@sema-agent/server 7.149.0 → 7.151.0

package/dist/boot/resolve-spec.js

@@ -15,6 +15,10 @@ import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScr
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { createSettingsHooksRegistrations, settingsHooksBudgetMs } from "../hooks/hook-runner.js";
 import { headerStr } from "../http/principal-gate.js";
+import { routeListFilter } from "../http/owner-access.js";
+import { projectRegistry } from "../capability-facts.js";
+import { projectContextOf } from "../project-context.js";
+import { memorySeedOf, memorySeedScopesOf } from "../project-registry.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, pickUserModel, refusedCatalogEntry, terminalCatalogName } from "../model-select.js";
 import { echoModelRef, modelNotAllowedMessage, modelUnavailableMessage, refusedNameLogField } from "../model-entry-refusal.js";
@@ -48,7 +52,7 @@ import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
 import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m38.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, readSettingsEnv, taskHooksHonored, settingsEnvCredentialIssue, settingsPermissionBucketIssue, withoutKeys } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, acceptOutputStyle, appendFold, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, readSettingsEnv, taskHooksHonored, settingsEnvCredentialIssue, settingsPermissionBucketIssue, withoutKeys } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { buildNeverAutoRetiredNotice } from "../retired-name-host-notice.js";
 import { entryProblemsFacts } from "../entry-problems.js";
@@ -60,6 +64,7 @@ import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-
 import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { bindingsOf } from "../session-bindings.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 function identityAxesOf(auth) {
     const subject = auth?.subject === undefined ? undefined : recoveredSubject(auth.subject);
@@ -71,7 +76,7 @@ function unrooted(spec) {
     return resolved;
 }
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, fenceSessionOwner, hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, historyAnchors, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, questionSeat, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
     const deploymentSkillSources = new Map(loadedSkills.map((k) => [k.spec.name, k.source]));
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
     const sessionHeadOf = headReadOf(ownerAware);
@@ -82,10 +87,10 @@ export function createResolveSpec(ctx) {
         approvalSeat: durableEnabled ? "durable" : "absent",
         singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
-    const realTaskRootOf = (root) => {
+    const realTaskRootOf = (legSessionCwd) => {
         if (DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config))
             return undefined;
-        const sessionCwd = effectiveHostWorkspace(perSessionCwd.get(root), {});
+        const sessionCwd = effectiveHostWorkspace(legSessionCwd, {});
         return sessionCwd ?? (laneWiresExecutionEnv(config.remoteExec.provider) ? undefined : process.cwd());
     };
     const memoryProjectLayers = createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySyncRunner, log: logger });
@@ -109,9 +114,45 @@ export function createResolveSpec(ctx) {
         }
         if (opts?.leg === "fresh")
             assertRequestMcpEntries(body.mcpServers);
+        const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
+        const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, root);
+        const registryFact = projectRegistry({ config });
+        const registry = registryFact.available ? registryFact.registry : undefined;
+        const projectViewer = opts?.leg === "fresh" && req !== undefined ? routeListFilter(req, { config }, "project-get") : undefined;
+        const memorySeed = opts?.leg === "fresh" ? memorySeedOf(registry, submittedProjectId, projectViewer) : opts?.memorySeed;
+        if (opts?.leg !== "fresh" && memorySeed === undefined && submittedProjectId !== undefined)
+            logger.warn("resume_memory_seed_unjudged", { sessionId: root, projectId: submittedProjectId, note: "this continuation's stored rebuild input carries no memory-seed judgment (it was parked before this server version judged one), so the project registry's default read layers are not applied to it; submit the work again as a new task to have them" });
+        let projectContext;
+        if (opts?.leg === "fresh") {
+            const decision = projectContextOf({
+                projectId: legProjectId,
+                registry,
+                viewer: projectViewer,
+                pathsHonored: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config),
+                requestCwd: typeof body.cwd === "string" && body.cwd.length > 0,
+                projectMemoryOff: body.projectMemory === "disabled",
+            });
+            projectContext = decision.context;
+            if (decision.withheldPathItems > 0)
+                logger.warn("task_project_paths_ignored", { lane: config.remoteExec.provider, pathItems: decision.withheldPathItems, sessionId: root });
+            if (projectContext?.brief !== undefined) {
+                const append = acceptAppendSystemPrompt(body.appendSystemPrompt);
+                const style = acceptOutputStyle(body.settings?.outputStyle);
+                const fold = appendFold([append, projectContext.brief, style]);
+                if (fold.chars > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
+                    const members = append !== undefined ? ["appendSystemPrompt", "projectId"] : ["projectId"];
+                    if (style !== undefined)
+                        members.push("settings.outputStyle");
+                    throw new HttpError(400, `the project brief this run inherits from project ${projectContext.projectId} (its goal, notes and context items) folds into one system-prompt block with appendSystemPrompt and settings.outputStyle — combined they must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters (including the 2-char joiners), and they are ${fold.chars}. Shorten what you send, send projectMemory: "disabled" to run without the project's context, or have the project's goal / notes shortened in the registry.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("system_prompt_fold", members, { count: fold.chars, cap: MAX_SETTINGS_OUTPUT_STYLE_CHARS }) } });
+                }
+            }
+        }
+        else
+            projectContext = opts?.projectContext;
+        const legCwd = projectContext?.cwd ?? body.cwd;
         if (opts?.leg === "fresh") {
             const conflict = scratchpadCoveringTaskRoot({
-                cwd: body.cwd,
+                cwd: legCwd,
                 shellScratchpadDir: body.scratchpadDir,
                 localDataRoot: config.localDataRoot ?? localRoot,
                 sessionId: root,
@@ -119,7 +160,11 @@ export function createResolveSpec(ctx) {
                 callerOwnsWorkerDisk: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config),
             });
             if (conflict) {
-                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", body.scratchpadDir === conflict.scratchpadDir.asSpelled ? ["cwd", "scratchpadDir"] : ["cwd"]), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
+                const cwdCoordinate = projectContext?.cwd !== undefined ? "projectId" : "cwd";
+                const fields = body.scratchpadDir === conflict.scratchpadDir.asSpelled ? [cwdCoordinate, "scratchpadDir"] : [cwdCoordinate];
+                throw new HttpError(400, cwdCoordinate === "projectId"
+                    ? `the working directory "${conflict.cwd.asSpelled}" this run inherits from project ${projectContext?.projectId} (its first folder) is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Send a cwd outside the scratchpad with this request, or have the project's first folder moved out of it in the registry.`
+                    : `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { ...fieldConflictFacts("scratchpad_root", fields), cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
             }
         }
         const offFieldIssue = singleMemberOffFieldIssue(body);
@@ -191,12 +236,12 @@ export function createResolveSpec(ctx) {
         const gated = await gateScenarioAndAppend(body, auth, root, opts, settingsEnv);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         assertWriteFaceAdmitted(effMode, config);
-        const lane = bindSettingsCwdEnvAndModel(body, auth, root, gated, opts);
-        const anchors = await resolveHistoryAnchors(body, req, auth, root);
-        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(root)) : undefined;
+        const lane = judgeSettingsCwdEnvAndModel(body, auth, root, gated, opts, legCwd);
+        const anchors = await resolveHistoryAnchors(body, req, auth, root, memorySeedScopesOf(registry, memorySeed), legProjectId);
+        const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(lane.sessionCwd)) : undefined;
         const runSkills = buildRunSkills({ scenario: gated.cap.skills, request: body.skills, disable: body.disableSkills === true, deploymentSources: deploymentSkillSources }, logger);
-        const spec = assembleSpecLiteral(body, auth, root, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills }, effMode);
-        const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated);
+        const spec = assembleSpecLiteral(body, auth, root, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes, runSkills, projectBrief: projectContext?.brief }, effMode);
+        const folded = await foldGovernanceAndSettings(body, auth, root, spec, gated, projectContext?.brief, lane.sessionCwd);
         const retiredNotice = opts.onNotice !== undefined ? buildNeverAutoRetiredNotice(gated.parsedSettings.settings?.tightenOnly?.neverAuto, root) : undefined;
         if (retiredNotice !== undefined)
             opts.onNotice?.(retiredNotice);
@@ -205,8 +250,7 @@ export function createResolveSpec(ctx) {
             scratchpadDir: folded.scratchpadDir,
             hostSemanticsLane: folded.hostSemanticsLane,
         });
-        const registeredCwd = perSessionCwd.get(root);
-        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, ...(registeredCwd !== undefined ? { registeredCwd } : {}) } };
+        return { spec: final, facts: { hands: gated.hands, skills: runSkills.roster, sessionWitness: gated.sessionWitness, sessionBindings: lane.sessionBindings, ...(projectContext !== undefined ? { projectContext } : {}), ...(memorySeed !== undefined ? { memorySeed } : {}) } };
     };
     const gateScenarioAndAppend = async (body, auth, root, opts, settingsEnv) => {
         const { parts: subjectParts, person } = identityAxesOf(auth);
@@ -264,22 +308,24 @@ export function createResolveSpec(ctx) {
         }
         return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice, sessionWitness };
     };
-    const bindSettingsCwdEnvAndModel = (body, auth, root, gated, opts) => {
+    const judgeSettingsCwdEnvAndModel = (body, auth, root, gated, opts, cwd) => {
         const { objective, parsedSettings } = gated;
         const cwdWriteGate = DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(config);
         const execLane = config.remoteExec.provider;
         fenceSessionOwner(root, auth?.subject ?? null, opts.execution.occupant?.incarnation);
-        if (typeof body.cwd === "string" && body.cwd.length > 0) {
-            if (cwdWriteGate && isAbsoluteHostPath(body.cwd))
-                setSessionCwd(root, body.cwd);
-            else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) && isAbsoluteHostPath(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
+        let boundCwd;
+        if (typeof cwd === "string" && cwd.length > 0) {
+            if (cwdWriteGate && isAbsoluteHostPath(cwd))
+                boundCwd = cwd;
+            else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config) && isAbsoluteHostPath(cwd) && satisfiedByProcessCwd(cwd, realpathSync))
                 logger.debug("task_cwd_inherited", { lane: execLane, sessionId: root });
             else
                 logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: root });
         }
+        let boundShellEnv;
         if (parsedSettings.settings?.shellEnv) {
             if (cwdWriteGate)
-                setSessionShellEnv(root, parsedSettings.settings.shellEnv);
+                boundShellEnv = parsedSettings.settings.shellEnv;
             else if (DEPLOYMENT_SHAPE_PREDICATES.noHandsSingleUser.holds(config)) {
                 const requested = parsedSettings.settings.shellEnv;
                 const mismatched = shellEnvMismatchCount(requested, process.env);
@@ -291,6 +337,8 @@ export function createResolveSpec(ctx) {
             else
                 logger.warn("task_shell_env_ignored", { honored: false, lane: execLane, sessionId: root });
         }
+        const sessionCwd = boundCwd ?? perSessionCwd.get(root);
+        const sessionBindings = bindingsOf(sessionCwd, boundShellEnv, body.inheritEnv);
         const taskHooks = (() => {
             const hc = parsedSettings.settings?.hooks;
             if (!hc)
@@ -302,7 +350,7 @@ export function createResolveSpec(ctx) {
             return createSettingsHooksRegistrations(hc, {
                 logger,
                 sessionId: root,
-                cwd: perSessionCwd.get(root) ?? process.cwd(),
+                cwd: sessionCwd ?? process.cwd(),
                 hookEnvAllow: config.hookEnvAllow,
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
                 httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
@@ -352,9 +400,9 @@ export function createResolveSpec(ctx) {
             metrics.inc("task_model_unknown_fallback_total");
             logger.warn("task_model_unknown_fallback", { requested: echoModelRef(picked.unknownExplicit), fallback: picked.model, sessionId: root });
         }
-        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
+        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, sessionBindings, sessionCwd };
     };
-    const resolveHistoryAnchors = async (body, req, auth, root) => {
+    const resolveHistoryAnchors = async (body, req, auth, root, s4DefaultScopes, legProjectId) => {
         const anchorReader = req === undefined ? undefined : anchorReaderOf(req, { config, logger }, claimCallerOf(identityAxesOf(auth).subject, config));
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
@@ -368,9 +416,6 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
             rewindFilesToEntryId = await resolveHistoryAnchor("rewindFilesTo", anchorsResolvable, anchorReader, root, body.rewindFilesTo, auth?.subject ?? null, "rewindFilesTo");
         }
-        const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
-        const s4DefaultScopes = submittedProjectId ? config.projects[submittedProjectId]?.defaultScopes : undefined;
-        const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, root);
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId };
     };
     const declaresInteractivePosture = (body, req, opts) => {
@@ -378,7 +423,7 @@ export function createResolveSpec(ctx) {
             return false;
         if (body.verify === true || body.cascade === true)
             return false;
-        if (liveQuestionFace === undefined)
+        if (!questionSeat)
             return false;
         if (body.interactiveTools === false)
             return false;
@@ -389,15 +434,15 @@ export function createResolveSpec(ctx) {
     };
     const assembleSpecLiteral = (body, auth, root, req, opts, parts, effMode) => {
         const { parts: subjectParts, person } = identityAxesOf(auth);
-        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId, projectKey, a2aPeers, storedToolAxes, runSkills, } = parts;
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId, projectKey, a2aPeers, storedToolAxes, runSkills, projectBrief, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
             ...buildPromptSeats(scenarioName, cap.prompt, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined),
-            appendSystemPrompt: acceptedAppend,
+            appendSystemPrompt: appendFold([acceptedAppend, projectBrief]).text,
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
             ...(legProjectId !== undefined ? { projectId: legProjectId } : {}),
-            principal: taskSpecIdentityOf(subjectParts).principal,
+            ...taskSpecIdentityOf(subjectParts),
             images: body.images,
             ...(body.userAttachments !== undefined ? { userAttachments: body.userAttachments } : {}),
             ...(body.clientContext ? { clientContext: { timeZone: body.clientContext.timeZone, userEmail: body.clientContext.userEmail } } : {}),
@@ -522,7 +567,6 @@ export function createResolveSpec(ctx) {
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
-                    question: liveQuestionFace,
                     ...(approvalExemptionStore !== undefined ? { exemption: createSessionExemptionRead(approvalExemptionStore, root, logger, "deployment_list") } : {}),
                 })
                 : singleUserAutoAcceptBaselineApplies(config)
@@ -543,13 +587,13 @@ export function createResolveSpec(ctx) {
                         totalBudgetUsd: config.resourceSuspendTotalBudgetUsd,
                         maxSlices: config.resourceSuspendMaxSlices,
                     })),
-                    ...(liveQuestionFace === undefined ? { onQuestion: QUESTION_AWAITS_RESUME } : {}),
+                    ...(questionSeat ? {} : { onQuestion: QUESTION_AWAITS_RESUME }),
                 }
                 : {}),
         };
         return spec;
     };
-    const foldGovernanceAndSettings = async (body, auth, root, spec, gated) => {
+    const foldGovernanceAndSettings = async (body, auth, root, spec, gated, projectBrief, legSessionCwd) => {
         const { acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !DEPLOYMENT_SHAPE_PREDICATES.sandboxPathAdjudication.holds(config);
         const laneHomeBase = () => {
@@ -558,7 +602,7 @@ export function createResolveSpec(ctx) {
         };
         const pathAdjudication = hostSemanticsLane
             ? (() => {
-                const realRoot = realTaskRootOf(root);
+                const realRoot = realTaskRootOf(legSessionCwd);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
                 return {
                     env: new NodeExecutionEnv({ cwd: gateCwd }),
@@ -578,8 +622,9 @@ export function createResolveSpec(ctx) {
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication));
         let governed = governedBase;
         let effectiveSettings = parsedSettings.settings;
-        if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-            logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: root });
+        const foldedChars = effectiveSettings?.outputStyle ? appendFold([acceptedAppend, projectBrief, effectiveSettings.outputStyle]).chars : 0;
+        if (effectiveSettings?.outputStyle && foldedChars > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
+            logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend?.length ?? 0} + project brief ${projectBrief?.length ?? 0} + style ${effectiveSettings.outputStyle.length}, ${foldedChars} with joiners) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: root });
             const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
             effectiveSettings = Object.keys(rest2).length > 0 ? rest2 : undefined;
         }

package/dist/boot/retention-lane.d.ts

@@ -1,5 +1,5 @@
 /**
- * [ref] 车2 —— 托管留存的 **sweep lane**(设计稿 `docs/DESIGN-270-retention-lane.md` v1.3 §3/§4/§7)。
+ * [ref] 车2 —— 托管留存的 **sweep lane**(设计稿 `docs/[ref]-retention-lane.md` v1.3 §3/§4/§7)。
  *
  * ── 为什么是独立文件、独立定时器,而不是折进 `startReapers()`(设计稿 §3 首条)───────────────────
  * `boot/reapers.ts` 里那二十条腿全都是**容忍多副本**的幂等清理:每台副本各扫各的,重复扫一遍只是浪费。

package/dist/boot/runner-deps.d.ts

@@ -206,6 +206,13 @@ export interface RunnerDepsCtx {
     sharedMemoryStores: RunnerDeps["sharedMemoryStores"];
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
+    /**
+     * [ref] §K —— per-principal 运行期准入的**收紧面**(`boot/runtime-caps.ts` 一处合成;缺席 = 这条部署腿没有 per-principal 收紧,
+     * 部署级缺省照管)。进{@link createSharedRunnerDeps 共享基座}:引擎按腿以 `spec.principal` 解它(每条腿各解一次),委派子代的主体由引擎的
+     * 父 spec 座继承 —— 子腿是同一个主体,跑它的那只 Runner 不挂 = 中心对这个主体的拒位(bypass / fork / 自编排 / auto / 强制门 / 观察者 /
+     * 记忆 opt-out)与中心硬故障时的 fail-closed 降级项一位都到不了子腿(安全轴 fail-open)。它不是会话设施(不同于 selfOrchestration /
+     * scheduler / memory 那几席),所以没有「子腿刻意不给」的理由。
+     */
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
     /** [ref] per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
      *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN.
@@ -248,7 +255,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "fileHistoryCapture" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat" | "runtimeCapsResolver">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -275,7 +282,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "fileHistoryStore" | "sessionPolicyStore" | "commitCoAuthor" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk" | "runtimeCapsResolver">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;

package/dist/boot/runner-deps.js

@@ -133,7 +133,7 @@ export function createSharedRunnerDeps(ctx) {
         toolResultStore: ctx.toolResultStore,
         checkpointStore: ctx.checkpointStore ? ctx.checkpointStore : undefined,
         fileHistoryStore: ctx.fileHistoryStore ? ctx.fileHistoryStore : undefined,
-        fileHistoryCapture: coreFileHistoryCaptureSeat(ctx.fileHistoryStore, ctx.config.fileHistoryCapture),
+        fileHistoryCapture: coreFileHistoryCaptureSeat(ctx.fileHistoryStore !== undefined, ctx.config.fileHistoryCapture),
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
         memoryScopeAdmission: ctx.orgMemoryAdmission.memoryScopeAdmission ? ctx.orgMemoryAdmission.memoryScopeAdmission : undefined,
         deploymentMemoryScopes: ctx.orgMemoryAdmission.deploymentMemoryScopes && ctx.orgMemoryAdmission.deploymentMemoryScopes.length > 0 ? ctx.orgMemoryAdmission.deploymentMemoryScopes : undefined,
@@ -146,6 +146,7 @@ export function createSharedRunnerDeps(ctx) {
         retentionPolicy: ctx.governanceSeams.retentionPolicy,
         mcpRevocations: ctx.mcpRevocations ? ctx.mcpRevocations : undefined,
         peerSeat: ctx.peerDesk.seat,
+        runtimeCapsResolver: ctx.runtimeCapsResolver ? ctx.runtimeCapsResolver : undefined,
     };
     return shared;
 }
@@ -153,7 +154,7 @@ export function localOwnerRulesDeclared(config, permissionRuleStore) {
     return permissionRuleStore !== undefined && !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config);
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
     const peerSessionLister = sessionStore.listSessionRows?.bind(sessionStore);
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
@@ -237,7 +238,6 @@ export function createRunnerDeps(ctx) {
                     memorySyncRunner.trigger("harvest");
             }
             : undefined,
-        runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         localOwnerRules: localOwnerRulesDeclared(config, permissionRuleStore),
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),

package/dist/boot/session-age-out.d.ts

@@ -0,0 +1,36 @@
+import type { SessionAgeOutExpectation, SessionPurgeOutcome } from "../session-deletion.js";
+import type { OwnerAwareSessionStore } from "../security.js";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+/** 每拍至多碰这么多只(一拍的删除量有上界:维护拍上其余各腿不被本腿拖住)。 */
+export declare const SESSION_AGE_OUT_CAP = 64;
+/** 每拍的时间预算(同上一句的理由)。 */
+export declare const SESSION_AGE_OUT_BUDGET_MS = 5000;
+/** 跳过的理由(闭集;计数的标签):条件在锁里不再成立 / 围栏判到认领 / 子代预检拒 / 另一次删除持有它 / 抛。 */
+export type SessionAgeOutSkip = "changed" | "active" | "children_alive" | "in_progress" | "failed";
+/** 一拍的读数(调用方记日志;钉读它)。 */
+export interface SessionAgeOutReading {
+    readonly deleted: number;
+    readonly skipped: Readonly<Record<SessionAgeOutSkip, number>>;
+    /** 本拍因帽或预算停下而候选还没看完。 */
+    readonly truncated: boolean;
+}
+export interface SessionAgeOutDeps {
+    readonly store: Required<Pick<OwnerAwareSessionStore, "listIdleOfKind">>;
+    readonly purge: (sessionId: string, owner: string | null, opts: {
+        readonly ageOut: SessionAgeOutExpectation;
+    }) => Promise<SessionPurgeOutcome>;
+    /** 视界(`BG_AGENT_RETENTION_MS`;每拍现读 —— 热改下一拍生效)。 */
+    readonly retentionMs: () => number;
+    readonly logger: Pick<Logger, "info" | "warn">;
+    readonly metrics: Pick<Metrics, "inc">;
+    readonly now?: () => number;
+    readonly cap?: number;
+    readonly budgetMs?: number;
+}
+/**
+ * 铸老化腿(一只闭包,带进程内的跨拍轮转起点与在飞守卫):每次调用跑一拍,交回读数;在飞时再调 ⇒ 立刻交回空读数(不叠拍)。
+ * 候选读抛 ⇒ 本拍停在那里(读数照交,下拍从同一起点再来);单行删除抛 ⇒ 计 `failed`、节流 warn,本拍继续下一行。
+ */
+export declare function createSessionAgeOut(deps: SessionAgeOutDeps): () => Promise<SessionAgeOutReading>;
+//# sourceMappingURL=session-age-out.d.ts.map

package/dist/boot/session-age-out.js

@@ -0,0 +1,101 @@
+import { SESSION_KINDS, idleSessionAfter } from "../session-kind.js";
+import { seatText } from "../trace/exit-seat.js";
+export const SESSION_AGE_OUT_CAP = 64;
+export const SESSION_AGE_OUT_BUDGET_MS = 5_000;
+function outcomeOf(outcome) {
+    if ("deleted" in outcome)
+        return outcome.deleted ? "deleted" : "changed";
+    if ("active" in outcome)
+        return "active";
+    if ("childrenAlive" in outcome)
+        return "children_alive";
+    if ("inProgress" in outcome)
+        return "in_progress";
+    const unknownOutcome = outcome;
+    throw new Error(`session age-out: no arm for purge outcome ${JSON.stringify(unknownOutcome)}`);
+}
+export function createSessionAgeOut(deps) {
+    const cap = deps.cap ?? SESSION_AGE_OUT_CAP;
+    const budgetMs = deps.budgetMs ?? SESSION_AGE_OUT_BUDGET_MS;
+    const now = deps.now ?? Date.now;
+    const resumeAfter = new Map();
+    let inFlight = false;
+    const empty = () => ({ changed: 0, active: 0, children_alive: 0, in_progress: 0, failed: 0 });
+    return async () => {
+        if (inFlight)
+            return { deleted: 0, skipped: empty(), truncated: false };
+        inFlight = true;
+        const started = now();
+        const skipped = empty();
+        let deleted = 0;
+        let touched = 0;
+        let truncated = false;
+        try {
+            for (const kind of SESSION_KINDS) {
+                const idleBefore = new Date(now() - deps.retentionMs());
+                const origin = resumeAfter.get(kind);
+                let after = origin;
+                let wrapped = origin === undefined;
+                let circled = false;
+                for (;;) {
+                    if (touched >= cap || (touched > 0 && now() - started >= budgetMs)) {
+                        truncated = true;
+                        break;
+                    }
+                    const page = await deps.store.listIdleOfKind(kind, idleBefore, { ...(after !== undefined ? { after } : {}), limit: cap - touched });
+                    if (page.length === 0) {
+                        if (wrapped) {
+                            resumeAfter.delete(kind);
+                            break;
+                        }
+                        wrapped = true;
+                        after = undefined;
+                        continue;
+                    }
+                    for (const row of page) {
+                        if (wrapped && origin !== undefined && !idleSessionAfter(origin, row)) {
+                            circled = true;
+                            break;
+                        }
+                        if (touched >= cap || (touched > 0 && now() - started >= budgetMs)) {
+                            truncated = true;
+                            break;
+                        }
+                        touched++;
+                        after = { lastActivityAt: row.lastActivityAt, sessionId: row.sessionId };
+                        resumeAfter.set(kind, after);
+                        let verdict;
+                        try {
+                            verdict = outcomeOf(await deps.purge(row.sessionId, row.owner, { ageOut: { incarnation: row.incarnation, kind, idleBefore } }));
+                        }
+                        catch (err) {
+                            verdict = "failed";
+                            deps.logger.warn("session_age_out_failed", { sessionId: row.sessionId, err: seatText("operator-log-text", String(err)), effect: "the session stays; the next maintenance tick judges it again" });
+                        }
+                        if (verdict === "deleted") {
+                            deleted++;
+                            deps.metrics.inc("sidechain_sessions_aged_out_total", {}, 1);
+                            deps.logger.info("session_aged_out", { sessionId: row.sessionId, sessionKind: kind, lastActivityAt: row.lastActivityAt });
+                        }
+                        else {
+                            skipped[verdict]++;
+                            deps.metrics.inc("sidechain_age_out_skipped_total", { reason: verdict }, 1);
+                        }
+                    }
+                    if (truncated || circled)
+                        break;
+                }
+                if (truncated)
+                    break;
+            }
+        }
+        finally {
+            inFlight = false;
+        }
+        if (deleted > 0 || truncated || Object.values(skipped).some((n) => n > 0)) {
+            deps.logger.info("reaper_swept", { metric: "sidechain_sessions_aged_out_total", count: deleted, skipped, truncated });
+        }
+        return { deleted, skipped, truncated };
+    };
+}
+//# sourceMappingURL=session-age-out.js.map

package/dist/boot/session-faces.d.ts

@@ -1,15 +1,3 @@
-/**
- * [ref] A10:composition root 分段 —— session 只读/删除面(审计、watch 注册表、E21 purge 协调器、
- * degenerate 仪表、plan-cache 探针)。
- *
- * 纯搬运:函数体逐字来自 `main.ts`(原 2967-3092 行),缩进不变;新增的只有 import 与包壳。
- *
- * ⚠️ **位置即契约**:
- *  1. `sessionWatchRegistry` 必须在 `purgeSession` **之前**构造 —— purge 尾部的 `dropSession` 是
- *     同副本租户轮转围栏(delete 即终结旧 owner 的 SSE 订阅),两者是一对;空间回收座在它**之后**起、且不在应答路径里。
- *  2. `setLeafAdvanceListener(...)` 是**进程级单点**装载(leaf-bus 只有一个监听位),必须与
- *     registry 的构造同段发生,晚于它、早于任何会 append 的路由。
- */
 import { type SessionAuditReadOpts } from "../audit.js";
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
@@ -25,7 +13,7 @@ import { SessionWatchRegistry } from "../session-watch.js";
 import type { TaskListLane } from "./task-list-lane.js";
 import { type RunnerDeps } from "@sema-agent/core";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
-import { type SessionPurgeOutcome } from "../session-deletion.js";
+import { type SessionAgeOutExpectation, type SessionPurgeOutcome } from "../session-deletion.js";
 import { type SessionEraser, type SessionEraseSettler } from "../session-erase.js";
 import type { UserInputLedgerStore } from "../user-input-ledger.js";
 import type { SpaceReclaimer } from "../workspace-space.js";
@@ -75,6 +63,7 @@ export interface SessionFacesCtx {
 export declare function createSessionFaces(ctx: SessionFacesCtx): {
     ownerAware: OwnerAwareSessionStore;
     sessionAudit: ((sessionId: string, opts?: SessionAuditReadOpts) => Promise<{
+        sessionKind?: "sidechain" | undefined;
         projectId?: string | undefined;
         agent?: import("../session-agent.js").SessionAgent | undefined;
         owner: string | null;
@@ -90,7 +79,9 @@ export declare function createSessionFaces(ctx: SessionFacesCtx): {
         promptEpoch?: import("@sema-agent/core").StoredPromptEpoch;
     } | undefined>) | undefined;
     sessionWatchRegistry: SessionWatchRegistry | undefined;
-    purgeSession: ((sessionId: string, owner: string | null) => Promise<SessionPurgeOutcome>) | undefined;
+    purgeSession: ((sessionId: string, owner: string | null, opts?: {
+        readonly ageOut?: SessionAgeOutExpectation;
+    }) => Promise<SessionPurgeOutcome>) | undefined;
     recoverPendingDeletions: (() => Promise<ReadonlyArray<{
         readonly sessionId: string;
         readonly outcome: SessionPurgeOutcome | {