@sema-agent/server 7.68.0 → 7.69.0

package/dist/http/server.js

@@ -3,7 +3,7 @@ import { redactErrorMessage, redactHead } from "../observability/run-terminal-lo
 import { once } from "node:events";
 import { createHash } from "node:crypto";
 import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
+import { decideParkedAgent, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
 import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
@@ -1175,29 +1175,60 @@ export function createHttpServer(rawDeps) {
         if (parkedForkLeaseDenial)
             return parkedForkLeaseDenial;
         const ownerLeaseAdmittedHere = req !== undefined;
-        if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
+        if (req !== undefined) {
             const parkedAgentStore = deps.backgroundAgentStore;
             const parkedTool = deps.parkedReviveTool;
-            const parked = await withPrincipal(decodeCheckpointScope(cp.scope), () => decideParkedAgent({
-                agentStore: parkedAgentStore,
-                checkpointStore: cs,
-                registry: defaultTaskRegistry,
-                reviveTool: parkedTool,
-                ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
-                ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
-                ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
-            }, {
+            const parkWarn = (event, fields) => deps.logger?.warn?.(event, fields);
+            const origin = await findParkOrigin({
+                ...(parkedAgentStore !== undefined && parkedTool !== undefined ? { agentStore: parkedAgentStore } : {}),
+                ...(deps.workflowAgentSessionIndex !== undefined && deps.workflowRunStore !== undefined
+                    ? { workflowIndex: deps.workflowAgentSessionIndex, workflowRunStore: deps.workflowRunStore }
+                    : {}),
+                ...(deps.logger ? { warn: parkWarn } : {}),
+            }, { token, scope: cp.scope, sessionId: cp.sessionId });
+            const parkedReq = {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
                 decision, hostDecision, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
-                ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
-            }));
-            if (parked !== undefined) {
+                ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
+            };
+            if (origin?.kind === "background" && parkedAgentStore !== undefined && parkedTool !== undefined) {
+                const parked = await withPrincipal(decodeCheckpointScope(cp.scope), () => decideParkedAgent({
+                    agentStore: parkedAgentStore,
+                    checkpointStore: cs,
+                    registry: defaultTaskRegistry,
+                    reviveTool: parkedTool,
+                    ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
+                    ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
+                    ...(deps.logger ? { warn: parkWarn } : {}),
+                }, parkedReq, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
                 noteLateSettleIfAccepted(parked);
                 return parked;
             }
+            if (origin?.kind === "workflow") {
+                void ctxPromise.catch(() => { });
+                const plan = planWorkflowParkedDecide(origin, parkedReq);
+                if (!plan.ok)
+                    return plan.deny;
+                const hostToken = await cs
+                    .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
+                    .catch(() => undefined);
+                if (!hostToken) {
+                    return {
+                        status: 409,
+                        body: {
+                            error: "the workflow's originating session is not parked awaiting this run — the deployment can only deliver the decision on the host's next turn; retry once the host session parks, or resume the workflow run yourself",
+                            errorCode: "decide.workflow_host_not_parked",
+                            runId: plan.runId,
+                        },
+                    };
+                }
+                return await resumeWake(plan.hostSessionId, plan.message, decider?.principal, req, acceptEarly, [
+                    { runId: plan.runId, token, outcome: plan.outcome },
+                ]);
+            }
         }
         let ctx;
         try {
@@ -1210,8 +1241,9 @@ export function createHttpServer(rawDeps) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
         let spec;
+        let engineNotices = [];
         try {
-            spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
+            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
         }
         catch (e) {
             if (e instanceof HttpError) {
@@ -1244,10 +1276,15 @@ export function createHttpServer(rawDeps) {
             hostDecision,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
         noteLateSettleIfAccepted(driven);
         return driven;
     }
+    const resolveResumeSpec = async (body, req, auth) => {
+        const engineNotices = [];
+        const spec = await deps.resolveSpec({ ...body, resumeAt: undefined }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
+        return { spec, engineNotices };
+    };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
             return await driveResumeLeg(args);
@@ -1503,6 +1540,7 @@ export function createHttpServer(rawDeps) {
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId,
+                    ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
                     durable: (row) => void append("engine_notice", row).catch((err) => {
                         recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
                         deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
@@ -1532,6 +1570,7 @@ export function createHttpServer(rawDeps) {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
+                        ...(args.workflowParkedResume !== undefined ? { workflowParkedResume: args.workflowParkedResume } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
                             {
@@ -1929,12 +1968,12 @@ export function createHttpServer(rawDeps) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
+        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
-    async function resumeWake(sessionId, message, caller, req, acceptEarly) {
+    async function resumeWake(sessionId, message, caller, req, acceptEarly, workflowParkedResume) {
         const cs = deps.checkpointStore;
         const wakeBinding = { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" };
         const token = (await cs.findPendingTokenBySession(sessionId, undefined, wakeBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
@@ -1988,7 +2027,7 @@ export function createHttpServer(rawDeps) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
+        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         return driveResumeIntoRunLog({
             runner: runnerFor(spec),
@@ -2001,8 +2040,10 @@ export function createHttpServer(rawDeps) {
             outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
             verifyRounds: undefined,
             mintFreshRun: { source: "wake" },
+            ...(engineNotices.length > 0 ? { engineNotices } : {}),
             ...(acceptEarly === true ? { acceptEarly: true } : {}),
             ...(req !== undefined ? { callerInitiated: true } : {}),
+            ...(workflowParkedResume !== undefined ? { workflowParkedResume } : {}),
         });
     }
     async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider) {
@@ -2066,7 +2107,7 @@ export function createHttpServer(rawDeps) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
+        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {
@@ -2075,7 +2116,7 @@ export function createHttpServer(rawDeps) {
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
         };
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     function recordTaskResult(result) {
         const plane = terminalProjection(result.terminal);
@@ -2314,7 +2355,7 @@ export function createHttpServer(rawDeps) {
             return;
         const expired = await cs.listExpiredApprovalGates(now).catch(() => []);
         const isParkedOwned = async (sessionId) => {
-            if (deps.backgroundAgentStore === undefined)
+            if (deps.backgroundAgentStore === undefined && deps.workflowAgentSessionIndex === undefined)
                 return false;
             try {
                 const token = await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS });
@@ -2323,7 +2364,12 @@ export function createHttpServer(rawDeps) {
                 const cp = await cs.get(token);
                 if (!cp)
                     return false;
-                return (await findParkedAgentForCheckpoint(deps.backgroundAgentStore, { token, scope: cp.scope, sessionId: cp.sessionId })) !== undefined;
+                return (await findParkOrigin({
+                    ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
+                    ...(deps.workflowAgentSessionIndex !== undefined && deps.workflowRunStore !== undefined
+                        ? { workflowIndex: deps.workflowAgentSessionIndex, workflowRunStore: deps.workflowRunStore }
+                        : {}),
+                }, { token, scope: cp.scope, sessionId: cp.sessionId })) !== undefined;
             }
             catch {
                 return false;

package/dist/leader/wire.d.ts

@@ -46,8 +46,15 @@ export interface LeaderWireConfig {
      * 委派 caps」只能有一个答案。缺席 = 展开空对象 = 五处字面量键缺席(与接线前逐字相同)。
      * 修前(≤7.53)这五只 Runner 一席都没有:运维写的 READ_DENY_PATTERNS / MEMORY_DELEGATION_EVIDENCE 等对
      * leader 编排的 planner / worker / repair / conflict 四类任务**静默不生效**(core 内建 deny 表仍在)。
-     */
-    deploymentPosture?: DeploymentPostureSeats;
+     *
+     * 🔴 **是 provider 不是快照**(S-174 追加,codex 对抗复审 r1 [high] 验真后修):本车道的 Runner 是
+     * **逐调用现构**的,而 S-174 起 `config.readFace` 在进程内**会变**(center 下发的 read face 转成了
+     * `Runner.swapDeps` 热换席)。boot 期取一次值再五处复用,等于让 leader 车道永远停在起服那一刻的 READ
+     * 姿态:读面(`/v1/capabilities`、`/v1/diagnostics/wiring`)报新档、`restart.reasons` 也不再要求重启,
+     * 而**新建的 leader Runner 仍在旧档上跑** —— 组织把 `open` 收紧成 `roots` 之后这条腿还在 open,方向是
+     * fail-OPEN。改成函数席之后每只 Runner 构造时现读,与主车道经 swap 门换代**同代**;已经准备好的腿
+     * 保留它准备时的那一份(core 的自然快照语义,两条腿同律)。 */
+    deploymentPosture?: () => DeploymentPostureSeats;
     /**
      * [ref]([ref])—— **计费/遥测追踪席**,原样递给本车道的每一只 Runner。唯一属主 =
      * `boot/budget-tracing.ts` 的 `createTracer(...)`(主 runner / subRunner / hook runner 经共享基座吃的

package/dist/leader/wire.js

@@ -150,7 +150,7 @@ export function createLeaderRunner(cfg) {
     const { repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds, conflictRounds: cfg.conflictRounds });
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
-    const deploymentPostureSeat = cfg.deploymentPosture ?? {};
+    const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
@@ -172,7 +172,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing repair (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = [
                         `The integrated project at ${repoDir} fails its build/test. Make the MINIMAL change to the working tree so this command exits 0 (cd into the repo and run it yourself to confirm):`,
                         `  ${testCmd}`,
@@ -216,7 +216,7 @@ export function createLeaderRunner(cfg) {
                         throw new Error(`oracle still present after remove (${f.path}) — refusing conflict-resolve (measurement integrity)`);
                 }
                 try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
+                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
                     const objective = buildConflictResolverObjective({ workerId, repoDir, patch, conflictText });
                     const res = await runner
                         .runTaskStream({
@@ -272,7 +272,7 @@ export function createLeaderRunner(cfg) {
             if (Array.isArray(body.subtasks) && body.subtasks.length > 0) {
                 return validateSubtasks(body.subtasks);
             }
-            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat });
+            const planRunner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat });
             const runRoute = async (prompt) => {
                 const res = await planRunner.runTaskStream({
                     objective: prompt,
@@ -363,7 +363,7 @@ export function createLeaderRunner(cfg) {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
                     baseSha,
                     runner: keepCtxWarm(new Runner({
-                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
+                        brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
                         executionEnvFactory: async (ctx) => withStaging(await envFactory(ctx), stage, async (e) => {
@@ -383,7 +383,7 @@ export function createLeaderRunner(cfg) {
             const baseSha = await sh(env)(`cd ${repo} && git rev-parse HEAD`);
             return {
                 workerId: sub.workerId, sessionId, branch: sub.branch, baseSha,
-                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat, ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
+                runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
                 spec: { ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() },

package/dist/main.js

@@ -179,7 +179,7 @@ async function main() {
         ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
         ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
     };
-    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     let parkedAskRedeem;
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
         config, logger, backend, sendUserFileTaskEnvs, ruleConsent,
@@ -546,20 +546,20 @@ async function main() {
         ["sub", subRunner],
         ["handslessSub", handslessSubRunner],
     ];
-    const swapRunnerModels = (plane) => {
+    const swapRunnerDeps = (next) => {
         for (let i = 0; i < bootRunners.length; i++) {
             const [name, rn] = bootRunners[i];
             try {
-                rn.swapModels({ models: plane.models, tiers: plane.tiers });
+                rn.swapDeps(next);
             }
             catch (err) {
                 if (i > 0)
-                    logger.error("model_plane_swap_split", { failedAt: name, swapped: bootRunners.slice(0, i).map(([n]) => n), err: String(err) });
+                    logger.error("runner_deps_swap_split", { failedAt: name, seats: Object.keys(next), swapped: bootRunners.slice(0, i).map(([n]) => n), err: String(err) });
                 throw err;
             }
         }
     };
-    configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerModels });
+    configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerDeps });
     configCenter.initKeyResolver();
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         deviceStore: deviceLane?.store,
@@ -610,6 +610,7 @@ async function main() {
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         sessionStorage: ownerAware,
         workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+        workflowAgentSessionIndex: workflowAgentSessionIndex ? workflowAgentSessionIndex : undefined,
         workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
         imageIndex,
         imageBakes,

package/dist/model-compat.d.ts

@@ -0,0 +1,81 @@
+/**
+ * `Model.compat` —— 一只模型对 **openai-completions 线路**的兼容声明(core `OpenAICompletionsCompat`;
+ * 声明面 settings-schema 1.10.0 `ModelEntry.compat`)。本模块是**两条腿共用的唯一判据点 + 唯一铸点**,
+ * 与 {@link import("./mcp-tool-faces.js").readMcpToolFaces} 同一个「判据单点、多腿一致」的形。
+ *
+ * ## 它治的病(1.10.0 CHANGELOG + core 型面顶注双向亲读)
+ * 引擎的 openai brain 一直按这五键发请求,但声明写不进来:
+ *  · settings-schema ≤1.9.0 的 `ModelEntry` 没有 `compat` 键 ⇒ 目录条目写了在 parse 期被 strip 剥掉;
+ *  · `extraBody` 也穿不过(引擎的 OpenAI 保留键表拦下 `chat_template_kwargs` / `enable_thinking`);
+ *  · env 侧只有 `MODEL_REASONING_EFFORT_LEVELS` 一根旋钮,`thinkingFormat` 无处可写。
+ * 真需求 = vLLM / Qwen 类**缺省开思考**的网关:关思考只能靠 `chat_template_kwargs.enable_thinking=false`
+ * (`thinkingFormat: "qwen-chat-template"`),否则 auto 档每一轮都白烧一段思考。
+ *
+ * ## 三张对表全部**从 core 的型面铸**,本仓一个词都不枚举
+ * `THINKING_LEVEL_TABLE` / `THINKING_FORMAT_TABLE` / `MAX_TOKENS_FIELD_TABLE` 都是 `Record<闭集词, true>`,
+ * `COMPAT_KEY_READERS` 是 `{ [K in keyof Required<OpenAICompletionsCompat>]: 读器 }` 的**映射型**:
+ * core 加词/删词、加键/删键,四张表当场 tsc 红(`MODEL_DEGRADE_ON` 的 `Set<DegradeReason>` 同款纪律)。
+ * 映射型这一步是刻意的 —— 只钉「键集相等」会留下一个洞:core 加一键、有人把它补进白名单却忘了写读器,
+ * 于是这个键被**允许但不读** = 静默丢。读器与键集是**同一张表**,那个洞在结构上不存在。
+ *
+ * ## 坏声明的方向:**丢 compat 键、模型本体保留、一条点名 warn**(降级通道,不是拒绝面)
+ * 与 `toolFaces` 的「整条 server 不进」**刻意分歧**,理由是键的方向不同:`toolFaces` 声明的是写围栏 /
+ * 敏感路径策略(**收窄**键,丢它 = 运维声明的保护静默失效);`compat` 声明的是**线路拼法**(这台网关吃
+ * 哪种 thinking 参数、max tokens 叫什么名),丢它 = 回落到 core 的自动推断 = **今天这一刻的行为**,
+ * 权限/审批/凭据一格不动。[ref] 要的是「安全轴不许静默 fail-open」,本键不在安全轴上,而丢键仍然
+ * **响亮**(`model_compat_dropped` 点名模型与哪一段不合)—— 与 `mcp_content_class_dropped` 同形。
+ * 反方向(整只模型不进)的代价则不成比例:一个拼错的 `thinkingFormat` 会让这只模型从目录里消失,
+ * 用户面直接是 `request.unknown_reference`。
+ *
+ * 判形**整只判**:任一键不合 ⇒ 整只声明不收(和 `toolFaces` 每只工具「applied whole or not at all」
+ * 同律)。留下好的那几键 = 让运维以为整条声明生效了,而实际发出去的请求是半张脸。
+ */
+import type { Model } from "@sema-agent/core";
+/** core `OpenAICompletionsCompat` —— core 的 index 没有按名导出它,从 `Model` 的**型面**取
+ *  (`Model<TApi>` 的 `compat` 按 api 分叉;openai 那支就是它)。这不是抄一份结构,是引用同一个型。 */
+export type OpenAICompletionsCompat = NonNullable<Model<"openai-completions">["compat"]>;
+/** 六档思考梯(core `ThinkingLevel`)。`MODEL_DEFAULT_THINKING` / `MODEL_REASONING_EFFORT_LEVELS` /
+ *  `compat.reasoningEffortLevels` 三处共用**这一张**表 —— [ref] 件⑤ 起就是「上游加一档而这里不补 ⇒
+ *  编译红」的锁步姿势,本模块只是把它挪到了它真正的家(compat 的一个键)。 */
+export type ModelThinkingLevel = NonNullable<Model["defaultThinking"]>;
+/** 六档闭集(有序:低→高,取自上表的书写序),目录行 `enumValues` 与拒因文案的单一真源。 */
+export declare const THINKING_LEVELS: readonly ModelThinkingLevel[];
+export declare const isThinkingTier: (w: unknown) => w is ModelThinkingLevel;
+/** `thinkingFormat` 七词闭集(core:openai / openrouter / deepseek / together / zai / qwen / qwen-chat-template)。 */
+export type ModelThinkingFormat = NonNullable<OpenAICompletionsCompat["thinkingFormat"]>;
+export declare const THINKING_FORMATS: readonly ModelThinkingFormat[];
+export declare const isThinkingFormat: (w: unknown) => w is ModelThinkingFormat;
+/** `maxTokensField` 两词闭集(缺席 ⇒ core 按模型 id 推断,见 `inferMaxTokensField`)。 */
+export type ModelMaxTokensField = NonNullable<OpenAICompletionsCompat["maxTokensField"]>;
+export declare const MAX_TOKENS_FIELDS: readonly ModelMaxTokensField[];
+type CompatKey = keyof Required<OpenAICompletionsCompat>;
+/** 五键闭集(书写序取自上表),未知键拒因文案的单一真源。 */
+export declare const MODEL_COMPAT_KEYS: readonly CompatKey[];
+/**
+ * 一条目录条目的 `compat` 判形结果:
+ *  · `{ ok: true, compat }` —— 合形(`compat` 缺席 = 这条条目没有声明,或声明了一个**空**对象:
+ *    两者对 core 同义,都不铸键);
+ *  · `{ ok: false, issue }` —— 判不出形,调用方**整只丢**这条声明并留一句 warn(见模块头注)。
+ *    `issue` 只带键名与哪一段不合,**不带值** —— 与 `source` / `toolFaces` 同一条留痕纪律。
+ */
+export type ModelCompatRead = {
+    ok: true;
+    compat?: OpenAICompletionsCompat;
+} | {
+    ok: false;
+    issue: string;
+};
+/** 从任一腿的原始条目里读出 `compat` —— **本地 config.d 腿与 center 腿共用的唯一判据点**。 */
+export declare function readModelCompat(v: unknown): ModelCompatRead;
+/**
+ * `Model.compat` 的**唯一铸点**(env 腿与目录腿都经这里)。层序 = 优先级,**前层逐键赢、后层补缺席**
+ * (BL-8:目录条目声明 ?? env 缺省 —— 不是整只替换,否则一条只写了 `thinkingFormat` 的目录条目会把
+ * 部署级的 `MODEL_REASONING_EFFORT_LEVELS` 静默吃掉,正是 `contextWindow`/`maxTokens` 那一族的老病)。
+ *
+ * 归一两条(两腿因此对同一个空值给出同一个下场):值 `undefined` = 这一层没声明这一键;
+ * `reasoningEffortLevels` 为**空表** = 没声明这一键(env 腿的空 CSV 与目录腿的 `[]` 同义)。
+ * 全空 ⇒ 回 `undefined` = **不铸这个键**(缺席 = core 走自己的推断 = 今日行为)。
+ */
+export declare function buildModelCompat(...layers: ReadonlyArray<OpenAICompletionsCompat | undefined>): OpenAICompletionsCompat | undefined;
+export {};
+//# sourceMappingURL=model-compat.d.ts.map

package/dist/model-compat.js

@@ -0,0 +1,52 @@
+const THINKING_LEVEL_TABLE = { minimal: true, low: true, medium: true, high: true, xhigh: true, max: true };
+export const THINKING_LEVELS = Object.keys(THINKING_LEVEL_TABLE);
+export const isThinkingTier = (w) => typeof w === "string" && THINKING_LEVELS.includes(w);
+const THINKING_FORMAT_TABLE = { openai: true, openrouter: true, deepseek: true, together: true, zai: true, qwen: true, "qwen-chat-template": true };
+export const THINKING_FORMATS = Object.keys(THINKING_FORMAT_TABLE);
+export const isThinkingFormat = (w) => typeof w === "string" && THINKING_FORMATS.includes(w);
+const MAX_TOKENS_FIELD_TABLE = { max_tokens: true, max_completion_tokens: true };
+export const MAX_TOKENS_FIELDS = Object.keys(MAX_TOKENS_FIELD_TABLE);
+const COMPAT_KEY_READERS = {
+    supportsReasoningEffort: (v) => (typeof v === "boolean" ? v : undefined),
+    requiresReasoningContentOnAssistantMessages: (v) => (typeof v === "boolean" ? v : undefined),
+    maxTokensField: (v) => (typeof v === "string" && MAX_TOKENS_FIELDS.includes(v) ? v : undefined),
+    thinkingFormat: (v) => (isThinkingFormat(v) ? v : undefined),
+    reasoningEffortLevels: (v) => (Array.isArray(v) && v.every(isThinkingTier) ? v : undefined),
+};
+export const MODEL_COMPAT_KEYS = Object.keys(COMPAT_KEY_READERS);
+const isCompatKey = (k) => MODEL_COMPAT_KEYS.includes(k);
+export function readModelCompat(v) {
+    if (v === undefined)
+        return { ok: true };
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return { ok: false, issue: `compat is ${v === null ? "null" : Array.isArray(v) ? "an array" : typeof v}, not an object of wire-compat keys` };
+    const out = {};
+    for (const [k, raw] of Object.entries(v)) {
+        if (!isCompatKey(k))
+            return { ok: false, issue: `unknown key ${JSON.stringify(k)} (valid: ${MODEL_COMPAT_KEYS.join(" | ")})` };
+        const read = COMPAT_KEY_READERS[k](raw);
+        if (read === undefined)
+            return { ok: false, issue: `key ${JSON.stringify(k)} does not fit the wire-compat shape` };
+        out[k] = read;
+    }
+    return Object.keys(out).length > 0 ? { ok: true, compat: out } : { ok: true };
+}
+export function buildModelCompat(...layers) {
+    const out = {};
+    for (const layer of layers) {
+        if (layer === undefined)
+            continue;
+        for (const k of MODEL_COMPAT_KEYS) {
+            if (k in out)
+                continue;
+            const v = layer[k];
+            if (v === undefined)
+                continue;
+            if (k === "reasoningEffortLevels" && Array.isArray(v) && v.length === 0)
+                continue;
+            out[k] = v;
+        }
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+//# sourceMappingURL=model-compat.js.map

package/dist/observability/fail-open.d.ts

@@ -13,6 +13,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-136 合并重扫确认项(`terminal.ts persistedPlaneOf`,持久 blob 的平面读面):盘上一条 `terminal` 因由形不合(`paused` 缺 gate / 词出闭集)让 core 的 `terminalProjection` 抛 ⇒ 本读面对这一行答**全格缺席**而不是整只 500。放行的最坏后果=一条坏行在列表/舰队读面上显示为无终局词;计数 + probe 带原句,便于按行回溯。";
     };
+    readonly "server.workflow-park-index.sync-failed": {
+        readonly cls: "P-DEBT";
+        readonly note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。";
+    };
     readonly "server.trace.gate-outcome-defective": {
         readonly cls: "F";
         readonly note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`,写腿与两条读腿共用):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。";

package/dist/observability/fail-open.js

@@ -4,6 +4,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-136 合并重扫确认项(`terminal.ts persistedPlaneOf`,持久 blob 的平面读面):盘上一条 `terminal` 因由形不合(`paused` 缺 gate / 词出闭集)让 core 的 `terminalProjection` 抛 ⇒ 本读面对这一行答**全格缺席**而不是整只 500。放行的最坏后果=一条坏行在列表/舰队读面上显示为无终局词;计数 + probe 带原句,便于按行回溯。",
     },
+    "server.workflow-park-index.sync-failed": {
+        cls: "P-DEBT",
+        note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。",
+    },
     "server.trace.gate-outcome-defective": {
         cls: "F",
         note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`,写腿与两条读腿共用):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。",

package/dist/operator-ask.d.ts

@@ -0,0 +1,46 @@
+/**
+ * **运维写下的 ask 一律自报为「显式 ask 规则」** —— 本仓所有 operator/治理面 `ask` 裁决的**唯一**铸造点。
+ *
+ * ── 为什么存在(成因是一次真红,不是预防性设计)────────────────────────────────────────────────
+ * core 7.11.0 [ref] 给 allow 层加了**第二位成员**:一条被 `readOnlyShellVerdict` 证明只读的 shell 命令,
+ * 在每一道收紧车道之后**直接放行**(`decisionReason:"read_only"`),没有分类器轮次、没有卡、没有 park。
+ * 它的消费谓词(`allowLayerMayClear`,与持久 allow 规则**同一只**)明写不会越过的几件事里,有一件是
+ * **显式 ask 规则**(`PermissionResult.matchedAskRule`)。
+ *
+ * 而本仓的 operator 门此前铸的是**裸** `{action:"ask", message}` —— 一条「someone WROTE 了这条规则」的
+ * 事实,从来没有在裁决上说出口。于是 7.11.0 提货那一拍,`APPROVAL_REQUIRE=Bash` 的部署上
+ * `echo x` / `cd sub` / `grep -r … ` 这一类**全部静默自动执行**:运维亲手写下的「这只工具必须人批」被
+ * 一个自动层清掉了,而且**一声不响**(本仓 7.68.0 的四条 e2e 当场红,那是这条缺口的机器证据)。
+ *
+ * ── 修法:一条规则,一个铸点 ────────────────────────────────────────────────────────────────
+ * core 的 `matchedAskRule` 顶注逐字给了自声明的授权与方向:「A policy self-declaring the member only ever
+ * OPTS ITS OWN ask OUT of classifier auto-resolution (**tightening** — the false-claim direction is safe)」。
+ * 所以本仓把它做成**不变量**而不是补丁:凡是「运维/部署写下的声明产生的 ask」,一律经本函数铸,自带那条
+ * 声明的原文。于是**任何**自动放行层(今天的持久规则与只读判词,明天的第三位成员)都够不着它 —— 规则从
+ * 「每来一个新 allow 层就回来补一次名单」变成「运维写的 ask 不可被自动清除」这一句。
+ *
+ * 🔴 **副作用是有意的、且方向只有一个**:带 `matchedAskRule` 的 ask 同时**退出 auto 模式分类器的自动
+ * 裁决**(core:「a person's standing "ask me each time" is not classifier hesitation」)。对
+ * `APPROVAL_NEVER_AUTO` 这是把一条**本来就漏**的缝补上(那张表的语义逐字是「always human」,而分类器
+ * 今天能替它答);对 `APPROVAL_REQUIRE` / `commandPolicy` 这是收紧一格 —— 与这两个旋钮的字面语义
+ * (「必须批准」)一致,且方向是 fail-closed。
+ *
+ * 🔴 **谁不进这扇门**(逐条,判据在 core 的同一段顶注):
+ *  · **模式默认**的 ask(`task-settings.ts` 的 plan/default 档折叠)—— core 明写 `matchedAskRule`
+ *    「never for a `defaultAction:"ask"` fallback(an unmatched call is default-closed posture, not a
+ *    per-call instruction)」;把姿态默认伪装成一条写下的规则会让分类器车道的资格判据整条失真。
+ *  · **钩子**的 ask(`hooks/hook-runner.ts`)—— core 在钩子面**自己盖** `decisionReason:"hook"`
+ *    (`dist/core/gate-fold.js`),那是 `allowLayerMayClear` 的另一条独立豁免;本仓再盖一次是第二个写者。
+ *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
+ */
+import type { PermissionResult } from "@sema-agent/core";
+/**
+ * 铸一条**运维声明产生的** `ask`。
+ *
+ * @param rule 产生这条 ask 的**声明原文**(进 `matchedAskRule`)。它是 gate 内部消费的机器位 ——
+ *   core 顶注逐字:「consumed inside the gate and deliberately NOT copied onto the park/approval-card
+ *   request」,所以它既不上 wire、也不进卡,写的必须是**真实的那条声明**而不是一句好看的话。
+ * @param message 给人看的那句话(照旧上卡)。
+ */
+export declare function operatorAsk(rule: string, message: string): PermissionResult;
+//# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -0,0 +1,4 @@
+export function operatorAsk(rule, message) {
+    return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
+}
+//# sourceMappingURL=operator-ask.js.map