@sema-agent/server 7.146.0 → 7.147.0

package/dist/config-invariants.d.ts

@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "require-execution-lane" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -65,7 +65,7 @@ export interface CrossInvariant {
 }
 /**
  * ── [ref] ① 推广(车 UZ 推广轮):**拒因句单铸点**是一类 —— 下面五只是 `config.ts` 区里五条跨域拒启的**判据 + 句子的唯一属主**
- * (`executionLaneRequiredRefusal` / `modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
+ * (`modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
  * 没有第二份文本可漂。修前这五条逐条两份不同的句子(boot 手写一份、表里另写一份),boot 那份是运维在 stderr 读到的(`config-validation.test.ts`
  * 钉着它的指纹),表那份只在热路径上被调 —— 而热键集带不上这些键 ⇒ 实际无读者。句子**取 boot 那份**(逐字不变);类钉 =
  * `test/config-hot/batch1-cross-invariants.test.ts` 的「类钉」一格(每条带 `bootAnchor` 的条目,boot 点不手写句子、且来自注册表本人或 check 同调的函数)。
@@ -84,6 +84,16 @@ export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariant
  * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
  */
 export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/**
+ * `operator-declaration-required`([ref])—— **单用户部署必须说出谁是运维**。单用户形(租户轴不成立,`DEPLOYMENT_SHAPE_PREDICATES.multiTenant`)上
+ * 「谁是运维」只有两种答法:`OPERATOR_SINGLE_USER=true`(每个调用方都是)或具名 `OPERATOR_PRINCIPALS`;两样都没有 = 没人能用这台部署的运维面
+ * (审批队列全量、诊断、outcomes、管理与记忆治理口),而升级前它是静默的 —— 本条把它变成起服拒,拒句一行给出两条出路。不加旋钮、不加宽限、不给缺省:
+ * 只有字面 `true` 是声明(`=false` 与缺席同判)。多租形不归本条:空名单 = 没人是运维是合法的多租姿态(durable 形另由 `operator-principals-required` 管)。
+ * 出路 A 只在单用户 ∧ 空名单时给出 —— 恰是 `operator-single-user` 放行的形;忘设 `REQUIRE_PRINCIPAL` 的团队机器不该照它把每个调用方变成运维,句子把它点出来。
+ * **两处调用、一只判据**:兜底座在装配运维面的地方(`createHttpServer`,装路由之前;所有装运维面者都过,嵌入方只过这一座,表条目的锚在这里);
+ * 服务入口另在起服第 1 段早拒(先于店连接与中心拉取)。不在 `loadConfig`:律管的是有运维面的进程,不装路由的 `run-local`(一次性 CLI,同读 `loadConfig`)不在射程。
+ */
+export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
 /** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,要**具名**运维 —— 空名单下要么没人用得了,要么(单用户声明)人人用得了。 */
 export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
 /**
@@ -133,6 +143,11 @@ export declare function remoteConfigProviderUrlRefusal(v: {
  * 留在扫车道自持门(`boot/retention-lane.ts`)。状态型:三键都只来自 env、运行期无写点 ⇒ 热路径上恒与 boot 同答。
  */
 export declare function retentionLaneRefusal(v: Pick<CrossInvariantView, "retentionPolicy" | "retentionSweep">): string | undefined;
+/**
+ * `run-stale-heartbeat` 的判据与拒因(唯一属主;[ref] ① 同形 —— 注册表条目的 `check` 与起服第 1 段的早拒都调它)。参数取窄 `Pick`:起服第 1 段手里是
+ * 合成之前的 raw 配置(执行车道还没定形),本条不读车道。
+ */
+export declare function runStaleHeartbeatRefusal(v: Pick<CrossInvariantView, "runStaleSec">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**([ref]②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -8,17 +8,17 @@ import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
 import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
 import { authBridgeIssuerOf } from "./auth-bridge.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
-import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
-    const lane = executionLaneOf(v.remoteExec?.provider);
+    const lane = v.remoteExec.provider;
     if (DEPLOYMENT_SHAPE_PREDICATES.laneSeparatesTenants.holds(v))
         return undefined;
-    const outlets = REMOTE_EXEC_PROVIDER_WORDS.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
+    const outlets = ALL_EXECUTION_LANES.filter((w) => executionLaneCaps(w).tenantSeparation === "supported");
     return (`REQUIRE_PRINCIPAL=true (multi-tenant posture) with the "${lane}" execution lane runs every tenant's Bash on one shared target — ` +
         `this lane does not separate tenants; set REMOTE_EXEC to ${outlets.join(" / ")}, or unset REQUIRE_PRINCIPAL for a single-user box`);
 }
@@ -56,6 +56,20 @@ export function operatorSingleUserRefusal(v) {
         return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
     return undefined;
 }
+export function operatorDeclarationRefusal(v) {
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(v) || v.operatorPrincipals.length > 0 || v.operatorSingleUser === true)
+        return undefined;
+    return ("No operator is declared for this single-user deployment: REQUIRE_PRINCIPAL is off, OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not true, " +
+        "so no caller could use its operator endpoints (the approval queues across owners, GET /v1/diagnostics/wiring, GET /v1/outcomes, the admin and memory-governance endpoints). " +
+        "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
+        "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
+}
+function sameOperatorDeclaration(a, b) {
+    return (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) &&
+        a.operatorSingleUser === b.operatorSingleUser &&
+        a.operatorPrincipals.length === b.operatorPrincipals.length &&
+        a.operatorPrincipals.every((p, k) => p === b.operatorPrincipals[k]));
+}
 export function bakeOperatorPrincipalsRefusal(v) {
     return v.imageBakes.enabled && v.operatorPrincipals.length === 0
         ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host and needs named operators: with an empty list nobody can use it, and the single-user operator declaration would open it to every caller (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
@@ -132,15 +146,18 @@ export function retentionLaneRefusal(v) {
     return (`RETENTION_SWEEP_INTERVAL_SEC=${intervalSec} arms the retention sweep lane, but ${gaps} — the lane would enumerate domains every tick and compute nothing. ` +
         "Set RETENTION_MAX_AGE_DAYS, or set RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off. Refusing to boot.");
 }
+export function runStaleHeartbeatRefusal(v) {
+    return v.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
+        ? `runStaleSec (${v.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
+        : undefined;
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
         keys: ["runStaleSec"],
         restartReason: "run-stale-heartbeat",
         bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:run-stale-heartbeat" },
-        check: ({ next }) => next.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
-            ? `runStaleSec (${next.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
-            : undefined,
+        check: ({ next }) => runStaleHeartbeatRefusal(next),
     },
     {
         id: "bind-posture",
@@ -181,6 +198,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
         check: ({ next }) => operatorSingleUserRefusal(next),
     },
+    {
+        id: "operator-declaration-required",
+        keys: ["requirePrincipal", "operatorPrincipals", "operatorSingleUser"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/http/server.ts", marker: "CROSS-INVARIANT:operator-declaration-required" },
+        check: ({ live, next }) => (sameOperatorDeclaration(live, next) ? undefined : operatorDeclarationRefusal(next)),
+    },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
@@ -203,20 +227,13 @@ export const CONFIG_CROSS_INVARIANTS = [
             }
         },
     },
-    {
-        id: "require-execution-lane",
-        keys: ["requireExecutionLane", "remoteExec"],
-        restartReason: "execution-lane",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
-        check: ({ next }) => executionLaneRequiredRefusal(next),
-    },
     {
         id: "leader-host-lane",
         keys: ["leaderEnabled", "remoteExec"],
         restartReason: "leader-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:leader-host-lane" },
-        check: ({ next }) => next.leaderEnabled && next.remoteExec?.provider === "host"
-            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, CONFIG_PROVIDER=local with REMOTE_EXEC unset, or a " +
+        check: ({ next }) => next.leaderEnabled && next.remoteExec.provider === "host"
+            ? "LEADER_ENABLED=true on the host execution lane (REMOTE_EXEC=host, or a " +
                 "config.d/remote-exec.json host override) is refused: the leader wire pins ONE absolute workspace path " +
                 "(LEADER_WORKSPACE / the /home/user default) for every sub-worker, while the host adapter gives each env a " +
                 "DIFFERENT random directory — so N concurrent host workers would share one physical git worktree and " +
@@ -251,13 +268,13 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "dbBackend", "tidb", "pg"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-store" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
+        check: ({ next }) => next.remoteExec.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
             ? `REMOTE_EXEC=device with DB_BACKEND=${next.dbBackend} and no SQL connection coordinates built is refused ` +
                 "[device-durable-store]: the device registry, the session↔device binding and the device audit trail are all " +
                 "SQL-backed — without a real SQL store the binding lives in this process only, so a restart forgets WHICH device " +
                 "a parked run must resume onto and a second replica cannot see it at all. Note DB_BACKEND alone is not enough: " +
                 "SESSION_BACKEND=memory (or auto with no MYSQL_HOST/PG_HOST) builds no coordinates at all. Configure a durable " +
-                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or unset REMOTE_EXEC " +
+                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) " +
                 "(device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
@@ -266,11 +283,11 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["remoteExec", "durableApproval"],
         restartReason: "device-lane",
         bootAnchor: { file: "src/boot/execution-lane.ts", marker: "CROSS-INVARIANT:device-durable-approval" },
-        check: ({ next }) => next.remoteExec?.provider === "device" && !next.durableApproval
+        check: ({ next }) => next.remoteExec.provider === "device" && !next.durableApproval
             ? "REMOTE_EXEC=device without DURABLE_APPROVAL=true is refused [device-durable-approval]: a personal device goes " +
                 "offline (lid closed, network drop) at arbitrary points, so an in-flight approval that outlives the window MUST " +
                 "have a park exit — without the durable approval store there is none and the run is stuck with nowhere to persist. " +
-                "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)"
+                "Set DURABLE_APPROVAL=true, or declare another lane (REMOTE_EXEC=none if the agent's tools need no execution environment) (device-executor-lane-v2 §4.7 boot invariant)"
             : undefined,
     },
     {

package/dist/config-lkg.d.ts

@@ -1,5 +1,5 @@
 import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
-import type { PublishedPromptArtifact } from "@sema-agent/core";
+import { type PublishedPromptArtifact } from "@sema-agent/core";
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
 export interface PersistedLkg {
     formatVersion: 5;

package/dist/config-lkg.js

@@ -2,10 +2,11 @@ import { promises as fs } from "node:fs";
 import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
 import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
-import { randomBytes } from "node:crypto";
+import { ensureDir } from "@sema-agent/core";
 import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { centerStateBin } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
+import { atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
 }
@@ -28,10 +29,8 @@ export function lkgReadDenyRows(configLkgPath) {
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
     const body = { formatVersion: 5, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
-    const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
-    await fs.mkdir(dirname(path), { recursive: true });
-    await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
-    await fs.rename(tmp, path);
+    ensureDir(dirname(path));
+    await atomicWriteFileAsync(path, JSON.stringify(body), { durability: "best-effort" });
 }
 export async function loadLkg(path, worker, identity) {
     let text;
@@ -153,7 +152,7 @@ function lkgPayloadShapeProblem(effective, etag) {
     const eff = effective;
     if (typeof eff.version !== "number")
         return "bad effective.version";
-    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["limits", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["a2a", "peers"], ["scenarios", "scenarios"], ["limits", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;

package/dist/config-provider.js

@@ -169,6 +169,7 @@ export function mapToServiceEffective(eff, version) {
                 tier: m.tier,
                 ...(m.reasoning !== undefined ? { reasoning: m.reasoning } : {}),
                 ...(m.vision !== undefined ? { vision: m.vision } : {}),
+                ...(m.thinkingLevelMap !== undefined ? { thinkingLevelMap: m.thinkingLevelMap } : {}),
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
                 ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),
@@ -187,6 +188,7 @@ export function mapToServiceEffective(eff, version) {
         },
         ...(eff.collab?.templates?.length ? { collab: { templates: eff.collab.templates } } : {}),
         ...(eff.plugins?.plugins?.length ? { plugins: { plugins: eff.plugins.plugins } } : {}),
+        a2a: eff.a2a,
         skills: {
             skills: (eff.skills.skills ?? []).map((s) => ({
                 name: s.name,