@sema-agent/server 3.13.0 → 3.14.0

package/dist/http/routes/capabilities.js

@@ -42,6 +42,15 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // AskUserQuestion-suspend + the approval center + resumable checkpoints, independent of whether any
             // TOOL is gated (APPROVAL_REQUIRE = the additive F4 layer). Legacy poll-gate approvalStore does NOT
             // count: alone it can't suspend (the P2-preflight lie).
+            //
+            // 🔴 **辖域比名字宽**(2026-08-01,web [C33]③.3 踩出来的):这个谓词同时是 `/v1/assistant/*`
+            // 整条车道的挂载条件 —— `routes/approvals-assistant.ts` 的分支头逐字是
+            // `if (deps.checkpointStore && (url.startsWith("/v1/approvals") || url.startsWith("/v1/assistant")))`。
+            // 所以 **`GET /v1/assistant/tasks`(计划运行/调度视图)也由这个键判**,而不是由 `scheduler`
+            // (那个键说的是 host 腿的自唤醒 cron 工具,与本视图无关)。
+            // web 因为按名字猜、用 `scheduler` 判这个面,在 local 部署形上永久渲「不可达」——名字窄、谓词宽
+            // 就是这么伤人的。键名不改(改名是 wire 破坏性变更),改成把辖域写在这里 + 附录 A,
+            // 让「says yes ⟺ route works」这句话对**读文档的人**也成立,而不只对写代码的人。
             approvals: Boolean(deps.checkpointStore),
             sessions: Boolean(deps.sessionAudit),
             // [1196] session 级 SSE 订阅面:与 /v1/sessions/:id/events 的 501 谓词同源(sessionWatch 只在

package/dist/http/server.js

@@ -2547,9 +2547,20 @@ function cors(res, req, origins, principalHeader) {
     if (allow === undefined)
         return;
     res.setHeader("access-control-allow-origin", allow);
-    res.setHeader("access-control-allow-methods", "GET, POST, OPTIONS");
+    // 🔴 这三行自 2026-07-14 公开快照起逐字未动,而这期间进来的路由与请求头它一个都不认
+    // (2026-08-01 缝合审)。浏览器前端撞的不是"请求失败"而是**请求根本发不出去** —— OPTIONS 预检就被拒。
+    // 维护纪律:**新增 PUT/DELETE 路由、或新读一个自定义请求头时,这里必须同步**;
+    // `test/cors-v2.test.ts` 的三条钉逐个断言方法与头名,漏一个当场红。
+    res.setHeader("access-control-allow-methods", "GET, POST, PUT, DELETE, OPTIONS");
     // Include the principal header so a browser front-end that sends it isn't rejected by the OPTIONS preflight
     // (which would otherwise drop identity → an owner=null session under requirePrincipal=false).
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}`);
+    // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
+    // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
+    // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid`);
+    // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
+    // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
+    // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。
+    res.setHeader("access-control-expose-headers", "x-task-id, retry-after");
 }
 //# sourceMappingURL=server.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.13.0",
+  "version": "3.14.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^2.9.0",
+    "@sema-agent/core": "^2.10.0",
     "@sema-agent/registry-core": "^0.11.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",