@sema-agent/server 4.3.0 → 5.0.0

package/dist/fleet/fleet-bus.js

@@ -21,7 +21,6 @@
  * replica-local). A cross-replica fleet roll-up is a fleet-token-gated trace-API concern (separate), not this.
  */
 import { EventEmitter } from "node:events";
-import { canonicalToolName } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
 /**
  * The process-local fleet aggregation bus. Holds the current active set + fans out deltas to SSE subscribers.
@@ -231,7 +230,9 @@ export function fleetRunPublisher(bus, run) {
         // `totalInputTokens`,旧核帧(尚未升级到 3.0.0、该键缺席)回落 `inputTokens`(防御性:本引擎恒 ≥3.0.0
         // 时两键并存;异常帧宁少算不 NaN)。Display-only(leader fleet 行的 token 数);billing(costMicroUsd)+
         // context/compaction 走 totalTokens,不受影响;child 行走 task_progress.usage.totalTokens(上面的早退臂)。
-        return (u.totalInputTokens ?? u.inputTokens ?? 0) + (u.outputTokens ?? 0);
+        // [2354] 兼容面全清:旧核帧回落臂(?? u.inputTokens)已删——floor ^4.0.0 下 totalInputTokens 恒在;
+        // 键缺席=越契约帧,按 0 计(宁少算不借异语义键充数)。
+        return (u.totalInputTokens ?? 0) + (u.outputTokens ?? 0);
     };
     return {
         onStart() {
@@ -283,7 +284,7 @@ export function fleetRunPublisher(bus, run) {
                 // PascalCase double-belt (core 1.176): canonicalize so a legacy snake CONTROL verb (e.g. a
                 // pre-1.176 emit / a stray report_blocked) renders as its CC name (ReportBlocked) and the shell's PascalCase
                 // suppression Set still hides it — never re-leaking a control verb as fleet-row activity.
-                bus.publishTask({ id: run.runId, description: canonicalToolName(ev.toolName) });
+                bus.publishTask({ id: run.runId, description: ev.toolName }); // RAW(5.0.0):live 名恒 canonical
             }
         },
         onForwardEvent(ev) {
@@ -595,9 +596,10 @@ export function fleetBackgroundChildPublisher(bus, log) {
             ...(inheritParent && tomb?.resolvedParentId !== undefined ? { resolvedParentId: tomb.resolvedParentId } : {}),
             // session-scoped: registry owner IS the host sessionId (design/129 owner key); fork spawns also carry
             // the child's uuid sessionId — that is the a*↔uuid cross-system anchor, NOT the host session, so it is not used here.
-            // [1522] LOW4:session-scoped 臂同样 root-first(另两臂 1.250 已升)——嵌套 session-scoped 形
-            // 的 owner=中间层子会话 uuid,标它=over-filter;显式 root 到货即锚 root(近死码但一处改齐)。
-            ...(e.sessionScoped && e.owner ? { hostSessionId: e.rootSessionId ?? e.owner } : {}),
+            // [1522] LOW4 root-first。[2378]/[2380] RB-478 到货:三条 revive 发射腿全部无条件带
+            // `root ?? parent` 链 ⇒ `?? e.owner` 回落臂成纯死臂,删([2370] 补审时显式排除在全清宣称外
+            // 等的就是这一天)。rootSessionId 缺席=不打 host 标(over-filter 方向,durable drain 兜)。
+            ...(e.sessionScoped && e.owner && e.rootSessionId ? { hostSessionId: e.rootSessionId } : {}),
             // 🔴 scope DOMAIN mapping: core's registry scope is `ctx.principal ?? deployment scope` —
             // UNDEFINED on a single-user no-principal deployment — while the service fleet domain keys the
             // no-principal caller as "default" (`gatedPrincipal ?? "default"`, streamFleet's callerScope). Without
@@ -606,8 +608,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // a principal exists, so the map is exact.
             tenantScope: e.scope ?? "default",
             sessionScoped: e.sessionScoped,
-            // core 1.367 δ:真 launch 锚(revive=wake 时刻)优先;旧 core 帧回落收帧时刻([1338]④ 原形)
-            spawnedAt: e.startedAt ?? Date.now(),
+            // [2354] 兼容面全清:旧 core 帧「回落收帧时刻」臂已删——floor ^4.0.0 下 startedAt 恒在;
+            // 缺席=诚实不发(行键 optional,消费端本就容忍缺席)。
+            ...(e.startedAt !== undefined ? { spawnedAt: e.startedAt } : {}),
             ...(e.rootSessionId ? { rootSessionId: e.rootSessionId } : {}),
             ...(e.parentToolCallId ? { parentToolCallId: e.parentToolCallId } : {}), // P1-2(core 1.432,12 发射点全带)
             ...(e.sessionId ? { aliasUuid: e.sessionId } : {}), // codex R4(M-B):uuid↔a* 别名(fork spawn 带 forkedId)
@@ -617,15 +620,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // core 帧的 parentSessionId(发起会话,1.350 声明字段——R2:无 runStore 的瞬态 sync 部署没有宿主
             // fleet 行,行查 fallback 必空);②宿主行 sessionId 查表(同租户)兜底。
             ...(e.workflowRunId && !(e.sessionScoped && e.owner)
-                ? (() => {
-                    // core 1.367 δ:显式 root 锚(spawnAttribution 把 root 传进每个 workflow-agent)——信任源第一
-                    if (e.rootSessionId)
-                        return { hostSessionId: e.rootSessionId };
-                    if (e.parentSessionId)
-                        return { hostSessionId: e.parentSessionId };
-                    const host = e.parentTaskId ? bus.snapshot().tasks.find((r) => r.id === e.parentTaskId && r.scope === (e.scope ?? "default")) : undefined;
-                    return host?.sessionId ? { hostSessionId: host.sessionId } : {};
-                })()
+                // [2378]/[2380] RB-478:wa* 三级回落(root→parentSessionId→行查表)收单级——core 三条发射腿
+                // 已无条件带 root 锚,后两级成死臂;缺席=不打标(over-filter,durable 兜),不再猜。
+                ? (e.rootSessionId ? { hostSessionId: e.rootSessionId } : {})
                 : {}),
             // [1493] cross-session isolation: a NON-session-scoped, non-wa* bg child (owner = the run taskId — the
             // norm when backgroundScope!="session", i.e. every multi-tenant deployment, and any local path where the
@@ -654,18 +651,11 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // top-level/nested discriminator) on the spawn event — asked as a core seam follow-up ([1493]).
             // core 1.367 δ:[1493] fable5-R1 注里请的 root fix **到货**——spawn 帧显式带 rootSessionId
             // (固定点语义,嵌套孙代恒=root shell 会话),信任源直用;alias 反查臂降为旧 core 帧回落。
-            ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && (e.rootSessionId ?? e.parentSessionId)
-                ? (() => {
-                    if (e.rootSessionId)
-                        return { hostSessionId: e.rootSessionId };
-                    const childScope = e.scope ?? "default";
-                    for (const pm of meta.values()) {
-                        if (pm.aliasUuid === e.parentSessionId && (pm.tenantScope ?? "default") === childScope) {
-                            return pm.hostSessionId ? { hostSessionId: pm.hostSessionId } : {}; // nested: inherit root (or stay untagged → Part B)
-                        }
-                    }
-                    return { hostSessionId: e.parentSessionId }; // top-level: parentSessionId IS the shell root session
-                })()
+            // [2354] 兼容面全清:alias 反查臂(旧 core 帧无 rootSessionId 时经 meta 反查 parentSessionId)已删——
+            // floor ^4.0.0 下 spawn 帧恒带 rootSessionId(core 1.367 δ 固定点语义);缺席=不打 host 标,
+            // 失败方向仍是 over-filtering(durable inbox/stream-open drain 兜),永不 cross-delivery。
+            ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && e.rootSessionId
+                ? { hostSessionId: e.rootSessionId }
                 : {}),
         };
         remember(e.taskId, m);
@@ -719,9 +709,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
         }
         const tokens = sumUsage(e.usage);
         const name = e.name ? redactSecrets(e.name) : undefined;
-        // [1364]③ K-7 换位:TYPE 列取 tick 帧的行级 `agentType`(core 1.350 定谳:`name` 位=display 标签
-        // ——description 充是历史语义非 bug,类型名在 agentType 位)。缺省回落 name(旧 core 兼容,原行为)。
-        const agentType = e.agentType ? redactSecrets(e.agentType) : name;
+        // [1364]③ K-7 换位:TYPE 列取 tick 帧的行级 `agentType`(core 1.350 定谳)。[2354] 兼容面全清:
+        // 「缺省回落 name」旧 core 兼容臂已删——floor ^4.0.0 下 agentType 恒在;缺席=诚实不发(行键 optional)。
+        const agentType = e.agentType ? redactSecrets(e.agentType) : undefined;
         // The sink tick carries core's currentAction (its only attachment point today) —
         // UNTRUSTED (tool argument head) → redact, same discipline as name. Additive; absent until a tool runs.
         const currentAction = e.currentAction ? redactSecrets(e.currentAction) : undefined;
@@ -838,7 +828,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             handleSpawn(e);
             return;
         }
-        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: e.scope ?? "default", spawnedAt: Date.now() }; // scope domain map holds on the lazily-minted path too([1338]④ 首见起表);F2(2026-07-30 复审):lazy-mint 曾硬编码 "default",scoped 部署下 claim 落错租户键 ⇒ 让位失效退回双生行
+        // [2354] 补审 F2:lazy-mint 不再铸 spawnedAt: Date.now() 假锚(与 spawn 臂同口径——缺 launch 锚=
+        // 诚实缺席,行键 optional;tick/terminal 先到=restart/丢 spawn 边缘,收帧时刻不是 launch 时刻)。
+        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: e.scope ?? "default" }; // scope domain map holds on the lazily-minted path too([1338]④ 首见起表);F2(2026-07-30 复审):lazy-mint 曾硬编码 "default",scoped 部署下 claim 落错租户键 ⇒ 让位失效退回双生行
         if (!meta.has(e.taskId)) {
             remember(e.taskId, m); // tick/terminal without a seen spawn (restart/eviction edge) — row minted lazily
             dlog("bg_child_event", { kind: `${e.kind}-lazy-mint`, taskId: e.taskId, sessionScoped: e.sessionScoped });

package/dist/fleet-client.js

@@ -190,7 +190,7 @@ export function startFleetClientFromEnv(cfg, opts) {
     if (!cc?.baseUrl || !cc.token || !address)
         return undefined;
     if (!cc.worker) {
-        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but CONFIG_CENTER_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;
     }
     return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker }, advertiseAddress: address });

package/dist/http/active-run-conflict.d.ts

@@ -38,6 +38,8 @@ export declare function resumeEntryForGate(kind: string, ids: {
  */
 export interface ActiveRunConflictDoneResult {
     status: "failed";
+    /** [2373]C-1:与 409 体同一机器码——流腿客户端凭它认拒绝,禁按 byte-frozen 文案匹配。 */
+    errorCode: "conflict.session_active_run";
     errorMessage: string;
     activeTaskId: string | null;
     activeTaskStatus?: string;

package/dist/http/active-run-conflict.js

@@ -36,6 +36,7 @@ export function resumeEntryForGate(kind, ids) {
 export function toDoneFrameResult(body) {
     return {
         status: "failed",
+        errorCode: body.errorCode,
         errorMessage: body.error,
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),

package/dist/http/routes/approvals-assistant.d.ts

@@ -4,7 +4,8 @@
  * 路由(前缀 `/v1/approvals` 与 `/v1/assistant`):
  *   · durable 腿(接了 checkpointStore 时优先):list / stream(SSE 原生推送)/ decide|answer / preempt /
  *     resume / plan_review;
- *   · legacy 腿(仅 approvalStore):list / by-id / decide —— 直连门部署下**必须**打不到(fail closed)。
+ *   · legacy 腿(approvalStore 轮询车道)已于 5.0.0 整体退役([2354]/[2356] A-5)——无 checkpointStore 时
+ *     `/v1/approvals` 落 404(诚实缺席),不再有 trusted-header 决裁面。
  *
  * 所有会**烧模型**的续跑都经 `ctx.legs.*`(resumeCheckpoint / resumePreempted / resumePlanReview)走 resume
  * 家族的同一条腿:lease admission、markResuming CAS、写 run log、发 fleet 帧都在腿里,本域只做入站鉴权/形状门。

package/dist/http/routes/approvals-assistant.js

@@ -1,5 +1,6 @@
-import { canonicalToolName } from "@sema-agent/core";
-import { principalFrom, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS, decodeCheckpointScope } from "../../security.js";
+import { principalFrom, decodeCheckpointScope } from "../../security.js";
+import { verifyDirectDoorProof } from "../../principal-jwt.js";
+import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview } from "../../trace/redact.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
@@ -123,7 +124,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendError(res, 400, "request.route_unsupported", "DELETE needs /exemptions/:toolName");
                     return;
                 }
-                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, canonicalToolName(exToolName));
+                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName); // RAW(5.0.0):豁免键空间=CC canonical 名,live/存量行同名
                 sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found", errorCode: "not_found.exemption" });
                 return;
             }
@@ -445,7 +446,9 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, out.status, out.body);
             return;
         }
-        const m = /^\/v1\/approvals\/([^/]+?)(?:\/decide)?$/.exec(url);
+        // [2373]C-4(5.0.0):裸 `POST /v1/approvals/:id` 装饰臂删——/decide 是唯一决裁形(裸形曾与
+        // `GET /v1/approvals/:id` 撞 URL 空间,并把限流/计费/wire 注三处记账劈成两条)。
+        const m = /^\/v1\/approvals\/([^/]+)\/decide$/.exec(url);
         if (m && req.method === "POST") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return; // 🔴 复审 C2:lease admitted in driveResumeIntoRunLog (owner principal). resume hits TiDB — rate-limit (council)
@@ -622,7 +625,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 ? async (overrideSessionId) => {
                     const grantSessionId = overrideSessionId ?? sessionId;
                     try {
-                        const canonical = canonicalToolName(rememberToolName);
+                        const canonical = rememberToolName; // RAW(5.0.0):行 toolName 由 core 铸,恒 canonical
                         await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
                         rememberApplied = true;
                         deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
@@ -643,97 +646,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
         sendError(res, 404, "not_found.route", "not found");
         return;
     }
-    // Human-in-the-loop approval gate (F4). Operators list/decide; the running task polls the row.
-    if (deps.approvalStore && url.startsWith("/v1/approvals")) {
-        const store = deps.approvalStore;
-        // 🔴 D-G belt (defense-in-depth): this LEGACY block authorizes /approvals via the trusted x-agent-principal
-        // header (no crypto). On a direct-door worker that path must NEVER be live — the boot invariant already forces
-        // DURABLE_APPROVAL (so checkpointStore owns /approvals above and we never reach here), but if a direct-door
-        // worker ever fell through to here, fail closed rather than expose the header-trusting path.
-        if (deps.config.directApprovalDoor) {
-            sendError(res, 503, "approval_door_unconfigured", "approvals are served by the direct door on this worker");
-            return;
-        }
-        if (req.method === "GET" && url === "/v1/approvals") {
-            const principal = principalFrom(req, deps.config);
-            if (isOperator(principal, deps.config.operatorPrincipals)) {
-                // operator: may filter by any ?owner (or list all). scope is owner-sourced, so the operator's ?owner
-                // filter IS the scope filter; an unfiltered operator list is cross-tenant BY DESIGN (operator queue).
-                const owner = new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined;
-                sendJson(res, 200, { pending: owner ? await store.listPending(owner, owner) : await store.listPendingAll() });
-            }
-            else {
-                // non-operator: only ITS OWN pending (ignore any ?owner spoof) — never others' tool-call args. scope =
-                // the caller's principal (owner-sourced), so the single-DB read guard isolates it at the SQL layer too.
-                sendJson(res, 200, { pending: principal ? await store.listPending(principal, principal) : [] });
-            }
-            return;
-        }
-        const m = /^\/v1\/approvals\/([^/]+)$/.exec(url);
-        if (m) {
-            const id = m[1];
-            if (req.method === "GET") {
-                // The row carries the full tool-call args (commands/paths/contents of a high-risk op). The list
-                // endpoint deliberately scopes non-operators to their OWN pending ("never others' tool-call args");
-                // a by-id GET must enforce the same boundary, else any token-holder who learns an id reads another
-                // tenant's args. Operators see all; everyone else only their own. 404 (not 403) to non-owners so
-                // existence isn't revealed — symmetric with runOwnerOk.
-                const principal = principalFrom(req, deps.config);
-                if (deps.config.requirePrincipal && !principal) {
-                    sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-                    return;
-                }
-                const operator = isOperator(principal, deps.config.operatorPrincipals);
-                // Operators read across tenants (scope-agnostic getById); a non-operator reads ONLY its own scope so the
-                // single-DB read guard fires at the SQL layer (no cross-tenant args even if it learns an id).
-                const row = operator ? await store.getById(id) : principal != null ? await store.get(id, principal) : undefined;
-                if (!row || (!operator && row.owner !== null && row.owner !== principal)) {
-                    sendError(res, 404, "not_found.approval", "approval not found");
-                    return;
-                }
-                sendJson(res, 200, row);
-                return;
-            }
-            if (req.method === "POST") {
-                // Deciding (approve/deny) is OPERATOR-ONLY — a requester approving its own high-risk op would
-                // defeat the F4 gate. (Legacy/unset OPERATOR_PRINCIPALS → the service token is the boundary — but
-                // ONLY on a single-tenant deployment: under REQUIRE_PRINCIPAL the empty-list true-for-all would let
-                // ANY tenant decide ANOTHER tenant's approval [the durable /decide got
-                // this hardening earlier and this legacy leg never did] — multi-tenant demands an EXPLICIT
-                // operator list, same posture as the durable twin.)
-                const principal = principalFrom(req, deps.config);
-                const operatorOk = deps.config.requirePrincipal
-                    ? explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals)
-                    : isOperator(principal, deps.config.operatorPrincipals);
-                if (!operatorOk) {
-                    sendError(res, 403, "auth.operator_only", "only an operator may decide an approval (set OPERATOR_PRINCIPALS)");
-                    return;
-                }
-                const body = (await readJson(req));
-                const decision = body?.decision === "approve" ? "approved" : body?.decision === "deny" ? "denied" : undefined;
-                if (!decision) {
-                    sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason? }");
-                    return;
-                }
-                // The operator decides ACROSS tenants by design (the F4 operator queue), so we bind the decide CAS to the
-                // row's OWN scope (read scope-agnostically first) rather than the operator's principal — the scope<=>?
-                // clause then becomes an exact, consistent guard instead of a cross-tenant bypass. Unknown id ⇒ 409.
-                const target = await store.getById(id);
-                if (!target) {
-                    sendError(res, 409, "conflict.approval_settled", "approval already decided or not found");
-                    return;
-                }
-                const applied = await store.decide(id, target.scope, decision, body.reason ?? null, principal ?? null);
-                if (applied)
-                    sendJson(res, 200, { id, status: decision });
-                else
-                    sendError(res, 409, "conflict.approval_settled", "approval already decided or not found");
-                return;
-            }
-        }
-        sendError(res, 404, "not_found.route", "not found");
-        return;
-    }
+    // [2354]/[2356] A-5(5.0.0):legacy F4 轮询腿(approvalStore list/by-id/decide,trusted-header 决裁)
+    // 整体退役。无 checkpointStore 的部署打 /v1/approvals 一律落到本域尾部的未匹配路径(404 诚实缺席)。
     miss.fell = true;
 }
 /** Server-side poll cadence for the native-push approvals stream. The CLIENT subscribes ONCE and never polls;

package/dist/http/routes/capabilities.js

@@ -40,8 +40,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             artifacts: Boolean(deps.runStore),
             // TRUE when durable HITL can FIRE = checkpointStore present (DURABLE_APPROVAL=true): it mounts
             // AskUserQuestion-suspend + the approval center + resumable checkpoints, independent of whether any
-            // TOOL is gated (APPROVAL_REQUIRE = the additive F4 layer). Legacy poll-gate approvalStore does NOT
-            // count: alone it can't suspend (the P2-preflight lie).
+            // TOOL is gated (APPROVAL_REQUIRE = the additive F4 layer). ([2354] A-5:legacy 轮询门已退役,
+            // durable 是唯一门形——本谓词自然成为 approvals 面唯一的挂载条件。)
             //
             // 🔴 **辖域比名字宽**(2026-08-01,web [C33]③.3 踩出来的):这个谓词同时是 `/v1/assistant/*`
             // 整条车道的挂载条件 —— `routes/approvals-assistant.ts` 的分支头逐字是
@@ -54,7 +54,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             approvals: Boolean(deps.checkpointStore),
             sessions: Boolean(deps.sessionAudit),
             // [1196] session 级 SSE 订阅面:与 /v1/sessions/:id/events 的 501 谓词同源(sessionWatch 只在
-            // sessionStorage 具备 getLeafId/ownerOf 时由 main.ts 构建)——web 据此换轨,false=回落 /head 轮询。
+            // sessionStorage 具备 getLeafId/ownerOf 时由 main.ts 构建)。[2373]A-5:截至 2026-08-02 无消费端接线
+            // (web 未按此换轨)——本位是预备位;「web 据此换轨」是当年的预期,不是已核实的现状。
             sessionEvents: Boolean(deps.sessionWatch && deps.sessionStorage?.getLeafId && deps.sessionStorage?.ownerOf),
             // #13([1871] web asks,clay 排批 2026-07-27):fleet 面能力族——一个诚实对象或 false(无 fleetBus=
             // 无 /v1/fleet/stream,路由 501 同谓词)。`resume:"snapshot"` 是刻意的语义广告而非搪塞:总线是
@@ -253,8 +254,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // 缺席时 issue()/prepareDirectUpload() 一律 fail-loud,工具挂着也必失败)。"says yes ⟺ 调用真能
             // 成功":只看 config.sendUserFile(签发面已配)会在工具缺席的形态(adb/local-docker lane、多租户
             // host/ssh)假 yes(配置自查 agent 抓获 2026-07-14);只看 emitter 会在无公网端点时假 yes。
-            // s3PublicEndpoint=web 渲染/拼接要的公网 base(bootstrap 单一真源判决——server 透出,web 不猜、
-            // 不走 registry env 双源;工具挂不挂载它都照透——纯感知面,web 可提前接线)。
+            // s3PublicEndpoint=公网 base 的单一真源透出(server 透出,消费端不猜、不走 registry env 双源;
+            // 纯感知面)。[2373]A-5:截至 2026-08-02 无消费端读它——预备位,「web 渲染要用」是预期非现状。
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             // SendUserFile 账本(多租户治理面):true ⇔ 签发面已配 + store backend 在(记账写点活 + GET

package/dist/http/routes/fleet.js

@@ -95,8 +95,11 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             }
             return rest;
         };
+        // [2373]C-12:data 里补 `type`(=event 名)双发——代理剥 `event:` 行/onmessage 忽略具名事件时,
+        // 按 data.type 分派的客户端在本流拿到的是 undefined(approvals 流注释里的真实约束,同理适用)。
+        // 单点注入:调用方已带 type 的帧(hook_notice/bg_notification)保持原值。
         const send = (event, data) => { if (!res.writableEnded)
-            res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`); };
+            res.write(`event: ${event}\ndata: ${JSON.stringify({ type: event, ...data })}\n\n`); };
         // connect-time snapshot (filtered + scope-stripped) — the visible rows become this connection's "seen" set.
         const snap = bus.snapshot();
         const tasks = snap.tasks.filter(visT);

package/dist/http/routes/images.js

@@ -23,6 +23,12 @@ export function coarseStatusForState(state) {
         return "failed";
     return "running";
 }
+/** [2373]C-7:202 受理体的**唯一铸点**——此前四份逐字构造散在 attach/竞态重读/新建/dryRun 四臂,
+ *  下一个字段必然只加到其中两处(:213/:217 与 :193/:206 已有分叉风险)。status/state 双发保留
+ *  (status=state 的粗化像,省客户端抄映射表)。 */
+function bakeAcceptedBody(b) {
+    return { bakeId: b.bakeId, eventsUrl: `/v1/images/bakes/${b.bakeId}/events`, status: b.status, state: b.state };
+}
 /** build.sh's structured exit code → the center band-composer UI's terminal `errorCode` (§P2.14 #2). null for an
  *  uncategorized failure (then `error` free-text + `exitCode` drive the UI). 10=dup-tag, 124=timeout, 507=disk. */
 export function errorCodeForExit(exitCode, cancelled) {
@@ -168,7 +174,7 @@ async function handleImagesBody(req, res, url, ctx, miss) {
                 // (a) an IDENTICAL-argv in-flight bake ⇒ attach (idempotent re-submit, 202) — no second build.
                 const sameArgv = await bakes.findActiveByArgv(argv);
                 if (sameArgv) {
-                    sendJson(res, 202, { bakeId: sameArgv.bakeId, eventsUrl: `/v1/images/bakes/${sameArgv.bakeId}/events`, status: sameArgv.status, state: sameArgv.state });
+                    sendJson(res, 202, bakeAcceptedBody(sameArgv));
                     return;
                 }
                 // (b) M4: ATOMIC admission — the busy-check and the create are ONE DB statement (`INSERT … SELECT …
@@ -181,18 +187,18 @@ async function handleImagesBody(req, res, url, ctx, miss) {
                 if (!r.created) {
                     const sameNow = await bakes.findActiveByArgv(argv);
                     if (sameNow) {
-                        sendJson(res, 202, { bakeId: sameNow.bakeId, eventsUrl: `/v1/images/bakes/${sameNow.bakeId}/events`, status: sameNow.status, state: sameNow.state });
+                        sendJson(res, 202, bakeAcceptedBody(sameNow));
                         return;
                     }
                     const busy = await bakes.findActiveAny();
                     sendError(res, 409, "conflict.bake_in_progress", "a bake is already in progress", { ...(busy ? { activeBakeId: busy.bakeId, eventsUrl: `/v1/images/bakes/${busy.bakeId}/events` } : {}) });
                     return;
                 }
-                sendJson(res, 202, { bakeId: r.bake.bakeId, eventsUrl: `/v1/images/bakes/${r.bake.bakeId}/events`, status: r.bake.status, state: r.bake.state });
+                sendJson(res, 202, bakeAcceptedBody(r.bake));
                 return;
             }
             const { bake } = await bakes.createBake(createInput);
-            sendJson(res, 202, { bakeId: bake.bakeId, eventsUrl: `/v1/images/bakes/${bake.bakeId}/events`, status: bake.status, state: bake.state });
+            sendJson(res, 202, bakeAcceptedBody(bake));
             return;
         }
         // GET /v1/images/bakes/:bakeId/events — resumable SSE (the live "baking…" view), run-trace-SSE-shaped (§P2.2).

package/dist/http/routes/runs.js

@@ -54,6 +54,29 @@ export const RUN_TASK_OUTPUT_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/output$
 export const RUN_TASK_STOP_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/stop$/;
 /** The task_run SSE — a thin wrapper over `streamSseLog` that PRESERVES the existing wire shape exactly
  *  (`data: {type, ...data}`, `event: failed` stale frame). Behavior-identical to the pre-refactor reader. */
+/** [2373]C-5:subagent/task-handle 两读写面的**共享 authz 门**(principal→owner→session 三级,
+ *  [1493] 模型)。此前两面逐字重写——[1493] 类修复要改两次的真风险。返回 run 行;`null`=已应答
+ *  (401/404,honest 404 无存在性 oracle)。语义逐字保留:operator 双跳过(owner+session)、
+ *  session-unbound run 仅 principal 门、fail-closed。 */
+async function subagentReadGate(req, res, deps, runId) {
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && principal === undefined) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return null;
+    }
+    const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+    const run = await deps.runStore.getRun(runId);
+    if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+        sendError(res, 404, "not_found.run", "run not found");
+        return null;
+    }
+    const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
+    if (!trusted && run.sessionId && callerSession !== run.sessionId) {
+        sendError(res, 404, "not_found.run", "run not found");
+        return null;
+    }
+    return { run, trusted };
+}
 async function streamRunEvents(req, res, runStore, taskId, staleMs) {
     await streamSseLog(req, res, {
         statusOf: async (id) => {
@@ -900,44 +923,18 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.run_store_required", "subagent output reads require the run store");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-            return;
-        }
         const runId = safeDecode(subOutputMatch[1]);
         const target = safeDecode(subOutputMatch[2]);
         if (runId === null || target === null) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-            sendError(res, 404, "not_found.run", "run not found");
-            return;
-        }
-        // [1493] SESSION-scoped content read. principal answers "is this your data at all" (whose); session
-        // answers "which conversation" (which). This verb returns CONVERSATION CONTENT (a child's final body), so
-        // the principal owner-gate above is necessary but NOT sufficient: under a SHARED principal (single-user
-        // multi-shell — the default local posture, and any tenant that shares an identity) it passes for every
-        // co-principal shell, so a SIBLING session could read another conversation's child (clay's dual-shell
-        // repro). The run belongs to a conversation (run.sessionId); a non-operator caller must PROVE it owns that
-        // conversation by asserting the matching `?session=`. Threat model is ACCIDENTAL cross-read within one
-        // user's own shells (no adversary — the shell honestly reports its own session), so an honest
-        // caller-asserted session is correct AND sufficient here (no unguessable capability needed). fable5 R1
-        // (deliberate boundary, do not "harden" this into a capability): yes, a co-principal caller COULD forge the
-        // target's session — but co-principal means the SAME authz identity, i.e. the same user reading their own
-        // data through another window; session is a content-ROUTING axis inside one principal, not an authz wall.
-        // Deployments with genuinely different humans MUST give them distinct principals (requirePrincipal) — the
-        // principal owner-gate above is the security boundary, and it runs first. An
-        // operator/trace caller bypasses (as it does the owner-gate). A run with no sessionId is not
-        // conversation-bound → principal gate only. Fail-CLOSED: a session-bound run with no/mismatched assertion → 404.
-        const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
-        if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-            sendError(res, 404, "not_found.run", "run not found");
+        const gated = await subagentReadGate(req, res, deps, runId); // [2373]C-5 共享门(principal→owner→session)
+        if (!gated)
             return;
-        }
+        const { run } = gated;
+        // [1493] SESSION 边界的完整论证(threat model/为何 caller-asserted session 足够/为何不做 capability)
+        // 已随共享门挪至 subagentReadGate 注;本面语义逐字不变。
         const out = await deps.subagentTaskOutput(target, { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) });
         const details = out.details;
         // codex R1 (type gate): pollTask is the GENERIC registry face — same-tuple b*/m*/w* handles (bash
@@ -1006,12 +1003,14 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             return;
         }
         sseHeaders(res);
+        // [2373]C-11(5.0.0 BREAKING,提货单点名):meta 帧的 run 实体键改 `taskId`——同 verb 家族的
+        // output 面(:936/:1162)一直叫 taskId,meta 独叫 runId 是家族内第三键名;5.0.0 收一。
         // meta 声明:live 帧 replica-local + replay 指引;status=探测快照(终态=不再有帧,发 meta 即收尾,
         // cli 拿到「走 replay 面」的信号而不是空挂)。seq=stop-cycle 世代号(settle 铸;core 1.377 起
         // **全域投影**——进程内 live 臂投当前复活周期号 [[1533] ask 兑现,[1548]①],durable 终态 serve
         // 同键同义;老 core 只在 durable 臂在场,缺省容忍)。1=spawn 周期,≥2=复活周期(retained revive
         // 或 tier-3 均 bump——codex 快审 #11 纠,勿窄读成仅 tier-3)。
-        res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, runId, target, status: probeDetails.status ?? "running", ...(typeof probeDetails.seq === "number" ? { seq: probeDetails.seq } : {}), live: "replica-local", replayFace: "GET /v1/runs/:id/subagents/:handle/output" })}\n\n`);
+        res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, taskId: runId, target, status: probeDetails.status ?? "running", ...(typeof probeDetails.seq === "number" ? { seq: probeDetails.seq } : {}), live: "replica-local", replayFace: "GET /v1/runs/:id/subagents/:handle/output" })}\n\n`);
         // core 1.382([1561] 提货单③):"parked" 非活非终态(durably suspended pending approval)——跟
         // running/pending 同归"还没完",tail 该继续等而不是收尾指去 replay 面(那是给真终态用的)。子代获批
         // 恢复后会在**同一条**活流上继续产帧,提前收尾会让客户端误判"已经结束",错过恢复后的后续内容。
@@ -1068,31 +1067,17 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         }
         if (stopVerb && rateLimited(req, res))
             return; // mutating, runs no model (parity with detach — rateLimited only, no quota/lease gate)
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-            return;
-        }
         const runId = safeDecode(taskVerbMatch[1]);
         const target = safeDecode(taskVerbMatch[2]);
         if (runId === null || target === null) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-            sendError(res, 404, "not_found.run", "run not found");
+        const gatedB = await subagentReadGate(req, res, deps, runId); // [2373]C-5 共享门([1493] 模型,论证见门注)
+        if (!gatedB)
             return;
-        }
-        // SESSION-scoped content/action face ([1493] model): enforced fail-closed — same boundary rationale as
-        // subagentOutput (principal = whose data, session = which conversation; honest caller-asserted session is
-        // correct AND sufficient inside one principal; operators bypass; a session-unbound run is principal-only).
+        const { run } = gatedB;
         const q = new URL(req.url ?? "", "http://x").searchParams;
-        if (!trusted && run.sessionId && q.get("session") !== run.sessionId) {
-            sendError(res, 404, "not_found.run", "run not found");
-            return;
-        }
         const access = { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) };
         // ?filter= is REFUSED on BOTH verbs, not ignored (fail-loud 400; the face shipped unreleased, zero
         // consumers — and codex R2: a GET-only refusal would leave the stop verb silently accepting it). The

package/dist/http/routes/session-sync.d.ts

@@ -9,7 +9,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionRulesRecord } from "@sema-agent/core";
-import { type StagingHandle } from "../../session-sync.js";
+import { type StagingHandle } from "../../session-sync-kernel.js";
 import type { RouteCtx } from "../route-ctx.js";
 export type PendingStaging = {
     handle: StagingHandle;

package/dist/http/routes/session-sync.js

@@ -2,7 +2,8 @@ import { once } from "node:events";
 import { randomBytes, createHash } from "node:crypto";
 import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, SessionError, SessionPolicyError } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
-import { exportSessionManifest, classifySyncRelationshipByIds, SyncConflictError, fileSnapshotImportFace } from "../../session-sync.js";
+import { exportSessionManifest, fileSnapshotImportFace } from "../../session-sync.js";
+import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape } from "../../security.js";
 import { sendJson, sendError, msg } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";

package/dist/http/routes/tasks.js

@@ -6,7 +6,7 @@ import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-t
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -371,8 +371,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             // parentToolCallId-gated), so this sink is the ONLY path a tick reaches the top-run consumers.
                             // 1.78 (review HIGH): fan it out to the LIVE SSE too (shared whitelist+redact builder, carrying
                             // the E2 identity the shell binds concurrent ticks by) — previously it fed ONLY the fleet bus,
-                            // so the conversation lane never saw a real tick and the in-loop task_progress branch below is
-                            // forward-compat only (dead against core ≤1.208). core swallow-guards a throwing sink.
+                            // so the conversation lane never saw a real tick and the in-loop task_progress branch below was
+                            // forward-compat then — [2373]B-4:floor ^4.0.0 下它是热路径(腐注方向已翻转,勿按旧注当死支)。
+                            // core swallow-guards a throwing sink.
                             const fwdInternals = {
                                 onForwardEvent: (e) => {
                                     fleetPub?.onForwardEvent(e);
@@ -652,10 +653,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     res.write(`data: ${JSON.stringify({ type: "workspace_changed", ...workspaceChangedEventData(ev) })}\n\n`);
                                 }
                                 else if (ev.type === "compaction_outcome") {
-                                    // core 2.5.0([2105]② 披露修):压缩非 compacted 结局上流帧——白名单投影:outcome/trigger
-                                    // 闭枚举 verbatim;reason 是引擎说明文本(可能引用配置值)→ redactSecrets;identity 两键同款。
-                                    const e = ev;
-                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", outcome: e.outcome, trigger: e.trigger, ...(e.reason !== undefined ? { reason: redactSecrets(e.reason) } : {}), ...(e.eventId !== undefined ? { eventId: e.eventId } : {}), ...(e.parentToolCallId !== undefined ? { parentToolCallId: e.parentToolCallId } : {}) })}\n\n`);
+                                    // core 2.5.0([2105]②)压缩非 compacted 结局帧。[2373]C-2:内联挑键收进共享 builder,
+                                    // 与两条 durable 腿同源(它曾是唯一不走 builder 的内容帧=三方普查共同盲区)。
+                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", ...compactionOutcomeEventData(ev) })}\n\n`);
                                 }
                                 else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     // 裸 catch-all 白名单化收官(probe-wire-1 表征钉的根治半场):最后四个已知臂离开

package/dist/http/routes/trace-usage.js

@@ -242,7 +242,7 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
     sseHeaders(res);
     // First event declares the stream contract: mode + a version (council — lets the relay detect a worker whose
     // SSE shape changed, e.g. when P1 adds token-delta granularity). resumeFrom echoes the honored Last-Event-ID.
-    res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, mode: "delta", resumeFrom: from })}\n\n`);
+    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "delta", resumeFrom: from })}\n\n`); // [2373]C-12:data.type 双发与内容帧一致
     let closed = false;
     req.on("close", () => {
         closed = true;