@sema-agent/server 7.147.0 → 7.149.0

package/dist/leader/leader.js

@@ -22,14 +22,25 @@ export function withLeaderLeg(spec, entry) {
     const word = entryPermissionMode(spec.permissionMode, entry.permissionMode).effective;
     return withUnattendedLeg(word === undefined ? spec : { ...spec, permissionMode: word });
 }
+export const LEADER_RUN_STOPPED = "leader run stopped at an abort checkpoint (cancel): no further work was started and nothing was pushed after the stop";
+export function stoppedResult(reports, route) {
+    const sus = reports.filter((r) => r.status === "suspended").map((r) => ({ workerId: r.workerId, sessionId: r.sessionId }));
+    return { ok: false, reports, cancelled: true, stopped: true, error: LEADER_RUN_STOPPED, ...(route ? { route } : {}), ...(sus.length > 0 ? { suspended: sus } : {}) };
+}
 export async function runLeaderTask(task, durableBaseSha, deps) {
+    const signal = deps.signal;
+    const aborted = () => signal?.aborted === true;
     let subs;
     try {
         subs = await deps.plan(task);
     }
     catch (e) {
+        if (aborted())
+            return stoppedResult([], undefined);
         return { ok: false, reports: [], cancelled: false, error: `plan failed: ${e instanceof Error ? e.message : String(e)}` };
     }
+    if (aborted())
+        return stoppedResult([], undefined);
     if (subs.length === 0)
         return { ok: false, reports: [], cancelled: false, error: "planner produced no sub-tasks" };
     const route = subs.length === 1 ? "single" : "fanout";
@@ -37,6 +48,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
     let finalReports = [];
     try {
         for (const sub of subs) {
+            if (aborted())
+                return stoppedResult([], route);
             try {
                 workers.push(await deps.provisionWorker(sub));
             }
@@ -52,7 +65,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
         const toSubtask = (w) => ({
             workerId: w.workerId, sessionId: w.sessionId, branch: w.branch, baseSha: w.baseSha, spec: w.spec,
         });
-        const foBase = { runner, timeoutMs: deps.timeoutMs, maxConcurrency: deps.maxConcurrency, cancelOnSuspend: true, ...(deps.logger ? { logger: deps.logger } : {}) };
+        const foBase = { runner, timeoutMs: deps.timeoutMs, maxConcurrency: deps.maxConcurrency, cancelOnSuspend: true, ...(signal ? { signal } : {}), ...(deps.logger ? { logger: deps.logger } : {}) };
         const runWave = async (sts) => {
             if (!deps.verifyWorker) {
                 return fanOut(sts, {
@@ -149,12 +162,16 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 return runWave([toSubtask(solo)]);
             }
         };
+        if (aborted())
+            return stoppedResult([], route);
         const fo1 = route === "single" && workers.length === 1
             ? await runSolo(workers[0], subs[0])
             : await runWave(workers.map(toSubtask));
         let reports = fo1.reports;
         let cancelled = fo1.cancelled;
         finalReports = reports;
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const workerRepoDir = deps.workerRepoDir ?? deps.repoDir;
         const workerDiff = (w) => w.fetchDiff
             ? w.fetchDiff()
@@ -193,6 +210,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const w = byId.get(r.workerId);
                 const sub = subById.get(r.workerId);
                 for (let attempt = 0; attempt <= maxR; attempt++) {
+                    if (aborted())
+                        return;
                     const d = await workerDiff(w);
                     if (!d.ok)
                         return;
@@ -201,6 +220,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     r.repairs = attempt;
                     if (verdict.ok)
                         return;
+                    if (aborted())
+                        return;
                     const safeVerdictReason = redactErrorMessage(verdict.reason ?? "behaviorally incorrect") ?? "";
                     if (attempt === maxR) {
                         r.status = "failed";
@@ -209,7 +230,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.entry)).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.entry)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }
@@ -222,6 +243,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             }));
         };
         await runModuleGate();
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const mergeDeps = {
             pullWorkerDiff: async (r) => workerDiff(byId.get(r.workerId)),
             provisionIntegrationSandbox: deps.provisionIntegrationSandbox,
@@ -232,6 +255,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             ...(deps.mergeGates?.measureGates ? { measureGates: true } : {}),
             ...(deps.mergeGates?.strongOracleSeeded ? { strongOracleSeeded: true } : {}),
             ...(deps.mergeGates?.measureDrivesRepair ? { measureDrivesRepair: deps.mergeGates.measureDrivesRepair } : {}),
+            ...(signal ? { signal } : {}),
             ...(deps.logger ? { logger: deps.logger } : {}),
         };
         let redispatched;
@@ -260,8 +284,10 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
         });
         const collapseToSingle = async (trigger, reason) => {
             const safeReason = redactHead(reason, 300);
-            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: safeReason });
             const replan = { trigger, collapsed: safeReason, ...(redispatched ? { redispatched } : {}) };
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
+            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: safeReason });
             const soloSub = { workerId: "collapse-solo", branch: "worker/collapse-solo", files: ["."], spec: { objective: task } };
             let solo;
             try {
@@ -274,12 +300,18 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             workers.push(solo);
             byId.set(solo.workerId, solo);
             bySession.set(solo.sessionId, solo);
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
             const fo = await runSolo(solo, soloSub);
             finalReports = [...reports, ...fo.reports];
+            if (aborted())
+                return { ...stoppedResult(finalReports, route), replan };
             const sus = await surfaceSuspended(finalReports, fo.reports);
             if (sus)
                 return { ...sus, replan: { ...replan, trigger: "suspended" }, ...(repairTerminal ? { repairTerminal } : {}), ...(candidatePatch ? { candidatePatch } : {}) };
             const m = await mergeBranches(fo.reports, durableBaseSha, mergeDeps);
+            if (!m.ok && m.stopped)
+                return { ...stoppedResult(finalReports, route), merge: m, replan };
             if (!m.ok && m.conflict) {
                 const cc = m.conflict;
                 deps.logger?.warn?.("merge_conflict_to_user", { conflicted: cc.conflicted, applied: cc.applied, files: cc.files.slice(0, 20) });
@@ -325,6 +357,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const fresh = [];
                 try {
                     for (const id of failedIds) {
+                        if (aborted())
+                            return stoppedResult(finalReports, route);
                         const w = await deps.provisionWorker(subById.get(id));
                         fresh.push(w);
                         workers.push(w);
@@ -342,6 +376,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 const retryById = new Map(fo2.reports.map((r) => [r.workerId, r]));
                 reports = reports.map((r) => retryById.get(r.workerId) ?? r);
                 finalReports = reports;
+                if (aborted())
+                    return stoppedResult(finalReports, route);
                 const sus2 = await surfaceSuspended(reports, fo2.reports);
                 if (sus2)
                     return sus2;
@@ -351,7 +387,11 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 }
             }
         }
+        if (aborted())
+            return stoppedResult(finalReports, route);
         const merge = await mergeBranches(reports, durableBaseSha, mergeDeps);
+        if (!merge.ok && merge.stopped)
+            return { ...stoppedResult(finalReports, route), merge };
         if (!merge.ok && merge.conflict) {
             const c = merge.conflict;
             deps.logger?.warn?.("merge_conflict_to_user", { conflicted: c.conflicted, applied: c.applied, files: c.files.slice(0, 20) });

package/dist/leader/merge.d.ts

@@ -52,6 +52,7 @@ export interface IntegrationRepair {
         errorText: string;
         testCmd: string;
         repoDir: string;
+        signal?: AbortSignal;
     }): Promise<{
         costUsd?: number;
         note?: string;
@@ -154,11 +155,17 @@ export interface MergeDeps {
         /** Parse the integrated patch into a changed-file list (the wire binds `git apply --numstat` / name-only). */
         changedFiles: (integratedPatch: string) => Promise<string[]>;
     };
+    /** 这条 leader run 的中止信号(与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消)。核点同一只判(`stopAt`):建集成沙箱前、
+     *  每一轮集成修复前、测试判决处、**push 咽喉**(下面唯一一处 `deps.push` 调用的正上方)。全部 push 路径都过那一处调用 ⇒ 中止被看见之后零 push;
+     *  已经发出的 push 不撤(同步 git,发出之后本进程看不见中止),它的结局照实回。 */
+    signal?: AbortSignal;
     logger?: {
         warn?: (m: string, x?: Record<string, unknown>) => void;
         info?: (m: string, x?: Record<string, unknown>) => void;
     };
 }
+/** 中止被看见时合并停下的那一句(人读;机读位是 `stopped`)。 */
+export declare const MERGE_STOPPED_REASON = "cancelled before push \u2014 the leader run was stopped, nothing was pushed";
 /** Integration-repair outcome (when `MergeDeps.provisionIntegrationSandbox` supplied a `repair`): how many
  *  rounds ran, whether the post-repair `testCmd` finally passed, and the repair spend. `outsidePlannedFiles`
  *  is honest accounting — repaired files are NOT attributed to the original disjoint workers. */
@@ -193,7 +200,8 @@ export type MergeResult = {
     measure?: {
         pass: boolean;
         reason?: string;
-    };
+    }; /** 只在中止信号被看见、合并在 push 之前停下时在场(恒 `true`):这一趟零 push。 */
+    stopped?: true;
 };
 /** Integrate completed workers' branches. Never throws — failures are typed MergeResult. */
 export declare function mergeBranches(reports: WorkerReport[], baseSha: string, deps: MergeDeps): Promise<MergeResult>;

package/dist/leader/merge.js

@@ -4,6 +4,7 @@ import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 const CONFLICT_FILES_MAX = 200;
 const CONFLICT_REJ_HEAD_MAX = 2048;
+export const MERGE_STOPPED_REASON = "cancelled before push — the leader run was stopped, nothing was pushed";
 export async function mergeBranches(reports, baseSha, deps) {
     const repo = deps.repoDir ?? "/repo";
     const mergeable = reports.filter((r) => r.status === "completed");
@@ -14,6 +15,9 @@ export async function mergeBranches(reports, baseSha, deps) {
     let phase = "diff-out";
     let repairMeta;
     let measure;
+    const stopAt = (at) => deps.signal?.aborted
+        ? { ok: false, phase: at, reason: MERGE_STOPPED_REASON, stopped: true, ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}) }
+        : undefined;
     try {
         const patches = [];
         for (const r of mergeable) {
@@ -24,6 +28,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             patches.push({ workerId: r.workerId, patch: d.patch });
         }
         phase = "provision";
+        const stoppedBeforeSandbox = stopAt("provision");
+        if (stoppedBeforeSandbox)
+            return stoppedBeforeSandbox;
         const integ = await deps.provisionIntegrationSandbox();
         destroy = integ.destroy;
         const { env } = integ;
@@ -59,6 +66,8 @@ export async function mergeBranches(reports, baseSha, deps) {
             let cost = 0;
             let round = 0;
             for (; round < integ.repair.maxRounds && test.exitCode !== 0; round++) {
+                if (deps.signal?.aborted)
+                    break;
                 const errorText = redactTail(test.stdout + "\n" + test.stderr, 4000);
                 if (errorText.startsWith(OVERSIZED_DIAG_PLACEHOLDER)) {
                     deps.logger?.warn?.("integration_repair_skipped_oversized_output", { round: round + 1, outputChars: test.stdout.length + test.stderr.length });
@@ -66,7 +75,7 @@ export async function mergeBranches(reports, baseSha, deps) {
                 }
                 deps.logger?.warn?.("integration_repair_round", { round: round + 1, maxRounds: integ.repair.maxRounds });
                 try {
-                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo });
+                    const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo, signal: deps.signal });
                     cost += r.costUsd ?? 0;
                 }
                 catch (e) {
@@ -80,6 +89,9 @@ export async function mergeBranches(reports, baseSha, deps) {
             repairMeta = { rounds: round, fixed: test.exitCode === 0, costUsd: cost };
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
         }
+        const stoppedAtTest = stopAt("test");
+        if (stoppedAtTest)
+            return stoppedAtTest;
         if (test.exitCode !== 0) {
             return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}) };
         }
@@ -116,6 +128,9 @@ export async function mergeBranches(reports, baseSha, deps) {
                 ...(repairMeta ? { repair: repairMeta } : {}),
             };
         }
+        const stoppedBeforePush = stopAt("push");
+        if (stoppedBeforePush)
+            return stoppedBeforePush;
         const push = await deps.push(integrated.stdout, baseSha);
         if (!push.ok) {
             if (push.raced)

package/dist/leader/repair-wire.js

@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.entry);
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.entry);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,10 +1,35 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type CheckpointToken } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
 import { type CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
 import type { LeaderRequestBody } from "./endpoint.js";
+/**
+ * leader worker 停驻行的两只 scope —— **唯一属主**(审批停驻 / 资源分片停驻各一只;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS` /
+ * `RESERVED_PRINCIPAL_PREFIXES`)。worker 的 durable spec 与取消时的残留过期({@link createLeaderParkExpirer})读这同一对。
+ */
+export declare const LEADER_APPROVAL_SCOPE = "_leader";
+export declare function leaderResourceScope(workerId: string): string;
+/** 过期残留停驻要的那两口(SQL 两方言与 local 店都有;结构型,单测用假件)。 */
+export interface LeaderParkStore {
+    findPendingTokenBySession(sessionId: string, scope?: string): Promise<CheckpointToken | null | undefined>;
+    expire(token: CheckpointToken, scope: string): Promise<boolean>;
+}
+/** 一次过期的回执:`expired` = CAS 赢的行数;`lost` = 找到了却没过期掉的行数(并发的 `/decide` 或 reaper 先结算了它 —— 被决的那一张会作为它自己的续跑接着走)。 */
+export interface LeaderParkExpiry {
+    readonly expired: number;
+    readonly lost: number;
+}
+/**
+ * 取消落定时把这条 leader run 的子 worker 残留停驻按 CAS 过期(与 reaper 同一口 `expire`:同一张停驻**永不**既被过期又被续跑)。
+ * 对每个 `{ workerId, sessionId }`,在两只 scope 上逐张排空(读口一次只交一张)。回执见 {@link LeaderParkExpiry}。
+ * 已经被决过的停驻不在待决集里 ⇒ 不碰(它的续跑是一条独立的 run,停它走 `POST /v1/runs/:id/cancel`)。
+ */
+export declare function createLeaderParkExpirer(store: LeaderParkStore): (workers: ReadonlyArray<{
+    readonly workerId: string;
+    readonly sessionId: string;
+}>) => Promise<LeaderParkExpiry>;
 /** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
 export interface LeaderDurableSeat {
     readonly checkpointStore: CheckpointStoreFull;
@@ -87,7 +112,7 @@ export interface LeaderWireConfig {
      * 全在那里(`createBrain` 自己不记账)。而 `POST /v1/leader` 的准入处**读**的正是 costQuota / fleetLease
      * 这两个桶。缺席 ⇒ 门查的桶与花钱的手不是同一只:`MAX_PRINCIPAL_COST_USD` 与 fleet 租约对这条腿结构性
      * 失效,而一条 leader run 扇出 ≤6 个带手 worker + planner + repair/conflict 环,全是实钱。
-     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withPrincipal`)—— 记账臂按 `currentPrincipal()`
+     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withSubject`)—— 记账臂按 `currentPerson()`
      * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
      */
     tracer?: RunnerDeps["tracer"];
@@ -98,6 +123,11 @@ export interface LeaderWireConfig {
      * 管不到 leader 派出的腿,拒绝计量 / 工具追踪也漏这条腿。缺席 ⇒ 展开空对象。
      */
     mods?: RunnerDeps["mods"];
+    /**
+     * **手带**(`RunnerDeps.hands`),原样递给本车道的每一只 Runner。唯一铸点 = `boot/runner-deps.ts` 的 `buildHandsBand`(共享基座调的同一只):
+     * 前台命令超时转后台读部署旋钮 `AUTO_BACKGROUND_ON_TIMEOUT`,本车道不署名。缺失时本车道的 Runner 没有手带(超时即杀、不署名)。缺席 ⇒ 展开空对象。
+     */
+    hands?: RunnerDeps["hands"];
     /**
      * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
      * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与
@@ -293,6 +323,8 @@ export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
  *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
  *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
  *  唯一新增是六条 execFileSync 各自的 `timeout`。
+ *  每条都显式交 `stdio: "pipe"`:不交 `stdio` 时 Node 把子进程的 stderr 原样转写到本进程 stderr(git / credential helper 的诊断直通、绕过日志出口接缝);
+ *  交了之后它只进错误对象,失败句经返回值的 `error` 交给调用方、由调用方的日志行过座(`test/log-exit-single-source-gate.test.ts` 钉「同步子进程必须显式交 stdio」)。
  *
  *  7.103.0([ref] 残余):六条 git 子进程的 env 一律 = `gitSubprocessEnv({ isolateConfig: false })` + `LC_ALL=C`(修前:
  *  `{ ...process.env, LC_ALL: "C" }`,两条 `git config` 连 env 都不交 ⇒ 整份服务 env 进 git 与它拉起的 helper / hook)。
@@ -304,6 +336,7 @@ export declare function createCoordinatorPush(durableRemote: string, targetRef:
     name: string;
     email: string;
 }): LeaderDeps["push"];
-export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
+/** 返回的函数收本 run 的中止信号(`createLeaderEndpoint` 的驱动腿恒交一根;与 core `TaskSpec.signal?` 同约定可选 —— 不交 = 这次调用停不下)。 */
+export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody, signal?: AbortSignal) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map

package/dist/leader/wire.js

@@ -21,9 +21,46 @@ import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
 import { buildInternalRunCtx } from "../internal-run-env.js";
-import { currentPrincipal } from "../observability/principal-context.js";
+import { currentSubject } from "../observability/principal-context.js";
+import { partsOf } from "../owner-brands.js";
+import { taskSpecIdentityOf } from "../engine-identity.js";
 import { redactHead } from "../observability/run-terminal.js";
 const REPAIR_LOOP_WIRED = true;
+export const LEADER_APPROVAL_SCOPE = "_leader";
+export function leaderResourceScope(workerId) {
+    return `_leader-resource-${workerId}`;
+}
+const PARK_DRAIN_MAX = 64;
+export function createLeaderParkExpirer(store) {
+    return async (workers) => {
+        let expired = 0;
+        let lost = 0;
+        const seen = new Set();
+        for (const w of workers) {
+            for (const scope of [LEADER_APPROVAL_SCOPE, leaderResourceScope(w.workerId)]) {
+                const key = `${w.sessionId}\u0000${scope}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const tried = new Set();
+                for (let i = 0;; i++) {
+                    const token = await store.findPendingTokenBySession(w.sessionId, scope);
+                    if (token === null || token === undefined)
+                        break;
+                    if (tried.has(token) || i >= PARK_DRAIN_MAX) {
+                        throw new Error(`leader park expiry: the checkpoint store kept answering pending token for session ${w.sessionId} in scope ${scope} after expiring it — refusing to spin (expired=${expired}, lost=${lost})`);
+                    }
+                    tried.add(token);
+                    if (await store.expire(token, scope))
+                        expired++;
+                    else
+                        lost++;
+                }
+            }
+        }
+        return { expired, lost };
+    };
+}
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);
     if (!r.ok)
@@ -111,20 +148,20 @@ export function createCoordinatorPush(durableRemote, targetRef, ident) {
         const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
         const gitEnv = { ...gitSubprocessEnv({ site: "server.leader.git-push", isolateConfig: false }), LC_ALL: "C" };
         try {
-            execFileSync("git", ["clone", "-q", durableRemote, dir], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["clone", "-q", durableRemote, dir], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             writeFileSync(join(dir, ".leader.patch"), integratedPatch);
-            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             rmSync(join(dir, ".leader.patch"));
             const ref = targetRef ?? "refs/heads/main";
-            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { stdio: "pipe", encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
             if (exists) {
-                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             }
             else {
-                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { stdio: "pipe", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
             }
             return { ok: true, ref };
         }
@@ -168,20 +205,21 @@ export function createLeaderRunner(cfg) {
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const modsSeat = cfg.mods ? { mods: cfg.mods } : {};
+    const handsSeat = cfg.hands ? { hands: cfg.hands } : {};
     const servedTableSeat = { models: cfg.models, roles: cfg.roles, ...(cfg.tiers ? { tiers: cfg.tiers } : {}) };
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
     const onErrorSeat = cfg.onError ? { onError: cfg.onError } : {};
     const principalSpec = () => {
-        const p = currentPrincipal();
-        return p ? { principal: p } : {};
+        const subject = currentSubject();
+        return taskSpecIdentityOf(subject === undefined ? undefined : partsOf(subject));
     };
     const mkRepair = (rawEnv, repoDir, oracleFiles, entry) => {
         if (repairRounds <= 0)
             return undefined;
         return {
             maxRounds: repairRounds,
-            run: async ({ round, errorText, testCmd }) => {
+            run: async ({ round, errorText, testCmd, signal }) => {
                 for (const f of oracleFiles) {
                     await rawEnv.remove(f.path).catch(() => { });
                     const ex = await rawEnv.exists(f.path);
@@ -189,7 +227,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -203,6 +241,7 @@ export function createLeaderRunner(cfg) {
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
+                        signal,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     }, entry))
                         .result();
@@ -220,7 +259,7 @@ export function createLeaderRunner(cfg) {
             },
         };
     };
-    return async (raw) => {
+    return async (raw, signal) => {
         const body = raw;
         if (!body.objective || !body.durableRemote || !body.testCmd || !body.seedCmd || !body.baseSha) {
             return { ok: false, reports: [], cancelled: false, error: "request must provide objective, durableRemote, baseSha, testCmd, seedCmd" };
@@ -256,12 +295,13 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat });
+            const planRunner = new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
                     ...principalSpec(),
                     sessionId: `leader-route-${Date.now()}`,
+                    signal,
                     ...(cfg.routerModel ? { model: cfg.routerModel } : { modelRole: "classifier" }),
                 }).result();
                 return res.result ?? "";
@@ -285,7 +325,7 @@ export function createLeaderRunner(cfg) {
                 durableSpec = {
                     toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval: d.requireApproval, ...(d.deny ? { deny: d.deny } : {}), ...(d.autoBudget ? { autoBudget: d.autoBudget } : {}), ...(d.neverAuto ? { neverAuto: d.neverAuto } : {}) })),
                     checkpointStore: d.checkpointStore,
-                    durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
+                    durableApproval: { scope: LEADER_APPROVAL_SCOPE, ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
                     onQuestion: QUESTION_AWAITS_RESUME,
                 };
                 await d.checkpointStore.putCtx(sessionId, storedResumeCtx).catch((e) => {
@@ -300,7 +340,7 @@ export function createLeaderRunner(cfg) {
             if (resourceCfg && !repairLoopActive && durable && cfg.toolResultStore && cfg.sessionStore) {
                 resourceSpec = {
                     checkpointStore: durable.checkpointStore,
-                    resourceSuspend: { scope: `_leader-resource-${sub.workerId}`, totalBudgetUsd: resourceCfg.totalBudgetUsd },
+                    resourceSuspend: { scope: leaderResourceScope(sub.workerId), totalBudgetUsd: resourceCfg.totalBudgetUsd },
                     limits: { ...workerLimits.limits, maxCostUsd: resourceCfg.sliceMaxCostUsd },
                     maxSuspends: resourceCfg.maxSuspends,
                 };
@@ -350,7 +390,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat,
+                        brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: async (ctx) => {
@@ -375,7 +415,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, ...servedTableSeat, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...modsSeat, ...handsSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeBody),
@@ -419,6 +459,7 @@ export function createLeaderRunner(cfg) {
         const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
             entry,
+            signal,
             plan,
             provisionWorker,
             provisionIntegrationSandbox,

package/dist/leg-facts.d.ts

@@ -1,7 +1,7 @@
 /**
- * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证)—— server 自有的载体,**不搭引擎 spec 的车**。
+ * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证 · 登记的工作目录)—— server 自有的载体,**不搭引擎 spec 的车**。
  *
- * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出三件
+ * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出四件
  * 只有 server 自己读的事实 —— 它们以装配器**自己的输出对象**为键登记在这一张表里(单一铸点 {@link mintLegFacts}),由两只漏斗
  * (受理 `http/admission.ts` 的 `prepareSpec` · 续跑 `http/resume-legs.ts` 的 `resolveResumeSpec`)在拿到装配输出的**同一只对象**时
  * 读一次(唯一读口 {@link legFactsOf},读在 `stampSpecRoot` 复制之前),此后作普通值随 `PreparedTaskSubmission.legFacts` /
@@ -26,6 +26,11 @@ export interface LegFacts {
     readonly skills: readonly RunSkillEntry[];
     /** 受理时读根会话行的那一读(会话 id + 住客)。读者 = 腿的会话行记录座(`session-workspace.ts`)。 */
     readonly sessionWitness: DelegationRootWitness;
+    /**
+     * 这次提交的根会话登记的工作目录(提交体 `cwd` 经唯一写口 `setSessionCwd` 登记的那一枚;装配器在登记之后读一次)。缺席 = 没登记。
+     * 读者 = 三只组合入口(同步 / 后台 / 续跑腿的梯子与验证门):经 `compositionLegRoot`(`task-cwd.ts`)交给它们驱动的每一条腿当交活方的工作目录。
+     */
+    readonly registeredCwd?: string;
 }
 /**
  * 铸事实(**单一属主**:只允许 `createResolveSpec` 的出口调用)。同一只对象被第二次铸 ⇒ 当场抛 —— 两个写者是漂移的成因,

package/dist/leg-facts.js

@@ -6,6 +6,7 @@ export function mintLegFacts(resolved, facts) {
         hands: facts.hands,
         skills: Object.freeze(facts.skills.map((e) => Object.freeze({ ...e }))),
         sessionWitness: Object.freeze({ ...facts.sessionWitness }),
+        ...(facts.registeredCwd !== undefined ? { registeredCwd: facts.registeredCwd } : {}),
     }));
     return resolved;
 }

package/dist/local-store-declaration.d.ts

@@ -0,0 +1,54 @@
+/**
+ * **local 店对引擎的声明**(会话店顶层 · 检查点店「两半」读同一份;委派分区的声明是子代转录档位的判据,不随两半降)—— 「这台部署向谁承诺店活过替换」的唯一读者,与运维那一个词的闭集。
+ *
+ * ## 规则(一句)
+ * local 文件店的设计声明是「活过进程重启」(`SESSION_DURABILITY`);起服的店持久性准入(`store-admission.ts`,第 2 段、第一笔写之前)拿这句声明与数据根介质对表
+ * (声明 `durable` ∧ 介质 `ephemeral` ⇒ 拒启 `config.store_not_durable`;第 9 段布线审计对引擎读到的声明同判)。声明降为引擎的 `process-local` 只有两个来源,都由 {@link localStoreDeclarationOf} 一处答:
+ *  · 运维写了 `LOCAL_STORE_DURABILITY=ephemeral`(闭集只有这一个词;缺席 = 设计声明);
+ *  · 店落在**调用方自己的盘**上(部署形表行 `callerOwnsWorkerDisk`:host 车道 ∧ 单主)且数据根介质判 `ephemeral` —— 调用方的工作区、工具与会话史同在那块盘上,
+ *    部署不替他承诺他自己那块易失盘活过替换(参照实现在无卷容器里同形)。
+ * 两半一起降:只降会话店,引擎的 durable-park 自检读出缺口(`durableParkGapOf`:检查点活过、会话不活);只降检查点店同理。
+ *
+ * 叶模块:值导入只有部署形表(叶)与店型常量的属主;`store-posture.ts` / `store-admission.ts` / `config.ts` / local 后端各读这里,不各写一份。
+ */
+import type { StoreDurability as EngineStoreDurability } from "@sema-agent/core";
+import { type DeploymentShapeInput } from "./deployment-shape.js";
+import type { StoreDurability } from "./store-posture.js";
+/** `LOCAL_STORE_DURABILITY` 的词(闭集,只有「易失」一个词;缺席 = 店型的设计声明)。不给第二个放宽词 —— 声明只有「我就是易失」这一句。 */
+export declare const LOCAL_STORE_DECLARATION_WORDS: readonly ["ephemeral"];
+export type LocalStoreDeclarationWord = (typeof LOCAL_STORE_DECLARATION_WORDS)[number];
+/**
+ * local 店声明的依据词(闭集;引擎声明词由 {@link engineDurabilityOfDeclarationRule} 的穷举 switch 派生 —— 加词 ⇒ 编译红):
+ *  · `declared_ephemeral` —— 运维写了 `LOCAL_STORE_DURABILITY=ephemeral` ⇒ `process-local`(不论车道与介质:这是部署者对自己的店说的话);
+ *  · `callers_own_volatile_disk` —— 部署形表行 `callerOwnsWorkerDisk` 成立(host 车道 ∧ 单主:店所在的盘就是调用方自己的盘 —— 他的工作区、工具与会话史同在一块盘上,
+ *    CC 在容器里同形)且数据根介质判 `ephemeral` ⇒ `process-local`:部署不替调用方承诺他自己那块易失盘活过替换;
+ *  · `store_design` —— 其余:local 文件店的设计声明(活过进程重启,`SESSION_DURABILITY`)。店落在调用方看不见的 worker 盘上而介质易失 ⇒ 审计拒启;
+ *    调用方自己的盘判 `durable` / `unknown` ⇒ 声明照旧(开发机、挂了卷的容器、非 Linux)。
+ */
+export declare const LOCAL_STORE_DECLARATION_RULES: readonly ["declared_ephemeral", "callers_own_volatile_disk", "store_design"];
+export type LocalStoreDeclarationRule = (typeof LOCAL_STORE_DECLARATION_RULES)[number];
+/** 依据词 → 引擎声明词(穷举 switch)。 */
+export declare function engineDurabilityOfDeclarationRule(rule: LocalStoreDeclarationRule): EngineStoreDurability;
+/** local 店的声明(依据词 + 派生的引擎声明词;两半店读同一份)。 */
+export interface LocalStoreDeclaration {
+    readonly rule: LocalStoreDeclarationRule;
+    readonly durability: EngineStoreDurability;
+}
+/** 声明读的部署事实:部署形表行 `callerOwnsWorkerDisk` 的读入形(车道 × 租户)+ 运维的词 `LOCAL_STORE_DURABILITY`(`ServiceConfig` 结构上满足)。 */
+export type LocalStoreDeclarationDeployment = DeploymentShapeInput<"lane" | "principal"> & {
+    readonly localStoreDurability: LocalStoreDeclarationWord | undefined;
+};
+/**
+ * 🔴 「local 店对引擎声明自己活过什么」的**唯一读者**(两个调用点读同一组输入:local 后端的构造 —— 两半店的声明都从它的返回值来;起服第 2 段的店持久性准入 `store-admission.ts` —— 拒启判读同一份)。
+ * `dataRootMedium` = 起服第 2 段对数据根介质的判定;没有起服证据的入口(`run-local`、嵌入方直调 `createStoreBackend`)递 `unknown` —— 与装配值同一条缺证据律:
+ * 判不出的介质不放宽声明,只有运维的词能。
+ */
+export declare function localStoreDeclarationOf(deployment: LocalStoreDeclarationDeployment, dataRootMedium: StoreDurability): LocalStoreDeclaration;
+/** 依据词的人读形(布线审计的 warn 行与店的持久性准入的拒句用)。 */
+export declare function describeLocalStoreDeclaration(d: LocalStoreDeclaration): string;
+/**
+ * `LOCAL_STORE_DURABILITY` 的读法(配置装载调这一只):缺席 / 空串 ⇒ `undefined`(设计声明);恰为闭集里的词(去首尾空白后逐字)⇒ 那个词;
+ * 别的任何值 ⇒ 抛(拒启)—— 一个读不懂的声明不许被折成「持久」或「易失」中的任何一边。
+ */
+export declare function parseLocalStoreDurabilityWord(raw: string | undefined): LocalStoreDeclarationWord | undefined;
+//# sourceMappingURL=local-store-declaration.d.ts.map