@sema-agent/server 7.9.0 → 7.11.0

package/dist/boot/adoption.js

@@ -0,0 +1,57 @@
+/**
+ * design/183 I6(server 同族)—— **每副本 boot 必查收编日志**。
+ *
+ * 🔴 为什么这道门必须存在:phase 真源住 SQL 正是为了「发起 host 在两条腿之间被摧毁 ⇒ 接棒副本按日志
+ * 续跑」。可是**没有人会替它按下重试** —— 运维那次 POST 的响应早就丢了。所以每个副本起来时都扫一遍
+ * 在飞行:能推就推到终态,推不动就**响亮**留痕(禁静默跳过 —— 静默跳过等于把半迁移状态带进服务期,
+ * 那正是 I6 存在的理由)。
+ *
+ * 🔴 为什么是「续跑或响亮拒」而不是「拒启」:半迁移的收编**是可恢复的**(每条腿幂等,phase 单调),
+ * 拒启只会让一个能自愈的状态变成一次停机。拒启留给不可恢复的装配谎言(boot/org-memory.ts 那类)。
+ * 与之对称:续跑失败**不吞异常** —— 它落一条 error 级留痕并把 outcome 记进返回值,调用方(main)
+ * 把读数打进启动日志,运维在启动行里就能看见「这台副本上还有 N 条收编没走完」。
+ *
+ * 阻塞性:扫描在**监听之前**跑完(main 的调用点)。一条弧的推进是几条 UPDATE,毫秒级;库里正常状态下
+ * 在飞行数为 0,一次 `WHERE state='in_flight'` 的索引点查而已。
+ */
+import { createAdoptionRunner } from "../adoption/runner.js";
+/**
+ * boot 期的在飞收编扫描。无 SQL 后端 ⇒ 零动作(收编面在那种部署上本来就 501)。
+ * 绝不抛:一次库抖动不该拒掉整台 worker 的启动,但**必须**留下响亮读数(`error` 位 + error 级日志)。
+ */
+export async function runAdoptionBootScan(ctx) {
+    const store = ctx.backend?.adoptionLog?.();
+    if (!store)
+        return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [] };
+    const runner = createAdoptionRunner({
+        store,
+        dialect: ctx.backend?.kind === "pg" ? "pg" : "tidb",
+        now: ctx.now ?? Date.now,
+        logger: ctx.logger,
+    });
+    try {
+        const inFlight = await store.listInFlight();
+        if (inFlight.length === 0)
+            return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [] };
+        ctx.logger.warn?.("adoption_in_flight_on_boot", {
+            count: inFlight.length,
+            ids: inFlight.map((r) => r.adoptionId),
+            note: "design/183 I6: resuming in-flight identity adoptions before this replica starts serving",
+        });
+        const out = await runner.resumeInFlight();
+        const reading = { scanned: inFlight.length, ...out };
+        if (reading.stalled.length > 0 || reading.rejected.length > 0 || reading.failed.length > 0) {
+            ctx.logger.error?.("adoption_boot_scan_incomplete", reading);
+        }
+        else {
+            ctx.logger.info?.("adoption_boot_scan_resumed", reading);
+        }
+        return reading;
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        ctx.logger.error?.("adoption_boot_scan_failed", { error });
+        return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [], error };
+    }
+}
+//# sourceMappingURL=adoption.js.map

package/dist/boot/coordinators.d.ts

@@ -15,11 +15,15 @@ import { ToolApprovalCoordinator } from "../tool-approval.js";
 import { SendUserFileEmitter } from "../capabilities/send-user-file-tool.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
+import type { RuleConsentLane } from "../rules-consent.js";
 export interface LiveCoordinatorsCtx {
     config: ServiceConfig;
     logger: Logger;
     backend: StoreBackend | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
+    /** #154 车二:持久化权限规则的同意车道(main.ts 与 `RunnerDeps.permissionRuleStore` **同源**于
+     *  `backend.permissionRule()` 的同一个返回值)。在场 ⇒ ask 帧投 `ruleSuggestions` + 回决可兑付。 */
+    ruleConsent: RuleConsentLane | undefined;
 }
 export declare function createLiveCoordinators(ctx: LiveCoordinatorsCtx): {
     elicitation: ElicitationCoordinator | undefined;

package/dist/boot/coordinators.js

@@ -8,7 +8,7 @@ import { withLedgerRecording } from "../plugins/send-file-ledger.js";
 import { basename, resolve } from "node:path";
 import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
 export function createLiveCoordinators(ctx) {
-    const { config, logger, backend, sendUserFileTaskEnvs } = ctx;
+    const { config, logger, backend, sendUserFileTaskEnvs, ruleConsent } = ctx;
     // E23 (shell-host contract): inbound MCP elicitation coordinator (live-only HITL). Present ONLY when MCP_ELICITATION_ENABLED
     // — absent ⇒ onElicit is not wired ⇒ core advertises no elicitation capability to any server (fail-closed). Shared
     // by the runner (the onElicit seam) and the HTTP layer (the respond route + the per-run ALS context wraps).
@@ -71,6 +71,8 @@ export function createLiveCoordinators(ctx) {
             // X-2 写侧准入门两帽(协议未上场时门本身不参与,见 ToolApprovalCoordinator.admit)。
             admitMaxPerTask: config.streamApproval.admitMaxPerTask,
             admitMaxPerOwner: config.streamApproval.admitMaxPerOwner,
+            // #154 车二:同意车道(缺席 = 规则店没装配 ⇒ 帧上零候选、回决的 persistRule 如实拒)。
+            ...(ruleConsent !== undefined ? { ruleConsent } : {}),
         })
         : undefined;
     // SendUserFile(真 CC 契约,clay 2026-07-14)两种 lane 形态,其余缺席=诚实(工具不进 roster):

package/dist/boot/parked-revive-gate.d.ts

@@ -1,5 +1,6 @@
 import { type BackgroundAgentRecord, type ToolExecuteContext } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
+import type { RunnerDepsOnAsk } from "./runner-deps.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
 import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
@@ -15,8 +16,35 @@ export interface ApprovalExemptionProbe {
 export interface ParkedReviveGateDeps {
     /** ⚠️ **活引用**:热改字段(autonomy/commandPolicy/守卫集/审批四旋钮)每次赎回现读,见下方「禁 memoize」。 */
     readonly config: ParkedReviveGateConfigView;
-    /** #152:活体 AskUserQuestion 面。赎回腿今天无 ALS ctx ⇒ 判 ask,与原形同判。 */
+    /** #152:活体 AskUserQuestion 面。赎回腿今天无 ALS ctx ⇒ 判 ask,与原形同判。
+     *  ⚠️ 它同时是**决议链元数据** `contentMandate` 的唯一判据(见 {@link mandatePostureOf})。 */
     readonly question: LiveQuestionFace | undefined;
+    /**
+     * 部署级活体审批席 —— `RunnerDeps.onAsk` 的**同源铸法**(main.ts 递 `createRunnerDepsOnAsk(toolApproval)`,
+     * 单一属主同 boot/runner-deps.ts)。
+     *
+     * ⚠️ **本仓确有 per-task `spec.onAsk` 装配点**(codex 对抗复审 R1-中1 验真纠正 —— 别照抄
+     * `createRunnerDepsOnAsk` 头注那句「bg/resume 两条腿没有 per-task 装配点」,那句话的射程只是那两条腿):
+     * `http/routes/tasks.ts` 的宿主 sync/stream 腿在装配点写 `spec.onAsk = toolApproval.boundAsk({owner,
+     * taskId, sessionId, legKey…})`(windowZero 形则写一个恒返 `"unavailable"` 的闭包)。core 冻的是
+     * `spec.onAsk ?? deps.onAsk`,所以那条腿冻下去的是**带身份的** bound 席,不是这一格。
+     *
+     * 这对本腿的两个用途分别意味着什么:
+     *  · **`durableMandate` 判据(承重,见 {@link mandatePostureOf})—— 不受影响**:两个装配点是**同一个
+     *    条件**的两种表达(`spec.onAsk` 的两支都在 `deps.toolApproval` 在场时才写,windowZero 支写的也是
+     *    函数),所以「席位在不在场」这个**布尔**在 spec 位与 deps 位上恒等。core 的
+     *    `isLiveApproverSeat` 只判 `typeof === "function"` ⇒ 本腿算出的位与 park 时冻的位逐字相同,摘要对得上。
+     *  · **重建条目的 `onAsk` 席位本身 —— 是一个诚实的降级,不是等价替换**:bound 席携的身份
+     *    (owner/taskId/sessionId/legKey/腿时限)是**宿主那条腿**的,park 时未持久化 ⇒ 跨副本重建不出来。
+     *    交这一格的效果:赎回腿没有 ALS 上下文,`ToolApprovalCoordinator.ask` 第一行 `if (!ctx) return
+     *    "unavailable"`(tool-approval.ts)⇒ 继承 ask 恒走 core 的 `approverUnavailable` 回路 = **再 park
+     *    一次给人**。它**到不了**宿主原来那张卡(那是残余,与「客户端折叠层重建不出」同族);它也**不会**
+     *    错投到别处(无 ctx 就直接返回,`askBroadcast` 根本不执行 —— codex 提出的「按赎回腿归因/投递」
+     *    这条机制经亲读证伪)。
+     *    为什么仍然要交:席位缺席 + `durableMandate` 为 false(装了活体席的部署就是这一形)⇒ 继承 ask 只剩
+     *    headless auto-deny,比「再问人一次」严且哑。交了之后最坏也是 park,方向 fail-safe。
+     */
+    readonly approverSeat: RunnerDepsOnAsk | undefined;
     readonly approvalExemptionStore: ApprovalExemptionProbe | undefined;
     readonly logger: {
         info(event: string, fields?: Record<string, unknown>): void;
@@ -36,6 +64,9 @@ export interface ParkedReviveGateDeps {
  * 事件(载体键集钉见 test/parked-revive-gate-wiring.test.ts)。
  */
 export type RebuiltInheritedGate = NonNullable<NonNullable<NonNullable<ToolExecuteContext["reviveClaim"]>["parkedResume"]>["inheritedGate"]>;
+/** 重建链的**单层条目**形 —— 同样从载体推导(理由同 {@link RebuiltInheritedGate}:core 又加一个
+ *  能收紧的槽时,本仓的编译面要看得见)。 */
+export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentConstraints"]>[number];
 /**
  * 赎回腿的父约束链重建(design/181 件二)。
  *
@@ -66,10 +97,12 @@ export type RebuiltInheritedGate = NonNullable<NonNullable<NonNullable<ToolExecu
  * 时点语义(成文进 docs/ASSISTANT-WIRE-CONTRACT.md,免运维当 bug 报):
  *  · toolPolicy 轴 = **当前** config(与 resume 重折一致,收紧与放松都被兑现——放松是一次显式运维动作);
  *  · shellGate 轴 = core 取 max(live, park 时 seed)—— 收紧兑现、放松**不**兑现(fail-safe)。
- *  · `onAsk` 不供,但**这不等于 auto-deny**(codex R3-中1 验真纠正):带 `durableMandate` 的继承层
- *    判 `ask` 时,core 只要还看得见 checkpoint 店 + durable 审批配置就把它**重新浮回 durable 门**
- *    (再 park 一次,人再批一次);deny 只是「durable 设施不在场」的兜底臂。⛔ 但**不是无条件**
- *    (codex R4-中1):core 对挂起链计 `suspendCount`,到 `maxSuspends`(默认 5)即终止任务而不再 park。
+ *  · `onAsk` 轴 = 部署的活体审批席(`deps.approverSeat`),**在场即供**:park 时那一层冻的就是它。
+ *    席位缺席的部署上不供,而**这不等于 auto-deny**(codex R3-中1 验真纠正):此形恒带
+ *    `durableMandate`(见 {@link mandatePostureOf}),继承层判 `ask` 时 core 只要还看得见 checkpoint 店
+ *    + durable 审批配置就把它**重新浮回 durable 门**(再 park 一次,人再批一次);deny 只是「durable
+ *    设施不在场」的兜底臂。⛔ 但**不是无条件**(codex R4-中1):core 对挂起链计 `suspendCount`,到
+ *    `maxSuspends`(默认 5)即终止任务而不再 park。
  *  · 客户端每请求 settings 折出来的层(`settings.permissions` 的 allow/deny/ask、模式派生的 fs-write
  *    ask 门、scratchpad 豁免……整类)park 时未持久化 ⇒ 重建不出。§2.3 已披露的残余,机制面有特征化钉
  *    (test/parked-revive-e2e.test.ts);真 settings→park→赎回的端到端钉未建(候件,随收口件一起)。

package/dist/boot/parked-revive-gate.js

@@ -57,17 +57,20 @@ function hostGateCwd(config, localRoot) {
  * 时点语义(成文进 docs/ASSISTANT-WIRE-CONTRACT.md,免运维当 bug 报):
  *  · toolPolicy 轴 = **当前** config(与 resume 重折一致,收紧与放松都被兑现——放松是一次显式运维动作);
  *  · shellGate 轴 = core 取 max(live, park 时 seed)—— 收紧兑现、放松**不**兑现(fail-safe)。
- *  · `onAsk` 不供,但**这不等于 auto-deny**(codex R3-中1 验真纠正):带 `durableMandate` 的继承层
- *    判 `ask` 时,core 只要还看得见 checkpoint 店 + durable 审批配置就把它**重新浮回 durable 门**
- *    (再 park 一次,人再批一次);deny 只是「durable 设施不在场」的兜底臂。⛔ 但**不是无条件**
- *    (codex R4-中1):core 对挂起链计 `suspendCount`,到 `maxSuspends`(默认 5)即终止任务而不再 park。
+ *  · `onAsk` 轴 = 部署的活体审批席(`deps.approverSeat`),**在场即供**:park 时那一层冻的就是它。
+ *    席位缺席的部署上不供,而**这不等于 auto-deny**(codex R3-中1 验真纠正):此形恒带
+ *    `durableMandate`(见 {@link mandatePostureOf}),继承层判 `ask` 时 core 只要还看得见 checkpoint 店
+ *    + durable 审批配置就把它**重新浮回 durable 门**(再 park 一次,人再批一次);deny 只是「durable
+ *    设施不在场」的兜底臂。⛔ 但**不是无条件**(codex R4-中1):core 对挂起链计 `suspendCount`,到
+ *    `maxSuspends`(默认 5)即终止任务而不再 park。
  *  · 客户端每请求 settings 折出来的层(`settings.permissions` 的 allow/deny/ask、模式派生的 fs-write
  *    ask 门、scratchpad 豁免……整类)park 时未持久化 ⇒ 重建不出。§2.3 已披露的残余,机制面有特征化钉
  *    (test/parked-revive-e2e.test.ts);真 settings→park→赎回的端到端钉未建(候件,随收口件一起)。
  */
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, approvalExemptionStore, logger, localRoot } = deps;
+    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
+    const mandate = mandatePostureOf(deps);
     return (row) => {
         // lane 分形与 resolve-spec 同一判别式(单一属主,取值处只此一个)。
         // 🔑 沙箱腿的 slot 键 = **row.sessionId**(子代自己的会话,design/181 §2.2 裁定):revive 后 core 以
@@ -101,11 +104,55 @@ export function createParkedReviveInheritedGate(deps) {
         // 治理段无可施加时 applyRuntimeGovernance 原样返回 base ⇒ 基线本身即为链(恒非 undefined,无需断言)。
         // shellGate 只在治理段真产出档位时出现在载体上(缺席 = 本次没有 live 值可交,core 用 seed 兜底)。
         return {
-            parentConstraints: [{ policy: governed.toolPolicy ?? baseline, durableMandate: true }],
+            parentConstraints: [
+                {
+                    policy: governed.toolPolicy ?? baseline,
+                    ...(approverSeat !== undefined ? { onAsk: approverSeat } : {}),
+                    ...mandate,
+                },
+            ],
             ...(governed.shellGate !== undefined ? { shellGate: governed.shellGate } : {}),
         };
     };
 }
+/**
+ * 重建条目的**决议链元数据**(core 5.22.0 F-012)—— 两位 mandate 的逐字重算。
+ *
+ * 为什么它承重:5.22.0 把 re-supply 契约从 count 换成 `cpv1:` 内容摘要
+ * (`constraintChainDigest`),而摘要 **把这两位卷了进去**。park 时那一层记的是什么,赎回腿就必须供
+ * 什么——供多了、供少了都是 `resume.parent_constraint_mismatch` 响亮拒(pre-CAS,checkpoint 留
+ * pending)。**不许**为了让摘要对上而回读 checkpoint 里记的那两位再原样回声:那等于把「重算出同一条链」
+ * 换成「抄一份自证」,摘要的防篡改语义当场归零。
+ *
+ * core 的原式(`prepare-task.js` 的 `inheritedGateForChildren`):
+ * ```
+ * durableMandate = runtimeCaps.forceDurableGate || (spec.durableApproval !== undefined && !isLiveApproverSeat(spec.onAsk      ?? deps.onAsk))
+ * contentMandate = runtimeCaps.forceDurableGate || (spec.durableApproval !== undefined && !isLiveQuestionFace(spec.onQuestion ?? deps.onQuestion))
+ * ```
+ * 本仓三项对位:
+ *  · `spec.durableApproval !== undefined` —— 本工厂**只在** `config.durableApproval` 为真时构造
+ *    (main.ts 的构造条件逐字),故这一项在本函数射程内恒成立;
+ *  · 审批席 = `spec.onAsk ?? deps.onAsk` 的**在场性**。本仓两个装配点(deps 级
+ *    `createRunnerDepsOnAsk`、per-task 级 `routes/tasks.ts` 的 `boundAsk`)受**同一个**条件闸
+ *    ——`toolApproval` 协调器在不在场——所以这个布尔在两位上恒等,`approverSeat` 在不在场即判据。
+ *    ⚠️ 判据是**在场性**不是同一只闭包:身份不同不影响摘要(全文见 {@link ParkedReviveGateDeps.approverSeat});
+ *  · 问答席 = resolve-spec 的 `liveQuestionFace`:在场 ⇒ spec 不 stamp sentinel、`deps.onQuestion` 的
+ *    协调器生效(`isLiveQuestionFace` 判 true);缺席 ⇒ spec stamp `QUESTION_AWAITS_RESUME`
+ *    (该 sentinel 被 `isLiveQuestionFace` 判 false)。两支都归结为 `question` 在不在场。
+ *
+ * ⛔ **已披露残余(fail-closed 且响亮,不是静默放行)**:`runtimeCaps.forceDurableGate`(center 逐
+ * principal 的授权位)在本装配点解不出来 —— core 的 `runtimeCapsResolver` 是 async 且按 principal 现解,
+ * 而重供席位的形是同步 `(row) => gate`。该位为真、且部署又装了活体席的组合上,park 记 true 而本腿供
+ * false ⇒ core pre-CAS 响亮拒、checkpoint 留 pending(带 `parked_resume.startup_failed` 码可观测),
+ * 绝不会让赎回腿在比挂起时更松的链下跑起来。收口件二选一:core 把该位一起持久进链条目,或重供席位改
+ * async 让 resolver 进得来。
+ */
+function mandatePostureOf(deps) {
+    return {
+        ...(deps.approverSeat === undefined ? { durableMandate: true } : {}),
+        ...(deps.question === undefined ? { contentMandate: true } : {}),
+    };
+}
 /** host 腿的裁决 env(真 fs;构造是纯字段赋值,不 spawn)。**每次赎回现铸**——与「禁 memoize」同因:
  *  cwd 占位读的是活 config 的 `localDataRoot`。 */
 function createHostAdjudicationEnv(config, localRoot) {

package/dist/boot/reapers.js

@@ -244,12 +244,12 @@ export function startReapers(ctx) {
             .then(reapCount("runs_reaped_total", { kind: "stale" }))
             .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError);
         // Durable F4 (design/45) + design/80 §3 inv#3 crash-safe backstop: CAS-expire checkpoints past their
-        // deadline OR their absolute terminal_at backstop (≈ deny), then fail the suspended run rows whose
+        // deadline OR their absolute terminal_at_ms backstop (≈ deny), then fail the suspended run rows whose
         // checkpoint was thereby expired (release task_active = unlock the session). These run EVERY tick,
-        // REGARDLESS of APPROVAL_TIMEOUT_SEC — terminal_at (stamped at put, never before an explicit deadline)
+        // REGARDLESS of APPROVAL_TIMEOUT_SEC — terminal_at_ms (stamped at put, never before an explicit deadline)
         // bounds even a NULL-deadline pending checkpoint, so the backstop is the always-on safety net (it was
         // inert when nested under the approvalTimeoutSec>0 guard — adversarial finding). The run-row half is
-        // checkpoint-STATE-driven (not a uniform timer) so it aligns with the per-row terminal_at. Global +
+        // checkpoint-STATE-driven (not a uniform timer) so it aligns with the per-row terminal_at_ms. Global +
         // idempotent across replicas, no election.
         if (checkpointStore) {
             // 轴A #5 注释落档(1.254):core CheckpointStore.reap 契约把弃置臂的 unpin 义务派给部署 reaper——

package/dist/boot/runner-deps.d.ts

@@ -75,10 +75,18 @@ export interface RunnerDepsCtx {
      *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
      *  subRunner=子代平面绕过目录判决。 */
     orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores`)。在场即挂载
+     *  `memory_list`/`memory_read` 两只工具(core 没有 TaskSpec 伴生旋钮:dep 的在场**就是**部署意图);
+     *  缺席 ⇒ 两只都不挂,连占位都没有。装配点按「SQL 供给面 ∧ org 折叠面」双在场才铸它,与 HTTP 面
+     *  同一个合取式(main.ts)。 */
+    sharedMemoryStores: RunnerDeps["sharedMemoryStores"];
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
     fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
+     *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleSuggestions` 不铸(诚实缺席)。 */
+    permissionRuleStore: RunnerDeps["permissionRuleStore"];
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
@@ -94,7 +102,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -123,7 +131,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore" | "orgMemoryAdmission">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores">;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -66,11 +66,16 @@ export function createSharedRunnerDeps(ctx) {
         // 构造(boot/stores.ts),两键同真同假。
         usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
         usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
+        // design/177 —— 必须进**共享基座**(codex 复审轮3 真缺口):它原先只挂在主 runnerDeps 上,于是
+        // 委托子代静默没有 memory_list/memory_read,而能力面与 HTTP 面照样宣布共享库可用 —— 正是 [1543]§三族A
+        // 「主 runner 挂了、subRunner 漏挂」那个病族。授权按 per-request principal 折叠(子代同宿主身份),
+        // 所以共享同一个 provider 实例既正确又是唯一能让两只 Runner 看到同一份库集合的做法。
+        sharedMemoryStores: ctx.sharedMemoryStores ? ctx.sharedMemoryStores : undefined,
     };
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileSnapshotStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileSnapshotStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
     // design/158 A10 留档发现②:共享基座——见 createSharedRunnerDeps 头注(main.ts 的第二处展开是
     // 并行车道待办,未在本次改动内接线)。
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
@@ -242,6 +247,9 @@ export function createRunnerDeps(ctx) {
         // memory dir). Absent (multi-tenant / MEMORY_ENGINE=off) ⇒ no deps.memoryBackend ⇒ memory dark.
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
         memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
+        // (sharedMemoryStores 由共享基座展开携带 —— 主/sub 两只 Runner 同源,见 createSharedRunnerDeps。
+        //  它与 `memoryBackend` **正交且完全不桥接**:那条是本地记忆链(注入索引 + 文件投影 + harvest,
+        //  有写路径),这条是纯文档只读面,共享内容永不进注入块/索引、永不落模型可写盘、永不被 harvest。)
         // S3-TOB 复审 F-9(operator 可观测底座):harvest 报告 → metrics(拒收/incident/patch 计数从此可见;
         // core swallow-guard 保证 throwing consumer 不伤边界)。
         onMemoryHarvestReport: memoryEngine
@@ -264,6 +272,9 @@ export function createRunnerDeps(ctx) {
         // E19: working-tree snapshot/restore for rewind (+ the 2c artifact store). core snapshots each completed turn +
         // restores on resumeAt when spec.rewindFiles is set, for ANY env when this store is wired (gate-split 1.134.0).
         fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        // #154 车二(core 5.18.0 design/179):持久化权限规则店 —— 引擎据它铸 `AskRequest.ruleSuggestions`
+        // 并把 `permissionRules.storeWired` 报成真。缺席=诚实缺席(零候选、storeWired:false),绝不占位。
+        permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         // (executionEnvFactory/lspManager already carried by the shared-base spread above.)
         // design/129-B (core 1.240.0): the PROCESS-LEVEL background-child observer — spawn/tick/terminal
         // for every bg delegation child, never dying with a leg. Feeds the fleet rows (launch 即有行, session-scoped

package/dist/capabilities/repo-tools.d.ts

@@ -13,8 +13,42 @@ export interface RepoCoords {
 }
 /** Parse `owner/name` or a repo URL (e.g. https://git.example.com/some-org/some-repo.git). */
 export declare function parseRepo(input: string): RepoCoords;
+import type { GitApiKind } from "../git-api-kind.js";
+export { GIT_API_KINDS, isGitApiKind, type GitApiKind } from "../git-api-kind.js";
+/** The read-only surface the repo tools are built over — one implementation per Git-host dialect. */
+export interface RepoReadClient {
+    defaultBranch(coords: RepoCoords): Promise<string>;
+    tree(coords: RepoCoords, ref: string): Promise<string[]>;
+    readFile(coords: RepoCoords, path: string, ref: string): Promise<string>;
+    pullDiff(coords: RepoCoords, index: number): Promise<string>;
+}
+export declare function createRepoClient(kind: GitApiKind, baseUrl: string, token?: string, fetchImpl?: typeof fetch): RepoReadClient;
 /** Thin read-only Gitea API client. Built once at startup; bound to a repo per task. */
-export declare class GiteaClient {
+export declare class GiteaClient implements RepoReadClient {
+    private readonly baseUrl;
+    private readonly token?;
+    private readonly fetchImpl;
+    constructor(baseUrl: string, token?: string | undefined, fetchImpl?: typeof fetch);
+    private api;
+    defaultBranch({ owner, repo }: RepoCoords): Promise<string>;
+    tree(coords: RepoCoords, ref: string): Promise<string[]>;
+    readFile(coords: RepoCoords, path: string, ref: string): Promise<string>;
+    pullDiff(coords: RepoCoords, index: number): Promise<string>;
+}
+/**
+ * Thin read-only GitHub (github.com / GHE) API client — same four-call surface as `GiteaClient`.
+ *
+ * Dialect differences (each one is why `GiteaClient` alone 404s against GitHub):
+ *  - base URL is the API root itself (`https://api.github.com`, GHE `https://ghe.example/api/v3`) —
+ *    no `/api/v1` prefix is appended;
+ *  - auth is `Authorization: Bearer <token>` (Gitea uses `token <token>`);
+ *  - a PR's unified diff comes from `/pulls/{n}` via `Accept: application/vnd.github.v3.diff`
+ *    (Gitea uses a `.diff` URL suffix);
+ *  - the tree API has no `per_page` cap — GitHub returns up to its own limit and reports overflow via
+ *    `truncated`; we additionally cap client-side at MAX_TREE_ENTRIES so the model-facing bound is the
+ *    same for both dialects.
+ */
+export declare class GitHubClient implements RepoReadClient {
     private readonly baseUrl;
     private readonly token?;
     private readonly fetchImpl;
@@ -26,5 +60,5 @@ export declare class GiteaClient {
     pullDiff(coords: RepoCoords, index: number): Promise<string>;
 }
 /** Build the read-only repo tool set bound to one repo (cheap per-task closure; the client is shared). */
-export declare function repoToolsFor(client: GiteaClient, coords: RepoCoords): ToolSpec[];
+export declare function repoToolsFor(client: RepoReadClient, coords: RepoCoords): ToolSpec[];
 //# sourceMappingURL=repo-tools.d.ts.map

package/dist/capabilities/repo-tools.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { z } from "zod";
 /** Parse `owner/name` or a repo URL (e.g. https://git.example.com/some-org/some-repo.git). */
 export function parseRepo(input) {
     const s = input.trim().replace(/\.git$/, "");
@@ -13,6 +14,43 @@ const MAX_FILE_BYTES = 96 * 1024;
 const MAX_TREE_ENTRIES = 2000;
 /** Bound each Git-host call so a slow/hung host can't pin a review lens to its whole deadline. */
 const REQUEST_TIMEOUT_MS = 15_000;
+export { GIT_API_KINDS, isGitApiKind } from "../git-api-kind.js";
+/** Wire schemas for the Git-host responses we consume (both dialects share these shapes — Gitea copied
+ *  GitHub's). Boundary discipline(宪法 [2704] §2):no bare `as` on `.json()`. */
+const RepoInfoWire = z.looseObject({ default_branch: z.string().optional() });
+const TreeWire = z.looseObject({
+    tree: z.array(z.looseObject({ path: z.string(), type: z.string() })).optional(),
+    truncated: z.boolean().optional(),
+});
+const ContentsWire = z.looseObject({
+    content: z.string().optional().nullable(),
+    encoding: z.string().optional(),
+    type: z.string().optional(),
+});
+const PullMetaWire = z.looseObject({ changed_files: z.number().optional() });
+/** Shared guard: `encodeURIComponent` does NOT escape "." — a `..` segment survives the per-segment
+ *  encode and the WHATWG URL parser collapses it when `fetch` builds the request, letting a crafted
+ *  `path` climb out of `/repos/<owner>/<repo>/contents/` to any endpoint the read token can reach.
+ *  The tools are contractually bound to exactly one repo, so reject traversal before it hits fetch. */
+function pathSegmentsRejectingTraversal(path) {
+    const segments = path.split("/").filter(Boolean);
+    if (segments.some((s) => s === "..")) {
+        throw new Error(`invalid path "${path}" (".." segments are not allowed)`);
+    }
+    return segments;
+}
+export function createRepoClient(kind, baseUrl, token, fetchImpl = fetch) {
+    switch (kind) {
+        case "gitea":
+            return new GiteaClient(baseUrl, token, fetchImpl);
+        case "github":
+            return new GitHubClient(baseUrl, token, fetchImpl);
+        default: {
+            const never = kind;
+            throw new Error(`unknown gitApiKind ${String(never)}`);
+        }
+    }
+}
 /** Thin read-only Gitea API client. Built once at startup; bound to a repo per task. */
 export class GiteaClient {
     baseUrl;
@@ -36,12 +74,12 @@ export class GiteaClient {
         return res;
     }
     async defaultBranch({ owner, repo }) {
-        const info = (await (await this.api(`/repos/${owner}/${repo}`)).json());
+        const info = RepoInfoWire.parse(await (await this.api(`/repos/${owner}/${repo}`)).json());
         return info.default_branch || "main";
     }
     async tree(coords, ref) {
         const { owner, repo } = coords;
-        const body = (await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=true&per_page=${MAX_TREE_ENTRIES}`)).json());
+        const body = TreeWire.parse(await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=true&per_page=${MAX_TREE_ENTRIES}`)).json());
         const paths = (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
         // The upstream API caps the listing at `per_page` and reports the overflow via `truncated` — it does
         // not report how many entries were left out. Surface that (same disclosure-marker family as
@@ -52,15 +90,8 @@ export class GiteaClient {
     }
     async readFile(coords, path, ref) {
         const { owner, repo } = coords;
-        // `encodeURIComponent` does NOT escape "." — so a `..` segment survives the per-segment encode and the
-        // WHATWG URL parser collapses it when `fetch` builds the request, letting a crafted `path` climb out of
-        // `/repos/<owner>/<repo>/contents/` to any endpoint the read token can reach (cross-repo / admin). The
-        // tools are contractually bound to exactly one repo (see header), so reject traversal before it hits fetch.
-        const segments = path.split("/").filter(Boolean);
-        if (segments.some((s) => s === "..")) {
-            throw new Error(`invalid path "${path}" (".." segments are not allowed)`);
-        }
-        const body = (await (await this.api(`/repos/${owner}/${repo}/contents/${segments.map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`)).json());
+        const segments = pathSegmentsRejectingTraversal(path);
+        const body = ContentsWire.parse(await (await this.api(`/repos/${owner}/${repo}/contents/${segments.map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`)).json());
         if (body.type !== "file" || body.content == null)
             throw new Error(`not a file: ${path}`);
         const text = body.encoding === "base64" ? Buffer.from(body.content, "base64").toString("utf8") : body.content;
@@ -75,6 +106,89 @@ export class GiteaClient {
         return text.length > MAX_FILE_BYTES * 4 ? text.slice(0, MAX_FILE_BYTES * 4) + "\n…[diff truncated]" : text;
     }
 }
+/**
+ * Thin read-only GitHub (github.com / GHE) API client — same four-call surface as `GiteaClient`.
+ *
+ * Dialect differences (each one is why `GiteaClient` alone 404s against GitHub):
+ *  - base URL is the API root itself (`https://api.github.com`, GHE `https://ghe.example/api/v3`) —
+ *    no `/api/v1` prefix is appended;
+ *  - auth is `Authorization: Bearer <token>` (Gitea uses `token <token>`);
+ *  - a PR's unified diff comes from `/pulls/{n}` via `Accept: application/vnd.github.v3.diff`
+ *    (Gitea uses a `.diff` URL suffix);
+ *  - the tree API has no `per_page` cap — GitHub returns up to its own limit and reports overflow via
+ *    `truncated`; we additionally cap client-side at MAX_TREE_ENTRIES so the model-facing bound is the
+ *    same for both dialects.
+ */
+export class GitHubClient {
+    baseUrl;
+    token;
+    fetchImpl;
+    constructor(baseUrl, token, fetchImpl = fetch) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+        this.fetchImpl = fetchImpl;
+    }
+    async api(path, accept = "application/vnd.github+json") {
+        const headers = { accept, "x-github-api-version": "2022-11-28" };
+        if (this.token)
+            headers.authorization = `Bearer ${this.token}`;
+        const res = await this.fetchImpl(`${this.baseUrl.replace(/\/+$/, "")}${path}`, {
+            headers,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            throw new Error(`git api ${path} → HTTP ${res.status}`);
+        return res;
+    }
+    async defaultBranch({ owner, repo }) {
+        const info = RepoInfoWire.parse(await (await this.api(`/repos/${owner}/${repo}`)).json());
+        return info.default_branch || "main";
+    }
+    async tree(coords, ref) {
+        const { owner, repo } = coords;
+        const body = TreeWire.parse(await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`)).json());
+        const paths = (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
+        // Same disclosure-marker family as GiteaClient.tree: a capped listing must never read as the whole
+        // repo. Two cap sources here — upstream `truncated`, and our own client-side MAX_TREE_ENTRIES bound.
+        if (paths.length > MAX_TREE_ENTRIES) {
+            return [...paths.slice(0, MAX_TREE_ENTRIES), `…[truncated, tree has more than ${MAX_TREE_ENTRIES} entries]`];
+        }
+        return body.truncated
+            ? [...paths, `…[truncated, tree has more than ${MAX_TREE_ENTRIES} entries]`]
+            : paths;
+    }
+    async readFile(coords, path, ref) {
+        const { owner, repo } = coords;
+        const segments = pathSegmentsRejectingTraversal(path);
+        const body = ContentsWire.parse(await (await this.api(`/repos/${owner}/${repo}/contents/${segments.map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`)).json());
+        if (body.type !== "file" || body.content == null)
+            throw new Error(`not a file: ${path}`);
+        // GitHub 文档行为(codex F1 定谳):1–100 MB 文件走对象形返回 `content:"", encoding:"none"` ——
+        // content 非 null 过上面的门,非 base64 臂又会把空串当正文交出 = 「大文件被当空文件评审」的静默
+        // 完整性失败。显式臂响亮拒(本工具本地帽 96 KiB,>1 MB 内容也装不下,拒绝即诚实)。
+        if (body.encoding === "none") {
+            throw new Error(`file too large for the contents API: ${path} (GitHub returns encoding:"none" for files over 1 MB — this read tool cannot fetch it; review it via the PR diff or skip it)`);
+        }
+        const text = body.encoding === "base64" ? Buffer.from(body.content, "base64").toString("utf8") : body.content;
+        return text.length > MAX_FILE_BYTES
+            ? text.slice(0, MAX_FILE_BYTES) + `\n…[truncated, ${text.length - MAX_FILE_BYTES} more bytes]`
+            : text;
+    }
+    async pullDiff(coords, index) {
+        const { owner, repo } = coords;
+        // GitHub 在服务端静默截断 PR diff(300 文件 / 1 MB / 20k 行,文档行为;codex F2 定谳)——被截的
+        // 响应可能远小于本地帽,靠字节数判不出来。先取 PR 元数据拿 changed_files,与 diff 里实际出现的
+        // 文件数对账,少了就显式披露(上游截断与本地帽是两种截断,分开标)。
+        const meta = PullMetaWire.parse(await (await this.api(`/repos/${owner}/${repo}/pulls/${index}`)).json());
+        const res = await this.api(`/repos/${owner}/${repo}/pulls/${index}`, "application/vnd.github.v3.diff");
+        let text = await res.text();
+        const filesInDiff = (text.match(/^diff --git /gm) ?? []).length;
+        if (typeof meta.changed_files === "number" && filesInDiff < meta.changed_files) {
+            text += `\n…[upstream truncated: this diff covers ${filesInDiff} of ${meta.changed_files} changed files — GitHub caps PR diffs (300 files / 1 MB); review the remaining files individually]`;
+        }
+        return text.length > MAX_FILE_BYTES * 4 ? text.slice(0, MAX_FILE_BYTES * 4) + "\n…[diff truncated]" : text;
+    }
+}
 /** Build the read-only repo tool set bound to one repo (cheap per-task closure; the client is shared). */
 export function repoToolsFor(client, coords) {
     const ref = (r) => (r ? Promise.resolve(r) : client.defaultBranch(coords));

package/dist/capabilities/scenarios.d.ts

@@ -1,7 +1,7 @@
 import { type WebFetchConfig, type BackgroundAgentStore, type CheckpointStore, type PromptProvider, type Runner, type SkillSpec, type SubagentSpawnContext, type ToolSpec, type WebSearchConfig } from "@sema-agent/core";
 import type { Metrics } from "../observability/metrics.js";
 import type { Logger } from "../observability/logger.js";
-import { GiteaClient } from "./repo-tools.js";
+import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
 /**
@@ -46,7 +46,7 @@ export interface ScenarioDeps {
     handslessSubRunner: Runner;
     model: string;
     skills: LoadedSkill[];
-    repoClient?: GiteaClient;
+    repoClient?: RepoReadClient;
     /** Multi-tenant deployment (REQUIRE_PRINCIPAL). Gates the full-body `WebFetch` tool out of the
      *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/malicious tenant model
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */

package/dist/capabilities/scenarios.js

@@ -1,7 +1,7 @@
 import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError } from "../security.js";
 import { nowTool } from "./builtin-tools.js";
-import { GiteaClient, parseRepo, repoToolsFor } from "./repo-tools.js";
+import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { createCouncilTool, clampRounds } from "./code-review-council.js";
 import { stablePrompt } from "./prompt.js";
 import { createTeamTool, teamCoordinatorPrompt, getTeam, teamNames } from "./team.js";