@sema-agent/server 7.151.0 → 7.152.0

package/dist/human-facing-args.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 给人看的调用入参 —— **唯一一份读法**。三处读者同调这一只函数:活卡的 `args`(`tool-approval.ts` 的卡帧 / `card_json` / 续跑拒体的 `acceptableForm`)、
+ * 停驻行的 `input`(`plugins/checkpoint-store-face.ts` 的 `boundedToolInput`:两孪生都在读时从停驻快照的待决动作投影,不存第二份)、问帧的 `questions`(`question.ts`)。
+ *
+ * 律(一条):**脱敏 → 序列化 → 按 UTF-8 字节量 → 对一个常量判;卡的种类决定超了怎样。**
+ *  · 入参**就是**人要决的东西(问:题干与选项;计划:要批的计划正文)⇒ 整份给出、从不折叠。折掉它,人能做的只剩拒答 —— 那就不该把 run 停在他面前;
+ *    同一份字节(模型原调用的那一份)本就随 `tool_start.args` 不封顶地进了同一条流与账本,在这里封顶挡不住它,只制造「活面不给看、停驻行给折叠」两种盲。
+ *  · 其余动作卡 ⇒ 超常量即折叠(活卡 `argsOmitted`、停驻行 `{ truncated: true, bytes }`):盲批的安全答是「不」,动作卡的保留部分在兄弟格上
+ *    (卡的 `message`、停驻行的 `riskDescriptor.summary` / `touchedPaths`),帽买到的是队列列举 / 流 upsert / `card_json` 少一份大拷贝。
+ *  · 无卡(引擎没铸卡词:更早的停驻行 / 非审批门;集外词在读点已读作无卡)⇒ 按动作折(有界是 fail-safe 方向)。
+ * 序列化不出(BigInt / 抛错的 `toJSON`;环在脱敏遍历里已被断开成 `[circular]`)⇒ 折叠、`bytes: null` —— 没有可给的整份,问 / 计划卡同此。
+ *
+ * 卡是哪一张只有引擎铸的 `approvalCard` 一个事实源(`approval-content-kind.ts` 的律:不从工具名回推):活卡读 `AskRequest.approvalCard`,停驻行读门上那一格
+ * (SQL 孪生 = `approval_card` / `gate_kind` 两列,LOCAL 孪生 = 门本身,同一只 `parkedApprovalCard`);调用方读定后交进来,本模块不读卡。
+ * 如实:这是一只函数、三处调用、同一判定,不是「一次判定先于所有落点」—— 各面在自己的时刻对自己手里的那份入参判,同一份入参在各面答同一个结局。
+ */
+import type { ToolApprovalCard } from "@sema-agent/core";
+/**
+ * 动作卡入参给人看的上限:脱敏后 JSON 的 **UTF-8 字节数**。取值:本版之前停驻行的帽是 8192 个 UTF-16 单元,一个单元至多 3 个 UTF-8 字节(`\uXXXX` 转义 6 单元 6 字节)
+ * ⇒ 那一帽下整份的入参最坏 24576 字节 < 本值 —— 停驻行、活卡、问三面相对上一版零收窄。
+ */
+export declare const HUMAN_FACING_ARGS_BYTES = 32768;
+/** 一份入参给人看的结局:整份(脱敏后的值)或折叠(`bytes` = 脱敏后 JSON 的 UTF-8 字节数;序列化不出 ⇒ `null`)。纯数据。 */
+export type HumanFacingArgs = {
+    readonly kind: "whole";
+    readonly value: unknown;
+} | {
+    readonly kind: "omitted";
+    readonly bytes: number | null;
+};
+/** 见模块头注的律。`card` = 调用方读定的卡(无卡 ⇒ `undefined`)。 */
+export declare function humanFacingArgs(args: unknown, card: ToolApprovalCard | undefined): HumanFacingArgs;
+//# sourceMappingURL=human-facing-args.d.ts.map

package/dist/human-facing-args.js

@@ -0,0 +1,33 @@
+import { redactDeep } from "./trace/redact.js";
+export const HUMAN_FACING_ARGS_BYTES = 32768;
+const ARGS_ARE_THE_DECISION = {
+    question: true,
+    plan: true,
+    "file-edit": false,
+    "file-write": false,
+    "notebook-edit": false,
+    shell: false,
+    fetch: false,
+    skill: false,
+    workflow: false,
+    generic: false,
+    "computer-access": false,
+    "computer-control": false,
+};
+export function humanFacingArgs(args, card) {
+    const redacted = redactDeep(args);
+    let text;
+    try {
+        text = JSON.stringify(redacted);
+    }
+    catch {
+        return { kind: "omitted", bytes: null };
+    }
+    if (text === undefined)
+        return { kind: "omitted", bytes: null };
+    if (card !== undefined && ARGS_ARE_THE_DECISION[card])
+        return { kind: "whole", value: redacted };
+    const bytes = Buffer.byteLength(text, "utf8");
+    return bytes > HUMAN_FACING_ARGS_BYTES ? { kind: "omitted", bytes } : { kind: "whole", value: redacted };
+}
+//# sourceMappingURL=human-facing-args.js.map

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export { RateLimiter, type RateDecision } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo, type GitApiKind, type RepoCoords, type RepoReadClient } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioChoice, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, type ScenarioSource, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS, type TaskListLane, type TaskListLaneBackend, type TaskListLaneOpts } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";

package/dist/k8s-api-credentials.d.ts

@@ -0,0 +1,29 @@
+/**
+ * k8s 车道的**集群 API 凭据**:缺什么、怎么说、说给谁(纯叶:零值依赖,零 IO)。
+ *
+ * ## 法
+ * 车道声明了(`REMOTE_EXEC=k8s`)而控制面凭据没有 ⇒ 车道上每一条命令都起不来(`shell_unavailable`),而 run 照常 `completed` —— 这是**起服前就知道**的事,
+ * 不许走到 run 才说(同一件事实一个出口)。判「凭据在不在」只有一只判官(`plugins/remote-env-k8s.ts` 的 `resolveK8sApiAccess`:显式配置 ∨ in-cluster 服务账号,
+ * 适配器每次请求前读的 `creds()` 与下面三处说法读同一只),它答三个事实之一({@link K8sApiCredentialFact});本模块只管每个事实的**一句话**与三处说法:
+ *  · 起服拒({@link k8sCredentialsMissingBootSentence} + {@link K8sApiCredentialsMissingError},机器码 `config.k8s_api_credentials_missing`):凭据缺 ⇒ 不起;
+ *  · 运行期拒({@link k8sCredentialsMissingRunSentence} / {@link k8sCredentialsRejectedRunSentence}):起服之后凭据缺(服务账号文件没了)或被集群 401 拒 ⇒
+ *    每条 run 的环境铸造前拒,码 `env.sandbox_refused`(`execution-env-refusal.ts`)。
+ * 两条出路只写一次({@link EXITS}),三句共用:给凭据,或改车道。
+ */
+/** 判官的三个事实:缺集群 API 地址 / 缺 API 令牌 / 缺 CA(且没声明实验室 TLS)。 */
+export type K8sApiCredentialFact = "api_url" | "token" | "ca";
+/** 一个缺失事实的一句话。 */
+export declare function describeMissingK8sCredential(fact: K8sApiCredentialFact): string;
+/** 起服拒的拒句:点名「REMOTE_EXEC=k8s 需要集群 API 凭据」、缺的那一件、后果与两条出路。 */
+export declare function k8sCredentialsMissingBootSentence(fact: K8sApiCredentialFact): string;
+/** 运行期拒(凭据在起服之后读不到):句里不再说「拒启」,说这条 run 被拒。 */
+export declare function k8sCredentialsMissingRunSentence(fact: K8sApiCredentialFact): string;
+/** 运行期拒(集群 API 以 401 拒了车道的凭据)。 */
+export declare function k8sCredentialsRejectedRunSentence(): string;
+/** 起服拒的机器码(`boot/fatal-exit.ts` 把带码异常写成 `<名> [<码>]: …` 标题;`config.*` 族与 `config.store_not_durable` 同形)。 */
+export declare const K8S_API_CREDENTIALS_MISSING_CODE = "config.k8s_api_credentials_missing";
+/** 起服因 k8s 车道声明而集群 API 凭据缺而拒启时的抛出物。 */
+export declare class K8sApiCredentialsMissingError extends Error {
+    readonly code = "config.k8s_api_credentials_missing";
+}
+//# sourceMappingURL=k8s-api-credentials.d.ts.map

package/dist/k8s-api-credentials.js

@@ -0,0 +1,25 @@
+const MISSING_WHAT = {
+    api_url: "no cluster API address is set (K8S_API_URL) and the process is not running in a cluster (no KUBERNETES_SERVICE_HOST)",
+    token: "no API token is set (K8S_TOKEN) and the mounted service-account token cannot be read",
+    ca: "no CA certificate is set (K8S_CA_CERT_B64) and the mounted service-account CA cannot be read, and K8S_INSECURE_TLS is not true",
+};
+export function describeMissingK8sCredential(fact) {
+    return MISSING_WHAT[fact];
+}
+const EXITS = "Either give the server the cluster API credentials (K8S_API_URL + K8S_TOKEN, plus K8S_CA_CERT_B64 or K8S_INSECURE_TLS=true for a lab; or run the server in a pod that mounts a service account) " +
+    "or declare an execution lane that needs no cluster (REMOTE_EXEC=none, or another lane).";
+export function k8sCredentialsMissingBootSentence(fact) {
+    return (`REMOTE_EXEC=k8s needs cluster API credentials, but ${MISSING_WHAT[fact]} — refusing to start rather than serving a lane on which every sandbox command ` +
+        `fails (shell_unavailable) while every run still finishes as completed. ${EXITS}`);
+}
+export function k8sCredentialsMissingRunSentence(fact) {
+    return `this run is refused: the k8s execution lane needs cluster API credentials, but ${MISSING_WHAT[fact]}. ${EXITS}`;
+}
+export function k8sCredentialsRejectedRunSentence() {
+    return `this run is refused: the cluster API rejected the k8s lane's credentials (HTTP 401) — a revoked or expired token, or an API address of another cluster. ${EXITS}`;
+}
+export const K8S_API_CREDENTIALS_MISSING_CODE = "config.k8s_api_credentials_missing";
+export class K8sApiCredentialsMissingError extends Error {
+    code = K8S_API_CREDENTIALS_MISSING_CODE;
+}
+//# sourceMappingURL=k8s-api-credentials.js.map

package/dist/lane-home-probe.d.ts

@@ -23,7 +23,7 @@
  * 读不了家目录的车道(device:设备协议没有读数)不持座 —— 声明就是座,起服披露「来自声明、未实测」(`execution-lane-caps.ts` `buildLaneHomeBootNote`)。
  * 规则基与 422 门在下单那一刻就要家目录,而那一刻执行环境还没开 —— 它们只读主张(`executionLaneHomeDir`);环境开起来时主张被证,证不了的环境不开。
  */
-import type { ExecutionEnvRefusalCode } from "./execution-env-refusal.js";
+import { type ExecutionEnvRefusalCode } from "./execution-env-refusal.js";
 /** 探针答案的行首标记:登录脚本 / profile 往 stdout 打的横幅不会被读成家目录 —— 只认带这个标记的那一行(恰一条,见 `markedHome`)。 */
 export declare const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
 /**

package/dist/lane-home-probe.js

@@ -1,3 +1,4 @@
+import { executionEnvRefusalError } from "./execution-env-refusal.js";
 export const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
 export const LANE_HOME_PROBE_COMMAND = `printf '\\n${LANE_HOME_PROBE_MARKER}%s\\n' "$HOME"`;
 const SHOWN_MAX = 256;
@@ -62,7 +63,7 @@ export function judgeLaneHome(lane, claim, probe, paths = "posix") {
     };
 }
 export function laneHomeRefusal(verdict) {
-    return Object.assign(new Error(verdict.refusal), { code: "env.home_unconfirmed" });
+    return executionEnvRefusalError("env.home_unconfirmed", verdict.refusal);
 }
 export const LANE_HOME_UNDECLARED_EVENT = "execution_lane_home_undeclared";
 const HOME_ABSENT_COST = "the engine cannot place its home-anchored read-deny rows, so every contents-disclosing recursive read (grep -r, rg, git grep, tar c, …) asks a person on the full shell — " +

package/dist/leader/diffup.d.ts

@@ -15,6 +15,25 @@
  * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
  */
 import { type PullDiffResult } from "./diffout.js";
+/** The leader's diff-out store (`MINIO_BUCKET` + the shared `MINIO_*` endpoint and key; `boot/leader.ts` `buildLeaderObjectStore`). */
+export interface LeaderDiffStore {
+    endpoint: string;
+    bucket: string;
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+}
+/**
+ * One worker's diff-out object and its two URLs — the ONE place the key is spelled (`leader-diff/<run>/<workerId>.patch`; one object per worker per
+ * leader run, a repair re-run overwrites): the PUT the worker env's upload script sends (`leader-diff/patch:PUT`, the sandbox) and the GET the
+ * leader fetches it with on the control plane (`leader-diff/patch:GET`, the server). `workerId` is validateSubtasks-clean (`[A-Za-z0-9._-]+`) ⇒
+ * safe as a key segment (the presigner backstop-rejects traversal anyway). `ttlSec` = the worker's deadline plus slack (`leaderResourceConfig`).
+ */
+export declare function buildLeaderDiffUrls(s3: LeaderDiffStore, workerId: string, ttlSec: number): {
+    readonly key: string;
+    readonly putUrl: string;
+    readonly getUrl: string;
+};
 /** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
  *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
  *  safeRev rules, but this function is the last line before the shell. The patch is written OUTSIDE the repo

package/dist/leader/diffup.js

@@ -1,6 +1,13 @@
 import { safeRev, DEFAULT_MAX_DIFF_BYTES } from "./diffout.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
 import { createEgressFetch } from "../egress-redirect.js";
+import { presignS3Url } from "../plugins/s3-presign.js";
+import { LEADER_DIFF_PREFIX } from "../object-store-buckets.js";
+export function buildLeaderDiffUrls(s3, workerId, ttlSec) {
+    const key = `${LEADER_DIFF_PREFIX}/${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}/${workerId}.patch`;
+    const base = { endpoint: s3.endpoint, bucket: s3.bucket, accessKey: s3.accessKey, secretKey: s3.secretKey, ...(s3.region ? { region: s3.region } : {}), key, expiresSec: ttlSec };
+    return { key, putUrl: presignS3Url({ ...base, op: "leader-diff/patch:PUT", method: "PUT" }), getUrl: presignS3Url({ ...base, op: "leader-diff/patch:GET", method: "GET" }) };
+}
 export function buildUploadScript(p) {
     if (!safeRev(p.baseSha))
         throw new Error(`buildUploadScript: unsafe baseSha ${JSON.stringify(p.baseSha)}`);

package/dist/leader/leader.d.ts

@@ -15,8 +15,10 @@
 import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
-import { type PermissionMode, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type PermissionMode, type ToolPolicy, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
 import { type UnattendedLegSpec } from "../unattended-permission-mode.js";
+import type { CheckpointStoreFull } from "../plugins/store-backend.js";
+import type { CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -77,13 +79,115 @@ export interface LeaderRunEntry {
     readonly permissionMode?: PermissionMode;
 }
 /**
- * leader 车道铸 spec 的**唯一**合并口:spec 的词钳在入口体的词之下(`runtime-governance.ts` `entryPermissionMode(spec 的词, 入口词)` —— 与受理门同一只函数;
- * 写进 spec 的值就是它的 `effective`),再交给无人值守腿的合并口(`withUnattendedLeg` 的 `default` 钳在那个词之下)。入口体无词 ⇒ spec 原物交给
- * `withUnattendedLeg`,与不经本口逐字同。本车道的 spec 今天自己不带模式词(子任务体只有 objective,其余并进的键是预算 / 审批 / 身份)⇒ 入口词在场时写下的就是它;
- * 将来带了词,比入口词松的折回入口词、比它紧的留着 —— 与一条提交体过受理门同一个答案,不另写「写」的规则。五个出生点(worker 首跑的工厂 / 静态两条车道、
- * 集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`(`test/leader-entry-floor.test.ts` 按语法树数调用点):「这条腿的词从哪来」只有入口体一个答案。
+ * 一条 leader run 的**出生上下文**:run 出生那一拍定下、本 run 铸的每一条腿都从它取 —— 入口体({@link LeaderRunEntry})、提交者的身份格
+ * (`engine-identity.ts` `taskSpecIdentityOf` 的产物,出生时读一次 ALS)、部署治理折叠(装配处闭包活 config 交进来,leader 自己不读 config)。
  */
-export declare function withLeaderLeg<S extends Partial<TaskSpec>>(spec: S, entry: LeaderRunEntry): S & UnattendedLegSpec;
+export interface LeaderBirth {
+    readonly entry: LeaderRunEntry;
+    /** 提交者的身份格(匿名 ⇒ `{}`:键缺席,与提交腿同一读法)。中心按主体的收紧位、治理窗的锅都按它解。 */
+    readonly identity: {
+        readonly principal?: string;
+    };
+    /**
+     * 部署治理折叠(`runtime-governance.ts` `applyRuntimeGovernance`,与 `resolveSpec` / 停驻赎回腿同一属主):运维 `AUTONOMY` / `commandPolicy` /
+     * `MANUAL_MODE_SHELL_GATE` / 守卫集 tighten-only 盖到 spec 上。`legSessionId` = 这条腿的**槽键**(沙盒车道上守卫按它在槽表里取那台真沙盒):
+     * 跑在 worker 执行器上的腿(首跑、模块门修复、单代理修复环)= worker 自己的会话号;集成修复腿 = 它那一轮的会话号(`leader/wire.ts` 按同一个键登记)。
+     */
+    readonly govern: (spec: TaskSpec, legSessionId: string) => TaskSpec;
+    /**
+     * 审批基线(`deployment-governance.ts` `createApprovalBaselinePolicy` 的两臂,装配处闭包活 config —— 名单热换对之后出生的腿生效)。出生口按这条腿的
+     * {@link LeaderLegDurability} 取一臂:耐久腿 `durable`(问答门 + 三张名单,问由停驻服);不耐久腿 `live`(三张名单,问由这条腿的活席服 —— 即无人值守层:
+     * 答得了的按类答,答不了的交回引擎的缺席路,这条腿没有停驻设施 ⇒ 拒)。
+     */
+    readonly baseline: (seat: "durable" | "live") => ToolPolicy;
+    /**
+     * 这条腿的 per-model 凭据席(`TaskSpec.getApiKeyAndHeaders`)—— 装配处铸(`boot/leader.ts` 的 `createLeaderLegAuth`:与任务面同一只活引用、与 side-query /
+     * WebFetch 摘要面同一只席工厂);leader 自己不碰钥链。**每只执行器出生时调一次**(出生口 {@link withLeaderLeg} 对执行器与腿同拍出生的腿调;planner 路由在它的
+     * Runner 构造那一拍调):解钥的那一代在这一拍定下,与这只执行器构造时收下的模型目录同代(目录与钥匙表由中心成对换代 ⇒ 在飞的腿不会把新家的钥发到它目录里的旧家)。
+     * 跑在已出生执行器上的腿不再调它,沿用那只执行器的席({@link LeaderLegExecutor})。
+     * `upstream` = spec 自带的席:每次调用先问它,它没意见才按模型解(不覆盖)。声明了钥匙却拿不到 ⇒ 席抛(与任务面同一只毒丸),那次调用整体失败,绝不回落网关钥。
+     */
+    readonly auth: (upstream: TaskSpec["getApiKeyAndHeaders"]) => NonNullable<TaskSpec["getApiKeyAndHeaders"]>;
+}
+/**
+ * leader worker 审批停驻行的 scope(唯一属主;保留标识见 `principal-shape.ts` 的 `RESERVED_PRINCIPALS`)。出生口给耐久腿的 `durableApproval` 与
+ * 取消时的残留过期(`wire.ts` `createLeaderParkExpirer`)读这同一只。
+ */
+export declare const LEADER_APPROVAL_SCOPE = "_leader";
+/** 部署的停驻设施(`LeaderWireConfig.durable` 函数席每次产出的一份;键在场 ⟺ 部署接了停驻店)。 */
+export interface LeaderDurableSeat {
+    readonly checkpointStore: CheckpointStoreFull;
+    /** [ref]:写 worker 续跑上下文的封口(`ServiceDeps.checkpointCtxSealing` 同一只;规则属主 `http/checkpoint-ctx.ts` 末段「凭据位密封」)。
+     *  worker 的续跑体只有入口词 + 子任务 objective、不带凭据位 ⇒ 实际不封任何值,但写 ctx 的每一笔都经同一只封口(没有不封的第二种写法)。 */
+    readonly ctxSealer: CheckpointCtxSealer | undefined;
+    readonly ttlMs?: number;
+}
+/**
+ * 出生点陈述的这条腿的事实 ——「停驻决完之后,谁接着做这条腿的工作」:
+ *  · `replay` —— worker 首跑:留续跑体,决完之后由一条单独的续跑 run(HTTP 续跑腿,照写下的体重放)接着做。`resumeCtx` = 续跑上下文那一笔的结局:
+ *    `landed` = 写进了出生点递给这条腿的停驻店(`park`);`lost` = 写了、店抛了;`unwritten` = 出生点没递停驻设施 ⇒ 不写。递不递由出生点按车道定:
+ *    工厂车道 = 部署接了停驻店即递(环境由 worker 自己的 Runner 经工厂铸,停驻时引擎把可恢复的环境句柄写进检查点,续跑腿经部署工厂按句柄接回同一工作区);
+ *    静态车道 = {@link staticLaneWorkerPark}(上一发布版的条件,不按本律)。
+ *  · `in_run` —— 这条腿的续接是本 run 内存里的那一轮(集成修复、模块门修复、单代理修复环):一条单独续跑的 run 交不回去。
+ */
+export type LeaderLegFacts = {
+    readonly continuation: "replay";
+    readonly resumeCtx: "landed";
+    readonly park: LeaderDurableSeat;
+} | {
+    readonly continuation: "replay";
+    readonly resumeCtx: "lost" | "unwritten";
+} | {
+    readonly continuation: "in_run";
+};
+/** 一条腿的耐久事实({@link leaderLegDurability} 的产物)。`transient.why` 是给运维的那一句(资源分片停驻不生效的告警原因读它)。 */
+export type LeaderLegDurability = {
+    readonly kind: "durable";
+    readonly park: LeaderDurableSeat;
+} | {
+    readonly kind: "transient";
+    readonly why: string;
+};
+/**
+ * **一条 leader 腿的耐久事实 —— 唯一读者**。耐久 ⇔ 这条腿由单独的续跑 run 接续 ∧ 它的续跑上下文真落进了出生点递给它的停驻店(没落 ⇒ 停出来的卡
+ * 决的时候重建不了这条腿 ⇒ 不耐久)。四个调用点:worker 首跑(工厂 / 静态两条车道共一次)、集成修复、模块门修复、单代理修复环;出生口({@link withLeaderLeg})
+ * 按它盖审批基线与停驻设施,worker 首跑按它保温续跑上下文、开资源分片停驻。主车道没有握在手里的环境(它的每一只环境都由工厂铸,环境能不能停驻由引擎读),
+ * 所以「递不递停驻设施」这一问只在本车道有。
+ */
+export declare function leaderLegDurability(leg: LeaderLegFacts): LeaderLegDurability;
+/**
+ * 静态车道 worker 递不递停驻设施 —— **上一发布版的条件原样**:部署接了停驻店 ∧ 任一审批名单在场(每只 worker 现读)。只此一处,worker 首跑的出生点调它一次。
+ * 不按 {@link leaderLegDurability} 的律(工厂车道「店在即递」)判:这条车道上两种停驻的续接路不同 —— 资源分片停驻由 leader 在进程内同一只执行器上续(续得上);
+ * 审批停驻的赎回走 HTTP 续跑腿、经部署工厂另铸执行环境(worker 的沙盒握在 leader 手里,检查点里没有它的句柄 ⇒ 续不上)。引擎今天只有「给不给停驻店」一个开关,
+ * 两种停驻拆不开:照「店在即递」会比上一版多出几种部署形停出决完落新执行环境的卡,照「续不上就不递」又关掉上一版就工作的资源分片停驻 ⇒ 沿用上一版的条件。
+ * 已知缺陷(上一版同形,随包文书同句披露):名单在 × 店在时审批问停驻,决完的续跑落在新执行环境上。引擎提供「宿主声明本腿审批停驻不可续」的声明位后,
+ * 本条件退役、静态车道并回本读者的律(店在即递 + 声明审批停驻不可续:资源分片照停,审批问不走停驻)。
+ */
+export declare function staticLaneWorkerPark(park: LeaderDurableSeat | undefined, approvalListInForce: boolean): LeaderDurableSeat | undefined;
+/**
+ * 这条腿跑在哪只执行器上 —— **凭据代随执行器**:执行器构造时把模型目录收成私有副本,这条腿的钥取同一代(否则中心换代之后,新一代的钥会配上旧一代目录里的端点)。
+ *  · `fresh` —— 执行器与这条腿同拍出生(worker 首跑的工厂 / 静态两条车道、集成修复):出生口此刻从出生上下文取一只席({@link LeaderBirth.auth},折 spec 自带的那一只);
+ *  · `reuses` —— 腿跑在一只已经出生的 worker 执行器上(模块门修复、单代理修复环):沿用那只 worker 首跑 spec 上的席(它经出生口 `fresh` 出生,已折过子任务自带的席),不再取一代。
+ */
+export type LeaderLegExecutor = {
+    readonly kind: "fresh";
+} | {
+    readonly kind: "reuses";
+    readonly worker: Pick<ProvisionedWorker, "spec">;
+};
+/** 出生口收的这条腿:槽键(见 {@link LeaderBirth.govern})+ 耐久事实(见 {@link leaderLegDurability})+ 执行器(凭据代,见 {@link LeaderLegExecutor})。 */
+export interface LeaderLeg {
+    readonly slotKey: string;
+    readonly durability: LeaderLegDurability;
+    readonly executor: LeaderLegExecutor;
+}
+/**
+ * leader 车道铸 spec 的**唯一**出生口。顺序即语义:身份格 + 凭据席(随执行器的那一代,{@link LeaderLegExecutor})+ 审批基线与停驻设施(按这条腿的耐久事实)→ 部署治理折叠(同属主,tighten-only 叠在基线上)→
+ * 入口词(spec 的词钳在入口体的词之下,`runtime-governance.ts` `entryPermissionMode` —— 与受理门同一只函数)→ 无人值守腿(`withUnattendedLeg` 头注要求它在
+ * 治理折叠**之后**)。首跑、修复腿与停驻后的续跑腿(续跑腿经 `resolveSpec` 折同一只治理)因此同一读法。五个出生点(worker 首跑的工厂 / 静态两条车道、
+ * 集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`、不各自盖身份或基线(`test/leader-entry-floor.test.ts` 按语法树数调用点)。
+ */
+export declare function withLeaderLeg(spec: TaskSpec, birth: LeaderBirth, leg: LeaderLeg): TaskSpec & UnattendedLegSpec;
 export interface LeaderDeps {
     /**
      * 本 run 的中止信号(取消口 / 陈旧裁决;HTTP 驱动腿恒给,`endpoint.ts` 的 `drive`)。与 core `TaskSpec.signal` 同一约定:缺席 = 不可外部取消(单测 / bench 形)。
@@ -91,9 +195,9 @@ export interface LeaderDeps {
      * 不再起任何新的计费工作;在跑的腿经 spec 的同一根信号中止(fan-out 共享信号 / 修复腿 / 单代理修复环);合并在 push 咽喉前再核一次(`merge.ts`)。
      */
     signal?: AbortSignal;
-    /** 本 run 的入口体({@link LeaderRunEntry}:运维地板在 run 出生时盖一次)。必填:没有地板的装配写 `{}` —— 缺席不是「没有地板」的合法拼法。
-     *  模块门修复与单代理修复环这两个出生点从这里取词(经 {@link withLeaderLeg})。 */
-    entry: LeaderRunEntry;
+    /** 本 run 的出生上下文({@link LeaderBirth}:入口体 + 身份格 + 治理折叠,run 出生时定一次)。必填:没有地板的装配写 `entry: {}` —— 缺席不是「没有地板」的合法拼法。
+     *  模块门修复与单代理修复环这两个出生点从这里出生(经 {@link withLeaderLeg})。 */
+    birth: LeaderBirth;
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */

package/dist/leader/leader.js

@@ -2,8 +2,9 @@ import { fanOut } from "./fanout.js";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
-import { Runner, runWithVerification, resumeWithVerification } from "@sema-agent/core";
+import { Runner, QUESTION_AWAITS_RESUME, runWithVerification, resumeWithVerification } from "@sema-agent/core";
 import { pausedCauseOf, outwardPlane } from "../terminal.js";
+import { seatText } from "../trace/exit-seat.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
 import { entryPermissionMode } from "../runtime-governance.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
@@ -18,9 +19,68 @@ export async function autoResumeOnResource(initial, signal, resume, maxSlices =
     }
     return vr;
 }
-export function withLeaderLeg(spec, entry) {
-    const word = entryPermissionMode(spec.permissionMode, entry.permissionMode).effective;
-    return withUnattendedLeg(word === undefined ? spec : { ...spec, permissionMode: word });
+export const LEADER_APPROVAL_SCOPE = "_leader";
+export function leaderLegDurability(leg) {
+    switch (leg.continuation) {
+        case "in_run":
+            return { kind: "transient", why: "this leg is continued by the leader's own in-run repair round, which a separately resumed run cannot hand its result back to" };
+        case "replay":
+            switch (leg.resumeCtx) {
+                case "landed":
+                    return { kind: "durable", park: leg.park };
+                case "lost":
+                    return { kind: "transient", why: "the worker's resume context did not land in the checkpoint store, so a decided park could not rebuild this leg" };
+                case "unwritten":
+                    return { kind: "transient", why: "no park facility for this worker (no durable checkpoint store; on the static lane, no approval list in force either)" };
+                default: {
+                    const unhandled = leg;
+                    throw new Error(`leader leg resume context ${JSON.stringify(unhandled)} has no durability arm`);
+                }
+            }
+        default: {
+            const unhandled = leg;
+            throw new Error(`leader leg facts ${JSON.stringify(unhandled)} have no durability arm`);
+        }
+    }
+}
+export function staticLaneWorkerPark(park, approvalListInForce) {
+    return approvalListInForce ? park : undefined;
+}
+function legAuthSeat(spec, birth, executor) {
+    switch (executor.kind) {
+        case "fresh":
+            return birth.auth(spec.getApiKeyAndHeaders);
+        case "reuses":
+            return executor.worker.spec.getApiKeyAndHeaders;
+        default: {
+            const unhandled = executor;
+            throw new Error(`leader leg executor ${JSON.stringify(unhandled)} has no credential seat`);
+        }
+    }
+}
+function legApprovalSeat(durability, birth) {
+    switch (durability.kind) {
+        case "durable": {
+            const d = durability;
+            return {
+                toolPolicy: birth.baseline("durable"),
+                checkpointStore: d.park.checkpointStore,
+                durableApproval: { scope: LEADER_APPROVAL_SCOPE, ...(d.park.ttlMs ? { ttlMs: d.park.ttlMs } : {}) },
+                onQuestion: QUESTION_AWAITS_RESUME,
+            };
+        }
+        case "transient":
+            return { toolPolicy: birth.baseline("live") };
+        default: {
+            const unhandled = durability;
+            throw new Error(`leader leg durability ${JSON.stringify(unhandled)} has no approval seat`);
+        }
+    }
+}
+export function withLeaderLeg(spec, birth, leg) {
+    const governed = birth.govern({ ...spec, ...birth.identity, getApiKeyAndHeaders: legAuthSeat(spec, birth, leg.executor), ...legApprovalSeat(leg.durability, birth) }, leg.slotKey);
+    const word = entryPermissionMode(governed.permissionMode, birth.entry.permissionMode).effective;
+    return withUnattendedLeg(word === undefined ? governed : { ...governed, permissionMode: word });
 }
 export const LEADER_RUN_STOPPED = "leader run stopped at an abort checkpoint (cancel): no further work was started and nothing was pushed after the stop";
 export function stoppedResult(reports, route) {
@@ -230,7 +290,11 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.entry)).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}`, ...(signal ? { signal } : {}) }, deps.birth, { slotKey: w.sessionId, durability: leaderLegDurability({ continuation: "in_run" }), executor: { kind: "reuses", worker: w } })).result();
+                        if (rr !== undefined && rr.terminal.kind !== "completed") {
+                            const plane = outwardPlane(rr.terminal);
+                            deps.logger?.warn?.("module_repair_incomplete", { workerId: r.workerId, attempt: attempt + 1, status: plane.status, ...(plane.errorMessage !== undefined ? { err: seatText("operator-log-error", plane.errorMessage) } : {}) });
+                        }
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -1,6 +1,6 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
-import { withLeaderLeg } from "./leader.js";
+import { leaderLegDurability, withLeaderLeg } from "./leader.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
 function statusForTerminal(t) {
@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.entry);
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId, ...(deps.signal ? { signal: deps.signal } : {}) }, deps.birth, { slotKey: solo.sessionId, durability: leaderLegDurability({ continuation: "in_run" }), executor: { kind: "reuses", worker: solo } });
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/run-entry.d.ts

@@ -16,7 +16,8 @@ import { type Autonomy } from "../runtime-governance.js";
 import type { LeaderRunEntry } from "./leader.js";
 /** 一条 leader run 的入口体:地板读一次、入口词经受理门同一只函数(地板缺席 ⇒ `{}`)。调用方读**活** config(热改只影响之后起的 run)。 */
 export declare function leaderRunEntry(autonomy: Autonomy | undefined): LeaderRunEntry;
-/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换档)。不含任何配置值之外的回显。
+/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换到 `ask` 档,代价写在句里)。`read-only` 不是出路:
+ *  部署治理折叠盖在 leader 每条腿的出生口上,`read-only` 下 worker 写不了。不含任何配置值之外的回显。
  *  受理口(HTTP 422 的 `error`)与 run 出生处(run 的 `error`)读的是这一份;字节由 `test/api-error-text-freeze.test.ts` 的常量锚格冻。 */
 export declare const LEADER_PLAN_ENTRY_REFUSAL: string;
 /**

package/dist/leader/run-entry.js

@@ -6,7 +6,7 @@ export function leaderRunEntry(autonomy) {
 export const LEADER_PLAN_ENTRY_REFUSAL = "this deployment runs with AUTONOMY=plan, which starts every task in plan mode and lets it out of plan mode only when a person approves its plan through plan review; " +
     "a leader task's workers have no plan review channel, so they could neither write nor hand their plan to anyone who can approve it. Nothing was started. " +
     "Submit the work as a run instead (POST /v1/runs, whose plan is reviewed through POST /v1/assistant/tasks/:id/plan_review), " +
-    "or ask the operator to set AUTONOMY=read-only or AUTONOMY=ask, under which leader tasks run.";
+    "or ask the operator to set AUTONOMY=ask, under which leader tasks run, though each shell command a worker runs then needs a person's approval.";
 export function leaderEntryRefusal(entry) {
     const mode = entry.permissionMode;
     if (mode === undefined)