶子 = 库里那一格(`session_meta.leaf_id`,引擎存储契约里「后端说出的头」),不是窗口末条之后的叶子(fork 拷整份日志带着别的分支时两者不同)。
+ * 窗口(引擎的存储)从条目推叶子、不收后端说的头 ⇒ 叶子由本类自己持有:唤醒时取行上那一格(它不在窗口里 ⇒ `corrupt_session`,与引擎存储基类同一判、同一句),
+ * 之后每落一笔前进到「这一笔之后的叶子」(与库里同一事务写下的值同一读法)。窗口里那只按条目推出的叶子不被读。
+ */
+import { InMemorySessionStorage, type SessionLogMark, type SessionMetadata, type SessionStorage, type SessionTreeEntry, type SessionWriteOptions } from "@sema-agent/core";
+export declare abstract class WindowedSessionStorage implements SessionStorage {
+    /** 唤醒读出的窗口(引擎的存储;叶子以外的每个读都是它的读)。 */
+    private readonly view;
+    /** 叶子(头注「叶子是行说的那一格」)。 */
+    private leaf;
+    /**
+     * `entries` = 窗口(按 `seq` 升序);`statedLeafId` = 行上那一格叶子;`floorEntryId` = 窗口的地板(没有压缩 ⇒ `null`,整条日志都在窗口里)。
+     * 地板不在窗口里 ⇒ 引擎存储拒 `corrupt_session`;行上的叶子不在窗口里 ⇒ 本类拒 `corrupt_session`(引擎存储基类的同一判、同一句)。
+     */
+    protected constructor(metadata: SessionMetadata, entries: SessionTreeEntry[], statedLeafId: string | null, floorEntryId: string | null);
+    /** 一笔写落库(方言孪生的事务:叶子 CAS + 追加事件)。抛 ⇒ 窗口不记。 */
+    protected abstract persist(entry: SessionTreeEntry, opts?: SessionWriteOptions): Promise<void>;
+    /** 地板之下按 id 回读一条(窗口里没有的;标签目标等)。没有 ⇒ `undefined`。 */
+    protected abstract readBelowFloor(id: string): Promise<SessionTreeEntry | undefined>;
+    getMetadata(): Promise<SessionMetadata>;
+    getLeafId(): Promise<string | null>;
+    createEntryId(): Promise<string>;
+    findEntries<TType extends SessionTreeEntry["type"]>(type: TType): Promise<Array<Extract<SessionTreeEntry, {
+        type: TType;
+    }>>>;
+    getLabel(id: string): Promise<string | undefined>;
+    getPathToRoot(leafId: string | null): Promise<SessionTreeEntry[]>;
+    getEntries(): Promise<SessionTreeEntry[]>;
+    /** 窗口的地板(没有压缩 ⇒ `null`)。 */
+    getFloorId(): string | null;
+    /** SQL 唤醒没有回放可丢(行是逐条读的):恒 `undefined`,经引擎存储原样答。 */
+    getReplayLoss(): ReturnType<InMemorySessionStorage["getReplayLoss"]>;
+    /** 窗口此刻的日志标记(同步读;引擎存储的读法)。 */
+    logMarkNow(): SessionLogMark;
+    /** 窗口里没有的 id(地板之下)回落到库。 */
+    getEntry(id: string): Promise<SessionTreeEntry | undefined>;
+    appendEntry(entry: SessionTreeEntry, opts?: SessionWriteOptions): Promise<void>;
+    /** 落成的一笔记进窗口,叶子前进到这一笔之后的叶子。 */
+    private record;
+    /** 叶子移动本身是一条落库的 `leaf` 条目,父 = 当前叶子(引擎存储的同一形:目标不在窗口里 ⇒ `not_found`,id 由引擎的铸法给)。 */
+    setLeafId(leafId: string | null, opts?: SessionWriteOptions): Promise<void>;
+}
+//# sourceMappingURL=windowed-session-storage.d.ts.map

package/dist/stores-sql/windowed-session-storage.js

@@ -0,0 +1,61 @@
+import { InMemorySessionStorage, SessionError, leafIdAfterEntry } from "@sema-agent/core";
+export class WindowedSessionStorage {
+    view;
+    leaf;
+    constructor(metadata, entries, statedLeafId, floorEntryId) {
+        this.view = new InMemorySessionStorage({ metadata, entries, floorEntryId });
+        if (statedLeafId !== null && !entries.some((e) => e.id === statedLeafId)) {
+            throw new SessionError("corrupt_session", `Entry ${statedLeafId} not found — the log's leaf names an entry the log does not hold`);
+        }
+        this.leaf = statedLeafId;
+    }
+    getMetadata() {
+        return this.view.getMetadata();
+    }
+    async getLeafId() {
+        return this.leaf;
+    }
+    createEntryId() {
+        return this.view.createEntryId();
+    }
+    findEntries(type) {
+        return this.view.findEntries(type);
+    }
+    getLabel(id) {
+        return this.view.getLabel(id);
+    }
+    getPathToRoot(leafId) {
+        return this.view.getPathToRoot(leafId);
+    }
+    getEntries() {
+        return this.view.getEntries();
+    }
+    getFloorId() {
+        return this.view.getFloorId();
+    }
+    getReplayLoss() {
+        return this.view.getReplayLoss();
+    }
+    logMarkNow() {
+        return this.view.logMarkNow();
+    }
+    async getEntry(id) {
+        return (await this.view.getEntry(id)) ?? (await this.readBelowFloor(id));
+    }
+    async appendEntry(entry, opts) {
+        await this.persist(entry, opts);
+        await this.record(entry);
+    }
+    async record(entry) {
+        await this.view.appendEntry(entry);
+        this.leaf = leafIdAfterEntry(entry);
+    }
+    async setLeafId(leafId, opts) {
+        if (leafId !== null && (await this.view.getEntry(leafId)) === undefined)
+            throw new SessionError("not_found", `Entry ${leafId} not found`);
+        const leafEntry = { type: "leaf", id: await this.view.createEntryId(), parentId: this.leaf, timestamp: new Date().toISOString(), targetId: leafId };
+        await this.persist(leafEntry, opts);
+        await this.record(leafEntry);
+    }
+}
+//# sourceMappingURL=windowed-session-storage.js.map

package/dist/{plugins → stores-sql}/workflow-journal-store-sql.d.ts

@@ -8,7 +8,7 @@
  * {@link import("@sema-agent/core").InMemoryWorkflowJournalStore} (single-replica, lost on crash); this is the
  * byte-match durable twin so a workflow survives a replica crash and RESUMES (replay the longest unchanged
  * PREFIX of recorded `ctx.agent` results, run only the first changed/new call + everything after it live). The
- * journal is LOAD-BEARING (unlike the best-effort {@link import("./run-store-sql.js")} observation layer):
+ * journal is LOAD-BEARING (unlike the best-effort {@link import("../plugins/run-store-sql.js")} observation layer):
  * append/load failures MUST throw — a silently-dropped entry would silently re-run already-done work.
  *
  * Schema = two tables (DDL in tidb-pool.ts / pg-pool.ts ensureSchema), the SQL normal form of core's per-run
@@ -36,7 +36,7 @@
  *     `run_id = ? AND scope = ?`.
  * Why the owner record's incarnation is in the row's PRIMARY KEY (one rule: **a row belongs to the owner record that
  * wrote it — readable only through it, overwritable only by a write made through it**): a write can outlive the owner
- * record it was judged against — `deleteByRun` / the GC sweep racing an append, an append stalled between its two
+ * record it was judged against — the GC sweep racing an append, an append stalled between its two
  * statements. Keyed and joined on run_id alone, (a) a leftover row would be adopted by the next claim of that run_id by
  * ANY scope, and (b) on PostgreSQL READ COMMITTED a stale guarded write whose SELECT still saw the old record would, via
  * the ON CONFLICT arm (which updates a row its snapshot never saw, without re-checking the source), overwrite the NEW
@@ -77,7 +77,7 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type WorkflowJournalEntry, type WorkflowJournalStore } from "@sema-agent/core";
-import { type SqlDriver } from "./sql-driver.js";
+import { type SqlDriver } from "../plugins/sql-driver.js";
 /** Dual-dialect durable WorkflowJournalStore. See the file header for the dialect-delta ledger. */
 /** [ref] 租约旋钮。TTL 只是**崩溃兜底**(engine 终态 finally 显式释放;[ref]/[ref] 两层分工:
  *  engine 崩了没释放 ⇒ 陈旧 claim 可被接管)。
@@ -137,11 +137,6 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     private oversizeCellOf;
     /** 读面的**唯一**行读法(`loadPage` 的块读与超门行的单条读共用):序数 ≥ `from` 的至多 `limit` 行,字节超 `inlineBytes` 的行 `resultJson` 为 null(只回 `resultBytes`)。 */
     private readRows;
-    /** GC — purge ALL journal entries for a run (every incarnation), then its owner row ([ref]). Scoped by run_id alone;
-     *  idempotent (returns the journal rows removed). Mirrors the resume-anchor store's deleteBySession. An append racing the
-     *  two DELETEs can leave a row behind without its owner record; it is keyed by the dead incarnation — readable and
-     *  overwritable by no one (file header) — and the GC sweep removes it by age. */
-    deleteByRun(runId: string): Promise<number>;
     /** [ref] / WF2([ref] core 拍板 a 形,签名逐字)—— cross-replica resume admission lease。
      *
      *  语义(bake-store `idem_key UNIQUE` 先例):PK (source_run_id, scope) 上的原子赢或观察。四步,每步
@@ -165,10 +160,10 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
         newRunId: string;
         scope: string;
     }): Promise<void>;
-    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at_ms < now - maxAgeMs). The
-     *  per-run deleteByRun has no production caller (a run-store reap gives no per-run hook), so this bounded sweep
-     *  — wired into the service reaper — is what keeps the heaviest table (TaskResult-bearing) from growing without
-     *  bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).
+    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at_ms < now - maxAgeMs). This is the
+     *  journal's ONE delete path (the engine's contract has no per-run delete; its File store's was retired in core 7.61.0,
+     *  and this store's went with it) — wired into the service reaper, it is what keeps the heaviest table
+     *  (TaskResult-bearing) from growing without bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).
      *  Idempotent; returns the journal rows purged.
      *
      *  [ref]: the same cutoff then purges owner rows whose OWN clock (`appended_at_ms`, pushed by every append of the

package/dist/{plugins → stores-sql}/workflow-journal-store-sql.js

@@ -1,9 +1,9 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { assertJournalEntryFits } from "@sema-agent/core";
-import { journalEntryOfCell, journalRowPayloadOf } from "./workflow-journal-payload.js";
+import { journalEntryOfCell, journalRowPayloadOf } from "../plugins/workflow-journal-payload.js";
 import { randomUUID } from "node:crypto";
-import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
+import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
+import { jsonColumnText, jsonColumnTextExpr } from "../plugins/sql-json-column.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 const INT_MIN = -2147483648;
 const INT_MAX = 2147483647;
@@ -75,11 +75,6 @@ export class SqlWorkflowJournalStore {
         const { rows } = await this.db.query(this.q(`SELECT ordinal, call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("mysql", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? AND ordinal >= ? ORDER BY ordinal ASC LIMIT ?`, `SELECT ordinal, call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 AND ordinal >= $4 ORDER BY ordinal ASC LIMIT $5`), params);
         return rows.map((r) => ({ ordinal: Number(r.ordinal), callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
     }
-    async deleteByRun(runId) {
-        const res = await this.db.query(this.q("DELETE FROM workflow_journal WHERE run_id = ?", "DELETE FROM workflow_journal WHERE run_id = $1"), [runId]);
-        await this.db.query(this.q("DELETE FROM workflow_journal_owner WHERE run_id = ?", "DELETE FROM workflow_journal_owner WHERE run_id = $1"), [runId]);
-        return res.affected;
-    }
     async resumeClaim(input) {
         const now = Date.now();
         const ins = await this.db.query(this.q("INSERT IGNORE INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at_ms) VALUES (?, ?, ?, ?)", "INSERT INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at_ms) VALUES ($1, $2, $3, $4) ON CONFLICT (source_run_id, scope) DO NOTHING"), [input.sourceRunId, input.scope, input.newRunId, now]);

package/dist/task-a2a.d.ts

@@ -57,7 +57,7 @@ export declare const A2A_PEER_DISPOSITION: {
     readonly toolAxes: "engine";
 };
 /** 请求体 `a2aPeers[i]` 的键闭集 = 处置表的键(书写序即判序)。 */
-export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "principalHeader" | "toolAxes" | "cardUrl" | "allowSkills")[];
+export declare const A2A_PEER_ENTRY_KEYS: readonly ("name" | "headers" | "url" | "cardUrl" | "principalHeader" | "allowSkills" | "toolAxes")[];
 /**
  * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
  * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
@@ -80,6 +80,12 @@ export declare function validateRequestA2a(raw: unknown): {
     ok: A2aDraft[];
     dropped: A2aInjectionDrop[];
 } | null;
+/**
+ * 一份请求的 `a2aPeers` 里,读器挂得上、`headers` 却剔掉了成员的那些坐标(`a2aPeers[<下标>].headers.__proto__`:成员名过回显清洗,只会是读器的保留名,不带值、不带调用方写的对端名)——
+ * 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 A2A 一座。读器与挂载同一只({@link normalizeA2aPeer},续跑重放腿的读法;新提交腿上同一形由判官表 400)。
+ * 挂不上的对端不算(整条不进,有自己的留声)。`storedToolAxes` = 续跑重放腿递的 M19 重读座。不是数组 ⇒ 空。
+ */
+export declare function requestA2aHeadersUnread(raw: unknown, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * 请求体 `a2aPeers`「这份声明能不能原样用」的回答者(与 MCP 的 `requestMcpDeclarationRefusal` 同一副骨架、同一个拒形):
  *  ① **列表**:在场却不是数组 / 超过 {@link MAX_REQUEST_A2A_PEERS} 条(撞帽机读位一组键)/ 某一条不是对象 ⇒ `400 request.field_invalid`;

package/dist/task-a2a.js

@@ -244,21 +244,18 @@ export function validateRequestA2a(raw) {
 }
 function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw === undefined || raw === null)
-        return { ok: [], dropped: [], toolAxesReread: [], headersLost: [] };
+        return { ok: [], dropped: [], toolAxesReread: [] };
     if (!Array.isArray(raw))
         return null;
     const ok = [];
     const dropped = [];
     const toolAxesReread = [];
-    const headersLost = [];
     for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
         const read = normalizeA2aPeer(e, leg, `${A2A_SEAT.list}[${i}]`, storedToolAxes);
         if (read.draft !== null) {
             ok.push(read.draft);
             if (read.toolAxesReread !== undefined)
                 toolAxesReread.push({ peer: read.draft.spec.name, sentence: read.toolAxesReread });
-            if (read.headersLost !== undefined)
-                headersLost.push({ peer: read.draft.spec.name, lost: read.headersLost });
         }
         else
             dropped.push({ peer: declaredName(e).slice(0, 128), ...read.because });
@@ -266,7 +263,20 @@ function validateRequestA2aEntries(raw, leg, storedToolAxes) {
     if (raw.length > MAX_REQUEST_A2A_PEERS) {
         dropped.push({ peer: `(+${raw.length - MAX_REQUEST_A2A_PEERS} over cap of ${MAX_REQUEST_A2A_PEERS})`, ...declarationOverCapFacts(A2A_SEAT, raw.length) });
     }
-    return { ok, dropped, toolAxesReread, headersLost };
+    return { ok, dropped, toolAxesReread };
+}
+export function requestA2aHeadersUnread(raw, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_A2A_PEERS).entries()) {
+        const at = `${A2A_SEAT.list}[${i}]`;
+        const read = normalizeA2aPeer(e, "resume", at, storedToolAxes);
+        if (read.draft !== null)
+            for (const member of read.headersLost ?? [])
+                out.push(`${at}.${member}`);
+    }
+    return out;
 }
 function requestA2aPeerRefusal(entry, at) {
     const snapshot = snapshotPeer(entry, false);
@@ -323,15 +333,6 @@ export function resolveRequestA2a(baseline, bodyA2a, config, desk, lease, logger
             note: "this replayed request was stored before the upgrade and the peer's toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade reader reads it (members that do not fit are dropped) and the peer stays mounted — once the window closes the same request leaves this peer unmounted",
         });
     }
-    for (const h of v.headersLost) {
-        if (baselineNames.has(h.peer))
-            continue;
-        logger?.warn("a2a_peer_headers_members_dropped", {
-            peer: h.peer,
-            lost: h.lost,
-            note: "this replayed request carries a headers member named \"__proto__\" for this peer (the engine refuses that name); the peer stays mounted with every other header as written, the named member left out. A new submission with the same peer leaves it unmounted",
-        });
-    }
     return merged;
 }
 //# sourceMappingURL=task-a2a.js.map

package/dist/task-cwd.d.ts

@@ -32,9 +32,9 @@ export declare function dirCoversPath(dir: string, target: string): boolean;
  *      刻意的单写者惯用法,不是疏漏:在消费端补第二道闸 = 把一条不变量拆给两个属主(同族消费者
  *      {@link effectiveHostWorkspace} 形状完全相同)。机器背书 = test/task-cwd.test.ts 的 [ref] 两格。
  *   2. 🔴 **前瞻/防御臂,本仓当前装配下零命中**([ref],2026-08-19 合并重扫 partial,存活断言):
- *      in-process 单用户 lane(部署形表行 `inProcessSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
- *      服务一个真部署形,其实到不了 —— 该 lane 的 `remoteExec` 未设 ⇒ boot/execution-env.ts 六条工厂臂全
- *      不命中 ⇒ core 落 `StubExecutionEnv` ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
+ *      无手(`none`)单用户 lane(部署形表行 `noHandsSingleUser`)取引擎自身 `process.cwd()`。它读起来像在
+ *      服务一个真部署形,其实到不了 —— 该 lane 声明没有执行环境 ⇒ boot/execution-env.ts 的工厂臂全
+ *      不命中、执行环境座也不给 ⇒ `handsEnabled=false` ⇒ 不挂 Bash ⇒ 未知工具在 agent-loop 走
  *      `tool.not_found`(**不进审批座**)⇒ 无 `ruleOffers` ⇒ 本函数在规则车道上根本不被调用;同 lane
  *      第 1 臂也因写侧闸只在 `callerCwd` 下开而恒空。危害口径按 refuter **降级**:死枝 ≡ 落第 3 臂
  *      `undefined` ≡ core global 缺省 ≡ [ref] 修前行为,**今天零用户可见伤害**,不是「恒不命中」类缺陷。
@@ -102,4 +102,12 @@ export declare function effectiveHostWorkspace(sessionCwd: string | undefined, c
     isolation?: string;
     parentCwd?: string;
 }): string | undefined;
+/**
+ * run 外回退口问「host 工厂这一次会落在一只**实在的**目录上吗」:根 = {@link effectiveHostWorkspace}(引擎 run 外环境请求的上下文归约成 `{}` ⇒ 就是登记的 cwd),
+ * 且它此刻是盘上的一只目录 ⇒ 交回它;没有根,或那只目录**不在**(`ENOENT` / `ENOTDIR`,或在但不是目录)⇒ `undefined`(调用方答 409:根不可知)。
+ * 「看不到」不是「不在」:其余 errno(`EACCES` / `ELOOP` / `EIO`)原样抛 —— 路由未分类 500 + 运维 warn,与 `memory-store-refusal.ts` 的解析故障同读法;
+ * 把它读成 409 会把一只权限 / 环路故障遮成「用户把目录移走了」。三态读法同 `project-identity.ts` 的 statFact。
+ * 只读不建:工厂对一只消失的 cwd 会 `mkdir -p` 把它建回来(那是 run 的读法),回退不许替用户把移走的目录建回来再往里写。
+ */
+export declare function presentHostWorkspaceOf(sessionCwd: string | undefined): Promise<string | undefined>;
 //# sourceMappingURL=task-cwd.d.ts.map

package/dist/task-cwd.js

@@ -1,4 +1,6 @@
 import path from "node:path";
+import { stat } from "node:fs/promises";
+import { errorCodeOf } from "./observability/err-text.js";
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export function normalizeAbsolutePathLexically(p) {
@@ -11,7 +13,7 @@ export function dirCoversPath(dir, target) {
     return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 export function cardRuleScopeRoot(registeredCwd, config, cwd = process.cwd) {
-    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.inProcessSingleUser.holds(config) ? cwd() : undefined);
+    const raw = registeredCwd ?? (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) ? cwd() : undefined);
     return raw === undefined ? undefined : path.resolve(raw);
 }
 export function satisfiedByProcessCwd(requested, realpath, cwd = process.cwd) {
@@ -44,4 +46,18 @@ export function parseAdditionalDirectories(raw) {
 export function effectiveHostWorkspace(sessionCwd, ctx) {
     return sessionCwd ?? (ctx.isolation !== "worktree" ? ctx.parentCwd : undefined);
 }
+export async function presentHostWorkspaceOf(sessionCwd) {
+    const root = effectiveHostWorkspace(sessionCwd, {});
+    if (root === undefined)
+        return undefined;
+    try {
+        return (await stat(root)).isDirectory() ? root : undefined;
+    }
+    catch (err) {
+        const code = errorCodeOf(err);
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw err;
+        return undefined;
+    }
+}
 //# sourceMappingURL=task-cwd.js.map

package/dist/task-mcp.d.ts

@@ -121,6 +121,14 @@ type ValidatedRequestMcp = {
         value: string;
     }>;
 };
+/**
+ * 一份请求的 `mcpServers` 里,读器挂得上、transport 却有几处不交给引擎的那些坐标(`mcpServers[<下标>].transport.headers` / `….env.__proto__` 一类:只有键路径,
+ * 成员名只会是读器的保留名,不带值、不带调用方写的 server 名)—— 「请求成员读不出」那一只判据(`unread-request-members.ts`)的 MCP 一座。
+ * 读器与挂载同一只({@link normalizeServer},契约包 `readRequestMcpTransport` 报的 `lost`);挂不上的条目(硬坏形)不算 —— 它们整条不挂、有自己的通告;
+ * 名字在 `closed`(部署占住的名字,{@link deploymentClosedMcpNames})里的条目也不算 —— 合并时输给部署(`name_reserved_by_deployment`),它的 transport 一处都不会交给引擎。
+ * `storedToolAxes` = 续跑重放腿递的 M19 重读座(同一只条目在挂载时也经它判挂不挂得上)。不是数组 ⇒ 空(整只忽略那一臂,不是本判据的事)。
+ */
+export declare function requestMcpTransportUnread(raw: unknown, closed: ReadonlySet<string>, storedToolAxes?: StoredToolAxesRereadM19): string[];
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -181,8 +189,8 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 重放腿走读器({@link normalizeServer} / {@link classifyRequestMcp}),处置:整只不是数组 ⇒ 整只忽略 + 运维 warn `mcp_injection_ignored`;条目不是对象 / 坏硬键
  * (`name` / `transport` 硬字段 / `allowTools` / `toolAxes` / `toolFaces`)⇒ 这一条 server 整条不进 + 运维 warn `mcp_injection_dropped` + 用户面通告 `mcp.injection_dropped` 点名 `field`
  * (`toolAxes` 在一次性迁移 M19 的窗开着时先按升级前读法重读一次,过了就挂,见读器的注);超上限的尾项 ⇒ `over_cap` 点名;坏软键(`contentOrigin` / `elicitation` / `source`)
- * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段 ⇒ 只不交坏的那几处(`env` / `headers` 对 JSON 存体按 7.131.x 的判据整键交或不交,
- * 交出去的剔掉 `__proto__` 名成员),server 照挂,运维 warn `mcp_transport_members_dropped` 逐处点名 —— 续跑重放腿不静默丢声明。
+ * 与词表外的键 ⇒ 丢键、server 照挂(`contentOrigin` 另有 `mcp_content_class_dropped` 留声);`transport` 软字段有几处读器不交(`env` / `headers` 不是纯数据的串记录、其中名叫 `__proto__` 的成员、
+ * `args` / `principalHeader` 坏形)⇒ 这份请求不重放(「请求成员读不出」那一只判据,`unread-request-members.ts`,经 {@link requestMcpTransportUnread} 读这一座;续跑腿折 409)。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
 /** 一次发送从一份声明里带出的头:件头(调用方原样写的名 → 值,由对端座按原字节作答)与身份头名(引擎按主体写值)。 */

package/dist/task-mcp.js

@@ -93,22 +93,31 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
     const dropped = [];
     const badContentOrigin = [];
     const toolAxesReread = [];
-    const transportLost = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
                 toolAxesReread.push({ server: v.spec.name, sentence: v.toolAxesReread });
-            if (v.transportLost.length > 0)
-                transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread, transportLost };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
+}
+export function requestMcpTransportUnread(raw, closed, storedToolAxes) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const [i, e] of raw.slice(0, MAX_REQUEST_MCP_SERVERS).entries()) {
+        const v = normalizeServer(e, () => undefined, storedToolAxes);
+        if (v.ok && !closed.has(v.spec.name))
+            for (const issue of v.transportLost)
+                out.push(`mcpServers[${i}].${issue.path}`);
+    }
+    return out;
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -324,18 +333,6 @@ function classifyHonored(baseline, entries, config, desk, lease, logger, storedT
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
-    for (const t of v.transportLost) {
-        if (!mounted.has(t.server))
-            continue;
-        logger?.warn("mcp_transport_members_dropped", {
-            server: t.server,
-            lost: t.lost.slice(0, MAX_KEY_ECHO),
-            ...(t.lost.length > MAX_KEY_ECHO ? { lostTotal: t.lost.length } : {}),
-            note: "this replayed request carries parts of this server's transport declaration that cannot be handed to the engine — an env / headers record that is not a plain object of string values (left out whole, as the pre-upgrade server read it), " +
-                "a member named \"__proto__\" in env / headers (only that member is left out: the engine refuses the name), args that are not a list of strings, a principalHeader that is not a string; " +
-                "the server mounts with the rest. A new submission with the same entry is refused (400)",
-        });
-    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toMcpDraft), reservedNames, desk, lease),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],