@sema-agent/server 4.3.0 → 5.0.1

package/dist/http/routes/approvals-assistant.js

@@ -1,5 +1,6 @@
-import { canonicalToolName } from "@sema-agent/core";
-import { principalFrom, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS, decodeCheckpointScope } from "../../security.js";
+import { principalFrom, decodeCheckpointScope } from "../../security.js";
+import { verifyDirectDoorProof } from "../../principal-jwt.js";
+import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview } from "../../trace/redact.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
@@ -123,7 +124,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendError(res, 400, "request.route_unsupported", "DELETE needs /exemptions/:toolName");
                     return;
                 }
-                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, canonicalToolName(exToolName));
+                const revoked = await deps.approvalExemptionStore.revoke(exSessionId, exToolName); // RAW(5.0.0):豁免键空间=CC canonical 名,live/存量行同名
                 sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found", errorCode: "not_found.exemption" });
                 return;
             }
@@ -445,7 +446,9 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, out.status, out.body);
             return;
         }
-        const m = /^\/v1\/approvals\/([^/]+?)(?:\/decide)?$/.exec(url);
+        // [2373]C-4(5.0.0):裸 `POST /v1/approvals/:id` 装饰臂删——/decide 是唯一决裁形(裸形曾与
+        // `GET /v1/approvals/:id` 撞 URL 空间,并把限流/计费/wire 注三处记账劈成两条)。
+        const m = /^\/v1\/approvals\/([^/]+)\/decide$/.exec(url);
         if (m && req.method === "POST") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return; // 🔴 复审 C2:lease admitted in driveResumeIntoRunLog (owner principal). resume hits TiDB — rate-limit (council)
@@ -622,7 +625,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 ? async (overrideSessionId) => {
                     const grantSessionId = overrideSessionId ?? sessionId;
                     try {
-                        const canonical = canonicalToolName(rememberToolName);
+                        const canonical = rememberToolName; // RAW(5.0.0):行 toolName 由 core 铸,恒 canonical
                         await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
                         rememberApplied = true;
                         deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
@@ -643,97 +646,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
         sendError(res, 404, "not_found.route", "not found");
         return;
     }
-    // Human-in-the-loop approval gate (F4). Operators list/decide; the running task polls the row.
-    if (deps.approvalStore && url.startsWith("/v1/approvals")) {
-        const store = deps.approvalStore;
-        // 🔴 D-G belt (defense-in-depth): this LEGACY block authorizes /approvals via the trusted x-agent-principal
-        // header (no crypto). On a direct-door worker that path must NEVER be live — the boot invariant already forces
-        // DURABLE_APPROVAL (so checkpointStore owns /approvals above and we never reach here), but if a direct-door
-        // worker ever fell through to here, fail closed rather than expose the header-trusting path.
-        if (deps.config.directApprovalDoor) {
-            sendError(res, 503, "approval_door_unconfigured", "approvals are served by the direct door on this worker");
-            return;
-        }
-        if (req.method === "GET" && url === "/v1/approvals") {
-            const principal = principalFrom(req, deps.config);
-            if (isOperator(principal, deps.config.operatorPrincipals)) {
-                // operator: may filter by any ?owner (or list all). scope is owner-sourced, so the operator's ?owner
-                // filter IS the scope filter; an unfiltered operator list is cross-tenant BY DESIGN (operator queue).
-                const owner = new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined;
-                sendJson(res, 200, { pending: owner ? await store.listPending(owner, owner) : await store.listPendingAll() });
-            }
-            else {
-                // non-operator: only ITS OWN pending (ignore any ?owner spoof) — never others' tool-call args. scope =
-                // the caller's principal (owner-sourced), so the single-DB read guard isolates it at the SQL layer too.
-                sendJson(res, 200, { pending: principal ? await store.listPending(principal, principal) : [] });
-            }
-            return;
-        }
-        const m = /^\/v1\/approvals\/([^/]+)$/.exec(url);
-        if (m) {
-            const id = m[1];
-            if (req.method === "GET") {
-                // The row carries the full tool-call args (commands/paths/contents of a high-risk op). The list
-                // endpoint deliberately scopes non-operators to their OWN pending ("never others' tool-call args");
-                // a by-id GET must enforce the same boundary, else any token-holder who learns an id reads another
-                // tenant's args. Operators see all; everyone else only their own. 404 (not 403) to non-owners so
-                // existence isn't revealed — symmetric with runOwnerOk.
-                const principal = principalFrom(req, deps.config);
-                if (deps.config.requirePrincipal && !principal) {
-                    sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-                    return;
-                }
-                const operator = isOperator(principal, deps.config.operatorPrincipals);
-                // Operators read across tenants (scope-agnostic getById); a non-operator reads ONLY its own scope so the
-                // single-DB read guard fires at the SQL layer (no cross-tenant args even if it learns an id).
-                const row = operator ? await store.getById(id) : principal != null ? await store.get(id, principal) : undefined;
-                if (!row || (!operator && row.owner !== null && row.owner !== principal)) {
-                    sendError(res, 404, "not_found.approval", "approval not found");
-                    return;
-                }
-                sendJson(res, 200, row);
-                return;
-            }
-            if (req.method === "POST") {
-                // Deciding (approve/deny) is OPERATOR-ONLY — a requester approving its own high-risk op would
-                // defeat the F4 gate. (Legacy/unset OPERATOR_PRINCIPALS → the service token is the boundary — but
-                // ONLY on a single-tenant deployment: under REQUIRE_PRINCIPAL the empty-list true-for-all would let
-                // ANY tenant decide ANOTHER tenant's approval [the durable /decide got
-                // this hardening earlier and this legacy leg never did] — multi-tenant demands an EXPLICIT
-                // operator list, same posture as the durable twin.)
-                const principal = principalFrom(req, deps.config);
-                const operatorOk = deps.config.requirePrincipal
-                    ? explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals)
-                    : isOperator(principal, deps.config.operatorPrincipals);
-                if (!operatorOk) {
-                    sendError(res, 403, "auth.operator_only", "only an operator may decide an approval (set OPERATOR_PRINCIPALS)");
-                    return;
-                }
-                const body = (await readJson(req));
-                const decision = body?.decision === "approve" ? "approved" : body?.decision === "deny" ? "denied" : undefined;
-                if (!decision) {
-                    sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason? }");
-                    return;
-                }
-                // The operator decides ACROSS tenants by design (the F4 operator queue), so we bind the decide CAS to the
-                // row's OWN scope (read scope-agnostically first) rather than the operator's principal — the scope<=>?
-                // clause then becomes an exact, consistent guard instead of a cross-tenant bypass. Unknown id ⇒ 409.
-                const target = await store.getById(id);
-                if (!target) {
-                    sendError(res, 409, "conflict.approval_settled", "approval already decided or not found");
-                    return;
-                }
-                const applied = await store.decide(id, target.scope, decision, body.reason ?? null, principal ?? null);
-                if (applied)
-                    sendJson(res, 200, { id, status: decision });
-                else
-                    sendError(res, 409, "conflict.approval_settled", "approval already decided or not found");
-                return;
-            }
-        }
-        sendError(res, 404, "not_found.route", "not found");
-        return;
-    }
+    // [2354]/[2356] A-5(5.0.0):legacy F4 轮询腿(approvalStore list/by-id/decide,trusted-header 决裁)
+    // 整体退役。无 checkpointStore 的部署打 /v1/approvals 一律落到本域尾部的未匹配路径(404 诚实缺席)。
     miss.fell = true;
 }
 /** Server-side poll cadence for the native-push approvals stream. The CLIENT subscribes ONCE and never polls;

package/dist/http/routes/capabilities.js

@@ -40,8 +40,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             artifacts: Boolean(deps.runStore),
             // TRUE when durable HITL can FIRE = checkpointStore present (DURABLE_APPROVAL=true): it mounts
             // AskUserQuestion-suspend + the approval center + resumable checkpoints, independent of whether any
-            // TOOL is gated (APPROVAL_REQUIRE = the additive F4 layer). Legacy poll-gate approvalStore does NOT
-            // count: alone it can't suspend (the P2-preflight lie).
+            // TOOL is gated (APPROVAL_REQUIRE = the additive F4 layer). ([2354] A-5:legacy 轮询门已退役,
+            // durable 是唯一门形——本谓词自然成为 approvals 面唯一的挂载条件。)
             //
             // 🔴 **辖域比名字宽**(2026-08-01,web [C33]③.3 踩出来的):这个谓词同时是 `/v1/assistant/*`
             // 整条车道的挂载条件 —— `routes/approvals-assistant.ts` 的分支头逐字是
@@ -54,7 +54,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             approvals: Boolean(deps.checkpointStore),
             sessions: Boolean(deps.sessionAudit),
             // [1196] session 级 SSE 订阅面:与 /v1/sessions/:id/events 的 501 谓词同源(sessionWatch 只在
-            // sessionStorage 具备 getLeafId/ownerOf 时由 main.ts 构建)——web 据此换轨,false=回落 /head 轮询。
+            // sessionStorage 具备 getLeafId/ownerOf 时由 main.ts 构建)。[2373]A-5:截至 2026-08-02 无消费端接线
+            // (web 未按此换轨)——本位是预备位;「web 据此换轨」是当年的预期,不是已核实的现状。
             sessionEvents: Boolean(deps.sessionWatch && deps.sessionStorage?.getLeafId && deps.sessionStorage?.ownerOf),
             // #13([1871] web asks,clay 排批 2026-07-27):fleet 面能力族——一个诚实对象或 false(无 fleetBus=
             // 无 /v1/fleet/stream,路由 501 同谓词)。`resume:"snapshot"` 是刻意的语义广告而非搪塞:总线是
@@ -253,8 +254,8 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // 缺席时 issue()/prepareDirectUpload() 一律 fail-loud,工具挂着也必失败)。"says yes ⟺ 调用真能
             // 成功":只看 config.sendUserFile(签发面已配)会在工具缺席的形态(adb/local-docker lane、多租户
             // host/ssh)假 yes(配置自查 agent 抓获 2026-07-14);只看 emitter 会在无公网端点时假 yes。
-            // s3PublicEndpoint=web 渲染/拼接要的公网 base(bootstrap 单一真源判决——server 透出,web 不猜、
-            // 不走 registry env 双源;工具挂不挂载它都照透——纯感知面,web 可提前接线)。
+            // s3PublicEndpoint=公网 base 的单一真源透出(server 透出,消费端不猜、不走 registry env 双源;
+            // 纯感知面)。[2373]A-5:截至 2026-08-02 无消费端读它——预备位,「web 渲染要用」是预期非现状。
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             // SendUserFile 账本(多租户治理面):true ⇔ 签发面已配 + store backend 在(记账写点活 + GET

package/dist/http/routes/fleet.js

@@ -62,7 +62,9 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
         // a new-generation shell can drop its frame-level own/foreign checks entirely (incl. the cross-shell
         // restart edge) while keeping them against older servers whose meta lacks the field. Additive (version
         // stays 1): older shells ignore unknown fields.
-        res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, scoped: callerScope !== null, sessionScoped: callerSession !== null, bgNotifyFailClosed: true })}\n\n`);
+        // `type: "meta"` 与 `event: meta` 同名双发(tasks/trace-usage/approvals 三流同款):部分代理只转发
+        // `data:` 行,按 data.type 分派的消费端否则认不出首帧。additive,老消费端忽略未知键。
+        res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, scoped: callerScope !== null, sessionScoped: callerSession !== null, bgNotifyFailClosed: true })}\n\n`);
         const seenTasks = new Set();
         const seenWf = new Set();
         // #3 fleet per-session scope (clay 2026-06-30): a row is visible iff it matches the caller's principal scope AND
@@ -95,8 +97,11 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             }
             return rest;
         };
+        // [2373]C-12:data 里补 `type`(=event 名)双发——代理剥 `event:` 行/onmessage 忽略具名事件时,
+        // 按 data.type 分派的客户端在本流拿到的是 undefined(approvals 流注释里的真实约束,同理适用)。
+        // 单点注入:调用方已带 type 的帧(hook_notice/bg_notification)保持原值。
         const send = (event, data) => { if (!res.writableEnded)
-            res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`); };
+            res.write(`event: ${event}\ndata: ${JSON.stringify({ type: event, ...data })}\n\n`); };
         // connect-time snapshot (filtered + scope-stripped) — the visible rows become this connection's "seen" set.
         const snap = bus.snapshot();
         const tasks = snap.tasks.filter(visT);

package/dist/http/routes/images.js

@@ -23,6 +23,12 @@ export function coarseStatusForState(state) {
         return "failed";
     return "running";
 }
+/** [2373]C-7:202 受理体的**唯一铸点**——此前四份逐字构造散在 attach/竞态重读/新建/dryRun 四臂,
+ *  下一个字段必然只加到其中两处(:213/:217 与 :193/:206 已有分叉风险)。status/state 双发保留
+ *  (status=state 的粗化像,省客户端抄映射表)。 */
+function bakeAcceptedBody(b) {
+    return { bakeId: b.bakeId, eventsUrl: `/v1/images/bakes/${b.bakeId}/events`, status: b.status, state: b.state };
+}
 /** build.sh's structured exit code → the center band-composer UI's terminal `errorCode` (§P2.14 #2). null for an
  *  uncategorized failure (then `error` free-text + `exitCode` drive the UI). 10=dup-tag, 124=timeout, 507=disk. */
 export function errorCodeForExit(exitCode, cancelled) {
@@ -168,7 +174,7 @@ async function handleImagesBody(req, res, url, ctx, miss) {
                 // (a) an IDENTICAL-argv in-flight bake ⇒ attach (idempotent re-submit, 202) — no second build.
                 const sameArgv = await bakes.findActiveByArgv(argv);
                 if (sameArgv) {
-                    sendJson(res, 202, { bakeId: sameArgv.bakeId, eventsUrl: `/v1/images/bakes/${sameArgv.bakeId}/events`, status: sameArgv.status, state: sameArgv.state });
+                    sendJson(res, 202, bakeAcceptedBody(sameArgv));
                     return;
                 }
                 // (b) M4: ATOMIC admission — the busy-check and the create are ONE DB statement (`INSERT … SELECT …
@@ -181,18 +187,18 @@ async function handleImagesBody(req, res, url, ctx, miss) {
                 if (!r.created) {
                     const sameNow = await bakes.findActiveByArgv(argv);
                     if (sameNow) {
-                        sendJson(res, 202, { bakeId: sameNow.bakeId, eventsUrl: `/v1/images/bakes/${sameNow.bakeId}/events`, status: sameNow.status, state: sameNow.state });
+                        sendJson(res, 202, bakeAcceptedBody(sameNow));
                         return;
                     }
                     const busy = await bakes.findActiveAny();
                     sendError(res, 409, "conflict.bake_in_progress", "a bake is already in progress", { ...(busy ? { activeBakeId: busy.bakeId, eventsUrl: `/v1/images/bakes/${busy.bakeId}/events` } : {}) });
                     return;
                 }
-                sendJson(res, 202, { bakeId: r.bake.bakeId, eventsUrl: `/v1/images/bakes/${r.bake.bakeId}/events`, status: r.bake.status, state: r.bake.state });
+                sendJson(res, 202, bakeAcceptedBody(r.bake));
                 return;
             }
             const { bake } = await bakes.createBake(createInput);
-            sendJson(res, 202, { bakeId: bake.bakeId, eventsUrl: `/v1/images/bakes/${bake.bakeId}/events`, status: bake.status, state: bake.state });
+            sendJson(res, 202, bakeAcceptedBody(bake));
             return;
         }
         // GET /v1/images/bakes/:bakeId/events — resumable SSE (the live "baking…" view), run-trace-SSE-shaped (§P2.2).

package/dist/http/routes/runs.js

@@ -54,6 +54,29 @@ export const RUN_TASK_OUTPUT_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/output$
 export const RUN_TASK_STOP_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/stop$/;
 /** The task_run SSE — a thin wrapper over `streamSseLog` that PRESERVES the existing wire shape exactly
  *  (`data: {type, ...data}`, `event: failed` stale frame). Behavior-identical to the pre-refactor reader. */
+/** [2373]C-5:subagent/task-handle 两读写面的**共享 authz 门**(principal→owner→session 三级,
+ *  [1493] 模型)。此前两面逐字重写——[1493] 类修复要改两次的真风险。返回 run 行;`null`=已应答
+ *  (401/404,honest 404 无存在性 oracle)。语义逐字保留:operator 双跳过(owner+session)、
+ *  session-unbound run 仅 principal 门、fail-closed。 */
+async function subagentReadGate(req, res, deps, runId) {
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && principal === undefined) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return null;
+    }
+    const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+    const run = await deps.runStore.getRun(runId);
+    if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+        sendError(res, 404, "not_found.run", "run not found");
+        return null;
+    }
+    const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
+    if (!trusted && run.sessionId && callerSession !== run.sessionId) {
+        sendError(res, 404, "not_found.run", "run not found");
+        return null;
+    }
+    return { run, trusted };
+}
 async function streamRunEvents(req, res, runStore, taskId, staleMs) {
     await streamSseLog(req, res, {
         statusOf: async (id) => {
@@ -900,44 +923,18 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.run_store_required", "subagent output reads require the run store");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-            return;
-        }
         const runId = safeDecode(subOutputMatch[1]);
         const target = safeDecode(subOutputMatch[2]);
         if (runId === null || target === null) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-            sendError(res, 404, "not_found.run", "run not found");
-            return;
-        }
-        // [1493] SESSION-scoped content read. principal answers "is this your data at all" (whose); session
-        // answers "which conversation" (which). This verb returns CONVERSATION CONTENT (a child's final body), so
-        // the principal owner-gate above is necessary but NOT sufficient: under a SHARED principal (single-user
-        // multi-shell — the default local posture, and any tenant that shares an identity) it passes for every
-        // co-principal shell, so a SIBLING session could read another conversation's child (clay's dual-shell
-        // repro). The run belongs to a conversation (run.sessionId); a non-operator caller must PROVE it owns that
-        // conversation by asserting the matching `?session=`. Threat model is ACCIDENTAL cross-read within one
-        // user's own shells (no adversary — the shell honestly reports its own session), so an honest
-        // caller-asserted session is correct AND sufficient here (no unguessable capability needed). fable5 R1
-        // (deliberate boundary, do not "harden" this into a capability): yes, a co-principal caller COULD forge the
-        // target's session — but co-principal means the SAME authz identity, i.e. the same user reading their own
-        // data through another window; session is a content-ROUTING axis inside one principal, not an authz wall.
-        // Deployments with genuinely different humans MUST give them distinct principals (requirePrincipal) — the
-        // principal owner-gate above is the security boundary, and it runs first. An
-        // operator/trace caller bypasses (as it does the owner-gate). A run with no sessionId is not
-        // conversation-bound → principal gate only. Fail-CLOSED: a session-bound run with no/mismatched assertion → 404.
-        const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
-        if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-            sendError(res, 404, "not_found.run", "run not found");
+        const gated = await subagentReadGate(req, res, deps, runId); // [2373]C-5 共享门(principal→owner→session)
+        if (!gated)
             return;
-        }
+        const { run } = gated;
+        // [1493] SESSION 边界的完整论证(threat model/为何 caller-asserted session 足够/为何不做 capability)
+        // 已随共享门挪至 subagentReadGate 注;本面语义逐字不变。
         const out = await deps.subagentTaskOutput(target, { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) });
         const details = out.details;
         // codex R1 (type gate): pollTask is the GENERIC registry face — same-tuple b*/m*/w* handles (bash
@@ -968,29 +965,19 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.run_store_required", "subagent streams require the run store");
             return;
         }
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-            return;
-        }
         const runId = safeDecode(subStreamMatch[1]);
         const target = safeDecode(subStreamMatch[2]);
         if (runId === null || target === null) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-            sendError(res, 404, "not_found.run", "run not found");
+        // [2373]C-5 共享门(principal→owner→session)——本腿此前逐字手写同三层([1493] 语义),与 output/stop
+        // 两腿并列;收编到同一函数后一次修复处处生效。判定顺序以共享门为准(与已收编的两腿现行为一致:
+        // 路径解码 400 先于 principal 401,门内三级次序不变)。
+        const gatedTail = await subagentReadGate(req, res, deps, runId);
+        if (!gatedTail)
             return;
-        }
-        // [1493] session 门(output 面同注,出生即强制——新面零消费者无软拍需要)。
-        const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
-        if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-            sendError(res, 404, "not_found.run", "run not found");
-            return;
-        }
+        const { run } = gatedTail;
         // 🔴 cli[1524] HIGH-2:**subscribe 先行,probe 在后**——原序(probe await→meta→subscribe)在
         // probe 与 subscribe 之间留竞态窗:窗内子代 settle → task_settled 发布时无订阅者被丢(总线无
         // replay/sticky)→ 订阅者只收 heartbeat 永挂。先建订阅,窗内 settle 自然落进队列;probe 判 404
@@ -1006,12 +993,16 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             return;
         }
         sseHeaders(res);
+        // [2373]C-11(5.0.0 BREAKING,提货单点名):meta 帧的 run 实体键改 `taskId`——同 verb 家族的
+        // output 面(:936/:1162)一直叫 taskId,meta 独叫 runId 是家族内第三键名;5.0.0 收一。
         // meta 声明:live 帧 replica-local + replay 指引;status=探测快照(终态=不再有帧,发 meta 即收尾,
         // cli 拿到「走 replay 面」的信号而不是空挂)。seq=stop-cycle 世代号(settle 铸;core 1.377 起
         // **全域投影**——进程内 live 臂投当前复活周期号 [[1533] ask 兑现,[1548]①],durable 终态 serve
         // 同键同义;老 core 只在 durable 臂在场,缺省容忍)。1=spawn 周期,≥2=复活周期(retained revive
         // 或 tier-3 均 bump——codex 快审 #11 纠,勿窄读成仅 tier-3)。
-        res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, runId, target, status: probeDetails.status ?? "running", ...(typeof probeDetails.seq === "number" ? { seq: probeDetails.seq } : {}), live: "replica-local", replayFace: "GET /v1/runs/:id/subagents/:handle/output" })}\n\n`);
+        // `type: "meta"` 与 `event: meta` 同名双发(tasks/trace-usage/approvals 三流同款):部分代理只转发
+        // `data:` 行,按 data.type 分派的消费端否则认不出首帧。additive,老消费端忽略未知键。
+        res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, taskId: runId, target, status: probeDetails.status ?? "running", ...(typeof probeDetails.seq === "number" ? { seq: probeDetails.seq } : {}), live: "replica-local", replayFace: "GET /v1/runs/:id/subagents/:handle/output" })}\n\n`);
         // core 1.382([1561] 提货单③):"parked" 非活非终态(durably suspended pending approval)——跟
         // running/pending 同归"还没完",tail 该继续等而不是收尾指去 replay 面(那是给真终态用的)。子代获批
         // 恢复后会在**同一条**活流上继续产帧,提前收尾会让客户端误判"已经结束",错过恢复后的后续内容。
@@ -1068,31 +1059,17 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         }
         if (stopVerb && rateLimited(req, res))
             return; // mutating, runs no model (parity with detach — rateLimited only, no quota/lease gate)
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
-            return;
-        }
         const runId = safeDecode(taskVerbMatch[1]);
         const target = safeDecode(taskVerbMatch[2]);
         if (runId === null || target === null) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-            sendError(res, 404, "not_found.run", "run not found");
+        const gatedB = await subagentReadGate(req, res, deps, runId); // [2373]C-5 共享门([1493] 模型,论证见门注)
+        if (!gatedB)
             return;
-        }
-        // SESSION-scoped content/action face ([1493] model): enforced fail-closed — same boundary rationale as
-        // subagentOutput (principal = whose data, session = which conversation; honest caller-asserted session is
-        // correct AND sufficient inside one principal; operators bypass; a session-unbound run is principal-only).
+        const { run } = gatedB;
         const q = new URL(req.url ?? "", "http://x").searchParams;
-        if (!trusted && run.sessionId && q.get("session") !== run.sessionId) {
-            sendError(res, 404, "not_found.run", "run not found");
-            return;
-        }
         const access = { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) };
         // ?filter= is REFUSED on BOTH verbs, not ignored (fail-loud 400; the face shipped unreleased, zero
         // consumers — and codex R2: a GET-only refusal would leave the stop verb silently accepting it). The

package/dist/http/routes/session-sync.d.ts

@@ -9,7 +9,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionRulesRecord } from "@sema-agent/core";
-import { type StagingHandle } from "../../session-sync.js";
+import { type StagingHandle } from "../../session-sync-kernel.js";
 import type { RouteCtx } from "../route-ctx.js";
 export type PendingStaging = {
     handle: StagingHandle;

package/dist/http/routes/session-sync.js

@@ -2,7 +2,8 @@ import { once } from "node:events";
 import { randomBytes, createHash } from "node:crypto";
 import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, SessionError, SessionPolicyError } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
-import { exportSessionManifest, classifySyncRelationshipByIds, SyncConflictError, fileSnapshotImportFace } from "../../session-sync.js";
+import { exportSessionManifest, fileSnapshotImportFace } from "../../session-sync.js";
+import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape } from "../../security.js";
 import { sendJson, sendError, msg } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";

package/dist/http/routes/tasks.js

@@ -6,7 +6,7 @@ import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-t
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -371,8 +371,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             // parentToolCallId-gated), so this sink is the ONLY path a tick reaches the top-run consumers.
                             // 1.78 (review HIGH): fan it out to the LIVE SSE too (shared whitelist+redact builder, carrying
                             // the E2 identity the shell binds concurrent ticks by) — previously it fed ONLY the fleet bus,
-                            // so the conversation lane never saw a real tick and the in-loop task_progress branch below is
-                            // forward-compat only (dead against core ≤1.208). core swallow-guards a throwing sink.
+                            // so the conversation lane never saw a real tick and the in-loop task_progress branch below was
+                            // forward-compat then — [2373]B-4:floor ^4.0.0 下它是热路径(腐注方向已翻转,勿按旧注当死支)。
+                            // core swallow-guards a throwing sink.
                             const fwdInternals = {
                                 onForwardEvent: (e) => {
                                     fleetPub?.onForwardEvent(e);
@@ -652,10 +653,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     res.write(`data: ${JSON.stringify({ type: "workspace_changed", ...workspaceChangedEventData(ev) })}\n\n`);
                                 }
                                 else if (ev.type === "compaction_outcome") {
-                                    // core 2.5.0([2105]② 披露修):压缩非 compacted 结局上流帧——白名单投影:outcome/trigger
-                                    // 闭枚举 verbatim;reason 是引擎说明文本(可能引用配置值)→ redactSecrets;identity 两键同款。
-                                    const e = ev;
-                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", outcome: e.outcome, trigger: e.trigger, ...(e.reason !== undefined ? { reason: redactSecrets(e.reason) } : {}), ...(e.eventId !== undefined ? { eventId: e.eventId } : {}), ...(e.parentToolCallId !== undefined ? { parentToolCallId: e.parentToolCallId } : {}) })}\n\n`);
+                                    // core 2.5.0([2105]②)压缩非 compacted 结局帧。[2373]C-2:内联挑键收进共享 builder,
+                                    // 与两条 durable 腿同源(它曾是唯一不走 builder 的内容帧=三方普查共同盲区)。
+                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", ...compactionOutcomeEventData(ev) })}\n\n`);
                                 }
                                 else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     // 裸 catch-all 白名单化收官(probe-wire-1 表征钉的根治半场):最后四个已知臂离开

package/dist/http/routes/trace-usage.js

@@ -242,7 +242,7 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
     sseHeaders(res);
     // First event declares the stream contract: mode + a version (council — lets the relay detect a worker whose
     // SSE shape changed, e.g. when P1 adds token-delta granularity). resumeFrom echoes the honored Last-Event-ID.
-    res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, mode: "delta", resumeFrom: from })}\n\n`);
+    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "delta", resumeFrom: from })}\n\n`); // [2373]C-12:data.type 双发与内容帧一致
     let closed = false;
     req.on("close", () => {
         closed = true;

package/dist/http/routes/workflows.js

@@ -451,7 +451,9 @@ function summarizeWorkflowDetail(run) {
  *  stream (same shape as not-found), so the caller passes the SAME scope it owner-gated with. */
 async function streamWorkflowRun(req, res, runId, scope) {
     sseHeaders(res);
-    res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, runId })}\n\n`);
+    // `type: "meta"` 与 `event: meta` 同名双发(tasks/trace-usage/approvals 三流同款):部分代理只转发
+    // `data:` 行,按 data.type 分派的消费端否则认不出首帧。additive,老消费端忽略未知键。
+    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, runId })}\n\n`);
     let closed = false;
     // subscribeWorkflow is a PUSH iterator: a parked `next()` on an idle-but-alive workflow does NOT observe a
     // `closed` flag, so a disconnected client would leave the subscriber queue registered in core's channels and

package/dist/http/server.d.ts

@@ -5,7 +5,7 @@ import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
 import { type OwnerAwareSessionStore } from "../security.js";
-import type { RunStore, ApprovalStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
+import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { LeaderEndpoint } from "../leader/endpoint.js";
@@ -25,8 +25,6 @@ import type { QuotaTracker } from "../observability/cost-quota.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import { scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { clampVerifyRounds } from "./verify-rounds.js";
-export { clampVerifyRounds };
 import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
@@ -88,8 +86,6 @@ export interface ServiceStoreDeps {
     /** E18 resume-at: the eventId→entryId anchor map (tidb/pg/local). Present whenever a backend is — resolveSpec
      *  resolves body.resumeAt(eventId)→entryId, the run lifecycle captures per-turn anchors, E21 purges them. */
     resumeAnchorStore?: ResumeAnchorStore;
-    /** Human-in-the-loop approval store (F4 poll gate). Enables /v1/approvals when present. */
-    approvalStore?: ApprovalStore;
     /** Per-session approval exemption store — enables decide body `remember:"session"` + the
      *  exemptions list/revoke surfaces on /v1/approvals. The ask-gate probe is wired separately (main.ts). */
     approvalExemptionStore?: ApprovalExemptionStore;
@@ -439,7 +435,6 @@ export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & Servi
 export type ServiceDeps = FlatServiceDeps & ServiceDepGroups;
 /** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export declare function flattenServiceDeps(deps: ServiceDeps): FlatServiceDeps;
-export type { TaskRequestBody } from "./wire-types.js";
 /** Personalization caps: server-pinned hard limits — a UI may be stricter, never looser. */
 export declare const MAX_USER_SKILLS = 10;
 /** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在