@sema-agent/server 7.93.6 → 7.94.0

package/dist/plugins/store-contracts.js

@@ -1,4 +1,3 @@
-import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
 export class StoreBootRefusalError extends Error {
 }
 export const RUN_STATUS_CLASS = {
@@ -36,63 +35,4 @@ export function sessionTempoOfRunStatus(lastStatus) {
 export function runProvenElsewhere(run, thisInstanceId) {
     return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
 }
-export function mapBakeRow(r) {
-    return {
-        bakeId: r.bake_id,
-        profile: r.profile,
-        bands: r.bands == null ? null : parseJsonOr(r.bands, []),
-        baseRef: r.base_ref,
-        push: !!r.push,
-        dryRun: !!r.dry_run,
-        logs: !!r.logs,
-        argv: parseJsonOr(r.argv, []),
-        status: r.status,
-        state: r.state ?? null,
-        digest: r.digest,
-        repo: r.repo,
-        ref: r.ref,
-        indexId: r.index_id,
-        exitCode: r.exit_code === null ? null : Number(r.exit_code),
-        error: r.error,
-        errorCode: r.error_code ?? null,
-        manifestSha: r.manifest_sha,
-        tag: r.tag,
-        idemKey: r.idem_key,
-        ingestSecret: r.ingest_secret,
-        runnerId: r.runner_id,
-        leaseUntil: isoOrNull(r.lease_until),
-        cancelRequested: !!r.cancel_requested,
-        requestedBy: r.requested_by,
-        createdAt: iso(r.created_at),
-        updatedAt: iso(r.updated_at),
-    };
-}
-export const BAKE_SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
-    "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
-    "cancel_requested, requested_by, created_at, updated_at";
-export function mapImageRow(r) {
-    return {
-        id: r.id,
-        profile: r.profile,
-        bands: parseJsonOr(r.bands, []),
-        repo: r.repo,
-        tag: r.tag,
-        digest: r.digest,
-        toolchainVersions: parseJsonOr(r.toolchain_versions, {}),
-        capabilities: parseJsonOr(r.capabilities, {}),
-        podContract: parseJsonOr(r.pod_contract, {}),
-        sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
-        status: r.status,
-        visibility: r.visibility,
-        tenantId: r.tenant_id,
-        manifestSha: r.manifest_sha,
-        recipeGitSha: r.recipe_git_sha,
-        generatorVersion: r.generator_version,
-        buildDate: isoOrNull(r.build_date),
-        supersedes: r.supersedes,
-        signed: !!r.signed,
-        createdAt: isoOrNull(r.created_at) ?? new Date(0).toISOString(),
-        updatedAt: isoOrNull(r.updated_at) ?? new Date(0).toISOString(),
-    };
-}
 //# sourceMappingURL=store-contracts.js.map

package/dist/plugins/task-attachment-store.d.ts

@@ -24,21 +24,30 @@
  *  - 绑定:`bind` 把行钉到 sessionId(重复绑定=改绑,同 owner 内 last-wins;同 session 多 task 共享
  *    自然成立——listBySession 是物化输入)。未绑定行 = 上传后从未被任何 task 引用 ⇒ reapUnbound(TTL)。
  */
+import { z } from "zod";
 import type { Pool } from "mysql2/promise";
 import type { PgQueryFn } from "./pg-query.js";
 import { type IndexSpec } from "./ensure-index.js";
-export interface TaskAttachmentRecord {
-    id: string;
-    owner: string;
-    /** 消毒后的 basename(http 面用 core sanitizePathComponent 处理;store 只存不再消毒)。 */
-    name: string;
-    mime: string;
-    sha256: string;
-    sizeBytes: number;
-    createdAtMs: number;
-    sessionId?: string;
-    boundAtMs?: number;
-}
+/**
+ * 一条附件 meta 的**形属主**(整仓唯一那份键集)。
+ *
+ * 🔴 为什么是一只 schema 而不只是一个 interface(S-550 车③b):SQL 车道把这些字段拆成**标量列**,
+ * 形由 DDL 管;local 车道把整条记录**序列化成一个 JSON 档**(`attachments/<id>.json`),于是它需要一个
+ * 运行期的形判据 —— 而那个判据必须与这里的键集是**同一份**(第二份键集分叉的那天 = 「写得进、读不出」)。
+ * 所以类型从 schema 推导({@link TaskAttachmentRecord}),两者按构造不可能漂。
+ */
+export declare const TaskAttachmentRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    owner: z.ZodString;
+    name: z.ZodString;
+    mime: z.ZodString;
+    sha256: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    createdAtMs: z.ZodNumber;
+    sessionId: z.ZodOptional<z.ZodString>;
+    boundAtMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type TaskAttachmentRecord = z.infer<typeof TaskAttachmentRecordSchema>;
 export interface TaskAttachmentStore {
     put(rec: TaskAttachmentRecord & {
         content: Uint8Array;

package/dist/plugins/task-attachment-store.js

@@ -1,4 +1,16 @@
+import { z } from "zod";
 import { ensureIndexes } from "./ensure-index.js";
+export const TaskAttachmentRecordSchema = z.object({
+    id: z.string(),
+    owner: z.string(),
+    name: z.string(),
+    mime: z.string(),
+    sha256: z.string(),
+    sizeBytes: z.number(),
+    createdAtMs: z.number(),
+    sessionId: z.string().optional(),
+    boundAtMs: z.number().optional(),
+});
 export const TASK_ATTACHMENT_TABLE = "task_attachment";
 export function materializedRelPaths(atts) {
     const used = new Set();

package/dist/plugins/tidb-session-storage.d.ts

@@ -1,8 +1,8 @@
 import { BaseSessionStorage, type PromptEpochDescriptor, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 export declare const SESSION_EVENT_LATEST_BY_TYPE_SQL: {
-    readonly floor: "SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ payload FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1";
-    readonly epochAnchor: "SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ seq, payload FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100";
+    readonly floor: `SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ ${string} FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`;
+    readonly epochAnchor: `SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ seq, ${string} FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`;
 };
 /**
  * TiDB-backed {@link BaseSessionStorage} — the durable L1 event log for one session.

package/dist/plugins/tidb-session-storage.js

@@ -3,10 +3,12 @@ import { BaseSessionStorage, SessionError, leafIdAfterEntry, normalizePromptEpoc
 import { toIso } from "./sql-row-helpers.js";
 import { isMysqlDupKeyError } from "./sql-errors.js";
 import { PLACEMENT_SELECT_COLUMNS, placementFromRow } from "./session-placement.js";
+import { decodeSessionEventPayload } from "./session-event-payload.js";
+import { jsonColumnText } from "./sql-json-column.js";
 const SESSION_EVENT_BY_TYPE_HINT = "/*+ USE_INDEX(session_event, idx_session_event_type) */";
 export const SESSION_EVENT_LATEST_BY_TYPE_SQL = {
-    floor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} payload FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`,
-    epochAnchor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} seq, payload FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`,
+    floor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`,
+    epochAnchor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`,
 };
 const isDupKey = isMysqlDupKeyError;
 export class TiDBSessionStorage extends BaseSessionStorage {
@@ -28,7 +30,7 @@ export class TiDBSessionStorage extends BaseSessionStorage {
             if (rows.length === 0)
                 return undefined;
             for (const r of rows) {
-                const e = (typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload);
+                const e = decodeSessionEventPayload(r.payload, this.sessionId, r.seq);
                 const d = e.type === "prompt_epoch" ? normalizePromptEpoch(e) : normalizePromptEpoch(e.details?.promptEpoch);
                 if (d)
                     return d;
@@ -42,8 +44,8 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         if (!meta)
             return null;
         const { floorEntryId, floorSeq } = await TiDBSessionStorage.computeFloor(pool, sessionId);
-        const [eventRows] = await pool.query("SELECT payload FROM session_event WHERE session_id = ? AND seq >= ? ORDER BY seq ASC", [sessionId, floorSeq]);
-        const entries = eventRows.map((r) => typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload);
+        const [eventRows] = await pool.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND seq >= ? ORDER BY seq ASC`, [sessionId, floorSeq]);
+        const entries = eventRows.map((r) => decodeSessionEventPayload(r.payload, sessionId, r.seq));
         const placement = placementFromRow(meta);
         const metadata = { id: sessionId, createdAt: toIso(meta.created_at), ...(placement !== undefined ? { placement } : {}) };
         return new TiDBSessionStorage(pool, sessionId, metadata, entries, meta.leaf_id ?? null, floorEntryId, floorSeq);
@@ -52,8 +54,8 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         const [compRows] = await pool.query(SESSION_EVENT_LATEST_BY_TYPE_SQL.floor, [sessionId]);
         if (!compRows[0])
             return { floorEntryId: null, floorSeq: 0 };
-        const comp = (typeof compRows[0].payload === "string" ? JSON.parse(compRows[0].payload) : compRows[0].payload);
-        const fk = comp.firstKeptEntryId;
+        const comp = decodeSessionEventPayload(compRows[0].payload, sessionId, "latest compaction");
+        const fk = comp.type === "compaction" ? comp.firstKeptEntryId : undefined;
         if (!fk)
             return { floorEntryId: null, floorSeq: 0 };
         const [seqRows] = await pool.query("SELECT seq FROM session_event WHERE session_id = ? AND entry_id = ?", [sessionId, fk]);
@@ -65,11 +67,10 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         const inMem = await super.getEntry(id);
         if (inMem)
             return inMem;
-        const [rows] = await this.pool.query("SELECT payload FROM session_event WHERE session_id = ? AND entry_id = ?", [this.sessionId, id]);
-        const p = rows[0]?.payload;
-        if (p == null)
+        const [rows] = await this.pool.query(`SELECT ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND entry_id = ?`, [this.sessionId, id]);
+        if (rows[0] === undefined)
             return undefined;
-        return (typeof p === "string" ? JSON.parse(p) : p);
+        return decodeSessionEventPayload(rows[0].payload, this.sessionId, id);
     }
     async appendEntry(entry, opts) {
         await this.persist(entry, opts);

package/dist/plugins/tidb-session-store.d.ts

@@ -155,8 +155,8 @@ export declare class TiDBSessionStore implements SessionStore {
      *
      * Resolves to `null` (NOT an empty async-iterable) when the session does not exist — checked via `session_meta`
      * EAGERLY here (before returning the iterable), exactly like {@link exportEntries}, so a missing session is distinct
-     * from a real-but-empty one (an empty stream). payload is parsed like {@link exportEntries} (string → JSON.parse,
-     * object passthrough). The check is eager (the method is async) because a generator body is lazy — it can't decide
+     * from a real-but-empty one (an empty stream). payload is decoded like {@link exportEntries}
+     * (按文本投影 + `decodeSessionEventPayload` 恰好解一次码,坏体当场拒). The check is eager (the method is async) because a generator body is lazy — it can't decide
      * `null` vs. iterable on its own first pull.
      */
     exportEntriesStream(sessionId: string, opts?: {

package/dist/plugins/tidb-session-store.js

@@ -1,5 +1,7 @@
 import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
+import { decodeSessionEventPayload } from "./session-event-payload.js";
+import { jsonColumnText } from "./sql-json-column.js";
 import { escapeLike } from "./sql-escape.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
@@ -186,7 +188,7 @@ export class TiDBSessionStore {
         if (!metaRows[0])
             return null;
         const leafId = metaRows[0].leaf_id ?? null;
-        const [eventRows] = await this.pool.query("SELECT entry_id, parent_id, type, payload, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC", [sourceId]);
+        const [eventRows] = await this.pool.query(`SELECT entry_id, parent_id, type, ${jsonColumnText("tidb", "payload")}, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [sourceId]);
         const newId = uuidv7();
         const now = new Date();
         const conn = await this.pool.getConnection();
@@ -194,7 +196,7 @@ export class TiDBSessionStore {
             await conn.beginTransaction();
             for (let seq = 0; seq < eventRows.length; seq++) {
                 const r = eventRows[seq];
-                const payload = typeof r.payload === "string" ? r.payload : JSON.stringify(r.payload);
+                const payload = String(r.payload);
                 await conn.query("INSERT INTO session_event (session_id, seq, entry_id, parent_id, type, payload, ts) VALUES (?,?,?,?,?,?,?)", [newId, seq, r.entry_id, r.parent_id ?? null, r.type, payload, r.ts]);
             }
             await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq) VALUES (?,?,?,?,?,?)", [newId, owner, now, now, leafId, eventRows.length]);
@@ -217,8 +219,8 @@ export class TiDBSessionStore {
         const [metaRows] = await this.pool.query("SELECT 1 FROM session_meta WHERE session_id = ?", [sessionId]);
         if (!metaRows[0])
             return null;
-        const [eventRows] = await this.pool.query("SELECT entry_id, parent_id, type, payload, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC", [sessionId]);
-        return eventRows.map((r) => (typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload));
+        const [eventRows] = await this.pool.query(`SELECT seq, entry_id, parent_id, type, ${jsonColumnText("tidb", "payload")}, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [sessionId]);
+        return eventRows.map((r) => decodeSessionEventPayload(r.payload, sessionId, r.seq));
     }
     async listEntryIds(sessionId) {
         const [metaRows] = await this.pool.query("SELECT 1 FROM session_meta WHERE session_id = ?", [sessionId]);
@@ -236,11 +238,9 @@ export class TiDBSessionStore {
         async function* gen() {
             let cursor = opts?.afterSeq ?? -1;
             for (;;) {
-                const [rows] = await pool.query("SELECT seq, payload FROM session_event WHERE session_id = ? AND seq > ? ORDER BY seq ASC LIMIT ?", [sessionId, cursor, batchSize]);
-                for (const r of rows) {
-                    const p = r.payload;
-                    yield (typeof p === "string" ? JSON.parse(p) : p);
-                }
+                const [rows] = await pool.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND seq > ? ORDER BY seq ASC LIMIT ?`, [sessionId, cursor, batchSize]);
+                for (const r of rows)
+                    yield decodeSessionEventPayload(r.payload, sessionId, r.seq);
                 if (rows.length < batchSize)
                     return;
                 cursor = Number(rows[rows.length - 1].seq);
@@ -321,8 +321,8 @@ export class TiDBSessionStore {
         }
     }
     async readStagedEntries(stagingId) {
-        const [rows] = await this.pool.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [stagingId]);
-        return rows.map((r) => (typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload));
+        const [rows] = await this.pool.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [stagingId]);
+        return rows.map((r) => decodeSessionEventPayload(r.payload, stagingId, r.seq));
     }
     async sweepStagingSessions() {
         const cutoff = new Date(Date.now() - STAGING_GC_GRACE_MS);
@@ -416,12 +416,13 @@ class TiDBStagingHandle {
                 throw new SyncConflictError(this.realSessionId, rel);
             }
             if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
-                const [dstFull] = await conn.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.realSessionId]);
-                const [stagedFull] = await conn.query("SELECT entry_id, payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.stagingId]);
-                const parseEntry = (p) => (typeof p === "string" ? JSON.parse(p) : p);
+                const [dstFull] = await conn.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [this.realSessionId]);
+                const [stagedFull] = await conn.query(`SELECT entry_id, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [this.stagingId]);
                 const dstSet = new Set(dstIds);
-                const dstEntries = dstFull.map((r) => parseEntry(r.payload));
-                const stagedShared = stagedFull.filter((r) => dstSet.has(String(r.entry_id))).map((r) => parseEntry(r.payload));
+                const dstEntries = dstFull.map((r) => decodeSessionEventPayload(r.payload, this.realSessionId, r.seq));
+                const stagedShared = stagedFull
+                    .filter((r) => dstSet.has(String(r.entry_id)))
+                    .map((r) => decodeSessionEventPayload(r.payload, this.stagingId, r.entry_id));
                 const diverged = fastForwardSharedContentDiverged(stagedShared, dstEntries);
                 if (diverged) {
                     await conn.rollback();
@@ -430,13 +431,10 @@ class TiDBStagingHandle {
             }
             await conn.query("DELETE FROM session_event WHERE session_id = ?", [this.realSessionId]);
             await conn.query("UPDATE session_event SET session_id = ? WHERE session_id = ?", [this.realSessionId, this.stagingId]);
-            const [lastRow] = await conn.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq DESC LIMIT 1", [this.realSessionId]);
+            const [lastRow] = await conn.query(`SELECT ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq DESC LIMIT 1`, [this.realSessionId]);
             let leafId = null;
-            if (lastRow[0]) {
-                const p = lastRow[0].payload;
-                const last = (typeof p === "string" ? JSON.parse(p) : p);
-                leafId = leafIdAfterEntry(last);
-            }
+            if (lastRow[0])
+                leafId = leafIdAfterEntry(decodeSessionEventPayload(lastRow[0].payload, this.realSessionId, "last staged row"));
             const now = new Date();
             await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq) VALUES (?,?,?,?,?,?) " +
                 "ON DUPLICATE KEY UPDATE owner = VALUES(owner), updated_at = VALUES(updated_at), leaf_id = VALUES(leaf_id), leaf_seq = VALUES(leaf_seq)", [this.realSessionId, owner, now, now, leafId, srcIds.length]);

package/dist/plugins/usage-window-store-sql.d.ts

@@ -25,8 +25,16 @@
  */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { UsageWindow, UsageWindowReading, UsageWindowStore } from "@sema-agent/core";
+import type { UsageWindow, UsageWindowReading, UsageWindowRecord, UsageWindowStore } from "@sema-agent/core";
+import { type JsonColumnShape } from "./sql-json-column.js";
 export declare const USAGE_WINDOW_TABLE = "usage_window";
+/**
+ * `usage_window.record` 的**形读者**(S-550 车③a:本店既有的那一份深度判据逐字搬进来,一个字没改判)。
+ *
+ * 判据深到内层元素:非数值 tokens 参与累加会得到 `"0oops"` ⇒ `exhausted:false` ⇒ **超额账户被判未耗尽**
+ * (与 core `FileUsageWindowStore` 的 validateSlots/validateBuckets 同轴)。
+ */
+export declare function readUsageWindowRecordBody(body: unknown): JsonColumnShape<UsageWindowRecord>;
 export declare function ensureTiDBUsageWindowSchema(pool: MySqlPool): Promise<void>;
 export declare function ensurePgUsageWindowSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
 export declare class TiDBUsageWindowStore implements UsageWindowStore {

package/dist/plugins/usage-window-store-sql.js

@@ -1,18 +1,32 @@
 import { EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord } from "@sema-agent/core";
+import { decodeJsonColumn, foldJsonColumn, jsonColumnText } from "./sql-json-column.js";
 export const USAGE_WINDOW_TABLE = "usage_window";
+class UsageRecordShapeProblem extends Error {
+}
+export function readUsageWindowRecordBody(body) {
+    try {
+        return { value: validateUsageWindowRecord(body) };
+    }
+    catch (e) {
+        if (e instanceof UsageRecordShapeProblem)
+            return { problem: e.message };
+        throw e;
+    }
+}
 function parseRecord(raw, key) {
-    let v;
     try {
-        v = JSON.parse(String(raw));
+        return decodeJsonColumn(raw, readUsageWindowRecordBody, `${USAGE_WINDOW_TABLE}.record for key "${key}"`);
     }
     catch (e) {
-        throw new Error(`usage_window record for key "${key}" is not valid JSON (${String(e)}) — refusing to mis-count a governance window`);
+        throw foldJsonColumn(e, (m) => new Error(`${m} — refusing to mis-count a governance window`));
     }
+}
+function validateUsageWindowRecord(v) {
     const r = v;
     if (typeof v !== "object" || v === null || !Array.isArray(r.slots) || !Array.isArray(r.buckets)) {
-        throw new Error(`usage_window record for key "${key}" has an invalid shape (expected {slots[],buckets[]}) — refusing to mis-count a governance window`);
+        throw new UsageRecordShapeProblem("expected {slots[],buckets[]}");
     }
-    const badShape = (detail) => new Error(`usage_window record for key "${key}" has an invalid shape (${detail}) — refusing to mis-count a governance window`);
+    const badShape = (detail) => new UsageRecordShapeProblem(detail);
     const finite = (x) => typeof x === "number" && Number.isFinite(x);
     const costKeys = (e) => {
         if (e.costMicroUsd !== undefined && (typeof e.costMicroUsd !== "number" || !Number.isSafeInteger(e.costMicroUsd) || e.costMicroUsd < 0)) {
@@ -70,7 +84,7 @@ export class TiDBUsageWindowStore {
         try {
             await c.beginTransaction();
             await c.query(`INSERT INTO ${USAGE_WINDOW_TABLE} (usage_key, record, updated_at_ms) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE usage_key = usage_key`, [key, JSON.stringify(EMPTY_USAGE_WINDOW_RECORD), at]);
-            const [rows] = (await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ? FOR UPDATE`, [key]));
+            const [rows] = (await c.query(`SELECT ${jsonColumnText("tidb", "record")} FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ? FOR UPDATE`, [key]));
             if (rows.length === 0) {
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
@@ -88,7 +102,7 @@ export class TiDBUsageWindowStore {
         }
     }
     async read(key, windows, now) {
-        const [rows] = (await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ?`, [key]));
+        const [rows] = (await this.pool.query(`SELECT ${jsonColumnText("tidb", "record")} FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ?`, [key]));
         const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
         return readUsageRecord(record, windows, now);
     }
@@ -107,7 +121,7 @@ export class PgUsageWindowStore {
                 JSON.stringify(EMPTY_USAGE_WINDOW_RECORD),
                 at,
             ]);
-            const { rows } = await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1 FOR UPDATE`, [key]);
+            const { rows } = await c.query(`SELECT ${jsonColumnText("pg", "record")} FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1 FOR UPDATE`, [key]);
             if (rows.length === 0) {
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
@@ -125,7 +139,7 @@ export class PgUsageWindowStore {
         }
     }
     async read(key, windows, now) {
-        const { rows } = await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1`, [key]);
+        const { rows } = await this.pool.query(`SELECT ${jsonColumnText("pg", "record")} FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1`, [key]);
         const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
         return readUsageRecord(record, windows, now);
     }

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,8 +1,17 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { assertJournalEntryFits } from "@sema-agent/core";
-import { journalEntryOfRow, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
+import { journalEntryOfBody, journalRowPayloadOf, readJournalRowBody } from "../orchestration/workflow-journal-entry.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { decodeJsonColumn, foldJsonColumn, jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
+function decodeJournalResult(cell, where) {
+    try {
+        return decodeJsonColumn(cell, readJournalRowBody, where);
+    }
+    catch (e) {
+        throw foldJsonColumn(e, (m) => new Error(`workflow journal: ${m} — refusing rather than replay a journal entry nobody can read`));
+    }
+}
 export class SqlWorkflowJournalStore {
     db;
     resumeClaimTtlMs;
@@ -21,8 +30,11 @@ export class SqlWorkflowJournalStore {
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);
     }
     async load(runId, scope) {
-        const { rows } = await this.db.query(this.q("SELECT call_key, result FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC", "SELECT call_key, result FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC"), [runId, scope]);
-        return rows.map((r) => journalEntryOfRow(String(r.call_key), String(r.result)));
+        const { rows } = await this.db.query(this.q(`SELECT call_key, ${jsonColumnText("tidb", "result")} FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC`, `SELECT call_key, ${jsonColumnText("pg", "result")} FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC`), [runId, scope]);
+        return rows.map((r) => {
+            const callKey = String(r.call_key);
+            return journalEntryOfBody(callKey, decodeJournalResult(r.result, `workflow_journal.result for run ${runId} entry ${callKey}`));
+        });
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;
@@ -31,7 +43,7 @@ export class SqlWorkflowJournalStore {
         const params = this.db.dialect === "tidb"
             ? [opts.maxResultBytes, runId, scope, opts.limit, opts.offset]
             : [runId, scope, opts.maxResultBytes, opts.limit, opts.offset];
-        const { rows } = await this.db.query(this.q("SELECT call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE result END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC LIMIT ? OFFSET ?", "SELECT call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE result END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC LIMIT $4 OFFSET $5"), params);
+        const { rows } = await this.db.query(this.q(`SELECT call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("tidb", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC LIMIT ? OFFSET ?`, `SELECT call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC LIMIT $4 OFFSET $5`), params);
         return rows.map((r) => ({ callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
     }
     async deleteByRun(runId) {

package/dist/run-local.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { buildDurableAbsenceNote, createCorruptReadSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -260,16 +261,7 @@ export async function runLocal(argv, deps = {}) {
         fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
             root,
             ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-            onCorruptRead: (info) => logger.warn("file_store_corrupt_read", {
-                path: info.path,
-                reason: info.reason,
-                ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
-                ...(info.principal !== undefined ? { principal: info.principal } : {}),
-                note: "a durable read was treated as ABSENT because the bytes were unreadable (never a plain ENOENT). " +
-                    "Consequence depends on which store read it: session-policy = this run lost its SUBTRACTIVE session-rule " +
-                    "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
-                    "rows; file-snapshot = a snapshot or scope read as missing. Inspect the named path before deciding.",
-            }),
+            onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "file_store_corrupt_read", buildDurableAbsenceNote("file-snapshot = a snapshot or scope read as missing")),
         }), config.storeLockWaitMs, (fields) => logger.warn("store_dir_lock_wait", { ...fields }));
     }
     catch (e) {

package/dist/usage-analytics.d.ts

@@ -93,7 +93,20 @@ export type UsageDimension = "principal" | "model";
 export declare function usageBreakdown(rows: UsageRow[], dimension: UsageDimension): Array<{
     key: string;
 } & UsageTotals>;
-/** store 行投影 helper:result JSON(已 parse 或原始字符串)→ UsageRow.stats。所有后端复用(方言只在 SQL)。 */
+/**
+ * store 行投影 helper:**已解码的** result 体 → UsageRow.stats。三个后端复用(方言只在 SQL)。
+ *
+ * 🔴 **本函数不解码**(S-550 车③b 删掉了它的 `typeof result === "string" ? JSON.parse(result) : result`
+ * 那一跳):那正是设计稿点名的歧义臂 ——「体是串就再解一次」在一列真 `JSON`/`JSONB` 上等于**解第二次**,
+ * 于是一个双重编码的 `task_run.result`(解一次得到的是串)会被解回好体、当成真的用量端出去。三个调用点
+ * 逐行亲核过,今天**一处都不递串**:
+ *  · `plugins/run-store-sql.ts#usageScan` → `usageResultBody(r.result)`(属主按文本投影 + `readJsonObjectColumn`
+ *    判形,交出来的是对象或 `undefined`;串在那只读者上就是坏体);
+ *  · `plugins/file-run-store.ts#usageScan` / `plugins/memory-run-store.ts#usageScan` → 行上的
+ *    `result: PersistedTaskResult | null`(File 形由 core 的 `readJsonlRecords` 解,内存形本来就是对象)。
+ * ⇒ 解码的属主是**店**(列 / 文件 / 内存三种承载各自一个),不是这只聚合投影。递进来一个串不会再被
+ * 「宽容地」解开,它会在下面那条「`stats` 不是对象 ⇒ `undefined`」的臂上落成诚实的降级。
+ */
 export declare function projectUsageStats(result: unknown): UsageRow["stats"];
 /** usageScan 的统一行数上限(触顶=结果 truncated:true;试点规模远在限内)。 */
 export declare const USAGE_SCAN_LIMIT = 50000;

package/dist/usage-analytics.js

@@ -87,24 +87,18 @@ export function usageBreakdown(rows, dimension) {
         .map(([key, t]) => ({ key, ...finish(t) }));
 }
 export function projectUsageStats(result) {
-    try {
-        const parsed = typeof result === "string" ? JSON.parse(result) : result;
-        const stats = parsed?.stats;
-        if (!stats || typeof stats !== "object")
-            return undefined;
-        const out = {};
-        if (typeof stats.tokens === "number")
-            out.tokens = stats.tokens;
-        const mu = stats.modelUsage;
-        if (mu && typeof mu === "object" && !Array.isArray(mu))
-            out.modelUsage = mu;
-        if (stats.usageMissing === true)
-            out.usageMissing = true;
-        return out;
-    }
-    catch {
+    const stats = result?.stats;
+    if (!stats || typeof stats !== "object")
         return undefined;
-    }
+    const out = {};
+    if (typeof stats.tokens === "number")
+        out.tokens = stats.tokens;
+    const mu = stats.modelUsage;
+    if (mu && typeof mu === "object" && !Array.isArray(mu))
+        out.modelUsage = mu;
+    if (stats.usageMissing === true)
+        out.usageMissing = true;
+    return out;
 }
 export const USAGE_SCAN_LIMIT = 50_000;
 //# sourceMappingURL=usage-analytics.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.93.6",
+  "version": "7.94.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.26.2",
+    "@sema-agent/core": "7.28.1",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",