@sema-agent/server 7.146.0 → 7.148.0

package/dist/leader/fanout.js

@@ -37,76 +37,91 @@ export async function fanOut(subtasks, opts) {
     };
     const sem = new Semaphore(opts.maxConcurrency);
     let pendingCancel;
-    const maybeCancelOnSuspend = (r) => {
-        if (opts.cancelOnSuspend && r.status === "suspended" && !cancelled) {
-            opts.logger?.info?.("fanout_suspend_cancel", { suspendedWorker: r.workerId });
-            pendingCancel ??= cancelAll();
-        }
-        return r;
-    };
-    const runOne = async (st) => {
-        const base = { workerId: st.workerId, sessionId: st.sessionId, branch: st.branch, baseSha: st.baseSha };
-        return sem.run(async () => {
-            if (sharedAC.signal.aborted)
-                return { ...base, status: "timeout", error: "cancelled before start" };
-            if (opts.runWorker) {
+    let parentStop;
+    let deadlineTimer;
+    let graceTimer;
+    const parentStopped = new Promise((resolve) => { parentStop = () => resolve("stopped"); });
+    const onParentAbort = () => { pendingCancel ??= cancelAll(); parentStop(); };
+    if (opts.signal?.aborted)
+        onParentAbort();
+    else
+        opts.signal?.addEventListener("abort", onParentAbort, { once: true });
+    try {
+        const maybeCancelOnSuspend = (r) => {
+            if (opts.cancelOnSuspend && r.status === "suspended" && !cancelled) {
+                opts.logger?.info?.("fanout_suspend_cancel", { suspendedWorker: r.workerId });
+                pendingCancel ??= cancelAll();
+            }
+            return r;
+        };
+        const runOne = async (st) => {
+            const base = { workerId: st.workerId, sessionId: st.sessionId, branch: st.branch, baseSha: st.baseSha };
+            return sem.run(async () => {
+                if (sharedAC.signal.aborted)
+                    return { ...base, status: "timeout", error: "cancelled before start" };
+                if (opts.runWorker) {
+                    try {
+                        return maybeCancelOnSuspend(redactWorkerReportError(await opts.runWorker(st, sharedAC.signal)));
+                    }
+                    catch (e) {
+                        return { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
+                    }
+                }
+                let stream;
                 try {
-                    return maybeCancelOnSuspend(redactWorkerReportError(await opts.runWorker(st, sharedAC.signal)));
+                    stream = opts.runner.runTaskStream({ ...st.spec, sessionId: st.sessionId, signal: sharedAC.signal });
                 }
                 catch (e) {
-                    return { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
+                    return { ...base, status: "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
                 }
-            }
-            let stream;
-            try {
-                stream = opts.runner.runTaskStream({ ...st.spec, sessionId: st.sessionId, signal: sharedAC.signal });
-            }
-            catch (e) {
-                return { ...base, status: "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
-            }
-            streams.set(st.workerId, stream);
-            let report;
-            try {
-                const result = await stream.result();
-                const plane = outwardPlane(result.terminal);
-                report = { ...base, status: mapStatus(result.terminal), stats: result.stats, ...(plane.errorMessage ? { error: redactErrorMessage(plane.errorMessage) ?? "" } : {}) };
-            }
-            catch (e) {
-                report = { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
-            }
-            finally {
-                streams.delete(st.workerId);
-            }
-            return maybeCancelOnSuspend(report);
-        });
-    };
-    const results = new Map();
-    const work = Promise.all(subtasks.map((st) => runOne(st).then((r) => { results.set(st.workerId, r); return r; })));
-    const timer = new Promise((resolve) => {
-        const id = setTimeout(() => resolve("timeout"), opts.timeoutMs);
-        void work.then(() => clearTimeout(id));
-    });
-    const raced = await Promise.race([work.then(() => "done"), timer]);
-    if (raced === "timeout") {
-        opts.logger?.warn?.("fanout_timeout", { timeoutMs: opts.timeoutMs, workers: subtasks.length });
-        await cancelAll();
-        const graceMs = opts.cancelGraceMs ?? CANCEL_GRACE_MS;
-        const grace = new Promise((resolve) => {
-            const id = setTimeout(() => resolve("grace"), graceMs);
-            void work.then(() => clearTimeout(id));
+                streams.set(st.workerId, stream);
+                let report;
+                try {
+                    const result = await stream.result();
+                    const plane = outwardPlane(result.terminal);
+                    report = { ...base, status: mapStatus(result.terminal), stats: result.stats, ...(plane.errorMessage ? { error: redactErrorMessage(plane.errorMessage) ?? "" } : {}) };
+                }
+                catch (e) {
+                    report = { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
+                }
+                finally {
+                    streams.delete(st.workerId);
+                }
+                return maybeCancelOnSuspend(report);
+            });
+        };
+        const results = new Map();
+        const work = Promise.all(subtasks.map((st) => runOne(st).then((r) => { results.set(st.workerId, r); return r; })));
+        const timer = new Promise((resolve) => {
+            deadlineTimer = setTimeout(() => resolve("timeout"), opts.timeoutMs);
         });
-        if ((await Promise.race([work.then(() => "done"), grace])) === "grace") {
-            opts.logger?.warn?.("fanout_cancel_grace_expired", { graceMs, settled: results.size, of: subtasks.length });
-            return {
-                reports: subtasks.map((st) => results.get(st.workerId) ?? { workerId: st.workerId, sessionId: st.sessionId, branch: st.branch, baseSha: st.baseSha, status: "timeout", error: "did not settle within cancel grace" }),
-                cancelled,
-            };
+        const raced = await Promise.race([work.then(() => "done"), timer, parentStopped]);
+        if (raced === "timeout") {
+            opts.logger?.warn?.("fanout_timeout", { timeoutMs: opts.timeoutMs, workers: subtasks.length });
+            pendingCancel ??= cancelAll();
         }
+        if (pendingCancel) {
+            const sweep = pendingCancel.catch(() => { });
+            const graceMs = opts.cancelGraceMs ?? CANCEL_GRACE_MS;
+            const grace = new Promise((resolve) => {
+                graceTimer = setTimeout(() => resolve("grace"), graceMs);
+            });
+            if ((await Promise.race([Promise.all([sweep, work]).then(() => "done"), grace])) === "grace") {
+                opts.logger?.warn?.("fanout_cancel_grace_expired", { graceMs, settled: results.size, of: subtasks.length });
+                return {
+                    reports: subtasks.map((st) => results.get(st.workerId) ?? { workerId: st.workerId, sessionId: st.sessionId, branch: st.branch, baseSha: st.baseSha, status: "timeout", error: "did not settle within cancel grace" }),
+                    cancelled,
+                };
+            }
+        }
+        const reports = await work;
+        return { reports, cancelled };
+    }
+    finally {
+        opts.signal?.removeEventListener("abort", onParentAbort);
+        clearTimeout(deadlineTimer);
+        clearTimeout(graceTimer);
     }
-    const reports = await work;
-    if (pendingCancel)
-        await pendingCancel.catch(() => { });
-    return { reports, cancelled };
 }
 const CANCEL_GRACE_MS = 30_000;
 //# sourceMappingURL=fanout.js.map

package/dist/leader/leader.d.ts

@@ -84,6 +84,12 @@ export interface LeaderRunEntry {
  */
 export declare function withLeaderLeg<S extends Partial<TaskSpec>>(spec: S, entry: LeaderRunEntry): S & UnattendedLegSpec;
 export interface LeaderDeps {
+    /**
+     * 本 run 的中止信号(取消口 / 陈旧裁决;HTTP 驱动腿恒给,`endpoint.ts` 的 `drive`)。与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消(单测 / bench 形)。
+     * 读法只有一条:段界核点(规划后、每次建 worker 前、每波扇出后、模块门、collapse / redispatch、合并前)看见 abort ⇒ 交 {@link stoppedResult} 的那一份,
+     * 不再起任何新的计费工作;在跑的腿经 spec 的同一根信号中止(fan-out 共享信号 / 修复腿 / 单代理修复环);合并在 push 咽喉前再核一次(`merge.ts`)。
+     */
+    signal?: AbortSignal;
     /** 本 run 的入口体({@link LeaderRunEntry}:运维地板在 run 出生时盖一次)。必填:没有地板的装配写 `{}` —— 缺席不是「没有地板」的合法拼法。
      *  模块门修复与单代理修复环这两个出生点从这里取词(经 {@link withLeaderLeg})。 */
     entry: LeaderRunEntry;
@@ -175,6 +181,9 @@ export interface LeaderResult {
     reports: WorkerReport[];
     merge?: MergeResult;
     cancelled: boolean;
+    /** 只在这条 run 在某个中止核点停下时在场(恒 `true`):核点之后没有起新的工作、**零 push**(push 咽喉的核点在 `deps.push` 正上方)。
+     *  缺席 = run 走完了自己的路(含「取消晚到、push 已发出」—— 那一趟的结局照实)。HTTP 驱动腿据它判取消终局(`failed` + `errorCode: "cancelled"`)。 */
+    stopped?: true;
     /** Which route the difficulty router picked (search [43]): "single" = a 1-subtask plan, "fanout" = N. */
     route?: "single" | "fanout";
     /** Set when planning/provisioning failed before fan-out. */
@@ -243,6 +252,13 @@ export interface LeaderResult {
         gradedHash?: string;
     };
 }
+/** 中止核点停下的那一句(人读;机读位是 {@link LeaderResult.stopped})。 */
+export declare const LEADER_RUN_STOPPED = "leader run stopped at an abort checkpoint (cancel): no further work was started and nothing was pushed after the stop";
+/**
+ * 中止核点的**唯一**结果形(`runLeaderTask` 每一处段界核点、合并停下的那一形都交这一只):`stopped: true` + 已知的报告 +
+ * 其中停驻着的 worker(`suspended[]`,与 C4 的形同 —— 取消落定时 HTTP 驱动腿按它和 `reports[]` 过期这条 run 的残留停驻)。不打捞(取消 = 立刻停)。
+ */
+export declare function stoppedResult(reports: WorkerReport[], route: LeaderResult["route"]): LeaderResult;
 /**
  * Run a task to an integrated, pushed result. Never throws — failures (plan, provision, fan-out, merge) are
  * captured in LeaderResult. ALWAYS destroys every provisioned worker env (leader owns the lifecycle).

package/dist/leader/leader.js

@@ -22,14 +22,25 @@ export function withLeaderLeg(spec, entry) {
     const word = entryPermissionMode(spec.permissionMode, entry.permissionMode).effective;
     return withUnattendedLeg(word === undefined ? spec : { ...spec, permissionMode: word });
 }
+export const LEADER_RUN_STOPPED = "leader run stopped at an abort checkpoint (cancel): no further work was started and nothing was pushed after the stop";
+export function stoppedResult(reports, route) {
+    const sus = reports.filter((r) => r.status === "suspended").map((r) => ({ workerId: r.workerId, sessionId: r.sessionId }));
+    return { ok: false, reports, cancelled: true, stopped: true, error: LEADER_RUN_STOPPED, ...(route ? { route } : {}), ...(sus.length > 0 ? { suspended: sus } : {}) };
+}
 export async function runLeaderTask(task, durableBaseSha, deps) {
+    const signal = deps.signal;
+    const aborted = () => signal?.aborted === true;
     let subs;
     try {
         subs = await deps.plan(task);
     }
     catch (e) {
+        if (aborted())
+            return stoppedResult([], undefined);
         return { ok: false, reports: [], cancelled: false, error: `plan failed: ${e instanceof Error ? e.message : String(e)}` };
     }
+    if (aborted())
+        return stoppedResult([], undefined);
     if (subs.length === 0)
         return { ok: false, reports: [], cancelled: false, error: "planner produced no sub-tasks" };
     const route = subs.length === 1 ? "single" : "fanout";
@@ -37,6 +48,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
     let finalReports = [];
     try {
         for (const sub of subs) {
+            if (aborted())
+                return stoppedResult([], route);
             try {
                 workers.push(await deps.provisionWorker(sub));
             }
@@ -52,7 +65,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
         const toSubtask = (w) => ({
             workerId: w.workerId, sessionId: w.sessionId, branch: w.branch, baseSha: w.baseSha, spec: w.spec,
         });
-        const foBase = { runner, timeoutMs: deps.timeoutMs, maxConcurrency: deps.maxConcurrency, cancelOnSuspend: true, ...(deps.logger ? { logger: deps.logger } : {}) };
+        const foBase = { runner, timeoutMs: deps.timeoutMs, maxConcurrency: deps.maxConcurrency, cancelOnSuspend: true, ...(signal ? { signal } : {}), ...(deps.logger ? { logger: deps.logger } : {}) };
         const runWave = async (sts) => {
             if (!deps.verifyWorker) {
                 return fanOut(sts, {
@@ -149,12 +162,16 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 return runWave([toSubtask(solo)]);
             }
         };
+        if (aborted())
+            return stoppedResult([], route);
         const fo1 = route === "single" && workers.length === 1
             ? await runSolo(workers[0], subs[0])
             : await runWave(workers.map(toSubtask));
         let reports = fo1.reports;
         let cancelled = fo1.cancelled;
         finalReports = reports;
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const workerRepoDir = deps.workerRepoDir ?? deps.repoDir;
         const workerDiff = (w) => w.fetchDiff
             ? w.fetchDiff()
@@ -193,6 +210,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const w = byId.get(r.workerId);
                 const sub = subById.get(r.workerId);
                 for (let attempt = 0; attempt <= maxR; attempt++) {
+                    if (aborted())
+                        return;
                     const d = await workerDiff(w);
                     if (!d.ok)
                         return;
@@ -201,6 +220,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     r.repairs = attempt;
                     if (verdict.ok)
                         return;
+                    if (aborted())
+                        return;
                     const safeVerdictReason = redactErrorMessage(verdict.reason ?? "behaviorally incorrect") ?? "";
                     if (attempt === maxR) {
                         r.status = "failed";
@@ -209,7 +230,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.entry)).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.entry)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }
@@ -222,6 +243,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             }));
         };
         await runModuleGate();
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const mergeDeps = {
             pullWorkerDiff: async (r) => workerDiff(byId.get(r.workerId)),
             provisionIntegrationSandbox: deps.provisionIntegrationSandbox,
@@ -232,6 +255,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             ...(deps.mergeGates?.measureGates ? { measureGates: true } : {}),
             ...(deps.mergeGates?.strongOracleSeeded ? { strongOracleSeeded: true } : {}),
             ...(deps.mergeGates?.measureDrivesRepair ? { measureDrivesRepair: deps.mergeGates.measureDrivesRepair } : {}),
+            ...(signal ? { signal } : {}),
             ...(deps.logger ? { logger: deps.logger } : {}),
         };
         let redispatched;
@@ -260,8 +284,10 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
         });
         const collapseToSingle = async (trigger, reason) => {
             const safeReason = redactHead(reason, 300);
-            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: safeReason });
             const replan = { trigger, collapsed: safeReason, ...(redispatched ? { redispatched } : {}) };
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
+            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: safeReason });
             const soloSub = { workerId: "collapse-solo", branch: "worker/collapse-solo", files: ["."], spec: { objective: task } };
             let solo;
             try {
@@ -274,12 +300,18 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             workers.push(solo);
             byId.set(solo.workerId, solo);
             bySession.set(solo.sessionId, solo);
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
             const fo = await runSolo(solo, soloSub);
             finalReports = [...reports, ...fo.reports];
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
             const sus = await surfaceSuspended(finalReports, fo.reports);
             if (sus)
                 return { ...sus, replan: { ...replan, trigger: "suspended" }, ...(repairTerminal ? { repairTerminal } : {}), ...(candidatePatch ? { candidatePatch } : {}) };
             const m = await mergeBranches(fo.reports, durableBaseSha, mergeDeps);
+            if (!m.ok && m.stopped)
+                return { ...stoppedResult(finalReports, route), merge: m, replan };
             if (!m.ok && m.conflict) {
                 const cc = m.conflict;
                 deps.logger?.warn?.("merge_conflict_to_user", { conflicted: cc.conflicted, applied: cc.applied, files: cc.files.slice(0, 20) });
@@ -325,6 +357,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const fresh = [];
                 try {
                     for (const id of failedIds) {
+                        if (aborted())
+                            return stoppedResult(finalReports, route);
                         const w = await deps.provisionWorker(subById.get(id));
                         fresh.push(w);
                         workers.push(w);
@@ -342,6 +376,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const retryById = new Map(fo2.reports.map((r) => [r.workerId, r]));
                 reports = reports.map((r) => retryById.get(r.workerId) ?? r);
                 finalReports = reports;
+                if (aborted())
+                    return stoppedResult(finalReports, route);
                 const sus2 = await surfaceSuspended(reports, fo2.reports);
                 if (sus2)
                     return sus2;
@@ -351,7 +387,11 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 }
             }
         }
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const merge = await mergeBranches(reports, durableBaseSha, mergeDeps);
+        if (!merge.ok && merge.stopped)
+            return { ...stoppedResult(finalReports, route), merge };
         if (!merge.ok && merge.conflict) {
             const c = merge.conflict;
             deps.logger?.warn?.("merge_conflict_to_user", { conflicted: c.conflicted, applied: c.applied, files: c.files.slice(0, 20) });

package/dist/leader/merge.d.ts

@@ -52,6 +52,7 @@ export interface IntegrationRepair {
         errorText: string;
         testCmd: string;
         repoDir: string;
+        signal?: AbortSignal;
     }): Promise<{
         costUsd?: number;
         note?: string;
@@ -154,11 +155,17 @@ export interface MergeDeps {
         /** Parse the integrated patch into a changed-file list (the wire binds `git apply --numstat` / name-only). */
         changedFiles: (integratedPatch: string) => Promise<string[]>;
     };
+    /** 这条 leader run 的中止信号(与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消)。核点同一只判(`stopAt`):建集成沙箱前、
+     *  每一轮集成修复前、测试判决处、**push 咽喉**(下面唯一一处 `deps.push` 调用的正上方)。全部 push 路径都过那一处调用 ⇒ 中止被看见之后零 push;
+     *  已经发出的 push 不撤(同步 git,发出之后本进程看不见中止),它的结局照实回。 */
+    signal?: AbortSignal;
     logger?: {
         warn?: (m: string, x?: Record<string, unknown>) => void;
         info?: (m: string, x?: Record<string, unknown>) => void;
     };
 }
+/** 中止被看见时合并停下的那一句(人读;机读位是 `stopped`)。 */
+export declare const MERGE_STOPPED_REASON = "cancelled before push \u2014 the leader run was stopped, nothing was pushed";
 /** Integration-repair outcome (when `MergeDeps.provisionIntegrationSandbox` supplied a `repair`): how many
  *  rounds ran, whether the post-repair `testCmd` finally passed, and the repair spend. `outsidePlannedFiles`
  *  is honest accounting — repaired files are NOT attributed to the original disjoint workers. */
@@ -193,7 +200,8 @@ export type MergeResult = {
     measure?: {
         pass: boolean;
         reason?: string;
-    };
+    }; /** 只在中止信号被看见、合并在 push 之前停下时在场(恒 `true`):这一趟零 push。 */
+    stopped?: true;
 };
 /** Integrate completed workers' branches. Never throws — failures are typed MergeResult. */
 export declare function mergeBranches(reports: WorkerReport[], baseSha: string, deps: MergeDeps): Promise<MergeResult>;

package/dist/leader/merge.js

@@ -4,6 +4,7 @@ import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 const CONFLICT_FILES_MAX = 200;
 const CONFLICT_REJ_HEAD_MAX = 2048;
+export const MERGE_STOPPED_REASON = "cancelled before push — the leader run was stopped, nothing was pushed";
 export async function mergeBranches(reports, baseSha, deps) {
     const repo = deps.repoDir ?? "/repo";
     const mergeable = reports.filter((r) => r.status === "completed");
@@ -14,6 +15,9 @@ export async function mergeBranches(reports, baseSha, deps) {
     let phase = "diff-out";
     let repairMeta;
     let measure;
+    const stopAt = (at) => deps.signal?.aborted
+        ? { ok: false, phase: at, reason: MERGE_STOPPED_REASON, stopped: true, ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}) }
+        : undefined;
     try {
         const patches = [];
         for (const r of mergeable) {
@@ -24,6 +28,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             patches.push({ workerId: r.workerId, patch: d.patch });
         }
         phase = "provision";
+        const stoppedBeforeSandbox = stopAt("provision");
+        if (stoppedBeforeSandbox)
+            return stoppedBeforeSandbox;
         const integ = await deps.provisionIntegrationSandbox();
         destroy = integ.destroy;
         const { env } = integ;
@@ -59,6 +66,8 @@ export async function mergeBranches(reports, baseSha, deps) {
             let cost = 0;
             let round = 0;
             for (; round < integ.repair.maxRounds && test.exitCode !== 0; round++) {
+                if (deps.signal?.aborted)
+                    break;
                 const errorText = redactTail(test.stdout + "\n" + test.stderr, 4000);
                 if (errorText.startsWith(OVERSIZED_DIAG_PLACEHOLDER)) {
                     deps.logger?.warn?.("integration_repair_skipped_oversized_output", { round: round + 1, outputChars: test.stdout.length + test.stderr.length });
@@ -66,7 +75,7 @@ export async function mergeBranches(reports, baseSha, deps) {
                 }
                 deps.logger?.warn?.("integration_repair_round", { round: round + 1, maxRounds: integ.repair.maxRounds });
                 try {
-                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo });
+                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo, signal: deps.signal });
                     cost += r.costUsd ?? 0;
                 }
                 catch (e) {
@@ -80,6 +89,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             repairMeta = { rounds: round, fixed: test.exitCode === 0, costUsd: cost };
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
         }
+        const stoppedAtTest = stopAt("test");
+        if (stoppedAtTest)
+            return stoppedAtTest;
         if (test.exitCode !== 0) {
             return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}) };
         }
@@ -116,6 +128,9 @@ export async function mergeBranches(reports, baseSha, deps) {
                 ...(repairMeta ? { repair: repairMeta } : {}),
             };
         }
+        const stoppedBeforePush = stopAt("push");
+        if (stoppedBeforePush)
+            return stoppedBeforePush;
         const push = await deps.push(integrated.stdout, baseSha);
         if (!push.ok) {
             if (push.raced)

package/dist/leader/repair-wire.js

@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.entry);
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.entry);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,10 +1,35 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type CheckpointToken } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
 import { type CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
 import type { LeaderRequestBody } from "./endpoint.js";
+/**
+ * leader worker 停驻行的两只 scope —— **唯一属主**(审批停驻 / 资源分片停驻各一只;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS` /
+ * `RESERVED_PRINCIPAL_PREFIXES`)。worker 的 durable spec 与取消时的残留过期({@link createLeaderParkExpirer})读这同一对。
+ */
+export declare const LEADER_APPROVAL_SCOPE = "_leader";
+export declare function leaderResourceScope(workerId: string): string;
+/** 过期残留停驻要的那两口(SQL 两方言与 local 店都有;结构型,单测用假件)。 */
+export interface LeaderParkStore {
+    findPendingTokenBySession(sessionId: string, scope?: string): Promise<CheckpointToken | null | undefined>;
+    expire(token: CheckpointToken, scope: string): Promise<boolean>;
+}
+/** 一次过期的回执:`expired` = CAS 赢的行数;`lost` = 找到了却没过期掉的行数(并发的 `/decide` 或 reaper 先结算了它 —— 被决的那一张会作为它自己的续跑接着走)。 */
+export interface LeaderParkExpiry {
+    readonly expired: number;
+    readonly lost: number;
+}
+/**
+ * 取消落定时把这条 leader run 的子 worker 残留停驻按 CAS 过期(与 reaper 同一口 `expire`:同一张停驻**永不**既被过期又被续跑)。
+ * 对每个 `{ workerId, sessionId }`,在两只 scope 上逐张排空(读口一次只交一张)。回执见 {@link LeaderParkExpiry}。
+ * 已经被决过的停驻不在待决集里 ⇒ 不碰(它的续跑是一条独立的 run,停它走 `POST /v1/runs/:id/cancel`)。
+ */
+export declare function createLeaderParkExpirer(store: LeaderParkStore): (workers: ReadonlyArray<{
+    readonly workerId: string;
+    readonly sessionId: string;
+}>) => Promise<LeaderParkExpiry>;
 /** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
 export interface LeaderDurableSeat {
     readonly checkpointStore: CheckpointStoreFull;
@@ -87,7 +112,7 @@ export interface LeaderWireConfig {
      * 全在那里(`createBrain` 自己不记账)。而 `POST /v1/leader` 的准入处**读**的正是 costQuota / fleetLease
      * 这两个桶。缺席 ⇒ 门查的桶与花钱的手不是同一只:`MAX_PRINCIPAL_COST_USD` 与 fleet 租约对这条腿结构性
      * 失效,而一条 leader run 扇出 ≤6 个带手 worker + planner + repair/conflict 环,全是实钱。
-     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withPrincipal`)—— 记账臂按 `currentPrincipal()`
+     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withSubject`)—— 记账臂按 `currentPerson()`
      * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
      */
     tracer?: RunnerDeps["tracer"];
@@ -98,6 +123,11 @@ export interface LeaderWireConfig {
      * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
      */
     mods?: RunnerDeps["mods"];
+    /**
+     * **手带**(`RunnerDeps.hands`),原样递给本车道的每一只 Runner。唯一铸点 = `boot/runner-deps.ts` 的 `buildHandsBand`(共享基座调的同一只):
+     * 前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT`,本车道不署名。缺失时本车道的 Runner 没有手带(超时即杀、不署名)。缺席 ⇒ 展开空对象。
+     */
+    hands?: RunnerDeps["hands"];
     /**
      * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
      * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与
@@ -293,6 +323,8 @@ export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
  *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
  *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
  *  唯一新增是六条 execFileSync 各自的 `timeout`。
+ *  每条都显式交 `stdio: "pipe"`:不交 `stdio` 时 Node 把子进程的 stderr 原样转写到本进程 stderr(git / credential helper 的诊断直通、绕过日志出口接缝);
+ *  交了之后它只进错误对象,失败句经返回值的 `error` 交给调用方、由调用方的日志行过座(`test/log-exit-single-source-gate.test.ts` 钉「同步子进程必须显式交 stdio」)。
  *
  *  7.103.0([ref] 残余):六条 git 子进程的 env 一律 = `gitSubprocessEnv({ isolateConfig: false })` + `LC_ALL=C`(修前:
  *  `{ ...process.env, LC_ALL: "C" }`,两条 `git config` 连 env 都不交 ⇒ 整份服务 env 进 git 与它拉起的 helper / hook)。
@@ -304,6 +336,7 @@ export declare function createCoordinatorPush(durableRemote: string, targetRef:
     name: string;
     email: string;
 }): LeaderDeps["push"];
-export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
+/** 返回的函数收本 run 的中止信号(`createLeaderEndpoint` 的驱动腿恒交一根;与 core `TaskSpec.signal?` 同约定可选 —— 不交 = 这次调用停不下)。 */
+export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody, signal?: AbortSignal) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map