@sema-agent/server 7.114.0 → 7.115.0

package/dist/hooks/hook-runner.d.ts

@@ -1,4 +1,4 @@
-import { HooksConfig } from "@sema-agent/settings-schema/hooks";
+import { HooksConfig, type HookEventName } from "@sema-agent/settings-schema/hooks";
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";
@@ -80,6 +80,10 @@ export interface ParseHooksConfigResult {
  * 拒放集合相对 7.113.0 的一处放宽(披露在 CHANGELOG / MIGRATION):超过上限的字面别名 matcher 7.113.0 拒(当时字面判不设上限),自 7.114.0 两档都判未判、受理。
  *
  * 错误句只回显**目录里的**别名与正名(闭集字符串),不回显调用方的原字节(S-716 姿势)。
+ *
+ * 🔴 **判决是数据,句子与体的机读位同出一只铸点**(S-1025;client-core 请托,additive):{@link deadToolMatcherIssue} 回 {@link DeadToolMatcherIssue}(event / alias / canonical)
+ * 而不是句子;{@link buildDeadToolMatcherRefusal} 是**唯一**把它铸成拒句 + `field` + `detail` 的函数,受理门只取它的返回、**不解析句子**。体上多出的两键让三端不必解析英文就能把这只拒
+ * 与普通提交失败分流、提示用户改 matcher;句子逐字同 7.114.0、零新码。
  */
 /** 超此长度的 matcher 不在受理面读(两档同一个上限;未判,reason = oversize)。与 {@link MAX_HOOK_COMMAND_CHARS} 同量纲的服务侧防线:真实 matcher(精确名 / 交替 / `mcp__.*`)远在其内;目录全部工具名交替 ~0.5 KiB。 */
 export declare const MAX_MATCHER_EVAL_CHARS = 8192;
@@ -95,13 +99,35 @@ export interface MatcherEvalBudget {
     readonly budgetMs?: number;
     readonly now?: () => number;
 }
+/** 一条受理面判决(纯数据):`event` 事件下的某只 matcher 选中了退役别名 `alias`、却选不中它的正名 `canonical`。`alias` / `canonical` 恒取自 core 静态目录(闭集字符串,不含调用方原字节)。 */
+export interface DeadToolMatcherIssue {
+    readonly event: HookEventName;
+    readonly alias: string;
+    readonly canonical: string;
+}
+/** {@link buildDeadToolMatcherRefusal} 的返回(纯数据):拒句 + 400 体上的两个机读位。`field` 恒为字面 `"settings.hooks"`;`detail` 与 {@link DeadToolMatcherIssue} 同三键(逐个挑出,不 spread)。 */
+export interface DeadToolMatcherRefusal {
+    readonly message: string;
+    readonly field: "settings.hooks";
+    readonly detail: {
+        readonly event: HookEventName;
+        readonly alias: string;
+        readonly canonical: string;
+    };
+}
+/**
+ * 判决 → 拒句 + 机读位。**拒句的唯一铸点**:句子逐字 = 7.114.0 的那一句(`test/hooks-alias-matcher-s995.test.ts` R7 冻结);受理门 `admission.ts` 用返回值填 400 体,
+ * 不从句子里反解字段。
+ */
+export declare function buildDeadToolMatcherRefusal(issue: DeadToolMatcherIssue): DeadToolMatcherRefusal;
 /**
- * fresh 提交面专用判据(S-924 / S-995):配置里第一条「永远打不中」的工具事件 matcher 的拒句;没有 ⇒ undefined。
+ * fresh 提交面专用判据(S-924 / S-995):配置里第一条「永远打不中」的工具事件 matcher 的判决数据({@link DeadToolMatcherIssue});没有 ⇒ undefined。
+ * 拒句与 400 体的机读位由 {@link buildDeadToolMatcherRefusal} 从这份数据铸(S-1025)。
  * 入参是 {@link parseHooksConfig} 已校验过的配置;`depth` 由调用点按车道定(见头注:`taskHooksHonored(config) ? "regex" : "literal"`)。
  * `budget` **仅供测试注入**({@link MatcherEvalBudget});生产调用点只传前两个实参。
  * **只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。未判的 matcher 过 `recordFailOpen`(tag `MATCHER_UNJUDGED_TAG`)。
  */
-export declare function deadToolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): string | undefined;
+export declare function deadToolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): DeadToolMatcherIssue | undefined;
 /**
  * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
  * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。

package/dist/hooks/hook-runner.js

@@ -142,6 +142,13 @@ function deadAliasInMatcher(matcher, depth, budget) {
     }
     return undefined;
 }
+export function buildDeadToolMatcherRefusal(issue) {
+    return {
+        message: `settings.hooks.${issue.event}: matcher "${issue.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${issue.canonical}"`,
+        field: "settings.hooks",
+        detail: { event: issue.event, alias: issue.alias, canonical: issue.canonical },
+    };
+}
 export function deadToolMatcherIssue(config, depth, budget = {}) {
     const now = budget.now ?? (() => performance.now());
     const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
@@ -158,7 +165,7 @@ export function deadToolMatcherIssue(config, depth, budget = {}) {
                 recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
                 continue;
             }
-            return `settings.hooks.${event}: matcher "${verdict.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${verdict.canonical}"`;
+            return { event, alias: verdict.alias, canonical: verdict.canonical };
         }
     }
     return undefined;
@@ -855,6 +862,7 @@ export function createTaskHooks(config, ctx) {
             let currentInput = input;
             let rewritten = false;
             let asked;
+            let allowedFor;
             let unknownDecision = false;
             const contexts = [];
             const deadlineAt = Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000;
@@ -868,11 +876,12 @@ export function createTaskHooks(config, ctx) {
                 }
                 if (!m)
                     continue;
+                const groupInput = currentInput;
                 const payload = {
                     ...basePayload(ctx, tctx.permissionMode),
                     hook_event_name: "PreToolUse",
                     tool_name: toolName,
-                    tool_input: currentInput,
+                    tool_input: groupInput,
                     tool_use_id: tctx.toolCallId,
                 };
                 const singles = await runMatchingEntries("PreToolUse", [{ ...group, matcher: undefined }], toolName, payload, ctx, onceFired, deadlineAt, `PreToolUse:${gi}`);
@@ -913,10 +922,13 @@ export function createTaskHooks(config, ctx) {
                             asked = clip(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS);
                         }
                         if (decision === "allow" || decision === undefined) {
-                            if (h.updatedInput !== null && typeof h.updatedInput === "object") {
+                            const rewrites = h.updatedInput !== null && typeof h.updatedInput === "object";
+                            if (rewrites) {
                                 currentInput = h.updatedInput;
                                 rewritten = true;
                             }
+                            if (decision === "allow")
+                                allowedFor = { input: rewrites ? h.updatedInput : groupInput };
                         }
                         else if (decision !== "deny" && decision !== "ask") {
                             unknownDecision = true;
@@ -946,13 +958,11 @@ export function createTaskHooks(config, ctx) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (rewritten || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(rewritten ? { updatedInput: currentInput } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === currentInput)
+                return { action: "allow", ...carried };
+            if (rewritten || contexts.length > 0)
+                return carried;
             return undefined;
         };
         hooks.preToolUse = preToolUseHook;
@@ -1324,6 +1334,7 @@ export function composeHooks(deployment, task) {
             let current = input;
             const contexts = [];
             let asked;
+            let allowedFor;
             for (const slot of [d.preToolUse?.bind(d), t.preToolUse?.bind(t)]) {
                 if (!slot)
                     continue;
@@ -1343,6 +1354,10 @@ export function composeHooks(deployment, task) {
                         asked = r;
                         break;
                     case "allow":
+                        if (updatedInput !== undefined)
+                            current = updatedInput;
+                        allowedFor = { input: current };
+                        break;
                     case undefined:
                         if (updatedInput !== undefined)
                             current = updatedInput;
@@ -1362,13 +1377,11 @@ export function composeHooks(deployment, task) {
                     ...buildHookContextField(contexts),
                 };
             }
-            if (current !== input || contexts.length > 0) {
-                return {
-                    action: "allow",
-                    ...(current !== input ? { updatedInput: current } : {}),
-                    ...buildHookContextField(contexts),
-                };
-            }
+            const carried = { ...(current !== input ? { updatedInput: current } : {}), ...buildHookContextField(contexts) };
+            if (allowedFor !== undefined && allowedFor.input === current)
+                return { action: "allow", ...carried };
+            if (current !== input || contexts.length > 0)
+                return carried;
             return undefined;
         };
     }

package/dist/http/admission.js

@@ -7,7 +7,7 @@ import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
-import { deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
+import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
@@ -202,7 +202,8 @@ export function createAdmission(ctx) {
                 }
                 const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (deadMatcher !== undefined) {
-                    sendError(res, 400, "request.field_invalid", deadMatcher);
+                    const refusal = buildDeadToolMatcherRefusal(deadMatcher);
+                    sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
             }
@@ -420,6 +421,10 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "limits.budgetStreamCancel is not caller-settable here — the engine default applies (armed whenever a cost budget is present); remove it");
                 return null;
             }
+            if (l.brainCallGuardrailMs !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.brainCallGuardrailMs is not caller-settable here — the engine's default wall on a single brain call applies (one hour); remove it");
+                return null;
+            }
             for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
                 const v = l[k];
                 if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {

package/dist/http/approval-sweeps.js

@@ -7,6 +7,8 @@ import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { readinessOf, billableRefusalOf } from "./readiness.js";
+import { readResumeCtx } from "./resume-ctx-read.js";
+import { allowListReadingUnstated } from "./checkpoint-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -64,17 +66,35 @@ export function createApprovalSweeps(ctx) {
                 return false;
             }
         };
+        const allowListUnservable = async (sessionId) => {
+            const read = await readResumeCtx(cs.getCtx(sessionId));
+            if (read.kind === "corrupt")
+                return false;
+            return read.kind === "ok" && allowListReadingUnstated(read.ctx);
+        };
         let parkedSkipped = 0;
+        const allowListSkipped = [];
         for (const { sessionId } of expired) {
             if (await isParkedOwned(sessionId)) {
                 parkedSkipped += 1;
                 continue;
             }
+            if (await allowListUnservable(sessionId)) {
+                allowListSkipped.push(sessionId);
+                continue;
+            }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, ...blockedScalars(r.body) }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
+        if (allowListSkipped.length > 0) {
+            deps.logger?.warn?.("deny_sweep_allow_list_reading_skipped", {
+                count: allowListSkipped.length,
+                sessionIds: allowListSkipped,
+                note: "these expired approvals belong to tasks suspended by a server version that read settings.permissions.allow as a whitelist; this version does not replay them, so the SLA deny cannot be delivered. They stay suspended (session lock held) until the reaper collects them at their terminal time — cancel them (POST /v1/runs/:id/cancel) to release the sessions now",
+            });
+        }
     }
     async function redeemParkedAsk(req) {
         const cs = deps.checkpointStore;

package/dist/http/checkpoint-ctx.d.ts

@@ -0,0 +1,68 @@
+/**
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号** —— S-1034(7.115.0)。
+ *
+ * ## 病
+ * 7.115.0 把 `settings.permissions.allow` 从「名单」(名单外的工具一律拒)改成「allow 规则」(命中 = 带理由的放行,未命中 = 不表态、照常判)。
+ * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)——
+ * 一条在 ≤7.114.0 上停驻、体里带非空 `allow` 的行,升级后续跑就被按新读法读:名单外的工具不再被拒。持久面上的静默语义翻转(放宽方向)。
+ * 坏形 `allow`(`Task` / `mcp__figma` / `Bash(npm:*)` …)的旧行则每次续跑都 409、SLA 拒扫腿逐拍重试直到收割 —— 一张本来放不开任何门的停驻被砖化。
+ *
+ * ## 规则(一条;持久数据的「响亮拒 + 一次性迁移」,零双读)
+ * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行没有「按表态读」的记号 ⇒ 拒**。
+ * 行留停驻、字节不动(拒发生在认领之前,run 行、卡、ctx 一个字节都不写);出路 = 作为新任务重提,这条任务若还停驻着先取消(`task_done` 唤醒停驻与 workflow 宿主那条腿没有可取消的 run)。
+ * **没有**「按旧名单语义继续读」的臂:那是第二种读法,正是本规则要消灭的东西。
+ *  · 记号 = ≥7.115.0 写下的行在体里带非空 `allow` 时,ctx 上的 `permissionsAllowReading: "statement"`(闭集一词)。
+ *    写点 = 每一次**新的**持久化写({@link buildCheckpointCtx} 是它们的唯一构造口);续跑腿的写回传的是读进来的那只 ctx(或其展开),记号随行,不重新判。
+ *  · 体里没有 `allow`(或空数组 —— 7.114.0 的名单判据 `acceptedRuleList` 对空数组同样读成「没有名单」)的行不写记号、不受本规则影响。
+ *
+ * ## 判据与 7.114.0 的关系(如实)
+ * 7.114.0 只在三桶整体合法时才读名单;判据这里只看「`allow` 是非空数组」,比 7.114.0 的「名单生效」宽一格(坏桶的行 7.114.0 也不读名单)——
+ * 方向 = 多拒,不会漏拒;而坏桶的体当年就被 fresh 受理门拒在门外,盘上本不该有。
+ *
+ * ## 何时删(一次性迁移,不是长期双读)
+ * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件 = 所有 ≤7.114.0 停驻的行都已结束或被收割
+ * (停驻行的终局时刻 = 落盘起 `TERMINAL_BACKSTOP_MS`,见 `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删:
+ * 届时盘上不会再有没记号却带 `allow` 的行,而有记号的行读不读它都一样。
+ */
+import type { CheckpointCtx } from "./route-ctx.js";
+import type { TaskRequestBody } from "./wire-types.js";
+/** 读法记号的闭集(一词):这一行体里的 `settings.permissions.allow` 是按「allow 规则(表态)」写下、也该按它读的。 */
+export declare const PERMISSIONS_ALLOW_READINGS: readonly ["statement"];
+export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/**
+ * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(与 7.114.0 名单判据 `acceptedRuleList` 同一个「在」——空数组 = 没有)。
+ * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
+ */
+export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
+/**
+ * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
+ *
+ * 调用方是「本进程刚按表态读过这份体」的写点:fresh 提交(受理门按 7.115.0 读过 `allow`),或已经过了续跑拒臂的重放腿
+ * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
+ * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ */
+export declare function buildCheckpointCtx(fields: {
+    body: TaskRequestBody;
+    memoryScope?: string | undefined;
+    unattendedLeg?: true;
+}): CheckpointCtx;
+/**
+ * 本行能否被按 7.115.0 的读法重放:体里 `allow` 在生效而行上没有记号 ⇒ **不能**(`true` = 拒)。
+ * 记号的值不在闭集里(手改 / 将来的写者)⇒ 同样拒:认不得的记号不是证据。
+ */
+export declare function allowListReadingUnstated(ctx: CheckpointCtx): boolean;
+/**
+ * 拒的答复 —— 码与落点照「退役 mode-seed 行」的先例(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending;**不是**「原样重试会成功」)。
+ * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子说原因(这条任务停在 `allow` 还是名单的版本上)与出路(作为新任务重提,仍停驻的先取消;要「只许这些工具」用会话规则 `toolAllow` / 每请求 `excludeTools`)。
+ *
+ * 🔴 形是给冻结门看的(`api-error-text-freeze` 的 resume 家族收集器):`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function allowListReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
+//# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -0,0 +1,36 @@
+export const PERMISSIONS_ALLOW_READINGS = ["statement"];
+export function bodyCarriesAllowList(body) {
+    const settings = body?.settings;
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return false;
+    const permissions = settings["permissions"];
+    if (permissions === null || typeof permissions !== "object" || Array.isArray(permissions))
+        return false;
+    const allow = permissions["allow"];
+    return Array.isArray(allow) && allow.length > 0;
+}
+export function buildCheckpointCtx(fields) {
+    return {
+        body: fields.body,
+        ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
+        ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "statement" } : {}),
+    };
+}
+export function allowListReadingUnstated(ctx) {
+    if (!bodyCarriesAllowList(ctx.body))
+        return false;
+    const reading = ctx.permissionsAllowReading;
+    return !(typeof reading === "string" && PERMISSIONS_ALLOW_READINGS.includes(reading));
+}
+export function allowListReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version, which read settings.permissions.allow as a whitelist (every tool not on the list was refused); this version reads that list as a statement that the named tools are allowed, not as a whitelist, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
+    };
+}
+//# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/durable-run-leg.js

@@ -8,6 +8,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
+import { buildCheckpointCtx } from "./checkpoint-ctx.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -31,7 +32,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope });
+        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope }));
     }
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);

package/dist/http/resume-legs.js

@@ -42,6 +42,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
+import { allowListReadingRefusal, allowListReadingUnstated } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -398,7 +399,13 @@ export function createResumeLegs(ctx) {
         });
         return { spec, engineNotices };
     };
+    const refuseAllowListReading = (sessionId) => {
+        deps.logger?.warn?.("resume_refused_allow_list_reading", { sessionId, note: "this session's stored request carries settings.permissions.allow written by a server that read it as a whitelist; it is not replayed under the current reading — the task stays suspended until someone cancels it" });
+        return allowListReadingRefusal();
+    };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
+        if (allowListReadingUnstated(ctx))
+            return { ok: false, answer: refuseAllowListReading(auth.sessionId) };
         try {
             const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
@@ -1332,6 +1339,8 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
+        if (allowListReadingUnstated(ctxRead.ctx))
+            return refuse(refuseAllowListReading(sessionId));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {

package/dist/http/route-ctx.d.ts

@@ -161,6 +161,13 @@ export interface CheckpointCtx {
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;
+    /**
+     * 🔴 S-1034(7.115.0)—— 体里 `settings.permissions.allow` 的**读法记号**:在场 = 这一行是 ≥7.115.0 写下的、体里带非空 `allow`,
+     * 它按「allow 规则(表态)」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 缺席而体里带非空 `allow` = ≤7.114.0 停驻的行(那时 `allow` 是名单)⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
+     * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
+     */
+    permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/a2a-serve.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type A2ATaskState } from "@sema-agent/core";
+import type { A2ATaskState } from "@sema-agent/core";
 import type { A2aServeConfig } from "../../config-types.js";
 import { type RunRecord } from "../../plugins/store-contracts.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
@@ -69,8 +69,6 @@ export declare function a2aStateForRun(run: Pick<RunRecord, "status" | "errorCod
  * `capabilities.a2aServe` 的子串,好让 `route-shape-roster` 层E 如实认出它们。
  */
 export declare function handleA2a(req: IncomingMessage, res: ServerResponse, match: RouteMatch<A2aRpcRouteId>, ctx: RouteCtx): Promise<void>;
-/** 九词闭集的对外可见锚(测试用它证明我们只发闭集词;也让「加一个自造词」在这里就被看见)。 */
-export declare const A2A_SERVE_TASK_STATES: readonly A2ATaskState[];
 export declare const A2A_SERVE_ROUTES: readonly [{
     readonly id: "a2a-agent-card";
     readonly path: "/.well-known/agent-card.json";

package/dist/http/routes/a2a-serve.js

@@ -1,7 +1,6 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal.js";
-import { A2A_TASK_STATES } from "@sema-agent/core";
 import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
@@ -396,7 +395,6 @@ export async function handleA2a(req, res, match, ctx) {
 function sendRpc(res, body) {
     sendJson(res, 200, body);
 }
-export const A2A_SERVE_TASK_STATES = A2A_TASK_STATES;
 export const A2A_SERVE_ROUTES = [
     { id: "a2a-agent-card", path: "/.well-known/agent-card.json", methods: ["GET"] },
 ];

package/dist/http/routes/admin-memory-optout.d.ts

@@ -42,8 +42,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 export declare const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
-/** 带参口(`:principal`)⇒ 路由声明表(`http/route-table.ts`)里走 `pattern` 行,不是 `path` 行。 */
-export declare const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE: RegExp;
 export declare function handleMemoryOptOut(req: IncomingMessage, res: ServerResponse, match: RouteMatch<MemoryOptOutRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const MEMORY_OPTOUT_ROUTES: readonly [{
     readonly id: "memory-optout-grants-list";

package/dist/http/routes/admin-memory-optout.js

@@ -4,7 +4,6 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../pri
 import { assertNever } from "../route-ctx.js";
 import { memoryOptOutPrincipalShapeProblem } from "../../plugins/memory-optout-grant-store-sql.js";
 export const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
-export const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE = /^\/v1\/admin\/memory-optout\/([^/]+)$/;
 const PutBodySchema = z.object({ allow: z.boolean(), note: z.string().min(1).max(500).optional() }).strict();
 export async function handleMemoryOptOut(req, res, match, ctx) {
     const { deps } = ctx;

package/dist/http/routes/capabilities.js

@@ -122,6 +122,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
+                settings: { permissions: { allowGrant: true } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,

package/dist/http/routes/diagnostics.d.ts

@@ -32,6 +32,9 @@ export interface ServerWiringGates {
     streamAskWindowMs: PostureKnobReading<number>;
     sessionAutoTitle: PostureKnobReading<boolean>;
     checkpointStore: boolean;
+    /** 7.115.0:运维的 allow 规则(`APPROVAL_GRANT`)原样 —— 空表 = 旋钮未设。规则名是工具名不是秘密,所以本面给全名单(条数 = 长度);
+     *  本位**只**在运维面(operator-only,门在路由上),不进 `/v1/capabilities` 的客户端能力位:它说的是部署替谁表了态,不是调用方能用什么。 */
+    approvalGrant: readonly string[];
 }
 /** `buildServerWiringGates` 的入参 = 三个谓词各自的**真输入**(不接受已算好的布尔:那样这里读到的就
  *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
@@ -49,6 +52,8 @@ export interface ServerWiringGateInput {
     streamAskWindowMsSource: PostureSource;
     sessionAutoTitle: boolean;
     sessionAutoTitleSource: PostureSource;
+    /** 7.115.0:`config.approvalGrant` 本身(读面不重算)。 */
+    approvalGrant: readonly string[];
 }
 /** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个

package/dist/http/routes/diagnostics.js

@@ -35,6 +35,7 @@ export function buildServerWiringGates(input) {
             postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
         }),
         checkpointStore: input.checkpointStore !== undefined,
+        approvalGrant: [...input.approvalGrant],
     };
 }
 export function buildStaticWiringAudit(facts) {
@@ -121,6 +122,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                     streamAskWindowMsSource: deps.config.streamAskWindowMsSource,
                     sessionAutoTitle: deps.config.sessionAutoTitle === true,
                     sessionAutoTitleSource: deps.config.sessionAutoTitleSource,
+                    approvalGrant: deps.config.approvalGrant,
                 }),
             });
             return;

package/dist/http/routes/sessions.js

@@ -5,7 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";

package/dist/http/routes/tasks.js

@@ -27,6 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
+import { buildCheckpointCtx } from "../checkpoint-ctx.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
@@ -252,7 +253,7 @@ export async function handleTasks(req, res, match, ctx) {
                 let ledgerSink;
                 let ledgerTerminal = false;
                 if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
+                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope }));
                 }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
@@ -804,7 +805,7 @@ export async function handleTasks(req, res, match, ctx) {
                 }
                 commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
+                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope }));
                 }
                 const syncCancelCtrl = createRunAbort();
                 if (prepared.spec.sessionId)

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { loadConfig, type ServiceConfig } from "./config.js";
-export { composeExecutionLane, assertExecutionLaneInvariants } from "./boot/execution-lane.js";
+export { composeExecutionLane, assertExecutionLaneInvariants, type ExecutionLaneComposeCtx } from "./boot/execution-lane.js";
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
 export { createStoreBackend, type StoreBackend, type SessionCaptureRecordSource } from "./plugins/store-backend.js";

package/dist/leader/wire.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { buildCheckpointCtx } from "../http/checkpoint-ctx.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
@@ -267,7 +268,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = { body: { objective: sub.spec.objective }, unattendedLeg: true };
+            const resumeCtx = buildCheckpointCtx({ body: { objective: sub.spec.objective }, unattendedLeg: true });
             let durableSpec = {};
             if (durable) {
                 const d = durable;

package/dist/local-data-root.d.ts

@@ -4,7 +4,7 @@
  * 链(第一个非空者胜,空串视作缺席):`LOCAL_DATA_ROOT` → `CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `<home>/.ai-agent`。
  *
  * 为什么是一只**纯函数、env 与 home 都由调用方递入**:本函数有两个读者 —— 服务自己的 `loadConfig`(递 `process.env` / `os.homedir()`)与随包发的运维脚本
- * `scripts/retired-mode-seed-drain-local.mjs`(经 `dist/local-data-root.js` 取同一只函数,缺省数据根不再自抄一份链:抄本只对了一半,
+ * `scripts/drain-check-local.mjs`(经 `dist/local-data-root.js` 取同一只函数,缺省数据根不再自抄一份链:抄本只对了一半,
  * 设了 `AGENT_DATA_DIR` 的部署不带参数跑脚本会读到另一个目录并报「干净」)。纯叶、零反向依赖 ⇒ 脚本引它不会把整个服务装载起来。
  *
  * ⚠️ 与**配置根**(`configLocalRoot`:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`,不吃 `LOCAL_DATA_ROOT`)不是同一条链 —— 两根分家的那一形由

package/dist/mcp-content-origin.d.ts

@@ -19,15 +19,8 @@
  * 单向钉挡不住第二种(手滑把 `"local"` 打成 `"locale"` 只会让一个合法声明被静默拒),所以两条都要。
  */
 import type { ToolContentOrigin } from "@sema-agent/core";
-/** 编译期断言:`T` 必须收敛到 `never`(有残余 ⇒ tsc 红)。 */
-type AssertNever<T extends never> = T;
 /** core `ToolContentOrigin` 的执法副本 —— **唯一**一份(见模块头注)。 */
 export declare const CONTENT_ORIGIN_WORDS: readonly ["local", "execution", "external"];
-type ContentOriginWord = (typeof CONTENT_ORIGIN_WORDS)[number];
-type _ContentOriginCovers = AssertNever<Exclude<ToolContentOrigin, ContentOriginWord>>;
-type _ContentOriginNoStray = AssertNever<Exclude<ContentOriginWord, ToolContentOrigin>>;
-/** (占位使用,防 noUnusedLocals;类型别名零运行时。) */
-export type ContentOriginWordTableGuards = [_ContentOriginCovers, _ContentOriginNoStray];
 /**
  * 词表内?—— 两个平面共用的**那一只**谓词。
  *
@@ -38,5 +31,4 @@ export type ContentOriginWordTableGuards = [_ContentOriginCovers, _ContentOrigin
 export declare function isContentOriginWord(v: unknown): v is ToolContentOrigin;
 /** 坏值的**可打印**摘要(进 400 文案 / warn 元数据)——中和 + 截长,绝不把任意长度的调用方输入原样回显。 */
 export declare function describeBadContentOrigin(v: unknown): string;
-export {};
 //# sourceMappingURL=mcp-content-origin.d.ts.map