@sema-agent/server 7.7.1 → 7.8.1

package/dist/plugins/task-list-store-sql.js

@@ -2,7 +2,7 @@
 import { assertJsonMetadata } from "@sema-agent/core";
 import { pgHasUnstorable, pgSafeJsonStringify, PgUnstorableError } from "./pg-safe-json.js";
 export const TASK_LIST_META_TABLE = "task_list_meta";
-export const TASK_LIST_ITEMS_TABLE = "task_list_items";
+export const TASK_LIST_ITEM_TABLE = "task_list_item";
 /** JS 对象 integer-like(array-index)键判別——file 参照的遍历序里数字升序的那一族:canonical
  *  十进制、0 ≤ n < 2^32-1。"01"/"1e3"/负数/超界 = 普通串键(插入序殿后)。 */
 function arrayIndexOf(id) {
@@ -30,7 +30,7 @@ export async function ensureTiDBTaskListSchema(pool) {
     next_sort BIGINT NOT NULL,
     PRIMARY KEY (list_key)
   ) COLLATE utf8mb4_bin`);
-    await pool.query(`CREATE TABLE IF NOT EXISTS ${TASK_LIST_ITEMS_TABLE} (
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${TASK_LIST_ITEM_TABLE} (
     list_key VARBINARY(190) NOT NULL,
     id VARBINARY(190) NOT NULL,
     id_num BIGINT NULL,
@@ -46,7 +46,7 @@ export async function ensurePgTaskListSchema(q) {
     next_sort BIGINT NOT NULL,
     PRIMARY KEY (list_key)
   )`);
-    await q(`CREATE TABLE IF NOT EXISTS ${TASK_LIST_ITEMS_TABLE} (
+    await q(`CREATE TABLE IF NOT EXISTS ${TASK_LIST_ITEM_TABLE} (
     list_key VARCHAR(190) COLLATE "C" NOT NULL,
     id VARCHAR(190) COLLATE "C" NOT NULL,
     id_num BIGINT,
@@ -83,9 +83,9 @@ async function setOn(exec, dialect, listKey, id, itemJson) {
         : `SELECT next_sort FROM ${TASK_LIST_META_TABLE} WHERE list_key = $1 FOR UPDATE`, [listKey]);
     const sort = Number(rows[0].next_sort);
     await exec(dialect === "tidb"
-        ? `INSERT INTO ${TASK_LIST_ITEMS_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES (?, ?, ?, ?, ?)
+        ? `INSERT INTO ${TASK_LIST_ITEM_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES (?, ?, ?, ?, ?)
          ON DUPLICATE KEY UPDATE item_json = VALUES(item_json)`
-        : `INSERT INTO ${TASK_LIST_ITEMS_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES ($1, $2, $3, $4, $5)
+        : `INSERT INTO ${TASK_LIST_ITEM_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES ($1, $2, $3, $4, $5)
          ON CONFLICT (list_key, id) DO UPDATE SET item_json = EXCLUDED.item_json`, [listKey, id, arrayIndexOf(id), sort, itemJson]);
     await exec(dialect === "tidb"
         ? `UPDATE ${TASK_LIST_META_TABLE} SET next_sort = ? WHERE list_key = ?`
@@ -118,7 +118,7 @@ export function createTiDBTaskListStore(pool, listKey) {
     // 套件抓获:8 并发 increment 终值 1)。MySQL 的快照点(首次快照读)不同但同修;顶层单语句无此臂。
     const build = (q, inTx) => ({
         get: async (id) => {
-            const [rows] = (await q.query(`SELECT item_json FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = ? AND id = ?${inTx ? " FOR UPDATE" : ""}`, [listKey, id]));
+            const [rows] = (await q.query(`SELECT item_json FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?${inTx ? " FOR UPDATE" : ""}`, [listKey, id]));
             return rows.length > 0 ? parseItem(rows[0].item_json) : undefined;
         },
         set: async (id, item) => {
@@ -128,11 +128,11 @@ export function createTiDBTaskListStore(pool, listKey) {
             await (inTx ? setOn(execOn(q), "tidb", listKey, id, json) : tx((c) => setOn(execOn(c), "tidb", listKey, id, json)));
         },
         delete: async (id) => {
-            const [res] = (await q.query(`DELETE FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = ? AND id = ?`, [listKey, id]));
+            const [res] = (await q.query(`DELETE FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?`, [listKey, id]));
             return res.affectedRows === 1;
         },
         list: async () => {
-            const [rows] = (await q.query(`SELECT item_json FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = ? ORDER BY id_num IS NULL, id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]));
+            const [rows] = (await q.query(`SELECT item_json FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? ORDER BY id_num IS NULL, id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]));
             return rows.map((r) => parseItem(r.item_json));
         },
         allocateId: async () => (inTx ? allocateOn(execOn(q), "tidb", listKey) : tx((c) => allocateOn(execOn(c), "tidb", listKey))),
@@ -177,7 +177,7 @@ export function createPgTaskListStore(pool, listKey) {
     // 双方言姿势,顺带把行锁真拿住)。
     const build = (q, inTx) => ({
         get: async (id) => {
-            const { rows } = await q.query(`SELECT item_json FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = $1 AND id = $2${inTx ? " FOR UPDATE" : ""}`, [listKey, id]);
+            const { rows } = await q.query(`SELECT item_json FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = $1 AND id = $2${inTx ? " FOR UPDATE" : ""}`, [listKey, id]);
             return rows.length > 0 ? parseItem(rows[0].item_json) : undefined;
         },
         set: async (id, item) => {
@@ -197,11 +197,11 @@ export function createPgTaskListStore(pool, listKey) {
             await (inTx ? setOn(execOn(q), "pg", listKey, id, json) : tx((c) => setOn(execOn(c), "pg", listKey, id, json)));
         },
         delete: async (id) => {
-            const res = await q.query(`DELETE FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = $1 AND id = $2`, [listKey, id]);
+            const res = await q.query(`DELETE FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = $1 AND id = $2`, [listKey, id]);
             return (res.rowCount ?? 0) === 1;
         },
         list: async () => {
-            const { rows } = await q.query(`SELECT item_json FROM ${TASK_LIST_ITEMS_TABLE} WHERE list_key = $1 ORDER BY (id_num IS NULL), id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]);
+            const { rows } = await q.query(`SELECT item_json FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = $1 ORDER BY (id_num IS NULL), id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]);
             return rows.map((r) => parseItem(r.item_json));
         },
         allocateId: async () => (inTx ? allocateOn(execOn(q), "pg", listKey) : tx((c) => allocateOn(execOn(c), "pg", listKey))),

package/dist/plugins/tidb-pool.js

@@ -296,9 +296,9 @@ export const SCHEMA_STATEMENTS = [
     // Service-side resume rebuild inputs (DURABLE-CHECKPOINT-PLAN §4.4a): sessionId-keyed because core's
     // put(token,cp) can't carry service scenario_ctx. GC'd by the reaper once its checkpoint is gone.
     `CREATE TABLE IF NOT EXISTS checkpoint_ctx (
-     session_id VARCHAR(190) NOT NULL,
-     ctx        JSON         NOT NULL,
-     updated_at BIGINT       NOT NULL,
+     session_id    VARCHAR(190) NOT NULL,
+     ctx           JSON         NOT NULL,
+     updated_at_ms BIGINT       NOT NULL,
      PRIMARY KEY (session_id)
    ) COLLATE utf8mb4_bin`,
     // E18 resume-at anchor map: the shell holds live E2 eventIds (never persisted by core); TaskSpec.resumeAt takes a
@@ -409,18 +409,18 @@ export const SCHEMA_STATEMENTS = [
     // core's InMemoryWorkflowJournalStore (byOrdinal.set). LOAD-BEARING (a resume replays it), unlike the best-effort
     // task_event observation log. GC'd by the run reaper (deleteByRun). See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
-     run_id     VARCHAR(191) NOT NULL,
-     ordinal    INT          NOT NULL,
+     run_id        VARCHAR(191) NOT NULL,
+     ordinal       INT          NOT NULL,
      -- scope (SVC-2 / CORE-9 audit BLOCKER): the table predates scope — it was added when the
      -- WorkflowJournalStore seam grew a scope param for cross-tenant resume isolation. Every new append writes the
      -- run's REAL scope. EXISTING (pre-migration) rows carry '' = CROSS-SCOPE ORPHANS, harmless by construction: a
      -- real resume filters WHERE scope = <caller>, so the blank-scope residue never matches a tenant. The
      -- NOT NULL DEFAULT '' is what let the original ALTER succeed on a table that already had rows — keep the
      -- default so the "'' = orphan, never a tenant" reading stays true.
-     scope      VARCHAR(190) NOT NULL DEFAULT '',
-     call_key   VARCHAR(255) NOT NULL,
-     result     MEDIUMTEXT   NOT NULL,
-     created_at BIGINT       NOT NULL,
+     scope         VARCHAR(190) NOT NULL DEFAULT '',
+     call_key      VARCHAR(255) NOT NULL,
+     result        MEDIUMTEXT   NOT NULL,
+     created_at_ms BIGINT       NOT NULL,
      PRIMARY KEY (run_id, ordinal)
    ) COLLATE utf8mb4_bin`,
     // RB-242 / WF2 ([1981] core 拍板 a 形):cross-replica workflow resume admission lease. PK (source_run_id, scope)
@@ -437,36 +437,36 @@ export const SCHEMA_STATEMENTS = [
     // WorkflowRun as a JSON blob + extracted index columns; `rev` column = the OCC authority (blob rev overlaid
     // on read). MEDIUMTEXT (16MB) >> the 4MB write guard in the store.
     `CREATE TABLE IF NOT EXISTS workflow_run (
-     id         VARCHAR(191) NOT NULL,
-     scope      VARCHAR(190) NOT NULL,
-     status     VARCHAR(16)  NOT NULL,
-     run        MEDIUMTEXT   NOT NULL,
-     rev        INT          NOT NULL DEFAULT 0,
-     created_at BIGINT       NOT NULL,
-     ended_at   BIGINT       NULL,
+     id            VARCHAR(191) NOT NULL,
+     scope         VARCHAR(190) NOT NULL,
+     status        VARCHAR(16)  NOT NULL,
+     run           MEDIUMTEXT   NOT NULL,
+     rev           INT          NOT NULL DEFAULT 0,
+     created_at_ms BIGINT       NOT NULL,
+     ended_at      BIGINT       NULL,
      PRIMARY KEY (id),
-     KEY idx_wfrun_scope_created (scope, created_at),
+     KEY idx_wfrun_scope_created (scope, created_at_ms),
      KEY idx_wfrun_scope_status (scope, status)
    ) COLLATE utf8mb4_bin`,
     // P1: cross-replica workflow completion inbox (the push half). seq = insertion order (re-enqueue
     // moves to tail via DELETE+INSERT). summary is bounded upstream (core notifier ≤4000).
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
-     seq         BIGINT       NOT NULL AUTO_INCREMENT,
-     session_id  VARCHAR(190) NOT NULL,
-     run_id      VARCHAR(191) NOT NULL,
-     owner       VARCHAR(190) NULL,
-     status      VARCHAR(16)  NOT NULL,
-     summary     TEXT         NOT NULL,
-     enqueued_at BIGINT       NOT NULL,
+     seq            BIGINT       NOT NULL AUTO_INCREMENT,
+     session_id     VARCHAR(190) NOT NULL,
+     run_id         VARCHAR(191) NOT NULL,
+     owner          VARCHAR(190) NULL,
+     status         VARCHAR(16)  NOT NULL,
+     summary        TEXT         NOT NULL,
+     enqueued_at_ms BIGINT       NOT NULL,
      -- kind (1.109): task_notification entries SHARE this inbox — kind discriminates the drain frame family.
      -- 🔴 NULL = a legacy workflow_complete row, AND it stays a LIVE value: the workflow_complete enqueue path
      -- never sets kind, so new rows are written NULL too. The read side has the matching compat branch —
      -- tidb-workflow-run-store.ts projects kind only when non-null and workflow-completion-inbox.ts routes
      -- kind === "task_notification" vs everything-else. Do NOT "tidy" this into NOT NULL DEFAULT.
-     kind        VARCHAR(24)  NULL,
+     kind           VARCHAR(24)  NULL,
      -- payload: bounded + redacted JSON extras (task_type / result / …) for the task_notification family.
      -- NULL for legacy / plain workflow_complete rows.
-     payload     TEXT         NULL,
+     payload        TEXT         NULL,
      PRIMARY KEY (session_id, run_id),
      UNIQUE KEY uq_wfinbox_seq (seq),
      KEY idx_wfinbox_session_seq (session_id, seq)

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -107,7 +107,7 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
         newRunId: string;
         scope: string;
     }): Promise<void>;
-    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at < now - maxAgeMs). The
+    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at_ms < now - maxAgeMs). The
      *  per-run deleteByRun has no production caller (a run-store reap gives no per-run hook), so this bounded sweep
      *  — wired into the service reaper — is what keeps the heaviest table (TaskResult-bearing) from growing without
      *  bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).

package/dist/plugins/workflow-journal-store-sql.js

@@ -29,11 +29,11 @@ export class SqlWorkflowJournalStore {
         // → its ordinal isn't cached, so a resume re-runs that one agent live (resume is an optimization).
         if (oversizeJournalResult(serialized))
             return;
-        await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at) VALUES (?,?,?,?,?,?) " +
+        await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES (?,?,?,?,?,?) " +
             // scope NOT in the UPDATE: a re-append keeps the FIRST writer's scope (fail-closed — a re-append must never
             // reassign tenancy). The owner is the sole writer + runId is unique per scope, so this never fires
             // cross-scope in practice; the secure choice over matching InMemory's last-write-wins on scope.
-            "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at) VALUES ($1,$2,$3,$4,$5,$6) " +
+            "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES ($1,$2,$3,$4,$5,$6) " +
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);
     }
     /** Entries for `runId` IF its recorded scope === `scope`, ASCENDING by ordinal; otherwise EMPTY. CORE-9 audit
@@ -108,13 +108,13 @@ export class SqlWorkflowJournalStore {
     async releaseResumeClaim(input) {
         await this.db.query(this.q("DELETE FROM workflow_resume_claim WHERE source_run_id = ? AND scope = ? AND new_run_id = ?", "DELETE FROM workflow_resume_claim WHERE source_run_id = $1 AND scope = $2 AND new_run_id = $3"), [input.sourceRunId, input.scope, input.newRunId]);
     }
-    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at < now - maxAgeMs). The
+    /** GC — time-based sweep: purge journal entries older than `maxAgeMs` (created_at_ms < now - maxAgeMs). The
      *  per-run deleteByRun has no production caller (a run-store reap gives no per-run hook), so this bounded sweep
      *  — wired into the service reaper — is what keeps the heaviest table (TaskResult-bearing) from growing without
      *  bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).
      *  Idempotent; returns the rows purged. */
     async reapExpired(now, maxAgeMs) {
-        const res = await this.db.query(this.q("DELETE FROM workflow_journal WHERE created_at < ?", "DELETE FROM workflow_journal WHERE created_at < $1"), [now - maxAgeMs]);
+        const res = await this.db.query(this.q("DELETE FROM workflow_journal WHERE created_at_ms < ?", "DELETE FROM workflow_journal WHERE created_at_ms < $1"), [now - maxAgeMs]);
         return res.affected;
     }
 }

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -12,7 +12,7 @@
  *
  * ## WorkflowRunStore twin
  * One row per run: the full `WorkflowRun` as a JSON blob + EXTRACTED columns for everything SQL needs to
- * index/filter (scope, status, created_at, ended_at) + an authoritative `rev` column (the OCC key — the
+ * index/filter (scope, status, created_at_ms, ended_at) + an authoritative `rev` column (the OCC key — the
  * blob's own `rev` is OVERLAID from the column on every read, so writes never have to know the bumped value
  * up front). `update` is a single-statement CAS (`WHERE id AND scope [AND rev]`, `SET rev = rev + 1`);
  * `listByScope` projects через core's SHARED `summarizeWorkflowRun` (anti-drift — identical to InMemory/File).

package/dist/plugins/workflow-run-store-sql.js

@@ -46,7 +46,7 @@ export class SqlWorkflowRunStore {
     async put(id, run) {
         const stored = { ...run, id, rev: run.rev ?? 0 }; // key authoritative + observed-rev base (InMemory parity)
         try {
-            await this.db.query(this.q("INSERT INTO workflow_run (id, scope, status, run, rev, created_at, ended_at) VALUES (?,?,?,?,?,?,?)", "INSERT INTO workflow_run (id, scope, status, run, rev, created_at, ended_at) VALUES ($1,$2,$3,$4,$5,$6,$7)"), [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
+            await this.db.query(this.q("INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at) VALUES (?,?,?,?,?,?,?)", "INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at) VALUES ($1,$2,$3,$4,$5,$6,$7)"), [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
         }
         catch (e) {
             // create-once error every backend throws (contract) — dup-key classification is dialect-specific:
@@ -132,7 +132,7 @@ export class SqlWorkflowRunStore {
             }
         }
         // Sort in SQL (newest first), summarize via core's SHARED projection (anti-drift).
-        const { rows } = await this.db.query(`SELECT run, rev FROM workflow_run WHERE ${where} ORDER BY created_at DESC, id DESC${limit}`, params);
+        const { rows } = await this.db.query(`SELECT run, rev FROM workflow_run WHERE ${where} ORDER BY created_at_ms DESC, id DESC${limit}`, params);
         return rows.map((r) => {
             const run = JSON.parse(String(r.run));
             run.rev = Number(r.rev);
@@ -156,12 +156,12 @@ export class SqlWorkflowRunStore {
             return 0; // retention is always explicit
         // Cheap columns only; terminal-set + keep-N semantics computed in JS to match InMemory EXACTLY
         // (isTerminalWorkflowStatus is core's — no status list duplicated into SQL).
-        const { rows } = await this.db.query(this.q("SELECT id, status, created_at, ended_at FROM workflow_run WHERE scope = ? ORDER BY created_at DESC, id DESC", "SELECT id, status, created_at, ended_at FROM workflow_run WHERE scope = $1 ORDER BY created_at DESC, id DESC"), [scope]);
+        const { rows } = await this.db.query(this.q("SELECT id, status, created_at_ms, ended_at FROM workflow_run WHERE scope = ? ORDER BY created_at_ms DESC, id DESC", "SELECT id, status, created_at_ms, ended_at FROM workflow_run WHERE scope = $1 ORDER BY created_at_ms DESC, id DESC"), [scope]);
         const terminal = rows.filter((r) => isTerminalWorkflowStatus(String(r.status)));
         const doomed = [];
         for (let i = 0; i < terminal.length; i++) {
             const r = terminal[i];
-            const anchor = r.ended_at != null ? Number(r.ended_at) : Number(r.created_at);
+            const anchor = r.ended_at != null ? Number(r.ended_at) : Number(r.created_at_ms);
             const tooOld = opts.maxAgeMs !== undefined && anchor < now - opts.maxAgeMs;
             const overKeep = opts.keep !== undefined && i >= opts.keep;
             if (tooOld || overKeep)
@@ -214,9 +214,9 @@ export class SqlWorkflowCompletionInbox {
         // TiDB `REPLACE` = delete-conflicting-row + insert atomically, and omitting `seq` mints a fresh
         // AUTO_INCREMENT = tail. PG has no REPLACE, so the twin is an upsert that explicitly re-mints `seq` off the
         // BIGSERIAL's own sequence — same outcome (idempotent-on-runId + move-to-tail in ONE statement).
-        await this.db.query(this.q("REPLACE INTO workflow_completion_inbox (session_id, run_id, owner, status, summary, enqueued_at, kind, payload) VALUES (?,?,?,?,?,?,?,?)", "INSERT INTO workflow_completion_inbox (session_id, run_id, owner, status, summary, enqueued_at, kind, payload) VALUES ($1,$2,$3,$4,$5,$6,$7,$8) " +
+        await this.db.query(this.q("REPLACE INTO workflow_completion_inbox (session_id, run_id, owner, status, summary, enqueued_at_ms, kind, payload) VALUES (?,?,?,?,?,?,?,?)", "INSERT INTO workflow_completion_inbox (session_id, run_id, owner, status, summary, enqueued_at_ms, kind, payload) VALUES ($1,$2,$3,$4,$5,$6,$7,$8) " +
             "ON CONFLICT (session_id, run_id) DO UPDATE SET seq = nextval(pg_get_serial_sequence('workflow_completion_inbox','seq')), " +
-            "owner = EXCLUDED.owner, status = EXCLUDED.status, summary = EXCLUDED.summary, enqueued_at = EXCLUDED.enqueued_at, kind = EXCLUDED.kind, payload = EXCLUDED.payload"), [entry.sessionId, entry.runId, entry.owner, entry.status, entry.summary, entry.enqueuedAt, entry.kind ?? null, entry.payload ?? null]);
+            "owner = EXCLUDED.owner, status = EXCLUDED.status, summary = EXCLUDED.summary, enqueued_at_ms = EXCLUDED.enqueued_at_ms, kind = EXCLUDED.kind, payload = EXCLUDED.payload"), [entry.sessionId, entry.runId, entry.owner, entry.status, entry.summary, entry.enqueuedAt, entry.kind ?? null, entry.payload ?? null]);
         // 1.108 review (lens① MAJOR ×2): the File impl's check-then-set is atomic on one event loop; here the
         // fence check and the INSERT are two network statements, so a fence written IN BETWEEN (a poll served on
         // another replica, or a racing purge) would leave fence + pending row coexisting → the next drain re-pushes
@@ -254,9 +254,9 @@ export class SqlWorkflowCompletionInbox {
         // inbox does — markTerminalServed's fence-INSERT and ack-DELETE are two statements, and a drain on
         // another replica between them re-emitted an already-served completion (the in-memory pending()
         // filters by servedAt; this brings the SQL twin to the same semantics).
-        const { rows } = await this.db.query(this.q("SELECT i.run_id, i.owner, i.status, i.summary, i.enqueued_at, i.kind, i.payload FROM workflow_completion_inbox i " +
+        const { rows } = await this.db.query(this.q("SELECT i.run_id, i.owner, i.status, i.summary, i.enqueued_at_ms, i.kind, i.payload FROM workflow_completion_inbox i " +
             "WHERE i.session_id = ? AND NOT EXISTS (SELECT 1 FROM workflow_inbox_fence f WHERE f.session_id = i.session_id AND f.kind = ? AND f.run_id IN (i.run_id, REGEXP_REPLACE(i.run_id, '#[0-9]+$', '')) AND f.until_ms >= ?) " +
-            "ORDER BY i.seq ASC", "SELECT i.run_id, i.owner, i.status, i.summary, i.enqueued_at, i.kind, i.payload FROM workflow_completion_inbox i " +
+            "ORDER BY i.seq ASC", "SELECT i.run_id, i.owner, i.status, i.summary, i.enqueued_at_ms, i.kind, i.payload FROM workflow_completion_inbox i " +
             "WHERE i.session_id = $1 AND NOT EXISTS (SELECT 1 FROM workflow_inbox_fence f WHERE f.session_id = i.session_id AND f.kind = $2 AND f.run_id IN (i.run_id, regexp_replace(i.run_id, '#[0-9]+$', '')) AND f.until_ms >= $3) " +
             "ORDER BY i.seq ASC"), [sessionId, KIND_SERVED, Date.now()]);
         return rows.map((r) => ({
@@ -265,7 +265,7 @@ export class SqlWorkflowCompletionInbox {
             owner: r.owner === null ? null : String(r.owner),
             status: String(r.status),
             summary: String(r.summary),
-            enqueuedAt: Number(r.enqueued_at),
+            enqueuedAt: Number(r.enqueued_at_ms),
             ...(r.kind != null ? { kind: String(r.kind) } : {}),
             ...(r.payload != null ? { payload: String(r.payload) } : {}),
         }));

package/dist/security.js

@@ -175,7 +175,15 @@ export function createAuthorizer(config, sessionStore) {
                 // omitted the header under requirePrincipal=false could attach to ANY owned session by id.
                 // Anonymous callers may still attach to anonymous (owner=null) sessions, so single-tenant dev
                 // (no principals anywhere) is unaffected; flipping the requirePrincipal default is NOT needed.
-                if (owner != null && owner !== principal) {
+                //
+                // [3262] 存量哨兵窄互认([3260] cli live 取证→本仓裁 (a)):cli ≤1.0.70 对本地单用户自发
+                // `anon:shell-live` header,存量 session 的 owner 列全是这一个哨兵;cli 停发(表示法归一为
+                // 「缺席」,[3239] 复裁)后若仍逐字比对,缺席请求 attach 存量会话恒 401 —— 用户全部既存
+                // resume 即断。互认=同一主体(本地单用户)两个表示法的过渡承接,不是兼容臂:三条件缺一
+                // 不可(单机形 ∧ owner 恰为哨兵字面量 ∧ 请求 principal 缺席),带任何具名 principal 的请求
+                // 对哨兵会话仍走下方 403;多租形 header 必到,本臂不可达。存量随会话生命周期消亡后本臂可整删。
+                const legacyShellOwner = !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
+                if (!legacyShellOwner && owner != null && owner !== principal) {
                     throw principal
                         ? new HttpError(403, "session does not belong to this principal")
                         : new HttpError(401, `session is principal-owned; missing principal header '${config.principalHeader}'`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.7.1",
+  "version": "7.8.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.10.0",
+    "@sema-agent/sdk": "^6.11.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",