@sema-agent/server 7.8.1 → 7.10.0

package/dist/plugins/workflow-run-store-sql.js

@@ -46,7 +46,7 @@ export class SqlWorkflowRunStore {
     async put(id, run) {
         const stored = { ...run, id, rev: run.rev ?? 0 }; // key authoritative + observed-rev base (InMemory parity)
         try {
-            await this.db.query(this.q("INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at) VALUES (?,?,?,?,?,?,?)", "INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at) VALUES ($1,$2,$3,$4,$5,$6,$7)"), [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
+            await this.db.query(this.q("INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at_ms) VALUES (?,?,?,?,?,?,?)", "INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at_ms) VALUES ($1,$2,$3,$4,$5,$6,$7)"), [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
         }
         catch (e) {
             // create-once error every backend throws (contract) — dup-key classification is dialect-specific:
@@ -83,7 +83,7 @@ export class SqlWorkflowRunStore {
                 return false; // even the skeleton is oversize — keep the prior revision
             blob = slim;
         }
-        const res = await this.db.query(this.q(`UPDATE workflow_run SET run = ?, rev = rev + 1, status = ?, ended_at = ? WHERE id = ? AND scope = ?${expect !== undefined ? " AND rev = ?" : ""}`, `UPDATE workflow_run SET run = $1, rev = rev + 1, status = $2, ended_at = $3 WHERE id = $4 AND scope = $5${expect !== undefined ? " AND rev = $6" : ""}`), expect !== undefined
+        const res = await this.db.query(this.q(`UPDATE workflow_run SET run = ?, rev = rev + 1, status = ?, ended_at_ms = ? WHERE id = ? AND scope = ?${expect !== undefined ? " AND rev = ?" : ""}`, `UPDATE workflow_run SET run = $1, rev = rev + 1, status = $2, ended_at_ms = $3 WHERE id = $4 AND scope = $5${expect !== undefined ? " AND rev = $6" : ""}`), expect !== undefined
             ? [blob, run.status, run.endedAt ?? null, id, scope, expect.rev]
             : [blob, run.status, run.endedAt ?? null, id, scope]);
         return res.affected === 1; // rev always bumps → affected is a faithful CAS verdict
@@ -156,12 +156,12 @@ export class SqlWorkflowRunStore {
             return 0; // retention is always explicit
         // Cheap columns only; terminal-set + keep-N semantics computed in JS to match InMemory EXACTLY
         // (isTerminalWorkflowStatus is core's — no status list duplicated into SQL).
-        const { rows } = await this.db.query(this.q("SELECT id, status, created_at_ms, ended_at FROM workflow_run WHERE scope = ? ORDER BY created_at_ms DESC, id DESC", "SELECT id, status, created_at_ms, ended_at FROM workflow_run WHERE scope = $1 ORDER BY created_at_ms DESC, id DESC"), [scope]);
+        const { rows } = await this.db.query(this.q("SELECT id, status, created_at_ms, ended_at_ms FROM workflow_run WHERE scope = ? ORDER BY created_at_ms DESC, id DESC", "SELECT id, status, created_at_ms, ended_at_ms FROM workflow_run WHERE scope = $1 ORDER BY created_at_ms DESC, id DESC"), [scope]);
         const terminal = rows.filter((r) => isTerminalWorkflowStatus(String(r.status)));
         const doomed = [];
         for (let i = 0; i < terminal.length; i++) {
             const r = terminal[i];
-            const anchor = r.ended_at != null ? Number(r.ended_at) : Number(r.created_at_ms);
+            const anchor = r.ended_at_ms != null ? Number(r.ended_at_ms) : Number(r.created_at_ms);
             const tooOld = opts.maxAgeMs !== undefined && anchor < now - opts.maxAgeMs;
             const overKeep = opts.keep !== undefined && i >= opts.keep;
             if (tooOld || overKeep)
@@ -311,31 +311,31 @@ export class SqlWorkflowNotifyJournalStore {
     async record(input) {
         // Idempotent-on-runId (a second record for the same run — incl. an acked one — is a no-op): TiDB
         // `INSERT IGNORE` vs PG `ON CONFLICT (run_id) DO NOTHING`.
-        await this.db.query(this.q("INSERT IGNORE INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at) VALUES (?,?,0,?,?,?)", "INSERT INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at) VALUES ($1,$2,0,$3,$4,$5) ON CONFLICT (run_id) DO NOTHING"), [input.runId, input.scope, input.sourceTaskId ?? null, input.principal ?? null, input.createdAt]);
+        await this.db.query(this.q("INSERT IGNORE INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at_ms) VALUES (?,?,0,?,?,?)", "INSERT INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at_ms) VALUES ($1,$2,0,$3,$4,$5) ON CONFLICT (run_id) DO NOTHING"), [input.runId, input.scope, input.sourceTaskId ?? null, input.principal ?? null, input.createdAt]);
     }
     async ack(runId, ackedAt) {
-        await this.db.query(this.q("UPDATE workflow_notify_journal SET acked = 1, acked_at = ? WHERE run_id = ? AND acked = 0", "UPDATE workflow_notify_journal SET acked = 1, acked_at = $1 WHERE run_id = $2 AND acked = 0"), [ackedAt, runId]);
+        await this.db.query(this.q("UPDATE workflow_notify_journal SET acked = 1, acked_at_ms = ? WHERE run_id = ? AND acked = 0", "UPDATE workflow_notify_journal SET acked = 1, acked_at_ms = $1 WHERE run_id = $2 AND acked = 0"), [ackedAt, runId]);
     }
     async listPending() {
-        const { rows } = await this.db.query("SELECT run_id, scope, source_task_id, principal, created_at FROM workflow_notify_journal WHERE acked = 0");
+        const { rows } = await this.db.query("SELECT run_id, scope, source_task_id, principal, created_at_ms FROM workflow_notify_journal WHERE acked = 0");
         return rows.map((r) => ({
             runId: String(r.run_id),
             scope: String(r.scope),
             acked: false,
             ...(r.source_task_id != null ? { sourceTaskId: String(r.source_task_id) } : {}),
             ...(r.principal != null ? { principal: String(r.principal) } : {}),
-            createdAt: Number(r.created_at),
+            createdAt: Number(r.created_at_ms),
         }));
     }
     /** Retention (same sweep as reapAllScopes): ACKED rows are pure history — without this the twin re-opens
      *  the unbounded-growth hole the same release closed for workflow_run. Pending rows are NEVER reaped (they
      *  are the recovery backlog; the orphan-grace sweep is what retires a stuck pending run). */
     async reapAcked(before) {
-        const res = await this.db.query(this.q("DELETE FROM workflow_notify_journal WHERE acked = 1 AND acked_at < ?", "DELETE FROM workflow_notify_journal WHERE acked = 1 AND acked_at < $1"), [before]);
+        const res = await this.db.query(this.q("DELETE FROM workflow_notify_journal WHERE acked = 1 AND acked_at_ms < ?", "DELETE FROM workflow_notify_journal WHERE acked = 1 AND acked_at_ms < $1"), [before]);
         return res.affected;
     }
     async get(runId) {
-        const { rows } = await this.db.query(this.q("SELECT run_id, scope, acked, source_task_id, principal, created_at, acked_at FROM workflow_notify_journal WHERE run_id = ?", "SELECT run_id, scope, acked, source_task_id, principal, created_at, acked_at FROM workflow_notify_journal WHERE run_id = $1"), [runId]);
+        const { rows } = await this.db.query(this.q("SELECT run_id, scope, acked, source_task_id, principal, created_at_ms, acked_at_ms FROM workflow_notify_journal WHERE run_id = ?", "SELECT run_id, scope, acked, source_task_id, principal, created_at_ms, acked_at_ms FROM workflow_notify_journal WHERE run_id = $1"), [runId]);
         const r = rows[0];
         if (!r)
             return null;
@@ -345,8 +345,8 @@ export class SqlWorkflowNotifyJournalStore {
             acked: Number(r.acked) === 1,
             ...(r.source_task_id != null ? { sourceTaskId: String(r.source_task_id) } : {}),
             ...(r.principal != null ? { principal: String(r.principal) } : {}),
-            createdAt: Number(r.created_at),
-            ...(r.acked_at != null ? { ackedAt: Number(r.acked_at) } : {}),
+            createdAt: Number(r.created_at_ms),
+            ...(r.acked_at_ms != null ? { ackedAt: Number(r.acked_at_ms) } : {}),
         };
     }
 }

package/dist/run-local.js

@@ -53,14 +53,14 @@ import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-cent
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
-import { GiteaClient } from "./capabilities/repo-tools.js";
+import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
 import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { pickHandsRunner, withoutExecutionEnv } from "./capabilities/hands-lane.js";
 import { HttpError } from "./security.js";
 import { memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
-import { buildPricing } from "./budget.js";
+import { buildPricing, cappedCeiling } from "./budget.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { createMetrics } from "./observability/metrics.js";
@@ -539,7 +539,7 @@ export async function runLocal(argv, deps = {}) {
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
     // Capability layer (loadSkills + buildScenarios + selectScenario) — assembled exactly like main.ts.
     const skills = loadSkills(config.skillsDir);
-    const repoClient = config.gitApiBaseUrl ? new GiteaClient(config.gitApiBaseUrl, config.gitApiToken) : undefined;
+    const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
     // systematic-audit: wire the env-configured WebSearch backend (WEB_SEARCH_PROVIDER) exactly like main.ts, so the
     // default scenario's WebSearch tool is assembled on the CLI path too (it was silently never built before).
     const webSearchCfg = webSearchConfigFromEnv();
@@ -598,6 +598,19 @@ export async function runLocal(argv, deps = {}) {
     const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "team");
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
+    // A-002.9(#180 governance 缺口的同文件兄弟残余):运营方预算天花板两枚 —— 与 server 主路径
+    // (boot/resolve-spec.ts)**同键同算法**,共用 budget.ts 的 `cappedCeiling`。此腿无 body(见上一段
+    // 的 [854]④ 记账),所以 requested 恒缺席 ⇒ env 天花板在场时**直接成为** spec 值,天花板为 0/未设时
+    // 仍是 undefined(键缺席=无预算,与改前逐字等价)。
+    // ⚠️ 只接这两枚:`degrade`(MODEL_DEGRADE_*)是另一条旋钮线,不在本条案射程内。
+    const maxCostUsd = cappedCeiling(undefined, config.maxTaskCostUsd);
+    const maxTokens = cappedCeiling(undefined, config.maxTaskTokens);
+    // core 5.8.0:预算族与墙钟同住 limits;三键各自缺席就不写(全缺 ⇒ 整个 limits 键缺席)。
+    const limits = {
+        ...(timeoutSec !== undefined ? { maxWalltimeMs: timeoutSec * 1000 } : {}),
+        ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
+        ...(maxTokens !== undefined ? { maxTokens } : {}),
+    };
     // design/181 件三:自建的 spec 字面量经**同一条**部署治理链(见 {@link applyLocalGovernance})——
     // 审批基线 + autonomy/commandPolicy/MANUAL_MODE_SHELL_GATE/守卫集,tighten-only,折叠属主仍是 core。
     const spec = applyLocalGovernance({
@@ -618,8 +631,8 @@ export async function runLocal(argv, deps = {}) {
         // [849]→[2400] 场景层定死终验已无生产者(autonomous 退役);OR 折入形保留,与 resolveSpec 同语义。
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
-        // core 5.8.0:timeoutSec 键退役 → maxWalltimeMs(毫秒);taskWallClockSec 仍产秒,此处换算一次。
-        ...(timeoutSec !== undefined ? { limits: { maxWalltimeMs: timeoutSec * 1000 } } : {}),
+        // core 5.8.0:timeoutSec 键退役 → maxWalltimeMs(毫秒);taskWallClockSec 仍产秒,换算在上方 limits 合成处。
+        ...(Object.keys(limits).length > 0 ? { limits } : {}),
     }, config, workspaceDir);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: config.remoteExec?.provider ?? "in-process" });
     // ── Run ONE task to completion (the sync /v1/tasks path: plain runTask, no verify/cascade). ──

package/dist/tool-approval.d.ts

@@ -2,6 +2,15 @@ import { type AskRequest, type AskOutcome } from "@sema-agent/core";
 import { type ApprovalRequestFrame, type ApprovalRevokeFrame } from "./approval-card.js";
 import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
+/** A-002.1:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
+ *  此前 7 份手写副本散在两只 checkpoint store 的数组/SQL 字面与 /decide 守卫——core 加审批味 kind 时
+ *  全部静默漂移。core 无导出词表(全大写导出面零命中,2026-08-09 亲验),属主落此;SQL IN 片段从
+ *  数组派生保证同源。门=test/approval-gate-kinds-single-owner.test.ts(副本回潮即红)。 */
+export declare const APPROVAL_GATE_KINDS: readonly ["human", "irreversible_ask"];
+export type ApprovalGateKind = (typeof APPROVAL_GATE_KINDS)[number];
+export declare function isApprovalGateKind(k: string | undefined): k is ApprovalGateKind;
+/** 两方言同形的 SQL IN 片段(值为闭集常量字面,无注入面)。 */
+export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */

package/dist/tool-approval.js

@@ -54,6 +54,16 @@ import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-a
  *  DI logger,构造签名是设计定稿钉死的三键 options bag,加第四个 logger 键属于重议已裁事项）。仅用于
  *  D5 的一次性 store-故障 warn。 */
 const defaultLogger = createLogger();
+/** A-002.1:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
+ *  此前 7 份手写副本散在两只 checkpoint store 的数组/SQL 字面与 /decide 守卫——core 加审批味 kind 时
+ *  全部静默漂移。core 无导出词表(全大写导出面零命中,2026-08-09 亲验),属主落此;SQL IN 片段从
+ *  数组派生保证同源。门=test/approval-gate-kinds-single-owner.test.ts(副本回潮即红)。 */
+export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
+export function isApprovalGateKind(k) {
+    return k !== undefined && APPROVAL_GATE_KINDS.includes(k);
+}
+/** 两方言同形的 SQL IN 片段(值为闭集常量字面,无注入面)。 */
+export const APPROVAL_GATE_KINDS_SQL_IN = `(${APPROVAL_GATE_KINDS.map((k) => `'${k}'`).join(",")})`;
 /** Size bound on the redacted args payload in a `tool_approval` frame (parity with question's MAX_QUESTIONS_BYTES).
  *  Over the cap ⇒ the frame still goes out WITHOUT args (`argsOmitted: true`). The sibling lane makes the OPPOSITE
  *  call and that asymmetry is deliberate: an over-cap question is DROPPED and the ask reports `unavailable`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.8.1",
+  "version": "7.10.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.11.0",
+    "@sema-agent/sdk": "^6.12.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",