@sema-agent/server 7.69.0 → 7.71.0

package/dist/config-types.d.ts

@@ -55,6 +55,24 @@ export interface RetentionSweepConfig {
  * 那道拒之后它即刻生效 —— 留着是为了「那天不必有人再猜一个数」。
  */
 export declare const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
+/**
+ * S-202 —— **首 token 看门狗的缺省上限(ms)**,全仓单一属主。
+ *
+ * 「SSE 已开但迟迟不吐第一个 delta」是唯一一条 core 的 idle 计时器够不着的挂死路(它只在首 token
+ * 之后才武装),所以这条看门狗是那条路上唯一的守卫。600s 而不是原来的 120s:自托管后端在长 prefill
+ * (大上下文 / 冷缓存 / 排队)下,首字合理地就是要等几分钟——120s 会把一次**正常**的慢启动判成
+ * `[network]` 失败去重试,而重试再交同一份 prompt 给同一个排队中的后端,只会更慢更贵。
+ *
+ * ⚠️ **`0 = 关`语义不变**,提高缺省不碰它;依赖 120s 快失败的部署把
+ * `MODEL_FIRST_TOKEN_TIMEOUT_MS=120000` 显式写回即可(env 恒赢)。
+ *
+ * 🔴 **常量在此、别处只许引用**:解析器腿(`config.ts` 的 `numEnv` 缺省)、目录腿
+ * (`config-catalog.ts` 的 `staticDefault`)与 `brain.ts` 的 `DEFAULT_RESILIENCE`(config 对象没带
+ * resilience 块时的同姿态兜底)此前各写一份 `120000` 字面量,改一处漏一处 = 对外宣告的缺省与真跑的
+ * 不是同一代。`test/config-catalog.test.ts` 的 S-202 两格咬:一格钉三腿同值,一格扫全 `src/` 判
+ * 「字面量」这一类写法为红(下一份镜像出生即红)。
+ */
+export declare const MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT = 600000;
 /**
  * [ref] D1/D2 —— consolidation driver 阀门的三根旋钮(语义与三问见
  * {@link ServiceConfigFlat.memoryConsolidationDriver})。纯数据。
@@ -608,6 +626,18 @@ export interface ServiceConfigFlat {
      *              snapshot). Self-hosted sandbox lane; auth = explicit K8S_* env or in-cluster service account.
      *   - `ssh`  → a real host over SSH (NOT isolated/suspendable; [ref] §5). AI-orchestrated batch deploy.
      *   - `adb`  → a real device over ADB (NOT isolated/suspendable). On-device APP testing. */
+    /**
+     * S-213④ —— `REMOTE_EXEC_HOME_DIR`:**执行环境的 home 目录**(core `ExecutionEnv.homeDir`),
+     * `~/…` 形权限规则(`Edit(~/.ssh/**)`)唯一的基,绝对路径。
+     *
+     * 部署级旋钮,**跨车道同一根**(不按 provider 分七根 —— 它回答的是同一个问题:「这条部署的手,
+     * 跑在哪个用户的 home 下」)。显式声明**恒赢**;缺席时只有 home 属于车道本身的那几条车道有答案
+     * (host/in-process = `os.homedir()`、e2b = 平台固定用户),k8s/local-docker(镜像属性)、
+     * ssh(目标机登录用户)、adb/device 一律缺席 ⇒ `~/` 规则在下单时被 422 响亮拒。
+     * 派生与逐车道理由的**单一属主** = `execution-lane-caps.ts` 的 `executionLaneHomeDir`。
+     * 非绝对路径 ⇒ **拒启**([ref] A 档;core 侧同判为 `config.execution_env_home_dir_invalid`)。
+     */
+    remoteExecHomeDir?: string;
     remoteExec?: {
         provider: "e2b";
         apiKey: string;
@@ -1721,7 +1751,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config-types.js

@@ -1,3 +1,4 @@
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
+export const MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT = 600_000;
 //# sourceMappingURL=config-types.js.map

package/dist/config.js

@@ -9,7 +9,7 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
@@ -856,7 +856,7 @@ function parseModelDomain() {
             : undefined,
         resilience: {
             connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", "30000"),
-            firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", "120000"),
+            firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", String(MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT)),
             idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", "300000"),
             circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", false),
             failureThreshold: numEnv("MODEL_CB_FAILURE_THRESHOLD", "5"),
@@ -1551,6 +1551,18 @@ function parseOrchestrationDomain(ctx) {
             assertReadDenyBuiltinsResolvable(tiers, exclude);
             return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
         })(),
+        ...((h) => (h !== undefined ? { remoteExecHomeDir: h } : {}))((() => {
+            const raw = process.env.REMOTE_EXEC_HOME_DIR;
+            if (raw === undefined || raw === "")
+                return undefined;
+            if (!raw.startsWith("/")) {
+                throw new Error(`REMOTE_EXEC_HOME_DIR="${raw}" is not an absolute path — it is the home directory of the user the EXECUTION ` +
+                    `environment runs as (the base a \`~/\` permission rule resolves against), so a relative value cannot be ` +
+                    `resolved and would silently guard nothing. Spell it absolutely (e.g. /home/user), or unset it to have ` +
+                    `\`~/\` rules refused loudly on this lane.`);
+            }
+            return raw;
+        })()),
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -1941,7 +1953,7 @@ const AUTH_GROUP_KEYS = [
     "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "remoteExec", "remoteExecHomeDir", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",

package/dist/deployment-governance.d.ts

@@ -59,8 +59,10 @@ export interface PathAdjudication {
      *  形上是一个永不创建的哨兵目录 —— 对写门 fail-safe,对规则 fail-open。理由逐字见
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskRoot`。缺席 ⇒ 需要基的规则拼法被 core 整表拒(fail-loud)。 */
     readonly taskRoot?: string;
-    /** 🔴 S-177 / codex r2:**执行环境的 home**(`~/…` 形规则的基)。只在引擎与执行同机时在场 ——
-     *  远端车道上 server 的 home 是另一个用户的目录,回落它 = 规则静默失效。逐字见
+    /** 🔴 S-177 / codex r2 + S-213④:**执行环境的 home**(`~/…` 形规则的基)。在**本部署的执行车道
+     *  真知道自己的 home 时**在场 —— 判据的唯一属主是 `execution-lane-caps.ts` 的 `executionLaneHomeDir`
+     *  (adapter 的 `ExecutionEnv.homeDir` 座读的是同一个函数)。绝不回落引擎进程自己的 home:远端车道上
+     *  那是另一个用户的目录,拿它去匹配 = 一条收紧规则静默守错地方。逐字见
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
     readonly taskHome?: string;
 }
@@ -85,7 +87,8 @@ export interface DurableApprovalSeat {
  * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
  * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
  * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
+ * 工具名取 `approval-content-kind.ts` 的单一属主(它 re-export core 根导出的 `ASK_USER_QUESTION_TOOL_NAME`);
+ * server.ts 的 pre-CAS 守卫读同一枚(S-213①:此处旧注称该常量「core 未根导出」= 失实,曾据此手抄 13 处)。
  * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
  * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
  * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)

package/dist/deployment-governance.js

@@ -1,12 +1,13 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, ok, } from "@sema-agent/core";
 import { createDurableAskPolicy } from "./approval.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
         check(req) {
-            if (req.toolName !== "AskUserQuestion")
+            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME)
                 return { action: "allow" };
             return live.hasLiveContext()
                 ? { action: "allow" }

package/dist/execution-lane-caps.d.ts

@@ -1,40 +1,3 @@
-/**
- * 执行车道**闭集**与 per-lane 能力表(design device-executor-lane-v2 §4.1 收敛件,车A-1)。
- *
- * ## 根本问题:lane 词表是开放字符串上的十几处独立判别式
- *
- * `config.remoteExec?.provider` 的静态型是 `string | undefined` 的判别联合,但消费面从来不是一处
- * switch —— 而是散在十几个文件里的**独立等式/集合/否定**:`cwdHonored` 比 `=== "host"`、
- * `isRemoteScratchpadLane` 查一个 `Set`、`isSandboxPathAdjudicationLane` 取 `!== "host"` 的否定、
- * `sandboxSendLaneEnabled` 是一串 if。于是「lane 词表加一个词」的病形不是编译错,是**每一处的默认
- * 答案静默错**:新词不在 Set 里 ⇒ 静默 false;不等于 `"host"` ⇒ 静默 true。没有一处会报,每一处都
- * 给出一个**没有人表过态**的答案(DISEASE-SHAPES V1/V2;[ref] 执行车道轴的同族病)。
- *
- * ## 本模块 = 那张表的单源(三件)
- *
- *  ① {@link ExecutionLane}:闭集联合。含 `in-process` —— `REMOTE_EXEC` 未设的进程内 stub 形**是**一条
- *     真车道(`boot/resolve-spec.ts` 的 `?? "in-process"`、`config.ts` 的落点记账都已在用这个词),
- *     把它排除在闭集外,普查就少一列。
- *  ② {@link executionLaneCaps}:**穷举 switch**(先例 = `capabilities/hands-lane.ts` 的
- *     `pickHandsRunner`:无 `default` 臂 ⇒ 联合加词而此处不加臂 = 编译错,而不是运行期落一个默认行)。
- *  ③ {@link ExecutionLaneCaps} 的每一位都点名它**今天的判别式坐标**,由对账测试
- *     `test/execution-lane-caps.test.ts` 逐位跑真判别式与本表对拍。
- *
- * ## 🔴 本模块是表,不是执法者
- *
- * 消费点今天仍各自判别(把判别式改成读本表 = 分批的后续车)。所以本表的全部价值押在对账测试上:
- * 表与判别式一旦分叉,门红。**唯一**允许的分叉是 {@link PLANNED_LANE_DIVERGENCES} 里逐条登记的
- * 「表是目标态、判别式待某车补」;登记项之外的分叉是漂移,登记项被补齐而不销行同样是红(双向)。
- *
- * ## 能力位的口径
- *
- * 每一位回答的是**车道结构上能不能**,不是「这个部署开没开」:旋钮(`LSP_ENABLED` /
- * `SCHEDULER_ENABLED` / k8s 的 `s3Snapshot`)由消费点在表之上再合取。租户面是唯一的例外 —— 它与
- * 车道语义绑死(host 的单用户前提),所以进了 {@link LaneCapability} 的第三个词而不是靠调用方记住。
- *
- * 依赖纪律:本文件是**叶**(只 type-import config-types),不引 config.ts —— config.ts 反过来引它取
- * {@link RemoteExecProvider}([ref] 必需 env 表按同一联合键控)。
- */
 import type { ServiceConfigFlat } from "./config-types.js";
 /** 一位能力的三态。`single-user-only` = 车道支持,但只在单用户部署(`requirePrincipal !== true`)开 ——
  *  多租户下这一位必须关(host 家族的 cwd/scheduler/backgroundShell/LSP 都是这一档,理由同源:
@@ -149,4 +112,55 @@ export interface PlannedLaneDivergence {
  * 加行的门槛不变:一条分叉必须写清 today / owner / why 三件,并在补齐的**同一批**里销掉。
  */
 export declare const PLANNED_LANE_DIVERGENCES: readonly PlannedLaneDivergence[];
+/**
+ * E2B 沙箱里 agent 跑成的那个用户的 home。
+ *
+ * 这是 **E2B 平台的事实**,不是本仓的猜:E2B 的基础模板建 `user` 这个用户,每个 sandbox 的进程都以它
+ * 运行,home 恒 `/home/user`;本仓 adapter 自己的工作区根默认值(`plugins/remote-env-e2b.ts` 的
+ * `DEFAULT_MOUNT_PATH`)用的就是同一个目录。**若某个部署的自定义模板换了用户**,运维用
+ * `REMOTE_EXEC_HOME_DIR` 显式声明覆盖 —— 那条旋钮恒赢,见 {@link executionLaneHomeDir}。
+ * ⚠️ 本值**未经真机实测**(本批无 e2b 真机),按平台约定 + 仓内既有默认常量登记。
+ */
+export declare const E2B_SANDBOX_HOME = "/home/user";
+/** {@link executionLaneHomeDir} 读的那两位部署配置(`ServiceConfig` 结构上满足)。 */
+export interface LaneHomeDeployment {
+    readonly remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+    /** `REMOTE_EXEC_HOME_DIR` —— 运维显式声明的执行环境 home(绝对路径;坏值在 config 层拒启)。 */
+    readonly remoteExecHomeDir?: string | undefined;
+}
+/**
+ * 「**这条部署的执行环境**以哪个 home 运行」—— `~/…` 形权限规则(`Edit(~/.ssh/**)`)唯一的基。
+ *
+ * ## 病(接入审计 M13 / DEBTS S-213④)
+ * core 的 `ExecutionEnv.homeDir` 是**由 adapter 声明**的座(`engine/harness/types.d.ts:511`,可选):
+ * 缺席 ⇒ core 的 `resolvePathPattern` 回 `{missingBase:"home"}` ⇒ 该规则对这条腿判 `unreadable`
+ * (fail-closed 的 ask)。四只远端 adapter(e2b/k8s/host/ssh)一个都没声明,而 server 侧的 422 前置门
+ * (`task-settings.ts` 的 `rejectUnmatchableSettingsNames`)在 home 未知时整表拒 `~/` 形 ——
+ * **于是远端部署根本写不出 `~/` 规则**,恒 422。
+ *
+ * ## 本函数 = 那个值的**单一属主**
+ * 两个消费面读同一份,不许各算各的(两处不同 = 一条规则在 422 门上被拒、却在引擎里编得出来,或反之):
+ *  ① 每只 adapter 的 `homeDir` 座(`boot/execution-env.ts` 把本函数的答案递进 adapter 配置);
+ *  ② 规则基 `PathRuleBases.home`(`boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 的
+ *     `pathAdjudication.taskHome`)。
+ *
+ * ## 一条规则,不是七条特判
+ * **运维显式声明恒赢**(`REMOTE_EXEC_HOME_DIR`,部署级旋钮,不挂任何客户端表态);没有声明时,
+ * 只有「home 是**车道本身**的属性」的那几条车道才有答案:
+ *  · `host` / `in-process` —— 命令就跑在本进程这台机器、这个用户下,`os.homedir()` 读的就是它
+ *    (core 自己的 `NodeExecutionEnv` 同判);
+ *  · `e2b` —— 平台固定用户,见 {@link E2B_SANDBOX_HOME};
+ *  · `k8s` / `local-docker` —— home 是**镜像**的属性,boot 期无从得知;
+ *  · `ssh` —— home 是**目标机上那个登录用户**的属性(root 是 `/root`、macOS 是 `/Users/<u>`),
+ *    连上之前无从得知,而 422 门要在下单那一刻回答;
+ *  · `adb` —— Android 没有 POSIX 意义上的登录 home;
+ *  · `device` —— 员工自己的机器,运行期才连进来。
+ * 这五条一律**缺席**(诚实:不猜一个目录去守)。缺席的后果是 `~/` 规则在下单时被 422 响亮拒,
+ * 与 core 的 `missingBase:"home"` 同向 —— 这正是负控要的那一格。
+ *
+ * 认不出的车道 ⇒ `undefined`(调用方 fail-closed)。生产链上不可达:`loadConfig` 的 [ref] 拒启门先咬。
+ */
+export declare function executionLaneHomeDir(deployment: LaneHomeDeployment): string | undefined;
 //# sourceMappingURL=execution-lane-caps.d.ts.map

package/dist/execution-lane-caps.js

@@ -1,3 +1,4 @@
+import { homedir } from "node:os";
 const NO = "unsupported";
 const YES = "supported";
 const SU = "single-user-only";
@@ -163,4 +164,26 @@ export function laneCapabilityHolds(cap, deployment) {
     }
 }
 export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
+export const E2B_SANDBOX_HOME = "/home/user";
+export function executionLaneHomeDir(deployment) {
+    const declared = deployment.remoteExecHomeDir;
+    if (declared !== undefined)
+        return declared;
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    switch (lane) {
+        case "in-process":
+        case "host":
+            return homedir();
+        case "e2b":
+            return E2B_SANDBOX_HOME;
+        case "k8s":
+        case "local-docker":
+        case "ssh":
+        case "adb":
+        case "device":
+            return undefined;
+    }
+}
 //# sourceMappingURL=execution-lane-caps.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -1,5 +1,6 @@
 import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
-import type { RunRecord } from "../plugins/store-contracts.js";
+import type { RunRecord, UnsuccessfulRunStatus } from "../plugins/store-contracts.js";
+import type { AssertAllKeysHandled } from "../trace/core-keyset-guard.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
  *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
@@ -618,4 +619,24 @@ export declare function isTerminalFleetStatus(status: FleetTaskStatus): boolean;
 export declare function runStatusToFleet(status: RunStatusForFleet, opts?: {
     awaitingPlanApproval?: boolean;
 }): FleetTaskStatus;
+/**
+ * S-213③ —— **编译期同源钉**:fleet 的 `"failed"` 桶必须恰好收下 `RUN_STATUS_CLASS` 判为「非成功终局」
+ * 的每一个 core 词。
+ *
+ * 这个词的病史:`blocked` 曾在本仓有**两个独立写者**且答案互斥 —— 本文件读它为「非成功终局(agent
+ * 放弃)⇒ 行离场」,而 `observability/run-terminal-log.ts` 读它为「治理判决,不是失败 ⇒ 不打行」。两处
+ * 各自穷举、各自正确地编译,结果是一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。
+ * 语义收归 `plugins/store-contracts.ts` 的那张表之后,本行不再自持判断:表把某个词挪出/挪进
+ * `unsuccessful`(或 core 新增一个非成功终态)而上面的 switch 没跟上 ⇒ 下面这条收不敛到 `never` ⇒ tsc 红。
+ * (`"error"` 是 server 自有别名、不在那张表的辖域内,故不在本钉的两边出现。)
+ */
+type FleetUnsuccessfulBucket = "failed" | "blocked";
+type _GuardFleetUnsuccessfulBucket = AssertAllKeysHandled<Exclude<UnsuccessfulRunStatus, FleetUnsuccessfulBucket>>;
+/** 反向门(与 `core-keyset-guard.ts` 的 `_Guard*Reverse` 同形):桶里留了一个表**不再**判为非成功终局的
+ *  词同样红 —— 只有正向门时,把 `blocked` 挪回 `succeeded` 而 switch 照旧塞进 failed 桶,并集覆盖、
+ *  差集门一声不吭(本批实测:只加正向门时该变异 tsc rc=0)。两道钉一起加。 */
+type _GuardFleetUnsuccessfulBucketReverse = AssertAllKeysHandled<Exclude<FleetUnsuccessfulBucket, UnsuccessfulRunStatus>>;
+/** 占位使用(防 noUnusedLocals 形 lint;类型别名本身零运行时)。 */
+export type FleetVocabGuards = [_GuardFleetUnsuccessfulBucket, _GuardFleetUnsuccessfulBucketReverse];
+export {};
 //# sourceMappingURL=fleet-bus.d.ts.map

package/dist/fleet/fleet-bus.js

@@ -634,9 +634,10 @@ export function runStatusToFleet(status, opts) {
         case "completed":
             return "completed";
         case "failed":
-        case "error":
         case "blocked":
             return "failed";
+        case "error":
+            return "failed";
         case "suspended":
             return "waiting";
         case "needs_review":

package/dist/http/routes/approvals-assistant.js

@@ -8,6 +8,7 @@ import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
+import { redactRiskDescriptor } from "../../observability/run-terminal-log.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
@@ -546,18 +547,8 @@ function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
     if (rd === null || rd === undefined)
         return row;
-    const shadowedRule = typeof rd.shadowedRule === "string" ? redactSecrets(rd.shadowedRule) : undefined;
-    const summary = typeof rd.summary === "string" ? redactSecrets(rd.summary) : undefined;
-    if (shadowedRule === undefined && summary === undefined)
-        return row;
-    return {
-        ...row,
-        riskDescriptor: {
-            ...rd,
-            ...(shadowedRule !== undefined ? { shadowedRule } : {}),
-            ...(summary !== undefined ? { summary } : {}),
-        },
-    };
+    const next = redactRiskDescriptor(rd);
+    return next === rd ? row : { ...row, riskDescriptor: next };
 }
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);

package/dist/http/routes/diagnostics.js

@@ -10,21 +10,25 @@ export function buildServerWiringGates(input) {
         backend: input.backend,
         parkFacility: input.checkpointStore !== undefined,
     });
+    const noCenterArm = (knob) => `this knob has no config-center arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
     return {
         streamApproval: gate.active ? "active" : gate.reason,
         durableApproval: buildPostureKnobReading(input.durableApproval, {
             knob: "DURABLE_APPROVAL",
             source: input.durableApprovalSource,
+            centerMeaning: noCenterArm("DURABLE_APPROVAL"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set) composed with a durable store being present: park/resume and the /v1/approvals routes are on by default — set DURABLE_APPROVAL=false to pin them off",
         }),
         streamAskWindowMs: buildPostureKnobReading(input.streamAskWindowMs, {
             knob: "STREAM_ASK_WINDOW_MS",
             source: input.streamAskWindowMsSource,
+            centerMeaning: noCenterArm("STREAM_ASK_WINDOW_MS"),
             postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): an approval card waits 24h instead of 5 minutes, so stepping away does not settle the run unattended — set STREAM_ASK_WINDOW_MS to pin your own window",
         }),
         sessionAutoTitle: buildPostureKnobReading(input.sessionAutoTitle, {
             knob: "SESSION_AUTO_TITLE",
             source: input.sessionAutoTitleSource,
+            centerMeaning: noCenterArm("SESSION_AUTO_TITLE"),
             postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
         }),
         checkpointStore: input.checkpointStore !== undefined,

package/dist/http/routes/runs.js

@@ -24,7 +24,7 @@ import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
-import { buildCancelContext } from "../../run-cancel-context.js";
+import { mintCancelledResult } from "../../run-cancel-context.js";
 import { buildCrossSliceUsage, readResourceWindow, recordResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
@@ -331,8 +331,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             }
             const err = note;
             try {
-                const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
-                const result = { taskId, sessionId: run.sessionId, terminal: { kind: "failed", code: "cancelled", message: err }, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
+                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err });
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {

package/dist/http/routes/tasks.js

@@ -9,7 +9,7 @@ import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotific
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
-import { buildCancelContext } from "../../run-cancel-context.js";
+import { mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
@@ -190,17 +190,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 let runRowSettled = false;
                 let durableTaskId;
                 let durableHeartbeat;
-                const mintCancelledResult = (errorMessage) => {
-                    const ctx = durableTaskId === undefined ? undefined : buildCancelContext(durableTaskId, streamLegStartedAt);
-                    return {
-                        taskId: durableTaskId ?? "",
-                        sessionId: prepared.spec.sessionId ?? "",
-                        terminal: { kind: "failed", code: "cancelled", message: errorMessage },
-                        result: "",
-                        stats: { turns: 0, tokens: 0 },
-                        ...(ctx ? { cancelContext: ctx } : {}),
-                    };
-                };
+                const cancelledResult = (errorMessage, engineResult) => mintCancelledResult({
+                    taskId: durableTaskId ?? "",
+                    sessionId: prepared.spec.sessionId ?? "",
+                    startedAtMs: streamLegStartedAt,
+                    message: errorMessage,
+                    ...(engineResult !== undefined ? { engineResult } : {}),
+                });
                 let userMsgEntryId;
                 let anchorPut = false;
                 const putRewindAnchor = () => {
@@ -398,12 +394,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     break;
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
+                                const cancelVerbAtDone = ev.type === "done" && durableTaskId !== undefined && cancelledViaVerb.has(durableTaskId);
                                 if (ev.type === "done") {
                                     finalResult = redactTerminalResult(stripResumeToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
-                                    if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.terminal.kind === "failed" && !finalResult.terminal.code) {
-                                        finalResult = { ...finalResult, terminal: { ...finalResult.terminal, code: "cancelled" } };
+                                    if (cancelVerbAtDone && finalResult !== undefined) {
+                                        finalResult = cancelledResult("cancelled by user", finalResult);
                                     }
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
@@ -644,7 +641,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             }
                             else {
                                 const dcErr = "stream client disconnected before completion (run aborted)";
-                                const dc = mintCancelledResult(dcErr);
+                                const dc = cancelledResult(dcErr);
                                 if (ledgerSink && !ledgerTerminal) {
                                     ledgerTerminal = true;
                                     await ledgerSink.flush().catch(() => undefined);
@@ -696,7 +693,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 }
                                 else if (ac.signal.aborted) {
                                     const err = "stream aborted before completion (run cancelled)";
-                                    const c = mintCancelledResult(err);
+                                    const c = cancelledResult(err);
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
                                         await ledgerSink.flush().catch(() => undefined);
@@ -745,6 +742,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
         else {
             const withDiscoveryNotice = (body) => prepared.verify || prepared.cascade ? { ...body, notice: MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE } : body;
             const runSyncSubmitLeg = async () => {
+                const syncLegStartedAt = Date.now();
                 let durableTaskId;
                 let durableHeartbeat;
                 if (deps.runStore && prepared.spec.sessionId) {
@@ -808,8 +806,14 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         cancelledViaVerb.delete(durableTaskId);
                     }
                 }
-                if (cancelVerbLabel && result.terminal.kind === "failed" && !result.terminal.code) {
-                    result = { ...result, terminal: { ...result.terminal, code: "cancelled" } };
+                if (cancelVerbLabel) {
+                    result = mintCancelledResult({
+                        taskId: durableTaskId ?? "",
+                        sessionId: prepared.spec.sessionId ?? "",
+                        startedAtMs: syncLegStartedAt,
+                        message: "cancelled by user",
+                        engineResult: result,
+                    });
                 }
                 const resumeAtStatus = resumeAtHttpStatus(result);
                 if (resumeAtStatus) {

package/dist/http/server.js

@@ -3,7 +3,7 @@ import { redactErrorMessage, redactHead } from "../observability/run-terminal-lo
 import { once } from "node:events";
 import { createHash } from "node:crypto";
 import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+import { decideParkedAgent, denyWorkflowParkIdentityLost, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
 import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
@@ -17,6 +17,7 @@ import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents }
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, stripResumeToken } from "../terminal.js";
+import { mintCancelledResult } from "../run-cancel-context.js";
 import { personDecision } from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
@@ -32,7 +33,7 @@ import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
-import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
@@ -84,6 +85,7 @@ export { coarseStatusForState, errorCodeForExit };
 import { sendJson, sendError, httpErrorCode, msg, isSseResponse } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 export { explicitOperatorOk, isOperator };
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
@@ -1142,7 +1144,7 @@ export function createHttpServer(rawDeps) {
             };
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
-        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== "AskUserQuestion"
+        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
@@ -1207,6 +1209,10 @@ export function createHttpServer(rawDeps) {
                 noteLateSettleIfAccepted(parked);
                 return parked;
             }
+            if (origin?.kind === "workflow_identity_lost") {
+                void ctxPromise.catch(() => { });
+                return denyWorkflowParkIdentityLost(origin);
+            }
             if (origin?.kind === "workflow") {
                 void ctxPromise.catch(() => { });
                 const plan = planWorkflowParkedDecide(origin, parkedReq);
@@ -1255,10 +1261,10 @@ export function createHttpServer(rawDeps) {
             throw e;
         }
         const pendingTool = cp.pendingAction.toolName;
-        if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
+        if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
         }
-        if (answer && (decision !== "approve" || pendingTool !== "AskUserQuestion")) {
+        if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
             return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, errorCode: "request.field_conflict" } };
         }
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
@@ -1306,6 +1312,7 @@ export function createHttpServer(rawDeps) {
         return await Promise.race([accepted, leg]);
     }
     async function driveResumeLeg(args, onAccepted) {
+        const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds } = args;
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
@@ -1689,6 +1696,13 @@ export function createHttpServer(rawDeps) {
                                 await flush();
                                 await append("wiring_manifest", wiringManifestEventData(ev));
                                 break;
+                            case "tool_roster_delta": {
+                                await flush();
+                                const rosterDelta = toolRosterDeltaEventData(ev);
+                                if (rosterDelta !== undefined)
+                                    await append("tool_roster_delta", rosterDelta);
+                                break;
+                            }
                             case "human_input":
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
@@ -1797,7 +1811,7 @@ export function createHttpServer(rawDeps) {
                         }
                     }
                     if (claimedRow && taskId && deps.runStore) {
-                        const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: e.message }, stats: { turns: 0, tokens: 0 } };
+                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: e.message });
                         await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
                     }
                     settleFleet("failed");
@@ -1852,7 +1866,7 @@ export function createHttpServer(rawDeps) {
             }
             if (cancelCtrl.signal.aborted) {
                 if (taskId && deps.runStore) {
-                    const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 } };
+                    const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user" });
                     await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
                 }
                 settleFleet("failed");

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { loadConfig, type ServiceConfig } from "./config.js";
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
-export { createStoreBackend, type StoreBackend } from "./plugins/store-backend.js";
+export { createStoreBackend, type StoreBackend, type SessionCaptureRecordSource } from "./plugins/store-backend.js";
 export { CachingSessionStore, type CachingOptions } from "./plugins/caching-session-store.js";
 export type { RunRecord, RunEvent } from "./plugins/store-contracts.js";
 export { runInBackground } from "./runs.js";