@sema-agent/server 7.146.0 → 7.148.0

package/dist/boot/shutdown.d.ts

@@ -18,11 +18,11 @@
  *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
  *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */
-import { Runner, type RunnerDeps } from "@sema-agent/core";
+import { Runner, type NodeLspManager } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import type { createHttpServer } from "../http/server.js";
 import type { RetentionLaneController } from "./retention-lane.js";
-import type { Logger } from "../observability/logger.js";
+import { type Logger } from "../observability/logger.js";
 import type { startOtlpExporter } from "../observability/otel-exporter.js";
 import type { CostQuota } from "../observability/cost-quota.js";
 import type { RateLimiter } from "../observability/rate-limit.js";
@@ -61,7 +61,8 @@ export interface ShutdownCtx {
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     runner: Runner;
     subRunner: Runner;
-    lspManager: RunnerDeps["lspManager"];
+    /** 铸点 `createLspManager` 的返回值(本机语言服务器管理器;缺席 = 这台部署不挂)。 */
+    lspManager: NodeLspManager | undefined;
     workflowNotifyJournal: WorkflowNotifyJournalStore | undefined;
     fleetClient: ReturnType<typeof startFleetClientFromConfig>;
     backend: StoreBackend | undefined;
@@ -83,7 +84,7 @@ export interface ShutdownCtx {
     /** [ref]-2:config 60s 刷新环(web-admin startRefreshLoop)——不停的话停机中途还可能热应用
      *  一份新配置。缺席 = 纯 env 部署没起环。 */
     webAdmin: {
-        stopRefreshLoop(): void;
+        stopRefreshLoop(): Promise<void>;
     } | undefined;
     /** [ref]:活体审批协调器(`TOOL_APPROVAL_ENABLED` 关 ⇒ 缺席)。hardShutdown 起点调它的 `drainForShutdown`:本进程握着的活卡
      *  按断连同路收场、审计留有序关停记号 —— 否则下一次 boot 把有序重启读成崩溃(`crashed_before_park`)。 */

package/dist/boot/shutdown.js

@@ -1,4 +1,5 @@
 import { Runner } from "@sema-agent/core";
+import { writeLogText } from "../observability/logger.js";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
@@ -56,7 +57,7 @@ export function installShutdownHandlers(ctx) {
     const onUncaughtException = (err) => {
         try {
             writeLastWords(err);
-            console.error(err);
+            writeLogText("stderr", err);
         }
         finally {
             process.exit(1);
@@ -74,7 +75,7 @@ export function installShutdownHandlers(ctx) {
         }
         try {
             writeLastWords(err);
-            console.error(err);
+            writeLogText("stderr", err);
         }
         finally {
             process.exit(1);
@@ -136,12 +137,12 @@ export function installShutdownHandlers(ctx) {
         storeLiveProbe?.stop();
         servingLease?.stop();
         void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: seatText("operator-log-text", String(err)) }));
-        webAdmin?.stopRefreshLoop();
+        const credentialSettled = webAdmin?.stopRefreshLoop() ?? Promise.resolve();
         otelExporter?.stop();
         breakerState?.stop();
         runner.sessions.dispose();
         subRunner.sessions.dispose();
-        void lspManager?.dispose?.();
+        void lspManager?.dispose();
         void workflowNotifyJournal?.close?.();
         const backgroundSoftStopped = exitBoundary.reapChildProcessesEarly();
         const softStoppedAt = Date.now();
@@ -164,6 +165,7 @@ export function installShutdownHandlers(ctx) {
             void Promise.all([retentionTeardown, ledgerStopped])
                 .then(() => (backend ? backend.close() : Promise.resolve()))
                 .then(() => routingStopped)
+                .finally(() => credentialSettled)
                 .finally(() => backgroundGrace)
                 .finally(() => process.exit(0));
         });

package/dist/boot/stage-01-config.d.ts

@@ -1,5 +1,5 @@
 export declare function runStage01(): {
-    config: import("../config-types.js").ServiceConfig;
+    config: import("../config-types.js").LoadedConfig;
     localRoot: string;
     logger: import("../observability/logger.js").Logger;
     metrics: import("../observability/metrics.js").Metrics;

package/dist/boot/stage-01-config.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { loadConfig, logConfigDiagnostics, splitLocalRoots } from "../config.js";
 import { configLocalRoot } from "../config-provider.js";
-import { crossInvariant } from "../config-invariants.js";
+import { operatorDeclarationRefusal, operatorSingleUserBoundaryRefusal, runStaleHeartbeatRefusal, singleUserAnonymousBoundaryRefusal } from "../config-invariants.js";
 import { drainNumEnvWarnings } from "../plugins/remote-shell.js";
 import { setWebSearchBadPayloadObserver } from "../plugins/web-search.js";
 import { createLogger } from "../observability/logger.js";
@@ -20,10 +20,22 @@ export function runStage01() {
     declareServerWithheldEnv();
     const config = loadConfig();
     bindOwnCredentialsConfig(config);
-    const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
+    const runStaleFailure = runStaleHeartbeatRefusal(config);
     if (runStaleFailure !== undefined) {
         throw new Error(runStaleFailure);
     }
+    const operatorDeclarationFailure = operatorDeclarationRefusal(config);
+    if (operatorDeclarationFailure !== undefined) {
+        throw new Error(operatorDeclarationFailure);
+    }
+    const anonymousBoundaryFailure = singleUserAnonymousBoundaryRefusal(config);
+    if (anonymousBoundaryFailure !== undefined) {
+        throw new Error(anonymousBoundaryFailure);
+    }
+    const singleUserBoundaryFailure = operatorSingleUserBoundaryRefusal(config);
+    if (singleUserBoundaryFailure !== undefined) {
+        throw new Error(singleUserBoundaryFailure);
+    }
     const logger = createLogger(config.logLevel);
     const metrics = createMetrics();
     installFailOpenRecorder({ logger, metrics, redactDetail: redactSecrets });

package/dist/boot/stage-02-web-admin-pull.d.ts

@@ -1,8 +1,9 @@
 import type { runStage01 } from "./stage-01-config.js";
 export declare function runStage02(ctx: Awaited<ReturnType<typeof runStage01>>): Promise<{
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-02-web-admin-pull.js

@@ -1,7 +1,10 @@
 import { createUnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { createWebAdminRuntime } from "./web-admin.js";
-import { composeExecutionLane, FILE_SOURCED_LANES } from "./execution-lane.js";
+import { composeExecutionLane, HTTP_SERVICE_LANE_ENTRY } from "./execution-lane.js";
 import { configSourceKind } from "../config-provider.js";
+import { announceConfigRootEnclosingWorkspace } from "../sema-config-dir.js";
+import { launchWorkspaceOf } from "../task-cwd.js";
+import { buildCandidateRejectionNotes } from "../web-admin-client/candidate-gate.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
 import { logEnvModelsMigration, runEnvModelsMigration } from "../config-root-migration.js";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
@@ -9,19 +12,23 @@ import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-re
 import { isRosterGateArmed } from "../config.js";
 import { judgeServedModelRoute } from "../model-route-endpoint.js";
 import { servedModelTableLeg } from "../model-select.js";
+import { captureBootStoreEvidence } from "./store-evidence.js";
 export async function runStage02(ctx) {
-    const { config, localRoot, logger, metrics } = ctx;
-    const configSource = configSourceKind(config);
+    const { config: loaded, localRoot, logger, metrics } = ctx;
+    const storeEvidence = await captureBootStoreEvidence({ config: loaded, localRoot });
+    const configSource = configSourceKind(loaded);
     if (configSource === "local") {
-        await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: config.configLocalOwnerUid });
-        const envModelsMigration = { root: localRoot, env: process.env, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) };
+        await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: loaded.configLocalOwnerUid });
+        const envModelsMigration = { root: localRoot, env: process.env, envTableIsPlaceholder: isRosterGateArmed(loaded.webAdmin) };
         logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
     }
-    await composeExecutionLane(config, { configSource, localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });
+    const config = await composeExecutionLane(loaded, { configSource, localRoot, logger, entry: HTTP_SERVICE_LANE_ENTRY });
+    announceConfigRootEnclosingWorkspace(config, logger, launchWorkspaceOf(config));
     const webAdmin = await createWebAdminRuntime({ config, logger, metrics, localRoot });
     const servedLeg = servedModelTableLeg(config);
-    const noDefaultModel = defaultModelRefusal(config, servedLeg);
+    const rejection = webAdmin.candidateRejectionState();
+    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes: rejection === undefined ? undefined : buildCandidateRejectionNotes(rejection) }, servedLeg);
     if (noDefaultModel !== undefined) {
         throw new Error(noDefaultModel);
     }
@@ -35,6 +42,6 @@ export async function runStage02(ctx) {
     }
     const ceilingVerdict = createUnpricedCeilingVerdict({ config, logger });
     ceilingVerdict.judge();
-    return { ...ctx, ceilingVerdict, webAdmin };
+    return { ...ctx, config, ceilingVerdict, storeEvidence, webAdmin };
 }
 //# sourceMappingURL=stage-02-web-admin-pull.js.map

package/dist/boot/stage-03-store-backend.d.ts

@@ -1,5 +1,7 @@
 import type { runStage02 } from "./stage-02-web-admin-pull.js";
+import type { AdoptionWiring } from "../adoption/plan.js";
 export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>): Promise<{
+    adoptionWiring: AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -24,9 +26,10 @@ export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-03-store-backend.js

@@ -1,9 +1,10 @@
 import { uuidv7 } from "@sema-agent/core";
 import { openStores } from "./stores.js";
 export async function runStage03(ctx) {
-    const { config, localRoot, logger, metrics } = ctx;
-    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, sessionCaptureRecords, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportStores, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, storeSweep, } = await openStores({ config, logger, metrics, localRoot });
+    const { config, localRoot, logger, metrics, storeEvidence } = ctx;
+    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, sessionCaptureRecords, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportStores, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, storeSweep, } = await openStores({ config, logger, metrics, localRoot, storeEvidence });
+    const adoptionWiring = { memoryEngine: memoryExportStores !== undefined, taskAttachment: taskAttachmentStore !== undefined };
     const instanceId = uuidv7();
-    return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportStores, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, storeSweep, taskAttachmentStore, taskListLane, usageWindowStore };
+    return { ...ctx, adoptionWiring, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportStores, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, storeSweep, taskAttachmentStore, taskListLane, usageWindowStore };
 }
 //# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -30,6 +30,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -54,9 +55,10 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-04-stores.js

@@ -8,7 +8,7 @@ import { createRuleConsentLane } from "../rules-consent.js";
 import { createConsolidationValve } from "./memory-consolidation.js";
 import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage04(ctx) {
-    const { backend, breakerState, config, logger, memoryEngine, metrics } = ctx;
+    const { adoptionWiring, backend, breakerState, config, logger, memoryEngine, metrics } = ctx;
     const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine) : undefined;
     const memoryComplianceFaces = memoryEngine
         ? createMemoryComplianceFaces(memoryEngine, {
@@ -24,7 +24,7 @@ export async function runStage04(ctx) {
         ? createSessionMemoryStatusFace(memoryEngine)
         : undefined;
     const { valve: consolidationValve, watch: consolidationSeatWatch } = createConsolidationValve({ config, memoryEngine, logger });
-    const adoptionBoot = await runAdoptionBootScan({ backend, logger });
+    const adoptionBoot = await runAdoptionBootScan({ backend, logger, wiring: adoptionWiring });
     if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
         logger.info("adoption_boot_scan", { ...adoptionBoot });
     }

package/dist/boot/stage-05-execution-env.d.ts

@@ -6,13 +6,15 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -51,6 +53,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -75,9 +78,10 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-05-execution-env.js

@@ -10,12 +10,12 @@ import { SANDBOX_GIT_PLANE_OFF_TEXT } from "../sandbox-git-plane.js";
 import { createPeerDesk } from "../peer-seat.js";
 export async function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
-    const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, seat: sessionStore.executionPlacement, replicaId: instanceId }) : undefined;
+    const deviceLane = config.remoteExec.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, seat: sessionStore.executionPlacement, replicaId: instanceId }) : undefined;
     const headOf = headReadOf(sessionStore);
     const spaceCommits = backend !== undefined ? () => runStore : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, sessionResidentBackground, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane: sandboxGitPlaneSeat, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
-    assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
-    if (deviceLane !== undefined && config.remoteExec?.provider === "device")
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, sessionResidentBackground, dropSessionScopedOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane: sandboxGitPlaneSeat, sandboxCapacity, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
+    assertDeviceLaneWired(config.remoteExec.provider === "device", deviceLane, executionEnvFactory !== undefined);
+    if (deviceLane !== undefined && config.remoteExec.provider === "device")
         await noteDeviceRelayBindings(config.remoteExec.relay, deviceLane.store, logger);
     assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { headOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     if (sandboxSecretSeatGate !== undefined)
@@ -34,6 +34,6 @@ export async function runStage05(ctx) {
     const peerDesk = createPeerDesk({ log: logger });
     metrics.dynamicGauge("peer_registry_entries", "Peer desk entries (declared peer credentials registered for in-flight legs and the roster)", () => peerDesk.size().entries);
     metrics.dynamicGauge("peer_registry_holders", "Peer desk holders of entries (host leases and engine holds), summed across entries", () => peerDesk.size().holders);
-    return { ...ctx, deploymentMods, deploymentModsLoaded, belowTaskChainPatterns, deviceLane, peerDesk, dropSessionScoped, executionEnvFactory, fenceSessionOwner, sessionResidentBackground, lspManager, spaceReclaimer, sandboxPodReaper, sandboxGitPlane, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
+    return { ...ctx, deploymentMods, deploymentModsLoaded, belowTaskChainPatterns, deviceLane, peerDesk, dropSessionScoped, dropSessionScopedOf, executionEnvFactory, fenceSessionOwner, sessionResidentBackground, lspManager, spaceReclaimer, sandboxReaper, sandboxGitPlane, sandboxCapacity, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
 }
 //# sourceMappingURL=stage-05-execution-env.js.map

package/dist/boot/stage-06-runners.d.ts

@@ -1,14 +1,8 @@
-/**
- * 装配第 6 段 —— **两只 Runner**(§3-6)。
- * workflow 编排 → 活体协调器 → per-principal caps → org/共享记忆 → checkpoint/留存/consolidation/治理座席 →
- * RunnerDeps → `new Runner` ×2(主 + 无手孪生)→ hook LLM/agent 载体 → 会话标题器 → subRunner ×2。
- * ⚠️ 位置即契约:checkpointStore 必须早于 `createGovernanceSeams` 与 `createRunnerDeps`;
- * `workflowModelAllowlistSnapshot` 必须与 `createRunnerDeps` 同步紧邻(两者之间零 await)。
- * 🔴 `runStore` / `parkedAskRedeem` 经 `late-binds.ts` 的晚绑 cell 读(原文同作用域前向引用/晚绑 holder)。
- */
 import { Runner } from "@sema-agent/core";
 import type { runStage05 } from "./stage-05-execution-env.js";
 export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): Promise<{
+    sessionEraser: import("../session-erase.js").SessionEraser | undefined;
+    settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
@@ -30,11 +24,11 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     question: import("../question.js").QuestionCoordinator | undefined;
-    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionExecutor: import("../plugins/retention-deployment.js").RetentionExecutor | undefined;
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    runtimeCapsPeekReading: ((principal: string | undefined) => Promise<import("../runtime-caps-resolver.js").RuntimeCapsReading>) | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
     sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
@@ -67,13 +61,15 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     deviceLane: import("./device-lane.js").DeviceLane | undefined;
     peerDesk: import("../peer-seat.js").PeerDesk;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
-    sessionResidentBackground: () => number;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
+    sessionResidentBackground: () => import("../session-resident-background.js").SessionResidentCounts;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
-    sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
+    sandboxReaper: import("../plugins/sandbox-reaper.js").SandboxReaper | undefined;
     sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxCapacity: import("../plugins/local-docker-capacity.js").LocalDockerCapacity | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -112,6 +108,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
+    adoptionWiring: import("../adoption/plan.js").AdoptionWiring;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
@@ -136,9 +133,10 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
     taskListLane: import("./task-list-lane.js").TaskListLane;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    config: import("../config-types.js").ServiceConfig;
     ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    storeEvidence: import("../store-posture.js").StoreEvidence;
     webAdmin: import("./web-admin.js").WebAdminRuntime;
-    config: import("../config-types.js").ServiceConfig;
     localRoot: string;
     logger: import("../index.js").Logger;
     metrics: import("../index.js").Metrics;

package/dist/boot/stage-06-runners.js

@@ -1,17 +1,18 @@
+import { createSessionEraseSettler } from "../session-erase.js";
 import { Runner, InMemoryToolResultStore, TtlSessionStore, uuidv7, createAllowDenyPolicy, workflowsCapability } from "@sema-agent/core";
+import { createEngineSessionRulesSeat } from "../session-rules-seat.js";
+import { headReadOf } from "../session-incarnation.js";
 import { outwardPlane } from "../terminal.js";
 import { createSessionTitler } from "../session-titler.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
 import { withoutHands } from "../capabilities/hands-lane.js";
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
-import { hasServiceAuth } from "../http/server.js";
-import { operatorRosterPresent } from "../http/principal-gate.js";
+import { hasServiceAuth } from "../identity-source.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
 import { buildConsolidationValveAudit, createMemoryConsolidationFaces, createOperatorValveWriteJudge, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
-import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
 import { assertApprovalAskRuleMaterialOnBackend } from "./stores.js";
@@ -20,7 +21,7 @@ import { CHECKPOINT_CTX_SEALING_REQUIRED } from "../http/checkpoint-ctx.js";
 import { sealCheckpointCtxCredentialsM28 } from "../checkpoint-ctx-seal-m28.js";
 import { retirePromptProfileM30 } from "../stored-request-prompt-profile-m30.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
-import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
+import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps, localOwnerRulesDeclared } from "./runner-deps.js";
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
@@ -28,10 +29,10 @@ import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-author
 import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
-import { retentionSweepRuns } from "../plugins/retention-store-sql.js";
+import { retentionSweepRuns } from "../plugins/retention-declaration.js";
 import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage06(ctx) {
-    const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
+    const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, spaceReclaimer, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
@@ -55,7 +56,7 @@ export async function runStage06(ctx) {
     if (streamApprovalGate.active)
         await assertApprovalAskRuleMaterialOnBackend(backend);
     const memoryOptOutGrantStore = backend?.memoryOptOutGrant();
-    const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekResolver } = createRuntimeCaps({ config, logger, memoryOptOutGrant: memoryOptOutGrantStore });
+    const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver, runtimeCapsPeekReading } = createRuntimeCaps({ config, logger, memoryOptOutGrant: memoryOptOutGrantStore });
     const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
     const sharedMemoryStore = orgMemoryAdmission.directory !== undefined
         ? backend?.sharedMemoryStore?.(createSharedMemoryScopeAuthorizer({
@@ -66,8 +67,10 @@ export async function runStage06(ctx) {
     if (sharedMemoryStore)
         logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
     const runnerOffloadStore = toolResultStore ?? new InMemoryToolResultStore({ maxTotalChars: 64_000_000 });
-    const commitHands = isBrandedDeployment(config) ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
-    const retentionExecutor = backend?.retention?.({ taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", logger });
+    const commitCoAuthor = isBrandedDeployment(config) ? "Sema <noreply@vivi-ai.com>" : undefined;
+    const retentionExecutorOptions = { taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", mailboxTables: mailboxStore !== undefined, completionInbox: workflowCompletionInbox !== undefined, logger };
+    const retentionExecutor = backend?.retention?.(retentionExecutorOptions);
+    const sessionEraser = backend?.sessionEraser?.(retentionExecutorOptions);
     const retentionLaneStore = backend?.retentionLane?.();
     assertRetentionLaneWirable({
         intervalSec: config.retentionSweep.intervalSec,
@@ -95,7 +98,8 @@ export async function runStage06(ctx) {
             models: config.models,
             tiers: config.tiers,
             roles: config.roles,
-            getApiKeyAndHeaders: createPerModelAuthSeat(() => webAdmin.getKeyResolver()),
+            modelApiKeyEnv: config.modelApiKeyEnv,
+            modelApiKeys: config.modelApiKeys,
         })
         : undefined;
     const memoryConsolidationFaces = consolidationSeat && memoryEngine
@@ -105,14 +109,13 @@ export async function runStage06(ctx) {
             ...(config.memoryProvenance !== undefined ? { provenance: config.memoryProvenance } : {}),
             onIncident: createOperatorFaceIncidentSink({ logger }, "memory_consolidation_incident"),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
-            writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
+            writeJudgeFor: (initiator) => createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, localOwnerDeclared: localOwnerRulesDeclared(config, permissionRuleProvider), initiator, config }),
             onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
             postureOf: governanceSeams.compliancePostureResolver,
         })
         : undefined;
     for (const w of buildConsolidationValveAudit({
         valve: consolidationValve,
-        operatorRosterPresent: operatorRosterPresent(config),
         hasServiceAuth: hasServiceAuth(config),
         allowUnauthedWrites: config.allowUnauthedWrites ?? false,
     }).warnings) {
@@ -130,16 +133,17 @@ export async function runStage06(ctx) {
     }
     const mcpRevocations = webAdmin.takeMcpRevocations();
     const workflowModelAllowlistSnapshot = workflowModelAllowlistFor(config) ?? [];
+    const engineSessionRules = sessionPolicyStore ? createEngineSessionRulesSeat(sessionPolicyStore, headReadOf(sessionStore)) : undefined;
     const runnerDeps = createRunnerDeps({
         consolidationSeat,
-        hands: commitHands,
+        commitCoAuthor,
         mcpRevocations,
         config, logger, metrics, localRoot, promptSource: webAdmin.promptSource, rosterStore, backgroundAgentStore, mailboxStore, mailboxRecipientLifecycle, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         engineDataRoot,
         peerDesk,
         sessionCaptureRecords,
-        memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
+        memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore: engineSessionRules, runtimeCapsResolver, fileHistoryStore,
         permissionRuleStore: permissionRuleProvider,
         executionEnvFactory, lspManager, fleetBus, deploymentMods, workflowRunStore, workflowJournalStore,
         workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, orgMemoryAdmission,
@@ -187,7 +191,7 @@ export async function runStage06(ctx) {
         ? createSessionTitler({
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
-            llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs, model: o.model }),
+            llm: hookLlm,
             logger,
             metrics,
         })
@@ -201,7 +205,7 @@ export async function runStage06(ctx) {
             metrics,
             config,
             logger,
-            hands: commitHands,
+            commitCoAuthor,
             mcpRevocations,
             brain,
             pricing,
@@ -215,7 +219,8 @@ export async function runStage06(ctx) {
             deploymentMods,
             toolResultStore: runnerOffloadStore,
             checkpointStore,
-            sessionPolicyStore,
+            fileHistoryStore,
+            sessionPolicyStore: engineSessionRules,
             usageWindowStore,
             orgMemoryAdmission,
             governanceSeams,
@@ -230,6 +235,7 @@ export async function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
+    const settleErasedSessions = createSessionEraseSettler({ attachments: taskAttachmentStore, spaceReclaimer, logger });
+    return { ...ctx, sessionEraser, settleErasedSessions, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekReading, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map