@sema-agent/server 7.34.0 → 7.35.0-rc.1

package/README.md

@@ -150,8 +150,8 @@ The server is configured entirely through environment variables. The most import
 | `MODEL_ID` | **required** | Default model id — **no factory default since 3.0.0**. Unset ⇒ the server refuses to boot with a message naming the knob (the old baked-in default was an internal-only model name, so every external deployment failed later and further from the cause: a gateway `400` plus a cascade of title-hook warnings). Set it to whatever model name your gateway serves, or supply the catalog via the config-center control plane |
 | `MODEL_API_KEY` | — | Gateway API key (optional) |
 | `SERVICE_AUTH_TOKEN` | — | Callers must send `Authorization: Bearer <token>` |
-| `DB_BACKEND` | `local`* | `mysql` (any MySQL-protocol DB: MySQL/TiDB/MariaDB; `tidb` alias) / `pg` (PostgreSQL) / `local` (file-backed, no DB) / `memory` (explicit in-memory: nothing survives a restart, durable-runs faces 501). *Bare boot (no DB env at all) defaults to `local` so a single-user machine keeps its runs across restarts; any SQL signal (`SESSION_BACKEND` or `TIDB_/MYSQL_/PG_HOST`) keeps the `mysql` engine default, and `REQUIRE_PRINCIPAL=true` bare boots stay `memory` (the local file store has no tenant isolation — a warning says so). A DEFAULT-derived `local` that cannot create its data root degrades to memory with a warning + the `store_backend_degraded` gauge; an EXPLICIT `DB_BACKEND=local` fails loud instead. Setting `mysql`/`pg` explicitly also switches sessions to durable |
-| `SESSION_BACKEND` | `memory`* | `memory` / `mysql` (durable session center; `tidb` alias) / `auto`. *Defaults to durable when `DB_BACKEND` is explicitly `mysql`/`pg` |
+| `DB_BACKEND` | `local`* | `mysql` (any MySQL-protocol DB: MySQL/TiDB/MariaDB) / `pg` (PostgreSQL) / `local` (file-backed, no DB) / `memory` (explicit in-memory: nothing survives a restart, durable-runs faces 501). *Bare boot (no DB env at all) defaults to `local` so a single-user machine keeps its runs across restarts; any SQL signal (`SESSION_BACKEND` or `TIDB_/MYSQL_/PG_HOST`) keeps the `mysql` engine default, and `REQUIRE_PRINCIPAL=true` bare boots stay `memory` (the local file store has no tenant isolation — a warning says so). A DEFAULT-derived `local` that cannot create its data root degrades to memory with a warning + the `store_backend_degraded` gauge; an EXPLICIT `DB_BACKEND=local` fails loud instead. Setting `mysql`/`pg` explicitly also switches sessions to durable |
+| `SESSION_BACKEND` | `memory`* | `memory` / `mysql` (durable session center) / `auto`. *Defaults to durable when `DB_BACKEND` is explicitly `mysql`/`pg` |
 | `REMOTE_EXEC` | unset | Sandbox execution lane: `host` / `local-docker` / `e2b` / `k8s` / `ssh` / `adb`; unset = in-process stub (with `CONFIG_PROVIDER=local` the default becomes `host`). Naming a lane without its required env (e.g. `e2b` without `E2B_API_KEY`) or an unrecognized value **refuses to start** — no silent downgrade to the host/in-process lane (#157 fail-closed) |
 | `CONFIG_PROVIDER` | unset | Config source: `local` (file-backed `config.d/`, single machine) / `remote` (registry control plane) |
 | `DEFAULT_SCENARIO` | `code` | Default scenario when the request body names none |

package/README.zh-CN.md

@@ -140,7 +140,7 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `MODEL_API_KEY` | — | 网关 key(可选) |
 | `SERVICE_AUTH_TOKEN` | — | 调用方需带 `Authorization: Bearer <token>` |
 | `DB_BACKEND` | `mysql` | SQL 引擎:`mysql`(任何 MySQL 协议库:MySQL/TiDB/MariaDB;`tidb` 为兼容别名)/ `pg`(PostgreSQL)/ `local`(免 DB 文件持久化)。显式设置 `mysql`/`pg` 时 session 自动转 durable |
-| `SESSION_BACKEND` | `memory`* | `memory` / `mysql`(durable 会话中心;`tidb` 别名)/ `auto`。*显式 `DB_BACKEND=mysql/pg` 时默认转 durable |
+| `SESSION_BACKEND` | `memory`* | `memory` / `mysql`(durable 会话中心)/ `auto`。*显式 `DB_BACKEND=mysql/pg` 时默认转 durable |
 | `REMOTE_EXEC` | 未设 | 沙箱执行通道:`host` / `local-docker` / `e2b` / `k8s` / `ssh` / `adb`;未设 = 进程内 stub(`CONFIG_PROVIDER=local` 时缺省转 `host`)。点名了通道但必需 env 不全(如 `e2b` 缺 `E2B_API_KEY`)或值不在闭集内 ⇒ **启动即拒**——不再静默降级到 host/进程内通道(#157 fail-closed) |
 | `CONFIG_PROVIDER` | 未设 | 配置来源:`local`(单机文件 `config.d/`)/ `remote`(registry 控制面) |
 | `DEFAULT_SCENARIO` | `code` | 请求体未指定场景时的缺省场景 |

package/dist/boot/coordinators.d.ts

@@ -24,6 +24,9 @@ export interface LiveCoordinatorsCtx {
     /** #154 车二:持久化权限规则的同意车道(main.ts 与 `RunnerDeps.permissionRuleStore` **同源**于
      *  `backend.permissionRule()` 的同一个返回值)。在场 ⇒ ask 帧投 `ruleSuggestions` + 回决可兑付。 */
     ruleConsent: RuleConsentLane | undefined;
+    /** #295(F-1):卡批规则的 project root 解析器(语义单点=task-cwd.ts `cardRuleScopeRoot`;main.ts
+     *  用 per-session cwd 登记簿 + config 铸)。缺席 ⇒ 不铸 scope,卡批规则落 core 的 global 缺省。 */
+    ruleScopeRootFor: ((sessionId: string | undefined) => string | undefined) | undefined;
 }
 export declare function createLiveCoordinators(ctx: LiveCoordinatorsCtx): {
     elicitation: ElicitationCoordinator | undefined;

package/dist/boot/coordinators.js

@@ -8,7 +8,7 @@ import { withLedgerRecording } from "../plugins/send-file-ledger.js";
 import { basename, resolve } from "node:path";
 import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
 export function createLiveCoordinators(ctx) {
-    const { config, logger, backend, sendUserFileTaskEnvs, ruleConsent } = ctx;
+    const { config, logger, backend, sendUserFileTaskEnvs, ruleConsent, ruleScopeRootFor } = ctx;
     // E23 (shell-host contract): inbound MCP elicitation coordinator (live-only HITL). Present ONLY when MCP_ELICITATION_ENABLED
     // — absent ⇒ onElicit is not wired ⇒ core advertises no elicitation capability to any server (fail-closed). Shared
     // by the runner (the onElicit seam) and the HTTP layer (the respond route + the per-run ALS context wraps).
@@ -74,6 +74,8 @@ export function createLiveCoordinators(ctx) {
             admitMaxPerOwner: config.streamApproval.admitMaxPerOwner,
             // #154 车二:同意车道(缺席 = 规则店没装配 ⇒ 帧上零候选、回决的 persistRule 如实拒)。
             ...(ruleConsent !== undefined ? { ruleConsent } : {}),
+            // #295(F-1):卡批规则 project root 解析器(缺席 ⇒ 落 global,修前行为)。
+            ...(ruleScopeRootFor !== undefined ? { ruleScopeRootFor } : {}),
             // #280 R-13 C:无人值守政策(闭集 park|deny)。**恒传**(不挂任何在场性推断):它是纯部署级的一位,
             // 语义/三问/射程边界一处成文见 `config-types.ts` 的 `unattendedApprovalPolicy` 域注。
             // ⚠️ 恒传是**刻意**的,不是顺手(codex R2-F2 点过这一行):`streamApprovalGate.active` 为假时只

package/dist/boot/resolve-spec.js

@@ -198,7 +198,7 @@ export function createResolveSpec(ctx) {
                     throw new HttpError(400, "`attachmentIds` exceeds the per-task limit (16)");
                 if (reqAtt.length > 0) {
                     if (!taskAttachmentStore)
-                        throw new HttpError(501, "attachmentIds require a store backend (DB_BACKEND=tidb|pg|local)");
+                        throw new HttpError(501, "attachmentIds require a store backend (DB_BACKEND=mysql|pg|local)");
                     if (!auth?.sessionId)
                         throw new HttpError(400, "`attachmentIds` requires a session-resolving deployment (no authorizer session)");
                     const sid = auth.sessionId;

package/dist/boot/stores.js

@@ -193,7 +193,7 @@ export async function openStores(ctx) {
         else {
             const pool = backend?.mysqlPool();
             if (!pool)
-                throw new Error("MEMORY_ENGINE_BACKEND=tidb requires DB_BACKEND=mysql/tidb — refusing to start half-configured");
+                throw new Error("MEMORY_ENGINE_BACKEND=tidb requires DB_BACKEND=mysql — refusing to start half-configured");
             await ensureTiDBMemoryEngineSchema(pool);
             await ensureTiDBMemoryHistorySchema(pool);
             await ensureTiDBMemorySyncSchema(pool); // 142-S2.5: sync_cursors(+push_queue)同池 ensure,幂等

package/dist/config.js

@@ -480,7 +480,7 @@ export const configLkgEnabled = () => boolEnvWithLegacyNegated("CONFIG_LKG_ENABL
 export const hostBackgroundShellEnabled = () => boolEnvWithLegacyNegated("HOST_BG_ENABLED", "HOST_BG_DISABLED", true);
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export const hostExecSpoolEnabled = () => boolEnvWithLegacyNegated("HOST_EXEC_SPOOL_ENABLED", "HOST_EXEC_SPOOL_DISABLED", true);
-/** Enum env with validation: a typo (e.g. SESSION_BACKEND=Tidb) FAILS at startup instead of being silently
+/** Enum env with validation: a typo (e.g. SESSION_BACKEND misspelled as `Tidb`) FAILS at startup instead of being silently
  *  cast to the union type and degrading to the default backend (dropping the persistence the operator asked for). */
 /** #246:READ_DENY_PATTERNS 的 env 形=JSON 数组,元素为 `"pattern"` 裸字符串简写或 {pattern, caseSensitive?}
  *  (与 core `ReadDenyEntry = string | {…}` 词表同宽——合并码扫 C6:USAGE 承诺了简写而 parser 只收对象形,
@@ -672,7 +672,7 @@ function parseStoreDomain(ctx) {
             },
         });
     }
-    // Asymmetry收编 (clay 2026-07-06, overseas-pilot pit #1): an EXPLICIT `DB_BACKEND=mysql/tidb/pg` is the operator
+    // Asymmetry收编 (clay 2026-07-06, overseas-pilot pit #1): an EXPLICIT `DB_BACKEND=mysql/pg` is the operator
     // asking for a durable SQL deployment — default sessions onto it (fail-fast, same as an explicit
     // SESSION_BACKEND=mysql) instead of silently keeping the in-memory default ("DB_BACKEND=pg engaged nothing,
     // session:memory, PG 0 tables"). DB_BACKEND=local keeps its own coercion in main.ts (it needs the built

package/dist/http/routes/admin-drain.d.ts

@@ -0,0 +1,22 @@
+/**
+ * #291(C17,[4470]/[4472] 认领,黑板 [4472] 原文即本口的契约):`POST /v1/admin/drain {reason}` ——
+ * 编排壳在发停机信号(SIGTERM)**之前**先调本口显式声明停机因由;server 记入 `drainState.reason`,
+ * draining 期间由 `/health`(`drainReason`)与 503 draining 体(`reason`)透出。未声明 = 两面键缺席
+ * (additive,不编数)——升级/缩容/驱逐在消费端因此可判别,而不是一律读成「实例没了」。
+ *
+ * 族属 = adoption / retention-ops 的 operator lane(同一条 `explicitOperatorOk` 门、billable=false、
+ * **刻意不吃 drain 503**——它正是 drain 开始前要调的口,吃了就自锁)。门序照 retention-ops 逐字:
+ * 身份 → 授权 → 验型。刻意**不进** `isCredentialGatedRewrite` 名单:那族的判据是「授权唯一输入是
+ * service token ∧ 爆炸半径跨租户持久改写」,本口只写一个进程内观测字段(重启即逝、零持久面),
+ * operator 门(空表恒拒,fail-closed)已是正确强度。
+ *
+ * reason 校验:非空 trim 后 string ≤ {@link MAX_DRAIN_REASON_CHARS} —— 它会进 /health 与 503 体
+ * (消费面是监控/壳),超长或怪型响亮拒([3425] 坏值立律),拒绝不留痕(不写半个值)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+export declare const ADMIN_DRAIN_PATH = "/v1/admin/drain";
+/** 上限与 approvals 的 reason 族同量级(消费面同为人读短句;非同一常量——两面语义无关,独立演化)。 */
+export declare const MAX_DRAIN_REASON_CHARS = 256;
+export declare function handleAdminDrain(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=admin-drain.d.ts.map

package/dist/http/routes/admin-drain.js

@@ -0,0 +1,44 @@
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
+/** 上限与 approvals 的 reason 族同量级(消费面同为人读短句;非同一常量——两面语义无关,独立演化)。 */
+export const MAX_DRAIN_REASON_CHARS = 256;
+const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable this endpoint)";
+export async function handleAdminDrain(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleAdminDrainBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+async function handleAdminDrainBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const path = url.split("?")[0] ?? url;
+    if (req.method !== "POST" || path !== ADMIN_DRAIN_PATH) {
+        miss.fell = true;
+        return;
+    }
+    // 门序 = operator 面的既有口径(routes/retention-ops.ts 逐字):身份 → 授权 → 验型。
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && !principal) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return;
+    }
+    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+        sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
+        return;
+    }
+    const body = (await ctx.helpers.readJson(req));
+    const reason = body?.reason;
+    if (typeof reason !== "string" || reason.trim().length === 0 || reason.length > MAX_DRAIN_REASON_CHARS) {
+        sendError(res, 400, "request.field_invalid", `body must be { reason: string } — a non-empty reason of at most ${MAX_DRAIN_REASON_CHARS} characters (it is surfaced verbatim on /health and the 503 draining body)`);
+        return;
+    }
+    if (!deps.drainState) {
+        // 无 drain 面的装配(嵌入/测试宿主)上声明无处可落——诚实 501,不吞成 200(声明了却不透出
+        // 比不能声明更糟:壳以为消费端能看到因由,实际两面永远缺席)。
+        sendError(res, 501, "capability.drain_state_required", "this deployment has no drain state wired (embedded host?) — the declared reason would have nowhere to surface");
+        return;
+    }
+    deps.drainState.reason = reason.trim();
+    sendJson(res, 200, { ok: true });
+}
+//# sourceMappingURL=admin-drain.js.map

package/dist/http/routes/runs.js

@@ -273,7 +273,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
     // Async run: create + return ids immediately, execute in the background.
     if (req.method === "POST" && url === "/v1/runs") {
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
             return;
         }
         // Idempotency-Key dedup (center blocker): a retried create returns the SAME taskId instead of starting a
@@ -1999,7 +1999,7 @@ idemKey) {
     const source = ctx.req.source;
     if (!deps.runStore) {
         // 防御性复检:两个调用方都在自己的入口先判过(各自面上的正确错误形不同),走到这里说明有人漏判。
-        sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
+        sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
         return null;
     }
     const runStore = deps.runStore;

package/dist/http/routes/sessions-list.js

@@ -27,7 +27,7 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
         }
         const lister = deps.sessionStorage?.listSessions?.bind(deps.sessionStorage) ?? deps.runStore?.listSessions?.bind(deps.runStore);
         if (!lister) {
-            sendError(res, 501, "capability.session_store_required", "session list requires a durable session store (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.session_store_required", "session list requires a durable session store (DB_BACKEND=mysql|pg)");
             return;
         }
         // [4198] 窄互认第二臂(列表面)—— 条件①③ 在此判,条件②(`owner === null`)由 store 的
@@ -57,7 +57,7 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
             return;
         }
         if (!deps.sendFileLedger) {
-            sendError(res, 501, "capability.store_required", "sendfile ledger requires a store backend (DB_BACKEND=tidb|pg|local) and the SendUserFile issuer configured");
+            sendError(res, 501, "capability.store_required", "sendfile ledger requires a store backend (DB_BACKEND=mysql|pg|local) and the SendUserFile issuer configured");
             return;
         }
         // F6 (codex audit): STRICT query validation — a malformed limit used to silently degrade to the default

package/dist/http/routes/sessions.js

@@ -257,7 +257,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
             const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
             if (!getLeafId || !ownerOf) {
-                sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (SESSION_BACKEND=tidb|pg|local)");
+                sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg)");
                 return;
             }
             const headSession = decodeURIComponent(hm[1]);
@@ -310,7 +310,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
             const watch = deps.sessionWatch;
             if (!deps.sessionStorage?.getLeafId || !ownerOf || !watch) {
-                sendError(res, 501, "capability.session_store_required", "session events require a durable session store (SESSION_BACKEND=tidb|pg|local)");
+                sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg)");
                 return;
             }
             const evSession = decodeURIComponent(em[1]);
@@ -579,7 +579,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             const fork = deps.sessionStorage?.fork?.bind(deps.sessionStorage);
             const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
             if (!fork || !ownerOf) {
-                sendError(res, 501, "capability.session_store_required", "session fork requires a durable session store (SESSION_BACKEND=tidb)");
+                sendError(res, 501, "capability.session_store_required", "session fork requires a durable session store (DB_BACKEND=mysql|pg)");
                 return;
             }
             const scope = sessionOwnerScopeForWrite(req);
@@ -638,7 +638,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             const purge = deps.purgeSession;
             const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
             if (!purge || !ownerOf) {
-                sendError(res, 501, "capability.session_store_required", "session delete requires a durable session store (SESSION_BACKEND=tidb)");
+                sendError(res, 501, "capability.session_store_required", "session delete requires a durable session store (DB_BACKEND=mysql|pg)");
                 return;
             }
             const scope = sessionOwnerScopeForWrite(req);

package/dist/http/routes/tasks.js

@@ -354,7 +354,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // result.taskId re-stamp) is gated on `runStore` ALONE; the durable-suspend resume ctx (`putCtx`) on
                 // `checkpointStore`. They were bundled under ONE checkpointStore gate, over-coupling REWIND to
                 // DURABLE_APPROVAL — but E18 resume-at needs NO checkpoint (main.ts:815). Now matches the /v1/runs bg path:
-                // rewind works with just runStore (DB_BACKEND=tidb/pg), no approval. Claim-first preserved (session locked
+                // rewind works with just runStore (DB_BACKEND=mysql|pg|local), no approval. Claim-first preserved (session locked
                 // submit→resume; a concurrent submit → 409, never a silent 2nd leg, and a rejected submit never clobbers the ctx).
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = earlyDurableTid ?? uuidv7(); // reuse the id already emitted as the X-Task-Id header (defensive mint if absent)
@@ -1301,7 +1301,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // re-stamp) is gated on `runStore` ALONE; the durable-suspend resume ctx (`putCtx`) on `checkpointStore`. These
                 // were bundled under ONE checkpointStore gate, which over-coupled REWIND to DURABLE_APPROVAL — but E18 resume-at
                 // needs NO checkpoint (main.ts:815). Now matches the already-decoupled /v1/runs bg path: rewind works with just
-                // runStore (DB_BACKEND=tidb/pg), no approval. Claim-first preserved (a lost claim → 409, never a silent 2nd leg).
+                // runStore (DB_BACKEND=mysql|pg|local), no approval. Claim-first preserved (a lost claim → 409, never a silent 2nd leg).
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = uuidv7();
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));

package/dist/http/routes/trace-usage.js

@@ -52,7 +52,7 @@ async function handleTraceUsageBody(req, res, url, ctx, miss) {
             return;
         }
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
             return;
         }
         const q = new URL(req.url ?? "", "http://x").searchParams;
@@ -72,7 +72,7 @@ async function handleTraceUsageBody(req, res, url, ctx, miss) {
             return;
         }
         if (!deps.runStore) {
-            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg) (SESSION_BACKEND=tidb)");
+            sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
             return;
         }
         const query = new URL(req.url ?? "", "http://x").searchParams;

package/dist/http/server.d.ts

@@ -430,6 +430,7 @@ export interface ServiceDeploymentDeps {
     drainState?: {
         draining: boolean;
         since?: number;
+        reason?: string;
         inflight?: () => number;
         lastActivityAt?: () => number;
     };

package/dist/http/server.js

@@ -40,6 +40,7 @@ import { handleObservability } from "./routes/observability.js";
 import { handleDiagnostics } from "./routes/diagnostics.js";
 import { handleAdoption } from "./routes/adoption.js";
 import { handleRetention } from "./routes/retention-ops.js";
+import { handleAdminDrain } from "./routes/admin-drain.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
 import { handleMemoryBundle } from "./routes/memory-bundle.js";
 import { handleSharedMemory } from "./routes/shared-memory.js";
@@ -213,6 +214,7 @@ const ROUTE_DOMAINS = [
     handleDiagnostics,
     handleAdoption,
     handleRetention,
+    handleAdminDrain,
     handleMemoryPolicy,
     handleMemoryBundle,
     handleRules,
@@ -454,7 +456,8 @@ export function createHttpServer(rawDeps) {
                 // shell/orchestrator (same source as GET /v1/capabilities.version; absent only if capabilities wiring is).
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 // additive draining flag — k8s readiness / shell Lifecycle Manager摘流 signal. Absent when not draining.
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}) } : {}),
+                // #291:drainReason = POST /v1/admin/drain 声明的停机因由(additive,未声明=键缺席)。
+                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
                 // S5: additive degradation flag — present ONLY when the boot auto-probe fell back to in-memory, so a
                 // healthy worker's /health shape is unchanged. durable:false = "this replica is NOT persisting although
                 // a DB was configured" (the orchestrator's restart/alarm signal; an in-memory-by-choice worker omits it).
@@ -629,7 +632,8 @@ export function createHttpServer(rawDeps) {
             // errorCode 补齐(2026-07-28 核查:cli 的 pre-stream drain 重试只能靠 `error` 文案字面判型——
             // SDK 的 code 臂恒 undefined 是死码;server 改文案=对端重试静默失效)。`error:"draining"` 字面
             // 自此视为**冻结的 wire 契约**(旧消费端判的就是它),errorCode 是机器码正门。
-            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" });
+            // #291:`reason` = 声明的停机因由(additive 键;`message` 字面冻结不动——SDK/壳按 error:"draining" 判)。
+            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance", ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}) });
             return;
         }
         // boot ready 门(b)(E3 workers.model 废除的 fail-closed 半场):registry 部署且无显式 env 模型时,
@@ -703,6 +707,10 @@ export function createHttpServer(rawDeps) {
         // 同样 billable=false 且刻意不吃 drain / model-roster-pending 两道 503)。
         if (await handleRetention(req, res, url, ctx))
             return;
+        // #291(C17):停机因由声明口(routes/admin-drain.ts,operator lane;POST /v1/admin/drain)。
+        // 同族(operator 门、billable=false、不吃 drain 503——它正是 drain 前要调的口),位置跟着 retention。
+        if (await handleAdminDrain(req, res, url, ctx))
+            return;
         // design/158 A9:memory 导出/同步 + /v1/policy 只读面(routes/memory-policy.ts)。
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
@@ -3386,6 +3394,8 @@ const ROUTE_LABEL_LITERALS = new Set([
     // design/183:收编发起口(operator-only,一次性部署级动作)。低频、但它的 duration 与失败率是
     // 迁移现场唯一的机器信号,落进 `other` 桶就看不见了。
     "/v1/adoption",
+    // #291:停机因由声明口(operator-only,drain 前一次性动作)。同 adoption 判:低频但只在停机现场被打。
+    "/v1/admin/drain",
     // #154 车二:CC settings 导入两口。字面量(无 id 段)⇒ 进 LITERALS 表而不是模式表。
     // 🔴 写**字面量**而不是引 `RULES_CC_IMPORT_*_PATH` 常量:名册门与 billable 申明门都是**扫源码文本**
     // 的(它们正则抓本表里的双引号词),引常量会让两条新路由对两道门隐形 —— 那不是「过了门」,是绕过门。

package/dist/main.js

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { Runner, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
@@ -8,6 +8,7 @@ import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js
 import { subagentSendUserFileExtraTools } from "./capabilities/send-user-file-tool.js";
 import { brainSummary } from "./brain.js";
 import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv, numEnv } from "./config.js";
+import { cardRuleScopeRoot } from "./task-cwd.js";
 import { isPricingConfigured } from "./budget.js"; // 缝合审 M3:capabilities.pricingConfigured 的单一真源判据
 import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
 import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
@@ -241,7 +242,12 @@ async function main() {
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     // design/158 A10:活体协调器 + SendUserFile 工具面搬到 src/boot/coordinators.ts(逐字;durableEnabled 的
     // 「必须早于 runnerDeps 求值」次序契约见该文件头注)。
-    const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs, ruleConsent });
+    const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
+        config, logger, backend, sendUserFileTaskEnvs, ruleConsent,
+        // #295(F-1,[4512] 修向 (b')):卡批「不再询问」的 project root——语义单点见 task-cwd.ts
+        // `cardRuleScopeRoot` 顶注(session 注册 cwd ?? in-process 单用户形 process.cwd();其余 undefined)。
+        ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config, (p) => realpathSync(p)),
+    });
     // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
     // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。

package/dist/observability/fail-open.d.ts

@@ -53,6 +53,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "CC 规则导入票的**认领回滚**失败(认领之后的某一步没成 ⇒ 本该把认领放回去,而这次放回本身也抛了)。放行的最坏后果 = 这张票留在已认领态、属主这一轮不能重试 —— 恰好等于加认领回滚**之前**的行为,不是新损失;票随 TTL 自然消失,属主重走一次 prepare 即可拿新票(导入按 core 的设计幂等:同一条规则再兑付只是同一个 dot 的重放)。方向上没有任何权限被放宽(规则**没有**落地才走到这条臂),故 F 类;必须留痕,否则「票为什么突然不能用了」在遥测里没有任何痕迹。";
     };
+    readonly "server.approvals.rule-scope-root-unresolvable": {
+        readonly cls: "F";
+        readonly note: "#295(F-1):卡批「不再询问」铸卡时解析授权发生地 root,realpath 失败(目录已删/权限/竞窗)。放行的最坏后果=**这一次**卡批落 global scope(= 7.34.0 及以前的全量行为,方向不比修前宽);不放行的代价=为一个几乎不可达的文件系统瞬态拒掉人已明说的「不再询问」,或铸一个未规范化、与规则判定时 kernel-resolved cwd 不同形的 root(静默恒不命中=把同意变哑)。故 F 类兜底+留痕:遥测里该 tag 计数>0 即说明有部署在这条臂上落了 global,可循 probe 定位。";
+    };
     readonly "server.approvals.rule-suggestions-cell-unreadable": {
         readonly cls: "F";
         readonly note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.rule_suggestions` 这一格**不是合法 JSON 文本**(手改过的行 / 未来列语义漂了 / 回滚残留)。放行的最坏后果 = **这一行**的「不再询问」候选缺席(展示/分诊材料,永不参与 resume、也不是任何判据),队列其余部分照常;不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空)。故 F 类,但必须留痕:静默吞掉之后「候选为什么消失了」在遥测里没有任何痕迹,而本键存在的全部理由就是「缺席 = 真的没有候选」。";

package/dist/observability/fail-open.js

@@ -76,6 +76,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "CC 规则导入票的**认领回滚**失败(认领之后的某一步没成 ⇒ 本该把认领放回去,而这次放回本身也抛了)。放行的最坏后果 = 这张票留在已认领态、属主这一轮不能重试 —— 恰好等于加认领回滚**之前**的行为,不是新损失;票随 TTL 自然消失,属主重走一次 prepare 即可拿新票(导入按 core 的设计幂等:同一条规则再兑付只是同一个 dot 的重放)。方向上没有任何权限被放宽(规则**没有**落地才走到这条臂),故 F 类;必须留痕,否则「票为什么突然不能用了」在遥测里没有任何痕迹。",
     },
+    "server.approvals.rule-scope-root-unresolvable": {
+        cls: "F",
+        note: "#295(F-1):卡批「不再询问」铸卡时解析授权发生地 root,realpath 失败(目录已删/权限/竞窗)。放行的最坏后果=**这一次**卡批落 global scope(= 7.34.0 及以前的全量行为,方向不比修前宽);不放行的代价=为一个几乎不可达的文件系统瞬态拒掉人已明说的「不再询问」,或铸一个未规范化、与规则判定时 kernel-resolved cwd 不同形的 root(静默恒不命中=把同意变哑)。故 F 类兜底+留痕:遥测里该 tag 计数>0 即说明有部署在这条臂上落了 global,可循 probe 定位。",
+    },
     "server.approvals.rule-suggestions-cell-unreadable": {
         cls: "F",
         note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.rule_suggestions` 这一格**不是合法 JSON 文本**(手改过的行 / 未来列语义漂了 / 回滚残留)。放行的最坏后果 = **这一行**的「不再询问」候选缺席(展示/分诊材料,永不参与 resume、也不是任何判据),队列其余部分照常;不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空)。故 F 类,但必须留痕:静默吞掉之后「候选为什么消失了」在遥测里没有任何痕迹,而本键存在的全部理由就是「缺席 = 真的没有候选」。",

package/dist/plugins/session-store.js

@@ -12,7 +12,7 @@ import { CachingSessionStore } from "./caching-session-store.js";
 export function createSessionStore(config, backend, metrics) {
     if (config.sessionBackend === "tidb") {
         if (!backend)
-            throw new Error("a DB session backend requires a store backend (SESSION_BACKEND=tidb + a reachable DB).");
+            throw new Error("a DB session backend requires a store backend (DB_BACKEND=mysql|pg + a reachable DB).");
         const store = backend.session();
         return config.sessionCacheTtlSec > 0
             ? new CachingSessionStore(store, { ttlSec: config.sessionCacheTtlSec, onConflictEvict: metrics ? () => metrics.inc("stale_cache_conflict_total") : undefined })

package/dist/task-cwd.d.ts

@@ -32,6 +32,24 @@ export declare function inProcessSingleUserLane(config: {
     };
     requirePrincipal?: boolean;
 }): boolean;
+/**
+ * #295(F-1,[4512] 修向 (b')):卡批「不再询问」落盘规则的 **project root** —— 「这次授权是在哪个
+ * 工作目录里点的」。取值与既有 cwd 语义同源,不新造坐标系:
+ *   1. session 显式注册的 cwd(cwd seam,host lane;与 {@link effectiveHostWorkspace} 第 1 优先级同源);
+ *   2. in-process 单用户 lane({@link inProcessSingleUserLane}):引擎自身 `process.cwd()` ——
+ *      壳把引擎 spawn 在用户目录的本地形([851]P3a 的 PROCESS 级消费者口径,hooks/C4 同判);
+ *   3. 其余(远程沙箱 / REMOTE_EXEC=host 未注册 / 多租户)⇒ `undefined`:root 在 server 坐标系里
+ *      不可知,调用方**不铸 scope**,落 core 的 global 缺省(= #295 修前行为,恒不更宽;也绝不铸一个
+ *      与规则判定时 cwd 不同坐标系的 root —— 那会静默把「不再询问」变成恒不命中)。
+ * 出口一律 realpath 规范化(`PersistedAllowRule.scope` 的 JSDoc 契约:root 由构造方 canonicalize;
+ * macOS `/tmp`→`/private/tmp` 族)——解析失败 ⇒ `undefined`(宁可落 global,不落一个歪 root)。
+ */
+export declare function cardRuleScopeRoot(registeredCwd: string | undefined, config: {
+    remoteExec?: {
+        provider?: string;
+    };
+    requirePrincipal?: boolean;
+}, realpath: (p: string) => string, cwd?: () => string): string | undefined;
 /** Is a requested cwd ALREADY the engine process's working dir? realpath BOTH sides (macOS `/tmp` →
  *  `/private/tmp`-class symlinks); either side failing to resolve ⇒ treated as a mismatch (warn — never a
  *  false downgrade). `realpath`/`cwd` are parameters for testability; production passes `fs.realpathSync`. */

package/dist/task-cwd.js

@@ -16,6 +16,7 @@
  * shell never pretends it took effect.
  */
 import path from "node:path";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Cap on a cwd path length (defensive — a row/path label bound; a real path is far shorter). */
 export const MAX_CWD_CHARS = 4_096;
 /** Is this a structurally-valid absolute host path? Rejects: non-strings, relative paths (TOC review #12 — a
@@ -51,6 +52,32 @@ export function cwdHonored(config) {
 export function inProcessSingleUserLane(config) {
     return config.remoteExec === undefined && config.requirePrincipal !== true;
 }
+/**
+ * #295(F-1,[4512] 修向 (b')):卡批「不再询问」落盘规则的 **project root** —— 「这次授权是在哪个
+ * 工作目录里点的」。取值与既有 cwd 语义同源,不新造坐标系:
+ *   1. session 显式注册的 cwd(cwd seam,host lane;与 {@link effectiveHostWorkspace} 第 1 优先级同源);
+ *   2. in-process 单用户 lane({@link inProcessSingleUserLane}):引擎自身 `process.cwd()` ——
+ *      壳把引擎 spawn 在用户目录的本地形([851]P3a 的 PROCESS 级消费者口径,hooks/C4 同判);
+ *   3. 其余(远程沙箱 / REMOTE_EXEC=host 未注册 / 多租户)⇒ `undefined`:root 在 server 坐标系里
+ *      不可知,调用方**不铸 scope**,落 core 的 global 缺省(= #295 修前行为,恒不更宽;也绝不铸一个
+ *      与规则判定时 cwd 不同坐标系的 root —— 那会静默把「不再询问」变成恒不命中)。
+ * 出口一律 realpath 规范化(`PersistedAllowRule.scope` 的 JSDoc 契约:root 由构造方 canonicalize;
+ * macOS `/tmp`→`/private/tmp` 族)——解析失败 ⇒ `undefined`(宁可落 global,不落一个歪 root)。
+ */
+export function cardRuleScopeRoot(registeredCwd, config, realpath, cwd = process.cwd) {
+    const raw = registeredCwd ?? (inProcessSingleUserLane(config) ? cwd() : undefined);
+    if (raw === undefined)
+        return undefined;
+    try {
+        return realpath(raw);
+    }
+    catch (err) {
+        // F 类兜底(#157 纪律):这一臂的放行方向=落 global(修前行为),但必须留痕——遥测里读得出
+        // 「有部署正在这条臂上退回 global」。语义与代价的完整三问见 fail-open.ts 的 tag 登记行。
+        recordFailOpen("server.approvals.rule-scope-root-unresolvable", `raw=${raw} err=${String(err)}`);
+        return undefined;
+    }
+}
 /** Is a requested cwd ALREADY the engine process's working dir? realpath BOTH sides (macOS `/tmp` →
  *  `/private/tmp`-class symlinks); either side failing to resolve ⇒ treated as a mismatch (warn — never a
  *  false downgrade). `realpath`/`cwd` are parameters for testability; production passes `fs.realpathSync`. */

package/dist/tool-approval.d.ts

@@ -471,6 +471,12 @@ export declare class ToolApprovalCoordinator {
      *  (memory: operator-knob-must-be-unconditional —— #153 shellGate 让部署级旋钮的生死由客户端表态
      *  决定,同病两犯过一次)。安全轴:`deny` 是收紧方向(不放行任何东西),fail-closed 铁律不受损。 */
     private readonly unattendedPolicy;
+    /** #295(F-1,[4512] 修向 (b')):卡批「不再询问」落盘规则的 **project root 解析器**。铸卡素材时以
+     *  ask 的 `sessionId` 咨询一次——「这次授权是在**哪里**点的」在授权发生时捕获,不在回决时再猜。
+     *  回 `undefined` = 该部署形上 run 的 workspace root 不可知(远程沙箱/多租户等)⇒ 不铸 scope,落
+     *  core 的 global 缺省(= 现行为,恒不更宽;也绝不错铸一个坐标系不对的 root)。装配见 main.ts:
+     *  registry cwd(host lane 显式注册的 launch dir)?? in-process 单用户形的 `process.cwd()`。 */
+    private readonly ruleScopeRootFor;
     constructor(opts?: {
         ttlMs?: number;
         askStore?: ApprovalAskStore;
@@ -483,6 +489,8 @@ export declare class ToolApprovalCoordinator {
         ruleConsent?: RuleConsentLane;
         /** #280 R-13 C:无人值守政策(见 {@link ToolApprovalCoordinator.unattendedPolicy});缺省 `park`。 */
         unattendedPolicy?: UnattendedApprovalPolicy;
+        /** #295:卡批规则的 project root 解析器(见 {@link ToolApprovalCoordinator.ruleScopeRootFor})。 */
+        ruleScopeRootFor?: (sessionId: string | undefined) => string | undefined;
     });
     /**
      * #280 R-13 C —— 「**无人可答**」这一类终局的**唯一**成形口(park 路由 vs deny 政策)。

package/dist/tool-approval.js

@@ -396,8 +396,15 @@ export class ToolApprovalCoordinator {
      *  (memory: operator-knob-must-be-unconditional —— #153 shellGate 让部署级旋钮的生死由客户端表态
      *  决定,同病两犯过一次)。安全轴:`deny` 是收紧方向(不放行任何东西),fail-closed 铁律不受损。 */
     unattendedPolicy;
+    /** #295(F-1,[4512] 修向 (b')):卡批「不再询问」落盘规则的 **project root 解析器**。铸卡素材时以
+     *  ask 的 `sessionId` 咨询一次——「这次授权是在**哪里**点的」在授权发生时捕获,不在回决时再猜。
+     *  回 `undefined` = 该部署形上 run 的 workspace root 不可知(远程沙箱/多租户等)⇒ 不铸 scope,落
+     *  core 的 global 缺省(= 现行为,恒不更宽;也绝不错铸一个坐标系不对的 root)。装配见 main.ts:
+     *  registry cwd(host lane 显式注册的 launch dir)?? in-process 单用户形的 `process.cwd()`。 */
+    ruleScopeRootFor;
     constructor(opts) {
         this.ruleConsent = opts?.ruleConsent;
+        this.ruleScopeRootFor = opts?.ruleScopeRootFor;
         this.governanceAskMarks = opts?.governanceAskMarks;
         this.ttlMs = opts?.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
         this.askStore = opts?.askStore;
@@ -504,7 +511,7 @@ export class ToolApprovalCoordinator {
             return false;
         return a.every((x, i) => x.rule === b[i].rule && x.match === b[i].match && x.command === b[i].command);
     }
-    buildRuleLaneMaterial(req, owner, governanceForced) {
+    buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
             return undefined;
         // 🔴 **治理档的 ask 不进规则车道**(#204 件7)。`governanceForced` 的语义(wire 契约逐字)是「这只
@@ -545,11 +552,15 @@ export class ToolApprovalCoordinator {
         if (typeof command !== "string" || command === "")
             return undefined;
         const boundInputHash = readBoundInputHash(req);
+        // #295(F-1):root 在**铸卡时**咨询——素材是「这次授权」的快照,scope 属于快照的一部分(回决可能
+        // 发生在断连重连/另一副本上,那时再解析等于让落盘 scope 取决于回决路径,而不是授权发生地)。
+        const scopeRoot = this.ruleScopeRootFor?.(sessionId);
         return {
             command,
             suggestions,
             ...(typeof req.toolCallId === "string" && req.toolCallId !== "" ? { toolCallId: req.toolCallId } : {}),
             ...(boundInputHash !== null ? { boundInputHash } : {}),
+            ...(scopeRoot !== undefined ? { scopeRoot } : {}),
         };
     }
     /** #241([3731]/[3730] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
@@ -961,7 +972,7 @@ export class ToolApprovalCoordinator {
         // 候选**基数**同批从 ≤1 变成 ≤2(reviewed 前缀候选,`exact` 恒 index 0)——本层逐字透传整只数组,
         // 不截长不重排;兑付口按**人报的文本**定位(`rules-consent.ts` 的 `findIndex`,不是 `[0]`)。
         // `let`:上面那条并集裁定可能在对账后把它撤回 undefined(行说这是治理门)。
-        let ruleLaneMaterial = this.buildRuleLaneMaterial(req, primary.owner, governanceForced);
+        let ruleLaneMaterial = this.buildRuleLaneMaterial(req, primary.owner, governanceForced, primary.sessionId);
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -1968,6 +1979,9 @@ export class ToolApprovalCoordinator {
                 ruleText,
                 ...(material.toolCallId !== undefined ? { toolCallId: material.toolCallId } : {}),
                 ...(material.boundInputHash !== undefined ? { boundInputHash: material.boundInputHash } : {}),
+                // #295(F-1,[4512] (b')):授权发生地已知 ⇒ 落 project scope;未知 ⇒ 键缺席,core 落 global
+                // (= 修前行为;绝不在坐标系不明时编一个 root)。root 语义与撤销面判别式串 `project:<root>` 同源。
+                ...(material.scopeRoot !== undefined ? { scope: { kind: "project", root: material.scopeRoot } } : {}),
             });
             if (!persisted.ok) {
                 defaultLogger.warn("permission rule was not persisted after an approval", { reason: persisted.reason, detail: persisted.detail });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.34.0",
+  "version": "7.35.0-rc.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",

package/dist/boot/lexical-path-env.d.ts

@@ -1,10 +0,0 @@
-import { FileError, StubExecutionEnv, type Result } from "@sema-agent/core";
-/**
- * 无文件系统的路径裁决 env(见文件头)。只覆写 `absolutePath` 一面,其余全部继承 `StubExecutionEnv`
- * 的 `not_supported` ——**继承而非逐一手写**是刻意的:core 日后给 `ExecutionEnv` 加必填面时,新面会
- * 随 `StubExecutionEnv` 一起到位并保持同一个诚实答案,不会在这里留下一个悄悄编出来的假答案。
- */
-export declare class LexicalPathExecutionEnv extends StubExecutionEnv {
-    absolutePath(path: string): Promise<Result<string, FileError>>;
-}
-//# sourceMappingURL=lexical-path-env.d.ts.map