@sema-agent/server 7.41.0 → 7.42.0

package/USAGE.md

@@ -243,6 +243,12 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
   行与编号高水位一并抹掉(同 anchors/附件/快照的级联)——会话 id 可被重新认领,残留就等于把上一位
   主人的任务标题与编号进度交给下一个化身。
 - 多实例边界:同一数据根同时只允许一个实例(BootLock 独占,第二个进程拒启;死主自愈含 SIGKILL)。
+  core 5.54.0 起拒启错误带**可分派 code**(`FileStoreLockError`,message 点名占用方 pid),运维按码
+  三动作:`store.dir_in_use`=另一个活进程持有该目录 → 停掉它(或换数据根/迁 SQL 后端);
+  `store.dir_claiming`=另一进程正在接管崩溃者留下的锁 → **瞬态,稍候重试**(接管方要么完成要么
+  自己也被收割);`store.lock_unreadable`=锁文件坏形(无 owner 可解析/嵌套接管残留)→ 人工处置,
+  message 会点名要删的文件,**不要盲删数据根下其它东西**。server 刻意不 catch 这族错(fail-fast:
+  两进程共用 file 数据目录是禁止形,静默容忍比拒启更坏)。
   `DB_BACKEND=memory` 并非全无盘:workflow 相关账本仍挂数据根下——多个 memory 形引擎**不要共用**
   数据根/HOME(1.309 起并发 boot 不再拒启,但账本内容级共享仍不受支持)。
 

package/dist/leader/merge.js

@@ -16,6 +16,12 @@ export async function mergeBranches(reports, baseSha, deps) {
     let destroy;
     // Track the current stage so a THROWN error is attributed to the right phase (not always "provision").
     let phase = "diff-out";
+    // [4953]② declared OUTSIDE the try (same pattern as `phase`) so the catch-all can still disclose them:
+    // spend/repair/measure that already HAPPENED must ride the thrown-failure return too — the leader folds
+    // conflictResolverCostUsd into the next round's budget, and a throw doesn't un-spend it.
+    let conflictResolverCostUsd = 0; // 🔴 capture the bounded conflict-resolver agent's spend (was dropped → S1 TEAM-cost undercount)
+    let repairMeta;
+    let measure;
     try {
         // 1. pull each worker's diff OUT of its container (M2). A failed diff quarantines that worker, aborts merge.
         const patches = [];
@@ -39,7 +45,6 @@ export async function mergeBranches(reports, baseSha, deps) {
         // 3. apply each patch --3way (council#3: keeps conflict context; capture .rej on failure, quarantine).
         phase = "apply";
         const conflictsResolved = [];
-        let conflictResolverCostUsd = 0; // 🔴 capture the bounded conflict-resolver agent's spend (was dropped → S1 TEAM-cost undercount)
         for (const p of patches) {
             const patchPath = `/tmp/${p.workerId}.patch`;
             await env.writeFile(patchPath, p.patch);
@@ -71,7 +76,6 @@ export async function mergeBranches(reports, baseSha, deps) {
         // Bounded integration-repair (search 2026-06-14): a clean-merge-but-failing-build used to be terminal.
         // If the sandbox supplied a `repair`, run the repair agent IN this merged tree (it edits the working tree;
         // the squash commit below captures worker patches + repair together), then re-run testCmd. Up to maxRounds.
-        let repairMeta;
         if (test.exitCode !== 0 && integ.repair && integ.repair.maxRounds > 0) {
             let cost = 0;
             let round = 0;
@@ -97,7 +101,6 @@ export async function mergeBranches(reports, baseSha, deps) {
         // 4b. truecorrect MEASURE (design/59) — run the thorough hidden oracle IN this sandbox (E2B), where the merged
         // code already lives, NOT on the CPU-contended control plane (fixes the frontier-multi oracle spawn-timeout
         // that thinned n). Pure observation: never gates `ok`, just reports into MergeResult.measure.
-        let measure;
         if (deps.measureCmd) {
             const mr = await env.exec(deps.measureCmd, { cwd: repo });
             measure = mr.exitCode === 0 ? { pass: true } : { pass: false, reason: (mr.stdout + " " + mr.stderr).slice(-200) };
@@ -163,8 +166,15 @@ export async function mergeBranches(reports, baseSha, deps) {
     }
     catch (e) {
         // Honour the "never throws" contract: a thrown pullWorkerDiff/provision/exec becomes a typed failure,
-        // attributed to the stage it threw in (not a blanket "provision").
-        return { ok: false, phase, reason: `merge aborted in ${phase}: ${e instanceof Error ? e.message : String(e)}`, quarantine: mergeable.map((r) => r.workerId) };
+        // attributed to the stage it threw in (not a blanket "provision"). [4953]②: spend/repair/measure that
+        // already happened before the throw ride this return too (same tail as every explicit failure return).
+        return {
+            ok: false, phase, reason: `merge aborted in ${phase}: ${e instanceof Error ? e.message : String(e)}`,
+            quarantine: mergeable.map((r) => r.workerId),
+            ...(measure ? { measure } : {}),
+            ...(repairMeta ? { repair: repairMeta } : {}),
+            ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}),
+        };
     }
     finally {
         // council#15: destroy the sandbox on EVERY exit path. Guarded because we may bail (diff-out) or throw

package/dist/leader/repair-oracle.js

@@ -133,8 +133,10 @@ export function mkRepairOracle(cfg) {
         // fork2.2 — bind the EXACT graded bytes (the diff that produced this verdict) so the caller surfaces the
         // candidate the human reviews == the bytes that were graded (not a later re-pull that may differ).
         cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed });
-        cfg.log?.("repair_oracle_verdict", { tier, passed, flaky, retries: K });
-        return { tier, passed, flaky, retries: K, ...(passed && !flaky ? {} : { trace: lastTrace || "oracle rejected the candidate" }) };
+        // [4953]① `retries` = how many re-isolations actually RAN (the cross-repo contract's wording) — the
+        // first-clear-fail short-circuit means this can be < K, and reporting the configured cap was a lie.
+        cfg.log?.("repair_oracle_verdict", { tier, passed, flaky, retries: verdicts.length });
+        return { tier, passed, flaky, retries: verdicts.length, ...(passed && !flaky ? {} : { trace: lastTrace || "oracle rejected the candidate" }) };
     };
 }
 //# sourceMappingURL=repair-oracle.js.map

package/dist/plugins/remote-env-adb.js

@@ -260,10 +260,18 @@ export class RemoteAdbExecutionEnv {
                 if (finished)
                     break;
                 const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
-                await new Promise((r) => {
-                    wake = r;
-                    setTimeout(r, waitMs);
-                });
+                // [4947] A-002.11 sibling: clear the losing timer — wake() firing first used to leave it armed.
+                let waitTimer;
+                try {
+                    await new Promise((r) => {
+                        wake = r;
+                        waitTimer = setTimeout(r, waitMs);
+                    });
+                }
+                finally {
+                    if (waitTimer !== undefined)
+                        clearTimeout(waitTimer);
+                }
                 if (idleMs && !finished && Date.now() - lastChunk >= idleMs) {
                     throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (device hang / disconnected)`);
                 }

package/dist/plugins/remote-env-host.js

@@ -1102,7 +1102,16 @@ export class RemoteHostExecutionEnv {
                     break;
                 // idle/liveness bound: no chunk within readTimeoutMs → typed timeout (a hung command).
                 const waitMs = idleMs != null ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
-                await new Promise((r) => { wake = r; setTimeout(r, waitMs); });
+                // [4947] A-002.11 sibling: the losing side of this race must be cleared — wake() firing first
+                // used to leave the timer armed for up to waitMs (30s), one per drain round on long streams.
+                let waitTimer;
+                try {
+                    await new Promise((r) => { wake = r; waitTimer = setTimeout(r, waitMs); });
+                }
+                finally {
+                    if (waitTimer !== undefined)
+                        clearTimeout(waitTimer);
+                }
                 if (idleMs != null && !finished && Date.now() - lastChunk >= idleMs) {
                     finished = true;
                     kill();

package/dist/plugins/remote-env-local-docker.js

@@ -350,7 +350,15 @@ export class RemoteLocalDockerExecutionEnv {
                 if (finished)
                     break;
                 const waitMs = idleMs != null ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
-                await new Promise((r) => { wake = r; setTimeout(r, waitMs); });
+                // [4947] A-002.11 sibling: clear the losing timer — wake() firing first used to leave it armed.
+                let waitTimer;
+                try {
+                    await new Promise((r) => { wake = r; waitTimer = setTimeout(r, waitMs); });
+                }
+                finally {
+                    if (waitTimer !== undefined)
+                        clearTimeout(waitTimer);
+                }
                 if (idleMs != null && !finished && Date.now() - lastChunk >= idleMs) {
                     finished = true;
                     try {

package/dist/plugins/remote-env-ssh.js

@@ -480,10 +480,18 @@ export class RemoteSshExecutionEnv {
                     break;
                 // idle/liveness bound: no chunk within readTimeoutMs → typed timeout (unreachable host)
                 const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
-                await new Promise((r) => {
-                    wake = r;
-                    setTimeout(r, waitMs);
-                });
+                // [4947] A-002.11 sibling: clear the losing timer — wake() firing first used to leave it armed.
+                let waitTimer;
+                try {
+                    await new Promise((r) => {
+                        wake = r;
+                        waitTimer = setTimeout(r, waitMs);
+                    });
+                }
+                finally {
+                    if (waitTimer !== undefined)
+                        clearTimeout(waitTimer);
+                }
                 if (idleMs && !finished && Date.now() - lastChunk >= idleMs)
                     throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (provider hang / unreachable host)`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.41.0",
+  "version": "7.42.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.53.0",
+    "@sema-agent/core": "^5.54.0",
     "@sema-agent/registry-core": "^0.19.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",