@sema-agent/server 7.55.0 → 7.57.0

package/dist/plugins/checkpoint-store-sql.js

@@ -1,8 +1,9 @@
+import { contentKindOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
-import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema } from "../approval-card.js";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
@@ -68,7 +69,7 @@ export function boundedRuleOffers(raw, opts = {}) {
     for (const item of raw.slice(0, MAX_RULE_OFFER_SCAN)) {
         if (out.length >= MAX_RULE_OFFERS)
             break;
-        const parsed = RuleOfferRawSchema.safeParse(preboundBatchMembers(item));
+        const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(preboundBatchMembers(item))));
         if (!parsed.success)
             continue;
         if (parsed.data.kind === "single") {
@@ -77,8 +78,18 @@ export function boundedRuleOffers(raw, opts = {}) {
         else {
             out.push({
                 kind: "batch",
-                rules: parsed.data.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS).map((r) => ({ rule: scrub(r.rule), match: r.match, command: scrub(r.command), segment: scrub(r.segment) })),
+                rules: parsed.data.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS).map((r) => {
+                    switch (r.kind) {
+                        case "command":
+                            return { kind: "command", rule: scrub(r.rule), match: r.match, command: scrub(r.command), segment: scrub(r.segment) };
+                        case "directoryRead":
+                            return { kind: "directoryRead", rule: scrub(r.rule), directory: scrub(r.directory), segment: scrub(r.segment) };
+                        default:
+                            throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                    }
+                }),
                 uncoveredSegments: parsed.data.uncoveredSegments,
+                ...(parsed.data.uncoveredDetail !== undefined ? { uncoveredDetail: parsed.data.uncoveredDetail.map((d) => ({ segment: scrub(d.segment), reason: d.reason })) } : {}),
             });
         }
     }
@@ -437,6 +448,7 @@ export class SqlCheckpointStore {
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
             : await this.db.query(`${base} ORDER BY c.created_at_ms ASC`);
         const out = rows.map((r) => {
+            const toolName = r.tool_name ?? null;
             const toolCallId = r.tool_call_id ?? null;
             const boundInputHash = r.bound_input_hash ?? null;
             const gateKind = r.gate_kind ?? null;
@@ -444,7 +456,7 @@ export class SqlCheckpointStore {
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
-                toolName: r.tool_name ?? null,
+                toolName,
                 toolCallId,
                 ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
                 ...(boundInputHash !== null ? { boundInputHash } : {}),
@@ -456,6 +468,7 @@ export class SqlCheckpointStore {
                 riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
                 ...(ruleOffers !== undefined ? { ruleOffers } : {}),
                 ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
+                ...(contentKindOf(toolName) !== undefined ? { contentKind: "content_ask" } : {}),
             };
         });
         return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
@@ -536,6 +549,12 @@ export class SqlCheckpointStore {
             };
         });
     }
+    async peekScopeByToken(token) {
+        const { rows } = await this.db.query(this.q("SELECT scope FROM checkpoint WHERE token = ?", "SELECT scope FROM checkpoint WHERE token = $1"), [token]);
+        if (!rows[0])
+            return undefined;
+        return rows[0].scope ?? null;
+    }
     async peekPendingScope(sessionId, binding) {
         const { sql, params } = this.pendingRowQuery("scope", sessionId, undefined, binding);
         const { rows } = await this.db.query(sql, params);

package/dist/plugins/file-run-store.d.ts

@@ -1,37 +1,6 @@
-/**
- * File-backed async run registry + replayable event log — the DURABLE local twin of {@link MemoryRunStore} (and the
- * file-backed sibling of {@link TiDBRunStore}/{@link PgRunStore}). P0.5 variant-1 (clay 2026-06-26): the file-backed
- * follow-on the Memory twin's header promised — a locally-run HTTP service now keeps its runs ledger + trace event log
- * across a process restart, not just in memory. Behaviour is byte-identical to MemoryRunStore (the shared parity oracle
- * — same single-active claim, the suspend/needs_review parks that KEEP the claim, the markResuming CAS that resets
- * cancel/preempt, the owner null-safe guard, the keyset list order, the (taskId,seq) event dedup, and the structuredClone
- * write/read isolation); the only difference is durability.
- *
- * THREE on-disk data planes (all under `<root>/runs/`), each using core's crash-safe fs primitives — never hand-rolled
- * fs (zero drift, no zero-length/torn corruption):
- *  1. run registry  — `<root>/runs/<taskId>/run.json` = the RunRow, replaced WHOLE on every status change via
- *                     `atomicWriteFile` (tmp→fsync→rename→fsync-dir, the 5-step atomic replace).
- *  2. single-active claim — `<root>/runs/active/<sanitizePathComponent(sessionId)>` carrying the active taskId, created
- *                     with `writeThenLink` (atomic create; EEXIST ⇒ the session already has an active run → the
- *                     createRun loses the claim, returns `{ok:false, activeTaskId}`). The file version of task_active's
- *                     unique key.
- *  3. per-run event log — `<root>/runs/<taskId>/events.jsonl` = an `AppendLog` (one line per event, fsync:false — events
- *                     are high-frequency, the torn-tail-drop on replay covers a crash tail; only the run.json status
- *                     commit + the active-claim create use fsync). (taskId,seq) is deduped on replay.
- *
- * An in-memory INDEX (the same Maps MemoryRunStore holds) is hydrated on construction by scanning each runs/<taskId>/
- * run.json + the active claim files — so listRuns/listSessions/getActiveTaskId are O(in-mem) with byte-identical keyset sort to the SQL/Memory
- * twins. Every write touches BOTH the disk and the index on one path. Single-process (the FileStorageBackend boot lock
- * guarantees one writer per data dir), so there is no per-op lock — with ONE exception: [ref]'s claim acquisition
- * (`withClaimLock`) runs under a per-session in-process critical section, because judging a claim stale involves
- * awaits (the checkpoint probe) and the claim + run row must commit as one unit (the SQL twin's transaction). The
- * checkpoint-coupled suspended-run reapers run
- * off an injected {@link RunStoreCheckpointProbe} ([ref]; wired by the local backend where checkpoint + run store
- * share one root) and degrade to honest no-ops when the probe is absent — exactly like MemoryRunStore.
- */
 import { type UsageRow } from "../usage-analytics.js";
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+import type { TaskStatus } from "@sema-agent/core";
+import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /**
@@ -136,7 +105,7 @@ export declare class FileRunStore {
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
-    setTerminal(taskId: string, status: TaskStatus, result: TaskResult | null, error: string | null): Promise<void>;
+    setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
     setSuspended(taskId: string): Promise<void>;
     /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */

package/dist/plugins/file-run-store.js

@@ -1,9 +1,11 @@
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { notifyRunTerminal } from "../observability/run-terminal-log.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const PROCESS_FACTS = {
     pid: process.pid,
@@ -338,6 +340,7 @@ export class FileRunStore {
         }
     }
     async appendEvent(taskId, seq, type, data) {
+        data = redactLedgerEventData(type, data);
         const list = this.events.get(taskId) ?? [];
         if (list.some((e) => e.seq === seq))
             return;
@@ -363,6 +366,8 @@ export class FileRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
+        result = redactTerminalResult(result);
+        error = error === null ? null : (redactErrorMessage(error) ?? null);
         const r = this.runs.get(taskId);
         if (!r) {
             for (const [sessionId, tid] of this.active)
@@ -372,6 +377,7 @@ export class FileRunStore {
                 }
             return;
         }
+        let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
@@ -379,9 +385,22 @@ export class FileRunStore {
             r.errorCode = result?.errorCode ?? null;
             r.updatedAt = new Date();
             this.persist(r);
+            pending = {
+                runId: taskId,
+                sessionId: r.sessionId,
+                owner: r.owner,
+                status,
+                resultTaskId: result?.taskId,
+                model: result?.model,
+                errorCode: r.errorCode ?? undefined,
+                errorMessage: result?.errorMessage ?? error ?? undefined,
+                elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
+            };
         }
         if (this.active.get(r.sessionId) === taskId)
             this.releaseClaim(r.sessionId);
+        if (pending)
+            notifyRunTerminal(pending);
     }
     async setSuspended(taskId) {
         const r = this.runs.get(taskId);
@@ -453,6 +472,7 @@ export class FileRunStore {
                 continue;
             const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
             const latest = sorted[0];
+            const latestRunId = latest.result?.runId;
             const times = arr.map((r) => r.createdAt.getTime());
             const last = Math.max(...times);
             const first = Math.min(...times);
@@ -465,6 +485,7 @@ export class FileRunStore {
                 objectivePreview: latest.objectivePreview,
                 lastStatus: latest.status,
                 lastRunId: latest.taskId,
+                ...(typeof latestRunId === "string" && latestRunId !== "" ? { lastTaskRunId: latestRunId } : {}),
                 title: null,
             });
         }

package/dist/plugins/local-checkpoint-store.d.ts

@@ -112,6 +112,16 @@ export declare class LocalCheckpointStore {
      *    投了就是「SQL 车道有、local 车道没有」的键集分岔。
      */
     findDecidedApprovalsForBinding(sessionId: string, boundCallId: string): Promise<DecidedApprovalRecord[]>;
+    /**
+     * [ref]:按 token 的 scope 读 —— 与 SQL 孪生**同一条契约**(`undefined` 无行 / `null` 匿名 / 属主串),
+     * 语义与存在理由的唯一属主 = SQL 侧 `peekScopeByToken` 顶注。
+     *
+     * ⚠️ 形差如实记:SQL 孪生那口是真「轻读」(只 SELECT scope 一列),本形没有列可选 —— core 的 File 店
+     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级版本闸(唯一的
+     * 读不动形是账本重放级 = 整店同时读不动,`findPendingTokenBySession` 先抛),所以「行体读得出而 scope
+     * 读不出」这一支在本形结构上不存在。哪天本形补了行级闸,这里要跟着改成不碰行体的读。
+     */
+    peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     /** `undefined` = no pending row; else the owner scope (local scopes are always strings — never null).
      *  [ref]:与 `findPendingTokenBySession` 同一个 {@link pickPendingRow}(同 binding ⇒ 同一行)。 */
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;

package/dist/plugins/local-checkpoint-store.js

@@ -1,3 +1,4 @@
+import { contentKindOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
@@ -160,6 +161,7 @@ export class LocalCheckpointStore {
                     return rs !== undefined ? { ruleOffers: rs } : {};
                 })(),
                 ...(pa?.hasBidiControls === true ? { hasBidiControls: true } : {}),
+                ...(contentKindOf(pa?.toolName ?? null) !== undefined ? { contentKind: "content_ask" } : {}),
             });
         }
         return rows.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
@@ -229,6 +231,9 @@ export class LocalCheckpointStore {
         }
         return out;
     }
+    async peekScopeByToken(token) {
+        return (await this.inner.get(token))?.scope;
+    }
     async peekPendingScope(sessionId, binding) {
         return this.pickPendingRow(await this.pendings(), sessionId, binding)?.cp.scope;
     }

package/dist/plugins/local-session-store.d.ts

@@ -27,6 +27,7 @@ export declare class LocalSessionStore implements SessionStore {
      *  has only TERMINAL runs (no live tail to re-attach), so `lastRunId` falls back to null and the shell uses its
      *  no-anchor path — same posture as the other local degrades here (runCount:0, lastStatus:""). Persisting it would
      *  need a sidecar-format change (the #10 clobber area); deferred until a real local-file-backed need. */
+    /** K-5c/[ref]/[ref]:per-session 最近一次 run 的 {taskId, runId?}(noteTaskRun 席;runId omit ⇒ 清座)。 */
     private readonly lastTaskRun;
     /** 2c P1d-β — live staged-import handles keyed by stagingId, so a local staging's in-memory buffer is readable via
      *  readStagedEntries (the durable twins re-read the staged session_event rows; local has no such rows). */
@@ -173,15 +174,14 @@ export declare class LocalSessionStore implements SessionStore {
     /** K-5c (core 1.155 SessionStore seam): core's Runner calls this at runTask START with the run's taskId, so the
      *  latest run surfaces as `lastRunId` on listSessions even while it is still running/suspended (the local backend
      *  has no runs ledger to derive it from, unlike the TiDB/PG twins). In-memory, last-write-wins per session.
-     *  [ref](core 5.65 增量批,**有意缓议**):core 的第三参 engine runId 在此**尚未消费**——它唯一的
-     *  合法出口是 listSessions 行上的 `lastTaskRunId`,而 `SessionSummary` 是 canonical spec 的**闭集**
-     *  (sema-sdk spec/openapi.yaml `additionalProperties:false`,producer-contract sessionsList 格咬着),
-     *  加键是跨仓 spec 节拍的事。spec 开键那一批再落:map 值扩成 `{taskId, runId?}` + 两座同动清座语义
-     *  (对齐 core TtlSessionStore.noteTaskRun 的 omit⇒clear,session-store.js 亲读)+ 行投影。
-     *  codex 5.65 增量批 R1-[medium] 曾建议「存储先行、投影另批」——**驳**:本店 runId 的唯一读点就是
-     *  行投影,先写不读=黑盒不可测的死状态(红先律无红可铺);清座语义单独存在也无观察面。存储与投影
-     *  必须同批,债主=sessions 列表 wire 键的 spec 节拍批(本注即债的定位锚)。 */
-    noteTaskRun(sessionId: string, taskId: string): void;
+     *  [ref] → [ref]([ref] 兑现;上一版「有意缓议」注即本批债锚,兑现随批撤):第三参 engine runId
+     *  自本批起**消费** —— map 值 {taskId, runId?} + 行投影 `lastTaskRunId` + **两座同动清座**(omit ⇒
+     *  清 runId 座,对齐 core TtlSessionStore.noteTaskRun 的 omit⇒clear 契约,core session.d.ts:204-212
+     *  亲读:旧 run 的 runId 挂在新 task 旁 = 把上一条 run 的身份错标给新 run)。存储与行投影同批落
+     *  (codex 5.65 R1-[medium]「存储先行、投影另批」之驳仍成立:本店 runId 唯一读点即行投影)。
+     *  wire 半场:HTTP 面零投影透传(sessions-list.ts,additive 键随行上 wire);sema-sdk spec
+     *  `SessionSummary` 闭集候 SDK 开键([ref]/.82 班车)——SDK 落键即端到端闭合。 */
+    noteTaskRun(sessionId: string, taskId: string, runId?: string): void;
     /** Synthesize a session's objective preview = the most-recent USER text message (the objective the run last saw).
      *  Reads the session's entries through the repo; any read error degrades to null (never fails the list). */
     private previewOf;

package/dist/plugins/local-session-store.js

@@ -275,6 +275,7 @@ export class LocalSessionStore {
                 continue;
             const firstActivityAt = meta.createdAt || new Date(0).toISOString();
             const lastActivityAt = this.lastActivity.get(meta.id) ?? firstActivityAt;
+            const lastRun = this.lastTaskRun.get(meta.id);
             all.push({
                 sessionId: meta.id,
                 owner,
@@ -283,7 +284,8 @@ export class LocalSessionStore {
                 runCount: 0,
                 objectivePreview: await this.previewOf(meta),
                 lastStatus: "",
-                lastRunId: this.lastTaskRun.get(meta.id) ?? null,
+                lastRunId: lastRun?.taskId ?? null,
+                ...(lastRun?.runId !== undefined ? { lastTaskRunId: lastRun.runId } : {}),
                 title: this.titleState.titles.get(meta.id) ?? null,
             });
         }
@@ -298,8 +300,8 @@ export class LocalSessionStore {
             : filtered;
         return after.slice(0, opts.limit);
     }
-    noteTaskRun(sessionId, taskId) {
-        this.lastTaskRun.set(sessionId, taskId);
+    noteTaskRun(sessionId, taskId, runId) {
+        this.lastTaskRun.set(sessionId, { taskId, ...(runId !== undefined ? { runId } : {}) });
     }
     async previewOf(meta) {
         try {

package/dist/plugins/memory-run-store.d.ts

@@ -1,18 +1,6 @@
-/**
- * In-memory async run registry + replayable event log — the LOCAL (DB-less) twin of {@link TiDBRunStore}/
- * {@link PgRunStore} (clay 2026-06-25: the seamless local↔cloud switch — a locally-run HTTP service must serve the
- * SAME contract a cloud worker does, incl. `/v1/runs` async runs + the trace event log). Behaviourally identical to
- * the SQL twins (the shared `storeBehaviorSuite` keeps them in lock-step), but process-local + ephemeral: a restart
- * loses run history (file-backed durability is the immediate follow-on; the conversation HISTORY + checkpoints DO
- * persist via core's FileStorageBackend). Single-process, so the cross-replica/durable reapers degrade — see below.
- *
- * Mirrors the SQL semantics exactly: the `task_active` single-active-run claim (a Map keyed by sessionId), the
- * NON-terminal suspend/needs_review parks that KEEP the claim, the markResuming CAS that resets cancel/preempt, the
- * owner null-safe guard on the flag/heartbeat paths (`<=>` → JS `(a??null)===(b??null)`), and the keyset list order.
- */
 import { type UsageRow } from "../usage-analytics.js";
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+import type { TaskStatus } from "@sema-agent/core";
+import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /**
  * [ref] P0 — the local lane's stand-in for the SQL twins' checkpoint-table JOIN. The file/memory run stores
@@ -66,7 +54,7 @@ export declare class MemoryRunStore {
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
-    setTerminal(taskId: string, status: TaskStatus, result: TaskResult | null, error: string | null): Promise<void>;
+    setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
     setSuspended(taskId: string): Promise<void>;
     /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */

package/dist/plugins/memory-run-store.js

@@ -1,4 +1,6 @@
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
+import { notifyRunTerminal } from "../observability/run-terminal-log.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
     runs = new Map();
@@ -78,6 +80,7 @@ export class MemoryRunStore {
             r.updatedAt = new Date();
     }
     async appendEvent(taskId, seq, type, data) {
+        data = redactLedgerEventData(type, data);
         const list = this.events.get(taskId) ?? [];
         if (list.some((e) => e.seq === seq))
             return;
@@ -100,6 +103,8 @@ export class MemoryRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
+        result = redactTerminalResult(result);
+        error = error === null ? null : (redactErrorMessage(error) ?? null);
         const r = this.runs.get(taskId);
         if (!r) {
             for (const [sessionId, tid] of this.active)
@@ -109,15 +114,29 @@ export class MemoryRunStore {
                 }
             return;
         }
+        let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
             r.error = error;
             r.errorCode = result?.errorCode ?? null;
             r.updatedAt = new Date();
+            pending = {
+                runId: taskId,
+                sessionId: r.sessionId,
+                owner: r.owner,
+                status,
+                resultTaskId: result?.taskId,
+                model: result?.model,
+                errorCode: r.errorCode ?? undefined,
+                errorMessage: result?.errorMessage ?? error ?? undefined,
+                elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
+            };
         }
         if (this.active.get(r.sessionId) === taskId)
             this.active.delete(r.sessionId);
+        if (pending)
+            notifyRunTerminal(pending);
     }
     async setSuspended(taskId) {
         const r = this.runs.get(taskId);
@@ -186,6 +205,7 @@ export class MemoryRunStore {
                 continue;
             const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
             const latest = sorted[0];
+            const latestRunId = latest.result?.runId;
             const times = arr.map((r) => r.createdAt.getTime());
             const last = Math.max(...times);
             const first = Math.min(...times);
@@ -198,6 +218,7 @@ export class MemoryRunStore {
                 objectivePreview: latest.objectivePreview,
                 lastStatus: latest.status,
                 lastRunId: latest.taskId,
+                ...(typeof latestRunId === "string" && latestRunId !== "" ? { lastTaskRunId: latestRunId } : {}),
                 title: null,
             });
         }

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,5 +1,5 @@
 import { FilePermissionRuleStoreProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope, type StaleRuleApprovalRecord } from "@sema-agent/core";
-import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
+import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
@@ -29,17 +29,34 @@ export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordSt
 /**
  * CC 导入票的 File 形。四条信任边界(principal 绑定 / TTL / 一次性原子消费 / 载荷绑定)与 SQL 形
  * **同语义**;唯一不同的是「原子」由谁保证 —— 那边是引擎行锁,这边是单进程 + 单写者(顶注)。
+ *
+ * 🔴 **每只店对自己那口钟负责**([ref]):SQL 形的 TTL 轴锚在数据库的钟上(多副本共享的唯一一口);
+ * local 形没有那样一口外部钟,它的钟就是本进程的 —— 而进程墙钟**不单调**,一次 NTP 回拨就能让一张
+ * 真实已经走满 TTL 的票复活(codex 对抗复审 r1 [high],验真后修)。所以本形自己带一枚**单调锚**:
+ * 本进程铸的票,判定钟 = `铸票墙钟 + 自铸票起单调钟走过的量`;重启后重放回来的行没有锚,如实退回墙钟。
  */
 export declare class FileRuleImportTicketStore {
     private readonly rows;
     private readonly log;
     private readonly gate;
-    constructor(dir: string, now?: () => number, onError?: (message: string) => void);
+    /** 单调钟(判定用)。与 {@link now}(墙钟,记账用)是两只不同的钟,别混。 */
+    private readonly monotonic;
+    constructor(dir: string, now?: () => number, onError?: (message: string) => void, monotonic?: () => number);
     private readonly now;
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
     get corrupt(): boolean;
     /** 归还本面 eager 持有的日志描述符(理由与姊妹面 {@link FileRuleApprovalRecordStore.close} 逐字同源)。 */
     close(): void;
+    /**
+     * 这一刻的**判定钟**([ref] r1-F1)。
+     *
+     * 本进程铸的票 ⇒ `铸票墙钟 + 自铸票起单调钟走过的量`:墙钟被前拨不会误杀(真实只过了几秒的票还活着),
+     * 被回拨也不会续命(单调钟照走)。重启后重放回来的行没有锚 ⇒ 退回墙钟(单调钟的零点跨进程无意义)。
+     *
+     * **给不了票额外寿命**:投影严格按单调钟前进,真实走满 TTL 必然越过 `expiresAtMs`(负控钉在
+     * `permission-rule-store-file.test.ts` 的 [ref] r1-F1 族)。
+     */
+    private decisionNowMs;
     mint(input: {
         ticketId: string;
         principal: string;
@@ -53,11 +70,11 @@ export declare class FileRuleImportTicketStore {
     }): Promise<RuleImportTicket>;
     /** 一次性**认领**。五条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → wrong-purpose →
      *  consumed → expired),于是两形的服务端日志归因可比;wire 面把五类折成同一个 404(零存在性 oracle)。 */
-    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
+    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose): Promise<RuleTicketRedeemResult>;
     /** 把认领**放回去**。`mustRemainValidMs` = 放回之后至少还要能用多久 —— 撑不过就不算放回成功
      *  (理由逐字见 SQL 侧 `release` 的头注:承诺一次必然兑现不了的重试比不承诺更坏)。
      *  `claimId` = A7 的认领围栏(R1-F1):被顶替的旧持有者动不了现持有者的认领。 */
-    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
+    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number): Promise<boolean>;
     /** [ref] A7 CLAIMED → **SETTLED**。判据与 SQL 孪生逐字同源(持有**这一代**认领 ∧ 未落定;过期
      *  **刻意不设门** —— 理由逐字见 SQL 侧 `settle` 的头注:拒绝记录一件已经发生的事只会把真相丢掉)。 */
     settle(ticketId: string, principal: string, claimId: string, outcome: unknown): Promise<boolean>;
@@ -89,5 +106,6 @@ export interface FilePermissionRuleStores extends PermissionRuleStoreBundle {
 export declare function createFilePermissionRuleStores(root: string, opts?: {
     onError?: (message: string) => void;
     now?: () => number;
+    monotonic?: () => number;
 }): FilePermissionRuleStores;
 //# sourceMappingURL=permission-rule-store-file.d.ts.map

package/dist/plugins/permission-rule-store-file.js

@@ -1,9 +1,11 @@
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { readdirSync } from "node:fs";
+import { performance } from "node:perf_hooks";
 import { FilePermissionRuleStoreProvider, AppendLog, ensureDir, readJsonlRecords, } from "@sema-agent/core";
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
+import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 const RuleScopeSchema = z.union([
     z.object({ kind: z.literal("global") }).strict(),
     z.object({ kind: z.literal("project"), root: z.string().min(1) }).strict(),
@@ -18,6 +20,7 @@ const RuleOffer2Schema = z.union([
         candidates: z.array(z.number().int().nonnegative().safe()),
         segments: z.array(z.string()).optional(),
         uncoveredSegments: z.number().int().nonnegative().safe().optional(),
+        uncoveredDetail: z.array(z.object({ segment: z.string(), reason: z.enum(UNCOVERED_SEGMENT_REASONS) }).strict()).optional(),
     })
         .strict(),
 ]);
@@ -26,7 +29,7 @@ const ApprovalRecordSchema = z
     id: z.string().min(1),
     principal: z.string().optional(),
     owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
-    schema: z.literal(2),
+    schema: z.literal(RULE_APPROVAL_RECORD_SCHEMA),
     kind: z.enum(["card", "import", "starter"]),
     state: z.enum(["pending", "approved", "redeemed"]),
     candidates: z.array(RuleCandidateSchema),
@@ -35,7 +38,10 @@ const ApprovalRecordSchema = z
     toolCallId: z.string().optional(),
     boundInputHash: z.string().optional(),
     command: z.string().optional(),
-    edited: z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict().optional(),
+    edited: z
+        .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
+        .strict()
+        .optional(),
     rev: z.number().int().nonnegative().safe(),
     selectedOffer: z.number().int().nonnegative().safe().optional(),
     redeemedDots: z.record(z.string(), RuleDotSchema).optional(),
@@ -137,7 +143,7 @@ export class FileRuleApprovalRecordStore {
             const parsed = ApprovalLineSchema.safeParse(raw);
             if (!parsed.success) {
                 const stale = StaleApprovalLineSchema.safeParse(raw);
-                if (stale.success && stale.data.record.schema !== 2) {
+                if (stale.success && stale.data.record.schema !== RULE_APPROVAL_RECORD_SCHEMA) {
                     this.rows.set(stale.data.record.id, toStaleEnvelope(stale.data.record));
                     continue;
                 }
@@ -195,8 +201,10 @@ export class FileRuleImportTicketStore {
     rows = new Map();
     log;
     gate;
-    constructor(dir, now, onError) {
+    monotonic;
+    constructor(dir, now, onError, monotonic) {
         this.now = now ?? Date.now;
+        this.monotonic = monotonic ?? (() => performance.now());
         ensureDir(dir);
         const path = join(dir, "import-tickets.jsonl");
         this.gate = new CorruptionGate("permission-rule import-ticket log", path, onError);
@@ -247,15 +255,21 @@ export class FileRuleImportTicketStore {
     close() {
         this.log.close();
     }
+    decisionNowMs(row) {
+        const a = row.mintAnchor;
+        return a === undefined ? this.now() : a.wallMs + (this.monotonic() - a.monoMs);
+    }
     async mint(input) {
         this.gate.assertUsable();
-        const expiresAtMs = this.now() + input.ttlMs;
+        const mintedAtWall = this.now();
+        const mintedAtMono = this.monotonic();
+        const expiresAtMs = mintedAtWall + input.ttlMs;
         const payloadHash = buildRulePayloadHash(input.candidates);
         this.log.append({ op: "mint", ticketId: input.ticketId, ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs }, true);
-        this.rows.set(input.ticketId, { ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs });
+        this.rows.set(input.ticketId, { ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs, mintAnchor: { wallMs: mintedAtWall, monoMs: mintedAtMono } });
         return { ticketId: input.ticketId, approvalId: input.approvalId, payloadHash, expiresAtMs };
     }
-    async consume(ticketId, principal, purpose, opts) {
+    async consume(ticketId, principal, purpose) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined)
@@ -267,7 +281,7 @@ export class FileRuleImportTicketStore {
         if (row.consumedAtMs !== undefined)
             return { ok: false, reason: "consumed" };
         const stampMs = this.now();
-        if (row.expiresAtMs <= (opts?.decisionNowMs ?? stampMs))
+        if (row.expiresAtMs <= this.decisionNowMs(row))
             return { ok: false, reason: "expired" };
         const claimId = randomUUID();
         this.log.append({ op: "consume", ticketId, atMs: stampMs, claimId }, true);
@@ -275,12 +289,12 @@ export class FileRuleImportTicketStore {
         row.claimId = claimId;
         return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash, claimId };
     }
-    async release(ticketId, principal, claimId, mustRemainValidMs = 0, opts) {
+    async release(ticketId, principal, claimId, mustRemainValidMs = 0) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined || row.ownerKey !== principal || row.consumedAtMs === undefined || row.claimId !== claimId || row.outcome !== undefined)
             return false;
-        if (row.expiresAtMs <= (opts?.decisionNowMs ?? this.now()) + mustRemainValidMs)
+        if (row.expiresAtMs <= this.decisionNowMs(row) + mustRemainValidMs)
             return false;
         this.log.append({ op: "release", ticketId }, true);
         delete row.consumedAtMs;
@@ -329,7 +343,7 @@ export function createFilePermissionRuleStores(root, opts) {
     ensureDir(dir);
     const provider = opts?.onError ? new FilePermissionRuleStoreProvider(dir, opts.onError) : new FilePermissionRuleStoreProvider(dir);
     const approvals = new FileRuleApprovalRecordStore(dir, opts?.onError);
-    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.onError);
+    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.onError, opts?.monotonic);
     return {
         provider,
         approvals,