@sema-agent/server 7.103.2 → 7.105.0

package/dist/http/resume-legs.js

@@ -2,6 +2,9 @@ import { redactErrorMessage, redactHead } from "../observability/run-terminal.js
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+const sessionFaceUnavailable = async (sessionId) => {
+    throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
+};
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
@@ -36,6 +39,7 @@ import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflic
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
+import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
     return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
@@ -258,7 +262,7 @@ export function createResumeLegs(ctx) {
                     checkpointStore: cs,
                     registry: defaultTaskRegistry,
                     reviveSurface: parkedSurface,
-                    ...(deps.sessionStorage?.ownerOf ? { sessionOwnerOf: deps.sessionStorage.ownerOf.bind(deps.sessionStorage) } : {}),
+                    sessionFaceOf: deps.sessionStorage?.sessionFaceOf ? deps.sessionStorage.sessionFaceOf.bind(deps.sessionStorage) : sessionFaceUnavailable,
                     ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
@@ -341,7 +345,7 @@ export function createResumeLegs(ctx) {
                     ok: false,
                     answer: {
                         status: 409,
-                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", blockedBy: httpErrorCode(e.status, e.code), ...(e.extra ?? {}) },
                     },
                 };
             }
@@ -908,7 +912,7 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                     else if (retriable) {
-                        await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId) : deps.runStore.setSuspended(taskId)).catch(() => undefined);
+                        await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
                         settleFleet(outcome.gate === "plan_review" ? "needs_review" : "suspended");
                     }
                     else {
@@ -973,9 +977,9 @@ export function createResumeLegs(ctx) {
         const resumePlane = outwardPlane(sealed.terminal);
         if (taskId && deps.runStore) {
             if (resumePlane.status === "suspended" || checkpointReopened)
-                await deps.runStore.setSuspended(taskId);
+                await deps.runStore.setSuspended(taskId, sealed.terminal.kind === "paused" ? sealed : null);
             else if (resumePlane.status === "needs_review")
-                await deps.runStore.setNeedsReview(taskId);
+                await deps.runStore.setNeedsReview(taskId, sealed);
             else
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }

package/dist/http/route-table.d.ts

@@ -55,7 +55,17 @@ import type { FlatServiceDeps } from "./server.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteDecl, RouteDispatchDecl, RouteMatch, RouteCtx, RouteMethod } from "./route-ctx.js";
 /** 一只域 handler 相对**全局服务凭据门**的位置。门前 = 未鉴权可达(每一只都要单独论证),门后 = 先过凭据。 */
-export type RoutePosition = "pre-credential" | "post-credential";
+/**
+ * 一行路由在全局服务凭据门的哪一侧、吃哪道门(闭集,三员;S-672 起由两员拆成三员):
+ *  · `"read-credential"` —— 门**之前**,但过**一只**读路谓词(`dispatch.ts` 的 `readCredentialOk`:部署配了 service
+ *    凭据时要「服务凭据(含只读 TRACE_TOKEN)∨ 已验 principal」,没配时与全局门同样放行)。只读路才能坐这一段:
+ *    它们在门前只为收只读 TRACE_TOKEN 单凭据的调用方,不是为了对端口全开;
+ *  · `"public"` —— 门之前、**不吃**任何凭据门:按裁定匿名可达的面(今天只有 A2A agent card,R-11「公网匿名可发现」,
+ *    零存量披露);
+ *  · `"post-credential"` —— 全局服务凭据门(+ 无凭据写门 / 排空 503 / roster-pending 503 / 破坏性会话写门)之后。
+ * 修前是 `"pre-credential" | "post-credential"` 两员:门前四族一律不吃任何门,三族只读路因此对端口全开(T-72)。
+ */
+export type RoutePosition = "read-credential" | "public" | "post-credential";
 export interface RouteRow {
     /** 域入口(`routes/*.ts` 的 `handleX`)。签名一致性是编译期钉:入口漂了形 = 编译红,不是运行时静默 404。
      *
@@ -79,9 +89,10 @@ export interface RouteRow {
     readonly enabled?: (deps: FlatServiceDeps) => boolean;
 }
 export declare const ROUTES: readonly RouteRow[];
-/** 两段(`dispatch.ts` 的分派循环各跑一段)。段内序 = 本表行序;
- *  「门前行不许出现在门后行之后」由 `test/route-order-freeze.test.ts` 钉住。 */
-export declare const PRE_CREDENTIAL_ROUTES: readonly RouteRow[];
+/** 三段(`dispatch.ts` 的分派循环按 read-credential → public → 全局门 → post-credential 各跑一段)。段内序 = 本表行序;
+ *  「三段各自连续、按这个次序排」由 `test/route-order-freeze.test.ts` 钉住。 */
+export declare const READ_CREDENTIAL_ROUTES: readonly RouteRow[];
+export declare const PUBLIC_ROUTES: readonly RouteRow[];
 export declare const POST_CREDENTIAL_ROUTES: readonly RouteRow[];
 /**
  * **探针路径**(k8s / 编排器 / 抓取器的常态高频采样):不计 admission inflight、不推活性时钟(`http/server.ts`

package/dist/http/route-table.js

@@ -38,10 +38,10 @@ function row(spec) {
     return spec;
 }
 export const ROUTES = [
-    row({ handler: handleTraceUsage, decls: TRACE_USAGE_ROUTES, position: "pre-credential", label: "trace-usage" }),
-    row({ handler: handleWorkflows, decls: WORKFLOWS_ROUTES, position: "pre-credential", label: "workflows" }),
-    row({ handler: handleFleet, decls: FLEET_ROUTES, position: "pre-credential", label: "fleet" }),
-    row({ handler: handleA2aServe, decls: A2A_SERVE_ROUTES, position: "pre-credential", label: "a2a-serve" }),
+    row({ handler: handleTraceUsage, decls: TRACE_USAGE_ROUTES, position: "read-credential", label: "trace-usage" }),
+    row({ handler: handleWorkflows, decls: WORKFLOWS_ROUTES, position: "read-credential", label: "workflows" }),
+    row({ handler: handleFleet, decls: FLEET_ROUTES, position: "read-credential", label: "fleet" }),
+    row({ handler: handleA2aServe, decls: A2A_SERVE_ROUTES, position: "public", label: "a2a-serve" }),
     row({ handler: handleCapabilities, decls: CAPABILITIES_ROUTES, position: "post-credential", label: "capabilities" }),
     row({ handler: handleSideQuery, decls: SIDE_QUERY_ROUTES, position: "post-credential", label: "side-query" }),
     row({ handler: handleTasks, decls: TASKS_ROUTES, position: "post-credential", label: "tasks" }),
@@ -78,7 +78,8 @@ export const ROUTES = [
     row({ handler: handleAttachments, decls: ATTACHMENTS_ROUTES, position: "post-credential", label: "attachments" }),
     row({ handler: handleNotifyWake, decls: NOTIFY_WAKE_ROUTES, position: "post-credential", label: "notify-wake" }),
 ];
-export const PRE_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "pre-credential");
+export const READ_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "read-credential");
+export const PUBLIC_ROUTES = ROUTES.filter((r) => r.position === "public");
 export const POST_CREDENTIAL_ROUTES = ROUTES.filter((r) => r.position === "post-credential");
 const PIPELINE_ROUTES = [
     { id: "health", path: "/health", methods: ["GET"] },

package/dist/http/routes/agents-roster.d.ts

@@ -25,10 +25,17 @@
  *  · **能力位同源**:`capabilities.agentRoster` 与这里的 501 谓词是同一个 `deps.backgroundAgentStore`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { BackgroundAgentRowSummary } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 名册窗的扫描上限(与 fleet 的终态窗同姿势:读面要有界)。窗满时回体带 `truncated:true`,
  *  `total` 于是诚实地是「窗内行数」而不是租户全量 —— 一个悄悄封顶的 total 比没有 total 更坏。 */
 export declare const ROSTER_SCAN_LIMIT = 500;
+/**
+ * 后台子代在 wire 上的 **id 投影**(唯一一只):名册行的 `handle` 与 `DELETE /v1/sessions/:id` 的 409
+ * `conflict.session_children_alive` 体里 `remaining[]` 的每一项都经它出门(S-790,裁定 2026-09-28)—— 两个面上
+ * 「同一只子代」必须是同一个串,消费方拿删除答复里的 id 才对得上名册里的行、才能去它运行的地方停它。
+ */
+export declare function rosterAgentId(row: Pick<BackgroundAgentRowSummary, "handle">): string;
 export declare function handleAgentRoster(req: IncomingMessage, res: ServerResponse, match: RouteMatch<AgentRosterRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const AGENT_ROSTER_ROUTES: readonly [{
     readonly id: "agents-roster";

package/dist/http/routes/agents-roster.js

@@ -1,4 +1,5 @@
 import { sendJson, sendError } from "../send.js";
+import { sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 export const ROSTER_SCAN_LIMIT = 500;
 const ROSTER_STATUSES = ["running", "parked", "completed", "failed", "killed"];
@@ -18,9 +19,12 @@ const ROSTER_KEY_DISPOSITION = {
     usage: "strip",
 };
 void ROSTER_KEY_DISPOSITION;
+export function rosterAgentId(row) {
+    return row.handle;
+}
 function projectRow(r) {
     return {
-        handle: r.handle,
+        handle: rosterAgentId(r),
         ...(r.name !== undefined ? { name: r.name } : {}),
         ...(r.agentType !== undefined ? { agentType: r.agentType } : {}),
         status: r.status,
@@ -56,7 +60,7 @@ export async function handleAgentRoster(req, res, match, ctx) {
         case "agents-roster": {
             const { fleetWide, gateOwner } = sessionOwnerScope(req);
             if (!fleetWide && gateOwner === null) {
-                sendError(res, 401, "auth.unauthorized", "unauthorized");
+                sendUnauthorized(res, "identity");
                 return;
             }
             const store = deps.backgroundAgentStore;

package/dist/http/routes/approvals-assistant.d.ts

@@ -3,31 +3,59 @@ import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
 import { type GovernancePosture } from "../../runtime-governance.js";
-import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
+/** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
+export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
+/** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
+export interface DecisionDoor {
+    /** 体的受理集 = 本门的 `*_BODY_DECLARED_KEYS`(那张表的双向编译期门照旧咬着它的类型)。 */
+    readonly accepted: readonly string[];
+    /** `unknown` 桶标签里的门名(「not a <这里> key — check the spelling」)。 */
+    readonly requestNoun: string;
+    /** 拒体引子里「这道门上拼错一个键最贵的后果」那半句(人读;每门一句)。 */
+    readonly costliestTypo: string;
+}
+export type DecisionDoorFamily = {
+    readonly [K in DecisionDoorId]: DecisionDoor;
+};
+/** 「名字是真的、只是不在这个体上」的三族(闭集;加第四族 = 下面 `switch` 编译红)。 */
+type NeighborFamily = "sibling_field" | "path_segment" | "submit_body";
+/** 一个邻键:它属哪一族 + 它在哪儿是真的(wire 路径,可多条)。 */
+interface NeighborKey {
+    readonly family: NeighborFamily;
+    readonly where: readonly string[];
+}
+/** 派生结果里一道门的全部判据(受理集 + 邻键表 + 两句人读)。 */
+export interface DerivedDecisionDoor {
+    readonly accepted: ReadonlySet<string>;
+    readonly neighbors: ReadonlyMap<string, NeighborKey>;
+    readonly requestNoun: string;
+    readonly costliestTypo: string;
+}
+export type DecisionDoorKeyTable = {
+    readonly [K in DecisionDoorId]: DerivedDecisionDoor;
+};
 /**
- * FRESH 决裁面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
- * 全部受理 ⇒ `null`。判据边界与孪生门(`taskBodyKeyIssue` / `taskSettingsKeyIssue`)逐字同一条:
- * **只判键名**(值形校验归各自既有的门,本门零抢话);体本身非对象 ⇒ 本门不判(留给「body must be
- * { decision … }」那道根形门,免得同一个体被两句话抢答)。
- *
- * 🔴 **重放不额外过门**,也不需要:本腿的幂等回放(`decideIdempotentReplay`)重放的是**同一次请求的同一份
- * 体**,它与首决走同一条路由、同一道门;而 checkpoint 的 resume 重建腿根本不读这个体(它读盘上的 body,
- * 走 `resolveSpec` 的宽容层)⇒ 4xx 砖不到任何存量 parked 任务。这与 tasks 面「RESUME 重放不过门」是同一条律
- * 的两种兑现方式:**门只站在人**(或客户端)**现写的那份字节**上。
+ * 回决门族的键闭集判据表 —— **唯一**的派生口(纯函数:同一份族描述 + 同一张路由表 ⇒ 同一张表)。
+ * 生产只在本模块尾调一次(路由表声明在文件尾,见 {@link DECISION_DOOR_KEY_TABLE});测试可以喂一份构造的族
+ * (「给兄弟门受理集加一个假键 ⇒ 本门的 unsupported 集自动多这一键」就是这么钉的)。
+ * 🔴 族两两不交是**前提**不是愿望:同一个键若既是某门的体字段又是某条 URL 的路径段,它的去处就有两个答案
+ * ⇒ 抛(模块加载期 = 启动即炸,不是请求期 500)。
  */
-export declare function decideBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
+export declare function deriveDecisionDoorKeyTable(family: DecisionDoorFamily, routes: readonly RouteDecl[]): DecisionDoorKeyTable;
 /**
- * FRESH 决裁面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
- * 全部受理 ⇒ `null`。判据边界与三个孪生门(`taskBodyKeyIssue` / `taskSettingsKeyIssue` /
- * {@link decideBodyKeyIssue})逐字同一条:**只判键名**(值形校验归各自既有的门,本门零抢话);体本身
- * 非对象 ⇒ 本门不判(留给「body must be { decision … }」那道根形门,免得同一个体被两句话抢答)。
+ * 回决门族**一道门**的顶层键闭集裁决:受理集之外的键 ⇒ 拒体(调用方 400 `request.body_shape`);全部受理 ⇒ `null`。
+ * 判据边界与两个孪生门(`taskBodyKeyIssue` / `taskSettingsKeyIssue`)逐字同一条:**只判键名**(值形校验归各自
+ * 既有的门,本门零抢话);体本身非对象 ⇒ 本门不判(留给「body must be { decision … }」那道根形门,免得同一个体
+ * 被两句话抢答)。
  *
- * 🔴 **重放不额外过门**,也不需要 —— 逐字同 {@link decideBodyKeyIssue} 的同名段:本腿的反重放是
- * 一次性 nonce(S-280),它守的是**同一份现写的字节**;而续跑重建读的是盘上的体、走 `resolveSpec` 的
- * 宽容层 ⇒ 4xx 砖不到任何存量挂起的任务。**门只站在人(或客户端)现写的那份字节上**。
+ * 🔴 **重放不额外过门**,也不需要:`/decide` 的幂等回放(`decideIdempotentReplay`)重放的是**同一次请求的同一份
+ * 体**、走同一条路由同一道门;plan_review 的反重放是一次性 nonce(S-280),守的也是同一份现写的字节;而续跑重建
+ * 读的是盘上的体、走 `resolveSpec` 的宽容层 ⇒ 4xx 砖不到任何存量挂起的任务。**门只站在人(或客户端)现写的
+ * 那份字节上**(与 tasks 面「RESUME 重放不过门」同一条律)。
  */
-export declare function planReviewBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
+export declare function decisionBodyKeyIssue(door: DecisionDoorId, raw: unknown, table?: DecisionDoorKeyTable): KeyClosureIssue | null;
 /**
  * S-342 —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
  *
@@ -147,4 +175,5 @@ export declare const APPROVALS_ASSISTANT_ROUTES: readonly [{
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type ApprovalsAssistantRouteId = RouteIdsOf<typeof APPROVALS_ASSISTANT_ROUTES>;
+export {};
 //# sourceMappingURL=approvals-assistant.d.ts.map

package/dist/http/routes/approvals-assistant.js

@@ -2,7 +2,7 @@ import { screenedGate } from "../../trace/project.js";
 import { hostDecisionFacts } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -27,30 +27,6 @@ const DECIDE_BODY_DECLARED_KEYS = [
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
-const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
-const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
-export function decideBodyKeyIssue(raw) {
-    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
-        return null;
-    const buckets = { unknown: [], unsupported: [] };
-    scanKeyClosure(raw, "", ACCEPTED_DECIDE_BODY, UNSUPPORTED_DECIDE_BODY, buckets);
-    if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
-        return null;
-    buckets.unknown.sort();
-    buckets.unsupported.sort();
-    const parts = [
-        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a decide-request key — check the spelling)")] : []),
-        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (a sibling approval door's field, or a path parameter — never read from this body)")] : []),
-    ];
-    return {
-        message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller ` +
-            `(a misspelled \`remember\` or \`boundInputHash\` silently turns off an exemption / the decision binding). ` +
-            `${parts.join("; ")}. ` +
-            `Accepted: ${[...ACCEPTED_DECIDE_BODY].sort().join(",")}`,
-        unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
-        unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
-    };
-}
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -71,29 +47,108 @@ function buildApprovalEnvelope(sessionId, covered, reading) {
         Object.assign(envelope, { [PROOF_SLOT_OF[key]]: reading[key] });
     return envelope;
 }
-const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
-const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
-    ...DECIDE_BODY_DECLARED_KEYS.filter((k) => !PLAN_REVIEW_BODY_DECLARED_KEYS.includes(k)),
-    "permissionMode", "sessionId", "taskId",
-]);
-export function planReviewBodyKeyIssue(raw) {
+const DECISION_DOOR_FAMILY = {
+    "approval-decide": {
+        accepted: DECIDE_BODY_DECLARED_KEYS,
+        requestNoun: "decide-request",
+        costliestTypo: "a misspelled `remember` or `boundInputHash` silently turns off an exemption / the decision binding",
+    },
+    "assistant-task-plan-review": {
+        accepted: PLAN_REVIEW_BODY_DECLARED_KEYS,
+        requestNoun: "plan-review-request",
+        costliestTypo: "a misspelled `permissionModeAfter` silently leaves this task read-only after you approved its plan",
+    },
+};
+const SUBMIT_BODY_NEAR_MISS_KEYS = ["permissionMode"];
+const SUBMIT_ENDPOINT = "POST /v1/tasks";
+function neighborLabel(n) {
+    const where = n.where.join(" / ");
+    switch (n.family) {
+        case "sibling_field":
+            return `unsupported (a body field of ${where} — send it there, this door never reads it)`;
+        case "path_segment":
+            return `unsupported (a path segment of ${where} — identity travels in the URL, never in a body)`;
+        case "submit_body":
+            return `unsupported (a submit-body key of ${where} — set when the task is submitted, this door never reads it)`;
+        default: {
+            const unreachable = n.family;
+            throw new Error(`decision-door key closure: unknown neighbor family ${String(unreachable)}`);
+        }
+    }
+}
+function doorEndpointOf(routes, id) {
+    const decl = routes.find((r) => "id" in r && r.id === id);
+    if (decl === undefined || !("pattern" in decl) || decl.label === undefined) {
+        throw new Error(`decision-door family: route "${id}" is not a labelled pattern row of the route table — the key-closure hints are derived from it`);
+    }
+    const groups = new RegExp(`${decl.pattern.source}|`, decl.pattern.flags).exec("")?.groups ?? {};
+    return { endpoint: `${decl.methods.join("|")} ${decl.label}`, pathSegments: Object.keys(groups) };
+}
+export function deriveDecisionDoorKeyTable(family, routes) {
+    const ids = Object.keys(family);
+    const endpoint = new Map(ids.map((id) => [id, doorEndpointOf(routes, id)]));
+    const collect = (pairs) => {
+        const m = new Map();
+        for (const [k, where] of pairs)
+            m.set(k, [...(m.get(k) ?? []), where]);
+        return m;
+    };
+    const siblingWhere = collect(ids.flatMap((id) => family[id].accepted.map((k) => [k, endpoint.get(id).endpoint])));
+    const pathWhere = collect(ids.flatMap((id) => endpoint.get(id).pathSegments.map((k) => [k, endpoint.get(id).endpoint])));
+    const submitWhere = collect(SUBMIT_BODY_NEAR_MISS_KEYS.map((k) => [k, SUBMIT_ENDPOINT]));
+    const sources = [
+        ["sibling_field", siblingWhere],
+        ["path_segment", pathWhere],
+        ["submit_body", submitWhere],
+    ];
+    for (let i = 0; i < sources.length; i++) {
+        for (let j = i + 1; j < sources.length; j++) {
+            const [fa, a] = sources[i];
+            const [fb, b] = sources[j];
+            const both = [...a.keys()].filter((k) => b.has(k));
+            if (both.length > 0)
+                throw new Error(`decision-door family: key(s) ${both.join(", ")} belong to both ${fa} and ${fb} — a refused key must have exactly one destination`);
+        }
+    }
+    const derive = (self) => {
+        const accepted = new Set(family[self].accepted);
+        const neighbors = new Map();
+        for (const [fam, source] of sources) {
+            for (const [k, where] of source)
+                if (!accepted.has(k))
+                    neighbors.set(k, { family: fam, where });
+        }
+        return { accepted, neighbors, requestNoun: family[self].requestNoun, costliestTypo: family[self].costliestTypo };
+    };
+    return { "approval-decide": derive("approval-decide"), "assistant-task-plan-review": derive("assistant-task-plan-review") };
+}
+export function decisionBodyKeyIssue(door, raw, table = DECISION_DOOR_KEY_TABLE) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
         return null;
+    const d = table[door];
     const buckets = { unknown: [], unsupported: [] };
-    scanKeyClosure(raw, "", ACCEPTED_PLAN_REVIEW_BODY, UNSUPPORTED_PLAN_REVIEW_BODY, buckets);
+    scanKeyClosure(raw, "", d.accepted, new Set(d.neighbors.keys()), buckets);
     if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
         return null;
     buckets.unknown.sort();
     buckets.unsupported.sort();
+    const byLabel = new Map();
+    for (const k of buckets.unsupported) {
+        const n = d.neighbors.get(k);
+        if (n === undefined)
+            throw new Error(`decision-door key closure: "${k}" was classified unsupported but has no destination`);
+        const label = neighborLabel(n);
+        byLabel.set(label, [...(byLabel.get(label) ?? []), k]);
+    }
     const parts = [
-        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, "unknown (not a plan-review-request key — check the spelling)")] : []),
-        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, "unsupported (a sibling approval door's field, a submit-body key, or a path parameter — never read from this body)")] : []),
+        ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, `unknown (not a ${d.requestNoun} key — check the spelling)`)] : []),
+        ...[...byLabel].map(([label, keys]) => keyClosureClause(keys, label)),
     ];
     return {
         message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller ` +
-            `(a misspelled \`permissionModeAfter\` silently leaves this task read-only after you approved its plan). ` +
+            `(${d.costliestTypo}). ` +
             `${parts.join("; ")}. ` +
-            `Accepted: ${[...ACCEPTED_PLAN_REVIEW_BODY].sort().join(",")}`,
+            `Accepted: ${[...d.accepted].sort().join(",")}`,
         unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
     };
@@ -437,7 +492,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             {
-                const keyIssue = planReviewBodyKeyIssue(body);
+                const keyIssue = decisionBodyKeyIssue("assistant-task-plan-review", body);
                 if (keyIssue) {
                     sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
                     return;
@@ -570,7 +625,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             {
-                const keyIssue = decideBodyKeyIssue(body);
+                const keyIssue = decisionBodyKeyIssue("approval-decide", body);
                 if (keyIssue) {
                     sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
                     return;
@@ -637,18 +692,29 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
-            if (deps.config.directDoorActive && body.settledBy !== undefined) {
-                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
-                return;
-            }
-            if (body.settledBy !== undefined && decision !== "deny") {
-                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
-                return;
-            }
-            if (body.settledBy !== undefined && typeof body.settledBy !== "string") {
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
-                return;
+            const settledByVerdict = judgeSettledByBody(body.settledBy, decision, deps.config.directDoorActive);
+            switch (settledByVerdict.kind) {
+                case "not_in_proof":
+                    sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                    return;
+                case "deny_only":
+                    sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                    return;
+                case "not_string":
+                    sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                    return;
+                case "too_wide":
+                    sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
+                    return;
+                case "absent":
+                case "accepted":
+                    break;
+                default: {
+                    const unreachable = settledByVerdict;
+                    throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                }
             }
+            const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -697,7 +763,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(body.settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {
@@ -832,4 +898,5 @@ export const APPROVALS_ASSISTANT_ROUTES = [
     { id: "assistant-task-plan-review", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/plan_review$/, label: "/v1/assistant/tasks/:id/plan_review", billable: true, methods: ["POST"] },
     { prefix: "/v1/approvals", billable: true },
 ];
+const DECISION_DOOR_KEY_TABLE = deriveDecisionDoorKeyTable(DECISION_DOOR_FAMILY, APPROVALS_ASSISTANT_ROUTES);
 //# sourceMappingURL=approvals-assistant.js.map

package/dist/http/routes/capabilities.js

@@ -1,7 +1,7 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
-import { isSealedKeyPoison } from "../../sealed-key.js";
+import { isSealedKeyPoison, projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
 import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { autonomyOverrides } from "../../runtime-governance.js";
@@ -176,7 +176,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 rewindFiles: Boolean(deps.fileHistoryStore),
                 restoreFiles: Boolean(deps.fileHistoryStore),
                 rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
-                fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore),
+                fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore, deps.config.fileHistoryCapture),
                 scheduler: Boolean(deps.config.schedulerEnabled && deps.config.requirePrincipal !== true && deps.config.remoteExec?.provider === "host"),
                 sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileHistoryStore),
                 sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
@@ -199,6 +199,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 })(),
                 manualCompact: Boolean(deps.runStore),
                 configCatalog: deps.config.configCatalogEnabled === true && deps.config.operatorPrincipals.length > 0,
+                sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
             });
             return;
         }

package/dist/http/routes/config-catalog.js

@@ -23,6 +23,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
             sendJson(res, 200, buildConfigCatalog({
                 config: deps.config,
                 env: process.env,
+                boot: { ...(deps.memoryConsolidationValve !== undefined ? { memoryConsolidationValve: deps.memoryConsolidationValve } : {}) },
                 knobs: configKnobTable(),
                 centerDomains: DOMAINS,
                 centerManagedKeys: deps.configCenterManagedKeys?.(),

package/dist/http/routes/fleet.d.ts

@@ -1,8 +1,9 @@
 /**
  * [ref] A9 域模块 —— MF-Fleet 实时舰队流。
  *
- * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**
- * (按 principal 自门,与 workflow 只读路由同列)。本域零可变状态。
+ * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**的
+ * 读路谓词段(S-672:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
+ * 与 workflow 只读路由同段)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";

package/dist/http/routes/images.js

@@ -420,7 +420,6 @@ async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
             return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
         },
         getEvents: (id, after) => bakes.getEvents(id, after),
-        retainedFrom: (id) => bakes.retainedFrom(id),
         formatEvent: (ev) => ({
             id: ev.seq,
             event: ev.kind,

package/dist/http/routes/memory-consolidation.d.ts

@@ -11,8 +11,9 @@
  *
  * ── 为什么缺席形是 **404 族**而不是 501(D4)───────────────────────────────────────────────────────
  * 本仓的 501 `capability.*` 说的是「**这家店**在本部署上不存在,换部署形态才行」(记忆引擎没接线、
- * 后端没有某个复合面)。本族不是那个形:阀门关着是一句**运维表态**(`MEMORY_CONSOLIDATION_DRIVER=off`,
- * 而且是出厂缺省),不是部署能力的缺失。而阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面
+ * 后端没有某个复合面)。本族不是那个形:阀门关着是一句**运维表态**(`MEMORY_CONSOLIDATION_DRIVER=off`),或
+ * 出厂缺省派生成关(S-824 / [ref]:未设而整理座落主模型 —— 起服时有一行提示点名 `MODEL_CHEAP_ID`),不是部署能力的
+ * 缺失。而阀门开着却结构上跑不了的三种形(引擎没接线 / 后端没有控制面
  * 归属 / provenance=off)在**启动期**就被拒了(`boot/memory-consolidation.ts` 的
  * `assertConsolidationDriverWirable`)—— 那些机器根本起不来,不会有一个"挂着的 501"去代表它们。
  * ⇒ 剩下的唯一缺席成因就是「阀门没开」,而它的诚实形是**这条路径不存在**:挂载条件写在 server.ts 的

package/dist/http/routes/memory-policy.js

@@ -2,7 +2,7 @@ import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 const ORG_PREFIX = "org:";
 export const MEMORY_EXPORT_MAX_LIMIT = 500;
@@ -68,7 +68,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
         case "memory-export": {
             const principal = gatedPrincipal(req, deps.config);
             if (!principal) {
-                sendError(res, 401, "auth.unauthorized", "unauthorized");
+                sendUnauthorized(res, "identity");
                 return;
             }
             if (deps.config.memoryEngineBackend === "file" || !deps.memoryExport) {
@@ -128,7 +128,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
         case "memory-sync-scope": {
             const principal = gatedPrincipal(req, deps.config);
             if (!principal) {
-                sendError(res, 401, "auth.unauthorized", "unauthorized");
+                sendUnauthorized(res, "identity");
                 return;
             }
             if (deps.config.memoryEngineBackend === "file" || !deps.memorySync) {

package/dist/http/routes/rules.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { sendJson, sendError, httpErrorCode } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
@@ -90,7 +90,7 @@ export async function handleRules(req, res, match, ctx) {
         return;
     const principal = gatedPrincipal(req, deps.config);
     if (principal === undefined) {
-        sendError(res, 401, "auth.unauthorized", "unauthorized");
+        sendUnauthorized(res, "identity");
         return;
     }
     const lane = deps.ruleConsent;