@sema-agent/server 7.67.0 → 7.69.0

package/dist/parked-decide.js

@@ -1,5 +1,45 @@
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
+export async function findParkOrigin(sources, cp) {
+    if (sources.agentStore !== undefined) {
+        let match;
+        try {
+            match = await findParkedAgentForCheckpoint(sources.agentStore, cp);
+        }
+        catch (e) {
+            quiet(sources.warn, "parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        }
+        if (match !== undefined)
+            return { kind: "background", handle: match.handle, row: match.row };
+    }
+    const index = sources.workflowIndex;
+    const runStore = sources.workflowRunStore;
+    if (index === undefined || runStore === undefined)
+        return undefined;
+    try {
+        const row = await index.findByAgentSession(cp.sessionId);
+        if (row === null)
+            return undefined;
+        const run = await runStore.get(row.runId);
+        if (run === null)
+            return undefined;
+        const agent = (run.agents ?? []).find((a) => a.sessionId === cp.sessionId && a.status === "parked");
+        if (agent === undefined || agent.parkedCheckpointToken !== cp.token)
+            return undefined;
+        return { kind: "workflow", runId: row.runId, run, agent };
+    }
+    catch (e) {
+        quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
+        return undefined;
+    }
+}
+function quiet(warn, event, fields) {
+    try {
+        warn?.(event, fields);
+    }
+    catch {
+    }
+}
 export async function findParkedAgentForCheckpoint(agentStore, cp) {
     for (const scope of backgroundScopesForCheckpointScope(cp.scope)) {
         const parked = await agentStore.listByScope(scope, { status: "parked" });
@@ -25,21 +65,61 @@ function mintReviveArgs(row, knownAgentTypes) {
         ...(row.agentType !== undefined && knownAgentTypes.has(row.agentType) ? { subagent_type: row.agentType } : {}),
     };
 }
-export async function decideParkedAgent(deps, req) {
-    let match;
-    try {
-        match = await findParkedAgentForCheckpoint(deps.agentStore, { token: req.token, scope: req.scope, sessionId: req.sessionId });
+export function buildParkedResumeOutcome(req) {
+    const pa = req.pendingAction;
+    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
+    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+    return {
+        gate: "policy_ask",
+        boundCallId: req.binding?.boundCallId ?? persistedCallId,
+        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
+        decision: req.decision === "approve" ? "allow" : "deny",
+        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.answer !== undefined ? { answer: req.answer } : {}),
+        ...(req.reason !== undefined ? { reason: req.reason } : {}),
+        hostDecision: req.hostDecision,
+    };
+}
+export function planWorkflowParkedDecide(origin, req) {
+    if (req.grantRemember !== undefined) {
+        return {
+            ok: false,
+            deny: {
+                status: 400,
+                body: {
+                    error: "remember:\"session\" is not supported for a parked WORKFLOW agent: this lane's 200 means the decision was handed to the host's next turn, not that the engine committed it — an exemption granted here could outlive a decision the engine later rejects. Re-issue the decide without `remember`.",
+                    errorCode: "decide.workflow_remember_unsupported",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    catch (e) {
-        try {
-            deps.warn?.("parked_decide_probe_failed", { error: e instanceof Error ? e.message : String(e) });
-        }
-        catch {
-        }
-        return undefined;
+    const hostSessionId = origin.run.originatingSessionId;
+    if (hostSessionId === undefined || hostSessionId === "") {
+        return {
+            ok: false,
+            deny: {
+                status: 409,
+                body: {
+                    error: "this parked workflow agent's run carries no originating session — the deployment has nowhere to deliver the decision (a directly-started workflow, not a Workflow tool call)",
+                    errorCode: "decide.workflow_host_unknown",
+                    runId: origin.runId,
+                },
+            },
+        };
     }
-    if (match === undefined)
-        return undefined;
+    const verdict = req.decision === "approve" ? "APPROVED" : "DENIED";
+    return {
+        ok: true,
+        hostSessionId,
+        runId: origin.runId,
+        outcome: buildParkedResumeOutcome(req),
+        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.agent.callKey}") has been ${verdict}. ` +
+            `Resume that run now by calling Workflow with resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment ` +
+            `and will be applied to the parked agent; completed steps replay from the journal. Do not re-issue the original call.`,
+    };
+}
+export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
@@ -81,19 +161,7 @@ export async function decideParkedAgent(deps, req) {
         catch {
         }
     }
-    const pa = req.pendingAction;
-    const persistedCallId = pa?.kind === "tool_approval" ? (pa.toolCallId ?? "") : "";
-    const persistedHash = pa?.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-    const outcome = {
-        gate: "policy_ask",
-        boundCallId: req.binding?.boundCallId ?? persistedCallId,
-        boundInputHash: req.binding?.boundInputHash ?? persistedHash,
-        decision: req.decision === "approve" ? "allow" : "deny",
-        ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
-        ...(req.answer !== undefined ? { answer: req.answer } : {}),
-        ...(req.reason !== undefined ? { reason: req.reason } : {}),
-        hostDecision: req.hostDecision,
-    };
+    const outcome = buildParkedResumeOutcome(req);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         reviveClaim: {

package/dist/plugins/pg-pool.js

@@ -266,6 +266,14 @@ export const PG_SCHEMA_STATEMENTS = [
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_created ON workflow_run (scope, created_at_ms)`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_status ON workflow_run (scope, status)`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) COLLATE "C" NOT NULL,
+     run_id     VARCHAR(191) COLLATE "C" NOT NULL,
+     agent_key  VARCHAR(191) COLLATE "C" NOT NULL,
+     scope      VARCHAR(190) COLLATE "C" NOT NULL,
+     PRIMARY KEY (session_id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_wfagentsess_run ON workflow_agent_session (run_id)`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGSERIAL,
      session_id     VARCHAR(190) COLLATE "C" NOT NULL,

package/dist/plugins/store-backend.d.ts

@@ -238,6 +238,11 @@ export interface StoreBackend {
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */
     notifyJournal?(): import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore;
+    /** S-185 车CM:workflow 出身 park 的**有界 join** 索引(子会话 id → 它所属的 workflow run)。
+     *  与 `workflowRun`/`completionInbox`/`notifyJournal` 同一条轴 —— SQL 后端 = 跨副本双生;`local` 车道
+     *  缺席**是一个真答案**:那里的索引家在 run 店同一间屋子里(`LocalWorkflowAgentSessionIndex`,文件账本
+     *  或纯内存),不需要经过 backend。契约与单写者纪律的属主 = orchestration/workflow-agent-session-index.ts。 */
+    workflowAgentSessionIndex?(): import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex;
     /** Cloud-only stores below are OPTIONAL: the `local` (in-memory/file) backend omits them (it has no core
      *  in-memory twin carrying the service extras, and these are fleet/multi-replica concepts), so a local HTTP
      *  service degrades EXACTLY like today's no-DB env (the consumers gate on `backend?.X?.()`). TiDB/PG provide all. */

package/dist/plugins/store-backend.js

@@ -4,7 +4,7 @@ import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
-import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
+import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore, RunStoreStrictHydrateError } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
@@ -145,6 +145,7 @@ class TiDBBackend {
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new TiDBWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new TiDBSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
     toolResult() { return new TiDBToolResultStore(this.pool); }
@@ -191,6 +192,7 @@ class PgBackend {
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); }
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); }
+    workflowAgentSessionIndex() { return new PgWorkflowAgentSessionIndex(this.pool); }
     sharedMemoryStore(authorizer) { return new PgSharedMemoryStore(this.pool, authorizer); }
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }
     toolResult() { return new PgToolResultStore(this.pool); }

package/dist/plugins/tidb-pool.js

@@ -446,6 +446,14 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (id),
      KEY idx_wfrun_scope_created (scope, created_at_ms),
      KEY idx_wfrun_scope_status (scope, status)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS workflow_agent_session (
+     session_id VARCHAR(190) NOT NULL,
+     run_id     VARCHAR(191) NOT NULL,
+     agent_key  VARCHAR(191) NOT NULL,
+     scope      VARCHAR(190) NOT NULL,
+     PRIMARY KEY (session_id),
+     KEY idx_wfagentsess_run (run_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGINT       NOT NULL AUTO_INCREMENT,

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,5 +1,6 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { oversizeJournalResult } from "@sema-agent/core";
+import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {
@@ -13,16 +14,22 @@ export class SqlWorkflowJournalStore {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
     async append(runId, scope, entry) {
-        const serialized = JSON.stringify(entry.result);
-        if (oversizeJournalResult(serialized))
+        const serialized = journalRowPayloadOf(entry);
+        if (oversizeJournalResult(serialized)) {
+            if (journalEntryPayload(entry).parked) {
+                throw new Error(`workflow journal: PARKED entry ${entry.callKey} is ${serialized.length} bytes, over the journal result cap — refusing to skip it. ` +
+                    "Skipping a parked entry would make a resume start a SECOND live agent beside the session already pinned by the pending checkpoint (duplicating pre-approval side effects); " +
+                    "a completed result may be skipped (resume just re-runs that agent), a park may not.");
+            }
             return;
+        }
         await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES (?,?,?,?,?,?) " +
             "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES ($1,$2,$3,$4,$5,$6) " +
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);
     }
     async load(runId, scope) {
         const { rows } = await this.db.query(this.q("SELECT call_key, result FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC", "SELECT call_key, result FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC"), [runId, scope]);
-        return rows.map((r) => ({ callKey: String(r.call_key), result: JSON.parse(String(r.result)) }));
+        return rows.map((r) => journalEntryOfRow(String(r.call_key), String(r.result)));
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -59,6 +59,7 @@ import type { Pool as PgPool } from "pg";
 import { summarizeWorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import { type WorkflowCompletionInbox, type WorkflowCompletionInboxEntry } from "../orchestration/workflow-completion-inbox.js";
 import type { WorkflowNotifyJournalStore, WorkflowNotifyJournalEntry } from "../orchestration/workflow-notify-journal.js";
+import type { WorkflowAgentSessionIndex, WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
 import { type SqlDriver } from "./sql-driver.js";
 type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 /** Row cap guard: a run blob beyond this is NOT stored on update (the prior revision stays) — TiDB's
@@ -153,6 +154,29 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
+/**
+ * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
+ * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
+ * 这里只记方言差)。行是 `WorkflowRun` 的派生投影,写者只有一个(Journaling 装饰器的写观察点)。
+ *
+ * ── 方言差,保持显式 ──────────────────────────────────────────────────────────────────────────
+ *   - `?` 占位 vs `$n`,且 `syncRun` 的删除腿在 PG 上要按 `params.length` 记位(与 `listByScope` 同因)。
+ *   - 「删掉这条 run 里已不在 rows 里的旧行」:TiDB `session_id NOT IN (?,?,…)`(动态占位数)vs
+ *     PG `session_id <> ALL($n::text[])`(数组绑定)—— 两边同一件事,语句结构不同(reap 的批删同先例)。
+ *   - upsert:TiDB `REPLACE INTO`(整行替换)vs PG `INSERT … ON CONFLICT (session_id) DO UPDATE`。
+ *   - schema 属主同店内其余表:TiDB DDL 在 tidb-pool.ts,PG DDL 在 pg-pool.ts(店不建表)。
+ *
+ * 🔴 **写序**:先 upsert 再删。反过来(先删后 upsert)会在两条语句之间留出一个**索引行不存在**的窗口,
+ * 而这期间进来的 `/decide` 会诚实 miss ⇒ 一次本可受理的批准被退回。先 upsert 的最坏形是窗口内多一条
+ * 旧行(读口按 session_id 精确查,取 run 后还要逐字比对赎回键 ⇒ 多余的行只会 miss,不会错配)。
+ */
+export declare class SqlWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
+    findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
+}
 /** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
  *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
@@ -175,5 +199,11 @@ export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbo
 export declare class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: PgPool);
 }
+export declare class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: MySqlPool);
+}
+export declare class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool: PgPool);
+}
 export {};
 //# sourceMappingURL=workflow-run-store-sql.d.ts.map

package/dist/plugins/workflow-run-store-sql.js

@@ -277,6 +277,36 @@ export class SqlWorkflowNotifyJournalStore {
         };
     }
 }
+export class SqlWorkflowAgentSessionIndex {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async syncRun(runId, rows) {
+        for (const r of rows) {
+            await this.db.query(this.q("REPLACE INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES (?,?,?,?)", `INSERT INTO workflow_agent_session (session_id, run_id, agent_key, scope) VALUES ($1,$2,$3,$4)
+             ON CONFLICT (session_id) DO UPDATE SET run_id = EXCLUDED.run_id, agent_key = EXCLUDED.agent_key, scope = EXCLUDED.scope`), [r.sessionId, r.runId, r.agentKey, r.scope]);
+        }
+        const keep = rows.map((r) => r.sessionId);
+        if (this.db.dialect === "tidb") {
+            const holes = keep.map(() => "?").join(",");
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = ?${keep.length > 0 ? ` AND session_id NOT IN (${holes})` : ""}`, [runId, ...keep]);
+        }
+        else {
+            await this.db.query(`DELETE FROM workflow_agent_session WHERE run_id = $1${keep.length > 0 ? " AND session_id <> ALL($2::text[])" : ""}`, keep.length > 0 ? [runId, keep] : [runId]);
+        }
+    }
+    async findByAgentSession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = ?", "SELECT session_id, run_id, agent_key, scope FROM workflow_agent_session WHERE session_id = $1"), [sessionId]);
+        const r = rows[0];
+        if (!r)
+            return null;
+        return { sessionId: String(r.session_id), runId: String(r.run_id), agentKey: String(r.agent_key), scope: String(r.scope) };
+    }
+}
 export class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
     constructor(pool, onWarn) {
         super(mysqlDriver(pool), onWarn);
@@ -307,4 +337,14 @@ export class PgWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore
         super(pgDriver(pool));
     }
 }
+export class TiDBWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgWorkflowAgentSessionIndex extends SqlWorkflowAgentSessionIndex {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
 //# sourceMappingURL=workflow-run-store-sql.js.map

package/dist/router/route-orchestration.js

@@ -1,4 +1,5 @@
 import {} from "@sema-agent/core";
+import { operatorAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,7 +41,7 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 export function supPostureOverrides() {
-    const ask = (toolName) => ({ action: "ask", message: `${toolName} gated by supervisor routing (capability-danger task)`, decisionReason: "rule" });
+    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
     const writeGate = {
         check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };

package/dist/run-local.js

@@ -190,7 +190,7 @@ export async function runLocal(argv, deps = {}) {
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
                 config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
-            applyCenterReadFace(config, r.effective, logger);
+            applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
             logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
         }
     }

package/dist/runs.d.ts

@@ -324,7 +324,16 @@ parkCheckpointReader?: {
             toolCallId?: unknown;
         };
     } | null>;
-}): Promise<void>;
+}, 
+/** L-167:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
+ *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
+ *  缺席 ⇒ 一个字节不投(既有调用方逐字不变)。 */
+pendingEngineNotices?: readonly {
+    code: string;
+    message: string;
+    detail?: Record<string, unknown>;
+    sessionId?: unknown;
+}[]): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -88,6 +88,8 @@ export function resumeAtHttpStatus(result) {
         return 400;
     if (code === "config.invalid_checkpoint_store")
         return 400;
+    if (code === "config.tool_mount_denied")
+        return 400;
     if (code === "config.memory_capture_unsupported")
         return 409;
     if (!code.startsWith("resume_at."))
@@ -153,7 +155,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -248,6 +250,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     };
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
+        ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
         durable: (row) => void append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`)),
     });
     try {

package/dist/runtime-governance.js

@@ -1,6 +1,7 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
 import { SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
+import { operatorAsk } from "./operator-ask.js";
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
@@ -13,18 +14,18 @@ export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const askSet = new Set(askCommands);
     const shellTools = new Set(tools);
-    const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
+    const ask = (message, rule) => operatorAsk(rule, message);
     return {
         check(req) {
             if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
-                return ask(`tool "${req.toolName}" call has no parseable command string`);
+                return ask(`tool "${req.toolName}" call has no parseable command string`, "commandPolicy(unparseable command)");
             const parsed = parseLeadingCommandName(command);
             if ("reject" in parsed)
-                return ask(`command is not a single simple command (${parsed.reject})`);
-            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`) : { action: "allow" };
+                return ask(`command is not a single simple command (${parsed.reject})`, "commandPolicy(argv[0] unparseable)");
+            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`, `commandPolicy(${parsed.name}=ask)`) : { action: "allow" };
         },
     };
 }

package/dist/task-mcp.d.ts

@@ -22,9 +22,25 @@
  *     `runtimeCapsResolver`) is a DEFERRED v2.
  * When the gate is closed, a sent `mcpServers` is IGNORED (advertised via `capabilities.mcpInjection`).
  */
-import { type CompliancePosture, type LockedKey, type McpServerSpec } from "@sema-agent/core";
+import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
+/**
+ * 🔴 **一类丢弃至多点名多少条**(codex 对抗复审 r1 [high],验真后采纳)—— 与挂载上限**同一个数**,
+ * 刻意不新造一个可调旋钮:点名的量级本就该与挂载的量级同阶。
+ *
+ * 病(本批引入,不是既有形):`MAX_REQUEST_MCP_SERVERS` 管的是「挂几台」,管不住「你发了几台」——
+ * HTTP 体上限 8 MiB 装得下十万个名字,而 `gate_closed`(整只列表被忽略)与 `over_cap`(上限之后的尾项)
+ * 两臂原本逐条点名,于是一条已认证请求就能造出十万条事实、十万条通告,逐条排进本腿的**串行账本写链**
+ * ——同一条链上后续的正常事件全部排在它们后面。修前的名字数组把超上限折成**一条**聚合串,所以无界的
+ * 是本批新写的那两个循环。
+ *
+ * 为什么不改成「数组太长就 400」(codex 的另一条建议,**未采纳**):今天 33 台的请求是**照常受理、挂前
+ * 32 台**的,加一条新的拒绝面为了一个资源边界去改受理语义,爆炸半径比病本身大(而且 resume 腿重放存量
+ * body 会当场砖死一批已 park 的任务——本仓 `opts.leg` 三处先例逐字写着「砖死 resume 比降级糟」)。
+ * 有界点名两头都占:该说的仍然说得出,量级钉死在与挂载同阶。
+ */
+export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (`requirePrincipal !== true`) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -37,19 +53,42 @@ export declare function mcpInjectionHonored(config: {
     lockedConfigKeys?: readonly LockedKey[];
     compliancePosture?: CompliancePosture;
 }): boolean;
+/**
+ * L-167(core 7.9.1)—— 一条**没有被挂上**的请求腿 MCP 条目的**事实**。宿主报事实,core 铸词:
+ * `reason` 的词表属主是 core(`McpInjectionDropReason` = malformed_entry / name_reserved_by_deployment /
+ * gate_closed / over_cap),本仓一个词都不枚举,通告的码/受众/句子一个字都不拼。
+ *
+ * `sessionId` **不在**这个形上:它是通告的**路由半场**,在铸点(`mintInjectionDropNotices`)才补 ——
+ * 一条丢弃事实在没有会话语境的调用方(桩、单测、未来的非 HTTP 腿)那里同样成立,而通告不成立。
+ */
+export interface McpInjectionDrop {
+    readonly server: string;
+    readonly reason: McpInjectionDropReason;
+    /** `malformed_entry` 专用:**哪个键**判不出形。结构性给出(读器在拒的那一行就知道),不从文案里 parse。 */
+    readonly field?: string;
+}
+/** L-167:本条腿的用户面通告席。`sessionId` = 路由半场(`auth.sessionId`,与 `spec.sessionId` 同源);
+ *  `emit` = 收下 core 铸好的 `EngineNotice`。**本模块不知道**它最后落在 SSE、账本还是日志上 —— 那是
+ *  投递腿的事,本模块只负责「事实 → core 工厂 → 一条通告」。 */
+export interface McpInjectionDropSeat {
+    readonly sessionId: string | undefined;
+    readonly emit: (notice: EngineNotice) => void;
+}
 /**
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
  * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
  */
-export declare function validateRequestMcp(raw: unknown): {
+export declare function validateRequestMcp(raw: unknown): ValidatedRequestMcp | null;
+type ValidatedRequestMcp = {
     ok: McpServerSpec[];
-    dropped: string[];
+    dropped: McpInjectionDrop[];
+    droppedTotal: number;
     badContentOrigin: Array<{
         server: string;
         value: string;
     }>;
-} | null;
+};
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -128,7 +167,7 @@ export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, g
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
- * unchanged. Logs an `mcp_injection_ignored` when a caller SENT servers a closed gate dropped (so the shell never
+ * unchanged. Logs an `mcp_injection_dropped` (reason `gate_closed`) when a caller SENT servers a closed gate dropped (so the shell never
  * silently believes its `.mcp.json` took effect — it also reads `capabilities.mcpInjection`).
  */
 export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined, bodyMcp: unknown, config: {
@@ -144,5 +183,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
-}): McpServerSpec[] | undefined;
+}, 
+/** L-167:本条腿的**用户面**投递口。`sessionId` = 通告的路由半场(缺席 ⇒ 一条都不铸,见
+ *  {@link mintInjectionDropNotices});`emit` 收下 core 铸好的通告,由调用腿决定投到哪(见 `boot/resolve-spec.ts`)。
+ *  整段缺席(桩、单测、非 HTTP 腿)⇒ 只走日志终点,行为逐字与本件之前相同。 */
+notice?: McpInjectionDropSeat): McpServerSpec[] | undefined;
+export {};
 //# sourceMappingURL=task-mcp.d.ts.map