@sema-agent/server 7.50.0 → 7.52.0

package/dist/boot/resolve-spec.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, expandTiers, tightenTaskSpec } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -13,6 +13,7 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApp
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
+import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
@@ -26,7 +27,7 @@ import { HttpError, encodeCheckpointScope } from "../security.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, toolNameListFromBody } from "../spec-fields.js";
-import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
+import { cwdHonored, deviceCwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpContentOrigin, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, shellGateForMode, withPermissionMode } from "../task-settings.js";
@@ -35,21 +36,25 @@ import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
-    const resolveSpec = async (body, _req, auth, opts) => {
+    const resolveSpec = async (body, req, auth, opts) => {
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
+        const rawMemoryCapture = body.memoryCapture;
+        if (rawMemoryCapture !== undefined && rawMemoryCapture !== "off") {
+            throw new HttpError(400, "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)", { code: "request.field_invalid" });
+        }
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
-        const spec = assembleSpecLiteral(body, auth, opts, { ...gated, ...lane, ...anchors }, effMode);
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
         const folded = await foldGovernanceAndSettings(body, auth, spec, gated, effMode);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
@@ -116,17 +121,20 @@ export function createResolveSpec(ctx) {
     };
     const bindSettingsCwdEnvAndModel = (body, auth, gated, effMode, opts) => {
         const { objective, parsedSettings } = gated;
+        const cwdWriteGate = cwdHonored(config) || deviceCwdHonored(config);
         const execLane = config.remoteExec?.provider ?? "in-process";
+        if (auth?.sessionId)
+            fenceSessionOwner(auth.sessionId, auth.principal ?? null);
         if (typeof body.cwd === "string" && body.cwd.length > 0 && auth?.sessionId) {
-            if (cwdHonored(config) && isValidCwd(body.cwd))
+            if (cwdWriteGate && isValidCwd(body.cwd))
                 setSessionCwd(auth.sessionId, body.cwd);
             else if (inProcessSingleUserLane(config) && isValidCwd(body.cwd) && satisfiedByProcessCwd(body.cwd, realpathSync))
                 logger.debug("task_cwd_inherited", { lane: execLane, sessionId: auth.sessionId });
             else
-                logger.warn("task_cwd_ignored", { honored: cwdHonored(config), lane: execLane, sessionId: auth.sessionId });
+                logger.warn("task_cwd_ignored", { honored: cwdWriteGate, lane: execLane, sessionId: auth.sessionId });
         }
         if (parsedSettings.settings?.shellEnv && auth?.sessionId) {
-            if (cwdHonored(config))
+            if (cwdWriteGate)
                 setSessionShellEnv(auth.sessionId, parsedSettings.settings.shellEnv);
             else if (inProcessSingleUserLane(config)) {
                 const requested = parsedSettings.settings.shellEnv;
@@ -204,28 +212,42 @@ export function createResolveSpec(ctx) {
         let resumeAtEntryId;
         if (typeof body.resumeAt === "string" && body.resumeAt.length > 0) {
             if (!auth?.sessionId)
-                throw new HttpError(422, "resumeAt requires a session to branch (resume_at.no_session)");
+                throw new HttpError(422, "resumeAt requires a session to branch (resume_at.no_session)", { code: "resume_at.no_session" });
             if (!resumeAnchorStore || !ownerAware.getLeafId)
                 throw new HttpError(501, "resume-at is not available on this worker (no session-store backend for the anchor map)");
             resumeAtEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.resumeAt, auth.principal ?? null);
             if (resumeAtEntryId === undefined)
-                throw new HttpError(404, "resumeAt: no such message in this session (resume_at.unknown_event)");
+                throw new HttpError(404, "resumeAt: no such message in this session (resume_at.unknown_event)", { code: "resume_at.unknown_event" });
         }
         let rewindFilesToEntryId;
         if (resumeAtEntryId === undefined && typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0) {
             if (!auth?.sessionId)
-                throw new HttpError(422, "rewindFilesTo requires a session (rewind_files_to.no_session)");
+                throw new HttpError(422, "rewindFilesTo requires a session (rewind_files_to.no_session)", { code: "rewind_files_to.no_session" });
             if (!resumeAnchorStore || !ownerAware.getLeafId)
                 throw new HttpError(501, "rewind-files-to is not available on this worker (no session-store backend for the anchor map)");
             rewindFilesToEntryId = await resumeAnchorStore.resolve(auth.sessionId, body.rewindFilesTo, auth.principal ?? null);
             if (rewindFilesToEntryId === undefined)
-                throw new HttpError(404, "rewindFilesTo: no such message in this session (rewind_files_to.unknown_event)");
+                throw new HttpError(404, "rewindFilesTo: no such message in this session (rewind_files_to.unknown_event)", { code: "rewind_files_to.unknown_event" });
         }
         const s4ProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
         const s4DefaultScopes = s4ProjectId ? config.projects[s4ProjectId]?.defaultScopes : undefined;
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes };
     };
-    const assembleSpecLiteral = (body, auth, opts, parts, effMode) => {
+    const declaresInteractivePosture = (body, req, opts) => {
+        if (opts?.liveStream !== true)
+            return false;
+        if (body.verify === true || body.cascade === true)
+            return false;
+        if (liveQuestionFace === undefined)
+            return false;
+        if (body.interactiveTools === false)
+            return false;
+        if (headerStr(req?.headers["x-detach-on-disconnect"]) === "true")
+            return false;
+        const askForm = resolveAskSeamForm({}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
+        return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
+    };
+    const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
         const { scenarioName, cap, hands, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -248,7 +270,9 @@ export function createResolveSpec(ctx) {
             requireExistingSession: body.requireExistingSession === true ? true : undefined,
             enableFork: enableForkFromBody(body, config, Boolean(centerRuntimeCapsResolver)),
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
-            rewindFiles: body.rewindFiles === true ? true : undefined,
+            restoreFiles: body.restoreFiles === true ? true : undefined,
+            acceptPartialRestore: body.acceptPartialRestore === true ? true : undefined,
+            ...(body.rewindFiles === true ? { rewindFiles: true } : {}),
             rewindFilesTo: rewindFilesToEntryId,
             additionalDirectories,
             additionalReadDirectories,
@@ -268,6 +292,7 @@ export function createResolveSpec(ctx) {
             ...(typeof body.interactiveTools === "boolean"
                 ? { interactiveTools: body.interactiveTools }
                 : {}),
+            ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
@@ -334,7 +359,7 @@ export function createResolveSpec(ctx) {
                 return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }) : undefined,
+            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, body.memoryCapture) : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
                 const extra = [...(selectEnvTool ? [selectEnvTool] : []), ...(sendUserFileToolSpec ? [sendUserFileToolSpec] : [])];

package/dist/boot/retention-lane.d.ts

@@ -21,7 +21,7 @@
  *  ③ 模式分家(§4):`audit-only` 只调 `previewRetention` 记 `audit_only` 行,**一条破坏性方法都不调**;
  *     `enforce` 才调三方法。两支在代码里**物理分开**(不是同一段带 `if` 的调用序)—— 自审判据「grep 三个
  *     方法名只出现在 enforce 臂」靠的就是这个形。
- *  ④ 单 domain 失败 ⇒ 记 `failed` 行 + **继续下一 domain**(一个坏租户不钉死整轮);同 domain 连败
+ *  ④ 单 domain 失败 ⇒ 记 `failed` 行 + **继续下一 domain**(一个坏租户不卡住整轮);同 domain 连败
  *     ≥ {@link RETENTION_SWEEP_STUCK_THRESHOLD} ⇒ `retention_sweep_stuck` 指标 + **一次性** warn。
  *
  * ── 破坏性审计行的属主(§6 F5)────────────────────────────────────────────────────────────────
@@ -181,7 +181,7 @@ export interface RetentionLaneCtx extends RetentionSweepCtx {
 /**
  * 起飞后的 lane 控制器(`create*` 形:有行为有状态)。
  *
- * 🔴 `stop()` 为什么必须**可等**(codex 对抗复审 R1-[high],验真后加):`clearInterval` 只挡住**新** tick,
+ * 🔴 `stop()` 为什么必须**可等**(codex 交叉复审 R1-[high],验真后加):`clearInterval` 只挡住**新** tick,
  * 它不等当前这一轮。旧形的收尾链停表之后紧跟着就让租 ⇒ 新副本立刻接租,而旧副本还在删同一个域的
  * 数据 —— 一个由**正常** SIGTERM/SIGINT 稳定触发的双执行者窗口(比任何竞态都好复现)。
  * 正确的次序是:停表 → **等在飞那一轮落地** → 让租 → 关连接池。

package/dist/boot/runner-deps.d.ts

@@ -29,10 +29,14 @@ import type { MemorySyncRunner } from "../memory-sync-client.js";
 /**
  * `RunnerDeps.onAsk` 的装配(#168 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
  *
- * 为什么值得有名字:bg / resume 两条腿**没有** per-task `spec.onAsk` 装配点(routes/runs.ts 只递 ALS 与
- * 两个窗旋钮),它们唯一的审批接缝就是这一格。端到端测试此前只能把这一行**照抄**一份,再靠一条读源码
+ * 为什么值得有名字(历史理由,#168 当时):bg / resume 两条腿彼时没有 per-task `spec.onAsk` 装配点,
+ * 它们唯一的审批接缝就是这一格。端到端测试此前只能把这一行**照抄**一份,再靠一条读源码
  * 的正则当漂移告警 —— 那种锚只抓得到「这一行没了/改名了」,抓不到任何语义变化,而且抄件与真件从此是两
  * 份实现。提成导出之后,测试直接取本函数,接缝与 production 是**同一个符号**。
+ * ⚠️ S-52 起**三腿都装** per-task `spec.onAsk = boundAsk`(sync=routes/tasks.ts、bg=runs.ts、
+ * resume=server.ts driveResumeLeg;core `resolveAsk` 取 `spec.onAsk ?? deps.onAsk` ⇒ 这三条腿及其继承链
+ * 子代不再落到本格)—— 本格现役的到达面 = 没有 per-task 装配的腿(headless/durable-submit、协调器在场
+ * 但 taskId 缺席的退化 resume 腿)与任何未来新腿的缺省兜底,fail-direction 不变(零 ctx ⇒ 政策口)。
  *
  * 命名(CLAUDE.md 工厂命名律):返回的是一个闭包(活对象)⇒ `create*`。
  *
@@ -74,11 +78,11 @@ export interface RunnerDepsCtx {
     memorySyncRunner: MemorySyncRunner | undefined;
     /** design/170 件A(#148 件3③):org 记忆准入两 seam 的装配产物(boot/org-memory.ts)。进**共享
      *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
-     *  subRunner=子代平面绕过目录判决。 */
+     *  subRunner=子代平面跳过目录判决。 */
     orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
     /** design/170 件B/C/D(#252 件1):三个部署治理座席的装配产物(boot/governance-seams.ts)。进**共享
      *  基座** —— 合规否决与锁定层必须同样管住委托子代那条腿(子代 prepare 走同一套 preflight;漏挂
-     *  subRunner = 子代平面绕过档位与锁,与件A 同一个理由)。`retentionPolicy` 是纯声明,同源携带。 */
+     *  subRunner = 子代平面跳过档位与锁,与件A 同一个理由)。`retentionPolicy` 是纯声明,同源携带。 */
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores`)。在场即挂载
      *  `memory_list`/`memory_read` 两只工具(core 没有 TaskSpec 伴生旋钮:dep 的在场**就是**部署意图);
@@ -88,7 +92,13 @@ export interface RunnerDepsCtx {
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
-    fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    /** S-15 per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
+     *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN. */
+    fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
+    /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): lets the rewind refusal
+     *  distinguish "never existed / reaped" from "exists in the RETIRED whole-tree epoch". Consulted only on
+     *  the refusal path; diagnostic input, never a control input (a bad probe cannot change the outcome). */
+    legacyRewindBoundaryProbe: RunnerDeps["legacyRewindBoundaryProbe"];
     /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleOffers` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];
@@ -126,7 +136,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -194,7 +204,7 @@ export declare function createEngineNoticeForwarder(logger: {
 }, router?: EngineNoticeRouter): NonNullable<RunnerDeps["onNotice"]>;
 /**
  * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
- * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 对抗复审 R1-[medium],验真后修)。
+ * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。
  *
  * 病(实测):把 leader 的门写成 `cfg.logger ? ((m, x) => cfg.logger?.warn?.(m, x)) : undefined` 时,
  * 「装配点切片里出现过 `warn` 这个词」这类**源码文本**判据一律照绿 —— 而只装了 `info` 的部署会拿到一个

package/dist/boot/runner-deps.js

@@ -41,6 +41,7 @@ export function createSharedRunnerDeps(ctx) {
         readDenyBuiltinExclude: ctx.config.readDenyBuiltinExclude ?? undefined,
         memoryDelegationEvidence: ctx.config.memoryDelegationEvidence ?? undefined,
         memoryProvenance: ctx.config.memoryProvenance ?? undefined,
+        memoryCapturePolicy: ctx.config.memoryCapturePolicy ?? undefined,
         delegationEntryCaps: ctx.config.delegationEntryCaps ?? undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
@@ -64,7 +65,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileSnapshotStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -160,7 +161,8 @@ export function createRunnerDeps(ctx) {
             }
             : undefined,
         runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
-        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
+        legacyRewindBoundaryProbe: legacyRewindBoundaryProbe ? legacyRewindBoundaryProbe : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
         loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,

package/dist/boot/runtime-caps.d.ts

@@ -9,10 +9,33 @@
  */
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
+import { type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
 export interface RuntimeCapsCtx {
     config: ServiceConfig;
     logger: Logger;
+    /** design/383 S-2:`RuntimeCaps.allowMemoryOptOut` 的本地 verdict 源(`backend.memoryOptOutGrant()`;
+     *  SQL 后端在场才有,local 车道 undefined)。缺席 ⇒ 本键不合成(零行为差)。 */
+    memoryOptOutGrant?: MemoryOptOutVerdictSource | undefined;
 }
+/**
+ * design/383 §3.1(S-49 S-1b)—— `MEMORY_CAPTURE_POLICY=governed` 的**半配置拒启**(`boot/memory-consolidation.ts`
+ * D1 / `boot/retention-lane.ts` 同姿态:安全/合规控件不得半开)。
+ *
+ * governed 的语义是「per-principal verdict **必答**」:core 对 verdict 缺席一律**拒跑**(fail-closed,部署显式
+ * 选的方向)。而 verdict 只能来自一个源 —— 本批唯一源 = SQL 后端上的 `memory_optout_grant` 表(三层折叠后
+ * 恒答显式 boolean)。governed 而无源 ⇒ 每一个 `capture:"off"` 声明都被 core 以
+ * `memory.capture_optout_denied` 拒掉,而运维看到的只是一台「启动成功、opt-out 全拒」的机器 —— 正是
+ * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:要么接 SQL 后端(表随中央
+ * ensureSchema 建),要么改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、后者全拒,
+ * 都不问 verdict)。
+ *
+ * ⚠️ center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema 的独立小件(S-50 §四 开放问题①),
+ * 到货前**不算源**;到货后本断言加一条「center 在场」析取臂即可,判据不变。
+ */
+export declare function assertMemoryCapturePolicyWirable(input: {
+    policy: ServiceConfig["memoryCapturePolicy"];
+    grantSourceWired: boolean;
+}): void;
 export declare function createRuntimeCaps(ctx: RuntimeCapsCtx): {
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;

package/dist/boot/runtime-caps.js

@@ -1,6 +1,21 @@
-import { applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker } from "../runtime-caps-resolver.js";
+import { applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+export function assertMemoryCapturePolicyWirable(input) {
+    if (input.policy !== "governed")
+        return;
+    if (input.grantSourceWired)
+        return;
+    throw new Error(`MEMORY_CAPTURE_POLICY=governed requires a per-principal memory opt-out verdict source, and this deployment wires NONE ` +
+        `— under "governed" core REFUSES every session memory-capture opt-out whose verdict is absent (fail-closed, the posture's ` +
+        `own contract), so a governed worker without a source would refuse every \`memory.capture:"off"\` declaration and the ` +
+        `refusal would read as an entitlement denial rather than the misconfiguration it is. The only verdict source in this ` +
+        `version is the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is created by the ` +
+        `central ensureSchema and administered through /v1/admin/memory-optout). Wire a SQL backend, or set ` +
+        `MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
+        `MEMORY_CAPTURE_POLICY=capture-required (every opt-out declaration refused, no source consulted).`);
+}
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
+    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined });
     if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
@@ -15,11 +30,18 @@ export function createRuntimeCaps(ctx) {
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
-    const runtimeCapsResolver = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
+    const withObservers = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
         experimentalObserverAgents: config.experimentalObserverAgents,
         requirePrincipal: config.requirePrincipal,
         warn: (msg, fields) => logger.warn(msg, fields),
     });
+    const runtimeCapsResolver = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
+        onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
+            principal,
+            err: String(err),
+            effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
+        }),
+    });
     return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver };
 }
 //# sourceMappingURL=runtime-caps.js.map

package/dist/boot/session-faces.d.ts

@@ -6,6 +6,7 @@ import { PlanCacheProbe } from "../plan-cache-probe.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { OwnerAwareSessionStore } from "../security.js";
+import type { DeviceStore } from "../device-store.js";
 import { SessionWatchRegistry } from "../session-watch.js";
 import type { TaskListLane } from "./task-list-lane.js";
 export interface SessionFacesCtx {
@@ -22,10 +23,14 @@ export interface SessionFacesCtx {
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     /** #318:会话级任务清单车道(E21 级联的一条腿)。缺席 = 装配未接本车道 ⇒ 无清单可删。 */
     taskListLane: TaskListLane | undefined;
+    /** device lane 的四表店(E21 级联的一条腿:`device_session` 绑定行随会话删)。缺席 = 非 SQL 后端。 */
+    deviceStore: DeviceStore | undefined;
+    /** per-session cwd/shellEnv 登记簿的清除口(E21 级联的一条腿,codex R1-F1)。缺席 = 装配未接。 */
+    dropSessionScoped: ((sid: string) => void) | undefined;
 }
 export declare function createSessionFaces(ctx: SessionFacesCtx): {
     ownerAware: OwnerAwareSessionStore;

package/dist/boot/session-faces.js

@@ -6,7 +6,7 @@ import { setLeafAdvanceListener } from "../session-leaf-bus.js";
 import { SessionWatchRegistry, posIntEnv } from "../session-watch.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
 export function createSessionFaces(ctx) {
-    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileSnapshotStore, workflowCompletionInbox, taskListLane, } = ctx;
+    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryStore, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, } = ctx;
     const mysqlPool = backend?.mysqlPool();
     const auditPgPool = backend?.pgPool();
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
@@ -63,8 +63,22 @@ export function createSessionFaces(ctx) {
                 await taskAttachmentStore.deleteBySession(sessionId);
             if (taskListLane)
                 await taskListLane.deleteBySession(sessionId);
-            if (fileSnapshotStore?.deleteBySession)
-                await fileSnapshotStore.deleteBySession(sessionId);
+            if (deviceStore)
+                await deviceStore.deleteByRootSession(sessionId);
+            dropSessionScoped?.(sessionId);
+            if (fileHistoryStore) {
+                if (typeof fileHistoryStore.deleteBySession === "function")
+                    await fileHistoryStore.deleteBySession(sessionId);
+                else {
+                    await fileHistoryStore.reap(sessionId, []);
+                    logger.warn("session_file_history_baselines_retained", {
+                        sessionId,
+                        note: "the local file-history store has no whole-scope purge verb; boundaries were reaped but v1 baselines (original file bytes) remain under the data root until the upstream purge seam lands — recorded as an open deletion-rights gap, not silent",
+                    });
+                }
+            }
+            if (backend?.legacySnapshotPurge)
+                await backend.legacySnapshotPurge(sessionId);
             if (workflowCompletionInbox)
                 await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
             await purgeScratchpadDir(config.localDataRoot ?? localRoot, sessionId);

package/dist/boot/shutdown.d.ts

@@ -72,6 +72,14 @@ export interface ShutdownCtx {
     storeLiveProbe: {
         stop(): void;
     } | undefined;
+    /**
+     * device lane 的 WS 汇聚端(§8-R7 发版排空,车A-4)。缺席 = 本部署没有 device 车道。
+     *
+     * 🔴 排空联动**必须**由装配层驱动(`http/server.ts` 的 `deviceHub` 键头注逐字):§8-R7 的顺序
+     * (新提交 503 → 新 upgrade 拒 → 停发新指令 → 在途结果照收 → 才断连)是**部署编排**的语义,
+     * HTTP 层不能自作主张。所以 `drainState.draining` 翻真的那一刻,这里同步调 `beginDrain()`。
+     */
+    deviceHub: import("../device-ws-hub.js").DeviceWsHub | undefined;
     /** #131-2:config 60s 刷新环(config-center startRefreshLoop)——不停的话停机中途还可能热应用
      *  一份新配置。缺席 = 纯 env 部署没起环。 */
     configCenter: {

package/dist/boot/shutdown.js

@@ -5,7 +5,7 @@ import { createParentWatch } from "../parent-watch.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, } = ctx;
+    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, } = ctx;
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -66,6 +66,7 @@ export function installShutdownHandlers(ctx) {
         parentWatch?.stop();
         engineLease?.stop();
         storeLiveProbe?.stop();
+        void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: String(err) }));
         configCenter?.stopRefreshLoop();
         otelExporter?.stop();
         breakerState?.stop();
@@ -107,6 +108,7 @@ export function installShutdownHandlers(ctx) {
         }
         draining = true;
         drainState.draining = true;
+        deviceHub?.beginDrain();
         drainState.since = Date.now();
         void fleetClient?.announceNow();
         const inflight = drainState.inflight?.() ?? 0;

package/dist/boot/stores.js

@@ -17,11 +17,13 @@ import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentS
 import { createSessionStore } from "../plugins/session-store.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
+import { ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
-import { assertPermissionRuleApprovalSchema } from "../plugins/permission-rule-store-sql.js";
+import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
+import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
 import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
@@ -55,6 +57,10 @@ export async function openStores(ctx) {
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            if (pgPool)
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+            else if (mysqlPool)
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         }
         if (resolveStreamApprovalGate({
             toolApprovalEnabled: config.toolApprovalEnabled === true,
@@ -67,6 +73,31 @@ export async function openStores(ctx) {
             else if (mysqlPool)
                 await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         }
+        if (pgPool)
+            await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+        else if (mysqlPool)
+            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+        {
+            const legacyProbeSql = "SELECT 1 FROM snapshot_manifest LIMIT 1";
+            const hasLegacyRows = await (pgPool
+                ? pgPool.query(legacyProbeSql).then((r) => r.rows.length > 0)
+                : mysqlPool
+                    ? mysqlPool.query(legacyProbeSql).then(([rows]) => rows.length > 0)
+                    : Promise.resolve(false)).catch(() => false);
+            if (hasLegacyRows) {
+                logger.warn("legacy_snapshot_epoch_rows_present", {
+                    note: "rows from the RETIRED whole-tree snapshot epoch (snapshot_manifest/snapshot_blob) exist. They are NOT " +
+                        "migrated (whole-tree manifests and per-file history are structurally different); rewind refusals for " +
+                        "legacy-era boundaries name the retired epoch via the boundary probe; the retention lane keeps sweeping " +
+                        "these rows by session, and the maintenance tick GCs their orphaned blob bytes.",
+                });
+            }
+        }
+    }
+    if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
+        logger.warn("rewind_snapshot_max_mb_retired", {
+            note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",
+        });
     }
     {
         const minioReq = ["MINIO_ENDPOINT", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY"];
@@ -343,6 +374,14 @@ export async function openStores(ctx) {
             await ensureTiDBTaskListSchema(mysqlPool);
         return createTaskListLane({ mysqlPool, pgPool, logger });
     })();
+    {
+        const mysqlPool = backend?.mysqlPool?.();
+        const pgPool = backend?.pgPool?.();
+        if (pgPool)
+            await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
+        if (mysqlPool)
+            await ensureTiDBDeviceSchema(mysqlPool);
+    }
     const sessionStore = createSessionStore(config, backend, metrics);
     if (config.requirePrincipal && backend?.kind === "local") {
         throw new Error("REQUIRE_PRINCIPAL=true is not supported on the local file backend (DB_BACKEND=local): session/run CONTENT is " +

package/dist/boot/task-list-lane.d.ts

@@ -21,7 +21,7 @@
  *    高水位(next_id)与插入序(next_sort)都由 meta 行的事务计数器持有,`mutate` 是真后端事务。
  *  - `memory`:无 SQL 后端(local/file 形、纯内存 dev)⇒ **进程级** per-session 内存店。跨 turn
  *    存活(这就是 F2 的修点),但**跨进程重启丢失**,且 LRU 溢出(> `maxSessions`)时最老的会话
- *    会被逐出=那条会话的待办清空。诚实登记在 USAGE(「local 形重启丢待办」),不伪造持久性:
+ *    会被逐出=那条会话的待办清空。诚实登记在 USAGE(「local 形重启丢待办」),不自造持久性:
  *    这与 local 形其余会话态设施(perSessionCwd / TtlSessionStore)是同一姿势。
  *
  * ## 为什么 SQL 形也进同一只缓存
@@ -50,7 +50,7 @@ export interface TaskListLane {
      * 🔴 为什么必须有:会话 id 由调用方自选、会话删除后可被**别人** `register` 重新登记(security.ts
      * 的 claim-create),而本车道的 listKey 是 `sessionId` 的确定性派生 ⇒ 不级联的话,新化身第一次
      * 打开清单就读到上一位主人的任务标题/描述,`TaskCreate` 还会从上一位的高水位续号(「这里以前
-     * 建过 47 条」本身也是泄漏)。同族腿(anchors / approval-exemption / session-policy / attachment /
+     * 建过 47 条」本身也是外泄)。同族腿(anchors / approval-exemption / session-policy / attachment /
      * snapshot / scratchpad)全部走同一条级联,本条与它们同 scoping 理由:路由已在 DELETE 门证过会话
      * 所有权,故按 sessionId 单键删。
      *