@sema-agent/server 7.70.0 → 7.72.0

package/dist/plugins/remote-env-k8s.js

@@ -49,6 +49,7 @@ export class RemoteK8sExecutionEnv {
     handleSnapshotId;
     inFlightExecs = 0;
     connectPromise;
+    homeDir;
     cfg;
     deps;
     constructor(config, deps) {
@@ -75,6 +76,7 @@ export class RemoteK8sExecutionEnv {
             ...(config.podEnv ? { podEnv: config.podEnv } : {}),
         };
         this.cwd = this.cfg.mountPath;
+        this.homeDir = config.homeDir;
         this.deps = deps ?? {};
         this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));

package/dist/plugins/remote-env-local-docker.d.ts

@@ -10,6 +10,15 @@ export interface LocalDockerEnvConfig {
      * in-network `node:20` mirror (SWR deprecated).
      */
     image: string;
+    /**
+     * S-213④ / core [ref] —— 本执行环境的 **home 目录**(`ExecutionEnv.homeDir` 座,绝对路径,本环境自己的
+     * 命名空间里)。`~/…` 形权限规则(`Edit(~/.ssh/**)`)对**跑在本 env 里的调用**就以它为基。
+     * 缺席 ⇒ 本 env 声明「我没有 home」,core 对 `~/` 规则判 `unreadable`(fail-closed 的 ask),
+     * 绝不回落引擎进程自己的 home(那在远端腿上是另一个用户的另一个目录 —— 静默守错目录正是 [ref] 的病)。
+     * 值由 `boot/execution-env.ts` 从**唯一属主** `execution-lane-caps.ts` 的 `executionLaneHomeDir` 递进来;
+     * adapter 不自算(两处各算一份 = 422 门与引擎对同一条规则给相反答案)。
+     */
+    homeDir?: string;
     /** Workspace root INSIDE the container; relative paths resolve against it. Default {@link DEFAULT_MOUNT_PATH}. */
     mountPath?: string;
     /** Path to the docker binary (or a docker-compatible CLI). Default "docker" (must be on PATH in the worker). */
@@ -73,6 +82,8 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     };
     /** Working directory inside the container; relative paths resolve against it (ExecutionEnv contract). */
     cwd: string;
+    /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
+    readonly homeDir?: string | undefined;
     private readonly cfg;
     private readonly spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */

package/dist/plugins/remote-env-local-docker.js

@@ -20,6 +20,7 @@ const unsupported = (op) => ({
 export class RemoteLocalDockerExecutionEnv {
     capabilities = { isolation: true, suspendable: false };
     cwd;
+    homeDir;
     cfg;
     spawnFn;
     containerName;
@@ -41,6 +42,7 @@ export class RemoteLocalDockerExecutionEnv {
             controlTimeoutMs: config.controlTimeoutMs ?? DEFAULT_CONTROL_TIMEOUT_MS,
         };
         this.cwd = this.cfg.mountPath;
+        this.homeDir = config.homeDir;
         this.spawnFn = deps.spawn ?? spawn;
         const id = config.id ?? randomBytes(6).toString("hex");
         const suffix = randomBytes(4).toString("hex");

package/dist/plugins/remote-env-ssh.d.ts

@@ -8,6 +8,15 @@ export interface SshEnvConfig {
     /** PEM private key — from the adapter-held secret env (NEVER the workspace). [ref] §5 #2. */
     privateKey: string;
     passphrase?: string;
+    /**
+     * S-213④ / core [ref] —— 本执行环境的 **home 目录**(`ExecutionEnv.homeDir` 座,绝对路径,本环境自己的
+     * 命名空间里)。`~/…` 形权限规则(`Edit(~/.ssh/**)`)对**跑在本 env 里的调用**就以它为基。
+     * 缺席 ⇒ 本 env 声明「我没有 home」,core 对 `~/` 规则判 `unreadable`(fail-closed 的 ask),
+     * 绝不回落引擎进程自己的 home(那在远端腿上是另一个用户的另一个目录 —— 静默守错目录正是 [ref] 的病)。
+     * 值由 `boot/execution-env.ts` 从**唯一属主** `execution-lane-caps.ts` 的 `executionLaneHomeDir` 递进来;
+     * adapter 不自算(两处各算一份 = 422 门与引擎对同一条规则给相反答案)。
+     */
+    homeDir?: string;
     /** Workspace root; relative paths resolve against it. Default "." (the login dir). */
     mountPath?: string;
     /** Connect handshake bound (ms). */
@@ -72,6 +81,8 @@ export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
      *  =重连风暴);②共享尝试**不携带任何 caller 信号**(首创者的 pre-abort 不得毒化 joiner;单 caller
      *  取消只退它自己的等待,底层握手余命 ≤ readyTimeout 有界,彻底取消归 destroy 代际闸)。 */
     private inFlight?;
+    /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
+    readonly homeDir?: string | undefined;
     private readonly cfg;
     private readonly injectedConnectOnce?;
     constructor(config: SshEnvConfig, deps?: SshEnvDeps);

package/dist/plugins/remote-env-ssh.js

@@ -23,6 +23,7 @@ export class RemoteSshExecutionEnv {
     destroyed = false;
     connEpoch = 0;
     inFlight;
+    homeDir;
     cfg;
     injectedConnectOnce;
     constructor(config, deps) {
@@ -41,6 +42,7 @@ export class RemoteSshExecutionEnv {
             hostKey: config.hostKey,
         };
         this.cwd = this.cfg.mountPath;
+        this.homeDir = config.homeDir;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));

package/dist/plugins/store-backend.d.ts

@@ -116,6 +116,22 @@ export type ToolResultStoreFull = ToolResultStore & {
 export type BreakerStateStore = TiDBBreakerState | PgBreakerState;
 export type CostQuotaStore = TiDBCostQuota | PgCostQuota;
 export type RateLimiterStore = TiDBRateLimiter | PgRateLimiter;
+/**
+ * S-215 —— capture opt-out **记录载体的按平面取用座**。形与 core 的
+ * `RunnerDeps.memoryCaptureRecordStore`(`(plane: { controlDir }) => SessionCaptureRecordStore`)同构,
+ * 多一个**不指名平面**的缺省臂:`src()` = 「本部署记忆引擎自己那一只平面」。
+ *
+ * 🔴 为什么是工厂而不是一只实例(S-215 codex r1 [high] 验真后改形):core 的记忆平面**不止一个**
+ * (`prepare-memory.js:162` 的 personal 平面自带 `derivePersonalControlDir(engineRoot)`,与 project 平面的
+ * controlDir 不是同一只)。返回单只实例 ⇒ server 把所有平面折到一只目录上,于是升级前落在 personal
+ * 控制面的旧 opt-out 记录在升级后读作**缺席**=采集恢复(隐私面的静默 fail-open)。按平面取用后,
+ * file 载体与 core 的缺省**逐字节同址**,唯一的变化是这个席位现在**被声明了**(core 的能力信号要的就是它)。
+ * SQL 载体**刻意忽略** plane:它按 session_id 键控、跨平面全局 —— opt-out 是**会话**事实而不是平面事实
+ * (逐字理由见 boot/runner-deps.ts 该席的注)。
+ */
+export type SessionCaptureRecordSource = (plane?: {
+    controlDir: string;
+}) => SessionCaptureRecordStore;
 export interface StoreBackend {
     /** Protocol-truth kind (clay 2026-07-06 wording): "mysql" = any MySQL-protocol server (MySQL / TiDB /
      *  MariaDB) behind the one mysql2 pool — the startup summary prints durable(mysql) for all of them. */
@@ -186,19 +202,25 @@ export interface StoreBackend {
      *  「没有行 ⇒ 代码缺省 allow」—— 那是**放宽面**上的静默降级(permissionRule 那条禁令的同一理由)。
      *  File 形候真实的 local+governed 部署需求出现再落(候需求档)。 */
     memoryOptOutGrant(): MemoryOptOutGrantStore | undefined;
-    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2):会话 capture opt-out **记录**的 SQL 载体
-     *  (`session_capture_optout`)—— core `RunnerDeps.memoryCaptureRecordStore` /
-     *  `MemoryEngineOptions.captureRecordStore` 的持久层(Promise 形三腿)。与 §3.1 的**授权表**不是一个轴:
-     *  那张管「谁**可以** opt-out」(operator 写的 verdict),这张管「谁**已经** opt-out」(用户写的一次性
-     *  单向记录)。
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2)/ S-215:会话 capture opt-out **记录**的载体 ——
+     *  core `RunnerDeps.memoryCaptureRecordStore` / `MemoryEngineOptions.captureRecordStore` 的持久层。
+     *  与 §3.1 的**授权表**不是一个轴:那张管「谁**可以** opt-out」(operator 写的 verdict),这张管
+     *  「谁**已经** opt-out」(用户写的一次性单向记录)。
+     *
+     *  返回的是**按平面取用的源**({@link SessionCaptureRecordSource}),不是一只实例 —— core 的记忆平面
+     *  不止一只,折平会挪动旧记录的地址(理由全文见该类型的头注)。
+     *  载体按车道分形,但**三条车道都供**(S-215 起):SQL 两支 = 双方言 twin(`session_capture_optout`,
+     *  Promise 形三腿,池即依托 ⇒ 无条件供,`plane` 刻意忽略);`local` = core 的控制面文件三腿
+     *  `fileSessionCaptureRecordStore(controlDir)` 按平面现造,依托是**记忆引擎的控制面目录** ⇒ 记忆面暗的
+     *  部署上该平面不存在,于是这一支**随引擎接线门缺席**(唯一的 `undefined` 成因,逐字理由见 LocalBackend 的实装注)。
      *
-     *  🔴 **可选**(与 memoryOptOutGrant 同族):SQL 后端 = 双方言 twin;`local` 车道 **undefined**,且缺席是
-     *  一个真答案 —— 缺席时 core 用它的控制面文件三腿(`fileSessionCaptureRecordStore`),单机部署上那正是
-     *  重启可存活的正确载体(383 §2.1b:「absent = 文件三腿,单进程/单机字节不变」)。SQL 载体要解决的病
-     *  只在无状态多副本形:文件记录对 resume 副本不可见,「record not found」恰朝**继续采集**方向坏。
-     *  刻意不给 local 一个 SQL/内存 twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差),
-     *  文件形 core 已自带。 */
-    sessionCaptureRecords(): SessionCaptureRecordStore | undefined;
+     *  🔴 修前 local 恒 `undefined` 且注称「缺席是一个真答案」—— 那句话在**事实层面**成立(单机的正确载体
+     *  确实就是文件三腿)、在**接线层面**是假的:core 的 `captureCarrierUnsupported`
+     *  (core 7.13.0 `prepare-task.js:497`)判的是「这个席位在不在」而不是「文件形能不能用」,叠上
+     *  `isRemoteExecutionEnv` 的接口形鸭子判(`remote-env.js:21`)把本仓 host lane 一并算作 remote,
+     *  于是单机默认部署上 `memoryCapture:"off"` 两条 ingress 结构性不可达(B-085)。
+     *  刻意仍不给 local 一个**内存** twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差)。 */
+    sessionCaptureRecords(): SessionCaptureRecordSource | undefined;
     /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): does the RETIRED whole-tree
      *  snapshot epoch hold a boundary for (sessionId, entryId)? Reads the legacy `snapshot_manifest` table.
      *  SQL backends only (local never had a whole-tree epoch table). Diagnostic input on the refusal path —

package/dist/plugins/store-backend.js

@@ -2,6 +2,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
+import { fileSessionCaptureRecordStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
@@ -20,6 +21,7 @@ import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-s
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
+import { fileMemoryControlDirFor } from "../memory-scope.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
@@ -136,7 +138,8 @@ class TiDBBackend {
     sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
-    sessionCaptureRecords() { return new TiDBSessionCaptureRecordStore(this.pool); }
+    sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
+    captureRecordsInst;
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("tidb", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("tidb", this.pool, sessionId); }
@@ -183,7 +186,8 @@ class PgBackend {
     sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
-    sessionCaptureRecords() { return new PgSessionCaptureRecordStore(this.pool); }
+    sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
+    captureRecordsInst;
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("pg", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("pg", this.pool, sessionId); }
@@ -259,6 +263,10 @@ class LocalBackend {
         this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root);
         this.workflowJournalStore = new FileWorkflowJournalStore(this.fileBackend.root);
         this.outcomeSinkInst = new FileOutcomeSink(this.fileBackend.root);
+        const ownControlDir = fileMemoryControlDirFor(config);
+        this.captureRecordsSource = ownControlDir === undefined
+            ? undefined
+            : (plane) => fileSessionCaptureRecordStore(plane?.controlDir ?? ownControlDir);
     }
     async ensureSchema() { }
     async close() {
@@ -304,7 +312,8 @@ class LocalBackend {
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
-    sessionCaptureRecords() { return undefined; }
+    sessionCaptureRecords() { return this.captureRecordsSource; }
+    captureRecordsSource;
     workflowJournal() { return this.workflowJournalStore; }
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }

package/dist/plugins/store-contracts.d.ts

@@ -108,27 +108,92 @@ export interface RunRecord {
     updatedAt: string;
 }
 /**
- * 「这一行已经走到**终局**了吗」——`RunRecord["status"]`(= `"running" | TaskStatus`)的**穷举**判据,
- * 与类型定义同住一个文件(词表的属主 = 判据的属主)。
+ * `RunRecord["status"]`(= `"running" | TaskStatus`)的**唯一分类表** —— 词表的属主 = 判据的属主,
+ * 与类型定义同住一个文件。四个类:
+ *  · `live` —— 还在跑;
+ *  · `succeeded` —— 成功终局;
+ *  · `unsuccessful` —— **非成功**终局。两个词:`failed`(限额/供应商/中止/无效输出)与 `blocked`
+ *    —— 后者是 core `TerminalCause` 的 `{kind:"blocked", reason}`,d.ts 逐字为「the agent could not
+ *    finish and said why」= **agent 自报的终态**(说完就结束,不等人、不留 checkpoint)。它**不是**
+ *    治理判决:门拒绝那条腿在 core 里走 `paused`/`failed`,永远不铸这个词;
+ *  · `parked` —— 停在门上还能再动(`suspended` 审批/资源门、`needs_review` 评审门)。
  *
- * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,[ref] 二轮扫描 finding):终局词表
- * **真变过**(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 里删了)。而集合形的门对象是 `string`,对词表
- * 两个方向都无钉:
- *   · **增词**(core 新加一个终局态)⇒ 集合不含它 ⇒ 该行被静默判成「非终局」,收敛器会一直等一个
- *     永远不会再动的行;
- *   · **删词** ⇒ 集合里留一个死字面量,没有任何东西会说话。
- * 穷举 `switch` 把两个方向都变成**编译期**问题:core 加成员 ⇒ `default` 臂收不敛到 `never` ⇒ tsc 红,
- * 加成员的人被迫当场回答「这个新态算不算终局」;删成员 ⇒ 对应 `case` 变成不可达字面量、同样红。
- * 这条判据不许再被手抄成第二份 —— 两个消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts`
- * 的取消后复读)都从这里取。
+ * 🔴 为什么是**一张表**而不是三张 switch(S-213③,2026-09-11):`blocked` 这个词此前在本仓有**两个
+ * 独立写者**且答案互斥 —— `observability/run-terminal-log.ts` 判它是「治理判决,不是失败 ⇒ 不打行」,
+ * `fleet/fleet-bus.ts` 判它是「非成功终局(agent 放弃)⇒ failed 桶、行离场」。两处各自穷举、各自正确
+ * 地编译,而一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。三张手抄的 switch
+ * 就是三个写者;收成一张表之后,词的语义只有这一处能改。
  *
- * 词表现状:终局 = completed / failed / blocked;非终局 = running / suspended / needs_review
- * (suspended 与 needs_review 都还能再动,`running` 更不必说)。
+ * 🔴 为什么这**不是**当年被否掉的 `ReadonlySet<string>`([ref] 二轮扫描 finding):那份集合的门对象是
+ * `string`,对词表两个方向都无钉 —— 增词静默判「非终局」、删词留一个死字面量没人说话。本表两个方向
+ * 都是**编译期**问题:`satisfies Readonly<Record<RunRecord["status"], RunStatusClass>>` 要求每个词都有
+ * 一行(core 加成员 ⇒ 缺行 ⇒ tsc 红,加成员的人被迫当场回答「这个新态算哪一类」),而多出一行
+ * core 已经没有的词同样红(超出键)。终局词表真变过(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 删了)。
+ *
+ * 判据不许再被手抄成第二份:消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts` 的取消后
+ * 复读、`observability/run-terminal-log.ts` 的级别判、`fleet/fleet-bus.ts` 的 failed 桶编译钉)都从这里取。
+ */
+export type RunStatusClass = "live" | "succeeded" | "unsuccessful" | "parked";
+export declare const RUN_STATUS_CLASS: {
+    readonly running: "live";
+    readonly completed: "succeeded";
+    readonly failed: "unsuccessful";
+    readonly blocked: "unsuccessful";
+    readonly suspended: "parked";
+    readonly needs_review: "parked";
+};
+/** 表判为「非成功终局」的词——**从表派生**,不是手抄的第二份清单。今天 = `"failed" | "blocked"`。
+ *  消费点(`fleet/fleet-bus.ts` 的 failed 桶)拿它做编译期同源钉:表翻面 ⇒ 那道钉当场红。 */
+export type UnsuccessfulRunStatus = {
+    [K in RunRecord["status"]]: (typeof RUN_STATUS_CLASS)[K] extends "unsuccessful" ? K : never;
+}[RunRecord["status"]];
+/**
+ * 一个状态词的类;**表里没有的词 ⇒ `undefined`**。
+ *
+ * 🔴 形参是 `string` 而不是 `RunRecord["status"]`(S-221):本函数的**全部工作**就是「这个词在不在表里」,
+ * 把入参收成闭集等于在签名上宣称「传进来的一定是表内词」,而下一行的 `undefined` 臂正是为了不是的那些 ——
+ * 签名与实现自相矛盾时,消费点只能靠 `as RunRecord["status"]` 硬转把窄读口(`{ status: string }`,
+ * 三形 store 共同面)喂进来,而那正是本文件头注点名的 `rowToRun` 裸 cast 的同一条病。闭集词照样能传
+ * (联合 ⊂ string),编译期的执法点在上面那张表的双向钉,不在这里。
+ *
+ * 导出面(S-221):`plugins/e2b-orphan-reclaim.ts` 的三臂判决(还能再动 / 终局 / 读不懂)需要的正是
+ * 「类 + unknown」这一对,而不是三条 boolean 谓词各问一遍 —— 它此前因此自带了第二份词表。
+ *
+ * 🔴 查的是 **null 原型**的那只表,不是 `RUN_STATUS_CLASS` 本身(codex 对抗复审 r1 [high],亲验后修):
+ * 普通对象字面量的查表**穿原型链** —— `status` 落在 `constructor` / `toString` / `__proto__` /
+ * `hasOwnProperty` / `valueOf` 上时查到的是 `Object.prototype` 的成员而不是 `undefined`,于是
+ * 「读不懂的词」这一臂被整条绕过。亲验读数(修前):`runStatusClassOf("constructor")` 返回
+ * `function Object`。这类值是**真可达**的(`rowToRun` 把无约束的 SQL 文本列裸 cast 成本联合),而消费点
+ * 据此做的是不可逆动作。修在此处一次,而不是在每个消费点各写一句 `Object.hasOwn` —— 后者要靠每个消费点
+ * 各记得一次,属主只有一个。
+ *
+ * 🔴 运行期未知词是**真可达**的([ref] codex R1 真缺陷,红先复现过):`plugins/run-store-sql.ts` 的
+ * `rowToRun` 把无约束的 SQL 文本列**裸 cast** 成本联合,滚动升级里一个更新的副本写入的新状态词会被
+ * 旧副本读到。三张派生判据对 `undefined` 一律答 `false`(保守方向,逐条理由见各自头注)——不是静默
+ * 兜底,而是「本进程读不懂这个词,少动一次远好过错杀」的显式表态;真正的执法点是上面那张表的编译期
+ * 双向钉,新词进词表的**那一刻**就红。
+ */
+export declare function runStatusClassOf(status: string): RunStatusClass | undefined;
+/**
+ * 「这一行已经走到**终局**了吗」——终局 = 成功 or 非成功(completed / failed / blocked);
+ * 非终局 = running / suspended / needs_review(后两者都还能再动)。
+ *
+ * 未知词判**非终局**:判成「终局」的代价不可逆 —— `approval-reconciler` 判据 2 会把一张还活着的 ask
+ * 永久打成 DENIED/routing_failure,取消路由也会把这一行当终局上报。
  */
 export declare function isTerminalRunStatus(status: RunRecord["status"]): boolean;
 /**
- * 「这一行**停在门上**(park)了吗」——`RunRecord["status"]` 的第二张穷举判据,与 {@link isTerminalRunStatus}
- * 同住词表属主处(扫描P2,2026-08-12)。
+ * 「这一行的终局是**非成功**的吗」(S-213③ 的共享判据)——`failed` 与 `blocked` 两词。
+ *
+ * 🔴 它回答的问题与 {@link isTerminalRunStatus} **不同**:后者只问「还会不会再动」,本判据问「这次任务
+ * 到底成没成」。凡是「这条 run 该不该在失败面上出声/离场」的判断都读这一条,不许再手抄
+ * `=== "failed" || === "blocked"`(那正是 `blocked` 长出两个互斥读法的成因)。
+ *
+ * 未知词判**不是**非成功:对读不懂的词保持沉默,好过按 error 级刷屏。
+ */
+export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 「这一行**停在门上**(park)了吗」(扫描P2,2026-08-12)。
  *
  * 🔴 为什么必须有名字:park 是**两个词**,不是一个 —— `suspended`(tool_approval / policy_ask / human /
  * resource_limit 门)与 `needs_review`(`plan_review` / dry-run 拦截门,写点 = 各 store 的
@@ -139,8 +204,6 @@ export declare function isTerminalRunStatus(status: RunRecord["status"]): boolea
  *
  * 未知词的方向与 {@link isTerminalRunStatus} 同向保守:判**不是** park。理由是消费点会据此做**不可逆**
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
- * 真正的执法点是下面那条 `never`:core 的 `TaskStatus` 一加成员就 tsc 红,加成员的人必须当场回答
- * 「这个新态算不算 park」。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its

package/dist/plugins/store-contracts.js

@@ -1,37 +1,25 @@
 import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
+export const RUN_STATUS_CLASS = {
+    running: "live",
+    completed: "succeeded",
+    failed: "unsuccessful",
+    blocked: "unsuccessful",
+    suspended: "parked",
+    needs_review: "parked",
+};
+const RUN_STATUS_CLASS_LOOKUP = Object.assign(Object.create(null), RUN_STATUS_CLASS);
+export function runStatusClassOf(status) {
+    return RUN_STATUS_CLASS_LOOKUP[status];
+}
 export function isTerminalRunStatus(status) {
-    switch (status) {
-        case "completed":
-        case "failed":
-        case "blocked":
-            return true;
-        case "running":
-        case "suspended":
-        case "needs_review":
-            return false;
-        default: {
-            const unhandled = status;
-            void unhandled;
-            return false;
-        }
-    }
+    const cls = runStatusClassOf(status);
+    return cls === "succeeded" || cls === "unsuccessful";
+}
+export function isUnsuccessfulRunStatus(status) {
+    return runStatusClassOf(status) === "unsuccessful";
 }
 export function isParkedRunStatus(status) {
-    switch (status) {
-        case "suspended":
-        case "needs_review":
-            return true;
-        case "running":
-        case "completed":
-        case "failed":
-        case "blocked":
-            return false;
-        default: {
-            const unhandled = status;
-            void unhandled;
-            return false;
-        }
-    }
+    return runStatusClassOf(status) === "parked";
 }
 export function mapBakeRow(r) {
     return {

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -59,7 +59,7 @@ import type { Pool as PgPool } from "pg";
 import { summarizeWorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import { type WorkflowCompletionInbox, type WorkflowCompletionInboxEntry } from "../orchestration/workflow-completion-inbox.js";
 import type { WorkflowNotifyJournalStore, WorkflowNotifyJournalEntry } from "../orchestration/workflow-notify-journal.js";
-import type { WorkflowAgentSessionIndex, WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
+import { type WorkflowAgentSessionIndex, type WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
 import { type SqlDriver } from "./sql-driver.js";
 type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 /** Row cap guard: a run blob beyond this is NOT stored on update (the prior revision stays) — TiDB's
@@ -68,19 +68,41 @@ type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 export declare const MAX_RUN_BLOB_BYTES: number;
 declare const onWarnType: (msg: string, meta: Record<string, unknown>) => void;
 export type InboxWarn = typeof onWarnType;
-/** Review fix (1.108, lens④ HIGH): an oversize blob must NOT fail the update outright — core's persist chain
- *  treats `false` as a CAS loss and does NOT advance its tracked rev, so once a run outgrows the cap EVERY later
- *  write (including the TERMINAL one) keeps failing → the durable row is stuck `running` forever and the 24h
- *  orphan sweep finalizes a genuinely-completed run as `abandoned`. Instead degrade the PAYLOAD, not the write:
- *  step 1 truncate the two unbounded strings (result/error); step 2 drop the heavy arrays (phases/agents/groups)
- *  with an explicit marker. Returns null only when even the skeleton is oversize (physics — caller keeps the
- *  prior revision, matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared
- *  verbatim by both twins. */
 /** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`,core 源头不脱)在**两条写腿**(put / update 常态 + oversize 降级)
  *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。 */
 export declare function withRedactedError<T extends {
     error?: string | undefined;
 }>(run: T): T;
+/** Review fix (1.108, lens④ HIGH): an oversize blob must NOT fail the update outright — core's persist chain
+ *  treats `false` as a CAS loss and does NOT advance its tracked rev, so once a run outgrows the cap EVERY later
+ *  write (including the TERMINAL one) keeps failing → the durable row is stuck `running` forever and the 24h
+ *  orphan sweep finalizes a genuinely-completed run as `abandoned`. Instead degrade the PAYLOAD, not the write.
+ *
+ *  🔴 **S-192(7.71.0):瘦身只裁展示载荷,parked 行的恢复身份是最后才放弃的东西。**
+ *  病(修前逐字):step2 写作 `agents: []` ⇒ 一只 parked 的 workflow 子代的 `callKey` / `sessionId` /
+ *  `parkedCheckpointToken` 随整段消失。server 侧复核「这条 park 仍在此 token 下」的依据**只有这一行**(join 索引
+ *  刻意不存它——它是能力;引擎自己的赎回键另住 resume journal),于是 `/decide` 的 workflow 车道在 `run.agents`
+ *  里找不到那一行 ⇒ 落 legacy 腿拿一个**错因**的 409 `conflict.resume_context_unavailable`,人的批准无处兑付;
+ *  同时 core resume 路径上那道「blob 里 parked 而 journal 缺条目 ⇒ 拒 resume」的防线(`prior.agents`)也随之失明。
+ *
+ *  阶梯 = 一张**按价值排序的放弃清单**,一级一级试到装得下为止(**判据只有一条:恢复身份最后放弃**):
+ *    step 1 —— 两个无界字符串(`result` / `error`)截断带标记;
+ *    step 2 —— `phases` / `groups` 整段丢,`agents` 收敛成**恢复身份行**
+ *              ({@link buildParkedRecoveryIdentities};非 parked 的行不带恢复身份 ⇒ 整行丢,与修前同);
+ *    step 3 —— 顶层**观测载荷**(codex r1-[high],红先复现后修):`effectiveArgs` 与 `resultFull` 整段丢、
+ *              `name` / `description` 先脱后切。core 对 `effectiveArgs` 的成文口径逐字是 OBSERVATION-ONLY
+ *              (never a gate input,never re-read by the engine;resume 的身份由 journal 的 callKey 携带,
+ *              不是这个字段),`resultFull` 同类(取回面),两者都**无界**。修前这一级不存在,于是阶梯
+ *              一边原样留着它们、一边把唯一那条 parked 行删掉盖标记 —— 自己违反了自己那条判据,
+ *              一条本来赎得回的审批被判死(生产上界 4 MiB 上真复现);
+ *    step 4 —— 恢复身份行上的**展示名**(`label`)—— 它是这条行上唯一可弃的展示物,身份四位恒在
+ *              (codex r2-[high],红先复现后修:修前阶梯一边留着每行 200 字符的 label、一边把**全部**身份
+ *              删掉盖标记 —— 同一条判据第二次被自己违反;6000 条 CJK label 的 parked 行在生产上界上
+ *              实测 `agents:[]` + `parks:6000`,而清空 label 后 6000 条身份**全都装得下**);
+ *    step 5 —— 连只剩身份的行都装不下 ⇒ 丢掉它们并落**显式不可恢复标记**({@link PARK_IDENTITY_LOSS_KEY}),
+ *              `/decide` 与 SLA sweep 读到它就**响亮拒**,而不是让一条赎回不了的 park 看起来像普通 miss。
+ *  Returns null only when even the marked skeleton is oversize (physics — caller keeps the prior revision,
+ *  matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared verbatim by both twins. */
 export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;

package/dist/plugins/workflow-run-store-sql.js

@@ -1,9 +1,11 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
 import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
+import { buildParkedRecoveryIdentities, buildParkIdentityLoss, PARK_IDENTITY_LOSS_KEY } from "../orchestration/workflow-agent-session-index.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 export const MAX_RUN_BLOB_BYTES = 4 * 1024 * 1024;
+const SLIM_HEADER_MAX = 200;
 const onWarnType = (msg, meta) => void [msg, meta];
 export function withRedactedError(run) {
     if (typeof run.error !== "string")
@@ -22,8 +24,33 @@ export function slimOversizeRun(run, maxBytes) {
     let blob = JSON.stringify(step1);
     if (Buffer.byteLength(blob) <= maxBytes)
         return blob;
-    const step2 = { ...step1, phases: [], agents: [], groups: [], error: step1.error ? String(step1.error).slice(0, 1000) + MARK : MARK };
+    const identities = buildParkedRecoveryIdentities(run.agents);
+    const shortError = step1.error ? String(step1.error).slice(0, 1000) + MARK : MARK;
+    const step2 = { ...step1, phases: [], agents: identities, groups: [], error: shortError };
     blob = JSON.stringify(step2);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const step3 = { ...step2 };
+    delete step3.effectiveArgs;
+    delete step3.resultFull;
+    if (typeof step3.name === "string")
+        step3.name = redactHead(step3.name, SLIM_HEADER_MAX);
+    if (typeof step3.description === "string")
+        step3.description = redactHead(step3.description, SLIM_HEADER_MAX);
+    blob = JSON.stringify(step3);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const bareIdentities = buildParkedRecoveryIdentities(run.agents, 0);
+    const step4 = { ...step3, agents: bareIdentities };
+    blob = JSON.stringify(step4);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const step5 = {
+        ...step4,
+        agents: [],
+        ...(identities.length > 0 ? { [PARK_IDENTITY_LOSS_KEY]: buildParkIdentityLoss(identities.length) } : {}),
+    };
+    blob = JSON.stringify(step5);
     return Buffer.byteLength(blob) <= maxBytes ? blob : null;
 }
 export class SqlWorkflowRunStore {

package/dist/run-cancel-context.js

@@ -30,7 +30,7 @@ export function mintCancelledResult(args) {
         sessionId: args.sessionId,
         terminal: { kind: "failed", code: CANCELLED_CODE, message: args.message },
         result: "",
-        stats: { turns: 0, tokens: 0 },
+        stats: { turns: 0, tokens: 0, usageMissing: true },
         ...(ctx ? { cancelContext: ctx } : {}),
     };
 }

package/dist/run-local.js

@@ -15,10 +15,11 @@ import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
-import { loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
+import { executionLaneHomeDir } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
@@ -197,6 +198,9 @@ export async function runLocal(argv, deps = {}) {
     catch (err) {
         logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
+    const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
+    if (unpricedCeiling)
+        logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
     try {
         const fileRx = await loadRemoteExec(root);
         if (fileRx?.provider === "host") {
@@ -273,6 +277,7 @@ export async function runLocal(argv, deps = {}) {
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
+            ...((h) => (h === undefined ? {} : { homeDir: h }))(executionLaneHomeDir(config)),
             backgroundShell: config.requirePrincipal !== true,
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
@@ -369,6 +374,7 @@ export async function runLocal(argv, deps = {}) {
         ],
     });
     const sharedRunnerDeps = createSharedRunnerDeps({
+        metrics,
         config,
         governanceSeams,
         logger,

package/dist/runs.d.ts

@@ -1,4 +1,4 @@
-import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -282,7 +282,21 @@ pendingEngineNotices?: readonly {
     message: string;
     detail?: Record<string, unknown>;
     sessionId?: unknown;
-}[]): Promise<void>;
+}[], 
+/**
+ * 🔴 **S-218:部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume`)。
+ *
+ * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。铸点只有
+ * 一个:`/decide` 的 workflow 第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide`
+ * 顶注 + `http/durable-run-leg.ts` 的 `TrustedRunInternals`)。本腿只负责把它摊进**下面那只**共享
+ * 供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
+ *
+ * 位置在座席对象的**最后**:座席里那几位(onActivity/onForwardEvent/onTaskNotification/onSubagentSpawn)
+ * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 真要撞名,撞的也只能是本腿自己新加的位,而那时
+ * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
+ * 缺席 ⇒ 座席与本位存在之前逐字相同。
+ */
+trustedInternals?: Pick<RunInternals, "workflowParkedResume">): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -160,7 +160,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -311,6 +311,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         },
                     }
                     : {}),
+                ...(trustedInternals ?? {}),
             };
             const statusSeat = {
                 onStatusEvent: (e) => {

package/dist/runtime-caps-resolver.js

@@ -45,6 +45,8 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowObservers = ent.allowObservers;
     if (typeof autoMode === "boolean")
         caps.autoMode = autoMode;
+    if (caps.autoMode === false)
+        caps.autoModeDenySource = "org";
     if (typeof ent.allowMemoryOptOut === "boolean")
         caps.allowMemoryOptOut = ent.allowMemoryOptOut;
     return Object.keys(caps).length ? caps : undefined;
@@ -142,7 +144,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(principal, entry);
@@ -231,7 +233,7 @@ export function applyLocalAutoModeDeny(base, deny) {
     if (!deny)
         return base;
     if (base === undefined)
-        return () => ({ autoMode: false });
-    return async (principal) => ({ ...(await base(principal)), autoMode: false });
+        return () => ({ autoMode: false, autoModeDenySource: "local" });
+    return async (principal) => ({ ...(await base(principal)), autoMode: false, autoModeDenySource: "local" });
 }
 //# sourceMappingURL=runtime-caps-resolver.js.map