@sema-agent/server 7.70.0 → 7.71.0

package/README.md

@@ -168,7 +168,7 @@ The server is configured entirely through environment variables. The most import
 | `PERMISSIONS_DISABLE_AUTO_MODE` | `false` | Local mirror of CC `permissions.disableAutoMode` — the **org deny** bit for `permissionMode:"auto"` (paired with core's intent-arming rule). **Tighten-only**: `true` folds every principal's `runtimeCaps.autoMode` to `false` (a center grant cannot flip it back); unset leaves caps untouched, so on a center-less box a shell asking for `auto` **arms** the classifier once the paired core (intent-arming rule "requested ∧ classifier seat ∧ `autoMode !== false`" — absence is not a deny) is installed; on core 7.2.0 the engine still uses the old "org grant" rule (`permissionModeAuto.intentArming:false`), so the self-check answers `armed:true` only for a center-granted principal and `deployment_incapable` on a center-less box. Boolean word table; any other value refuses to start. Self-check: `GET /v1/capabilities?permissionMode=auto` → `permissionModeAuto.{armed, reason, model}` (USAGE §9.4) |
 | `SCRATCHPAD_SWEEP_TTL_MS` | 7 days | Idle-reap window for per-session scratchpad dirs (by dir mtime; `0` disables). The scratchpad is **ephemeral by contract**: replica-local disk, NOT part of the durable-suspend persistence set — a resume on a different replica, or after a sweep, starts with an empty dir (same two-track posture as the Agent SDK hosting doc: conversation persists, working-directory artifacts don't). Raise/disable only on single-replica deployments that park approvals for longer than the window |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | Gateway connect timeout |
-| `MODEL_FIRST_TOKEN_TIMEOUT_MS` | `120000` | First-token timeout |
+| `MODEL_FIRST_TOKEN_TIMEOUT_MS` | `600000` | First-token timeout (the only watchdog for a stream that opens and never emits; `0` = off. Raised from `120000` in 7.71.0 — a self-hosted backend's long prefill legitimately takes minutes to the first byte; set `120000` to restore the old posture) |
 | `MODEL_IDLE_TIMEOUT_MS` | `300000` | Mid-stream idle timeout (`0` = off) |
 | `LOG_LEVEL` | `info` | `debug` / `info` / `warn` / `error` (structured JSON logs) |
 

package/README.zh-CN.md

@@ -151,7 +151,7 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `WRITE_PROTECTED_EXTRA` | 未设(引擎缺省表) | 给 core 的**写保护名表**加行(字面名表:命中即把幸存的 `allow` 降级成 `ask`,作用于 Write/Edit/NotebookEdit)。逗号分隔裸名(裸名匹配**任意路径段**,含 `/` 的名匹配连续段)或 JSON 数组(`"name"` 串 / `{name, kind}` 行,`kind`:`basename` \| `segment` \| `segment-run`)。值按 `[...core 缺省表, …]` 组合,**丢不掉任何缺省行**。未设 = 不铸座 = 引擎缺省表在岗(本仓从不复制那张表)。两形按**内容**判而不是猜首字符:值里出现 JSON 结构字符(`[ ] { } "`)即按 JSON 解析,且顶层**必须是数组**(少写一对方括号 ⇒ 拒启,而不是被拆成垃圾裸名静默收下)。空值 / 坏值(通配符、未知 kind、kind 与名字段数矛盾)/ 与 `WRITE_PROTECTED_TABLE_REPLACE` 同时设置 ⇒ **启动即拒**。读面:`GET /v1/capabilities` 的 `writeProtection.{armed,rows,replaced}`;`GET /v1/diagnostics/wiring` 的 `writeProtection.{rows,source,droppedDefaultRows}`(operator-only) |
 | `WRITE_PROTECTED_TABLE_REPLACE` | 未设(引擎缺省表) | **整表替换**写保护名表(core 的座按契约就是整表)。只收 JSON 数组 —— 刻意不给逗号简写:一个手滑的裸串会把 51 行换成 1 行。`[]` = 显式「完全不要这张表」。替换时 boot 期发一条**响亮**日志逐名列出被丢的缺省行(`write_protection_table_replaced`;空表走 `write_protection_table_disabled`)—— 想「加两行」请用 `WRITE_PROTECTED_EXTRA`。拒启条件同姊妹键,外加:两根同写 = 一条语义面两个写者 ⇒ 拒启 |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | 网关连接超时 |
-| `MODEL_FIRST_TOKEN_TIMEOUT_MS` | `120000` | 首 token 超时 |
+| `MODEL_FIRST_TOKEN_TIMEOUT_MS` | `600000` | 首 token 超时(开流不吐字的唯一看门狗;`0`=关。7.71.0 起由 `120000` 提高 —— 自托管后端长 prefill 下首字合理地就要等几分钟;要旧姿态显式设 `120000`) |
 | `MODEL_IDLE_TIMEOUT_MS` | `300000` | 流中 idle 超时(`0` 关) |
 | `LOG_LEVEL` | `info` | `debug` / `info` / `warn` / `error`(结构化 JSON 日志) |
 

package/USAGE.md

@@ -63,6 +63,8 @@ ANTHROPIC_API_KEY=sk-ant-…   # 可选:ANTHROPIC_BASE_URL / ANTHROPIC_VERSION /
 # ③ 分级超时:任务级 limits.maxWalltimeMs(6.0.0 起,毫秒)之下补两段,各记为可重试的 [network] → 触发重试/断路器/failover
 MODEL_CONNECT_TIMEOUT_MS=8000        # fetch 迟迟不返响应头(网关连不上)→ 中止
 MODEL_FIRST_TOKEN_TIMEOUT_MS=30000   # SSE 已开但迟迟不吐第一个 delta(网关 hang);reasoning 的首个 thinking 也算首 token
+                                     # 缺省 600000(7.71.0 起,原 120000):自托管后端长 prefill 下首字合理地要等几分钟,
+                                     # 120s 会把一次正常的慢启动判成 [network] 失败去重试。快失败部署显式设回 120000;0=关
 MODEL_IDLE_TIMEOUT_MS=20000          # (1.40.1)出过 token 后中途卡死:每个 delta 重置,静默超时→中止(补 first-token 只管首字)
 # ④ 断路器:主网关连败 N 次即"开路"→ 快速失败,让 failover 立刻切备(不再逐个等超时)
 MODEL_CIRCUIT_BREAKER=true  MODEL_CB_FAILURE_THRESHOLD=5  MODEL_CB_COOLDOWN_MS=30000
@@ -163,7 +165,7 @@ MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;词
 - 成本计量**自动开**:从 config 的 `model.cost`(per-1M 绝对 USD)注入 `pricing`,core 算出权威的整数 `costMicroUsd`(避免浮点累计误差)。`/metrics` 新增:`model_cost_micro_usd_total{model}`(覆盖所有 brain 调用=主任务+异步+council 子任务的总花费)、`brain_first_token_ms`(网关 hang 早警)、`brain_call_latency_ms`、`tool_calls_total{name,ok}`、`budget_exceeded_total{code}`、`cost_quota_rejected_total`、`degraded_total{reason}`(1.40 降级)。
 - **近预算降级 vs 硬闸**:降级(`MODEL_DEGRADE_TO`,到 `atCostFraction` 切便宜模型)是**撑长**预算、任务仍完成(出口质量下降、发 `task.degraded` 事件可告警);硬闸(`maxCostUsd` 全额)仍在,切了便宜模型还超全额 → `limits.max_cost_exceeded` 停。
 - **`METRICS_TOKEN`**(可选,只读):设了它,`GET /metrics`+`/metrics/summary` 接受**它或** `SERVICE_AUTH_TOKEN`。**全 fleet 设同一个值** → 管理端(sema-web,规划名 sema-admin)用**一个** token 拉所有 worker 的指标,**无需持有各 worker 的全权 `SERVICE_AUTH_TOKEN`**(不破坏 secret 边界)。即使外泄也只暴露指标(只读)。
-- **`GET /metrics/summary`**(token-gated,同 `/metrics`):`/metrics` 的**精炼 JSON**——`{model, runsActive, tasks{status}, tokensTotal, costUsd, costUsdByModel, taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, rateLimited, costQuotaRejected, budgetExceeded, degraded, cascade, verifications, councilRuns, toolErrors}`。给**轻量 fleet 看板**用(管理端 sema-web 的 fleet 页按 worker 拉、渲染卡片、按轮询算速率;**不用 Prometheus/Grafana**)。counter 是累计值、histogram 报均值。
+- **`GET /metrics/summary`**(token-gated,同 `/metrics`):`/metrics` 的**精炼 JSON**——`{model, runsActive, tasks{status}, tokensTotal, costUsd, costUsdByModel, taskDurationAvgSec, brainFirstTokenAvgMs, brainCallAvgMs, cacheHitRateAvg, rateLimited, costQuotaRejected, budgetExceeded, limitCeilingAfterAnswer, degraded, cascade, verifications, councilRuns, toolErrors}`(`limitCeilingAfterAnswer` 自 7.71.0,按 `origin` 分桶的「答后撞顶」计数;与 `budgetExceeded` **总体不同** —— 前者每条引擎 run 都过,后者只由 HTTP 提交腿递增 —— 不要无条件相加)。给**轻量 fleet 看板**用(管理端 sema-web 的 fleet 页按 worker 拉、渲染卡片、按轮询算速率;**不用 Prometheus/Grafana**)。counter 是累计值、histogram 报均值。
 - 预算闸是 core 强制的:`maxCostUsd` pre-call 估算(没花钱就拒)+ 流中途取消 + turn 边界(`limits.max_cost_exceeded`);`maxTokens` 超 → `limits.max_tokens_exceeded`(core 5.8.0 起 `budget.*` 前缀退役)。**review 网关**建议设 `MAX_TASK_COST_USD` 防单任务烧掉共享云 key。
 - 🔴 **三道 $ 闸的分工(别拿进场门当中途停机用)**:三根旋钮名字都带 cost,但**判的时刻**和**能不能打断正在烧的那张单**完全不同。按「谁触发 / 什么时刻判 / 拒或停长什么样」对表:
 
@@ -322,7 +324,7 @@ MODEL_CODE_ROLES=default,subagent     # 不设=全中立;仅这些角色在「
 | `MEMORY_ORG_UNAVAILABLE_BACKOFF_MS` | `10000`(`[500, 600000]`) | 目录取不到之后的退避窗(只用于取数失败臂,不用于负结果) |
 | `MEMORY_DELEGATION_EVIDENCE` | 缺省(=引擎自缺省 `static-face`) | **委派臂的证据标准**(core 5.45.0 起)。`static-face`=今日行为:委派的 attestation 缺失/未知**且**静态工具面够得着外部内容 ⇒ 标记本会话记忆为已污染(可能性即暴露)。`attested-only`=**只**豁免那一条静态面标记,且**真的豁免了一次**才响亮通告(`engine_notice` 的 `memory.delegation_static_mark_waived`,每个 prepared leg **至多**一次);送达 `external` attestation 照标、非委派的污染类工具照标、委派工具自身被分类为污染的照标。⚠️ 通告**不是 leg 计数器**:不含委派的 leg、污染面没挂载的 leg、送达了 attestation 的委派都不发 —— 看不到通告的常态含义是「没有可豁免的事」,不是「配置坏了」。坏值**启动期拒**。**部署席 only**(TaskSpec 无同名键,任务/受治脚本无法据此放松部署)。⚠️ **已接受的代价**:`attested-only` 下**后台**子代的真实外部接触不标记本会话(其内容经 TaskOutput / 任务通知注入 / AgentTranscript 摘要回流,三条都不带 attestation);异常收尾的前台子代同理。已标记的会话永不回滚清洗。运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.delegationEvidence`(`null`=本部署未设,引擎自缺省) |
 | `MEMORY_PROVENANCE` | 缺省(=引擎自缺省 `carry`) | **记忆 provenance 总开关**(core 5.46.0 起)。一个会话被判为**已暴露**之后,它的记忆写怎么处置。`carry`=引擎缺省:**普通**记忆写照常提交,但带上引擎铸的 `origin` 标记(随条目走后端/同步/导出包);指令形文件(feedback / pinned / triggers / applies-when)仍被扣下隔离;派生索引的会话散文照回滚;内容扫描门原样跑(**标记不是豁免**)。`off`=此前的行为:不铸 origin 标记,已暴露会话的 harvest **一条都不收**(整体隔离候人审)。⚠️ 已提交的标记在编辑时照样带下去 —— `off` 停的是**铸**,从不抹掉已记的事实。与 `MEMORY_DELEGATION_EVIDENCE` **正交**(四种组合全合法):那一键决定**什么时候**判会话为已暴露,本键决定判了之后**对写做什么**。坏值**启动期拒**(`OFF`/`false`/`none` 这类「看起来像关掉」的写法一律不折成缺省 —— 静默回默认 = 一台自认为「暴露会话零收录」的部署其实在照常收录)。**部署席 only**(TaskSpec 无同名键,任务/受治脚本无法据此改姿态);**不冻进 checkpoint**(resume 腿跟当前部署配置走)。运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.provenance`(`null`=本部署未设,引擎自缺省) |
-| `MEMORY_CAPTURE_POLICY` | 缺省(=引擎自缺省 `open`) | **记忆采集 opt-out 的部署姿态**(core 7.0.0 起)。任务可带 `memory.capture:"off"` 声明「本会话不进长期记忆」(一次性,resume 恒不采集,无反向拼写),本键决定怎么裁那条声明:`open`=按面值生效,**只有**该 principal 的显式 `false` verdict 拒(403 `memory.capture_optout_denied`),resolver 故障**放行**+披露(隐私轴 fail-safe:错拒=记了用户明说不要记的会话,不可逆);`governed`=verdict **必答**(混合车队:部分用户强制留存),故障/缺席**拒跑**(fail-closed);`capture-required`=全体声明拒(一行配置)。verdict 源**两条**(析取):①SQL 店后端上的授权表 `memory_optout_grant`(三层折叠:per-principal 行 → 部署缺省行 → 代码缺省 allow;管理面 `GET|PUT /v1/admin/memory-optout`(PUT=部署缺省行)· `PUT|DELETE …/:principal`,operator-only,能力位 `memoryOptOutGrant`,零缓存写后即生效);②非 dry-run 的 config center 在该 principal 的 entitlement caps 里发 `allowMemoryOptOut`。🔴 **`governed` 而两源皆无 ⇒ 启动期拒启**(无源 = 每个声明都被拒且没人知道为什么;接 `DB_BACKEND=mysql|pg`、接非 dry-run center,或改姿态)。⚠️ **center-only 源的语义**(只配了 center、没有 SQL 授权表):`allowMemoryOptOut` 在 entitlement schema 里是**可选键** —— center 不发它 = 该 principal 的 verdict **缺席** = `governed` 下每次 opt-out 恒拒(403 `memory.capture_optout_denied`),而 worker **照常起动**;这一形部署级证不死(per-principal 授权只有运行期才知道),所以 server 两处响亮:启动期一行 `memory_capture_governed_center_only_source`、运行期首次真缺席一行 `memory_capture_governed_verdict_absent`(每进程一次,纯披露不改判)。要确定性 verdict 就接 SQL 授权表(它三层折叠后恒答显式 boolean)。坏值**启动期拒**(`Governed`/`required`/`off` 一律不折成缺省:两种姿态的故障极性**相反**)。**部署席 only**;**不冻进 checkpoint**。运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。记录载体(core 7.0.2 起):SQL 后端(`DB_BACKEND=mysql\|pg`)上记录落 `session_capture_optout` 表(跨副本存活,随中央 schema 自建零旋钮)——**远端车道(e2b/k8s)的 `capture:"off"` 声明自此真持久**;无 SQL 店的远端形仍 409 `config.memory_capture_unsupported`(诚实拒:落不进 resume 副本可见的载体就不许诺);单机本地车道走 core 文件三件套照常。用户面四口:提交键 `memoryCapture:"off"`(声明形)· `POST /v1/runs/:id/memory/capture-optout`(live 中途翻转,owner 门)· `POST /v1/sessions/:id/memory/erase`(所有者自助抹除,select 硬限本会话)· `GET /v1/sessions/:id/memory-status`(状态读面,owner 门,五可选键诚实缺席)。契约全文 `docs/ASSISTANT-WIRE-CONTRACT.md` §12 |
+| `MEMORY_CAPTURE_POLICY` | 缺省(=引擎自缺省 `open`) | **记忆采集 opt-out 的部署姿态**(core 7.0.0 起)。任务可带 `memory.capture:"off"` 声明「本会话不进长期记忆」(一次性,resume 恒不采集,无反向拼写),本键决定怎么裁那条声明:`open`=按面值生效,**只有**该 principal 的显式 `false` verdict 拒(403 `memory.capture_optout_denied`),resolver 故障**放行**+披露(隐私轴 fail-safe:错拒=记了用户明说不要记的会话,不可逆);`governed`=verdict **必答**(混合车队:部分用户强制留存),故障/缺席**拒跑**(fail-closed);`capture-required`=全体声明拒(一行配置)。verdict 源**两条**(析取):①SQL 店后端上的授权表 `memory_optout_grant`(三层折叠:per-principal 行 → 部署缺省行 → 代码缺省 allow;管理面 `GET|PUT /v1/admin/memory-optout`(PUT=部署缺省行)· `PUT|DELETE …/:principal`,operator-only,能力位 `memoryOptOutGrant`,零缓存写后即生效);②非 dry-run 的 config center 在该 principal 的 entitlement caps 里发 `allowMemoryOptOut`。🔴 **`governed` 而两源皆无 ⇒ 启动期拒启**(无源 = 每个声明都被拒且没人知道为什么;接 `DB_BACKEND=mysql|pg`、接非 dry-run center,或改姿态)。⚠️ **center-only 源的语义**(只配了 center、没有 SQL 授权表):`allowMemoryOptOut` 在 entitlement schema 里是**可选键** —— center 不发它 = 该 principal 的 verdict **缺席** = `governed` 下每次 opt-out 恒拒(403 `memory.capture_optout_denied`),而 worker **照常起动**;这一形部署级证不死(per-principal 授权只有运行期才知道),所以 server 两处响亮:启动期一行 `memory_capture_governed_center_only_source`、运行期首次真缺席一行 `memory_capture_governed_verdict_absent`(每进程一次,纯披露不改判)。要确定性 verdict 就接 SQL 授权表(它三层折叠后恒答显式 boolean)。坏值**启动期拒**(`Governed`/`required`/`off` 一律不折成缺省:两种姿态的故障极性**相反**)。**部署席 only**;**不冻进 checkpoint**。运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。记录载体(core 7.0.2 起):SQL 后端(`DB_BACKEND=mysql\|pg`)上记录落 `session_capture_optout` 表(跨副本存活,随中央 schema 自建零旋钮)——**远端车道(e2b/k8s)的 `capture:"off"` 声明自此真持久**;`DB_BACKEND=local` 自 7.71.0 起在记忆引擎接线时供 core 的控制面文件三腿(钉在本部署记忆引擎那只控制面目录上,按记忆平面取用)⇒ 单机默认部署(`CONFIG_PROVIDER=local`、`REMOTE_EXEC` 未设)上声明与中途翻转 verb 从 409 转为真受理(此前该 409 在这一形上是结构性的:core 判「远端」看的是执行环境的接口形,host 车道同被判 remote);记忆面暗的部署本席位缺席而 core 也不走采集腿。今天仍答 409 `config.memory_capture_unsupported` 的只剩把记忆引擎接了却没给任何店的自建装配形。用户面四口:提交键 `memoryCapture:"off"`(声明形)· `POST /v1/runs/:id/memory/capture-optout`(live 中途翻转,owner 门)· `POST /v1/sessions/:id/memory/erase`(所有者自助抹除,select 硬限本会话)· `GET /v1/sessions/:id/memory-status`(状态读面,owner 门,五可选键诚实缺席)。契约全文 `docs/ASSISTANT-WIRE-CONTRACT.md` §12 |
 
   ⚠️ **拒启动**:多租户 + 记忆面点亮 + `projects[].defaultScopes` 里有 org 键 + 目录源缺席 ⇒ 启动报错
   并点名 projectId(该部署的每个此类请求都会在 prepare 期整拒,响亮拒启动比静默全拒服务诚实)。
@@ -1264,7 +1266,8 @@ curl -N http://<host>:8090/v1/tasks/stream -H 'content-type: application/json' \
 | HTTP `200` + `terminal.kind:"completed"` | 成功 | 取 `result` |
 | `terminal.kind:"blocked"` | agent 主动报卡住 | 看 `terminal.reason`,补信息再发 |
 | `terminal:{kind:"failed", code:"conflict"}` | 跨实例乐观锁丢失 | 直接重试(幂等) |
-| `terminal:{kind:"failed", code:"limits.max_walltime_exceeded"}` | 墙钟到限(6.0.0 起 `status:"timeout"` 退役;7.64.0 起平面 `status` 键退役) | 拆小任务 / 提高 `limits.maxWalltimeMs`(毫秒) |
+| `terminal:{kind:"failed", code:"limits.max_walltime_exceeded"}` | 墙钟到限(6.0.0 起 `status:"timeout"` 退役;7.64.0 起平面 `status` 键退役)。🔴 **7.71.0 / 引擎 7.13.0 收窄**:上限若在最后一轮 turn **已经给出干净答案之后**才响,run 记 `completed`、答案就是 `result`,**不铸本码**——那次停机的唯一痕迹是 `engine_notice` 的 `task.interrupt_unconsumed{origin:"walltime"}`(附录 D.3)。本码此后只在**工作被真切断**时出现。⚠️ 按码计数的运维面要把 `origin ∈ walltime\|turns` 的那一帧计入才守恒(server 侧对偶计量 `limit_ceiling_after_answer_total{origin}`,与 `budget_exceeded_total{code}` **相加**才是撞顶总量) | 拆小任务 / 提高 `limits.maxWalltimeMs`(毫秒) |
+| `terminal:{kind:"failed", code:"limits.max_turns_exceeded"}` | 轮数到帽。🔴 **同上收窄**(引擎 7.13.0):帽子若落在**那一轮答案自己**身上 ⇒ `completed` + `task.interrupt_unconsumed{origin:"turns"}`,不铸本码 | 提高 `limits.maxTurns` / 拆小任务 |
 | HTTP `401` | 缺 `Authorization` / 缺 `x-agent-principal`(要求时) | 补头 |
 | HTTP `403` / `404`(session/run) | 不是该 principal 的资源 | 用正确身份 |
 | HTTP `409`(`/v1/runs`) | 同 session 已有活跃 run | 等它完成 / 用返回的 `activeTaskId` |

package/dist/approval-content-kind.d.ts

@@ -1,22 +1,28 @@
 /**
- * [ref]([ref]② core 点名 → [ref] 认领):`contentKind` 投影键的**单一词属主**(server 侧)。
+ * [ref]:`contentKind` 投影键的**单一词属主**(server 侧)。
  *
  * core 在 `summarizeCheckpoint`(dist/core/checkpoint-store.js)对 tool_approval 门铸
- * `contentKind: "content_ask"`,判据一行:`tool.toolName === ASK_USER_QUESTION_TOOL_NAME`
- * (常量声明 = core `dist/core/ask-question.d.ts:14`,值 `"AskUserQuestion"`;该常量**未从 core 包根
- * 导出**(index.d.ts 零命中,exports map 无深路径口)⇒ 本仓落一份同字节常量,不做深路径导入)。
+ * `contentKind: "content_ask"`,判据一行:`tool.toolName === ASK_USER_QUESTION_TOOL_NAME`。
+ * 该常量 **core 从包根导出**(`@sema-agent/core` 的 `index.d.ts`;声明在 `dist/core/ask-question.d.ts`,
+ * 值 `"AskUserQuestion"`)⇒ 本仓 **re-export 那一枚**,一个字节都不自铸。
+ * (S-213①:此处旧注曾写「该常量未从 core 包根导出」并据此在全仓手抄了 13 处同字面量 —— 那句前提
+ *  失实,而每一份手抄都是一个独立写者:core 哪天改了保留工具名,手抄的那些当场与引擎分岔且全部静默。)
  * 三条 server 投影面(SQL `listPending` 列读 / LOCAL `listPending` blob 读 / live `listLivePending`)
  * 全部经 {@link contentKindOf} 派生,恒与 core 的 summarize 面同词 —— 词漂移由 parity 钉看住
  * (`test/local-checkpoint-store.test.ts` [ref] parity 格:core `summarizeCheckpoint` 对 AskUserQuestion
- * checkpoint 的铸值必须逐字等于本函数的答案)。
+ * checkpoint 的铸值必须逐字等于本函数的答案;同文件 S-213① 格再普查「src/ 里零第二份手抄字面量」)。
  *
  * 🔴 与 `hasBidiControls` 的「server 不重算」纪律**不冲突**:那一位是有界扫描的结果(重算可分家),
  * 而 contentKind 是行上 core 铸的 `toolName` 的**全函数**(一行确定性判)——派生 ≠ 重扫。
- * 🔴 OMIT 契约与同族键一致(`boundCallId`/`gateKind`/`hasBidiControls` 的 [ref]② 纪律):
+ * 🔴 OMIT 契约与同族键一致(`boundCallId`/`gateKind`/`hasBidiControls` 的纪律):
  * `"content_ask"` 或**缺席**,恒不铸 `null`/`false`;缺席 = 不是内容问句门(普通工具门 / 非工具 park /
  * toolName 缺席的存量行)。展示/分诊/渲染分型用,永不参与 resume / gate / CAS。
  */
-export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
+/** 保留工具名的 **SQL 字面量**形(单引号已包)。SQL 里也不许再手抄那个词:片段从同一枚常量派生,
+ *  与 `tool-approval.ts` 的 `APPROVAL_GATE_KINDS_SQL_IN`(闭集数组 → IN 片段)同一属主纪律。
+ *  值来自 core 的常量(标识符形,无引号/反斜杠),故直接内插不产生注入面。 */
+export declare const ASK_USER_QUESTION_SQL_LITERAL = "'AskUserQuestion'";
 /** 三读面共用的派生:AskUserQuestion 工具门 ⇒ `"content_ask"`;其余(含 null/缺席)⇒ undefined(键缺席)。 */
 export declare function contentKindOf(toolName: string | null | undefined): "content_ask" | undefined;
 //# sourceMappingURL=approval-content-kind.d.ts.map

package/dist/approval-content-kind.js

@@ -1,4 +1,6 @@
-export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
+import { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
+export const ASK_USER_QUESTION_SQL_LITERAL = `'${ASK_USER_QUESTION_TOOL_NAME}'`;
 export function contentKindOf(toolName) {
     return toolName === ASK_USER_QUESTION_TOOL_NAME ? "content_ask" : undefined;
 }

package/dist/approval.js

@@ -1,5 +1,6 @@
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
 import { operatorAsk } from "./operator-ask.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 export function hasOperatorGateIntent(config) {
     return (config.approvalRequire.length > 0 ||
@@ -58,7 +59,7 @@ export function createDurableAskPolicy(opts) {
                 if (remEarly !== undefined && remEarly <= 0) {
                     return operatorAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
                 }
-                if (opts.exempt && toolName !== "AskUserQuestion") {
+                if (opts.exempt && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
                     return (async () => {
                         let exempted = false;
                         try {
@@ -84,7 +85,7 @@ export function createDurableAskPolicy(opts) {
         if (rem !== undefined && rem <= 0) {
             return operatorAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
         }
-        if (toolName !== "AskUserQuestion" && budget > 0 && autoApproved < budget) {
+        if (toolName !== ASK_USER_QUESTION_TOOL_NAME && budget > 0 && autoApproved < budget) {
             autoApproved++;
             return { action: "allow" };
         }

package/dist/bench/s1/live-deps.js

@@ -4,6 +4,7 @@ import { loadConfig } from "../../config.js";
 import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
 import { RemoteContainerExecutionEnv } from "../../plugins/remote-env-e2b.js";
+import { E2B_SANDBOX_HOME } from "../../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../../approval.js";
 import { createLeaderRunner } from "../../leader/wire.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
@@ -67,6 +68,7 @@ const sh = (env) => async (cmd) => {
 async function provisionSandbox(rt, role, cellId) {
     const env = new RemoteContainerExecutionEnv({
         apiKey: rt.e2bApiKey,
+        homeDir: E2B_SANDBOX_HOME,
         ...(rt.e2bTemplate ? { template: rt.e2bTemplate } : {}),
         timeoutMs: rt.sandboxTimeoutMs ?? 600_000,
         metadata: { s1Cell: cellId, s1Role: role },

package/dist/boot/execution-env.js

@@ -20,6 +20,7 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -68,6 +69,8 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
 }
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
+    const laneHomeDir = executionLaneHomeDir(config);
+    const homeDirSeat = laneHomeDir !== undefined ? { homeDir: laneHomeDir } : {};
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
     const sessionScoped = createSessionScopedRegistries();
@@ -78,6 +81,7 @@ export function createExecutionEnv(ctx) {
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
+            ...homeDirSeat,
             ...(config.remoteExec.template ? { template: config.remoteExec.template } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
             ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
@@ -94,6 +98,7 @@ export function createExecutionEnv(ctx) {
     else if (config.remoteExec?.provider === "k8s") {
         const k8sCfg = {
             image: config.remoteExec.image,
+            ...homeDirSeat,
             ...(config.remoteExec.apiUrl ? { apiUrl: config.remoteExec.apiUrl } : {}),
             ...(config.remoteExec.token ? { token: config.remoteExec.token } : {}),
             ...(config.remoteExec.caCert ? { caCert: config.remoteExec.caCert } : {}),
@@ -116,6 +121,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = sshExecutionEnvFactory({
             host: config.remoteExec.host,
             username: config.remoteExec.username,
+            ...homeDirSeat,
             privateKey: config.remoteExec.privateKey,
             ...(config.remoteExec.port != null ? { port: config.remoteExec.port } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
@@ -128,6 +134,7 @@ export function createExecutionEnv(ctx) {
                 hub: ctx.deviceLane.hub,
                 store: ctx.deviceLane.store,
                 enrollment: ctx.deviceLane.enrollment,
+                ...homeDirSeat,
                 ...(config.remoteExec.execTimeoutMs != null ? { execTimeoutMs: config.remoteExec.execTimeoutMs } : {}),
                 perSessionCwd,
                 perSessionShellEnv,
@@ -138,6 +145,7 @@ export function createExecutionEnv(ctx) {
     else if (config.remoteExec?.provider === "adb") {
         executionEnvFactory = adbExecutionEnvFactory({
             serial: config.remoteExec.serial,
+            ...homeDirSeat,
             ...(config.remoteExec.adbPath ? { adbPath: config.remoteExec.adbPath } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
         });
@@ -160,6 +168,7 @@ export function createExecutionEnv(ctx) {
             if (hostScheduler)
                 logger.info(`R7: self-wake scheduler enabled (host lane), store=${config.schedulerStorePath ?? defaultSchedulerStorePath()}`);
             const hostCfg = {
+                ...homeDirSeat,
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
@@ -181,6 +190,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
+            ...homeDirSeat,
             ...(config.remoteExec.dockerPath ? { dockerPath: config.remoteExec.dockerPath } : {}),
             ...(config.remoteExec.dockerHost ? { dockerHost: config.remoteExec.dockerHost } : {}),
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
@@ -206,14 +216,14 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec?.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
+            const gitBaseEnv = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
                 ...(config.worktreeIsolation.commit ? { commit: config.worktreeIsolation.commit } : {}),
                 baseEnvForGit: gitBaseEnv,
                 rootEnvAt: (dir) => {
-                    const env = new RemoteHostExecutionEnv({ workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
+                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
                     return lspManager ? evictLspOnDestroy(env, lspManager) : env;
                 },
                 logger,

package/dist/boot/memory-consolidation.d.ts

@@ -191,7 +191,8 @@ export declare function createMemoryConsolidationFaces(store: {
      *  🔴 这只引擎是四只 operator 面里**真读名册**的那只:`consolidationEligibility` 第四臂
      *  (engine.js `listCaptureOptOutSessions`)拿它筛掉 opt-out 会话的贡献条目 —— SQL 部署上漏喂
      *  = 驱动器读文件空名册 ⇒ 蒸馏器放大用户明说不要记的内容(S-5 真实失效形;全站同批注入律,
-     *  机器钉 capture-optout-lane ②)。缺席(local 车道)⇒ core 文件三腿,与 Runner 同本。 */
+     *  机器钉 capture-optout-lane ②)。S-215 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
+     *  缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
     captureRecordStore?: SessionCaptureRecordStore;
 }): MemoryConsolidationFaces;
 //# sourceMappingURL=memory-consolidation.d.ts.map

package/dist/boot/parked-revive-gate.d.ts

@@ -6,6 +6,8 @@ import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
     readonly remoteExec?: ServiceConfig["remoteExec"];
+    /** S-213④:`executionLaneHomeDir` 读的运维声明(切面必须点名本腿消费的每一个字段,否则窄视图字面量会静默丢掉旋钮)。 */
+    readonly remoteExecHomeDir?: ServiceConfig["remoteExecHomeDir"];
     /** host 腿裁决 env 的 cwd 占位根(见下方 `hostGateCwd`)。 */
     readonly localDataRoot?: ServiceConfig["localDataRoot"];
 }

package/dist/boot/parked-revive-gate.js

@@ -6,6 +6,7 @@ import { decodeCheckpointScope } from "../security.js";
 import { createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "../deployment-governance.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
@@ -14,6 +15,8 @@ export function createParkedReviveInheritedGate(deps) {
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
+        const laneHome = executionLaneHomeDir(config);
+        const homeBase = laneHome !== undefined ? { taskHome: laneHome } : {};
         const pathAdjudication = isSandboxPathAdjudicationLane(config.remoteExec?.provider)
             ? {
                 env: new DeferredSandboxPathEnv({
@@ -21,8 +24,9 @@ export function createParkedReviveInheritedGate(deps) {
                     slots,
                     logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider, leg: "parked_revive" }) },
                 }),
+                ...homeBase,
             }
-            : { env: createHostAdjudicationEnv(config, localRoot) };
+            : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
             question,

package/dist/boot/resolve-spec.js

@@ -1,6 +1,5 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { homedir } from "node:os";
 import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
@@ -35,6 +34,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSet
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
@@ -409,17 +409,20 @@ export function createResolveSpec(ctx) {
     const foldGovernanceAndSettings = async (body, auth, spec, gated, effMode) => {
         const { appendLessPack, acceptedAppend, parsedSettings } = gated;
         const hostSemanticsLane = !isSandboxPathAdjudicationLane(config.remoteExec?.provider);
+        const laneHomeBase = () => {
+            const home = executionLaneHomeDir(config);
+            return home !== undefined ? { taskHome: home } : {};
+        };
         const pathAdjudication = hostSemanticsLane
             ? (() => {
                 const sessionCwd = auth?.sessionId ? effectiveHostWorkspace(perSessionCwd.get(auth.sessionId), {}) : undefined;
                 const realRoot = sessionCwd ?? (config.remoteExec === undefined ? process.cwd() : undefined);
                 const gateCwd = realRoot ?? join(config.localDataRoot ?? localRoot, "fs-write-gate-unrooted");
-                const realHome = config.remoteExec === undefined ? homedir() : undefined;
                 return {
                     env: new NodeExecutionEnv({ cwd: gateCwd }),
                     cwd: gateCwd,
                     ...(realRoot !== undefined ? { taskRoot: realRoot } : {}),
-                    ...(realHome !== undefined ? { taskHome: realHome } : {}),
+                    ...laneHomeBase(),
                 };
             })()
             : {
@@ -428,6 +431,7 @@ export function createResolveSpec(ctx) {
                     slots: sandboxPathEnvSlots,
                     logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider }) },
                 }),
+                ...laneHomeBase(),
             };
         const governedBase = applyRuntimeGovernance(spec, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngine?.root }));
         let governed = governedBase;
@@ -476,6 +480,7 @@ export function createResolveSpec(ctx) {
                         const sandboxScratchpadDir = isRemoteScratchpadLane(config.remoteExec?.provider) ? remoteScratchpadDirFor(auth?.sessionId) : undefined;
                         return {
                             env: pathAdjudication.env,
+                            ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
                             ...gateCommon,
                             ...(sandboxScratchpadDir ? { scratchpadDir: sandboxScratchpadDir } : {}),
                             ...(gateCommon.isExempt

package/dist/boot/runner-deps.d.ts

@@ -21,10 +21,10 @@ import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js"
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
 import { type EngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
-import type { ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { ServiceWorkflowJournalStore, SessionCaptureRecordSource, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
-import type { MemoryBackend, SessionCaptureRecordStore } from "@sema-agent/core";
+import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
 /**
  * `RunnerDeps.onAsk` 的装配([ref] 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
@@ -116,12 +116,14 @@ export interface RunnerDepsCtx {
         backend: MemoryBackend;
         root: string;
     } | undefined;
-    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2):会话 capture opt-out 记录的 SQL 载体
-     *  (`backend.sessionCaptureRecords()`,main.ts 取**一次**、与四只 operator 面引擎同实例 —— 全站同批
-     *  注入律,机器钉 = test/memory-capture-optout-lane.test.ts ②)。缺席(local 车道)⇒ core 用控制面
-     *  文件三腿,单机字节不变;在场 ⇒ 远端车道 `capture:"off"` 声明从 409 `config.memory_capture_unsupported`
-     *  稳态转为真持久(core prepare-memory 的 §2.1b 能力信号)。 */
-    sessionCaptureRecordStore: SessionCaptureRecordStore | undefined;
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2)/ S-215:会话 capture opt-out 记录的**按平面取用源**
+     *  (`backend.sessionCaptureRecords()`,main.ts 取**一次**、与四只 operator 面引擎同一只源 —— 全站同批
+     *  注入律,机器钉 = test/memory-capture-optout-lane.test.ts ②)。在场 ⇒ `capture:"off"` 声明与中途翻转
+     *  verb 真持久;缺席 ⇒ core 读作「无店」,而 core 的 `captureCarrierUnsupported` 判据是**席位在不在**
+     *  (不是「文件形能不能用」),叠上 `isRemoteExecutionEnv` 的接口形鸭子判 ⇒ 两条 ingress 都拒
+     *  `config.memory_capture_unsupported`。S-215 起三条车道都供(SQL 双方言 twin / local 的控制面文件三腿),
+     *  所以缺席今天只剩一个成因:**记忆面暗**的 local 部署(那时 core 的 capture 腿本就不参与)。 */
+    sessionCaptureRecords: SessionCaptureRecordSource | undefined;
     memorySyncRunner: MemorySyncRunner | undefined;
     /** [ref] 件A([ref] 件3③):org 记忆准入两 seam 的装配产物(boot/org-memory.ts)。进**共享
      *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
@@ -214,43 +216,14 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations">;
-/**
- * core `EngineNotice` → 结构化 `engine_notice` 行的**唯一**转发体([ref]②)。
- *
- * 🔴 为什么是具名导出而不是就地闭包(合并码重扫):这一席此前只落在共享基座里,于是 leader 车道
- * (`src/leader/wire.ts` 自拼 deps 的五处 `new Runner({...})`)一处都没有 —— core 的契约是「接线 ⇒ 走
- * sink,缺席 ⇒ 逐字打 `console.warn`」,所以缺席不是静默而是**同一部署两条通告通道**:主车道进结构化
- * JSON 行,leader 车道落裸 stderr,按 code 采集(`tool_result.offload_put_failed` 等)的运维面漏掉后者。
- * 两处各写一份转发体必漂(键名/字段集),故收成一个函数;入参取**结构形** logger(leader 的 cfg 只带
- * 可选 `warn`/`info` 两格,不是全形 `Logger`)。
- *
- * 🔴 `warn` 是**必填**(codex 复审第一轮,验真后修):可选链 `logger.warn?.(…)` 形在「只装了 `info` 的
- * logger」上会把通告**吞掉** —— 比不接线还坏(不接线时 core 至少还打它自己的 `console.warn`)。所以
- * 「有没有 warn」这个判断留在**装配点**:没有就别铸这一席,让 core 的响亮权留在原处。
- *
- * ## [ref]:双终点分流器(设计稿 = 黑板 [ref])
- * 本体自 [ref] 起是**分流器**,两个终点:
- *  1. **日志(全族,逐字保留)** —— 上面那段契约一个字节不变:任何 code、detail 原样、缺 detail 不铸键。
- *     运维观察面零回退是本腿的硬前提(wire 半场是**增量**,不是搬家)。
- *  2. **wire(白名单 + sessionId 路由)** —— `router.route(notice)`:码在
- *     {@link import("../trace/engine-notice-wire.js").ENGINE_NOTICE_WIRE_CODES} 内**且**归属键在场时,
- *     投给那条会话的 run 腿(SSE + durable 账本);否则一帧不出。归属键 = 顶层 `EngineNotice.sessionId`
- *     **优先**、缺席回落 `detail.sessionId`(单点 `engineNoticeSessionId`;此前这一行只写了 detail 那一半,
- *     顶层键 core 5.46+ 就到了)。判据整条住在
- *     `src/trace/engine-notice-wire.ts`(白名单/归属/消毒/隔离四件同源),这里只负责**先日志后分流**的次序。
- *
- * 🔴 次序是承重的:日志在前 ⇒ 即便 wire 半场整条坏掉(路由抛、口抛),事实仍然完整落在运维面。
- * 反过来写就是「wire 故障吃掉运维日志」,那正是本仓 [ref] 纪律要根除的形。route 自身按 sink 隔离 +
- * F 类留痕(`server.engine-notice.wire-sink-threw`),不向 core 回抛。
- *
- * 🔴 `router` **有默认值**(进程单例)而不是必填:这一席有五个以上装配点(共享基座 / leader 车道四处 /
- * 未来任何新车道),必填会让"新车道忘了传 router"变成**静默半聋**(日志有、wire 无)——与本函数当初
- * 被抽成具名导出的理由逐字同一个。测试要隔离时显式传自己 new 的实例。
- */
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics">;
+/** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
+export interface EngineNoticeMetricsSeat {
+    inc: (name: string, labels?: Record<string, string>) => void;
+}
 export declare function createEngineNoticeForwarder(logger: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
-}, router?: EngineNoticeRouter): NonNullable<RunnerDeps["onNotice"]>;
+}, router?: EngineNoticeRouter, metrics?: EngineNoticeMetricsSeat): NonNullable<RunnerDeps["onNotice"]>;
 /**
  * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
  * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。

package/dist/boot/runner-deps.js

@@ -23,9 +23,15 @@ export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
     "shared-memory-not-mounted",
     "shell-gate-off",
 ]);
-export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter) {
+const CEILING_ORIGINS = new Set(["walltime", "turns"]);
+export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
         logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(notice.detail !== undefined ? { detail: notice.detail } : {}) });
+        if (metrics !== undefined && notice.code === "task.interrupt_unconsumed") {
+            const origin = notice.detail?.origin;
+            if (typeof origin === "string" && CEILING_ORIGINS.has(origin))
+                metrics.inc("limit_ceiling_after_answer_total", { origin });
+        }
         router.route(notice);
     };
 }
@@ -53,7 +59,7 @@ export function buildDeploymentPostureSeats(config) {
 export function createSharedRunnerDeps(ctx) {
     const shared = {
         brain: ctx.brain,
-        onNotice: createEngineNoticeForwarder(ctx.logger),
+        onNotice: createEngineNoticeForwarder(ctx.logger, defaultEngineNoticeRouter, ctx.metrics),
         tiers: ctx.config.tiers,
         models: ctx.config.models,
         roles: ctx.config.roles,
@@ -84,7 +90,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecordStore, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -152,7 +158,7 @@ export function createRunnerDeps(ctx) {
         sessionStore,
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
         memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
-        memoryCaptureRecordStore: sessionCaptureRecordStore !== undefined ? () => sessionCaptureRecordStore : undefined,
+        memoryCaptureRecordStore: sessionCaptureRecords !== undefined ? (plane) => sessionCaptureRecords(plane) : undefined,
         onMemoryHarvestReport: memoryEngine
             ? (report, info) => {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });

package/dist/brain.d.ts

@@ -15,7 +15,9 @@ export declare const FAST_FAIL_MAX_RETRIES = 2;
  *   - **Tiered timeouts** (1.38, `connectTimeoutMs`/`firstTokenTimeoutMs`) are passed into each
  *     openai-compatible brain at creation — they bound "gateway never accepts the connection" and
  *     "stream opened but hangs without a token" as retryable `[network]` failures. Default ON
- *     (30s/120s, [ref] fleet audit; env =0 disables).
+ *     (connect 30s per the fleet-audit recommendation; first-token 600s since S-202 — a self-hosted backend's long
+ *     prefill legitimately takes minutes to the first byte, and 120s turned that into a retry handing the
+ *     same prompt back to the same queue. env =0 disables; env =120000 restores the old posture).
  *   - **Circuit breaker** (`createCircuitBreakerBrain`) wraps the *primary* gateway route(s) when
  *     `MODEL_CIRCUIT_BREAKER=true`: after N transient failures it opens and fast-fails, so failover
  *     switches to the bare backup immediately instead of waiting out each timeout. The last gateway

package/dist/brain.js

@@ -1,5 +1,6 @@
 import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, hasAuthCarrier, resolveRouteCredential, routeRefusalText, } from "@sema-agent/core";
 import { normalizeBaseUrl } from "@sema-agent/core";
+import { MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
@@ -16,7 +17,7 @@ function degradeDeclaredRoot(fallbackBaseUrl, config) {
 export const FAST_FAIL_MAX_RETRIES = 2;
 const DEFAULT_RESILIENCE = {
     connectTimeoutMs: 30_000,
-    firstTokenTimeoutMs: 120_000,
+    firstTokenTimeoutMs: MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT,
     idleTimeoutMs: 300_000,
     circuitBreaker: false,
     failureThreshold: 5,

package/dist/config-catalog.js

@@ -1,5 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { THINKING_FORMATS } from "./model-compat.js";
+import { MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT } from "./config-types.js";
 import { webSearchConfigFromEnv } from "./plugins/web-search.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
@@ -274,7 +275,7 @@ export const CONFIG_CATALOG = [
     r("MODEL_DEGRADE_TO", "modelPlane", "string", "降级目标模型(设了=开降级;外部网关名不必在目录)", { danger: BILL }),
     r("MODEL_DEGRADE_TO_VISION", "modelPlane", "boolean", "降级目标的 vision 声明(false ⇒ 带图任务丢降级不丢图)", { staticDefault: "false" }),
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
-    r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗)", { staticDefault: "120000" }),
+    r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
     r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
     r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV)", { configKey: "gatewayFallbackUrls" }),
@@ -345,6 +346,7 @@ export const CONFIG_CATALOG = [
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: ["e2b", "k8s", "ssh", "adb", "host", "local-docker", "device"], danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),