@sema-agent/server 7.18.0 → 7.19.0

package/dist/http/route-ctx.d.ts

@@ -109,6 +109,15 @@ export interface DriveResumeArgs {
      *  ask sees them — the decide leg's exemption grant). Contract: must not throw (callers swallow internally);
      *  awaited so the ordering guarantee is real, and a store write here is ms-scale vs the model leg. */
     onResumeCommitted?: () => Promise<void>;
+    /** [3829]/[3830]:调用方声明「本腿的 park 是终局后纯 park,session claim 已随终局 finalize 删除」——
+     *  getActiveTaskId 缺席时**铸新 canonical taskId + createRun 全生命周期行**(wake 续跑=同 session 新一轮
+     *  turn),而不是无行裸跑(不可取消/无计费归因/无 durable append/fleet 不可见,且 core `spec.taskId ??
+     *  sessionId` fallback 会把 lastRunId 铸成 sessionId)。`source` 进 run 行元数据(runMeta 同列)。
+     *  decide/answer/plan_review 腿**不设**此位:它们的 claim 在 park 期间特意保留,缺席=行被 reap 的竞态,
+     *  维持既有兜底(checkpoint token 同拍过期 ⇒ resumeStream 拒),不铸新行。 */
+    mintFreshRun?: {
+        source: string;
+    };
 }
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用

package/dist/http/server.js

@@ -13,7 +13,7 @@ import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
-import { recordTurnActivity } from "../turn-activity.js";
+import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -61,7 +61,7 @@ export { coarseStatusForState, errorCodeForExit };
 // (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
 import { sendJson, sendError, httpErrorCode, msg } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
-import { resumeEntryForGate } from "./active-run-conflict.js";
+import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 export { explicitOperatorOk, isOperator };
 /** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export function flattenServiceDeps(deps) {
@@ -1687,7 +1687,36 @@ export function createHttpServer(rawDeps) {
                 return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
             }
         }
-        const taskId = await deps.runStore?.getActiveTaskId(sessionId);
+        let taskId = await deps.runStore?.getActiveTaskId(sessionId);
+        // [3829]/[3830] wake 腿(mintFreshRun 声明位):task_done 纯 park 的终局 finalize 已删 task_active
+        // claim——本腿在此恒拿不到 taskId,曾经整腿无行裸跑(不可取消/无计费归因/无 durable append/fleet
+        // 不可见),而 core `spec.taskId ?? sessionId` fallback 还会把 lastRunId 铸成 sessionId(续听恒 404,
+        // cli 7.18 提货围栏首撞)。wake 续跑=同 session 新一轮 turn(原任务已终局),正确形=铸新 canonical
+        // taskId + createRun 全生命周期行;createRun 的 task_active 唯一键 claim 同时补上 double-text 互斥
+        // (getActiveTaskId 读后另一提交抢建行的竞态窗 ⇒ 与 sync 腿同形 409 真出路)。未声明该位的腿
+        // (decide/answer/plan_review)语义不变:claim 缺席=行被 reap 的竞态,checkpoint token 同拍过期兜底。
+        let freshRunClaimed = false;
+        // 🔴 codex R1-F1(2026-08-14):mintFreshRun 腿对「claim 有值」**只有 409 一条出路**,绝不落入下方的
+        // markResuming 复用臂。本腿的 park 是终局后纯 park——它自己的行早已终局并释放 claim,此刻 claim 里
+        // 的必是**别的 run**(典型:task_done park 之后同 session 又提交了新任务且其已 park 成 suspended,
+        // claim 保留)。旧路径会用**本 park 的旧 token**对**对方的行**赢下 markResuming CAS 并驱动续跑——
+        // 错误终局化对方的行、孤儿化对方仍 pending 的卡(checkpoint 表无 per-session pending 唯一约束,
+        // findPendingTokenBySession 又是无序 LIMIT 1,两条 pending 并存时旧 task_done park 完全可能被选中)。
+        if (args.mintFreshRun && taskId && deps.runStore) {
+            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, taskId) };
+        }
+        if (!taskId && args.mintFreshRun && deps.runStore) {
+            const freshId = uuidv7();
+            const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
+                source: args.mintFreshRun.source,
+                objectivePreview: resumeObjective ? redactSecrets(resumeObjective).slice(0, 120) : null,
+            });
+            if (!created.ok) {
+                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+            }
+            taskId = freshId;
+            freshRunClaimed = true;
+        }
         // MF-Fleet (TOC review #7): a HITL resume (/decide, /answer, /plan_review, /preempt-resume, /wake) drives the
         // SAME durable run row that suspended — so it must re-publish to the fleet bus under the SAME runId, or the run
         // VANISHES from GET /v1/fleet/stream the moment it resumes (the original publisher's row was last touched at
@@ -1773,7 +1802,9 @@ export function createHttpServer(rawDeps) {
             // approval (and released the session lock), the run is terminal, or a concurrent resume already claimed
             // it. Bail rather than run a resume whose run row is gone / a sibling owns; the checkpoint reaper expires
             // the token in the same tick so resumeStream would reject anyway. Closes the window the heartbeat can't.
-            claimedRow = await deps.runStore.markResuming(taskId);
+            // [3829]:fresh 行由上面的 createRun 事务铸出即 `running` + claim 在手——markResuming 的 CAS 只认
+            // suspended/needs_review,对它恒败;跳过=行本来就是本腿自己的,资格等价于 CAS 赢。
+            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId);
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
             // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): codex F3(2026-08-13)
@@ -2377,6 +2408,13 @@ export function createHttpServer(rawDeps) {
             // C: a plain Error (not CheckpointError, not a cancel) is about to propagate before the post-catch
             // `settleFleet(result.status)` can run → settle the re-published row to "failed" first so it doesn't leak
             // as a stale "running" (no-op if a CheckpointError/cancel branch above already settled it).
+            // 🔴 codex R1-F2(2026-08-14):行也要落终局,不只 fleet 帧——本腿在 markResuming/createRun 赢下行后
+            // 普通异常一路 throw 出去,行曾一直留 running+claim 在手直到 reapStale(期间 session 被锁死,最终被
+            // 误记 instance-lost)。cancel 分支(上方)早为同一理由落行,本臂是漏掉的孪生。claimedRow 守卫=只有
+            // 抢到行的腿才有资格驱终局(与 CheckpointError 臂同一条纪律)。
+            if (claimedRow && taskId && deps.runStore) {
+                await deps.runStore.setTerminal(taskId, "failed", null, e instanceof Error ? e.message : String(e)).catch(() => undefined);
+            }
             settleFleet("failed");
             throw e;
         }
@@ -2555,6 +2593,7 @@ export function createHttpServer(rawDeps) {
             resumeObjective,
             outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
             verifyRounds: undefined, // wake 续跑不重开 verify 门(原任务已终局;新工作要 verify 走新 run)
+            mintFreshRun: { source: "wake" }, // [3829]:终局纯 park 的 claim 已删,声明铸新行(注释见 DriveResumeArgs)
         });
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.18.0",
+  "version": "7.19.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.30.0",
+    "@sema-agent/core": "^5.31.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",