@sema-agent/server 3.15.1 → 3.15.2

package/dist/security.js

@@ -169,7 +169,11 @@ export function createAuthorizer(config, sessionStore) {
                 // 判据改成 fail-closed:多租形下拿不到归属判别能力,就不能允许复用一个 caller 自报的
                 // sessionId(拒绝的是「复用」,不是「提交」—— 不带 sessionId 的新会话照常受理)。
                 // 单租/dev 形(requirePrincipal=false)零行为变化:那里没有租户边界可越。
-                throw new HttpError(403, "session reuse needs an owner-aware session store on a multi-tenant deployment: this worker's session store cannot attest who owns a session, so a caller-supplied sessionId cannot be authorized. Configure a durable session backend (SESSION_BACKEND), or omit sessionId to start a new session.");
+                // ⚠️ 消息必须点名「连本 worker 自己刚铸的 id 也一样」:无 `register` 的 store 上,新会话的
+                // 归属**根本没被记下**,所以第二个 turn 带回引擎自己给的 id 时同样落到这里。不说清楚的话,
+                // 这个 403 从消费端看是纯粹的反直觉(「这 id 是你给我的,你现在说我无权用」)——
+                // 实测:客户端「首 turn 不发 sessionId、后续 turn 带回铸值」这一常见形状,第二个 turn 起必拒。
+                throw new HttpError(403, "session reuse needs an owner-aware session store on a multi-tenant deployment: this worker's session store cannot attest who owns a session, so a sessionId cannot be authorized — including one this worker itself minted a moment ago (without a register seam it was never recorded as yours). Configure a durable session backend (SESSION_BACKEND), or omit sessionId on every turn to start fresh.");
             }
             sessionId = requested;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.15.1",
+  "version": "3.15.2",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",