@sema-agent/server 7.116.1 → 7.118.0

package/dist/http/resume-legs.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 const sessionFaceUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
 };
@@ -15,7 +15,7 @@ import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -42,7 +42,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { allowListReadingRefusal, allowListReadingUnstated } from "./checkpoint-ctx.js";
+import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -274,7 +274,7 @@ export function createResumeLegs(ctx) {
         const rememberableTool = paForGrant !== undefined &&
             paForGrant.toolName &&
             paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
+            standingAnswerDurablyRecordable(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
@@ -345,6 +345,10 @@ export function createResumeLegs(ctx) {
                 void ctxPromise.catch(() => { });
                 return denyWorkflowParksUnreadable(origin);
             }
+            if (origin?.kind === "workflow_park_forked") {
+                void ctxPromise.catch(() => { });
+                return denyWorkflowParkForked(origin);
+            }
             if (origin?.kind === "workflow") {
                 void ctxPromise.catch(() => { });
                 const plan = planWorkflowParkedDecide(origin, parkedReq);
@@ -408,26 +412,21 @@ export function createResumeLegs(ctx) {
         });
         return { spec, engineNotices };
     };
-    const refuseAllowListReading = (sessionId) => {
-        deps.logger?.warn?.("resume_refused_allow_list_reading", { sessionId, note: "this session's stored request carries settings.permissions.allow written by a server that read it as a whitelist; it is not replayed under the current reading — the task stays suspended until someone cancels it" });
-        return allowListReadingRefusal();
+    const refuseStoredBodyReplay = (sessionId, refusal) => {
+        deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
+        return storedBodyReplayAnswer(refusal);
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        if (allowListReadingUnstated(ctx))
-            return { ok: false, answer: refuseAllowListReading(auth.sessionId) };
+        const replay = storedBodyReplayRefusal(ctx);
+        if (replay !== undefined)
+            return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
             const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
         }
         catch (e) {
             if (e instanceof HttpError) {
-                return {
-                    ok: false,
-                    answer: {
-                        status: 409,
-                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", blockedBy: httpErrorCode(e.status, e.code), ...(e.extra ?? {}) },
-                    },
-                };
+                return { ok: false, answer: resumeBlockedByPolicyAnswer(e.message, httpErrorCode(e.status, e.code), e.extra) };
             }
             throw e;
         }
@@ -1348,8 +1347,9 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        if (allowListReadingUnstated(ctxRead.ctx))
-            return refuse(refuseAllowListReading(sessionId));
+        const replay = storedBodyReplayRefusal(ctxRead.ctx);
+        if (replay !== undefined)
+            return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {

package/dist/http/retired-skill-manifest.d.ts

@@ -9,7 +9,7 @@
  * 「带」= 键在场、值是什么都算(`null` / 空对象同样是「我带了 manifest」)—— 与引擎的退役键表读法同形(`RETIRED_TASK_SPEC_KEYS["skills[].manifest"]`:`at !== undefined`)。
  * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
  *
- * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它,与 `checkpoint-ctx.js` 同一姿势)—— 往里加 import 要先想想脚本那一头。
+ * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它;`checkpoint-ctx.js` 7.117.0 起经 `rule-entry-list.js` 依赖引擎包根 —— 包形里有它)—— 往里加 import 要先想想脚本那一头。
  */
 /** 一条技能(提交体 `skills[]` / `agents[].skills[]` 的元素)是否还带退役的 `manifest` 键。 */
 export declare function skillCarriesRetiredManifest(skill: unknown): boolean;

package/dist/http/route-ctx.d.ts

@@ -162,9 +162,9 @@ export interface CheckpointCtx {
      */
     unattendedLeg?: true;
     /**
-     * 🔴 S-1034(7.115.0)—— 体里 `settings.permissions.allow` 的**读法记号**:在场 = 这一行是 ≥7.115.0 写下的、体里带非空 `allow`,
-     * 它按「allow 规则(表态)」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
-     * 缺席而体里带非空 `allow` = ≤7.114.0 停驻的行(那时 `allow` 是名单)⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
+     * 体里 `settings.permissions.allow` 的**读法记号**(闭集只有当前读法一词 `"allow_layer"`):在场 = 这一行是当前读法下写下的、体里带非空 `allow`,
+     * 它按「交给引擎的 allow 层」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 缺席(≤7.114.0,名单时代)或旧词 `"statement"`(7.115.0–7.116.x,表态时代)而体里带非空 `allow` ⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
      * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
      */
     permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { hostDecisionFacts } from "../../host-decision.js";
+import { hostDecisionFacts, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, standingAnswerMayRetire } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -17,7 +17,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
-import { answerGrantsBeyondCall } from "../../standing-answer-grant.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -25,10 +25,10 @@ import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -356,6 +356,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
+                    ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
+                    ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
+                    ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
                     objective,
                     input,
                 };
@@ -637,7 +640,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }");
                 return;
             }
             {
@@ -708,29 +711,22 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
-            const settledByVerdict = judgeSettledByBody(body.settledBy, decision, deps.config.directDoorActive);
-            switch (settledByVerdict.kind) {
+            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            switch (decidedByReading.kind) {
                 case "not_in_proof":
-                    sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                    sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                     return;
-                case "deny_only":
-                    sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                case "outside_closed_set":
+                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                     return;
-                case "not_string":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
-                    return;
-                case "too_wide":
-                    sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
-                    return;
-                case "absent":
                 case "accepted":
                     break;
                 default: {
-                    const unreachable = settledByVerdict;
-                    throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                    const unreachable = decidedByReading;
+                    throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
                 }
             }
-            const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+            const decidedBy = decidedByReading.decidedBy;
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -779,7 +775,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
                 try {
@@ -826,11 +822,12 @@ function redactPendingDisclosures(row) {
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
-    const rememberRefused = !standingAnswerMayRetire({
+    const rememberRefused = !standingAnswerDurablyRecordable({
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantsBeyondCall: answerGrantsBeyondCall(row),
+        grantBinding: grantBindingOf(row),
+        classes: row.classes,
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
+import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -120,7 +120,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
-                settings: { permissions: { allowGrant: true } },
+                settings: { permissions: { allowGrant: true, allowLayer: true } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -137,6 +137,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 taskAgents: deps.config.requirePrincipal !== true,
                 retainBackgroundProcesses: deps.config.requirePrincipal !== true,
                 interactiveTools: true,
+                approvalReach: true,
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
@@ -158,6 +159,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalsStreamLive: projectApprovalsStreamLiveCapability(deps),
                 streamApproval: facts.streamApproval(deps).available,
                 approvalDecisionNote: true,
+                approvalDecidedBy: true,
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),
@@ -238,7 +240,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 id: m.id,
                 provider: m.provider,
                 reasoning: m.reasoning,
-                vision: Array.isArray(m.input) ? m.input.includes("image") : false,
+                ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),

package/dist/http/routes/mcp-reconnect.d.ts

@@ -36,6 +36,23 @@
  * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
  *
+ * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
+ * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟
+ * (env `MCP_TIMEOUT`,未设落 SDK 缺省 60s;拨号之前还有一次不在那条钟里的旧连接 `close()`),一台拨不通 / 半开的远端能把这一口
+ * HTTP 请求挂很久。现在与 `GET /v1/sessions/:id/mcp` 面板读**同一只**数 `MCP_DIAL_DEADLINE_MS`(`../mcp-dial-deadline.ts`),
+ * 到点答 **503 `state.mcp_reconnect_unsettled`**。
+ * 🔴 **只界应答,不取消重拨**:core 的 `TaskStream.reconnectMcpServer(server)` 不收 `AbortSignal`(d.ts 逐字:单参),
+ * 本面没有取消把手可递,也不伪造一个。到点之后重拨**继续跑**,落定时照常把名册写上这条 run(成功)或撤走(拨号失败)—— 所以
+ * 503 说的是「这一口没等到结果」,**不是**「失败」,文案与契约 §G.7c 都按这个读法写。重发**不作保证**:core 的在途守卫
+ * (`redialsInFlight`,`dist/core/mcp.js`)只罩**拨号本身**(关旧 + 连 + 列),拨号一落定就放开,而 `redialMcpServer`
+ * (`dist/core/runner/mcp-redial.js`)随后还要 `await commitMcpRosterChanges`(重建工具面)—— 那一段里守卫已不在,
+ * 此刻再发会开第二次「先关后拨」。所以文案只说「拨号还在跑时 core 会拒第二次」,不说「重发一定得 refused」,也不把重发
+ * 推荐成探针(对抗复审 [medium],验真后采纳;守卫延到名册提交之后是 core 的活,本仓不自造第二份在途判)。
+ * 为什么是 503 而不是 200 + 第四个 `outcome` 词:`outcome` 三词是 core 结果的投影,这里**没有结果**,编一个词就是替
+ * core 说话(与 `unsupported` 那一行「没有 core 结果就不铸 `prefix`」同一条纪律);503 是 `state.*` 族的唯一状态
+ * (附录 A 判据 3),与 `state.mcp_probe_incomplete` 同族同档,但**不复用**它的码 —— 那一码的语义钉在 probe 面上。
+ * 本面**不**带 `Retry-After`:重发不是无代价的重试(见上),一个会被通用重试臂自动执行的头在一次交易动词上是错的方向。
+ *
  * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────
  * 零模型工作(不进 billable;不吃 drain / roster-pending);mutating ⇒ `rateLimited`。能力位 `mcpReconnect`
  * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。

package/dist/http/routes/mcp-reconnect.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
@@ -99,11 +100,15 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {
                 try {
-                    const result = await live.reconnectMcpServer(server);
+                    const result = await raceDeadline(live.reconnectMcpServer(server), MCP_DIAL_DEADLINE_MS);
                     sendJson(res, 200, { taskId: activeTaskId, sessionId, ...projectResult(result) });
                     return;
                 }
                 catch (e) {
+                    if (e instanceof DeadlineExceeded) {
+                        sendError(res, 503, "state.mcp_reconnect_unsettled", "the MCP re-dial did not settle within the time this endpoint waits, so there is no outcome to report — the re-dial itself was NOT cancelled (the engine takes no cancellation for it) and may still finish, so do not assume it failed; do not resend blindly either: the engine refuses a second re-dial of the same server only while the dial itself is still running, and a request sent after that point starts another close-then-dial on a server that may now be healthy, so check the server's state before re-sending");
+                        return;
+                    }
                     const code = e.code;
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {

package/dist/http/routes/memory-bundle.js

@@ -37,7 +37,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
+    if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-compliance.js

@@ -12,7 +12,7 @@ const EraseRequestSchema = z.object({
     allowUnevidenced: z.boolean().optional(),
 });
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-origin.js

@@ -54,7 +54,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
-    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);

package/dist/http/routes/runs.js

@@ -1,7 +1,7 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -14,13 +14,16 @@ import { createHash } from "node:crypto";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { ASK_DECISION_CONSUMER_ABSENT, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, outcomeOfDecidedRow, resolveStreamApprovalGate, respondSettledBy } from "../../tool-approval.js";
+import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
+import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
+import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
+import { userInputLaneOf } from "../../user-input-ledger.js";
+import { INJECTION_TIERS } from "../../trace/injection-tier.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
@@ -30,6 +33,10 @@ import { mintAndDriveDurableRun } from "../durable-run-leg.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
+import { storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "../checkpoint-ctx.js";
+const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
+const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
+const STEER_PRIORITY_CHOICES = STEER_PRIORITY_WORDS.length <= 2 ? STEER_PRIORITY_WORDS.join(" or ") : `${STEER_PRIORITY_WORDS.slice(0, -1).join(", ")}, or ${STEER_PRIORITY_WORDS[STEER_PRIORITY_WORDS.length - 1]}`;
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
 const AskDecisionActorSchema = ActorAssertionWire.strip();
@@ -45,7 +52,7 @@ const AskDecisionBodySchema = z
         .refine((k) => k.trim() === k, { message: "idempotency key must not have leading/trailing whitespace" })
         .optional(),
     actor: z.object({ label: z.string().max(ASK_ACTOR_LABEL_MAX) }).strict().optional(),
-    settledBy: z.unknown().optional(),
+    decidedBy: z.unknown().optional(),
 })
     .strict();
 const ASK_DECISION_CONFIRM_TIMEOUT_MS = 2_000;
@@ -135,11 +142,16 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
+function sendSteerReplayRefusal(res, refusal) {
+    const detail = refusal?.detail;
+    const differs = detail !== null && typeof detail === "object" ? readClosedWordSeat(detail, "differs") : undefined;
+    sendError(res, 409, "steering.duplicate_input_id", refusal instanceof Error ? refusal.message : "this steering input id was already accepted with different values", differs !== undefined ? { detail: { differs } } : undefined);
+}
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
         return undefined;
     try {
-        return await deps.userInputLedger.accept({ input: "steer", messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+        return await deps.userInputLedger.accept({ input: userInputLaneOf(at.tier), messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
     }
     catch (e) {
         deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
@@ -428,15 +440,15 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         if (typeof body.text !== "string" || body.text.length === 0) {
-            sendError(res, 400, "request.body_shape", "body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: 'now' | 'next' | 'later' }");
+            sendError(res, 400, "request.body_shape", `body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: ${STEER_PRIORITY_UNION} }`);
             return;
         }
         if (body.mode !== undefined && body.mode !== "all" && body.mode !== "one-at-a-time") {
             sendError(res, 400, "request.field_invalid", "mode must be 'all' or 'one-at-a-time' when present");
             return;
         }
-        if (body.priority !== undefined && body.priority !== "now" && body.priority !== "next" && body.priority !== "later") {
-            sendError(res, 400, "request.field_invalid", "priority must be 'now', 'next', or 'later' when present");
+        if (body.priority !== undefined && !isSystemInjectionPriority(body.priority)) {
+            sendError(res, 400, "request.field_invalid", `priority must be ${STEER_PRIORITY_CHOICES} when present`);
             return;
         }
         const text = body.text;
@@ -494,19 +506,19 @@ export async function handleRuns(req, res, match, ctx) {
                     return "queue-full";
                 }
                 if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e.message;
+                    parkDuplicateKey = e;
                     return "duplicate-key";
                 }
                 throw e;
             }
         };
         const sendQueueFull = () => sendError(res, 409, "steering.queue_full", parkQueueFull ?? "the parked steering queue on this checkpoint is full");
-        const sendDuplicateKey = () => sendError(res, 409, "steering.duplicate_input_id", parkDuplicateKey ?? "this Idempotency-Key is already parked with different steering content — reissue with a fresh key");
+        const sendDuplicateKey = () => sendSteerReplayRefusal(res, parkDuplicateKey);
         const sendParked = (status) => sendJson(res, 202, { taskId, status, delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const live = steerableRuns.get(taskId);
         if (live) {
-            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live });
+            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live, tier: priority });
             if (acceptance === "refused")
                 return;
             try {
@@ -525,7 +537,7 @@ export async function handleRuns(req, res, match, ctx) {
                     return;
                 }
                 if (code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e instanceof Error ? e.message : undefined;
+                    parkDuplicateKey = e;
                     sendDuplicateKey();
                     return;
                 }
@@ -600,7 +612,7 @@ export async function handleRuns(req, res, match, ctx) {
                         return;
                     }
                     if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                        parkDuplicateKey = e.message;
+                        parkDuplicateKey = e;
                         mintResult.duplicateKey = true;
                         return;
                     }
@@ -634,6 +646,11 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.noResumeCtx = true;
                     return;
                 }
+                const unservable = storedBodyReplayRefusal(resumeRead.ctx);
+                if (unservable !== undefined) {
+                    mintResult.unservable = unservable;
+                    return;
+                }
                 const cpScope = encodeCheckpointScope(run.owner);
                 const wakeToken = mintCheckpointToken();
                 await cs.put(wakeToken, {
@@ -688,6 +705,12 @@ export async function handleRuns(req, res, match, ctx) {
                 sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — no wake card was minted and nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
                 return;
             }
+            if (mintResult.unservable !== undefined) {
+                deps.logger?.warn?.("steer_wake_park_refused_stored_body", { taskId, sessionId: run.sessionId, ...storedBodyReplayLogFields(mintResult.unservable) });
+                const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable);
+                sendError(res, status, errorCode, error, rest);
+                return;
+            }
             if (mintResult.noResumeCtx) {
                 sendError(res, 409, "conflict.resume_context_unavailable", "run already ended and this session's resume context is gone — a steer queued now could never be delivered by POST /v1/sessions/:id/wake; submit a new task instead");
                 return;
@@ -819,7 +842,7 @@ export async function handleRuns(req, res, match, ctx) {
             });
             return;
         }
-        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream });
+        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream, tier: "now" });
         if (acceptance === "refused")
             return;
         try {
@@ -836,7 +859,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (code === "steering.duplicate_input_id") {
-                sendError(res, 409, "steering.duplicate_input_id", e instanceof Error ? e.message : "this Idempotency-Key was already accepted with different content or at a different tier — reissue with a fresh key");
+                sendSteerReplayRefusal(res, e);
                 return;
             }
             if (code !== "steering.not_running")
@@ -1209,7 +1232,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     return;
                 }
                 const messageId = uuidv7();
-                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle });
+                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle, tier: undefined });
                 if (acceptance === "refused")
                     return;
                 const marker = await relayAcceptedInput(deps, acceptance, () => handle.steer(redacted));
@@ -1349,33 +1372,26 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const parsedBody = AskDecisionBodySchema.safeParse(rawBody);
         if (!parsedBody.success) {
-            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / settledBy");
+            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / decidedBy");
             return;
         }
         const body = parsedBody.data;
-        const settledByVerdict = judgeSettledByBody(body.settledBy, body.decision, deps.config.directDoorActive);
-        switch (settledByVerdict.kind) {
+        const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+        switch (decidedByReading.kind) {
             case "not_in_proof":
-                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                 return;
-            case "deny_only":
-                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+            case "outside_closed_set":
+                sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                 return;
-            case "not_string":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
-                return;
-            case "too_wide":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
-                return;
-            case "absent":
             case "accepted":
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
-        const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+        const decidedBy = decidedByReading.decidedBy;
         const hasUpdatedInput = typeof rawBody === "object" && rawBody !== null && "updatedInput" in rawBody;
         const taskId = match.params.taskId;
         const askId = match.params.askId;
@@ -1501,6 +1517,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendTerminal(row0);
             return;
         }
+        if (policyCannotAllow(decidedBy, body.decision === "approve", storedCardDemandsAPerson(row0.cardJson))) {
+            sendError(res, 400, "request.field_conflict", POLICY_CANNOT_ALLOW_PERSON_ASK);
+            return;
+        }
         let outcome;
         const releaseEditMark = body.decision === "approve" && hasUpdatedInput ? deps.toolApproval?.markEditedDecisionInFlight(askId) : undefined;
         try {
@@ -1509,7 +1529,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 decisionActor: actor,
                 decisionNote: body.note ?? null,
                 idempotencyKey: body.idempotencyKey ?? null,
-                ...(settledBy !== undefined ? { settledBy: respondSettledBy({ settledBy }) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(decidedBy)),
                 ...(body.decision === "approve" && hasUpdatedInput ? { updatedInput: body.updatedInput } : {}),
             });
         }

package/dist/http/routes/sessions.d.ts

@@ -6,7 +6,7 @@
  *
  * 单域独占状态(lens1 §C2 的 12 条里的 5 条)全部收进 `SessionsLocal`,每个 server 实例一份:
  * SSE 连接坑计数 `sseConnections`、owner 查探许可 `sseOwnerLookups`、`/mcp` 面板的短 TTL single-flight
- * 缓存 `mcpStatusCache` 与它的两个时限常量。
+ * 缓存 `mcpStatusCache` 与它的时限常量(应答期限 `MCP_DIAL_DEADLINE_MS` 与 `POST …/mcp/reconnect` 共读,见 `../mcp-dial-deadline.ts`)。
  *
  * ⚠️ 搬运例外(仅此一处,语义等价):两个原为闭包 `let` 的计数器进了 local 盒子,于是 6 个使用点写成
  * `sse.sseConnections` / `sse.sseOwnerLookups`——`let` 无法跨模块共享自增。判据/时机/配对释放逐字未动。