@sema-agent/server 7.147.0 → 7.148.0

package/dist/plugins/scheduler-support.js

@@ -1,8 +1,9 @@
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { randomBytes, createHash } from "node:crypto";
-import { SchedulerError, isValidCronExpr } from "@sema-agent/core";
+import { SchedulerError, ensureDir, isValidCronExpr } from "@sema-agent/core";
 import { loadSchedulerStore, mutateSchedulerStore } from "@sema-agent/settings-schema/node";
 import { configRootOf } from "../sema-config-dir.js";
+import { trustedFileRefusal } from "../config-dir-trust.js";
 const ok = (value) => ({ ok: true, value });
 const err = (error) => ({ ok: false, error });
 export const DEFAULT_SCHEDULER_CAPS = {
@@ -89,12 +90,21 @@ export class FileSchedulerBackend {
     storePath;
     now;
     log;
+    trust;
     constructor(opts) {
         this.schedulerCapabilities = { ...DEFAULT_SCHEDULER_CAPS, ...(opts.caps ?? {}) };
         this.storePath = opts.storePath;
         this.log = opts.log;
+        this.trust = opts.trust;
         this.now = opts.now ?? (() => Date.now());
     }
+    async untrustedStore() {
+        const refusal = await trustedFileRefusal({ reader: "scheduler-store", file: this.storePath, declaredOwnerUid: this.trust.declaredOwnerUid, ...(this.trust.host !== undefined ? { host: this.trust.host } : {}) });
+        if (refusal === undefined)
+            return undefined;
+        this.log.warn("scheduler_store_untrusted", { path: this.storePath, refusal, note: "the scheduled-task store can be changed by another user — this read / write was refused and nothing was written; the refusal names the path and the fix" });
+        return new SchedulerError("io", "the scheduled-task store is not trusted (another user could change it) — nothing was read or written; the operator log names the path and the fix");
+    }
     mutate(fn, what) {
         let result;
         let produced = false;
@@ -135,6 +145,10 @@ export class FileSchedulerBackend {
         if (intent.lifetime === "session" && this.schedulerCapabilities.supportsSessionLifetime === false) {
             return err(new SchedulerError("invalid_schedule", 'lifetime:"session" is not supported on this deployment (no resident daemon reaps session-lifetime records — the row would be an orphan)'));
         }
+        const untrusted = await this.untrustedStore();
+        if (untrusted)
+            return err(untrusted);
+        ensureDir(dirname(this.storePath));
         const key = dedupKey(ctx.scope, intent, ctx.sessionId);
         const decided = this.mutate((records) => {
             const existingIdx = records.findIndex((r) => {
@@ -166,6 +180,9 @@ export class FileSchedulerBackend {
         return decided.ok ? decided.value : decided;
     }
     async cancel(id, ctx) {
+        const untrusted = await this.untrustedStore();
+        if (untrusted)
+            return err(untrusted);
         const decided = this.mutate((records) => {
             const idx = records.findIndex((r) => r.id === id);
             if (idx < 0 || records[idx].scope !== ctx.scope) {
@@ -176,6 +193,9 @@ export class FileSchedulerBackend {
         return decided.ok ? decided.value : decided;
     }
     async list(ctx) {
+        const untrusted = await this.untrustedStore();
+        if (untrusted)
+            return err(untrusted);
         let read;
         try {
             read = loadSchedulerStore(this.storePath, { nowMs: this.now() });

package/dist/plugins/schema-consistency.d.ts

@@ -26,6 +26,16 @@
  * 半径远大于本批;先解析文本,理由写在这里。)拒启文案里的那句 `ALTER TABLE … ADD COLUMN …` 也由
  * **同一份解析结果**生成,不是手写的。
  *
+ * ── 第二问:声明非空而库里允许 NULL(tightened)─────────────────────────────────────────────────────
+ * 缺列的拒句给的是 `ALTER TABLE … ADD COLUMN <原文>`;对「声明 `NOT NULL`、没有缺省、不是键」的列,那一句原文在已有行的表上会被引擎拒(PG)或写进隐式缺省(MySQL 非严格),
+ * 部署者于是把列加成**可空**——只列名对账从此转绿,而存量行在这一列上是 NULL,本构建按非空读它。所以对账多问一件事,**一条谓词**:本构建声明非空的列
+ * (顶层 `NOT NULL`,或主键成员)在库里是否也非空;库里允许 NULL ⇒ 拒,并给出收紧的下一步。谓词不分类;**配方**按同一张分类表({@link columnFill})给:
+ *   · `self`  —— 引擎自己给值(可空 / 有 DEFAULT / 自增 / 生成列):缺列 ⇒ 一句 `ADD COLUMN <原文>`;库里允许 NULL ⇒ 有 DEFAULT 的:一句**真语句**
+ *               `UPDATE t SET c = <声明的 DEFAULT 原文> WHERE c IS NULL;`(缺省是本构建声明的,不算替存量行猜值)再收紧;自增 / 生成列:只收紧(值由引擎给);
+ *   · `value` —— 声明非空、无缺省、不是键:缺列 ⇒ 可空加列 → 注释回填(值只有部署者知道) → 收紧;库里允许 NULL ⇒ 只打后两(三)句;
+ *   · `key`   —— 主键成员:给存量行加主键列等于改它们的身份,**不出语句**,只一句话(出路走「部署匹配的构建」)。
+ * 反方向(构建可空、库里非空)不判:现网库里可能有,判了会让数量不明的库起不来。
+ *
  * ── 失败方向:读不到就拒,不跳过 ─────────────────────────────────────────────────────────────
  * information_schema 查询抛错、或整库一行都读不出来 ⇒ **拒启**。探针的语义是「我证明了库等于代码」,
  * 证不出来时放行等于把一条保护性断言静默降级成祝福([ref]:保护型缺席必须 fail-closed)。
@@ -51,12 +61,16 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import type { SqlDialect } from "./sql-driver.js";
-import { type SchemaProbeRead } from "./schema-live-columns.js";
+import { type LiveColumns, type SchemaProbeRead } from "./schema-live-columns.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-/** 一列:名字 + 它在 `CREATE TABLE` 里的**原样定义文本**(生成 ADD COLUMN 指路用,不另手写)。 */
+/**
+ * 一列:名字 + 它在 `CREATE TABLE` 里的**原样定义文本**(生成 ADD COLUMN 指路用,不另手写)。
+ * `key` 只在为真时出现:这一列是主键成员(内联 `PRIMARY KEY`,或表级 / 命名约束 `PRIMARY KEY (…)` 的成员);缺席 = 不是键。
+ */
 export interface ParsedColumn {
     readonly name: string;
     readonly ddl: string;
+    readonly key?: true;
 }
 /** 一张表的列形。 */
 export interface ParsedTable {
@@ -66,11 +80,25 @@ export interface ParsedTable {
 /**
  * 解析一条 `CREATE TABLE`。不是建表语句(CREATE INDEX / INSERT / SELECT / CREATE EXTENSION)⇒ `undefined`。
  *
- * 认识面窄得刻意:只取**表名 + 顶层列名 + 该列的定义文本**。类型、默认值、可空性一律**不比对** ——
+ * 认识面窄得刻意:取**表名 + 顶层列名 + 该列的定义文本 + 是否主键成员**。类型、默认值**不比对** ——
  * 本探针守的是「列在不在」这一类(T-47 的真病),把类型也拉进来会让方言差异(`DATETIME(3)` ⇄
  * `TIMESTAMPTZ(3)`、`vector(d)` ⇄ `jsonb` 的运行期参数化)变成一堆假红,而那是另一条判据另一台车。
+ * 唯一多看的一件是声明非空的列在库里是否仍允许 NULL({@link declaresNotNull} / {@link diffSchema}),原因见文件头「第二问」。
  */
 export declare function parseCreateTable(stmt: string): ParsedTable | undefined;
+/** 这一列声明的 `DEFAULT` 表达式原文;没有缺省(或值由引擎给)⇒ `undefined`;有缺省却读不出 ⇒ 抛。 */
+export declare function declaredDefault(col: ParsedColumn): string | undefined;
+/** 本构建声明这一列非空:顶层 `NOT NULL`,或主键成员。**tightened 的唯一谓词**(库里该列允许 NULL ⇒ 拒)。 */
+export declare function declaresNotNull(col: ParsedColumn): boolean;
+/**
+ * 一列的「给存量行补值」类:**配方的分类表**(见文件头「第二问」;判 tightened 用 {@link declaresNotNull} 一条谓词,不按类开例外)。
+ *   · `key`   —— 主键成员(优先于其它);
+ *   · `value` —— 声明非空(顶层 `NOT NULL`)∧ 无 `DEFAULT` ∧ 不是自增 / 序列 / 生成列:值只有部署者知道;
+ *   · `self`  —— 其余:可空、或引擎自己给值(DEFAULT 的值就是声明的那个)。
+ * 关键字只在顶层算({@link maskNested}):列名、引号串、括号组里的字样不参与。
+ */
+export type ColumnFill = "key" | "value" | "self";
+export declare function columnFill(col: ParsedColumn): ColumnFill;
 /** 启动时真会建出来的**全部**表形(录制 → 解析)。同名表二次出现以**先到**为准(`IF NOT EXISTS` 的真语义)。 */
 export declare function expectedTableShapes(dialect: SqlDialect): Promise<Map<string, ParsedTable>>;
 /** 一张表的对账结论。 */
@@ -80,19 +108,24 @@ export interface TableMismatch {
     readonly missing: readonly ParsedColumn[];
     /** 库有、代码没有(库比代码**新** —— 滚动窗里的旧副本)。 */
     readonly ghost: readonly string[];
+    /** 列在库里、构建声明非空({@link declaresNotNull})而库里允许 NULL(库比代码**旧**:缺列时部署者把它加成了可空,还没补值收紧;或手工放宽过)。 */
+    readonly tightened: readonly ParsedColumn[];
 }
-/** 对账(纯函数:期望 × 实况 → 不符表清单)。 */
-export declare function diffSchema(expected: Map<string, ParsedTable>, live: Map<string, Set<string>>): TableMismatch[];
+/** 对账(纯函数:期望 × 实况 → 不符表清单)。实况 = {@link readLiveColumns} 的读数(列在不在 + 可不可空,一次读)。 */
+export declare function diffSchema(expected: Map<string, ParsedTable>, live: LiveColumns): TableMismatch[];
+/** 缺一列时的配方(按 {@link columnFill} 三类);拒启句里这一列的那几行就是它的返回值,真库钉据此取期望而不手抄句子。 */
+export declare function missingColumnLines(dialect: SqlDialect, table: string, c: ParsedColumn): string[];
 /**
  * 逐表段 + 闭集出路段(多行):整库对账的拒启句与单表探针的拒因共用这一份句形(`schema-drift-sentence.ts` 的 `describeProbedTableDrift` 读它)。
- * ADD COLUMN 句由解析结果**生成**,不手写。
+ * 语句由解析结果**生成**,不手写;逐列配方按 {@link columnFill} 三类(缺列:自填 = 一句 ADD COLUMN,要值 = 可空加列 → 回填注释 → 收紧,键 = 一句话没有语句;
+ * 列在而允许 NULL:见 {@link tightenedColumnLines})。
  *
  * 出路段 = {@link SCHEMA_MISMATCH_WAYS_OUT}(**闭集三条**,常量;句子的属主在 `schema-drift-sentence.ts`):
- * ① 部署与这个库匹配的构建;② 库比构建旧(缺列)⇒ 部署者自己执行上面逐字打印的 `ALTER TABLE … ADD COLUMN …`(列集对账与拒启句永不改库);
- * ③ 库比构建新(多列)⇒ 部署持有那些列的构建(先升库、再升副本)。
+ * ① 部署与这个库匹配的构建;② 库比构建旧(缺列,或声明非空而库里允许 NULL)⇒ 部署者自己执行上面逐字打印的语句(要值的列,值归部署者;打印的语句全部生效之前拒启不松)
+ * (列集对账与拒启句永不改库);③ 库比构建新(多列)⇒ 部署持有那些列的构建(先升库、再升副本)。
  * 🔴 **没有销毁性的一条**:对带数据的库,任何「删库 / 重建」的指路都是教人销毁数据 —— 这里不写,拒启句的钉也守着(`test/schema-consistency.test.ts` ⑤)。
  */
-export declare function describeMismatchedTables(mismatches: readonly TableMismatch[]): string[];
+export declare function describeMismatchedTables(dialect: SqlDialect, mismatches: readonly TableMismatch[]): string[];
 /** 拒启文案(表头 + 逐表段与闭集三条出路 {@link describeMismatchedTables})。 */
 export declare function describeSchemaMismatch(dialect: SqlDialect, mismatches: readonly TableMismatch[]): string;
 /**

package/dist/plugins/schema-consistency.js

@@ -3,7 +3,7 @@ import { readLiveColumns } from "./schema-live-columns.js";
 import { SCHEMA_MISMATCH_WAYS_OUT } from "./schema-drift-sentence.js";
 import { SCHEMA_MISMATCH_ERROR_CODE, StoreBootRefusalError } from "./store-contracts.js";
 const QUOTES = new Set(["'", '"', "`"]);
-function stripLineComments(sql) {
+function stripComments(sql) {
     let out = "";
     for (let i = 0; i < sql.length; i++) {
         const c = sql[i];
@@ -25,6 +25,12 @@ function stripLineComments(sql) {
             out += "\n";
             continue;
         }
+        if (c === "/" && sql[i + 1] === "*") {
+            const end = sql.indexOf("*/", i + 2);
+            out += " ";
+            i = end < 0 ? sql.length : end + 1;
+            continue;
+        }
         out += c;
     }
     return out;
@@ -56,8 +62,69 @@ function splitTopLevel(body) {
 }
 const CONSTRAINT_HEADS = new Set(["PRIMARY", "UNIQUE", "KEY", "INDEX", "CONSTRAINT", "FOREIGN", "CHECK", "FULLTEXT", "SPATIAL", "EXCLUDE"]);
 const unquote = (s) => s.replace(/^[`"](.*)[`"]$/s, "$1");
+function maskNested(s) {
+    let out = "";
+    let depth = 0;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (QUOTES.has(c)) {
+            let j = i + 1;
+            while (j < s.length && s[j] !== c)
+                j++;
+            out += "\0".repeat(Math.min(j, s.length - 1) - i + 1);
+            i = j;
+            continue;
+        }
+        if (c === "(") {
+            out += depth === 0 ? "(" : "\0";
+            depth++;
+        }
+        else if (c === ")") {
+            depth = Math.max(0, depth - 1);
+            out += "\0";
+        }
+        else {
+            out += depth > 0 ? "\0" : c;
+        }
+    }
+    return out;
+}
+function groupEnd(s, open) {
+    let depth = 0;
+    for (let i = open; i < s.length; i++) {
+        const c = s[i];
+        if (QUOTES.has(c)) {
+            i++;
+            while (i < s.length && s[i] !== c)
+                i++;
+            continue;
+        }
+        if (c === "(")
+            depth++;
+        else if (c === ")") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+function primaryKeyMembers(constraint) {
+    const at = /\bPRIMARY\s+KEY\b/i.exec(maskNested(constraint));
+    if (!at)
+        return [];
+    const open = constraint.indexOf("(", at.index);
+    if (open < 0)
+        return [];
+    const close = groupEnd(constraint, open);
+    if (close < 0)
+        return [];
+    return splitTopLevel(constraint.slice(open + 1, close))
+        .map((m) => unquote(m.trim().split(/[\s(]/, 1)[0]).toLowerCase())
+        .filter((m) => m !== "");
+}
 export function parseCreateTable(stmt) {
-    const sql = stripLineComments(stmt).trim();
+    const sql = stripComments(stmt).trim();
     const head = /^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"]?[\w$.]+[`"]?)\s*\(/i.exec(sql);
     if (!head)
         return undefined;
@@ -85,18 +152,93 @@ export function parseCreateTable(stmt) {
     }
     if (close < 0)
         return undefined;
-    const columns = [];
+    const plain = [];
+    const tableKey = new Set();
     for (const raw of splitTopLevel(sql.slice(open + 1, close))) {
         const part = raw.trim().replace(/\s+/g, " ");
         if (part === "")
             continue;
         const first = part.split(/[\s(]/, 1)[0];
-        if (CONSTRAINT_HEADS.has(first.toUpperCase()))
+        if (CONSTRAINT_HEADS.has(first.toUpperCase())) {
+            for (const member of primaryKeyMembers(part))
+                tableKey.add(member);
             continue;
-        columns.push({ name: unquote(first).toLowerCase(), ddl: part });
+        }
+        plain.push({ name: unquote(first).toLowerCase(), ddl: part, inlineKey: /\bPRIMARY\s+KEY\b/i.test(maskNested(part.slice(first.length))) });
     }
+    const columns = plain.map((c) => (c.inlineKey || tableKey.has(c.name) ? { name: c.name, ddl: c.ddl, key: true } : { name: c.name, ddl: c.ddl }));
     return { table: unquote(head[1]).toLowerCase(), columns };
 }
+function declarationOf(col) {
+    const rest = col.ddl.slice(col.ddl.split(/[\s(]/, 1)[0].length);
+    const top = maskNested(rest);
+    const notNull = /\bNOT\s+NULL\b/i.test(top);
+    const engineGives = /\b(?:AUTO_INCREMENT|GENERATED|IDENTITY|(?:BIG|SMALL)?SERIAL\d?)\b/i.test(top) || /\bAS\s*\(/i.test(top);
+    const at = /\bDEFAULT\b/i.exec(top);
+    const hasDefault = at !== null;
+    const defaultExpr = () => (!engineGives && at !== null ? defaultExpression(rest, at.index + at[0].length, col.name) : undefined);
+    return { key: col.key === true, notNull, engineGives, hasDefault, defaultExpr };
+}
+function defaultExpression(rest, from, column) {
+    let i = from;
+    while (i < rest.length && /\s/.test(rest[i]))
+        i++;
+    const start = i;
+    const c = rest[i];
+    let end = -1;
+    if (c !== undefined && QUOTES.has(c)) {
+        let j = i + 1;
+        for (;;) {
+            while (j < rest.length && rest[j] !== c)
+                j++;
+            if (j >= rest.length)
+                break;
+            if (rest[j + 1] === c) {
+                j += 2;
+                continue;
+            }
+            end = j + 1;
+            break;
+        }
+    }
+    else if (c === "(") {
+        const close = groupEnd(rest, i);
+        if (close >= 0)
+            end = close + 1;
+    }
+    else if (c !== undefined) {
+        const word = /^[+-]?[A-Za-z0-9_.$]+/.exec(rest.slice(i));
+        if (word) {
+            end = i + word[0].length;
+            if (rest[end] === "(") {
+                const close = groupEnd(rest, end);
+                end = close >= 0 ? close + 1 : -1;
+            }
+        }
+    }
+    if (end < 0 || end === start)
+        throw new Error(`cannot read the DEFAULT expression of column ${column}: ${rest.trim()}`);
+    return rest.slice(start, end);
+}
+export function declaredDefault(col) {
+    return declarationOf(col).defaultExpr();
+}
+export function declaresNotNull(col) {
+    const d = declarationOf(col);
+    return d.key || d.notNull;
+}
+export function columnFill(col) {
+    const d = declarationOf(col);
+    if (d.key)
+        return "key";
+    return d.notNull && !d.engineGives && !d.hasDefault ? "value" : "self";
+}
+function nullableForm(ddl) {
+    const at = /(?:\bCONSTRAINT\s+\S+\s+)?\bNOT\s+NULL\b/i.exec(maskNested(ddl));
+    if (!at)
+        return ddl;
+    return (ddl.slice(0, at.index) + " " + ddl.slice(at.index + at[0].length)).replace(/\s+/g, " ").trim();
+}
 export async function expectedTableShapes(dialect) {
     const shapes = new Map();
     for (const stmt of await recordEnsureStatements(dialect)) {
@@ -114,19 +256,78 @@ export function diffSchema(expected, live) {
             continue;
         const missing = shape.columns.filter((c) => !cols.has(c.name));
         const known = new Set(shape.columns.map((c) => c.name));
-        const ghost = [...cols].filter((c) => !known.has(c)).sort();
-        if (missing.length > 0 || ghost.length > 0)
-            out.push({ table, missing, ghost });
+        const ghost = [...cols.keys()].filter((c) => !known.has(c)).sort();
+        const tightened = shape.columns.filter((c) => cols.get(c.name)?.nullable === true && declaresNotNull(c));
+        if (missing.length > 0 || ghost.length > 0 || tightened.length > 0)
+            out.push({ table, missing, ghost, tightened });
     }
     return out;
 }
-export function describeMismatchedTables(mismatches) {
+function tightenLines(dialect, table, c) {
+    switch (dialect) {
+        case "pg":
+            return [`    ALTER TABLE ${table} ALTER COLUMN ${columnRef(c)} SET NOT NULL;`];
+        case "mysql":
+            return [`    SET SESSION sql_mode = CONCAT_WS(',', @@SESSION.sql_mode, 'STRICT_ALL_TABLES');`, `    ALTER TABLE ${table} MODIFY COLUMN ${c.ddl};`];
+        default: {
+            const unreachable = dialect;
+            throw new Error(`unknown SQL dialect ${String(unreachable)}`);
+        }
+    }
+}
+const columnRef = (c) => c.ddl.split(/[\s(]/, 1)[0];
+function backfillComment(table, column) {
+    return `    -- rows already in ${table} need a value for ${column} that this build cannot choose: UPDATE ${table} SET ${column} = … WHERE ${column} IS NULL;`;
+}
+export function missingColumnLines(dialect, table, c) {
+    const fill = columnFill(c);
+    switch (fill) {
+        case "self":
+            return [`    ALTER TABLE ${table} ADD COLUMN ${c.ddl};`];
+        case "value":
+            return [`    ALTER TABLE ${table} ADD COLUMN ${nullableForm(c.ddl)};`, backfillComment(table, columnRef(c)), ...tightenLines(dialect, table, c)];
+        case "key":
+            return [`    table ${table}: column ${c.name} is part of the primary key — adding it to rows already in ${table} changes their identity; this build has no statement for it.`];
+        default: {
+            const unreachable = fill;
+            throw new Error(`unknown column fill ${String(unreachable)}`);
+        }
+    }
+}
+function tightenedColumnLines(dialect, table, c) {
+    const fill = columnFill(c);
+    switch (fill) {
+        case "key":
+            return [`    table ${table}: column ${c.name} is part of the primary key and allows NULL in the database — rows already in ${table} may hold NULL in their key; this build has no statement for it.`];
+        case "value":
+            return [backfillComment(table, columnRef(c)), ...tightenLines(dialect, table, c)];
+        case "self": {
+            if (!declaresNotNull(c))
+                throw new Error(`schema mismatch for ${table}.${c.name}: a column this build declares nullable cannot be tightened`);
+            const defaultExpr = declaredDefault(c);
+            const ref = columnRef(c);
+            return defaultExpr === undefined
+                ? tightenLines(dialect, table, c)
+                : [`    UPDATE ${table} SET ${ref} = ${defaultExpr} WHERE ${ref} IS NULL;`, ...tightenLines(dialect, table, c)];
+        }
+        default: {
+            const unreachable = fill;
+            throw new Error(`unknown column fill ${String(unreachable)}`);
+        }
+    }
+}
+export function describeMismatchedTables(dialect, mismatches) {
     const lines = [];
     for (const m of mismatches) {
         if (m.missing.length > 0) {
             lines.push(`  table ${m.table}: MISSING column(s) ${m.missing.map((c) => c.name).join(", ")} — the database is OLDER than this build.`);
             for (const c of m.missing)
-                lines.push(`    ALTER TABLE ${m.table} ADD COLUMN ${c.ddl};`);
+                lines.push(...missingColumnLines(dialect, m.table, c));
+        }
+        if (m.tightened.length > 0) {
+            lines.push(`  table ${m.table}: column(s) ${m.tightened.map((c) => c.name).join(", ")} allow NULL in the database, but this build declares them NOT NULL — the database is OLDER than this build.`);
+            for (const c of m.tightened)
+                lines.push(...tightenedColumnLines(dialect, m.table, c));
         }
         if (m.ghost.length > 0) {
             lines.push(`  table ${m.table}: UNKNOWN column(s) ${m.ghost.join(", ")} — the database is NEWER than this build (a rolling window where an old replica reached an upgraded database).`);
@@ -142,7 +343,7 @@ export function describeSchemaMismatch(dialect, mismatches) {
         "Schema policy: the code is the single source of truth, and the column check that produced this refusal never alters a database —",
         "so a drifted database is a deployment-order problem, not something the process may quietly work around.",
         "",
-        ...describeMismatchedTables(mismatches),
+        ...describeMismatchedTables(dialect, mismatches),
     ];
     return lines.join("\n");
 }

package/dist/plugins/schema-drift-sentence.d.ts

@@ -11,7 +11,10 @@ export interface OlderWayOut {
  * 🔴 **没有销毁性的一条**:对带数据的库,任何「删库 / 重建」的指路都是教人销毁数据。
  */
 export declare function schemaWaysOut(older: OlderWayOut): readonly string[];
-/** 缺列方向的出路段(整库对账与单表探针共用;逐字钉在 `test/schema-consistency.test.ts` ⑤)。 */
+/**
+ * 旧方向的出路段(整库对账与单表探针共用;逐字钉在 `test/schema-consistency.test.ts` ⑤)。「旧」= 缺列,或声明非空而库里仍允许 NULL 的列;
+ * 打印的是语句集,不只是 ADD COLUMN:要值列的值只有部署者知道(回填那一步以注释行给出),所以这一条把「值归部署者」和「打印的语句全部生效之前拒启不松」写明。
+ */
 export declare const SCHEMA_MISMATCH_WAYS_OUT: readonly string[];
 /** 探针读口:一条 SQL → `{ rows }`(各 `assert*Schema` 的 `query` 形)。 */
 export type ProbeQuery = (sql: string) => Promise<{

package/dist/plugins/schema-drift-sentence.js

@@ -8,8 +8,8 @@ export function schemaWaysOut(older) {
     ];
 }
 export const SCHEMA_MISMATCH_WAYS_OUT = schemaWaysOut({
-    when: "missing columns",
-    action: "run the ALTER TABLE … ADD COLUMN statements printed above yourself",
+    when: "missing columns, or columns that allow NULL where this build declares NOT NULL",
+    action: "run the statements printed above yourself (where a column needs a value this build cannot choose for rows already in the table, the printed comment says so and that value is yours; this refusal stays until every printed statement has taken effect)",
 });
 export async function describeProbedTableDrift(query, dialect, tables) {
     const d = dialect === "pg" ? "pg" : "mysql";
@@ -18,9 +18,9 @@ export async function describeProbedTableDrift(query, dialect, tables) {
     try {
         const sc = await import("./schema-consistency.js");
         const diff = sc.diffSchema(await sc.expectedTableShapes(d), await readLiveColumns(read, d));
-        const missingOnly = diff.filter((m) => tables.includes(m.table) && m.missing.length > 0).map((m) => ({ ...m, ghost: [] }));
+        const missingOnly = diff.filter((m) => tables.includes(m.table) && m.missing.length > 0).map((m) => ({ ...m, ghost: [], tightened: [] }));
         if (missingOnly.length > 0)
-            return sc.describeMismatchedTables(missingOnly).join("\n");
+            return sc.describeMismatchedTables(d, missingOnly).join("\n");
         why = "this build's table definitions list no column that the database lacks on that table, so the probe and the definitions disagree";
     }
     catch (err) {

package/dist/plugins/schema-ensure-legs.d.ts

@@ -2,6 +2,15 @@ import type { PgQueryFn } from "./pg-query.js";
 import type { SqlDialect } from "./sql-driver.js";
 /** advisory lock 语句 —— 与 schema 无关,录制时跳过(但要答成功,否则 ensure* 走降级告警路径)。 */
 export declare const LOCK_RE: RegExp;
+/**
+ * [ref] `ensureIndex` 的**索引在场**探针(MySQL 臂)。答「在场」——因为**新建库**上这批索引本来就随
+ * `CREATE TABLE` 的内联 `KEY` 一起到货,而基线按定义 =「启动时对一个新库真会执行的东西」。答"零行"会让
+ * 录制里凭空多出 68 条**新建库上永不发生**的 `ALTER TABLE … ADD INDEX`,基线就成了一份撒谎的产物。
+ * ⚠️ 这条特判**只**放行索引探针:任何别的 `information_schema` 探针照旧答零行 ⇒ 残留的「探列→ALTER」
+ * seam 仍会真的发出 ALTER 并被基线生成器的 `SeamViolation`(`scripts/dump-schema.ts`)当场抓住
+ * (SCHEMA POLICY 的那半一个字没松)。
+ */
+export declare const INDEX_PROBE_RE: RegExp;
 /**
  * **「一个新库对 ensure 探针怎么答」的唯一属主**(合并复审 车HB 后收口:此前生成器录制器、`test/ensure-schema.test.ts`
  * 的假池、`test/schema-baseline-generated.test.ts` ③c 的假驱动各抄一份,[ref] 加了索引探针 + PG 锁改 `got === true`

package/dist/plugins/schema-ensure-legs.js

@@ -14,7 +14,7 @@ import { ensureTiDBUsageWindowSchema, ensurePgUsageWindowSchema } from "../store
 import { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./task-list-store-sql.js";
 import { ensureTiDBDeviceSchema, ensurePgDeviceSchema } from "./device-store-sql.js";
 export const LOCK_RE = /GET_LOCK|RELEASE_LOCK|pg_(try_)?advisory/i;
-const INDEX_PROBE_RE = /FROM information_schema\.statistics\b/i;
+export const INDEX_PROBE_RE = /^\s*SHOW\s+INDEX\s+FROM\b/i;
 const PG_INDEX_VALID_RE = /FROM pg_index i WHERE i\.indexrelid = to_regclass/i;
 function newDatabaseSessionMetaKeyCollation() {
     const stmt = SCHEMA_STATEMENTS.find((s) => s.includes("CREATE TABLE IF NOT EXISTS session_meta ("));

package/dist/plugins/schema-indexes.js

@@ -7,6 +7,7 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "task_active", name: "idx_task_active_task", columns: ["task_id"] },
     { table: "checkpoint", name: "idx_checkpoint_status_deadline", columns: ["status", "deadline"] },
     { table: "checkpoint", name: "idx_checkpoint_session_status", columns: ["session_id", "status"] },
+    { table: "checkpoint", name: "idx_checkpoint_host_session_status", columns: ["host_session_id", "status"] },
     { table: "resume_anchor", name: "idx_resume_anchor_session", columns: ["session_id"] },
     { table: "approval_nonce", name: "idx_approval_nonce_expires", columns: ["expires_at_ms"] },
     { table: "user_input_acceptance", name: "idx_user_input_acceptance_session", columns: ["session_id", "state", "accepted_at_ms"] },
@@ -17,6 +18,7 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "snapshot_blob", name: "idx_snapshot_blob_created", columns: ["created_at"] },
     { table: "file_history_version", name: "idx_file_history_version_blob", columns: ["blob_hash"] },
     { table: "file_history_boundary_file", name: "idx_file_history_bf_key", columns: ["scope", "key_hash"] },
+    { table: "file_history_boundary", name: "uq_file_history_boundary_seq", columns: ["scope", "publish_seq"], unique: true },
     { table: "file_history_blob", name: "idx_file_history_blob_created", columns: ["created_at"] },
     { table: "workflow_run", name: "idx_wfrun_scope_created", columns: ["scope", "created_at_ms"] },
     { table: "workflow_run", name: "idx_wfrun_scope_status", columns: ["scope", "status"] },
@@ -24,6 +26,7 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "workflow_park_decision", name: "idx_wfparkdec_host", columns: ["host_session_id"] },
     { table: "workflow_park_decision", name: "idx_wfparkdec_run", columns: ["run_id"] },
     { table: "workflow_completion_inbox", name: "idx_wfinbox_session_seq", columns: ["session_id", "seq"] },
+    { table: "workflow_completion_inbox", name: "uq_wfinbox_seq", columns: ["seq"], unique: true },
     { table: "workflow_inbox_fence", name: "idx_wffence_until", columns: ["until_ms"] },
     { table: "workflow_notify_journal", name: "idx_wfnotify_acked", columns: ["acked"] },
     { table: "shared_memory_store", name: "idx_shared_memory_store_scope", columns: ["scope_key", "store_id"] },

package/dist/plugins/schema-live-columns.d.ts

@@ -1,20 +1,29 @@
 /**
- * 库里**实际**的列集 —— 唯一读者([ref] 列册探针 `schema-consistency.ts` 的对账读它;`ensure-index.ts` 的索引补建在失败之后判「是不是这张表
+ * 库里**实际**的列册 —— 唯一读者([ref] 列册探针 `schema-consistency.ts` 的对账读它;`ensure-index.ts` 的索引补建在失败之后判「是不是这张表
  * 缺这条索引的列」也读它)。叶子模块:不值依赖任何模块(列册探针那边经录制驱动 / 建表腿值依赖 `ensure-index.ts`,读者若住在那边,
  * `ensure-index.ts` 读它就是一个运行时环)。方言词是 `ensure-index.ts` 的闭集(类型边,擦除)。
+ *
+ * 一个读者、一次读:同一张目录视图的同一批行同时回答「哪些列在」(键)与「它允许 NULL 吗」(值)。两方言的「读哪张表 / 哪个 schema」
+ * (MySQL 协议 = 连接上的库;PG = `search_path` 次序里的首次命中)只在这里写一遍;只问列在不在的读者(索引补建、退役 schema 判)用 `Map.has`,不看值。
  */
 import type { SqlDialect } from "./sql-driver.js";
 /** 探针读口:一条 SQL → 行数组(两方言由调用方各自绑)。 */
 export type SchemaProbeRead = (sql: string) => Promise<Array<Record<string, unknown>>>;
+/** 库里一列的实况。`nullable` = 目录的 `is_nullable` 是 `YES`(两个目录都是 `YES` / `NO` 的闭集;读数里没有 `n` 或不是 `YES` ⇒ 不算可空,只有目录明说可空的列才被判)。 */
+export interface LiveColumn {
+    readonly nullable: boolean;
+}
+/** 库里实际的列册:表名 → (列名 → 实况)。读者交出的是只读视图(消费方只问 `has` / `get`)。 */
+export type LiveColumns = ReadonlyMap<string, ReadonlyMap<string, LiveColumn>>;
 /**
- * 库里实际的列集(表名 → 列名集合)。
+ * 库里实际的列册(表名 → 列名 → { nullable })。
  *
  * 🔴 **PG 侧读的是「查询真正会解析到的那个关系」,不是 `current_schema()`**(codex 对抗复审本轮 [medium]
  * 采纳):店里的 SQL 全是**不限定 schema** 的裸表名,它按 `search_path` **逐个** schema 解析,命中第一个;
  * 而 `current_schema()` 只是路径的第一段。两者不等的部署是真的存在(角色的 `search_path` 配了多段),那时
  * 只读第一段会让探针对「表其实住在路径后段、而且缺列」这一形**完全沉默**。⇒ 按 `current_schemas(false)`
- * 的**顺序**取每张表的第一次命中 —— 探针于是与执行器看同一张表。MySQL 协议没有这个概念(库 = 连接上的
- * `DATABASE()`),那条臂一个字不变。
+ * 的**顺序**取每张表的第一次命中 —— 探针于是与执行器看同一张表(列在不在、可不可空对同一张表说话)。MySQL 协议没有这个概念(库 = 连接上的
+ * `DATABASE()`),那条臂只有选择列多一格。
  */
-export declare function readLiveColumns(read: SchemaProbeRead, dialect: SqlDialect): Promise<Map<string, Set<string>>>;
+export declare function readLiveColumns(read: SchemaProbeRead, dialect: SqlDialect): Promise<LiveColumns>;
 //# sourceMappingURL=schema-live-columns.d.ts.map

package/dist/plugins/schema-live-columns.js

@@ -1,8 +1,8 @@
 export async function readLiveColumns(read, dialect) {
     const live = new Map();
     if (dialect !== "pg") {
-        for (const row of await read("SELECT table_name AS t, column_name AS c FROM information_schema.columns WHERE table_schema = DATABASE()")) {
-            addColumn(live, row["t"], row["c"], "fold");
+        for (const row of await read("SELECT table_name AS t, column_name AS c, is_nullable AS n FROM information_schema.columns WHERE table_schema = DATABASE()")) {
+            addColumn(live, row["t"], row["c"], row["n"], "fold");
         }
         return live;
     }
@@ -13,7 +13,7 @@ export async function readLiveColumns(read, dialect) {
             order.set(s, Number(row["ord"]));
     }
     const winner = new Map();
-    for (const row of await read("SELECT table_schema AS s, table_name AS t, column_name AS c FROM information_schema.columns WHERE table_schema = ANY (current_schemas(false))")) {
+    for (const row of await read("SELECT table_schema AS s, table_name AS t, column_name AS c, is_nullable AS n FROM information_schema.columns WHERE table_schema = ANY (current_schemas(false))")) {
         const t = String(row["t"] ?? "");
         const rank = order.get(String(row["s"] ?? "")) ?? Number.MAX_SAFE_INTEGER;
         const held = winner.get(t);
@@ -23,20 +23,20 @@ export async function readLiveColumns(read, dialect) {
             winner.set(t, rank);
             live.delete(t);
         }
-        addColumn(live, t, row["c"], "verbatim");
+        addColumn(live, t, row["c"], row["n"], "verbatim");
     }
     return live;
 }
-function addColumn(live, table, column, mode) {
+function addColumn(live, table, column, isNullable, mode) {
     const t = mode === "fold" ? String(table ?? "").toLowerCase() : String(table ?? "");
     const c = mode === "fold" ? String(column ?? "").toLowerCase() : String(column ?? "");
     if (t === "" || c === "")
         return;
-    let set = live.get(t);
-    if (set === undefined) {
-        set = new Set();
-        live.set(t, set);
+    let columns = live.get(t);
+    if (columns === undefined) {
+        columns = new Map();
+        live.set(t, columns);
     }
-    set.add(c);
+    columns.set(c, { nullable: String(isNullable ?? "").toUpperCase() === "YES" });
 }
 //# sourceMappingURL=schema-live-columns.js.map

package/dist/plugins/send-user-file.js

@@ -3,6 +3,7 @@ import { uuidv7 } from "@sema-agent/core";
 import { stripControlAndBidi } from "@sema-agent/settings-schema";
 import { presignS3CopyUrl, presignS3Url } from "./s3-presign.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "./blob-backend.js";
+import { createEgressFetch } from "../egress-redirect.js";
 export const PRESIGN_MAX_TTL_SEC = 604_800;
 export function scopeSegment(secretKey, scope) {
     if (scope === undefined || scope === "")
@@ -27,7 +28,7 @@ export function sanitizeSendFileName(name) {
     return clean.length > 0 ? clean : "file";
 }
 export function createSendUserFileIssuer(cfg, deps) {
-    const f = deps?.fetchImpl ?? fetch;
+    const f = createEgressFetch("declare the final object-store address as MINIO_ENDPOINT / S3_ENDPOINT", deps?.fetchImpl);
     const bounded = () => ({ signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
     const upload = deps?.upload ??
         (async (bucket, key, bytes) => {