@sema-agent/server 7.147.0 → 7.148.0

package/dist/leader/merge.d.ts

@@ -52,6 +52,7 @@ export interface IntegrationRepair {
         errorText: string;
         testCmd: string;
         repoDir: string;
+        signal?: AbortSignal;
     }): Promise<{
         costUsd?: number;
         note?: string;
@@ -154,11 +155,17 @@ export interface MergeDeps {
         /** Parse the integrated patch into a changed-file list (the wire binds `git apply --numstat` / name-only). */
         changedFiles: (integratedPatch: string) => Promise<string[]>;
     };
+    /** 这条 leader run 的中止信号(与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消)。核点同一只判(`stopAt`):建集成沙箱前、
+     *  每一轮集成修复前、测试判决处、**push 咽喉**(下面唯一一处 `deps.push` 调用的正上方)。全部 push 路径都过那一处调用 ⇒ 中止被看见之后零 push;
+     *  已经发出的 push 不撤(同步 git,发出之后本进程看不见中止),它的结局照实回。 */
+    signal?: AbortSignal;
     logger?: {
         warn?: (m: string, x?: Record<string, unknown>) => void;
         info?: (m: string, x?: Record<string, unknown>) => void;
     };
 }
+/** 中止被看见时合并停下的那一句(人读;机读位是 `stopped`)。 */
+export declare const MERGE_STOPPED_REASON = "cancelled before push \u2014 the leader run was stopped, nothing was pushed";
 /** Integration-repair outcome (when `MergeDeps.provisionIntegrationSandbox` supplied a `repair`): how many
  *  rounds ran, whether the post-repair `testCmd` finally passed, and the repair spend. `outsidePlannedFiles`
  *  is honest accounting — repaired files are NOT attributed to the original disjoint workers. */
@@ -193,7 +200,8 @@ export type MergeResult = {
     measure?: {
         pass: boolean;
         reason?: string;
-    };
+    }; /** 只在中止信号被看见、合并在 push 之前停下时在场(恒 `true`):这一趟零 push。 */
+    stopped?: true;
 };
 /** Integrate completed workers' branches. Never throws — failures are typed MergeResult. */
 export declare function mergeBranches(reports: WorkerReport[], baseSha: string, deps: MergeDeps): Promise<MergeResult>;

package/dist/leader/merge.js

@@ -4,6 +4,7 @@ import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 const CONFLICT_FILES_MAX = 200;
 const CONFLICT_REJ_HEAD_MAX = 2048;
+export const MERGE_STOPPED_REASON = "cancelled before push — the leader run was stopped, nothing was pushed";
 export async function mergeBranches(reports, baseSha, deps) {
     const repo = deps.repoDir ?? "/repo";
     const mergeable = reports.filter((r) => r.status === "completed");
@@ -14,6 +15,9 @@ export async function mergeBranches(reports, baseSha, deps) {
     let phase = "diff-out";
     let repairMeta;
     let measure;
+    const stopAt = (at) => deps.signal?.aborted
+        ? { ok: false, phase: at, reason: MERGE_STOPPED_REASON, stopped: true, ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}) }
+        : undefined;
     try {
         const patches = [];
         for (const r of mergeable) {
@@ -24,6 +28,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             patches.push({ workerId: r.workerId, patch: d.patch });
         }
         phase = "provision";
+        const stoppedBeforeSandbox = stopAt("provision");
+        if (stoppedBeforeSandbox)
+            return stoppedBeforeSandbox;
         const integ = await deps.provisionIntegrationSandbox();
         destroy = integ.destroy;
         const { env } = integ;
@@ -59,6 +66,8 @@ export async function mergeBranches(reports, baseSha, deps) {
             let cost = 0;
             let round = 0;
             for (; round < integ.repair.maxRounds && test.exitCode !== 0; round++) {
+                if (deps.signal?.aborted)
+                    break;
                 const errorText = redactTail(test.stdout + "\n" + test.stderr, 4000);
                 if (errorText.startsWith(OVERSIZED_DIAG_PLACEHOLDER)) {
                     deps.logger?.warn?.("integration_repair_skipped_oversized_output", { round: round + 1, outputChars: test.stdout.length + test.stderr.length });
@@ -66,7 +75,7 @@ export async function mergeBranches(reports, baseSha, deps) {
                 }
                 deps.logger?.warn?.("integration_repair_round", { round: round + 1, maxRounds: integ.repair.maxRounds });
                 try {
-                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo });
+                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo, signal: deps.signal });
                     cost += r.costUsd ?? 0;
                 }
                 catch (e) {
@@ -80,6 +89,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             repairMeta = { rounds: round, fixed: test.exitCode === 0, costUsd: cost };
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
         }
+        const stoppedAtTest = stopAt("test");
+        if (stoppedAtTest)
+            return stoppedAtTest;
         if (test.exitCode !== 0) {
             return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}) };
         }
@@ -116,6 +128,9 @@ export async function mergeBranches(reports, baseSha, deps) {
                 ...(repairMeta ? { repair: repairMeta } : {}),
             };
         }
+        const stoppedBeforePush = stopAt("push");
+        if (stoppedBeforePush)
+            return stoppedBeforePush;
         const push = await deps.push(integrated.stdout, baseSha);
         if (!push.ok) {
             if (push.raced)

package/dist/leader/repair-wire.js

@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.entry);
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.entry);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,10 +1,35 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type CheckpointToken } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
 import { type CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
 import type { LeaderRequestBody } from "./endpoint.js";
+/**
+ * leader worker 停驻行的两只 scope —— **唯一属主**(审批停驻 / 资源分片停驻各一只;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS` /
+ * `RESERVED_PRINCIPAL_PREFIXES`)。worker 的 durable spec 与取消时的残留过期({@link createLeaderParkExpirer})读这同一对。
+ */
+export declare const LEADER_APPROVAL_SCOPE = "_leader";
+export declare function leaderResourceScope(workerId: string): string;
+/** 过期残留停驻要的那两口(SQL 两方言与 local 店都有;结构型,单测用假件)。 */
+export interface LeaderParkStore {
+    findPendingTokenBySession(sessionId: string, scope?: string): Promise<CheckpointToken | null | undefined>;
+    expire(token: CheckpointToken, scope: string): Promise<boolean>;
+}
+/** 一次过期的回执:`expired` = CAS 赢的行数;`lost` = 找到了却没过期掉的行数(并发的 `/decide` 或 reaper 先结算了它 —— 被决的那一张会作为它自己的续跑接着走)。 */
+export interface LeaderParkExpiry {
+    readonly expired: number;
+    readonly lost: number;
+}
+/**
+ * 取消落定时把这条 leader run 的子 worker 残留停驻按 CAS 过期(与 reaper 同一口 `expire`:同一张停驻**永不**既被过期又被续跑)。
+ * 对每个 `{ workerId, sessionId }`,在两只 scope 上逐张排空(读口一次只交一张)。回执见 {@link LeaderParkExpiry}。
+ * 已经被决过的停驻不在待决集里 ⇒ 不碰(它的续跑是一条独立的 run,停它走 `POST /v1/runs/:id/cancel`)。
+ */
+export declare function createLeaderParkExpirer(store: LeaderParkStore): (workers: ReadonlyArray<{
+    readonly workerId: string;
+    readonly sessionId: string;
+}>) => Promise<LeaderParkExpiry>;
 /** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
 export interface LeaderDurableSeat {
     readonly checkpointStore: CheckpointStoreFull;
@@ -87,7 +112,7 @@ export interface LeaderWireConfig {
      * 全在那里(`createBrain` 自己不记账)。而 `POST /v1/leader` 的准入处**读**的正是 costQuota / fleetLease
      * 这两个桶。缺席 ⇒ 门查的桶与花钱的手不是同一只:`MAX_PRINCIPAL_COST_USD` 与 fleet 租约对这条腿结构性
      * 失效,而一条 leader run 扇出 ≤6 个带手 worker + planner + repair/conflict 环,全是实钱。
-     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withPrincipal`)—— 记账臂按 `currentPrincipal()`
+     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withSubject`)—— 记账臂按 `currentPerson()`
      * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
      */
     tracer?: RunnerDeps["tracer"];
@@ -98,6 +123,11 @@ export interface LeaderWireConfig {
      * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
      */
     mods?: RunnerDeps["mods"];
+    /**
+     * **手带**(`RunnerDeps.hands`),原样递给本车道的每一只 Runner。唯一铸点 = `boot/runner-deps.ts` 的 `buildHandsBand`(共享基座调的同一只):
+     * 前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT`,本车道不署名。缺失时本车道的 Runner 没有手带(超时即杀、不署名)。缺席 ⇒ 展开空对象。
+     */
+    hands?: RunnerDeps["hands"];
     /**
      * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
      * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与
@@ -293,6 +323,8 @@ export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
  *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
  *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
  *  唯一新增是六条 execFileSync 各自的 `timeout`。
+ *  每条都显式交 `stdio: "pipe"`:不交 `stdio` 时 Node 把子进程的 stderr 原样转写到本进程 stderr(git / credential helper 的诊断直通、绕过日志出口接缝);
+ *  交了之后它只进错误对象,失败句经返回值的 `error` 交给调用方、由调用方的日志行过座(`test/log-exit-single-source-gate.test.ts` 钉「同步子进程必须显式交 stdio」)。
  *
  *  7.103.0([ref] 残余):六条 git 子进程的 env 一律 = `gitSubprocessEnv({ isolateConfig: false })` + `LC_ALL=C`(修前:
  *  `{ ...process.env, LC_ALL: "C" }`,两条 `git config` 连 env 都不交 ⇒ 整份服务 env 进 git 与它拉起的 helper / hook)。
@@ -304,6 +336,7 @@ export declare function createCoordinatorPush(durableRemote: string, targetRef:
     name: string;
     email: string;
 }): LeaderDeps["push"];
-export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
+/** 返回的函数收本 run 的中止信号(`createLeaderEndpoint` 的驱动腿恒交一根;与 core `TaskSpec.signal?` 同约定可选 —— 不交 = 这次调用停不下)。 */
+export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody, signal?: AbortSignal) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map

package/dist/leader/wire.js

@@ -21,9 +21,46 @@ import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
 import { buildInternalRunCtx } from "../internal-run-env.js";
-import { currentPrincipal } from "../observability/principal-context.js";
+import { currentSubject } from "../observability/principal-context.js";
+import { partsOf } from "../owner-brands.js";
+import { taskSpecIdentityOf } from "../engine-identity.js";
 import { redactHead } from "../observability/run-terminal.js";
 const REPAIR_LOOP_WIRED = true;
+export const LEADER_APPROVAL_SCOPE = "_leader";
+export function leaderResourceScope(workerId) {
+    return `_leader-resource-${workerId}`;
+}
+const PARK_DRAIN_MAX = 64;
+export function createLeaderParkExpirer(store) {
+    return async (workers) => {
+        let expired = 0;
+        let lost = 0;
+        const seen = new Set();
+        for (const w of workers) {
+            for (const scope of [LEADER_APPROVAL_SCOPE, leaderResourceScope(w.workerId)]) {
+                const key = `${w.sessionId}\u0000${scope}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const tried = new Set();
+                for (let i = 0;; i++) {
+                    const token = await store.findPendingTokenBySession(w.sessionId, scope);
+                    if (token === null || token === undefined)
+                        break;
+                    if (tried.has(token) || i >= PARK_DRAIN_MAX) {
+                        throw new Error(`leader park expiry: the checkpoint store kept answering pending token for session ${w.sessionId} in scope ${scope} after expiring it — refusing to spin (expired=${expired}, lost=${lost})`);
+                    }
+                    tried.add(token);
+                    if (await store.expire(token, scope))
+                        expired++;
+                    else
+                        lost++;
+                }
+            }
+        }
+        return { expired, lost };
+    };
+}
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);
     if (!r.ok)
@@ -111,20 +148,20 @@ export function createCoordinatorPush(durableRemote, targetRef, ident) {
         const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
         const gitEnv = { ...gitSubprocessEnv({ site: "server.leader.git-push", isolateConfig: false }), LC_ALL: "C" };
         try {
-            execFileSync("git", ["clone", "-q", durableRemote, dir], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["clone", "-q", durableRemote, dir], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             writeFileSync(join(dir, ".leader.patch"), integratedPatch);
-            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             rmSync(join(dir, ".leader.patch"));
             const ref = targetRef ?? "refs/heads/main";
-            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { stdio: "pipe", encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
             if (exists) {
-                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             }
             else {
-                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             }
             return { ok: true, ref };
         }
@@ -168,20 +205,21 @@ export function createLeaderRunner(cfg) {
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const modsSeat = cfg.mods ? { mods: cfg.mods } : {};
+    const handsSeat = cfg.hands ? { hands: cfg.hands } : {};
     const servedTableSeat = { models: cfg.models, roles: cfg.roles, ...(cfg.tiers ? { tiers: cfg.tiers } : {}) };
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
     const onErrorSeat = cfg.onError ? { onError: cfg.onError } : {};
     const principalSpec = () => {
-        const p = currentPrincipal();
-        return p ? { principal: p } : {};
+        const subject = currentSubject();
+        return taskSpecIdentityOf(subject === undefined ? undefined : partsOf(subject));
     };
     const mkRepair = (rawEnv, repoDir, oracleFiles, entry) => {
         if (repairRounds <= 0)
             return undefined;
         return {
             maxRounds: repairRounds,
-            run: async ({ round, errorText, testCmd }) => {
+            run: async ({ round, errorText, testCmd, signal }) => {
                 for (const f of oracleFiles) {
                     await rawEnv.remove(f.path).catch(() => { });
                     const ex = await rawEnv.exists(f.path);
@@ -189,7 +227,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -203,6 +241,7 @@ export function createLeaderRunner(cfg) {
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
+                        signal,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     }, entry))
                         .result();
@@ -220,7 +259,7 @@ export function createLeaderRunner(cfg) {
             },
         };
     };
-    return async (raw) => {
+    return async (raw, signal) => {
         const body = raw;
         if (!body.objective || !body.durableRemote || !body.testCmd || !body.seedCmd || !body.baseSha) {
             return { ok: false, reports: [], cancelled: false, error: "request must provide objective, durableRemote, baseSha, testCmd, seedCmd" };
@@ -256,12 +295,13 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat });
+            const planRunner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
                     ...principalSpec(),
                     sessionId: `leader-route-${Date.now()}`,
+                    signal,
                     ...(cfg.routerModel ? { model: cfg.routerModel } : { modelRole: "classifier" }),
                 }).result();
                 return res.result ?? "";
@@ -285,7 +325,7 @@ export function createLeaderRunner(cfg) {
                 durableSpec = {
                     toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval: d.requireApproval, ...(d.deny ? { deny: d.deny } : {}), ...(d.autoBudget ? { autoBudget: d.autoBudget } : {}), ...(d.neverAuto ? { neverAuto: d.neverAuto } : {}) })),
                     checkpointStore: d.checkpointStore,
-                    durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
+                    durableApproval: { scope: LEADER_APPROVAL_SCOPE, ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
                     onQuestion: QUESTION_AWAITS_RESUME,
                 };
                 await d.checkpointStore.putCtx(sessionId, storedResumeCtx).catch((e) => {
@@ -300,7 +340,7 @@ export function createLeaderRunner(cfg) {
             if (resourceCfg && !repairLoopActive && durable && cfg.toolResultStore && cfg.sessionStore) {
                 resourceSpec = {
                     checkpointStore: durable.checkpointStore,
-                    resourceSuspend: { scope: `_leader-resource-${sub.workerId}`, totalBudgetUsd: resourceCfg.totalBudgetUsd },
+                    resourceSuspend: { scope: leaderResourceScope(sub.workerId), totalBudgetUsd: resourceCfg.totalBudgetUsd },
                     limits: { ...workerLimits.limits, maxCostUsd: resourceCfg.sliceMaxCostUsd },
                     maxSuspends: resourceCfg.maxSuspends,
                 };
@@ -350,7 +390,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat,
+                        brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: async (ctx) => {
@@ -375,7 +415,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeBody),
@@ -419,6 +459,7 @@ export function createLeaderRunner(cfg) {
         const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
             entry,
+            signal,
             plan,
             provisionWorker,
             provisionIntegrationSandbox,

package/dist/lsp-evict.d.ts

@@ -8,9 +8,11 @@
  * while the dir is rm'd (rooted there, it just sees ENOENT). Only the ephemeral lane is wrapped by the caller — the
  * caller-cwd (deployment-shape row `callerCwd`) persistent-project path keeps its warm server (stable root, reused across turns = CC-parity, no leak).
  *
- * Structural param types (no `ExecutionEnv`/`NodeLspManager` import): a non-evicting manager (e2b/k8s bridge) or an
- * env without a string `cwd` / callable `destroy` is returned UNWRAPPED (probe-guarded), so this is a safe no-op
- * everywhere the precondition doesn't hold.
+ * The manager is the one the mint point `createLspManager` returns (core `NodeLspManager`), typed by the one method used
+ * (`Pick<NodeLspManager, "evict">`: the class has private members, so a structural test stub could not stand in for the
+ * whole class type). The env stays structural: an env without a string `cwd` / callable `destroy` is returned UNWRAPPED
+ * (probe-guarded), so this is a safe no-op wherever that precondition doesn't hold.
  */
-export declare function evictLspOnDestroy<E extends object>(env: E, lsp: unknown): E;
+import type { NodeLspManager } from "@sema-agent/core";
+export declare function evictLspOnDestroy<E extends object>(env: E, lsp: Pick<NodeLspManager, "evict">): E;
 //# sourceMappingURL=lsp-evict.d.ts.map

package/dist/lsp-evict.js

@@ -1,12 +1,11 @@
 export function evictLspOnDestroy(env, lsp) {
-    const evict = lsp?.evict;
     const e = env;
-    if (typeof evict !== "function" || typeof e.cwd !== "string" || typeof e.destroy !== "function")
+    if (typeof e.cwd !== "string" || typeof e.destroy !== "function")
         return env;
     const origDestroy = e.destroy.bind(e);
     const root = e.cwd;
     e.destroy = () => {
-        void evict.call(lsp, root).catch(() => { });
+        void lsp.evict(root).catch(() => { });
         return origDestroy();
     };
     return env;

package/dist/memory-operator-faces.d.ts

@@ -178,9 +178,9 @@ export interface MemoryOriginFaces {
         origin: MemoryEntryOrigin;
         provenance: EntryProvenanceAccount;
     }>>;
-    /** §13-4② 读半场:清标审计账(**同步** —— core 的 `listOriginClearances` 就是一次严格 sidecar 读;
-     *  账本损坏 ⇒ `ControlPlaneCorruptError`,fail-closed,绝不回半张表)。 */
-    listClearances: (at?: MemoryLayerSeat) => OriginClearanceRow[];
+    /** §13-4② 读半场:清标审计账(**异步** —— core 7.66.0 [ref] 起 `listOriginClearances` 经引擎的治理店读那份账(`Promise`;
+     *  File 后端 = 同一份控制面文件、同字节);账本损坏 ⇒ `ControlPlaneCorruptError`,fail-closed,绝不回半张表)。 */
+    listClearances: (at?: MemoryLayerSeat) => Promise<OriginClearanceRow[]>;
     /** §13-4② 写半场:审计化的 UN-MARK 阀门。拒因族是 core 的**闭集码**,本层零翻译原样上抛。 */
     clear: (entryId: string, input: {
         requestId: string;
@@ -199,7 +199,8 @@ export interface MemoryOriginFaces {
  * ## 控制面归属:判据与合规两口**逐字同一条**(§1 F-9 裁),但理由更硬
  *
  * 亲读 core 5.59.0(不信 JSDoc,读 `engine.js` 实装):
- *  · `listOriginClearances` = `readOriginClearances(this.controlDir)`;
+ *  · `listOriginClearances` = `readOriginClearances(this.controlDir)`(core 7.66.0 [ref] 起经引擎的治理店 `this.governanceStore` 读,答 `Promise`;
+ *    本族只挂在自带控制面的 File 后端上,那只店就是同一控制面上的 File 店 —— 同目录、同名、同字节);
  *  · `clearEntryOrigin` 整条弧都压在 `this.controlDir` 上 —— 写前开行(`openOriginClearance`)、
  *    墓碑落定登记(`markOriginClearanceTombstoned`)、终态事件(`settleOriginClearance`);
  *  · `listExternalOriginEntries` 每一行都要 `provenanceOf`,而它读 `challengedEntryIds` /

package/dist/memory-operator-faces.js

@@ -80,7 +80,7 @@ export function createMemoryOriginFaces(stores, opts) {
     });
     return {
         listExternal: async (scopes) => engineOf(memoryStoreForRequest(stores, scopes)).listExternalOriginEntries(scopes),
-        listClearances: (at) => engineOf(memoryStoreForRequest(stores, seatLayers(at))).listOriginClearances(),
+        listClearances: async (at) => engineOf(memoryStoreForRequest(stores, seatLayers(at))).listOriginClearances(),
         clear: async (entryId, input, at) => engineOf(memoryStoreForRequest(stores, seatLayers(at))).clearEntryOrigin(entryId, input),
     };
 }

package/dist/memory-scope.d.ts

@@ -1,6 +1,7 @@
 import { FileMemoryEngineBackend, type TaskSpec } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import { type ExecutionLane } from "./execution-lane-caps.js";
+import type { Logger } from "./observability/logger.js";
 import { type MemoryProjectKey, type ProjectLayerOfTask } from "./project-identity.js";
 /** 前缀词表本体(供门/诊断读;判定一律走 {@link isV2ScopeKey},别在别处重写 startsWith 链)。 */
 export declare const V2_SCOPE_PREFIXES: readonly string[];
@@ -177,17 +178,26 @@ export declare function fileMemoryEngineRoot(config: Pick<ServiceConfig, "memory
  * 一条路径的**规范形**(给 {@link judgeMemoryRootOutsideDataRoot} 的 `canonical` 座用的生产实现):
  *  · 既存的绝对路径 ⇒ **原样**交给 `realpath`(`.native`:大小写不敏感的文件系统上返回盘上的拼写;符号链接、macOS 的 `/var` → `/private/var` 在这一步展平)。
  *    不先在字串上折 `..`:操作系统在展开符号链接**之后**才折 `..`,`/link/..` 的真身是链接目标的父目录,字串折叠会把它读成 `/`;
- *  · 其余(尚不存在 / 相对)⇒ 绝对化并折叠 → 取**最深既存祖先**的 `realpath` → 接回尚不存在的尾巴(尾巴只做字串规范化)。
+ *  · 其余(尚不存在 / 相对)⇒ 绝对化(**不折叠**)后逐段走:既存的前缀每进一段取一次 `realpath`(符号链接在这一步展开),`..` 折在**已展开**的前缀上 ——
+ *    与操作系统同序(`/别名/../新目录` 的真身在链接目标的父目录下;先在字串上折会读成别名的父目录,判到另一只挂载上);第一段不存在起,余下是尚不存在的尾巴
+ *    (尾巴只做字串规范化,与 `mkdir -p` 建出来的同形)。
  *
  * 为什么按「最深既存祖先」而不是直接 `realpath(p)`:boot 期记忆根常常还没建出来(新数据根),`realpath` 对不存在的路径抛 ENOENT,
  * 而数据根那一侧已经存在、会被展平 —— 两侧拼写空间不一样,同一个目录会被读成「不在其下」。祖先用 `existsSync` 找(它对 ENOENT / ENOTDIR / EACCES / ELOOP
  * 一律答 `false`,不抛),所以走到的那一级一定 stat 得动;`realpath` 仍可能在「探完到取值之间目录被挪走 / 搜索权限被收」的竞态里抛 ——
  * 不在本函数里吞(吞了就是一条无声的降级臂),由 boot 调用点接住并响亮报一行(`memory_engine_dir_check_unavailable`),起服照常。
  *
- * 取舍:尾巴(不存在的那几段)只比规范化字串,**不折大小写**,`..` 也按字串折:两个只差大小写、且都还不存在的拼写在大小写不敏感的盘上会被读成两处 ——
+ * 取舍:尾巴(不存在的那几段)只比规范化字串,**不折大小写**,尾巴里的 `..` 按字串折:两个只差大小写、且都还不存在的拼写在大小写不敏感的盘上会被读成两处 ——
  * 方向是多报一条 warn(这条判据的失败方向),不会漏报。
  */
 export declare function canonicalPathOf(p: string): string;
+/**
+ * **路径包含**(含相等)的判官:`child` 是不是 `root` 本身或它的后代 —— `path.relative(canonical(root), canonical(child))` 不是 `..`、不以 `..` 加分隔符起头、也不是绝对路径(跨盘符)。
+ * `..` 要按**整段**判:名为 `..data` 的子目录在其下;`startsWith("..")` 会把它读成在其外。`canonical` 座缺省 `path.resolve`(字串规范形),boot 递 {@link canonicalPathOf} 取符号链接展平后的形;
+ * 两侧同一只座(先 root、后 child)。读者两处:记忆根「在数据根之外」那一判({@link judgeMemoryRootOutsideDataRoot})与起服时「配置根是不是工作区的祖先」那一判(`sema-config-dir.ts`);
+ * 树里别处内联的同形表达式(`boot/deployment-mods.ts` · `plugins/local-data-dir-modes-m39.ts` · `plugins/remote-env-host.ts` · `plugins/worktree-isolation.ts`)不在本次收口范围。
+ */
+export declare function pathIsWithin(root: string, child: string, canonical?: (p: string) => string): boolean;
 /** {@link judgeMemoryRootOutsideDataRoot} 的读数:记忆引擎的根落在本机数据根**之外**。三键即 boot 日志行的字段(`hint` 是一句带两条真路径的人话)。 */
 export type MemoryRootOutsideDataRoot = {
     readonly root: string;
@@ -273,6 +283,23 @@ onIncident?: (err: Error & {
     backend: FileMemoryEngineBackend;
     root: string;
 } | undefined;
+/**
+ * **起服期读 file 记忆控制面账本的形:一行 warn,不拒启**([ref])。
+ *
+ * 病:core >= 7.64.0 的 File 记忆店不再升级「绑定之前」的旧形账本(裸 id → rev 映射)—— 构造器既不碰盘也不抛,读账本的那一刻才抛
+ * `ControlPlaneCorruptError`,本仓的记忆面把它答成 `500 internal.memory_control_plane_corrupt`(`http/memory-face-fault-reply.ts`)。
+ * 于是升级前账本还是旧形(或任何引擎拒的形)的 file 记忆部署,升级后**起服一切正常、第一次读账本的记忆面才 500**,起服日志里零提示。
+ *
+ * 读法:只经 core 导出读口 `readMemoryLedgerForm`(只读、不升级、不加锁、不建文件)问「账本是什么形」—— 本仓不自读账本文件、不认它的文件名
+ * (一件事一个读者)。答词是闭集三个,穷尽 `switch`。位置 = 构造 file 后端之前:boot 与 run-local 两个宿主各在 {@link memoryEngineBackendFor} 前调一次;
+ * 坐标取 {@link fileMemoryPlaneFor} 单铸点,与那只工厂同门(工厂不接线的部署形 —— 多租户 / `MEMORY_ENGINE=off` / 平面分裂车道未 allow —— 这里也不读)。
+ *
+ * 失败方向:**披露面,不拒启**(不是安全轴;拒启要新码、另票):
+ *  · `malformed` ⇒ 一行 warn `memory_ledger_malformed`(`root` 数据根 · `controlDir` 控制面目录 · `hint` 一句带出路的话);`v2` / `absent` ⇒ 零输出;
+ *  · 读口自己抛(账本路径是目录 / 无权读 / 环路:引擎答「没有形」,既不是 `absent` 也不是 `malformed`)⇒ 另报一行 `memory_ledger_check_unavailable`
+ *    (类名 + 机器码,不带消息原文,与 `memory_engine_dir_check_unavailable` 同形),照常起服,不编一个形。
+ */
+export declare function announceMemoryLedgerForm(config: ServiceConfig, fallbackRoot: string | undefined, log: Logger): Promise<void>;
 /**
  * core 7.49.0 [ref] —— **记忆店根搬动 ⇒ 拒启**(不降级)。店根的物理路径是控制面里的一条记录(`root-anchor.json`),每次打开都比对;
  * 目录被搬走 / 换成指向别处的链接之后,File 后端的**构造器**就抛 `memory.target_outside_store`(`detail` 恰在这一形上带

package/dist/memory-scope.js

@@ -1,7 +1,8 @@
 import { existsSync, realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope, normalizeMemorySpec } from "@sema-agent/core";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { FileMemoryEngineBackend, readMemoryLedgerForm, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope, normalizeMemorySpec } from "@sema-agent/core";
 import { capabilitiesFor, executionLaneOf } from "./execution-lane-caps.js";
+import { errorCodeOf, errorKindOf } from "./observability/err-text.js";
 import { assertMemoryScopeWidth } from "./plugins/memory-key-guards.js";
 import { projectLayerForTaskRoot } from "./project-identity.js";
 import { parseProjectLayerKey, projectLayerOwnerOf } from "./project-layer-key.js";
@@ -113,25 +114,40 @@ export function fileMemoryEngineRoot(config, fallbackRoot) {
 export function canonicalPathOf(p) {
     if (isAbsolute(p) && existsSync(p))
         return realpathSync.native(p);
-    const abs = resolve(p);
-    let existing = abs;
+    const abs = isAbsolute(p) ? p : `${process.cwd()}${sep}${p}`;
+    const { root } = parse(abs);
+    let existing = root;
     const tail = [];
-    while (!existsSync(existing)) {
-        const parent = dirname(existing);
-        if (parent === existing)
-            return abs;
-        tail.unshift(basename(existing));
-        existing = parent;
+    for (const seg of abs.slice(root.length).split(sep === "\\" ? /[\\/]+/ : /\/+/)) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (tail.length > 0) {
+            if (seg === "..")
+                tail.pop();
+            else
+                tail.push(seg);
+            continue;
+        }
+        if (seg === "..") {
+            existing = dirname(existing);
+            continue;
+        }
+        const next = join(existing, seg);
+        if (existsSync(next))
+            existing = realpathSync.native(next);
+        else
+            tail.push(seg);
     }
-    return join(realpathSync.native(existing), ...tail);
+    return join(existing, ...tail);
+}
+export function pathIsWithin(root, child, canonical = resolve) {
+    const rel = relative(canonical(root), canonical(child));
+    return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
 }
 export function judgeMemoryRootOutsideDataRoot(a) {
     if (!a.dataRoot)
         return undefined;
-    const canonical = a.canonical ?? resolve;
-    const rel = relative(canonical(a.dataRoot), canonical(a.memoryRoot));
-    const inside = rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-    if (inside)
+    if (pathIsWithin(a.dataRoot, a.memoryRoot, a.canonical))
         return undefined;
     return {
         root: a.memoryRoot,
@@ -171,6 +187,39 @@ export function memoryEngineBackendFor(config, fallbackRoot, onIncident) {
     }
     return { backend, root: plane.root };
 }
+const MEMORY_LEDGER_MIGRATION_EXIT = "先用上一版引擎开一次再升级";
+export async function announceMemoryLedgerForm(config, fallbackRoot, log) {
+    const plane = fileMemoryPlaneFor(config, fallbackRoot);
+    if (plane === undefined)
+        return;
+    const where = { root: plane.root, controlDir: plane.controlDir };
+    let form;
+    try {
+        form = await readMemoryLedgerForm(plane.controlDir);
+    }
+    catch (err) {
+        log.warn("memory_ledger_check_unavailable", { ...where, errorKind: errorKindOf(err), errorCode: errorCodeOf(err) });
+        return;
+    }
+    switch (form) {
+        case "v2":
+        case "absent":
+            return;
+        case "malformed":
+            log.warn("memory_ledger_malformed", {
+                ...where,
+                hint: `the memory control plane at ${plane.controlDir} holds a committed-rev ledger this engine refuses to read — the memory faces that read it answer ` +
+                    `500 internal.memory_control_plane_corrupt (the server itself starts regardless). If it is the pre-binding v1 form (a bare id → rev map, no longer ` +
+                    `upgraded on open), the exit is, from MIGRATION.md: 「${MEMORY_LEDGER_MIGRATION_EXIT}」`,
+            });
+            return;
+        default: {
+            const unknownForm = form;
+            log.warn("memory_ledger_check_unavailable", { ...where, errorKind: `UnknownLedgerForm:${String(unknownForm)}` });
+            return;
+        }
+    }
+}
 export function memoryStoreRootMovedRefusal(e) {
     const err = e;
     const d = err?.detail;