@sema-agent/server 7.82.1 → 7.83.0

package/dist/plugins/tidb-pool.d.ts

@@ -1,6 +1,7 @@
 import mysql from "mysql2/promise";
 import type { Pool, PoolConnection } from "mysql2/promise";
 import type { ServiceConfig } from "../config-types.js";
+import { type IndexSpec } from "./ensure-index.js";
 /**
  * Shared TiDB (MySQL wire-compatible) connection pool for the durable Session center (L1).
  * Owned by `main.ts`; closed on shutdown.
@@ -57,11 +58,22 @@ export declare const ENSURE_SCHEMA_LOCK = "sema_ensure_schema";
  *  lock row — which both exhausts TiDB's "pessimistic lock retry limit" (surfacing as a thrown error) AND starves the
  *  app's OWN `SELECT … FOR UPDATE` paths (image-bake admission/lease) of pessimistic-lock budget. So we acquire
  *  NON-BLOCKING (GET_LOCK(name, 0) returns 0 immediately if held) and POLL with jittered backoff: one holder, the
- *  rest sleeping (not blocked in-DB). Return false only after exhausting retries (the caller then DEGRADES to
- *  unserialized rather than blocking boot forever — the DDL is still individually idempotent). */
-export declare function acquireEnsureSchemaLock(conn: PoolConnection, tag?: string): Promise<boolean>;
+ *  rest sleeping (not blocked in-DB). Polls until acquired (7.83.0: never degrades to unserialized — the S-287
+ *  `ADD INDEX` leg is not race-safe); a connection whose probe keeps throwing surfaces as a boot failure. */
+export declare function acquireEnsureSchemaLock(conn: PoolConnection, tag?: string): Promise<void>;
 /** Release {@link ENSURE_SCHEMA_LOCK} on `conn` (best-effort — the lock also auto-frees when the connection closes). */
 export declare function releaseEnsureSchemaLock(conn: PoolConnection, tag?: string): Promise<void>;
+/**
+ * S-287:`SCHEMA_STATEMENTS` 建的那批表**在存量库上可能缺的索引**(声明与 PG 侧逐条共用同一份 —— 见
+ * `plugins/ensure-index.ts` 头注与 `plugins/schema-indexes.ts`)。
+ *
+ * 组合口径与 `SCHEMA_STATEMENTS` **一一对应**:凡是它建的表,索引声明就进这个数组;它不建的表
+ * (device / roster / background-agent / mailbox / task-attachment / memory 两族……由 `boot/stores.ts`
+ * 各自的 `ensureTiDB*Schema` 腿建)由那条腿自己应用自己的声明 —— 否则这里会对一张还不存在的表发 ALTER。
+ *
+ * 新建库上这批索引早已随 `CREATE TABLE` 的内联 `KEY` 到货 ⇒ `ensureIndex` 的探测全部命中、**零 DDL**。
+ */
+export declare const SCHEMA_INDEXES: readonly IndexSpec[];
 /** Create tables if absent (+ seed the image-bake admission sentinel). Safe to call on every startup.
  *
  *  Per the SCHEMA POLICY on {@link SCHEMA_STATEMENTS} this is a pure CREATE run — there are NO additive

package/dist/plugins/tidb-pool.js

@@ -6,6 +6,21 @@ import { TIDB_LEADER_RUN_STATEMENTS } from "./leader-run-store-sql.js";
 import { TIDB_ADOPTION_LOG_STATEMENTS } from "./adoption-log-sql.js";
 import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js";
 import { TIDB_RETENTION_STATEMENTS } from "./retention-store-sql.js";
+import { ensureIndexes } from "./ensure-index.js";
+import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
+import { SESSION_INDEXES } from "./pg-session-storage.js";
+import { TOOL_RESULT_INDEXES } from "./tool-result-store-sql.js";
+import { COST_QUOTA_INDEXES } from "./pg-cost-quota.js";
+import { RATE_LIMIT_INDEXES } from "./pg-rate-limiter.js";
+import { OUTCOME_LEDGER_INDEXES } from "./outcome-ledger-sql.js";
+import { IMAGE_INDEX_INDEXES } from "./image-index-sql.js";
+import { IMAGE_BAKE_INDEXES } from "./image-bake-store-sql.js";
+import { APPROVAL_ASK_INDEXES } from "./approval-ask-store-sql.js";
+import { ADOPTION_LOG_INDEXES } from "./adoption-log-sql.js";
+import { PERMISSION_RULE_INDEXES } from "./permission-rule-store-sql.js";
+import { RETENTION_INDEXES } from "./retention-store-sql.js";
+import { LEADER_RUN_INDEXES } from "./leader-run-store-sql.js";
+import { pollUntilLocked } from "./ensure-schema-lock-policy.js";
 export function tidbPoolOptions(tidb) {
     const { host, port, user, password, database, connectionLimit } = tidb;
     const limit = connectionLimit ?? 10;
@@ -670,20 +685,10 @@ export const SCHEMA_STATEMENTS = [
 ];
 export const ENSURE_SCHEMA_LOCK = "sema_ensure_schema";
 export async function acquireEnsureSchemaLock(conn, tag = "ensureSchema") {
-    await new Promise((r) => setTimeout(r, Math.floor(Math.random() * 400)));
-    for (let attempt = 0; attempt < 40; attempt++) {
-        try {
-            const [rows] = await conn.query("SELECT GET_LOCK(?, 0) AS got", [ENSURE_SCHEMA_LOCK]);
-            if (Number(rows[0]?.got) === 1)
-                return true;
-        }
-        catch (err) {
-            console.warn(`[${tag}] GET_LOCK('${ENSURE_SCHEMA_LOCK}') attempt ${attempt + 1}/40:`, err?.message ?? err);
-        }
-        await new Promise((r) => setTimeout(r, 100 + Math.min(attempt, 3) * 100 + Math.floor(Math.random() * 150)));
-    }
-    console.warn(`[${tag}] could not acquire '${ENSURE_SCHEMA_LOCK}' after retries`);
-    return false;
+    await pollUntilLocked(async () => {
+        const [rows] = await conn.query("SELECT GET_LOCK(?, 0) AS got", [ENSURE_SCHEMA_LOCK]);
+        return Number(rows[0]?.got) === 1;
+    }, { tag, label: `GET_LOCK('${ENSURE_SCHEMA_LOCK}')` });
 }
 export async function releaseEnsureSchemaLock(conn, tag = "ensureSchema") {
     try {
@@ -693,14 +698,32 @@ export async function releaseEnsureSchemaLock(conn, tag = "ensureSchema") {
         console.warn(`[${tag}] RELEASE_LOCK('${ENSURE_SCHEMA_LOCK}') failed (lock auto-frees on connection close):`, err);
     }
 }
+export const SCHEMA_INDEXES = [
+    ...CENTRAL_SCHEMA_INDEXES,
+    ...SESSION_INDEXES,
+    ...TOOL_RESULT_INDEXES,
+    ...COST_QUOTA_INDEXES,
+    ...RATE_LIMIT_INDEXES,
+    ...OUTCOME_LEDGER_INDEXES,
+    ...IMAGE_INDEX_INDEXES,
+    ...IMAGE_BAKE_INDEXES,
+    ...APPROVAL_ASK_INDEXES,
+    ...ADOPTION_LOG_INDEXES,
+    ...PERMISSION_RULE_INDEXES,
+    ...RETENTION_INDEXES,
+    ...LEADER_RUN_INDEXES,
+];
 export async function ensureSchema(pool) {
     const conn = await pool.getConnection();
-    const locked = await acquireEnsureSchemaLock(conn);
+    let locked = false;
     try {
+        await acquireEnsureSchemaLock(conn);
+        locked = true;
         for (const stmt of SCHEMA_STATEMENTS) {
             await conn.query(stmt);
         }
         await conn.query("INSERT IGNORE INTO image_bake_admit (pool) VALUES ('standard')");
+        await ensureIndexes((text, params) => conn.query(text, params), "mysql", SCHEMA_INDEXES);
     }
     finally {
         if (locked)

package/dist/plugins/tool-result-store-sql.d.ts

@@ -2,10 +2,13 @@ import type { ToolResultProvenance, ToolResultStore, ToolResultSlice, ToolResult
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool, PoolClient as PgPoolClient } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
+import { type IndexSpec } from "./ensure-index.js";
 /** PG schema for the tool_result table — the PG translation of tidb-pool.ts's tool_result DDL
  *  (LONGTEXT→TEXT, DATETIME(3)→TIMESTAMPTZ(3), inline KEY→separate CREATE INDEX). Disjoint from other stores'
  *  tables, so a self-contained ensureSchema is safe (central pg-pool aggregation is done separately). */
 export declare const PG_TOOL_RESULT_SCHEMA: string[];
+/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensureSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+export declare const TOOL_RESULT_INDEXES: readonly IndexSpec[];
 /** Idempotent schema apply for the tool_result table (for the integration test to call). */
 export declare function ensureSchema(pool: PgPool | PgPoolClient): Promise<void>;
 /**

package/dist/plugins/tool-result-store-sql.js

@@ -2,6 +2,7 @@ import { MAX_MINTED_TOOL_RESULT_REF_CHARS, assertSafeToolResultRef, assertToolRe
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
+import { ensureIndexes } from "./ensure-index.js";
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
      ref              VARCHAR(518) COLLATE "C" NOT NULL,
@@ -11,11 +12,14 @@ export const PG_TOOL_RESULT_SCHEMA = [
      created_at       TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (ref)
    )`,
-    `CREATE INDEX IF NOT EXISTS idx_tool_result_created ON tool_result (created_at)`,
+];
+export const TOOL_RESULT_INDEXES = [
+    { table: "tool_result", name: "idx_tool_result_created", columns: ["created_at"] },
 ];
 export async function ensureSchema(pool) {
     for (const stmt of PG_TOOL_RESULT_SCHEMA)
         await pool.query(stmt);
+    await ensureIndexes((t, p) => pool.query(t, p), "pg", TOOL_RESULT_INDEXES);
 }
 export async function assertToolResultProvenanceSchema(query, dialect) {
     const widthRow = await query(dialect === "tidb"

package/dist/trace/project.d.ts

@@ -190,7 +190,8 @@ export declare function screenedStoredEventData(type: string, data: unknown): un
 /** `text_end` 段末帧的**唯一**铸点(三腿共用:top stream / 转发子代腿 / 子代 tail 面)。content = 段权威全文 ⇒ 与
  *  durable 面(`result` / 账本 `text` 行)同一只 {@link redactModelText}(认出才改写、抛则占位、不设上限)。
  *  此前三处各自逐字透传 —— 同一份文本毫秒后在 `done.result.result` 上已脱,live 面却在凭据生成瞬间明文(B-114)。
- *  `text_delta` 仍逐字:跨 chunk 的凭据无法就地判,流式脱敏是独立设计件(S-270)。
+ *  `text_delta` 仍逐字:跨 chunk 的凭据无法就地判;clay [ref] ②(2026-09-18)裁定**维持逐字成文**(S-270 U-3 关票),
+ *  权威段 `text_end.content` 已脱敏、消费端段末整段替换即得脱敏读法。
  *  坏形(content 非串/空串)⇒ null(丢帧,不铸「权威空段」:core 契约明言空段不发本帧,消费端收到空段会清掉已攒 delta)。
  *  身份**四键**随行(live 现状带全四键,消费端可能已依赖);值经 {@link identityKey} —— 非空 string 才上 wire
  *  (S-334 起不再逐字透传:坏形身份键会在 live 写口上铸出假游标)。 */

package/dist/trace/redact.d.ts

@@ -77,6 +77,12 @@ export declare function resetPpkScanBytesForTest(): void;
  *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js:9-11`),截过与天生就短在 wire 上不可区分。
  *  所以一个 `arm="fragment"` 计数可能来自残片,也可能来自一个恰好落在阈值之上的 look-alike;
  *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
+/**
+ * 🔴 **词名 = 表归属,不是语义**(clay 裁 [ref] ①,2026-09-18,关 S-307):`"full"` = 强证据表(`SECRET_PATTERNS` 一族,
+ * 含 7.76.2 起改判进来的 PEM/ppk 体)命中的臂,`"fragment"` = 弱证据表({@link FRAGMENT_SECRET_PATTERNS})命中的臂。
+ * 7.76.2 起两档语义已是「强证据 / 弱证据」,词名**刻意保留**:它是 Prometheus 标签 `redactions_applied_total{arm}` 的
+ * 标签值,改名 = 硬 breaking 的标签值漂移(面板与告警按值匹配),而语义只在这一段注释里说全即可。判据是 {@link armOfToken}。
+ */
 export type RedactionArm = "full" | "fragment";
 export interface RedactionHitMeta {
     /** 命中臂的**判别力档位**(闭集两词,S-303):`"fragment"` = {@link FRAGMENT_SECRET_PATTERNS} 那一族

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.82.1",
+  "version": "7.83.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",