@sema-agent/server 5.11.0 → 5.13.0

package/dist/fleet-client.js

@@ -103,6 +103,18 @@ export class FleetUsageAccumulator {
         return this.cells.size;
     }
 }
+/** #123 F1 披露半场(§M):center 的拒绝响应体是操作员唯一的自诊线索(E2E #121:web 端明说了
+ *  「address must be a parseable http(s) base URL」而 server 日志只有 `announce 400`)——摘要进错误
+ *  信息(cap 200 字符);读体失败不改变结果面(照旧只有状态码)。 */
+async function rejectionSnippet(res) {
+    try {
+        const text = (await res.text()).slice(0, 200).trim();
+        return text ? ` — center said: ${text}` : "";
+    }
+    catch {
+        return "";
+    }
+}
 /**
  * Start the worker-side fleet loops. Caller has already gated on "center configured ∧ advertise address set"
  * (startFleetClientFromEnv below) — this function assumes a complete opts.
@@ -131,7 +143,7 @@ export function startFleetClient(opts) {
             // 半开连接钉住;心跳侧每 tick 叠一个在飞请求。
             const res = await f(`${base}/api/fleet/instances`, { method: "POST", headers, body: JSON.stringify(body), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
             if (!res.ok)
-                throw new Error(`announce ${res.status}`);
+                throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
             if (failStreak > 0)
                 opts.logger?.info("fleet_announce_recovered", { after: failStreak });
             failStreak = 0;
@@ -156,7 +168,7 @@ export function startFleetClient(opts) {
         try {
             const res = await f(`${base}/api/fleet/usage`, { method: "POST", headers, body: JSON.stringify({ reports: [report] }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
             if (!res.ok)
-                throw new Error(`usage ${res.status}`);
+                throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
         catch (err) {
             // Delivery failed → the window was never recorded center-side; carry the amounts forward (no loss, no double).
@@ -196,6 +208,19 @@ export function startFleetClientFromEnv(cfg, opts) {
     const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
     if (!cc?.baseUrl || !cc.token || !address)
         return undefined;
+    // #123 F1(E2E #121 立案):旋钮**设了但坏形** ≠ 没设——center 端要求可解析的 http(s) base URL,
+    // 坏形(如缺 scheme 的 host:port)此前静默通过,启动后 fleet 腿每拍 announce 400、worker 永不注册。
+    // env fail-loud 族判据([2443] A1 同族):这里前置响亮拒,部署在起点就失败可见,而不是带病运行。
+    let parsed;
+    try {
+        parsed = new URL(address);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
+        throw new Error(`FLEET_ADVERTISE_ADDRESS must be a parseable http(s) base URL (e.g. "http://10.0.0.5:8090"); got "${address}" — the fleet center rejects any other shape on every announce`);
+    }
     if (!cc.worker) {
         opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;

package/dist/http/server.js

@@ -1245,9 +1245,9 @@ export function createHttpServer(rawDeps) {
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
                 // remember 的 grant 闭包(onResumeCommitted 的唯一现役来源)在 parked 腿以行的 root/host
                 // 会话为锚透传([1591] 候裁② server 修——落子代会话则探针键永不相交,见 grantOnCommit 注);
-                // answer 显式 400(复审 F6)。
+                // answer 原样透传(RB-459,core 5.7.0 起 revive 侧有挂点;形状校验已在路由层 isQuestionAnswer)。
                 ...(onResumeCommitted ? { grantRemember: (rootSessionId) => onResumeCommitted(rootSessionId) } : {}),
-                ...(answer !== undefined ? { answerPresent: true } : {}),
+                ...(answer !== undefined ? { answer } : {}),
             });
             if (parked !== undefined) {
                 void ctxPromise.catch(() => { }); // 并行 ctx 读不再被消费,吞掉可能的 rejection
@@ -1342,12 +1342,11 @@ export function createHttpServer(rawDeps) {
             return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, errorCode: "request.field_conflict" } };
         }
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        // Durable ask (TC-5.4, core 1.95): the resume re-mounts AskUserQuestion with the operator's answer
-        // closure — the pending call executes against it and the model continues with "The user answered: …".
-        // This OVERRIDES the suspend-side QUESTION_AWAITS_RESUME placeholder resolveSpec just rebuilt. Absent
-        // answer ⇒ config unchanged (an F4 tool approval resumes exactly as before).
-        if (answer)
-            taskConfig.onQuestion = async () => answer;
+        // Durable ask (TC-5.4 → RB-459, core 5.7.0): the operator's answer rides the ResumeOutcome — core's
+        // answerFaceForRedeemedCall replays it to the REDEEMED question call only, so a NEW question on the
+        // resumed leg gets an honest error instead of a silently replayed stale answer (which the pre-5.7.0
+        // `onQuestion = async () => answer` closure form did). Absent answer ⇒ outcome unchanged (an F4 tool
+        // approval resumes exactly as before). The onQuestion seat is left alone.
         // D-1 decision-action binding (core 1.101, design/80 §2): echo the boundCallId + boundInputHash the operator
         // saw back into the outcome — core verifies opaque STRING equality against the persisted suspend-mint values
         // (fail-closed, PRE-CAS), so "saw action A, resolve B" is rejected. boundInputHash is NEVER recomputed here
@@ -1364,6 +1363,7 @@ export function createHttpServer(rawDeps) {
             decision: decision === "approve" ? "allow" : "deny",
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
+            ...(answer !== undefined ? { answer } : {}),
         };
         // Developer-mode verify (1.44) survives suspend/resume (core `resumeWithVerification`, design/51 P1-b): a
         // task submitted with verify:true that hit an F4 gate must STILL be gated by the adversarial verifier on

package/dist/parked-decide.d.ts

@@ -8,7 +8,7 @@
  * 判别必须 parked-first:legacy 腿的 `resumeStream` 会绕开 bg registry(无 consumeParkedFlip、
  * 行永 parked、生命周期分叉)。
  */
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, TaskRegistry, ToolSpec } from "@sema-agent/core";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, TaskRegistry, ToolSpec } from "@sema-agent/core";
 export interface ParkedAgentMatch {
     handle: string;
     row: BackgroundAgentRecord;
@@ -72,9 +72,11 @@ export interface ParkedDecideRequest {
      *  root 会话则宿主键闭包立即命中,复活子代的后续同工具 ask 被短路(探针 v2 实证),语义与同步车道/
      *  宿主任务的「本会话不再询问」一致(= host 会话树全域)。行无 root 锚(病态形)⇒ claim 前诚实 400。 */
     grantRemember?: (rootSessionId: string) => Promise<void>;
-    /** body 带了 `answer`(复审 F6):parked 腿无 onQuestion 挂点,显式 400 与 legacy 腿对同一
-     *  畸形输入的拒绝姿势对齐(legacy:「answer 仅在 approve AskUserQuestion 时合法」),不静默吞。 */
-    answerPresent?: boolean;
+    /** RB-459(core 5.7.0,F6 翻案):AskUserQuestion 的 approve 携操作员答案——原样透传进
+     *  `ResumeOutcome.answer`(形状校验在路由层 isQuestionAnswer;header 逐字匹配等语义校验在 core,
+     *  server 不预判)。core 拒绝形:同步腿 409 invalid_outcome field:"answer",parked 腿经 drive 失败
+     *  面 422 parked_resume.startup_failed。 */
+    answer?: QuestionAnswer;
     /** claim CAS 赢了(≈ legacy 腿的 markResuming 赢)之后、execute 之前触发——remember 豁免 grant
      *  的挂点(调用方自吞错,绝不抛落赎回)。claim 败/判别 miss 恒不触发。 */
     onDecideCommitted?: () => Promise<void>;

package/dist/parked-decide.js

@@ -76,15 +76,13 @@ export async function decideParkedAgent(deps, req) {
         // remember 的 grant 必须锚在 root/host 会话(探针闭包键);行无任何会话锚 = 无处可落,claim 前诚实拒。
         return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
     }
-    if (req.answerPresent === true) {
-        // 复审 F6:与 legacy 腿同姿势显式拒,不静默丢弃操作员的输入。
-        return { status: 400, body: { error: "body.answer is not supported when deciding a parked background agent (no question hookpoint on the revive path)", errorCode: "decide.parked_answer_unsupported", taskId: match.handle } };
-    }
     const pendingTool = req.pendingAction?.toolName;
-    if (pendingTool === "AskUserQuestion" && req.decision === "approve") {
-        // 复审 F1:只拦 approve(approve 必须携 answer 才有意义,而 parked 腿无 onQuestion 挂点);
-        // deny 放行走赎回(deny outcome 不需要 answer),决策面不留死角。claim 之前拒,claim 不被消费。
-        return { status: 400, body: { error: "pending action is AskUserQuestion — approve is not supported for a parked background agent (deny it, stop the agent, or let the gate expire)", errorCode: "decide.parked_question_unsupported", taskId: match.handle } };
+    if (pendingTool === "AskUserQuestion" && req.decision === "approve" && req.answer === undefined) {
+        // RB-459(core 5.7.0,F1/F6 翻案后唯一剩下的 claim 前拒):问题门的 approve 必须携 answer——
+        // parked 腿无 live answering face,core 侧同判(invalid_outcome field:"answer"),但那要消费 claim
+        // 并空跑一次 revive;这里 claim 前拒是同一判据的免损前置,不是 server 另立规则。带 answer 的
+        // approve 与任何 deny 都放行透传,core 是语义权威(header 逐字匹配等)。
+        return { status: 400, body: { error: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", errorCode: "decide.parked_answer_required", taskId: match.handle } };
     }
     if (row.name === undefined) {
         // forwardDurableApproval 只对具名子代成立,parked 行理应恒有 name;缺 = 行受损,claim 前诚实拒
@@ -135,6 +133,8 @@ export async function decideParkedAgent(deps, req) {
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
         ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        // RB-459:answer 原样透传(核不预判、不改写——header 逐字匹配/合法组合全在 core 的 resume 校验)。
+        ...(req.answer !== undefined ? { answer: req.answer } : {}),
         // B10:存在性判定,不是真值判定 —— reason 可以是空串("运维显式选择不写理由"),这与"没传 reason"
         // 是两件不同的事(姊妹 approval-hmac.ts `env.reason ?? null` 同判据:`??` 只在 null/undefined 时落
         // null,空串照样入签名载荷)。真值判定会把显式 "" 与缺席折成同一个结果,审计/签名面丢了这个区分。
@@ -200,6 +200,22 @@ export async function decideParkedAgent(deps, req) {
         // 无害 "lost"([1588] Q2 幂等核定),结果面仍诚实(操作员重查 pending 列表即可自愈)。
         const disp = await rollback("execute_rejected");
         const content = receipt.content;
+        const receiptError = receipt.details?.error;
+        if (receiptError === "parked_resume.startup_failed") {
+            // RB-459([2458] 裁定形):resume 已发起但启动即败(含 core 对 outcome.answer 的语义拒——
+            // header 不匹配/answer 配错门,invalid_outcome field:"answer" 在 drive 内抛)——422 透传 core
+            // 的码,不塌 409 revive_rejected(那是入参级早退的形)。core 已自滚,上面的补滚在 claimId CAS
+            // 下退化无害 lost(G-F5 口径),行回 parked 可再决。
+            return {
+                status: 422,
+                body: {
+                    error: typeof content === "string" ? content : "the parked resume failed during startup",
+                    errorCode: "parked_resume.startup_failed",
+                    taskId: match.handle,
+                    rollback: disp,
+                },
+            };
+        }
         return {
             status: 409,
             body: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "5.11.0",
+  "version": "5.13.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.6.0",
+    "@sema-agent/core": "^5.7.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^5.1.0",
+    "@sema-agent/sdk": "^5.2.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",