@sema-agent/server 7.70.0 → 7.72.0

package/dist/config.js

@@ -9,7 +9,7 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
@@ -260,16 +260,53 @@ function numEnvOr(name, fallback) {
         return fallback;
     return parseNumOrFail(name, raw);
 }
-function cheapCostEnv(name, mainPrice) {
+function costEnv(name, emptyString) {
     const raw = process.env[name];
     if (raw === undefined)
-        return mainPrice;
+        return undefined;
     if (raw === "") {
+        if (emptyString === "unset")
+            return undefined;
         CONFIG_WARNINGS.push({ env: name, raw: "", used: "0", kind: "empty-preserved" });
         return 0;
     }
     return parseNumOrFail(name, raw);
 }
+function buildCostOrAbsent(read, inherited) {
+    const declared = read.input !== undefined || read.output !== undefined || read.cacheRead !== undefined || read.cacheWrite !== undefined;
+    if (!declared && inherited === undefined)
+        return undefined;
+    return {
+        input: read.input ?? inherited?.input ?? 0,
+        output: read.output ?? inherited?.output ?? 0,
+        cacheRead: read.cacheRead ?? inherited?.cacheRead ?? 0,
+        cacheWrite: read.cacheWrite ?? inherited?.cacheWrite ?? 0,
+    };
+}
+export function buildModelCostKey(cost) {
+    return (cost === undefined ? {} : { cost });
+}
+export function buildUnpricedCeilingNotice(models, limits) {
+    const ceilings = [
+        ...(limits.maxTaskCostUsd > 0 ? ["MAX_TASK_COST_USD"] : []),
+        ...(limits.maxPrincipalCostUsd > 0 ? ["MAX_PRINCIPAL_COST_USD"] : []),
+    ];
+    const entries = Object.values(models);
+    if (ceilings.length === 0 || entries.length === 0 || entries.some((m) => m.cost !== undefined))
+        return undefined;
+    return {
+        event: "cost_ceiling_without_pricing",
+        fields: {
+            ceilings: ceilings.join(","),
+            models: [...new Set(entries.map((m) => m.id))].join(","),
+            note: `${ceilings.join(" / ")} is configured but NO model in the effective catalog declares a price table — an ` +
+                "unpriced model reports NO cost at all (core RB-368), so these $ ceilings can never fire and this deployment " +
+                "has no cost guardrail despite looking like it does. Set MODEL_COST_INPUT / MODEL_COST_OUTPUT / " +
+                "MODEL_COST_CACHE_READ / MODEL_COST_CACHE_WRITE (env lane), or a per-model `cost` on the center roster row. " +
+                "The token ceiling (MAX_TASK_TOKENS) is unaffected and still fires.",
+        },
+    };
+}
 function optNumEnvStrict(name) {
     const raw = process.env[name];
     if (!raw)
@@ -753,12 +790,12 @@ function parseModelDomain() {
         baseUrl: "",
         reasoning: boolEnv("MODEL_REASONING", true),
         input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"],
-        cost: {
-            input: numEnv("MODEL_COST_INPUT", "0"),
-            output: numEnv("MODEL_COST_OUTPUT", "0"),
-            cacheRead: numEnv("MODEL_COST_CACHE_READ", "0"),
-            cacheWrite: numEnv("MODEL_COST_CACHE_WRITE", "0"),
-        },
+        ...buildModelCostKey(buildCostOrAbsent({
+            input: costEnv("MODEL_COST_INPUT", "unset"),
+            output: costEnv("MODEL_COST_OUTPUT", "unset"),
+            cacheRead: costEnv("MODEL_COST_CACHE_READ", "unset"),
+            cacheWrite: costEnv("MODEL_COST_CACHE_WRITE", "unset"),
+        }, undefined)),
         contextWindow: numEnv("MODEL_CONTEXT_WINDOW", "262144"),
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
             ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
@@ -776,12 +813,12 @@ function parseModelDomain() {
             id: cheapId,
             name: cheapId,
             input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
-            cost: {
-                input: cheapCostEnv("MODEL_CHEAP_COST_INPUT", model.cost.input),
-                output: cheapCostEnv("MODEL_CHEAP_COST_OUTPUT", model.cost.output),
-                cacheRead: cheapCostEnv("MODEL_CHEAP_COST_CACHE_READ", model.cost.cacheRead),
-                cacheWrite: cheapCostEnv("MODEL_CHEAP_COST_CACHE_WRITE", model.cost.cacheWrite),
-            },
+            ...buildModelCostKey(buildCostOrAbsent({
+                input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
+                output: costEnv("MODEL_CHEAP_COST_OUTPUT", "declares-zero"),
+                cacheRead: costEnv("MODEL_CHEAP_COST_CACHE_READ", "declares-zero"),
+                cacheWrite: costEnv("MODEL_CHEAP_COST_CACHE_WRITE", "declares-zero"),
+            }, model.cost)),
             contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
@@ -855,12 +892,12 @@ function parseModelDomain() {
             }
             : undefined,
         resilience: {
-            connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", "30000"),
-            firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", "120000"),
-            idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", "300000"),
-            circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", false),
-            failureThreshold: numEnv("MODEL_CB_FAILURE_THRESHOLD", "5"),
-            cooldownMs: numEnv("MODEL_CB_COOLDOWN_MS", "30000"),
+            connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.connectTimeoutMs.value)),
+            firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value)),
+            idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.idleTimeoutMs.value)),
+            circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", RESILIENCE_DEFAULTS.circuitBreaker.value),
+            failureThreshold: numEnv("MODEL_CB_FAILURE_THRESHOLD", String(RESILIENCE_DEFAULTS.failureThreshold.value)),
+            cooldownMs: numEnv("MODEL_CB_COOLDOWN_MS", String(RESILIENCE_DEFAULTS.cooldownMs.value)),
         },
         model,
         envModel: model,
@@ -1551,6 +1588,18 @@ function parseOrchestrationDomain(ctx) {
             assertReadDenyBuiltinsResolvable(tiers, exclude);
             return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
         })(),
+        ...((h) => (h !== undefined ? { remoteExecHomeDir: h } : {}))((() => {
+            const raw = process.env.REMOTE_EXEC_HOME_DIR;
+            if (raw === undefined || raw === "")
+                return undefined;
+            if (!raw.startsWith("/")) {
+                throw new Error(`REMOTE_EXEC_HOME_DIR="${raw}" is not an absolute path — it is the home directory of the user the EXECUTION ` +
+                    `environment runs as (the base a \`~/\` permission rule resolves against), so a relative value cannot be ` +
+                    `resolved and would silently guard nothing. Spell it absolutely (e.g. /home/user), or unset it to have ` +
+                    `\`~/\` rules refused loudly on this lane.`);
+            }
+            return raw;
+        })()),
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -1941,7 +1990,7 @@ const AUTH_GROUP_KEYS = [
     "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
-    "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "remoteExec", "remoteExecHomeDir", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",

package/dist/deployment-governance.d.ts

@@ -59,8 +59,10 @@ export interface PathAdjudication {
      *  形上是一个永不创建的哨兵目录 —— 对写门 fail-safe,对规则 fail-open。理由逐字见
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskRoot`。缺席 ⇒ 需要基的规则拼法被 core 整表拒(fail-loud)。 */
     readonly taskRoot?: string;
-    /** 🔴 S-177 / codex r2:**执行环境的 home**(`~/…` 形规则的基)。只在引擎与执行同机时在场 ——
-     *  远端车道上 server 的 home 是另一个用户的目录,回落它 = 规则静默失效。逐字见
+    /** 🔴 S-177 / codex r2 + S-213④:**执行环境的 home**(`~/…` 形规则的基)。在**本部署的执行车道
+     *  真知道自己的 home 时**在场 —— 判据的唯一属主是 `execution-lane-caps.ts` 的 `executionLaneHomeDir`
+     *  (adapter 的 `ExecutionEnv.homeDir` 座读的是同一个函数)。绝不回落引擎进程自己的 home:远端车道上
+     *  那是另一个用户的目录,拿它去匹配 = 一条收紧规则静默守错地方。逐字见
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
     readonly taskHome?: string;
 }
@@ -85,7 +87,8 @@ export interface DurableApprovalSeat {
  * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
  * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
  * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
+ * 工具名取 `approval-content-kind.ts` 的单一属主(它 re-export core 根导出的 `ASK_USER_QUESTION_TOOL_NAME`);
+ * server.ts 的 pre-CAS 守卫读同一枚(S-213①:此处旧注称该常量「core 未根导出」= 失实,曾据此手抄 13 处)。
  * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
  * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
  * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)

package/dist/deployment-governance.js

@@ -1,12 +1,13 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, ok, } from "@sema-agent/core";
 import { createDurableAskPolicy } from "./approval.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
         check(req) {
-            if (req.toolName !== "AskUserQuestion")
+            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME)
                 return { action: "allow" };
             return live.hasLiveContext()
                 ? { action: "allow" }

package/dist/execution-lane-caps.d.ts

@@ -1,40 +1,3 @@
-/**
- * 执行车道**闭集**与 per-lane 能力表(design device-executor-lane-v2 §4.1 收敛件,车A-1)。
- *
- * ## 根本问题:lane 词表是开放字符串上的十几处独立判别式
- *
- * `config.remoteExec?.provider` 的静态型是 `string | undefined` 的判别联合,但消费面从来不是一处
- * switch —— 而是散在十几个文件里的**独立等式/集合/否定**:`cwdHonored` 比 `=== "host"`、
- * `isRemoteScratchpadLane` 查一个 `Set`、`isSandboxPathAdjudicationLane` 取 `!== "host"` 的否定、
- * `sandboxSendLaneEnabled` 是一串 if。于是「lane 词表加一个词」的病形不是编译错,是**每一处的默认
- * 答案静默错**:新词不在 Set 里 ⇒ 静默 false;不等于 `"host"` ⇒ 静默 true。没有一处会报,每一处都
- * 给出一个**没有人表过态**的答案(DISEASE-SHAPES V1/V2;[ref] 执行车道轴的同族病)。
- *
- * ## 本模块 = 那张表的单源(三件)
- *
- *  ① {@link ExecutionLane}:闭集联合。含 `in-process` —— `REMOTE_EXEC` 未设的进程内 stub 形**是**一条
- *     真车道(`boot/resolve-spec.ts` 的 `?? "in-process"`、`config.ts` 的落点记账都已在用这个词),
- *     把它排除在闭集外,普查就少一列。
- *  ② {@link executionLaneCaps}:**穷举 switch**(先例 = `capabilities/hands-lane.ts` 的
- *     `pickHandsRunner`:无 `default` 臂 ⇒ 联合加词而此处不加臂 = 编译错,而不是运行期落一个默认行)。
- *  ③ {@link ExecutionLaneCaps} 的每一位都点名它**今天的判别式坐标**,由对账测试
- *     `test/execution-lane-caps.test.ts` 逐位跑真判别式与本表对拍。
- *
- * ## 🔴 本模块是表,不是执法者
- *
- * 消费点今天仍各自判别(把判别式改成读本表 = 分批的后续车)。所以本表的全部价值押在对账测试上:
- * 表与判别式一旦分叉,门红。**唯一**允许的分叉是 {@link PLANNED_LANE_DIVERGENCES} 里逐条登记的
- * 「表是目标态、判别式待某车补」;登记项之外的分叉是漂移,登记项被补齐而不销行同样是红(双向)。
- *
- * ## 能力位的口径
- *
- * 每一位回答的是**车道结构上能不能**,不是「这个部署开没开」:旋钮(`LSP_ENABLED` /
- * `SCHEDULER_ENABLED` / k8s 的 `s3Snapshot`)由消费点在表之上再合取。租户面是唯一的例外 —— 它与
- * 车道语义绑死(host 的单用户前提),所以进了 {@link LaneCapability} 的第三个词而不是靠调用方记住。
- *
- * 依赖纪律:本文件是**叶**(只 type-import config-types),不引 config.ts —— config.ts 反过来引它取
- * {@link RemoteExecProvider}([ref] 必需 env 表按同一联合键控)。
- */
 import type { ServiceConfigFlat } from "./config-types.js";
 /** 一位能力的三态。`single-user-only` = 车道支持,但只在单用户部署(`requirePrincipal !== true`)开 ——
  *  多租户下这一位必须关(host 家族的 cwd/scheduler/backgroundShell/LSP 都是这一档,理由同源:
@@ -149,4 +112,55 @@ export interface PlannedLaneDivergence {
  * 加行的门槛不变:一条分叉必须写清 today / owner / why 三件,并在补齐的**同一批**里销掉。
  */
 export declare const PLANNED_LANE_DIVERGENCES: readonly PlannedLaneDivergence[];
+/**
+ * E2B 沙箱里 agent 跑成的那个用户的 home。
+ *
+ * 这是 **E2B 平台的事实**,不是本仓的猜:E2B 的基础模板建 `user` 这个用户,每个 sandbox 的进程都以它
+ * 运行,home 恒 `/home/user`;本仓 adapter 自己的工作区根默认值(`plugins/remote-env-e2b.ts` 的
+ * `DEFAULT_MOUNT_PATH`)用的就是同一个目录。**若某个部署的自定义模板换了用户**,运维用
+ * `REMOTE_EXEC_HOME_DIR` 显式声明覆盖 —— 那条旋钮恒赢,见 {@link executionLaneHomeDir}。
+ * ⚠️ 本值**未经真机实测**(本批无 e2b 真机),按平台约定 + 仓内既有默认常量登记。
+ */
+export declare const E2B_SANDBOX_HOME = "/home/user";
+/** {@link executionLaneHomeDir} 读的那两位部署配置(`ServiceConfig` 结构上满足)。 */
+export interface LaneHomeDeployment {
+    readonly remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+    /** `REMOTE_EXEC_HOME_DIR` —— 运维显式声明的执行环境 home(绝对路径;坏值在 config 层拒启)。 */
+    readonly remoteExecHomeDir?: string | undefined;
+}
+/**
+ * 「**这条部署的执行环境**以哪个 home 运行」—— `~/…` 形权限规则(`Edit(~/.ssh/**)`)唯一的基。
+ *
+ * ## 病(接入审计 M13 / DEBTS S-213④)
+ * core 的 `ExecutionEnv.homeDir` 是**由 adapter 声明**的座(`engine/harness/types.d.ts:511`,可选):
+ * 缺席 ⇒ core 的 `resolvePathPattern` 回 `{missingBase:"home"}` ⇒ 该规则对这条腿判 `unreadable`
+ * (fail-closed 的 ask)。四只远端 adapter(e2b/k8s/host/ssh)一个都没声明,而 server 侧的 422 前置门
+ * (`task-settings.ts` 的 `rejectUnmatchableSettingsNames`)在 home 未知时整表拒 `~/` 形 ——
+ * **于是远端部署根本写不出 `~/` 规则**,恒 422。
+ *
+ * ## 本函数 = 那个值的**单一属主**
+ * 两个消费面读同一份,不许各算各的(两处不同 = 一条规则在 422 门上被拒、却在引擎里编得出来,或反之):
+ *  ① 每只 adapter 的 `homeDir` 座(`boot/execution-env.ts` 把本函数的答案递进 adapter 配置);
+ *  ② 规则基 `PathRuleBases.home`(`boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 的
+ *     `pathAdjudication.taskHome`)。
+ *
+ * ## 一条规则,不是七条特判
+ * **运维显式声明恒赢**(`REMOTE_EXEC_HOME_DIR`,部署级旋钮,不挂任何客户端表态);没有声明时,
+ * 只有「home 是**车道本身**的属性」的那几条车道才有答案:
+ *  · `host` / `in-process` —— 命令就跑在本进程这台机器、这个用户下,`os.homedir()` 读的就是它
+ *    (core 自己的 `NodeExecutionEnv` 同判);
+ *  · `e2b` —— 平台固定用户,见 {@link E2B_SANDBOX_HOME};
+ *  · `k8s` / `local-docker` —— home 是**镜像**的属性,boot 期无从得知;
+ *  · `ssh` —— home 是**目标机上那个登录用户**的属性(root 是 `/root`、macOS 是 `/Users/<u>`),
+ *    连上之前无从得知,而 422 门要在下单那一刻回答;
+ *  · `adb` —— Android 没有 POSIX 意义上的登录 home;
+ *  · `device` —— 员工自己的机器,运行期才连进来。
+ * 这五条一律**缺席**(诚实:不猜一个目录去守)。缺席的后果是 `~/` 规则在下单时被 422 响亮拒,
+ * 与 core 的 `missingBase:"home"` 同向 —— 这正是负控要的那一格。
+ *
+ * 认不出的车道 ⇒ `undefined`(调用方 fail-closed)。生产链上不可达:`loadConfig` 的 [ref] 拒启门先咬。
+ */
+export declare function executionLaneHomeDir(deployment: LaneHomeDeployment): string | undefined;
 //# sourceMappingURL=execution-lane-caps.d.ts.map

package/dist/execution-lane-caps.js

@@ -1,3 +1,4 @@
+import { homedir } from "node:os";
 const NO = "unsupported";
 const YES = "supported";
 const SU = "single-user-only";
@@ -163,4 +164,26 @@ export function laneCapabilityHolds(cap, deployment) {
     }
 }
 export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
+export const E2B_SANDBOX_HOME = "/home/user";
+export function executionLaneHomeDir(deployment) {
+    const declared = deployment.remoteExecHomeDir;
+    if (declared !== undefined)
+        return declared;
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    switch (lane) {
+        case "in-process":
+        case "host":
+            return homedir();
+        case "e2b":
+            return E2B_SANDBOX_HOME;
+        case "k8s":
+        case "local-docker":
+        case "ssh":
+        case "adb":
+        case "device":
+            return undefined;
+    }
+}
 //# sourceMappingURL=execution-lane-caps.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -1,5 +1,6 @@
 import type { TaskNotificationPayload, TerminalCause, WorkflowRun } from "@sema-agent/core";
-import type { RunRecord } from "../plugins/store-contracts.js";
+import type { RunRecord, UnsuccessfulRunStatus } from "../plugins/store-contracts.js";
+import type { AssertAllKeysHandled } from "../trace/core-keyset-guard.js";
 /** [ref] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
  *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
@@ -618,4 +619,24 @@ export declare function isTerminalFleetStatus(status: FleetTaskStatus): boolean;
 export declare function runStatusToFleet(status: RunStatusForFleet, opts?: {
     awaitingPlanApproval?: boolean;
 }): FleetTaskStatus;
+/**
+ * S-213③ —— **编译期同源钉**:fleet 的 `"failed"` 桶必须恰好收下 `RUN_STATUS_CLASS` 判为「非成功终局」
+ * 的每一个 core 词。
+ *
+ * 这个词的病史:`blocked` 曾在本仓有**两个独立写者**且答案互斥 —— 本文件读它为「非成功终局(agent
+ * 放弃)⇒ 行离场」,而 `observability/run-terminal-log.ts` 读它为「治理判决,不是失败 ⇒ 不打行」。两处
+ * 各自穷举、各自正确地编译,结果是一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。
+ * 语义收归 `plugins/store-contracts.ts` 的那张表之后,本行不再自持判断:表把某个词挪出/挪进
+ * `unsuccessful`(或 core 新增一个非成功终态)而上面的 switch 没跟上 ⇒ 下面这条收不敛到 `never` ⇒ tsc 红。
+ * (`"error"` 是 server 自有别名、不在那张表的辖域内,故不在本钉的两边出现。)
+ */
+type FleetUnsuccessfulBucket = "failed" | "blocked";
+type _GuardFleetUnsuccessfulBucket = AssertAllKeysHandled<Exclude<UnsuccessfulRunStatus, FleetUnsuccessfulBucket>>;
+/** 反向门(与 `core-keyset-guard.ts` 的 `_Guard*Reverse` 同形):桶里留了一个表**不再**判为非成功终局的
+ *  词同样红 —— 只有正向门时,把 `blocked` 挪回 `succeeded` 而 switch 照旧塞进 failed 桶,并集覆盖、
+ *  差集门一声不吭(本批实测:只加正向门时该变异 tsc rc=0)。两道钉一起加。 */
+type _GuardFleetUnsuccessfulBucketReverse = AssertAllKeysHandled<Exclude<FleetUnsuccessfulBucket, UnsuccessfulRunStatus>>;
+/** 占位使用(防 noUnusedLocals 形 lint;类型别名本身零运行时)。 */
+export type FleetVocabGuards = [_GuardFleetUnsuccessfulBucket, _GuardFleetUnsuccessfulBucketReverse];
+export {};
 //# sourceMappingURL=fleet-bus.d.ts.map

package/dist/fleet/fleet-bus.js

@@ -634,9 +634,10 @@ export function runStatusToFleet(status, opts) {
         case "completed":
             return "completed";
         case "failed":
-        case "error":
         case "blocked":
             return "failed";
+        case "error":
+            return "failed";
         case "suspended":
             return "waiting";
         case "needs_review":

package/dist/http/durable-run-leg.d.ts

@@ -0,0 +1,64 @@
+/**
+ * **一条 durable run 的「建行 + 驱动」单一属主**(S-218 提取;此前整段住在 `routes/runs.ts` 的
+ * `createDurableRun` 里,只服务 HTTP/A2A 两条提交门)。
+ *
+ * 🔴 为什么提成模块:`/decide` 的 workflow 第三条车道在**宿主不在 park 上**时,同样要在宿主会话上起
+ * 一跑新 turn 把决定交给宿主的模型(S-218)。这条链上挂着 `createRun` 的会话 claim(以及它唯一诚实的
+ * 409 出路)、checkpoint ctx 落库、fleet 行发布、resume/rewind 两族锚点捕获、审批 ALS、通告投递……
+ * 手抄第二份 = 把这十来件事复制成两份会漂的实现,而漂开的那天没有任何东西会说话(`createDurableRun`
+ * 当年从路由体里提取出来时,头注写的就是同一条判词)。方向:`routes/runs.ts` 与 `http/server.ts`
+ * 都 import 本模块,本模块谁都不 import —— 与 `http/run-meta.ts` 同一条「两个域共用一件 ⇒ 单独成文件」。
+ *
+ * 边界(本腿**不**含的东西,留给各自的门):`body.taskId` 幂等重放、`Idempotency-Key` 内存去重、
+ * lease / 治理窗 pre-admission、属主门。它们是**提交面**的判据(读请求、写响应),而本腿只吃已经备好的
+ * `PreparedTaskSubmission` 并交回一份收据 —— 这正是它能被一条没有 `ServerResponse` 的内部车道复用的原因。
+ */
+import { type RunInternals } from "@sema-agent/core";
+import type { RunStore } from "../plugins/store-backend.js";
+import type { PreparedTaskSubmission, RouteCtxBase } from "./route-ctx.js";
+/**
+ * 🔴 **TRUSTED run internals** —— 由**部署方**(不是模型、不是请求体、不是工具参数)铸给这一跑的
+ * core 内部席位。今天唯一成员 `workflowParkedResume` = 人对一条 parked workflow 子代的决定
+ * (语义属主 = core `RunInternals.workflowParkedResume` 的 d.ts 顶注:「A host that decided a workflow
+ * child's parked checkpoint launches the run that re-invokes `Workflow({resumeFromRunId})` with the
+ * decision here」)。
+ *
+ * 为什么单独命名而不是直接摊 `RunInternals`:`RunInternals` 里绝大多数席位是**执行腿自己**铸的
+ * (onForwardEvent / onTaskNotification / onActivity …),把整只类型开给调用方等于邀请第二个写者;
+ * 本类型只开「部署方可以决定的那一格」,新增一格时**必须**在这里显式点名,编译期看得见。
+ * 缺席 ⇒ 对两条腿都是完整 no-op。
+ */
+export type TrustedRunInternals = Pick<RunInternals, "workflowParkedResume">;
+export interface DurableRunLegArgs {
+    /** `prepareSpec` 的产物,或内部车道按同一条 `resolveSpec` 装配出来的等价形。 */
+    prepared: PreparedTaskSubmission;
+    /** 调用方自带的 taskId(`POST /v1/runs` 的 `body.taskId` 幂等键);缺席 ⇒ 本腿铸 uuidv7。 */
+    clientTaskId?: string;
+    /** 🔒 这条 run 的 **fleet 行 scope** —— 必须与 `GET /v1/fleet/stream` 过滤用的是同一个身份,且绝不是
+     *  自报的 `x-agent-principal` 头(自报头会把行打到受害者的 scope 上,或打到 `default` 而真属主的流把它
+     *  过滤掉)。提交门传 `gatedPrincipal(req) ?? "default"`;`/decide` 的第三条车道传 resume 家族的
+     *  `resumeFleetScope(req, auth)`(同一条 wire 上两条腿因此同答)。 */
+    fleetScope: string;
+    /** 🔒 这条 run 的 **elicit / question 应答方**(E23:与 respond 门读的是同一个已验身份,不是自报头)。
+     *  提交门传 `gatedPrincipal(req) ?? null` = 提交者本人;`/decide` 的第三条车道传**卡属主**(= 原提交者,
+     *  不是代为按下按钮的 operator —— 与 resume 腿那条成文口径逐字同源)。`null` = 匿名/开放部署。 */
+    elicitOwner: string | null;
+    /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。 */
+    source: string | null;
+    /** 见 {@link TrustedRunInternals}。缺席 ⇒ 与本位存在之前逐字相同。 */
+    trustedInternals?: TrustedRunInternals;
+}
+/**
+ * 建行 + 驱动。返回 `202` = 新行已建并在跑(体带 `taskId`/`sessionId`);`409` = 会话被别的 run 占着,
+ * **没有**建行(体 = `buildActiveRunConflict` 的既有形,含 `errorCode: "conflict.session_active_run"`)。
+ * 协议渲染归调用方(HTTP `sendJson` / A2A 协议对象 / `/decide` 的受理体)。
+ */
+export declare function mintAndDriveDurableRun(ctx: RouteCtxBase, runStore: RunStore, args: DurableRunLegArgs): Promise<{
+    status: number;
+    body: {
+        taskId: string;
+        sessionId: string;
+        status: string;
+    } | object;
+}>;
+//# sourceMappingURL=durable-run-leg.d.ts.map

package/dist/http/durable-run-leg.js

@@ -0,0 +1,63 @@
+import { uuidv7 } from "@sema-agent/core";
+import { runInBackground } from "../runs.js";
+import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
+import { cascadeConfig, runMeta } from "./run-meta.js";
+import { resolveStreamApprovalGate } from "../tool-approval.js";
+import { buildActiveRunConflict } from "./active-run-conflict.js";
+import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
+import { recordResourceWindow } from "../resource-window.js";
+export async function mintAndDriveDurableRun(ctx, runStore, args) {
+    const { deps } = ctx;
+    const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
+    const sessionId = args.prepared.spec.sessionId ?? uuidv7();
+    const taskId = args.clientTaskId ?? uuidv7();
+    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(args.prepared, args.source));
+    if (created.ok)
+        clearTurnActivity(taskId);
+    if (created.ok)
+        recordResourceWindow(taskId, args.prepared.spec.resourceSuspend);
+    if (created.ok)
+        deps.sessionTitler?.maybeTitle(sessionId, args.prepared.spec.objective, typeof args.prepared.spec.model === "string" ? args.prepared.spec.model : args.prepared.spec.model?.id);
+    if (!created.ok) {
+        if (args.clientTaskId && created.activeTaskId === args.clientTaskId) {
+            return { status: 202, body: { taskId: args.clientTaskId, sessionId, status: "running" } };
+        }
+        return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+    }
+    if (deps.checkpointStore) {
+        await deps.checkpointStore.putCtx(sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope });
+    }
+    const anchorOwner = args.prepared.auth?.principal ?? null;
+    const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
+    const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
+        ? async (eventId) => {
+            const leaf = await getLeafId(sessionId);
+            if (leaf)
+                await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
+        }
+        : undefined;
+    const captureUserMessageAnchor = deps.resumeAnchorStore
+        ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
+        : undefined;
+    const fleetPub = fleetRunPublisher(deps.fleetBus, {
+        runId: taskId,
+        scope: args.fleetScope,
+        rootTaskId: taskId,
+        ...fleetRunLabels(args.prepared.spec.objective),
+    });
+    void runInBackground(args.prepared.runner, { ...args.prepared.spec, sessionId }, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
+        ? {
+            coordinator: deps.toolApproval,
+            streamApprovalOn: resolveStreamApprovalGate({
+                toolApprovalEnabled: true,
+                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                backend: deps.backend,
+                parkFacility: deps.checkpointStore !== undefined,
+            }).active,
+            windowMs: deps.config.streamApproval?.windowMs,
+            windowMarginMs: deps.config.streamAskWindowMarginMs,
+        }
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals);
+    return { status: 202, body: { taskId, sessionId, status: "running" } };
+}
+//# sourceMappingURL=durable-run-leg.js.map

package/dist/http/route-ctx.d.ts

@@ -438,6 +438,20 @@ export interface RouteMiss {
  * 两臂逐字节同形,指路价值不丢。钉=audit-fixes-http「[ref]」格(两臂全文比对);文案变更走
  * api-error-text-freeze 基线流程。
  */
+/**
+ * **「决定/续跑已受理」那一枚 200 收据的单一铸点**(S-218)。
+ *
+ * 两条腿投同一份体:①resume 家族的受理点(`driveResumeLeg`,宿主停在 park 上时);②`/decide` 的
+ * workflow 第三条车道在宿主**不在** park 上时新铸的那一跑。契约上这两条腿说的是同一句话 ——
+ * 「决定已被受理,拿 `taskId` 去 poll `GET /v1/runs/:id` / `/events` 跟终态」——所以消费端**一条分支
+ * 都不该加**;写成两份字面量,漂开的那天没有任何东西会说话。
+ *
+ * `bindingEnforced` 的语义不因铸点而变(「这次决定按绑定坐标受理,不是盲目放行」),故两腿同带。
+ */
+export declare function acceptedResumingReceipt(taskId: string, sessionId: string): {
+    status: number;
+    body: object;
+};
 export declare const RUN_NOT_FOUND_MESSAGE = "run not found \u2014 the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 /** [ref] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给 TaskOutput/journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
 export declare function runNotFoundMessage(id: string): string;

package/dist/http/route-ctx.js

@@ -17,6 +17,9 @@ export function sendResumeOutcome(res, out, logger, extraBody) {
         res.setHeader("retry-after", String(Math.ceil(wait)));
     sendJson(res, out.status, extraBody === undefined ? out.body : { ...out.body, ...extraBody });
 }
+export function acceptedResumingReceipt(taskId, sessionId) {
+    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
+}
 export const RUN_NOT_FOUND_MESSAGE = "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
 export function runNotFoundMessage(id) {
     const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);

package/dist/http/routes/approvals-assistant.js

@@ -1,4 +1,4 @@
-import { screenedGate } from "../../trace/project.js";
+import { screenedStoredGate } from "../../trace/project.js";
 import { personDecision } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
@@ -87,7 +87,7 @@ async function decideIdempotentReplay(cs, args) {
                 return undefined;
             }
         }
-        return screenedGate(first);
+        return screenedStoredGate(first);
     })();
     return {
         status: 200,
@@ -200,7 +200,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     ...(s.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
-                    ...(s.classifierUnavailable !== undefined ? { classifierUnavailable: s.classifierUnavailable } : {}),
+                    ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),
                     objective: ctx?.body?.objective ?? null,
                     input,
                 };

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { DEFAULT_EFFORT_LEVELS, expandTiers, routePairingStatus } from "@sema-agent/core";
+import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { isModelAllowlisted } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
@@ -194,7 +194,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             vision: Array.isArray(m.input) ? m.input.includes("image") : false,
             ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
             ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
-            ...(m.reasoning ? { supportedEffortLevels: [...DEFAULT_EFFORT_LEVELS] } : {}),
+            ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
             ...(m.compat !== undefined ? { compat: m.compat } : {}),
             ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
             routePairing: routePairingOf(deps, name, m),