feat: 补齐 HWLAB 基线 AgentRun 执行元语

src/mgr/store.ts

@@ -3,6 +3,7 @@ import { AgentRunError } from "../common/errors.js";
 import { newId, nowIso, stableHash } from "../common/validation.js";
 import { redactJson } from "../common/redaction.js";
 import { backendCapabilities } from "../common/backend-profiles.js";
+import { normalizeRunEventPayload, requireEventType } from "../common/events.js";
 
 export type MaybePromise<T> = T | Promise<T>;
 
@@ -198,8 +199,10 @@ export class MemoryAgentRunStore implements AgentRunStore {
 
   appendEvent(runId: string, type: RunEvent["type"], payload: JsonRecord): RunEvent {
     this.getRun(runId);
+    const eventType = requireEventType(type);
+    const eventPayload = normalizeRunEventPayload(eventType, payload);
     const events = this.eventsByRun.get(runId) ?? [];
-    const event: RunEvent = { id: newId("evt"), runId, seq: events.length + 1, type, payload: redactJson(payload), createdAt: nowIso() };
+    const event: RunEvent = { id: newId("evt"), runId, seq: events.length + 1, type: eventType, payload: redactJson(eventPayload), createdAt: nowIso() };
     events.push(event);
     this.eventsByRun.set(runId, events);
     return event;
@@ -258,7 +261,10 @@ export class MemoryAgentRunStore implements AgentRunStore {
   private resolveSessionForRun(input: CreateRunInput, at: string): SessionRef | null {
     if (!input.sessionRef) return null;
     const existing = this.sessions.get(input.sessionRef.sessionId);
-    if (existing) return sessionRefFromRecord(existing, input.sessionRef);
+    if (existing) {
+      assertSessionBoundary(existing, input);
+      return sessionRefFromRecord(existing, input.sessionRef);
+    }
     const record: SessionRecord = {
       sessionId: input.sessionRef.sessionId,
       tenantId: input.tenantId,
@@ -298,6 +304,15 @@ export class MemoryAgentRunStore implements AgentRunStore {
   }
 }
 
+export function assertSessionBoundary(existing: SessionRecord, input: CreateRunInput): void {
+  if (existing.tenantId !== input.tenantId || existing.projectId !== input.projectId) {
+    throw new AgentRunError("tenant-policy-denied", "sessionRef cannot be reused across tenant or project boundary", { httpStatus: 403, details: { sessionId: existing.sessionId, valuesPrinted: false } });
+  }
+  if (existing.backendProfile !== input.backendProfile) {
+    throw new AgentRunError("schema-invalid", "sessionRef cannot be reused across backendProfile boundary", { httpStatus: 400, details: { sessionId: existing.sessionId, existingBackendProfile: existing.backendProfile, requestedBackendProfile: input.backendProfile, valuesPrinted: false } });
+  }
+}
+
 export function statusFromTerminal(terminalStatus: TerminalStatus): RunRecord["status"] {
   if (terminalStatus === "completed") return "completed";
   if (terminalStatus === "cancelled") return "cancelled";