@sema-agent/server 7.79.2 → 7.80.0

package/dist/boot/stage-10-http-server.d.ts

@@ -0,0 +1,204 @@
+import type { runStage09 } from "./stage-09-leader.js";
+export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>): Promise<{
+    drainState: {
+        draining: boolean;
+        since?: number;
+        reason?: string;
+        inflight?: () => number;
+        lastActivityAt?: () => number;
+        attachedStreams?: () => number;
+        lastAttachEndedAt?: () => number;
+    };
+    hookWakeBus: {
+        deliver?: (sessionId: string, text: string) => Promise<boolean>;
+    };
+    instrumentDegenerate: ((result: import("@sema-agent/core").TaskResult) => void) | undefined;
+    leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
+    ownerAware: import("../security.js").OwnerAwareSessionStore;
+    planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
+    purgeSession: ((sessionId: string, owner: string | null) => Promise<{
+        deleted: boolean;
+    } | {
+        active: string;
+    }>) | undefined;
+    registryJwtVerifier: import("../auth-bridge.js").RegistryJwtVerifier | undefined;
+    sessionAudit: ((sessionId: string) => Promise<{
+        owner: string | null;
+        sessionId: string;
+        createdAt: string;
+        floorEntryId: string | null;
+        thinkingLevel: string;
+        model: {
+            provider: string;
+            modelId: string;
+        } | null;
+        messages: unknown[];
+        promptEpoch?: {
+            epoch: number;
+            artifactDigest: string;
+            packId: string;
+            assemblyApi: number;
+            activatedBy: "session_start" | "compaction" | "legacy_migration";
+        };
+    } | undefined>) | undefined;
+    sessionWatchRegistry: import("../session-watch.js").SessionWatchRegistry | undefined;
+    staticWiring: import("@sema-agent/core").WiringManifest;
+    otelExporter: {
+        stop(): void;
+    } | undefined;
+    reaper: NodeJS.Timeout;
+    retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
+    approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
+    approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
+    authorize: (ctx: {
+        req: import("http").IncomingMessage;
+        body: import("../index.js").TaskRequestBody;
+    }) => Promise<import("../security.js").AuthContext>;
+    imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
+    imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
+    parkedReviveInheritedGate: ((row: import("@sema-agent/core").BackgroundAgentRecord, identity: import("./parked-revive-gate.js").ParkedReviveIdentity) => Promise<import("./parked-revive-gate.js").RebuiltInheritedGate>) | undefined;
+    parkedReviveTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    rateLimiter: import("../index.js").RateLimiter | import("../plugins/pg-rate-limiter.js").PgRateLimiter | import("../plugins/tidb-rate-limiter.js").TiDBRateLimiter;
+    resumeAnchorStore: import("../plugins/store-backend.js").ResumeAnchorStore | undefined;
+    runStore: import("../plugins/store-backend.js").RunStore | undefined;
+    scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
+    scenarios: Record<string, import("../index.js").Scenario>;
+    selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    singleUserAutoAcceptBaseline: boolean;
+    taskLimitCaps: {
+        timeoutSec: number | undefined;
+        maxOutputTokens: number | undefined;
+        maxTurns: number | undefined;
+    };
+    taskTimeoutSec: number;
+    approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
+    centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
+    checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    durableEnabled: boolean;
+    elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
+    fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
+    governanceSeams: import("./governance-seams.js").GovernanceSeams;
+    handslessRunner: import("@sema-agent/core").Runner;
+    handslessSubRunner: import("@sema-agent/core").Runner;
+    hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
+    hookAgentRunner: import("@sema-agent/core").Runner;
+    hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
+    mcpRevocations: import("../config-center/mcp-revocation.js").McpRevocationLedger;
+    memoryConsolidationFaces: import("./memory-consolidation.js").MemoryConsolidationFaces | undefined;
+    memoryOptOutGrantStore: import("../plugins/memory-optout-grant-store-sql.js").MemoryOptOutGrantStore | undefined;
+    orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
+    principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
+    question: import("../question.js").QuestionCoordinator | undefined;
+    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
+    runner: import("@sema-agent/core").Runner;
+    runnerDeps: import("@sema-agent/core").RunnerDeps;
+    runnerTierFrozen: boolean;
+    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
+    sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
+    sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    sessionShellGateRegistry: import("./session-shell-gate-registry.js").SessionShellGateRegistry;
+    sessionTitler: import("../session-titler.js").SessionTitler | undefined;
+    sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
+    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    subRunner: import("@sema-agent/core").Runner;
+    subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
+    subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
+    toolApproval: import("../tool-approval.js").ToolApprovalCoordinator | undefined;
+    workflowAgentRegistry: import("../orchestration/workflow-agent-steer.js").WorkflowAgentRegistry | undefined;
+    workflowAgentSessionIndex: import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex | undefined;
+    workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
+    workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
+    workflowModelAllowlistSnapshot: readonly string[];
+    workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
+    workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
+    workflowRecoverOpts: {
+        orphanGraceMs?: number;
+        finalizeStartedBeforeMs?: number;
+        publishTerminalFleetRow?: (id: string, run: import("@sema-agent/core").WorkflowRun) => void;
+    };
+    workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
+    workflowsCapable: boolean;
+    deploymentHooks: import("@sema-agent/core").Hooks;
+    deviceLane: import("./device-lane.js").DeviceLane | undefined;
+    dropSessionScoped: (sid: string) => void;
+    executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    perSessionCwd: Map<string, string>;
+    perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
+    sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
+    setSessionCwd: (sid: string, cwd: string) => void;
+    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    worktreeReap: (() => Promise<void>) | undefined;
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../plugins/store-backend.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../plugins/store-backend.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+}>;
+//# sourceMappingURL=stage-10-http-server.d.ts.map

package/dist/boot/stage-10-http-server.js

@@ -0,0 +1,289 @@
+import { defaultTaskRegistry } from "@sema-agent/core";
+import { posIntEnv } from "../session-watch.js";
+import { brainSummary } from "../brain.js";
+import { resolveBindHost } from "../config.js";
+import { buildWriteProtectionPosture } from "../write-protection.js";
+import { isPricingConfigured } from "../budget.js";
+import { createHandsRunnerSelector } from "../capabilities/hands-lane.js";
+import { createHttpServer } from "../http/server.js";
+import { exportMemoryScope } from "../memory-export.js";
+import { performMemorySync } from "../memory-sync.js";
+import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs.js";
+import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
+import { createStoreLiveProbe } from "../store-live-probe.js";
+import { counterStoreLabel } from "../plugins/store-backend.js";
+import { startFleetClientFromEnv } from "../fleet-client.js";
+import { createResolveSpec } from "./resolve-spec.js";
+import { startFleetReconciler } from "../fleet/fleet-reconciler.js";
+import { createSideQueryLane } from "./side-query-lane.js";
+import { classifierRouteFor, coreArmsAutoOnIntent } from "../auto-mode-face.js";
+import { createRunnerDepsOnAsk } from "./runner-deps.js";
+import { installShutdownHandlers } from "./shutdown.js";
+import { bindServerLateSeats } from "./late-binds.js";
+import { serviceVersion } from "../service-version.js";
+export async function runStage10(ctx) {
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, singleUserAutoAcceptBaseline, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const stores = {
+        runStore,
+        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
+        approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
+        approvalNonceStore: approvalNonceStore ? approvalNonceStore : undefined,
+        checkpointStore,
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        ruleConsent,
+        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
+        toolResultStore,
+        taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        sessionStorage: ownerAware,
+        workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+        workflowAgentSessionIndex: workflowAgentSessionIndex ? workflowAgentSessionIndex : undefined,
+        workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
+        imageIndex,
+        imageBakes,
+        outcomeSink: outcomeSink ? outcomeSink : undefined,
+        sendFileLedger: sendFileLedger ? sendFileLedger : undefined,
+        backend: backend ? backend : undefined,
+    };
+    let resolveFleetRecovery;
+    const fleetRecoveryDone = new Promise((r) => { resolveFleetRecovery = r; });
+    const coordinators = {
+        elicitation: elicitation ? elicitation : undefined,
+        question: question ? question : undefined,
+        toolApproval: toolApproval ? toolApproval : undefined,
+        approvalAskAudit: approvalAskAudit ? approvalAskAudit : undefined,
+        approvalLateSettle: approvalAskAudit ? approvalAskAudit : undefined,
+        workflowAgentRegistry: workflowAgentRegistry ? workflowAgentRegistry : undefined,
+        subagentSteerRegistry,
+        workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined,
+        fleetBus,
+        fleetRecoveryDone,
+        sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined,
+        hookWakeBus,
+        sendUserFile: sendUserFileEmitter ? sendUserFileEmitter : undefined,
+        leaderEndpoint,
+        sessionTitler: sessionTitler ? sessionTitler : undefined,
+    };
+    const seams = {
+        deviceHub: deviceLane?.hub,
+        deviceStore: deviceLane?.store,
+        sessionAudit,
+        routeJudgeBrain: brain,
+        purgeSession: purgeSession ? purgeSession : undefined,
+        subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
+        taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
+        taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
+        memoryExport: memoryExportBackend ? (scope) => exportMemoryScope(memoryExportBackend, scope) : undefined,
+        memorySync: memoryExportBackend && memorySyncCursors
+            ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
+            : undefined,
+        memoryBundleExport: memoryBundleFaces ? memoryBundleFaces.exportScopes : undefined,
+        memoryBundleImport: memoryBundleFaces ? memoryBundleFaces.importBundle : undefined,
+        memoryCompliance: memoryComplianceFaces,
+        memoryOriginFace: memoryOriginFaces,
+        sessionMemoryStatus: sessionMemoryStatusFace,
+        memoryConsolidation: memoryConsolidationFaces,
+        memoryOptOutGrant: memoryOptOutGrantStore,
+        orgMemoryDirectory: orgMemoryAdmission.directory,
+        sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
+        sessionMirrorRuling: principalCaps
+            ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
+            : undefined,
+        instrumentDegenerate,
+        sideQueryAccounting,
+        parkedReviveTool: parkedReviveTool ? parkedReviveTool : undefined,
+        parkedReviveInheritedGate: parkedReviveInheritedGate ? parkedReviveInheritedGate : undefined,
+    };
+    const observability = {
+        logger,
+        metrics,
+        modelUsage: modelUsageTracker,
+        promptManifests: promptManifestTracker,
+        planCacheProbe,
+    };
+    const governance = {
+        authorize,
+        registryJwtVerifier: registryJwtVerifier ? registryJwtVerifier : undefined,
+        rateLimiter,
+        costQuota,
+        fleetLease: fleetLease ? fleetLease : undefined,
+        usageWindowStore: usageWindowStore ? usageWindowStore : undefined,
+        autoModeFace: {
+            seatMounted: runnerDeps.autoMode !== undefined,
+            engineArmsOnIntent: coreArmsAutoOnIntent(),
+            resolveCaps: runtimeCapsPeekResolver,
+            classifierModel: () => {
+                const route = classifierRouteFor(runnerDeps);
+                if (route.fault !== undefined)
+                    logger.debug("auto_mode_classifier_route_unresolved", { fault: route.fault });
+                return route.id;
+            },
+        },
+    };
+    const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0
+        ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
+        : undefined;
+    const deployment = {
+        sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        modelReady: () => configCenter.modelReady(),
+        scenarioDetails,
+        workflowsCapable,
+        workflowModelAllowlist: workflowModelAllowlistSnapshot,
+        staticWiring,
+        memoryPosture,
+        sqlEngineFacts,
+        writeProtection: buildWriteProtectionPosture(config),
+        instanceId,
+        capabilities: {
+            version: serviceVersion(),
+            scenarios: Object.keys(scenarios),
+            get pricingConfigured() {
+                return isPricingConfigured(pricing);
+            },
+        },
+        restartState: () => configCenter.restartState(),
+        planeDeferredState: () => configCenter.planeDeferredState(),
+        configApplyState: () => configCenter.configApplyState(),
+        mcpRevocations,
+        mcpRevocationState: () => configCenter.mcpRevocationState(),
+        configRefreshNow: () => configCenter.refreshNow(),
+        configCenterManagedKeys: () => configCenter.centerManagedKeys(),
+        drainState,
+        storeDegraded: storeBackendDegraded,
+        storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
+    };
+    const knobs = {
+        snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
+            ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
+            : undefined,
+        sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
+    };
+    const resolveSpec = createResolveSpec({
+        config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver,
+        getCenterPrompts: () => configCenter.getCenterPrompts(),
+        getKeyResolver: () => configCenter.getKeyResolver(),
+        taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
+        hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
+        noteSessionShellGate: sessionShellGateRegistry.note,
+        selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
+        singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
+        sessionEnvSelection,
+        lockedKeys: governanceSeams.lockedKeys,
+        liveQuestionFace: question,
+        approverSeat: createRunnerDepsOnAsk(toolApproval),
+    });
+    const runnerFor = createHandsRunnerSelector({ full: runner, handsless: handslessRunner });
+    const sideQuery = createSideQueryLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver() });
+    const server = createHttpServer({ runner, runnerFor, sideQuery, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
+    bindServerLateSeats({ config, logger, server });
+    const fleetReconcile = startFleetReconciler({
+        bus: fleetBus,
+        isLiveOnThisReplica: server.isRunLiveOnThisReplica,
+        ...(runStore ? { runs: runStore } : {}),
+        ...(workflowRunStore ? { workflows: workflowRunStore } : {}),
+        instanceId,
+        logger,
+        metrics,
+    });
+    const bindHost = resolveBindHost(config);
+    if (config.bindHostSource === "HOST" && bindHost !== config.bindHost) {
+        logger.warn("bind_host_from_HOST_env_overridden", {
+            bindHost,
+            ignoredHostEnv: config.bindHost,
+            note: "HOST was inherited from the shell (zsh commonly sets it to the machine name) and would have bound the write face to a non-loopback address — but this deployment has ALLOW_UNAUTHED_WRITES with no service token, so the bind address was narrowed to loopback instead. Two ways out if you meant to expose it: set BIND_HOST explicitly, or configure a service token.",
+        });
+    }
+    else if (config.bindHostSource === "HOST") {
+        logger.warn("bind_host_from_HOST_env", {
+            bindHost,
+            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
+        });
+    }
+    let onListenError;
+    try {
+        await new Promise((resolve, reject) => {
+            onListenError = reject;
+            server.once("error", onListenError);
+            bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve);
+        });
+    }
+    catch (e) {
+        logger.error("listen_failed", {
+            port: config.port,
+            bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
+            ...(config.bindHostSource ? { bindHostSource: config.bindHostSource } : {}),
+            ...(config.bindHostSource === "HOST" ? { note: "bind failed for a host inherited from the HOST env var — set BIND_HOST explicitly (e.g. BIND_HOST=127.0.0.1)." } : {}),
+            error: e instanceof Error ? e.message : String(e),
+        });
+        throw e;
+    }
+    finally {
+        if (onListenError)
+            server.removeListener("error", onListenError);
+    }
+    server.on("error", (e) => {
+        logger.error("server_error", {
+            error: e.message,
+            ...("code" in e ? { code: String(e.code) } : {}),
+        });
+    });
+    const fleetClient = startFleetClientFromEnv(config, {
+        instanceId,
+        version: serviceVersion(),
+        isDraining: () => drainState.draining,
+        ...(fleetUsage ? { usage: fleetUsage } : {}),
+        logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}) },
+    });
+    if (fleetClient)
+        logger.info("fleet_client_started", { worker: config.configCenter?.worker, address: process.env.FLEET_ADVERTISE_ADDRESS });
+    logger.info("listening", {
+        port: config.port,
+        bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
+        ...(bindHost === "127.0.0.1" && !config.bindHost
+            ? { bindHostNote: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
+            : {}),
+        model: config.model.id,
+        brain: brainSummary(config),
+        breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
+        session: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
+        memory: memoryEngine ? `engine(${memoryEngine.root})` : "off",
+        instanceId,
+        rateLimitPerMin: config.rateLimitPerMin,
+        rateLimit: config.rateLimitPerMin > 0 ? counterStoreLabel(backend?.rateLimiter, backend?.kind) : "off",
+        maxPrincipalCostUsd: config.maxPrincipalCostUsd || null,
+        costQuota: config.maxPrincipalCostUsd > 0 ? counterStoreLabel(backend?.costQuota, backend?.kind) : "off",
+        toolResultStore: toolResultStore ? (backend?.kind === "local" ? "file(local)" : "shared(sql)") : "in-process",
+        otel: config.otel ? config.otel.endpoint : null,
+        perModelKeys: Object.keys(config.modelApiKeyEnv).length,
+        sealedModelKeys: Object.values(config.modelApiKeys).filter((v) => typeof v === "string").length,
+        sealedPoisonedModels: Object.values(config.modelApiKeys).filter((v) => typeof v !== "string").length,
+        workflowRunStore: config.selfOrchestrationEnabled
+            ? config.workflowRunStoreBackend === "memory"
+                ? "in-process"
+                : sqlWorkflowRunStore
+                    ? `db(${backend.kind})`
+                    : "file"
+            : "off",
+    });
+    if (workflowNotifyGate) {
+        void workflowNotifyGate
+            .recover(workflowRecoverOpts)
+            .then((tally) => logger.info("workflow_notify_recovered", tally))
+            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }))
+            .finally(() => resolveFleetRecovery());
+    }
+    else {
+        resolveFleetRecovery();
+    }
+    void installShutdownHandlers({
+        config, logger, server, reaper, fleetReconcile, otelExporter, breakerState, costQuota, rateLimiter,
+        version: serviceVersion(),
+        runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
+        storeLiveProbe, configCenter,
+        deviceHub: deviceLane?.hub,
+        retentionLane: retentionLaneStarted,
+        releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,
+    });
+    return { ...ctx };
+}
+//# sourceMappingURL=stage-10-http-server.js.map

package/dist/config-invariants.d.ts

@@ -52,6 +52,15 @@ export interface CrossInvariant {
     check(input: CrossInvariantInput): string | undefined;
 }
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
+/**
+ * 按 id 取**一条**(S-157②:boot 面的单源化出口)。
+ *
+ * 为什么不是在 boot 期跑 `checkCrossInvariants` 全表:全表里有若干条的 boot 拒启点在 `config.ts` 的装配尾
+ * (各自有自己的锚),在这里再跑一遍全表等于给 boot 加上今天不存在的拒启臂 —— 那是行为改动,不是单源化。
+ * 本出口只做一件事:让 boot 与 stage 两面调**同一只** `check`(连拒因文本也来自它),消灭手抄的第二份判据。
+ * 闭集越界不可达(`CrossInvariantId` 是编译期闭集),真撞上就响亮抛 —— 不返回 undefined 让调用方静默跳过。
+ */
+export declare function crossInvariant(id: CrossInvariantId): CrossInvariant;
 export type CrossInvariantVerdict = {
     ok: true;
 } | {

package/dist/config-invariants.js

@@ -8,7 +8,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "run-stale-heartbeat",
         keys: ["runStaleSec"],
         restartReason: "run-stale-heartbeat",
-        bootAnchor: { file: "src/main.ts", marker: "CROSS-INVARIANT:run-stale-heartbeat" },
+        bootAnchor: { file: "src/boot/stage-01-config.ts", marker: "CROSS-INVARIANT:run-stale-heartbeat" },
         check: ({ next }) => next.runStaleSec * 1000 <= LIVENESS_HEARTBEAT_MS
             ? `runStaleSec (${next.runStaleSec}s) must exceed the ${LIVENESS_HEARTBEAT_MS / 1000}s liveness heartbeat — the reaper would race a run that is still heartbeating normally and reap live work`
             : undefined,
@@ -130,6 +130,12 @@ export const CONFIG_CROSS_INVARIANTS = [
             : undefined,
     },
 ];
+export function crossInvariant(id) {
+    const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);
+    if (inv === undefined)
+        throw new Error(`unknown cross-invariant: ${id}`);
+    return inv;
+}
 export function checkCrossInvariants(input) {
     for (const inv of CONFIG_CROSS_INVARIANTS) {
         const reason = inv.check(input);

package/dist/config-types.d.ts

@@ -1167,7 +1167,7 @@ export interface ServiceConfigFlat {
     infraCostRates: InfraCostRates;
     /** v2 leader endpoint ([ref]): enable POST/GET /v1/leader. Requires an ISOLATED remote-exec backend —
      *  REMOTE_EXEC=e2b, OR REMOTE_EXEC=k8s (Kata pod-sandbox) WITH an S3/MinIO config for the workspace-durable
-     *  snapshot/merge (main.ts:524) — + (deploy) git on the host + a durable remote with creds. Orthogonal to the
+     *  snapshot/merge(装配点 `boot/leader.ts#assertLeaderDurableStore`) — + (deploy) git on the host + a durable remote with creds. Orthogonal to the
      *  D-G direct door (auth axis) — a worker can be direct-mode + kata + leader at once. Default OFF. `LEADER_ENABLED=true`. */
     leaderEnabled: boolean;
     /** [ref] A6 (correctness-first knob): `LEADER_FANOUT_ENABLED=false` pins the leader router to the

package/dist/http/dispatch.js

@@ -2,9 +2,10 @@ import { createHash } from "node:crypto";
 import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { PRE_CREDENTIAL_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath } from "./route-table.js";
+import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
+import { PRE_CREDENTIAL_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute } from "./route-table.js";
 import { sendJson, sendError, isSseResponse } from "./send.js";
-import { authorized, systemFor } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function hasServiceAuth(config) {
     return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
@@ -42,19 +43,29 @@ export function createDispatch(ctx) {
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
     }
-    async function dispatchSegment(rows, req, res, url, ctx) {
+    async function dispatchSegment(rows, req, res, url, search, method, allow, ctx) {
         for (const row of rows) {
             if (row.enabled !== undefined && !row.enabled(deps))
                 continue;
-            if (await row.handler(req, res, url, ctx))
-                return true;
+            const found = lookupRoute(row.decls, url, method);
+            for (const m of found.allow)
+                if (!allow.includes(m))
+                    allow.push(m);
+            if (found.decl === null)
+                continue;
+            await row.handler(req, res, { decl: found.decl, params: found.params, search }, ctx);
+            return true;
         }
         return false;
     }
     async function handle(req, res) {
         const startedAt = Date.now();
         const method = req.method ?? "GET";
-        const url = (req.url ?? "/").split("?")[0];
+        const rawUrl = req.url ?? "/";
+        const qMark = rawUrl.indexOf("?");
+        const url = qMark === -1 ? rawUrl : rawUrl.slice(0, qMark);
+        const search = qMark === -1 ? "" : rawUrl.slice(qMark);
+        const allow = { pre: [], post: [] };
         noteActivity(url);
         const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
         if (admitted)
@@ -180,7 +191,7 @@ export function createDispatch(ctx) {
                 }
             }
         }
-        if (await dispatchSegment(PRE_CREDENTIAL_ROUTES, req, res, url, ctx))
+        if (await dispatchSegment(PRE_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
@@ -221,8 +232,17 @@ export function createDispatch(ctx) {
             sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
-        if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, ctx))
+        if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, search, method, allow.post, ctx))
             return;
+        if (allow.pre.length > 0 || allow.post.length > 0) {
+            if (allow.post.length > 0 && deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            res.setHeader("allow", ROUTE_METHOD_ORDER.filter((m) => allow.pre.includes(m) || allow.post.includes(m)).join(", "));
+            sendError(res, 405, "method_not_allowed", "this path exists but not for this HTTP method — the `Allow` response header lists the methods it does answer");
+            return;
+        }
         sendError(res, 404, "not_found.route", "not found");
     }
     return { handle };