@sema-agent/server 7.151.0 → 7.152.0

package/dist/boot/runner-deps.js

@@ -65,10 +65,6 @@ export function createEngineNoticeForwarder(logger, router = defaultEngineNotice
 export function installDefaultEngineNoticeSeat(logger, metrics) {
     setDefaultEngineNoticeSeat(createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics));
 }
-export function createEngineNoticeSeat(logger, router = defaultEngineNoticeRouter) {
-    const warn = logger?.warn?.bind(logger);
-    return warn ? { onNotice: createEngineNoticeForwarder({ warn }, router) } : {};
-}
 export const CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL = { multi_tenant: true, single_user: false };
 export function crossBoundaryPostureOf(requirePrincipal) {
     for (const w of Object.keys(CROSS_BOUNDARY_POSTURE_REQUIRES_PRINCIPAL)) {
@@ -111,9 +107,8 @@ export function announceReadDenyRows(config, logger) {
     announcedReadDenyRows.set(config, key);
     auditReadDenyAnchoring({ rows: config.readDenyPatterns, logger });
 }
-export function createSharedRunnerDeps(ctx) {
-    announceReadDenyRows(ctx.config, ctx.logger);
-    const shared = {
+export function createDeploymentPlaneDeps(ctx, lane) {
+    const plane = {
         brain: ctx.brain,
         onNotice: createEngineNoticeForwarder(ctx.logger, defaultEngineNoticeRouter, ctx.metrics),
         tiers: ctx.config.tiers,
@@ -123,13 +118,29 @@ export function createSharedRunnerDeps(ctx) {
         tracer: ctx.tracer,
         promptSource: ctx.promptSource,
         ...buildDeploymentPostureSeats(ctx.config),
+        mods: ctx.deploymentMods,
+        hands: buildHandsBand(ctx.config, lane.commitCoAuthor),
+        usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
+        usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
+        memoryEngineDir: ctx.engineDataRoot,
+        compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
+        lockedConfig: ctx.governanceSeams.lockedConfig,
+        retentionPolicy: ctx.governanceSeams.retentionPolicy,
+        mcpRevocations: ctx.mcpRevocations ? ctx.mcpRevocations : undefined,
+        runtimeCapsResolver: ctx.runtimeCapsResolver ? ctx.runtimeCapsResolver : undefined,
+        onError: ctx.onError,
+    };
+    return plane;
+}
+export function createSharedRunnerDeps(ctx) {
+    announceReadDenyRows(ctx.config, ctx.logger);
+    const shared = {
+        ...createDeploymentPlaneDeps(ctx, { commitCoAuthor: ctx.commitCoAuthor }),
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
         backgroundAgentStore: ctx.backgroundAgentStore ? ctx.backgroundAgentStore : undefined,
         mailboxStore: ctx.mailboxStore ? ctx.mailboxStore : undefined,
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
-        mods: ctx.deploymentMods,
-        hands: buildHandsBand(ctx.config, ctx.commitCoAuthor),
         toolResultStore: ctx.toolResultStore,
         checkpointStore: ctx.checkpointStore ? ctx.checkpointStore : undefined,
         fileHistoryStore: ctx.fileHistoryStore ? ctx.fileHistoryStore : undefined,
@@ -137,16 +148,8 @@ export function createSharedRunnerDeps(ctx) {
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
         memoryScopeAdmission: ctx.orgMemoryAdmission.memoryScopeAdmission ? ctx.orgMemoryAdmission.memoryScopeAdmission : undefined,
         deploymentMemoryScopes: ctx.orgMemoryAdmission.deploymentMemoryScopes && ctx.orgMemoryAdmission.deploymentMemoryScopes.length > 0 ? ctx.orgMemoryAdmission.deploymentMemoryScopes : undefined,
-        usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
-        usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
         sharedMemoryStores: ctx.sharedMemoryStores ? ctx.sharedMemoryStores : undefined,
-        memoryEngineDir: ctx.engineDataRoot,
-        compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
-        lockedConfig: ctx.governanceSeams.lockedConfig,
-        retentionPolicy: ctx.governanceSeams.retentionPolicy,
-        mcpRevocations: ctx.mcpRevocations ? ctx.mcpRevocations : undefined,
         peerSeat: ctx.peerDesk.seat,
-        runtimeCapsResolver: ctx.runtimeCapsResolver ? ctx.runtimeCapsResolver : undefined,
     };
     return shared;
 }
@@ -157,7 +160,78 @@ export function createRunnerDeps(ctx) {
     const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
     const peerSessionLister = sessionStore.listSessionRows?.bind(sessionStore);
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
-    const sharedRunnerDeps = createSharedRunnerDeps(ctx);
+    const onError = (err, ctx) => {
+        const codeField = codeFieldOf(err);
+        if (ctx.phase === "degraded") {
+            logger.warn("task_degraded", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
+            return;
+        }
+        if (ctx.phase === "prompt-constitution") {
+            logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
+            return;
+        }
+        if (ctx.phase === "rewind") {
+            const code = rewindFailureCode(err);
+            logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: seatText("operator-log-text", String(err)) });
+            metrics.inc("rewind_snapshot_failed_total", { code });
+            return;
+        }
+        if (ctx.phase === "memory") {
+            memoryEngineIncident(err, ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : undefined);
+            return;
+        }
+        if (ctx.phase === "mcp") {
+            logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
+            metrics.inc("mcp_server_unavailable_total");
+            return;
+        }
+        if (ctx.phase === "a2a") {
+            logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
+            metrics.inc("a2a_peer_unavailable_total");
+            return;
+        }
+        if (ctx.phase === "prompt-cache") {
+            const classification = ctx.classification;
+            const causeLevel = classification === undefined ? undefined : PROMPT_CACHE_BREAK_LEVELS.get(classification);
+            const level = classification === undefined ? "warn" : (causeLevel ?? "error");
+            const fields = {
+                sessionId: ctx.sessionId,
+                confirmed: classification !== undefined,
+                ...(classification !== undefined ? { classification, classificationKnown: causeLevel !== undefined } : {}),
+                ...codeField,
+                err: seatText("operator-log-text", String(err)),
+            };
+            metrics.inc("prompt_cache_low_hit_total", {
+                ...(classification !== undefined ? { classification: causeLevel !== undefined ? classification : "unknown" } : {}),
+                level,
+            });
+            if (level === "warn")
+                logger.warn("prompt_cache_break", fields);
+            else
+                logger.error("prompt_cache_break", fields);
+            return;
+        }
+        if (ctx.phase === "config") {
+            const classification = ctx.classification;
+            const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
+            const fields = {
+                sessionId: ctx.sessionId,
+                ...codeField,
+                ...(classification !== undefined ? { classification, classificationKnown } : {}),
+                info: seatText("operator-log-text", String(err)),
+            };
+            logger.warn("runner_config_advisory", fields);
+            metrics.inc("runner_config_advisory_total", {
+                ...codeField,
+                ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
+                level: "warn",
+            });
+            return;
+        }
+        metrics.inc("runner_error_total", { phase: ctx.phase });
+        logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, ...codeField, err: seatText("operator-log-text", String(err)) });
+    };
+    const sharedRunnerDeps = createSharedRunnerDeps({ ...ctx, onError });
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
         ? {
@@ -248,77 +322,6 @@ export function createRunnerDeps(ctx) {
             ? makeProbeInstructionSources()
             : undefined,
         ...selfOrchestrationDeps,
-        onError: (err, ctx) => {
-            const codeField = codeFieldOf(err);
-            if (ctx.phase === "degraded") {
-                logger.warn("task_degraded", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
-                return;
-            }
-            if (ctx.phase === "prompt-constitution") {
-                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
-                return;
-            }
-            if (ctx.phase === "rewind") {
-                const code = rewindFailureCode(err);
-                logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: seatText("operator-log-text", String(err)) });
-                metrics.inc("rewind_snapshot_failed_total", { code });
-                return;
-            }
-            if (ctx.phase === "memory") {
-                memoryEngineIncident(err, ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : undefined);
-                return;
-            }
-            if (ctx.phase === "mcp") {
-                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
-                metrics.inc("mcp_server_unavailable_total");
-                return;
-            }
-            if (ctx.phase === "a2a") {
-                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
-                metrics.inc("a2a_peer_unavailable_total");
-                return;
-            }
-            if (ctx.phase === "prompt-cache") {
-                const classification = ctx.classification;
-                const causeLevel = classification === undefined ? undefined : PROMPT_CACHE_BREAK_LEVELS.get(classification);
-                const level = classification === undefined ? "warn" : (causeLevel ?? "error");
-                const fields = {
-                    sessionId: ctx.sessionId,
-                    confirmed: classification !== undefined,
-                    ...(classification !== undefined ? { classification, classificationKnown: causeLevel !== undefined } : {}),
-                    ...codeField,
-                    err: seatText("operator-log-text", String(err)),
-                };
-                metrics.inc("prompt_cache_low_hit_total", {
-                    ...(classification !== undefined ? { classification: causeLevel !== undefined ? classification : "unknown" } : {}),
-                    level,
-                });
-                if (level === "warn")
-                    logger.warn("prompt_cache_break", fields);
-                else
-                    logger.error("prompt_cache_break", fields);
-                return;
-            }
-            if (ctx.phase === "config") {
-                const classification = ctx.classification;
-                const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
-                const fields = {
-                    sessionId: ctx.sessionId,
-                    ...codeField,
-                    ...(classification !== undefined ? { classification, classificationKnown } : {}),
-                    info: seatText("operator-log-text", String(err)),
-                };
-                logger.warn("runner_config_advisory", fields);
-                metrics.inc("runner_config_advisory_total", {
-                    ...codeField,
-                    ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
-                    level: "warn",
-                });
-                return;
-            }
-            metrics.inc("runner_error_total", { phase: ctx.phase });
-            logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, ...codeField, err: seatText("operator-log-text", String(err)) });
-        },
         ...(ctx.consolidationSeat !== undefined
             ? {
                 memoryConsolidation: {},

package/dist/boot/shutdown.d.ts

@@ -39,6 +39,12 @@ export interface ShutdownCtx {
     version: string;
     logger: Logger;
     server: ReturnType<typeof createHttpServer>;
+    /**
+     * 本机控制 socket 那只 `http.Server`(`server.controlSocketServer`)—— present-iff 它在听(起服第 10 段 `openControlSocket` 的结局)。
+     * 🔴 收尾序承重:两只 server **都**关完(close 回调落地)才 `backend.close()`(数据根锁在那条链里放)。运行时关 unix socket 监听口时按路径名 unlink;
+     * 锁若先放、控制口还在听,接班的引擎可在此刻替换路径,随后这边关口就删掉接班者的 socket(`control-socket.ts` 头注前提律)。
+     */
+    controlSocket?: import("node:http").Server | undefined;
     reaper: NodeJS.Timeout;
     /** [ref]:fleet 存活对账腿(60s 定时器 + 总线订阅)。与 `reaper` 同列文件头契约 3 —— 收尾期不该再有
      *  对账 tick 打向正在关闭的池,订阅也要摘(否则 bus 的扇出还在往一个已停的观察者写)。 */

package/dist/boot/shutdown.js

@@ -19,7 +19,8 @@ export function backgroundGraceRemainingMs(a) {
     return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
 }
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, webAdmin, version, deviceHub, toolApproval, parkCommits, servingLease, peerInbound, } = ctx;
+    const { config, logger, server, controlSocket, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, webAdmin, version, deviceHub, toolApproval, parkCommits, servingLease, peerInbound, } = ctx;
+    const httpListeners = controlSocket === undefined ? [server] : [server, controlSocket];
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -161,7 +162,8 @@ export function installShutdownHandlers(ctx) {
                 rateLimiter.stop();
             await fleetClient?.flushFinalUsage();
         });
-        server.close(() => {
+        const listenersClosed = Promise.all(httpListeners.map((s) => new Promise((resolve) => s.close(() => resolve())))).then(() => undefined);
+        void listenersClosed.then(() => {
             void Promise.all([retentionTeardown, ledgerStopped])
                 .then(() => (backend ? backend.close() : Promise.resolve()))
                 .then(() => routingStopped)
@@ -172,8 +174,12 @@ export function installShutdownHandlers(ctx) {
         const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: FINAL_EXIT_MS }); process.exit(0); }, FINAL_EXIT_MS);
         finalExit.unref?.();
         drainState.endSubscriptions?.();
-        server.closeIdleConnections?.();
-        const forceClose = setTimeout(() => server.closeAllConnections?.(), HARD_STOP_GRACE_MS);
+        for (const s of httpListeners)
+            s.closeIdleConnections?.();
+        const forceClose = setTimeout(() => {
+            for (const s of httpListeners)
+                s.closeAllConnections?.();
+        }, HARD_STOP_GRACE_MS);
         forceClose.unref?.();
     };
     let draining = false;

package/dist/boot/stage-02-web-admin-pull.js

@@ -5,13 +5,12 @@ import { configSourceKind } from "../config-provider.js";
 import { announceConfigRootEnclosingWorkspace } from "../sema-config-dir.js";
 import { launchWorkspaceOf } from "../task-cwd.js";
 import { buildCandidateRejectionNotes } from "../web-admin-client/candidate-gate.js";
-import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
 import { logEnvModelsMigration, runEnvModelsMigration } from "../config-root-migration.js";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 import { isRosterGateArmed } from "../config.js";
 import { judgeServedModelRoute } from "../model-route-endpoint.js";
-import { servedModelTableLeg } from "../model-select.js";
+import { modelRefusalLegOf, servedModelTableLeg } from "../model-select.js";
 import { warnAssumedContextWindows } from "../context-window-notice.js";
 import { captureBootStoreEvidence } from "./store-evidence.js";
 import { admitStoreDurability } from "../store-admission.js";
@@ -22,7 +21,6 @@ export async function runStage02(ctx) {
     const configSource = configSourceKind(loaded);
     if (configSource === "local") {
         await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: loaded.configLocalOwnerUid });
-        logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
     }
     const config = await composeExecutionLane(loaded, { configSource, localRoot, logger, entry: HTTP_SERVICE_LANE_ENTRY });
     admitStoreDurability(config, storeEvidence);
@@ -35,11 +33,12 @@ export async function runStage02(ctx) {
     const webAdmin = await createWebAdminRuntime({ config, logger, metrics, localRoot });
     const servedLeg = servedModelTableLeg(config);
     const rejection = webAdmin.candidateRejectionState();
-    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes: rejection === undefined ? undefined : buildCandidateRejectionNotes(rejection) }, servedLeg);
+    const webAdminIsConfigSource = configSource === "remote";
+    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes: rejection === undefined ? undefined : buildCandidateRejectionNotes(rejection) }, modelRefusalLegOf(servedLeg, webAdminIsConfigSource));
     if (noDefaultModel !== undefined) {
         throw new Error(noDefaultModel);
     }
-    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) });
+    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: isRosterGateArmed(config.webAdmin), webAdminIsConfigSource });
     if (routeVerdict !== undefined) {
         throw new Error(routeVerdict.reason);
     }

package/dist/boot/stage-05-execution-env.js

@@ -13,11 +13,12 @@ export async function runStage05(ctx) {
     const deviceLane = config.remoteExec.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, seat: sessionStore.executionPlacement, replicaId: instanceId }) : undefined;
     const headOf = headReadOf(sessionStore);
     const spaceCommits = backend !== undefined ? () => runStore : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, sessionBindings, fenceSessionOwner, dropSessionScoped, sessionResidentBackground, dropSessionScopedOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane: sandboxGitPlaneSeat, sandboxCapacity, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, sessionBindings, fenceSessionOwner, dropSessionScoped, sessionResidentBackground, dropSessionScopedOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxApiCredentialsGate, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane: sandboxGitPlaneSeat, sandboxCapacity, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
     assertDeviceLaneWired(config.remoteExec.provider === "device", deviceLane, executionEnvFactory !== undefined);
     if (deviceLane !== undefined && config.remoteExec.provider === "device")
         await noteDeviceRelayBindings(config.remoteExec.relay, deviceLane.store, logger);
     assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { headOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
+    sandboxApiCredentialsGate?.();
     if (sandboxSecretSeatGate !== undefined)
         await sandboxSecretSeatGate();
     await sandboxGitPlaneSeat.settle();

package/dist/boot/stage-06-runners.d.ts

@@ -1,6 +1,8 @@
 import { Runner } from "@sema-agent/core";
+import { type DeploymentPlaneDeps, type DeploymentPlaneLane } from "./runner-deps.js";
 import type { runStage05 } from "./stage-05-execution-env.js";
 export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): Promise<{
+    deploymentPlane: (lane: DeploymentPlaneLane) => DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;

package/dist/boot/stage-06-runners.js

@@ -3,6 +3,7 @@ import { Runner, InMemoryToolResultStore, TtlSessionStore, uuidv7, createAllowDe
 import { createEngineSessionRulesSeat } from "../session-rules-seat.js";
 import { outwardPlane } from "../terminal.js";
 import { createSessionTitler } from "../session-titler.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { sessionOccupantReadOf } from "../http/owner-access.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
@@ -21,7 +22,7 @@ import { CHECKPOINT_CTX_SEALING_REQUIRED } from "../http/checkpoint-ctx.js";
 import { sealCheckpointCtxCredentialsM28 } from "../checkpoint-ctx-seal-m28.js";
 import { retirePromptProfileM30 } from "../stored-request-prompt-profile-m30.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
-import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps, localOwnerRulesDeclared } from "./runner-deps.js";
+import { createDeploymentPlaneDeps, createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps, localOwnerRulesDeclared } from "./runner-deps.js";
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
@@ -36,6 +37,8 @@ export async function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, spaceReclaimer, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, heldParksHere, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore, getRunEndedHandoff: () => runEndedHandoff });
     backend?.bindWorkflowRunReader?.(workflowRunStore ?? "none");
+    const cardScopeRootOf = (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config);
+    backend?.bindCardScopeRoot?.(cardScopeRootOf);
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
     const parkCommits = parkCommitted?.watch;
@@ -56,7 +59,7 @@ export async function runStage06(ctx) {
         config, logger, backend, sendUserFileTaskEnvs, ruleConsent, parkCommits,
         ...(checkpointStore !== undefined ? { checkpointStore } : {}),
         getParkedRedeem: () => parkedAskRedeem,
-        ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
+        ruleScopeRootFor: cardScopeRootOf,
     });
     if (streamApprovalGate.active)
         await assertApprovalAskRuleMaterialOnBackend(backend);
@@ -164,11 +167,13 @@ export async function runStage06(ctx) {
         const pick = hookModelFor(model);
         if (!pick.ok)
             return pick;
+        const resolver = webAdmin.getKeyResolver();
         try {
             const result = await hookAgentRunner.runTask({
                 objective: prompt,
                 sessionId: uuidv7(),
                 model: pick.catalogRef,
+                getApiKeyAndHeaders: createPerModelAuthSeat(() => resolver),
                 ...(system !== undefined ? { systemPrompt: system } : {}),
                 handsReadOnly: true,
                 enableFork: false,
@@ -235,15 +240,16 @@ export async function runStage06(ctx) {
             engineDataRoot,
             peerDesk,
             runtimeCapsResolver,
+            onError: runnerDeps.onError,
         }),
         sessionStore: subRunnerSessions,
         onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
         loadProjectMemory: runnerDeps.loadProjectMemory ? runnerDeps.loadProjectMemory : undefined,
         probeInstructionSources: runnerDeps.probeInstructionSources ? runnerDeps.probeInstructionSources : undefined,
-        onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
+    const deploymentPlane = (lane) => createDeploymentPlaneDeps({ config, logger, metrics, brain, pricing, tracer, promptSource: webAdmin.promptSource, deploymentMods, usageWindowStore, governanceSeams, mcpRevocations, engineDataRoot, runtimeCapsResolver, onError: runnerDeps.onError }, lane);
     const settleErasedSessions = createSessionEraseSettler({ attachments: taskAttachmentStore, spaceReclaimer, logger });
-    return { ...ctx, sessionEraser, settleErasedSessions, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekReading, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowParkHolderPull, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
+    return { ...ctx, deploymentPlane, sessionEraser, settleErasedSessions, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekReading, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowParkDecisions, workflowParkHolderPull, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -24,6 +24,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -94,7 +94,7 @@ export async function runStage07(ctx) {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal === undefined ? undefined : personOf(recoveredSubject(principal)), config), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal === undefined ? undefined : personOf(recoveredSubject(principal)), config, "operate"), tenantId: principal ?? null }),
         })
         : undefined;
     const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;

package/dist/boot/stage-08-reapers.d.ts

@@ -37,6 +37,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;

package/dist/boot/stage-09-leader.d.ts

@@ -59,6 +59,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;

package/dist/boot/stage-09-leader.js

@@ -11,7 +11,7 @@ import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { seatText } from "../trace/exit-seat.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, checkpointCtxSealing, config, webAdmin, deploymentMods, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionEraser, sessionPolicyStore, sessionStore, settleErasedSessions, storePosture, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, deploymentPlane, backend, backgroundAgentStore, checkpointStore, checkpointCtxSealing, config, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, resumeAnchorStore, runStore, runnerDeps, sessionEraser, sessionPolicyStore, sessionStore, settleErasedSessions, storePosture, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, userInputLedgerStore, webAdmin, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, recoverPendingDeletions, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         dropSessionScoped,
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
@@ -31,7 +31,7 @@ export function runStage09(ctx) {
     bindSessionAgeOut(purgeSession !== undefined && ageOutStore !== undefined && facts.sessionKinds({ sessionStorage: ownerAware, purgeSession }).available
         ? createSessionAgeOut({ store: ageOutStore, purge: purgeSession, retentionMs: () => config.backgroundAgentRetentionMs, logger, metrics })
         : undefined);
-    const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError, deploymentMods });
+    const leaderEndpoint = createLeaderFace({ config, logger, localRoot, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, backend, deploymentPlane, getKeyResolver: () => webAdmin.getKeyResolver() });
     const drainState = { draining: false };
     const authBridgeIssuer = authBridgeIssuerOf(config)?.issuer;
     const webAdminJwtVerifier = authBridgeIssuer

package/dist/boot/stage-10-http-server.d.ts

@@ -1,11 +1,14 @@
 import { brainSummary } from "../brain.js";
 import { type ServiceConfig } from "../config.js";
 import type { runStage09 } from "./stage-09-leader.js";
+import { type ControlSocketUnavailableReason } from "../control-socket.js";
 /**
  * 启动协议行 `listening` 的字段(行本身是 `observability/logger.ts` 的 {@link import("../observability/logger.js").STARTUP_PROTOCOL_EVENTS} 一员:不随 `LOG_LEVEL`)。
  * 铸点 = 本文件 listen 之后那一行(全仓唯一,`test/source-hygiene-gate.test.ts` M7),字面量过 {@link exactListeningLine}(键集恰等于本型,可选键与条件展开同算);
  * 键集登记在自铸登记表 `listeningLineKey`(`satisfies Record<keyof ListeningLine, …>`:键加一个而登记表没跟 / 多一个 ⇒ tsc 红)。只登顶层键;`brain` 段里的键随 `brainSummary` 走,不在本型。
  *
+ * 本机控制 socket 两格(`controlSocket` / `controlSocketUnavailable`)恰一只在场:同一次开口结局(`control-socket.ts` 的 `openControlSocket`)的投影 —— 绑定的事实由绑定者报,与 `boundAddress` 同一条。
+ *
  * 绑址两格,一格一个事实:`bindHost` = 本进程**请求**绑的地址(`resolveBindHost` 的答案 —— `BIND_HOST` 经无鉴权自收窄之后的那一只;答案缺席 = 全接口时是说明串);`boundAddress` = 内核**实际**绑上的地址
  * (`server.address().address` 原样:`::` / `0.0.0.0` / `127.0.0.1` / `::1` …;配置写 `localhost` 时它是解析出的那一只)。口同理:`port` 读的也是绑定者自己的答案。
  */
@@ -14,6 +17,10 @@ export interface ListeningLine {
     readonly bindHost: string;
     readonly bindHostNote?: string;
     readonly boundAddress: string;
+    /** 本机控制 socket 的绝对路径 —— present-iff 它在听(与下一键恰一只在场;同一次开口结局的投影 `controlSocketLineKeysOf`)。 */
+    readonly controlSocket?: string;
+    /** 本机控制 socket 没开的原因词(闭集 `CONTROL_SOCKET_UNAVAILABLE_REASONS`)—— present-iff 它没在听。 */
+    readonly controlSocketUnavailable?: ControlSocketUnavailableReason;
     readonly model: ServiceConfig["model"]["id"];
     readonly brain: ReturnType<typeof brainSummary>;
     readonly breakerState: string;
@@ -90,6 +97,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     userInputLedger: import("../user-input-ledger.js").UserInputLedger | undefined;
     userInputLedgerStore: import("../user-input-ledger.js").UserInputLedgerStore | undefined;
     webSearchProvider: "brave" | "tavily" | "searxng" | undefined;
+    deploymentPlane: (lane: import("./runner-deps.js").DeploymentPlaneLane) => import("./runner-deps.js").DeploymentPlaneDeps;
     sessionEraser: import("../session-erase.js").SessionEraser | undefined;
     settleErasedSessions: import("../session-erase.js").SessionEraseSettler;
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;

package/dist/boot/stage-10-http-server.js

@@ -29,6 +29,7 @@ import { createRunnerDepsOnAsk } from "./runner-deps.js";
 import { installShutdownHandlers } from "./shutdown.js";
 import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
+import { controlSocketLineKeysOf, openControlSocket } from "../control-socket.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 function exactListeningLine(line) {
@@ -238,19 +239,6 @@ export async function runStage10(ctx) {
         metrics,
     });
     const bindHost = resolveBindHost(config);
-    if (config.bindHostSource === "HOST" && bindHost !== config.bindHost) {
-        logger.warn("bind_host_from_HOST_env_overridden", {
-            bindHost,
-            ignoredHostEnv: config.bindHost,
-            note: "HOST was inherited from the shell (zsh commonly sets it to the machine name) and would have bound the write face to a non-loopback address — but this deployment has ALLOW_UNAUTHED_WRITES with no service token, so the bind address was narrowed to loopback instead. Two ways out if you meant to expose it: set BIND_HOST explicitly, or configure a service token.",
-        });
-    }
-    else if (config.bindHostSource === "HOST") {
-        logger.warn("bind_host_from_HOST_env", {
-            bindHost,
-            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
-        });
-    }
     let onListenError;
     try {
         await new Promise((resolve, reject) => {
@@ -263,8 +251,6 @@ export async function runStage10(ctx) {
         logger.error("listen_failed", {
             port: config.port,
             bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
-            ...(config.bindHostSource ? { bindHostSource: config.bindHostSource } : {}),
-            ...(config.bindHostSource === "HOST" ? { note: "bind failed for a host inherited from the HOST env var — set BIND_HOST explicitly (e.g. BIND_HOST=127.0.0.1)." } : {}),
             error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)),
         });
         throw e;
@@ -279,6 +265,14 @@ export async function runStage10(ctx) {
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
+    const controlSocketServer = server.controlSocketServer;
+    controlSocketServer.on("error", (e) => {
+        logger.error("control_socket_error", {
+            error: seatText("operator-log-text", e.message),
+            ...("code" in e ? { code: String(e.code) } : {}),
+        });
+    });
+    const controlSocket = await openControlSocket(controlSocketServer, { exclusiveDataRoot: backend?.exclusiveDataRoot?.() });
     const fleetClient = startFleetClientFromConfig(config, {
         instanceId,
         version: serviceVersion(),
@@ -307,6 +301,7 @@ export async function runStage10(ctx) {
             ? { bindHostNote: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
             : {}),
         boundAddress: bound.address,
+        ...controlSocketLineKeysOf(controlSocket),
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
@@ -342,6 +337,7 @@ export async function runStage10(ctx) {
     }
     void installShutdownHandlers({
         config, logger, server, reaper, fleetReconcile, otelExporter, breakerState, costQuota, rateLimiter,
+        controlSocket: controlSocket.listening ? controlSocketServer : undefined,
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
         storeLiveProbe, webAdmin,

package/dist/boot/stores.js

@@ -9,7 +9,7 @@ import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/me
 import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugins/memory-engine-tidb.js";
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
-import { MinioBlobBackend } from "../plugins/blob-backend.js";
+import { createSessionBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -304,14 +304,17 @@ export async function openStores(ctx) {
         const mysqlPool = backend?.mysqlPool?.();
         const pgPool = backend?.pgPool?.();
         if (pgPool || mysqlPool) {
-            const minio = config.snapshotBlobStore;
-            if (!minio) {
+            const namespace = backend?.sessionBlobNamespace?.();
+            if (!config.snapshotBlobStore) {
                 logger.error("attachments_disabled_object_store_required", {
                     hint: "cloud deployments must configure object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) — attachment routes will 501 until it is set",
                 });
             }
+            else if (!namespace) {
+                throw new Error("object storage is configured but the store backend holds no session blob namespace — the attachment store's bytes have no namespace proven to be this database's (a store backend that does not implement sessionBlobNamespace())");
+            }
             else {
-                const bytes = new MinioBlobBackend({ ...minio, keyPrefix: `${minio.keyPrefix ?? ""}attachments/` });
+                const bytes = createSessionBlobBackend(namespace, "attachments");
                 if (pgPool) {
                     const q = async (text, params) => { const r = await pgPool.query(text, params); return { rows: r.rows }; };
                     await ensurePgTaskAttachmentSchema(q);