@sema-agent/server 7.149.0 → 7.151.0

package/dist/plugins/workspace-fill.js

@@ -1,12 +1,13 @@
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { RemoteExecutionError } from "@sema-agent/core";
+import { connectRefusal } from "./remote-env-connect-seat.js";
 import { readProjectBundle } from "../project-bundle.js";
 import { attachmentBytesOf, attachmentPlacementsOf, seedOfSession } from "./task-attachment-store.js";
 import { shellQuote } from "./remote-shell.js";
 const FILLED = { ok: true };
 function refused(message, standing = false) {
-    return { ok: false, error: new RemoteExecutionError("connect_failed", message), standing };
+    return standing ? connectRefusal("workspace_fill_refused", message) : { ok: false, error: new RemoteExecutionError("connect_failed", message), standing: false };
 }
 function errText(e) {
     return e instanceof Error ? e.message : String(e);

package/dist/plugins/write-behind-counter.js

@@ -1,4 +1,5 @@
 import { alignedWindow, retryAfterSecUntil } from "../observability/cost-quota.js";
+import { sealStoreClass } from "./store-boundary.js";
 const SEP = "\u0000";
 export const DEFAULT_COUNTER_QUERY_TIMEOUT_MS = 30_000;
 export class SqlWriteBehindCounter {
@@ -173,6 +174,10 @@ export class SqlWriteBehindCounter {
         this.windowMs = windowMs;
     }
 }
+sealStoreClass(SqlWriteBehindCounter, "sql-write-behind-counter", {
+    window: "exit", bucket: "exit", usedIn: "exit", used: "exit", addLocal: "exit", retryAfterSec: "exit", flush: "exit", refresh: "exit", reap: "exit",
+    startRefresh: "exit", stop: "exit", refreshRunning: "exit", setWindowMs: "exit",
+});
 export class WriteBehindCounter extends SqlWriteBehindCounter {
     constructor(pool, t, windowMs, now, onDegraded, queryTimeoutMs) {
         super("mysql", pool, t, windowMs, now, onDegraded, queryTimeoutMs);

package/dist/process-instance.d.ts

@@ -0,0 +1,3 @@
+/** 本进程的身份(第一次调用时铸,之后恒同值)。 */
+export declare function processInstanceId(): string;
+//# sourceMappingURL=process-instance.d.ts.map

package/dist/process-instance.js

@@ -0,0 +1,7 @@
+import { uuidv7 } from "@sema-agent/core";
+let minted;
+export function processInstanceId() {
+    minted ??= uuidv7();
+    return minted;
+}
+//# sourceMappingURL=process-instance.js.map

package/dist/project-context.d.ts

@@ -0,0 +1,64 @@
+import { type ProjectRegistration } from "@sema-agent/settings-schema";
+import type { ListFilter } from "./owner-faces.js";
+/** 进简报 / 进 `cwd` 的登记字段(闭集)。每一格的写角色不低于 `prompts` 域(`test/project-context-inheritance.test.ts` 按 settings-schema 的 `writeRoleFor` 钉);身份字段永不在表里。 */
+export declare const PROJECT_BRIEF_FIELDS: readonly ["goal", "notes", "contextItems"];
+/** 进简报 / 进 `cwd` 的登记字段。 */
+export type ProjectBriefField = (typeof PROJECT_BRIEF_FIELDS)[number];
+/** 内容证明:配置中心写口在一次按写权表判过内容字段的写之后盖的时刻(写角色同为 publisher)。本服务只读在不在。 */
+export declare const PROJECT_CONTENT_ATTESTATION_FIELD: "contentAttestedAt";
+/** 继承判读得到的登记成员(类型上只够得着表内字段 + 可见性的属主键 + 内容证明)。 */
+export type ProjectContextSource = Pick<ProjectRegistration, ProjectBriefField | "registeredBy" | typeof PROJECT_CONTENT_ATTESTATION_FIELD>;
+/** 一条 run 继承到的项目上下文(冻结记录;随 run 落进续跑重建输入,续跑腿原样重放)。 */
+export interface ProjectContext {
+    /** 判出它的项目(登记簿键,小写)。 */
+    readonly projectId: string;
+    /** 继承的工作目录:第一条 `folder` 条目 —— 只在射程内(`callerOwnsWorkerDisk`)且请求没带 `cwd` 时在场。 */
+    readonly cwd?: string;
+    /** 项目简报(系统提示追加折叠的第二段);`projectMemory: "disabled"` 或无可列内容 ⇒ 缺席。 */
+    readonly brief?: string;
+}
+/** 继承判的输入(全部是新提交腿此刻读得到的事实)。 */
+export interface ProjectContextInput {
+    /** 这条腿的项目(`legProjectIdOf`);缺席 ⇒ 不继承。 */
+    readonly projectId: string | undefined;
+    /** 本部署的登记簿(`capability-facts.ts` `projectRegistry` 的见证);缺席 = 本部署没有登记簿 ⇒ 不继承。 */
+    readonly registry: Readonly<Record<string, ProjectContextSource>> | undefined;
+    /** 提交者在读面上的视域(读面同一只推导);缺席 = 没有请求 ⇒ 不继承。 */
+    readonly viewer: ListFilter | undefined;
+    /** 部署形表行 `callerOwnsWorkerDisk`:路径条目(继承 `cwd`、简报的路径两段)只在它成立时兑现。 */
+    readonly pathsHonored: boolean;
+    /** 请求体带了 `cwd`(非空串)⇒ 显式值赢,不填。 */
+    readonly requestCwd: boolean;
+    /** 请求 `projectMemory: "disabled"` ⇒ 不出简报。 */
+    readonly projectMemoryOff: boolean;
+}
+/** 继承判的答案:继承到的上下文,外加射程外未列的路径条目数(server 侧 warn 只计数,不记路径)。 */
+export interface ProjectContextDecision {
+    readonly context: ProjectContext | undefined;
+    readonly withheldPathItems: number;
+}
+/**
+ * 项目简报的唯一铸点(纯串;各段缺席不出,全缺席 ⇒ 无简报)。只读 {@link PROJECT_BRIEF_FIELDS};路径两段只在 `pathsHonored` 时出,且只列名字 ——
+ * `file` 条目未附上,段名写明「相关时去读」。首行点名来源与项目 id(不带 `displayName`:身份字段不进提示)。
+ */
+export declare function buildProjectBrief(projectId: string, registration: Pick<ProjectRegistration, ProjectBriefField>, pathsHonored: boolean): string | undefined;
+/**
+ * 继承判(唯一;调用点只有装配器头部的新提交腿)。项目缺席 / 本部署无登记簿 / 没有观者 / 未登记 / 看不见 / 无内容证明 ⇒ 不继承(不拒,与随机 id 同答)。
+ */
+export declare function projectContextOf(input: ProjectContextInput): ProjectContextDecision;
+/** 续跑重建输入里冻结的那一份的读数:缺席(没继承 / 7.150.0 之前写下的行)· 读得出 · 形不对。 */
+export type FrozenProjectContextReading = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "ok";
+    readonly context: ProjectContext;
+} | {
+    readonly kind: "malformed";
+};
+/**
+ * 冻结的那一份的**唯一读法**(读者 = `http/resume-ctx-read.ts` 的续跑上下文读口)。服务端写下的形是闭集(本文件 {@link projectContextOf} 铸、`buildCheckpointCtx` 原样落盘):
+ * 自有键只在 `projectId` / `cwd` / `brief` 里;`projectId` = 规范小写 UUID;`cwd` 在场 = 宿主绝对路径;`brief` 在场 = 非空串、不超过系统提示追加折叠的帽;
+ * `cwd` 与 `brief` 至少其一(都缺的不会被冻结)。别的形 ⇒ `malformed`(读口答坏体:续跑不重放它、不登记它的 `cwd`)。
+ */
+export declare function frozenProjectContextOf(stored: unknown): FrozenProjectContextReading;
+//# sourceMappingURL=project-context.d.ts.map

package/dist/project-context.js

@@ -0,0 +1,66 @@
+import { PROJECT_ID_REGEX } from "@sema-agent/core";
+import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
+import { visibleProjectOf } from "./project-registry.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS } from "./task-settings.js";
+export const PROJECT_BRIEF_FIELDS = ["goal", "notes", "contextItems"];
+export const PROJECT_CONTENT_ATTESTATION_FIELD = "contentAttestedAt";
+export function buildProjectBrief(projectId, registration, pathsHonored) {
+    const sections = [];
+    if (registration.goal !== undefined && registration.goal.length > 0)
+        sections.push(`## Goal\n${registration.goal}`);
+    if (registration.notes !== undefined && registration.notes.length > 0)
+        sections.push(`## Notes\n${registration.notes}`);
+    const items = registration.contextItems ?? [];
+    const notes = items.flatMap((item) => (item.kind === "note" && item.value.length > 0 ? [item.value] : []));
+    if (notes.length > 0)
+        sections.push(`## Project notes\n${notes.join("\n\n")}`);
+    if (pathsHonored) {
+        const folders = items.flatMap((item) => (item.kind === "folder" ? [`- ${item.value}`] : []));
+        if (folders.length > 0)
+            sections.push(`## Project folders\n${folders.join("\n")}`);
+        const files = items.flatMap((item) => (item.kind === "file" ? [`- ${item.value}`] : []));
+        if (files.length > 0)
+            sections.push(`## Project files (not attached — read them when relevant)\n${files.join("\n")}`);
+    }
+    if (sections.length === 0)
+        return undefined;
+    return [`# Project context (from this deployment's project registry; project ${projectId})`, ...sections].join("\n\n");
+}
+export function projectContextOf(input) {
+    const { projectId } = input;
+    const registration = visibleProjectOf(input.registry, projectId, input.viewer);
+    if (projectId === undefined || registration === undefined)
+        return { context: undefined, withheldPathItems: 0 };
+    if (registration[PROJECT_CONTENT_ATTESTATION_FIELD] === undefined)
+        return { context: undefined, withheldPathItems: 0 };
+    const items = registration.contextItems ?? [];
+    const withheldPathItems = input.pathsHonored ? 0 : items.filter((item) => item.kind !== "note").length;
+    const firstFolder = input.pathsHonored ? items.find((item) => item.kind === "folder")?.value : undefined;
+    const cwd = input.requestCwd ? undefined : firstFolder;
+    const brief = input.projectMemoryOff ? undefined : buildProjectBrief(projectId, registration, input.pathsHonored);
+    if (cwd === undefined && brief === undefined)
+        return { context: undefined, withheldPathItems };
+    return { context: { projectId, ...(cwd !== undefined ? { cwd } : {}), ...(brief !== undefined ? { brief } : {}) }, withheldPathItems };
+}
+export function frozenProjectContextOf(stored) {
+    if (stored === undefined)
+        return { kind: "absent" };
+    if (typeof stored !== "object" || stored === null || Array.isArray(stored))
+        return { kind: "malformed" };
+    if (!Object.keys(stored).every((k) => k === "projectId" || k === "cwd" || k === "brief"))
+        return { kind: "malformed" };
+    const own = (k) => (Object.hasOwn(stored, k) ? stored[k] : undefined);
+    const projectId = own("projectId");
+    const cwd = own("cwd");
+    const brief = own("brief");
+    if (typeof projectId !== "string" || !PROJECT_ID_REGEX.test(projectId) || projectId !== projectId.toLowerCase())
+        return { kind: "malformed" };
+    if (cwd !== undefined && (typeof cwd !== "string" || !isAbsoluteHostPath(cwd)))
+        return { kind: "malformed" };
+    if (brief !== undefined && (typeof brief !== "string" || brief.length === 0 || brief.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS))
+        return { kind: "malformed" };
+    if (cwd === undefined && brief === undefined)
+        return { kind: "malformed" };
+    return { kind: "ok", context: { projectId, ...(cwd !== undefined ? { cwd } : {}), ...(brief !== undefined ? { brief } : {}) } };
+}
+//# sourceMappingURL=project-context.js.map

package/dist/project-registry.d.ts

@@ -0,0 +1,46 @@
+import type { ProjectRegistration } from "@sema-agent/settings-schema";
+import type { ListFilter } from "./owner-faces.js";
+/** 一张登记簿(键 = 小写规范 UUID;值至少带可见性的属主键)。缺席 = 本部署没有登记簿(`capability-facts.ts` `projectRegistry` 答 no)。 */
+export type ProjectRegistryTable<R> = Readonly<Record<string, R>> | undefined;
+/**
+ * 谓词读的观者事实(列表面视域 {@link ListFilter} 里与登记可见性有关的两格)。`gateOwner` 只拿来与登记的 `registeredBy`(settings-schema 的纯串)逐字节比,
+ * 所以这里收纯串:新提交腿交来的是读面推导出的主体(品牌串,天然是串),续跑腿交来的是冻结时落成字节的那一串(不重铸品牌 —— 它不进任何属主门,只比这一格)。
+ */
+export interface ProjectViewer {
+    readonly fleetWide: ListFilter["fleetWide"];
+    readonly gateOwner: string | null;
+}
+/** 一只登记对这位观者可见吗(唯一判):全舰队视域看全部;否则只看 `registeredBy` 恰是自己的(无身份的观者 `gateOwner = null` 恒看不见)。 */
+export declare function projectVisibleTo(viewer: ProjectViewer, registration: Pick<ProjectRegistration, "registeredBy">): boolean;
+/** 这位观者看得见的那只登记(唯一取法):未登记 / 看不见 / 没有观者 / 本部署没有登记簿 ⇒ 同答 `undefined`。按 id 只认自有键。 */
+export declare function visibleProjectOf<R extends Pick<ProjectRegistration, "registeredBy">>(registry: ProjectRegistryTable<R>, projectId: string | undefined, viewer: ProjectViewer | undefined): R | undefined;
+/** 一条 run 的登记簿默认读层种子:种子项目(这次提交带的、提交者看得见的那只)+ 判出它的那一位观者。随 run 冻结(续跑重建输入 `CheckpointCtx.memorySeed`)。 */
+export interface MemorySeed {
+    readonly projectId: string;
+    readonly viewer: ProjectViewer;
+}
+/**
+ * 新提交腿的种子判(一条 run 一次):这次**提交**没带项目 ⇒ `undefined`(没什么可判);带了而对提交者可见 ⇒ 种子;带了而判不出(未登记 / 看不见 / 没有观者 / 没有登记簿)
+ * ⇒ `null`(判过,无 —— 冻结下来,续跑腿据它与「停驻在种子判出现之前」分开)。
+ */
+export declare function memorySeedOf(registry: ProjectRegistryTable<Pick<ProjectRegistration, "registeredBy">>, submittedProjectId: string | undefined, viewer: ProjectViewer | undefined): MemorySeed | null | undefined;
+/** 种子的词(两腿同调):种子的那一位观者此刻仍看得见的那只登记声明的 `defaultScopes`;没有种子 / 判过无 / 登记已不在 / 不再对他可见 ⇒ 缺席。 */
+export declare function memorySeedScopesOf(registry: ProjectRegistryTable<Pick<ProjectRegistration, "registeredBy" | "defaultScopes">>, seed: MemorySeed | null | undefined): string[] | undefined;
+/** 续跑重建输入里冻结的种子的读数:缺席(提交没带项目 / 本格出现之前写下的行)· 判过无(`null`)· 读得出 · 形不对。 */
+export type FrozenMemorySeedReading = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "none";
+} | {
+    readonly kind: "ok";
+    readonly seed: MemorySeed;
+} | {
+    readonly kind: "malformed";
+};
+/**
+ * 冻结的种子的**唯一读法**(读者 = `http/resume-ctx-read.ts` 的续跑上下文读口,开封之后、任何续跑消费者之前)。服务端写下的形是闭集({@link memorySeedOf} 铸、经部署事实落盘):
+ * `null`(判过,无)或 `{ projectId, viewer: { fleetWide, gateOwner } }` —— `projectId` = 规范小写 UUID;`fleetWide` 布尔;`gateOwner` = 非空串(冻结时落成字节的主体,原样)或 `null`;
+ * 观者至少看得见点什么(`fleetWide` 或 `gateOwner` 在场 —— 看不见的提交不冻结种子)。别的形 ⇒ `malformed`(读口答坏体:续跑不按它挑种子)。
+ */
+export declare function frozenMemorySeedOf(stored: unknown): FrozenMemorySeedReading;
+//# sourceMappingURL=project-registry.d.ts.map

package/dist/project-registry.js

@@ -0,0 +1,44 @@
+import { PROJECT_ID_REGEX } from "@sema-agent/core";
+export function projectVisibleTo(viewer, registration) {
+    return viewer.fleetWide || registration.registeredBy === viewer.gateOwner;
+}
+export function visibleProjectOf(registry, projectId, viewer) {
+    if (registry === undefined || projectId === undefined || viewer === undefined || !Object.hasOwn(registry, projectId))
+        return undefined;
+    const registration = registry[projectId];
+    return registration !== undefined && projectVisibleTo(viewer, registration) ? registration : undefined;
+}
+export function memorySeedOf(registry, submittedProjectId, viewer) {
+    if (submittedProjectId === undefined)
+        return undefined;
+    if (viewer === undefined || visibleProjectOf(registry, submittedProjectId, viewer) === undefined)
+        return null;
+    return { projectId: submittedProjectId, viewer: { fleetWide: viewer.fleetWide, gateOwner: viewer.gateOwner } };
+}
+export function memorySeedScopesOf(registry, seed) {
+    return visibleProjectOf(registry, seed?.projectId, seed?.viewer)?.defaultScopes;
+}
+export function frozenMemorySeedOf(stored) {
+    if (stored === undefined)
+        return { kind: "absent" };
+    if (stored === null)
+        return { kind: "none" };
+    const own = (o, k) => (Object.hasOwn(o, k) ? o[k] : undefined);
+    const closedObject = (v, keys) => typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).every((k) => keys.includes(k));
+    if (!closedObject(stored, ["projectId", "viewer"]))
+        return { kind: "malformed" };
+    const projectId = own(stored, "projectId");
+    const viewer = own(stored, "viewer");
+    if (typeof projectId !== "string" || !PROJECT_ID_REGEX.test(projectId) || projectId !== projectId.toLowerCase())
+        return { kind: "malformed" };
+    if (!closedObject(viewer, ["fleetWide", "gateOwner"]))
+        return { kind: "malformed" };
+    const fleetWide = own(viewer, "fleetWide");
+    const gateOwner = own(viewer, "gateOwner");
+    if (typeof fleetWide !== "boolean" || (gateOwner !== null && (typeof gateOwner !== "string" || gateOwner.length === 0)))
+        return { kind: "malformed" };
+    if (!fleetWide && gateOwner === null)
+        return { kind: "malformed" };
+    return { kind: "ok", seed: { projectId, viewer: { fleetWide, gateOwner } } };
+}
+//# sourceMappingURL=project-registry.js.map

package/dist/question.d.ts

@@ -9,15 +9,15 @@ export interface QuestionFrame {
     /** "question" only: the model's structured questions, secret-redacted. UNTRUSTED-for-display (shell renders; never
      *  re-feeds a model). Absent on an over-cap payload (the ask then reports unavailable — no frame is emitted at all). */
     questions?: AskQuestion[];
-    /** "question_complete" only: whether the human answered (`answered`) or the ask was released unanswered
-     *  (`unanswered` — ttl/abort → core was told nobody was reachable). Cosmetic dialog-dismiss. */
+    /** "question_complete" only: whether the human answered (`answered`) or the ask closed without an answer
+     *  (`unanswered` — window elapsed / abort / leg-exit sweep). Cosmetic dialog-dismiss. */
     outcome?: "answered" | "unanswered";
     /** Server-signed emit timestamp (additive, [ref]§五→[ref]). Server-minted side-frame ⇒ no core-stream
      *  `eventId` to carry (absence is honest); this is the frame's own time coordinate. */
     serverNowMs?: number;
     /** "question" only ([ref]③, additive, the `tool_approval` window-trio precedent from [ref]): the
-     *  coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5min) — at expiry the ask releases
-     *  UNAVAILABLE ("unanswered") and core adjudicates park-vs-continue. Minted from the SAME `ttlMs` the
+     *  coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5min) — at expiry the ask closes ("unanswered"); core hears
+     *  a delivery failure when a live face presented the card, `unavailable` otherwise ({@link seamOutcomeOf}). Minted from the SAME `ttlMs` the
      *  `setTimeout` below actually arms (single source; a shell countdown rendered from these can never
      *  disagree with the release). Relative + absolute + `serverNowMs` above = clock-skew-proof trio. */
     expiresInMs?: number;
@@ -30,9 +30,7 @@ export interface QuestionFrame {
  *  awaiting a human when the run aborts.
  *
  *  The ledger carries the CARD, not the answer door: `POST /v1/questions/:id/respond` stays live-only (this replica's
- *  memory, `ttlMs`), so a replayed card is answerable only until its own `expiresAtMs` and only on this replica.
- *  The adjudication probe ({@link QuestionCoordinator.hasLiveContext}) reads the same transport's `reachable()` — one
- *  reading of "can this leg's face show a card right now?". */
+ *  memory, `ttlMs`), so a replayed card is answerable only until its own `expiresAtMs` and only on this replica. */
 export interface QuestionRunContext {
     taskId: string;
     owner: string | null;
@@ -73,12 +71,11 @@ export declare class QuestionCoordinator {
     private readonly throttle;
     constructor(throttle?: QuestionThrottle);
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → released) and drop the run's counters (no leak). */
     runWithContext<T>(ctx: QuestionRunContext, fn: () => Promise<T>): Promise<T>;
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
-     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
-     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
-     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; what it settles to is what core
+     *  acts on — a {@link QuestionAnswer} ONLY when a human really answered; a THROW when a live face presented the card and its
+     *  window elapsed unanswered; `{kind:"unavailable"}` otherwise ({@link seamOutcomeOf}). Either way the run never hangs. Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
     question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<OnQuestionOutcome>;
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
      *  existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404. Returns the
@@ -89,15 +86,6 @@ export declare class QuestionCoordinator {
     };
     /** Test/observability hook: number of currently-parked questions. */
     pendingCount(): number;
-    /** [ref] ([ref] 案二):durable 部署上的 AskUserQuestion 判决探针——本调用点是否处在某条**投递得到人的**
-     *  活流腿上(runWithContext 包裹的 bg/SSE 腿=true;sync /v1/tasks、verify/cascade、durable resume 驱动=false)。
-     *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
-     *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
-     *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow;park 才是它该走的腿。读的是本腿传输的 `reachable()`
-     *  (有直写面 ⇒ 直写此刻活着;只有账本 ⇒ 恒真,后台腿的 durable events tail 语义;谓词读不出 ⇒ 假,判决面 fail-closed 到 park)。
-     *  只服务判决面:判决放行之后的开帧投递只读传输律(有账本的腿上死直写 = 卡在账本里,送到)。 */
-    hasLiveContext(): boolean;
     private countersFor;
 }
 //# sourceMappingURL=question.d.ts.map

package/dist/question.js

@@ -12,6 +12,20 @@ export const DEFAULT_QUESTION_THROTTLE = {
     ttlMs: 5 * 60_000,
 };
 const UNAVAILABLE = Object.freeze({ kind: "unavailable" });
+const RELEASED = Object.freeze({ kind: "released" });
+const WINDOW_ELAPSED = Object.freeze({ kind: "window_elapsed" });
+function seamOutcomeOf(settlement, presentedLive, ttlMs) {
+    switch (settlement.kind) {
+        case "answered":
+            return settlement.answer;
+        case "released":
+            return UNAVAILABLE;
+        case "window_elapsed":
+            if (!presentedLive)
+                return UNAVAILABLE;
+            throw new Error(`the question was shown on this run's live stream and nobody answered it within its ${ttlMs / 1000}s answer window`);
+    }
+}
 export function parseQuestionResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
@@ -61,7 +75,7 @@ export class QuestionCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle(UNAVAILABLE, "unanswered");
+                        p.settle(RELEASED);
                 }
                 this.counters.delete(ctx.taskId);
             }
@@ -83,9 +97,9 @@ export class QuestionCoordinator {
         rc.inflight += 1;
         let done = false;
         let timer;
-        let resolveAnswer;
-        const answerP = new Promise((resolve) => { resolveAnswer = resolve; });
-        const settle = (a, outcome) => {
+        let resolveSettled;
+        const settledP = new Promise((resolve) => { resolveSettled = resolve; });
+        const settle = (s) => {
             if (done)
                 return;
             done = true;
@@ -95,12 +109,10 @@ export class QuestionCoordinator {
             ctx.abortSignal?.removeEventListener("abort", onAbort);
             this.pending.delete(id);
             rc.inflight = Math.max(0, rc.inflight - 1);
-            lastOutcome = outcome;
-            resolveAnswer(a);
+            resolveSettled(s);
         };
-        let lastOutcome = "unanswered";
-        const onAbort = () => settle(UNAVAILABLE, "unanswered");
-        timer = setTimeout(() => settle(UNAVAILABLE, "unanswered"), this.throttle.ttlMs);
+        const onAbort = () => settle(RELEASED);
+        timer = setTimeout(() => settle(WINDOW_ELAPSED), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -108,7 +120,7 @@ export class QuestionCoordinator {
         const now = Date.now();
         const race = createHitlOpenRace({
             targets: [{ transport: ctx.transport, frame: { type: "question", questionId: id, questions, serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs } }],
-            settled: answerP,
+            settled: settledP,
         });
         const phase = await race.phase;
         if (phase === "delivered") {
@@ -116,7 +128,7 @@ export class QuestionCoordinator {
         }
         else if (phase === "undelivered") {
             recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
-            settle(UNAVAILABLE, "unanswered");
+            settle(RELEASED);
         }
         else {
             void race.landing.then((late) => {
@@ -126,9 +138,10 @@ export class QuestionCoordinator {
                     recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
             });
         }
-        const answer = await answerP;
-        race.close({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() });
-        return answer;
+        const settlement = await settledP;
+        race.close({ type: "question_complete", questionId: id, outcome: settlement.kind === "answered" ? "answered" : "unanswered", serverNowMs: Date.now() });
+        const presentedLive = settlement.kind === "window_elapsed" && phase === "delivered" && (await race.acceptedLive(0));
+        return seamOutcomeOf(settlement, presentedLive, this.throttle.ttlMs);
     };
     respond(id, principal, body) {
         const parsed = parseQuestionResponse(body);
@@ -138,16 +151,12 @@ export class QuestionCoordinator {
         if (!entry || !keyAdmits("ask.answer", { subject: recoveredSubject(principal), operator: false }, ownerCellOf(entry.owner))) {
             return { status: 404, body: refusalBody({ errorCode: "question.not_pending", message: "no pending question for this id (answered, expired, or not on this replica)" }) };
         }
-        entry.settle(parsed.value, "answered");
+        entry.settle({ kind: "answered", answer: parsed.value });
         return { status: 200, body: { questionId: id, delivery: "applied" } };
     }
     pendingCount() {
         return this.pending.size;
     }
-    hasLiveContext() {
-        const ctx = this.als.getStore();
-        return ctx !== undefined && ctx.transport.reachable();
-    }
     countersFor(taskId) {
         let rc = this.counters.get(taskId);
         if (!rc) {

package/dist/request-key-closure.js

@@ -29,7 +29,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
-    "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
+    "sessionId", "sessionKind", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
     "userAttachments", "userInvokedSkills", "verify", "verifyRounds",
 ];
 const TASK_BODY_SCENARIO_KEYS = ["repo"];

package/dist/request-value-closure.d.ts

@@ -148,5 +148,9 @@ export interface InheritEnvFieldIssue {
  * 句子对两种坏值形是同一句(点名两词与「名单不是请求值」);`reason` 区分它们。
  */
 export declare function inheritEnvFieldIssue(raw: unknown): InheritEnvFieldIssue | null;
+/** 词表外的拒句(wire 可见、字节冻结在 `test/api-error-text-freeze.test.ts` 的常量锚格)。 */
+export declare const SESSION_KIND_VALUE_MESSAGE: string;
+/** `sessionKind` 在场且不在闭集里 ⇒ 拒句;缺席或合法 ⇒ `null`(只在 fresh 受理门调)。 */
+export declare function sessionKindFieldIssue(raw: unknown): string | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -1,3 +1,4 @@
+import { SESSION_KINDS, isSessionKind } from "./session-kind.js";
 export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)";
 export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
@@ -49,4 +50,13 @@ export function inheritEnvFieldIssue(raw) {
         return null;
     return { message: INHERIT_ENV_VALUE_MESSAGE, facts: inheritEnvFacts(typeof value === "string" ? "unknown_word" : "not_a_string") };
 }
+export const SESSION_KIND_VALUE_MESSAGE = `sessionKind must be one of ${SESSION_KINDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
+    `("sidechain" = the session this submission creates is a client-placed sub-conversation: it is not listed by GET /v1/sessions unless asked for with ?sessionKind=sidechain, ` +
+    `and it is deleted after BG_AGENT_RETENTION_MS of inactivity; absent = a top-level conversation) — the kind is written once, when the session is created`;
+export function sessionKindFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw.sessionKind;
+    return value === undefined || isSessionKind(value) ? null : SESSION_KIND_VALUE_MESSAGE;
+}
 //# sourceMappingURL=request-value-closure.js.map

package/dist/run-acceptance.d.ts

@@ -76,12 +76,13 @@ export interface RunAcceptance {
     observe(ev: {
         type: string;
     }): Promise<void>;
-    /** 终局落行之后:还没在流上见过受理帧、而结果里跑过 turn(只回结果的腿)⇒ 受理。只读 `stats.turns`。不抛、不等。 */
+    /** 结果到手、**放掉这条 run 的认领之前**(收场写 / 停驻提交之前):还没在流上见过受理帧、而结果里跑过 turn(只回结果的腿)⇒ 受理。只读 `stats.turns`。不抛;
+     *  交回的那一拍等标题器钉住要起名的住客(有界一读;认领在手 ⇒ 会话删不掉 ⇒ 住客就是这条 run 的)与补写落定 —— 腿 await 它再放认领。 */
     settle(result: {
         readonly stats: {
             readonly turns: number;
         };
-    }): void;
+    }): Promise<void>;
     /** 提交那一刻就知道的交付文本(腿上没有屏 ⇒ 请求原文);腿上有屏 ⇒ 缺席:各面提交时不写,交付时经 {@link onDelivered} 补。 */
     readonly objectiveAtSubmit: string | undefined;
     /**

package/dist/run-acceptance.js

@@ -35,11 +35,10 @@ export function createRunAcceptance(deps, input) {
         delivered = objective;
         if (objective === undefined)
             return Promise.resolve();
-        if (input.sessionId)
-            deps.sessionTitler?.maybeTitle(input.sessionId, objective, input.model, deliver);
+        const titled = input.sessionId ? (deps.sessionTitler?.maybeTitle(input.sessionId, objective, input.model, deliver) ?? Promise.resolve()) : Promise.resolve();
         if (!input.screened)
-            return Promise.resolve();
-        return Promise.all(fills.map(({ face, fill }) => runFill(face, fill, objective))).then(() => undefined);
+            return titled;
+        return Promise.all([titled, ...fills.map(({ face, fill }) => runFill(face, fill, objective))]).then(() => undefined);
     };
     return {
         objectiveAtSubmit: input.screened ? undefined : input.objective,
@@ -51,8 +50,7 @@ export function createRunAcceptance(deps, input) {
             return Promise.resolve();
         },
         settle(result) {
-            if (result.stats.turns > 0)
-                void accept(input.screened ? undefined : input.objective);
+            return result.stats.turns > 0 ? accept(input.screened ? undefined : input.objective) : Promise.resolve();
         },
         onDelivered(face, fill) {
             if (!input.screened)

package/dist/run-cancel-card.d.ts

@@ -15,7 +15,7 @@ import type { CheckpointToken } from "@sema-agent/core";
 import type { CheckpointStoreFull, RunStore } from "./plugins/store-backend.js";
 /** 取消动词在 `runSessionId` 这条 run 的会话上会结算的那一张卡;没有 ⇒ `null`。 */
 export declare function runCancelCardOf(cs: Pick<CheckpointStoreFull, "findPendingTokenBySession">, runSessionId: string): Promise<CheckpointToken | null>;
-/** 取消动词要问的 run 行的两口:这条会话上持着认领的 run、它的行。 */
+/** 取消动词要问的 run 行的两口:这条会话上持着认领的 run、它的状态(不带属主的一格事实,只经属主存取器读)。 */
 export type CancelRunReader = Pick<RunStore, "getActiveTaskId" | "getRun">;
 /**
  * 取消动词会不会结算 `token` 这一张 —— 出路投影问的就是这一问,三个条件都是取消口自己的:

package/dist/run-cancel-card.js

@@ -1,5 +1,6 @@
 import { LIVE_RUN_GATE_KINDS } from "./plugins/checkpoint-store-face.js";
 import { isParkedRunStatus } from "./plugins/store-contracts.js";
+import { runFactsOf } from "./http/owner-access.js";
 const RUN_CANCEL_CARD = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
 export function runCancelCardOf(cs, runSessionId) {
     return cs.findPendingTokenBySession(runSessionId, undefined, RUN_CANCEL_CARD);
@@ -13,7 +14,7 @@ export async function cancelSettlesCard(cs, runs, token) {
     const holder = await runs.getActiveTaskId(host);
     if (holder === undefined)
         return false;
-    const run = await runs.getRun(holder);
+    const run = await runFactsOf(runs, holder);
     return run !== undefined && isParkedRunStatus(run.status) && (await runCancelCardOf(cs, host)) === token;
 }
 //# sourceMappingURL=run-cancel-card.js.map

package/dist/run-local.js

@@ -637,6 +637,7 @@ export async function runLocal(argv, deps = {}) {
         sharedMemoryStores: undefined,
         mcpRevocations: undefined,
         peerDesk,
+        runtimeCapsResolver: undefined,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,