@sema-agent/server 7.79.2 → 7.79.3

package/dist/boot/late-binds.d.ts

@@ -0,0 +1,35 @@
+/**
+ * 晚绑席(S-151 十段切分的**唯一**跨段可变面)—— 四只 cell,读点在前段、写点在后段。
+ *
+ * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
+ * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
+ * 而本刀的律是字节不变(`scripts/move-only-check.mjs`)。ESM 的 `import` 对 `let` 是 **live 读**,
+ * 于是读点一个字都不改就能拿到后段写进来的值。写点分两形:
+ *  · `runStore` / `rateLimiter` —— 声明行留在第 7 段原位,紧随一行 `bindX(...)` 把值交过来;
+ *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
+ *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
+ *    所以 cell 与它的写点必须同居一个模块。
+ *
+ * 时序与修前逐字相同:四只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
+ * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
+ */
+import type { Logger } from "../observability/logger.js";
+import type { ParkedAskRedeem } from "../tool-approval.js";
+import type { RateGate } from "../observability/rate-limit.js";
+import type { ServiceConfig } from "../config.js";
+import type { StoreBackend } from "../plugins/store-backend.js";
+import type { createHttpServer } from "../http/server.js";
+declare let runStore: ReturnType<StoreBackend["run"]> | undefined;
+declare let rateLimiter: RateGate | undefined;
+declare let parkedAskRedeem: ParkedAskRedeem | undefined;
+declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
+export declare function bindRateLimiter(v: RateGate): void;
+export declare function bindServerLateSeats(ctx: {
+    config: ServiceConfig;
+    logger: Logger;
+    server: ReturnType<typeof createHttpServer>;
+}): void;
+//# sourceMappingURL=late-binds.d.ts.map

package/dist/boot/late-binds.js

@@ -0,0 +1,20 @@
+let runStore;
+let rateLimiter;
+let parkedAskRedeem;
+let runDenySweep;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep };
+export function bindRunStore(v) {
+    runStore = v;
+}
+export function bindRateLimiter(v) {
+    rateLimiter = v;
+}
+export function bindServerLateSeats(ctx) {
+    const { config, logger, server } = ctx;
+    runDenySweep = server.denyExpiredApprovals;
+    if (!config.directDoorActive)
+        parkedAskRedeem = server.redeemParkedAsk;
+    else
+        logger.info("parked_late_decision_disabled", { reason: "direct_door_requires_signed_decision_envelope" });
+}
+//# sourceMappingURL=late-binds.js.map

package/dist/boot/stage-01-config.d.ts

@@ -0,0 +1,7 @@
+export declare function runStage01(): {
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../observability/logger.js").Logger;
+    metrics: import("../observability/metrics.js").Metrics;
+};
+//# sourceMappingURL=stage-01-config.d.ts.map

package/dist/boot/stage-01-config.js

@@ -0,0 +1,60 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadConfig, logConfigDiagnostics, splitLocalRoots } from "../config.js";
+import { crossInvariant } from "../config-invariants.js";
+import { drainNumEnvWarnings } from "../plugins/remote-shell.js";
+import { setWebSearchBadPayloadObserver } from "../plugins/web-search.js";
+import { createLogger } from "../observability/logger.js";
+import { createMetrics } from "../observability/metrics.js";
+import { installFailOpenRecorder } from "../observability/fail-open.js";
+import { installFileHistoryFailureRecorder } from "../file-history-disclosure.js";
+import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
+import { setRunTerminalObserver } from "../observability/run-terminal-log.js";
+import { setRedactionObserver } from "../trace/redact.js";
+export function runStage01() {
+    const config = loadConfig();
+    const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
+    if (runStaleFailure !== undefined) {
+        throw new Error(runStaleFailure);
+    }
+    const logger = createLogger(config.logLevel);
+    const metrics = createMetrics();
+    installFailOpenRecorder({ logger, metrics });
+    installSecretEnvScrubRecorder({ logger, metrics });
+    installFileHistoryFailureRecorder({ logger, metrics });
+    logConfigDiagnostics(logger);
+    for (const w of drainNumEnvWarnings())
+        logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw });
+    if ((config.roles?.verifier ?? "default") === "default") {
+        logger.warn("verify_decorrelation_unavailable", {
+            hint: "verifier role = default (= implementer) — adversarial verification grades its own work; set MODEL_VERIFIER=<catalog model id> to a heterogeneous model",
+            ...(process.env.MODEL_VERIFIER ? { rejected: process.env.MODEL_VERIFIER, reason: "not in catalog" } : {}),
+        });
+    }
+    setRedactionObserver((pattern, n, meta) => metrics.inc("redactions_applied_total", { pattern, arm: meta.arm }, n));
+    setWebSearchBadPayloadObserver((provider) => {
+        metrics.inc("web_search_bad_payload_total", { provider });
+        logger.warn("web_search_non_array_payload", { provider });
+    });
+    setRunTerminalObserver((level, fields) => {
+        if (level === "error")
+            logger.error("run_failed", fields);
+        else
+            logger.info("run_failed", fields);
+    });
+    const localRoot = config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
+    const rootsSplit = splitLocalRoots({
+        localDataRoot: config.localDataRoot,
+        configLocalDir: config.configLocalDir,
+        agentDataDir: process.env.AGENT_DATA_DIR,
+        home: homedir(),
+    });
+    if (rootsSplit) {
+        logger.warn("local_roots_split", {
+            ...rootsSplit,
+            note: "LOCAL_DATA_ROOT moved the local backend's DATA root, but config.d / remote-exec.json are still read from the config root (LOCAL_DATA_ROOT is not consulted there). If you meant to move both, set CONFIG_LOCAL_DIR to the same directory.",
+        });
+    }
+    return { config, localRoot, logger, metrics };
+}
+//# sourceMappingURL=stage-01-config.js.map

package/dist/boot/stage-02-registry-pull.d.ts

@@ -0,0 +1,10 @@
+import type { runStage01 } from "./stage-01-config.js";
+export declare function runStage02(ctx: Awaited<ReturnType<typeof runStage01>>): Promise<{
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+}>;
+//# sourceMappingURL=stage-02-registry-pull.d.ts.map

package/dist/boot/stage-02-registry-pull.js

@@ -0,0 +1,11 @@
+import { createUnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
+import { createConfigCenterRuntime } from "./config-center.js";
+export async function runStage02(ctx) {
+    const { config, localRoot, logger, metrics } = ctx;
+    const configCenter = await createConfigCenterRuntime({ config, logger, metrics, localRoot });
+    await configCenter.applyLocalRemoteExec();
+    const ceilingVerdict = createUnpricedCeilingVerdict({ config, logger });
+    ceilingVerdict.judge();
+    return { ...ctx, ceilingVerdict, configCenter };
+}
+//# sourceMappingURL=stage-02-registry-pull.js.map

package/dist/boot/stage-03-store-backend.d.ts

@@ -0,0 +1,32 @@
+import type { runStage02 } from "./stage-02-registry-pull.js";
+export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>): Promise<{
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+}>;
+//# sourceMappingURL=stage-03-store-backend.d.ts.map

package/dist/boot/stage-03-store-backend.js

@@ -0,0 +1,11 @@
+import { uuidv7 } from "@sema-agent/core";
+import { openStores } from "./stores.js";
+export async function runStage03(ctx) {
+    const { config, localRoot, logger, metrics } = ctx;
+    const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
+    const instanceId = uuidv7();
+    const sessionCaptureRecords = backend?.sessionCaptureRecords();
+    const sessionCaptureRecordStore = sessionCaptureRecords?.();
+    return { ...ctx, backend, backgroundAgentStore, breakerState, instanceId, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storeBackendDegraded, taskAttachmentStore, taskListLane, usageWindowStore };
+}
+//# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -0,0 +1,69 @@
+import type { runStage03 } from "./stage-03-store-backend.js";
+export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>): Promise<{
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+}>;
+//# sourceMappingURL=stage-04-stores.d.ts.map

package/dist/boot/stage-04-stores.js

@@ -0,0 +1,49 @@
+import { createPermissionRuleStoreProvider } from "@sema-agent/core";
+import { createMemoryBundleFaces } from "../memory-bundle-engine.js";
+import { createMemoryComplianceFaces, createMemoryOriginFaces, createSessionMemoryStatusFace } from "../memory-operator-faces.js";
+import { runAdoptionBootScan } from "./adoption.js";
+import { auditDormantPermissionRules } from "./permission-rules-audit.js";
+import { createBudgetAndTracing } from "./budget-tracing.js";
+import { createRuleConsentLane } from "../rules-consent.js";
+export async function runStage04(ctx) {
+    const { backend, breakerState, config, logger, memoryEngine, metrics, sessionCaptureRecordStore } = ctx;
+    const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}) }) : undefined;
+    const memoryComplianceFaces = memoryEngine
+        ? createMemoryComplianceFaces(memoryEngine, {
+            onIncident: (err) => logger.warn("memory_compliance_incident", { code: err.code ?? null, detail: err.message }),
+            ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
+        })
+        : undefined;
+    const memoryOriginFaces = memoryEngine
+        ? createMemoryOriginFaces(memoryEngine, {
+            onIncident: (err) => logger.warn("memory_origin_incident", { code: err.code ?? null, detail: err.message }),
+            ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
+        })
+        : undefined;
+    const sessionMemoryStatusFace = memoryEngine
+        ? createSessionMemoryStatusFace(memoryEngine, { ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}) })
+        : undefined;
+    const adoptionBoot = await runAdoptionBootScan({ backend, logger });
+    if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
+        logger.info("adoption_boot_scan", { ...adoptionBoot });
+    }
+    const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileHistoryStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
+    const permissionRuleStores = config.permissionRulesEnabled && backend ? backend.permissionRule() : undefined;
+    const permissionRuleProvider = permissionRuleStores
+        ? createPermissionRuleStoreProvider({ durable: permissionRuleStores.durable })
+        : undefined;
+    const ruleConsent = permissionRuleStores && permissionRuleProvider
+        ? createRuleConsentLane({ ...permissionRuleStores, provider: permissionRuleProvider })
+        : undefined;
+    if (config.permissionRulesEnabled && permissionRuleStores === undefined) {
+        logger.info("permission_rules_lane_unavailable", {
+            knob: "PERMISSION_RULES_ENABLED",
+            reason: backend === undefined ? "no_backend" : "backend_has_no_rule_store",
+            backendKind: backend?.kind ?? null,
+            note: "PERMISSION_RULES_ENABLED is on but no permission-rule store is wired — /v1/rules/* answer 501, approval cards carry no rule suggestions, and respond's persistRule is refused with rule_lane_unavailable",
+        });
+    }
+    await auditDormantPermissionRules({ stores: permissionRuleStores, logger, explicit: config.permissionRulesEnabledExplicit });
+    return { ...ctx, brain, costQuota, counterDegradeHook, fileHistoryStore, fleetLease, fleetUsage, memoryBundleFaces, memoryComplianceFaces, memoryOriginFaces, modelUsageTracker, permissionRuleProvider, permissionRuleStores, pricing, promptManifestTracker, ruleConsent, sessionMemoryStatusFace, sessionPolicyStore, sideQueryAccounting, toolResultStore, tracer };
+}
+//# sourceMappingURL=stage-04-stores.js.map

package/dist/boot/stage-05-execution-env.d.ts

@@ -0,0 +1,82 @@
+import type { runStage04 } from "./stage-04-stores.js";
+export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>): {
+    deploymentHooks: import("@sema-agent/core").Hooks;
+    deviceLane: import("./device-lane.js").DeviceLane | undefined;
+    dropSessionScoped: (sid: string) => void;
+    executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    perSessionCwd: Map<string, string>;
+    perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
+    sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
+    setSessionCwd: (sid: string, cwd: string) => void;
+    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    worktreeReap: (() => Promise<void>) | undefined;
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+};
+//# sourceMappingURL=stage-05-execution-env.d.ts.map

package/dist/boot/stage-05-execution-env.js

@@ -0,0 +1,20 @@
+import { createToolTracer, createPermissionDeniedMeter } from "../observability/tool-trace.js";
+import { composeHooks } from "../hooks/hook-runner.js";
+import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
+import { createExecutionEnv } from "./execution-env.js";
+import { rateLimiter } from "./late-binds.js";
+export function runStage05(ctx) {
+    const { backend, config, instanceId, logger, metrics, taskAttachmentStore } = ctx;
+    const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId, rateGate: () => rateLimiter }) : undefined;
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}) });
+    assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
+    const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
+    if (toolTracer)
+        logger.info("tool_trace_enabled", {});
+    const deploymentHooks = {
+        ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
+        ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
+    };
+    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionShellEnv, worktreeReap };
+}
+//# sourceMappingURL=stage-05-execution-env.js.map

package/dist/boot/stage-06-runners.d.ts

@@ -0,0 +1,143 @@
+/**
+ * 装配第 6 段 —— **两只 Runner**(§3-6)。
+ * workflow 编排 → 活体协调器 → per-principal caps → org/共享记忆 → checkpoint/留存/consolidation/治理座席 →
+ * RunnerDeps → `new Runner` ×2(主 + 无手孪生)→ hook LLM/agent 载体 → 会话标题器 → subRunner ×2。
+ * ⚠️ 位置即契约:checkpointStore 必须早于 `createGovernanceSeams` 与 `createRunnerDeps`;
+ * `workflowModelAllowlistSnapshot` 必须与 `createRunnerDeps` 同步紧邻(两者之间零 await)。
+ * 🔴 `runStore` / `parkedAskRedeem` 经 `late-binds.ts` 的晚绑 cell 读(原文同作用域前向引用/晚绑 holder)。
+ */
+import { Runner } from "@sema-agent/core";
+import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
+import type { runStage05 } from "./stage-05-execution-env.js";
+export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>): {
+    approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
+    centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
+    checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    durableEnabled: boolean;
+    elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
+    fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
+    governanceSeams: import("./governance-seams.js").GovernanceSeams;
+    handslessRunner: Runner;
+    handslessSubRunner: Runner;
+    hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
+    hookAgentRunner: Runner;
+    hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
+    mcpRevocations: import("../config-center/mcp-revocation.js").McpRevocationLedger;
+    memoryConsolidationFaces: import("./memory-consolidation.js").MemoryConsolidationFaces | undefined;
+    memoryOptOutGrantStore: import("../plugins/memory-optout-grant-store-sql.js").MemoryOptOutGrantStore | undefined;
+    orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
+    principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
+    question: import("../question.js").QuestionCoordinator | undefined;
+    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
+    runner: Runner;
+    runnerDeps: import("@sema-agent/core").RunnerDeps;
+    runnerTierFrozen: boolean;
+    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
+    sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
+    sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    sessionShellGateRegistry: import("./session-shell-gate-registry.js").SessionShellGateRegistry;
+    sessionTitler: import("../session-titler.js").SessionTitler | undefined;
+    sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
+    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    subRunner: Runner;
+    subRunnerSessions: ForkRoutingSessionStore;
+    subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
+    toolApproval: import("../tool-approval.js").ToolApprovalCoordinator | undefined;
+    workflowAgentRegistry: import("../orchestration/workflow-agent-steer.js").WorkflowAgentRegistry | undefined;
+    workflowAgentSessionIndex: import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex | undefined;
+    workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
+    workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
+    workflowModelAllowlistSnapshot: readonly string[];
+    workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
+    workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
+    workflowRecoverOpts: {
+        orphanGraceMs?: number;
+        finalizeStartedBeforeMs?: number;
+        publishTerminalFleetRow?: (id: string, run: import("@sema-agent/core").WorkflowRun) => void;
+    };
+    workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
+    workflowsCapable: boolean;
+    deploymentHooks: import("@sema-agent/core").Hooks;
+    deviceLane: import("./device-lane.js").DeviceLane | undefined;
+    dropSessionScoped: (sid: string) => void;
+    executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    perSessionCwd: Map<string, string>;
+    perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
+    sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
+    setSessionCwd: (sid: string, cwd: string) => void;
+    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    worktreeReap: (() => Promise<void>) | undefined;
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+};
+//# sourceMappingURL=stage-06-runners.d.ts.map