@sema-agent/server 7.117.0 → 7.118.0

package/dist/http/routes/mcp-reconnect.d.ts

@@ -36,6 +36,23 @@
  * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;**不是** bare `isOperator`)。
  *
+ * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
+ * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟
+ * (env `MCP_TIMEOUT`,未设落 SDK 缺省 60s;拨号之前还有一次不在那条钟里的旧连接 `close()`),一台拨不通 / 半开的远端能把这一口
+ * HTTP 请求挂很久。现在与 `GET /v1/sessions/:id/mcp` 面板读**同一只**数 `MCP_DIAL_DEADLINE_MS`(`../mcp-dial-deadline.ts`),
+ * 到点答 **503 `state.mcp_reconnect_unsettled`**。
+ * 🔴 **只界应答,不取消重拨**:core 的 `TaskStream.reconnectMcpServer(server)` 不收 `AbortSignal`(d.ts 逐字:单参),
+ * 本面没有取消把手可递,也不伪造一个。到点之后重拨**继续跑**,落定时照常把名册写上这条 run(成功)或撤走(拨号失败)—— 所以
+ * 503 说的是「这一口没等到结果」,**不是**「失败」,文案与契约 §G.7c 都按这个读法写。重发**不作保证**:core 的在途守卫
+ * (`redialsInFlight`,`dist/core/mcp.js`)只罩**拨号本身**(关旧 + 连 + 列),拨号一落定就放开,而 `redialMcpServer`
+ * (`dist/core/runner/mcp-redial.js`)随后还要 `await commitMcpRosterChanges`(重建工具面)—— 那一段里守卫已不在,
+ * 此刻再发会开第二次「先关后拨」。所以文案只说「拨号还在跑时 core 会拒第二次」,不说「重发一定得 refused」,也不把重发
+ * 推荐成探针(对抗复审 [medium],验真后采纳;守卫延到名册提交之后是 core 的活,本仓不自造第二份在途判)。
+ * 为什么是 503 而不是 200 + 第四个 `outcome` 词:`outcome` 三词是 core 结果的投影,这里**没有结果**,编一个词就是替
+ * core 说话(与 `unsupported` 那一行「没有 core 结果就不铸 `prefix`」同一条纪律);503 是 `state.*` 族的唯一状态
+ * (附录 A 判据 3),与 `state.mcp_probe_incomplete` 同族同档,但**不复用**它的码 —— 那一码的语义钉在 probe 面上。
+ * 本面**不**带 `Retry-After`:重发不是无代价的重试(见上),一个会被通用重试臂自动执行的头在一次交易动词上是错的方向。
+ *
  * ── 计费/门 ─────────────────────────────────────────────────────────────────────────────────────
  * 零模型工作(不进 billable;不吃 drain / roster-pending);mutating ⇒ `rateLimited`。能力位 `mcpReconnect`
  * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。

package/dist/http/routes/mcp-reconnect.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
@@ -99,11 +100,15 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {
                 try {
-                    const result = await live.reconnectMcpServer(server);
+                    const result = await raceDeadline(live.reconnectMcpServer(server), MCP_DIAL_DEADLINE_MS);
                     sendJson(res, 200, { taskId: activeTaskId, sessionId, ...projectResult(result) });
                     return;
                 }
                 catch (e) {
+                    if (e instanceof DeadlineExceeded) {
+                        sendError(res, 503, "state.mcp_reconnect_unsettled", "the MCP re-dial did not settle within the time this endpoint waits, so there is no outcome to report — the re-dial itself was NOT cancelled (the engine takes no cancellation for it) and may still finish, so do not assume it failed; do not resend blindly either: the engine refuses a second re-dial of the same server only while the dial itself is still running, and a request sent after that point starts another close-then-dial on a server that may now be healthy, so check the server's state before re-sending");
+                        return;
+                    }
                     const code = e.code;
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {

package/dist/http/routes/memory-bundle.js

@@ -37,7 +37,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
+    if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-compliance.js

@@ -12,7 +12,7 @@ const EraseRequestSchema = z.object({
     allowUnevidenced: z.boolean().optional(),
 });
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }, ctx.deps.logger))
         return true;
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;

package/dist/http/routes/memory-origin.js

@@ -54,7 +54,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
-    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);

package/dist/http/routes/runs.js

@@ -1,7 +1,7 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -14,13 +14,16 @@ import { createHash } from "node:crypto";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { ASK_DECISION_CONSUMER_ABSENT, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING, SETTLED_BY_TOO_WIDE, judgeSettledByBody, outcomeOfDecidedRow, resolveStreamApprovalGate, respondSettledBy } from "../../tool-approval.js";
+import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
+import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
+import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
+import { userInputLaneOf } from "../../user-input-ledger.js";
+import { INJECTION_TIERS } from "../../trace/injection-tier.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
@@ -31,6 +34,9 @@ import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "../checkpoint-ctx.js";
+const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
+const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
+const STEER_PRIORITY_CHOICES = STEER_PRIORITY_WORDS.length <= 2 ? STEER_PRIORITY_WORDS.join(" or ") : `${STEER_PRIORITY_WORDS.slice(0, -1).join(", ")}, or ${STEER_PRIORITY_WORDS[STEER_PRIORITY_WORDS.length - 1]}`;
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
 const AskDecisionActorSchema = ActorAssertionWire.strip();
@@ -46,7 +52,7 @@ const AskDecisionBodySchema = z
         .refine((k) => k.trim() === k, { message: "idempotency key must not have leading/trailing whitespace" })
         .optional(),
     actor: z.object({ label: z.string().max(ASK_ACTOR_LABEL_MAX) }).strict().optional(),
-    settledBy: z.unknown().optional(),
+    decidedBy: z.unknown().optional(),
 })
     .strict();
 const ASK_DECISION_CONFIRM_TIMEOUT_MS = 2_000;
@@ -136,11 +142,16 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
+function sendSteerReplayRefusal(res, refusal) {
+    const detail = refusal?.detail;
+    const differs = detail !== null && typeof detail === "object" ? readClosedWordSeat(detail, "differs") : undefined;
+    sendError(res, 409, "steering.duplicate_input_id", refusal instanceof Error ? refusal.message : "this steering input id was already accepted with different values", differs !== undefined ? { detail: { differs } } : undefined);
+}
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
         return undefined;
     try {
-        return await deps.userInputLedger.accept({ input: "steer", messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+        return await deps.userInputLedger.accept({ input: userInputLaneOf(at.tier), messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
     }
     catch (e) {
         deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
@@ -429,15 +440,15 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         if (typeof body.text !== "string" || body.text.length === 0) {
-            sendError(res, 400, "request.body_shape", "body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: 'now' | 'next' | 'later' }");
+            sendError(res, 400, "request.body_shape", `body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: ${STEER_PRIORITY_UNION} }`);
             return;
         }
         if (body.mode !== undefined && body.mode !== "all" && body.mode !== "one-at-a-time") {
             sendError(res, 400, "request.field_invalid", "mode must be 'all' or 'one-at-a-time' when present");
             return;
         }
-        if (body.priority !== undefined && body.priority !== "now" && body.priority !== "next" && body.priority !== "later") {
-            sendError(res, 400, "request.field_invalid", "priority must be 'now', 'next', or 'later' when present");
+        if (body.priority !== undefined && !isSystemInjectionPriority(body.priority)) {
+            sendError(res, 400, "request.field_invalid", `priority must be ${STEER_PRIORITY_CHOICES} when present`);
             return;
         }
         const text = body.text;
@@ -495,19 +506,19 @@ export async function handleRuns(req, res, match, ctx) {
                     return "queue-full";
                 }
                 if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e.message;
+                    parkDuplicateKey = e;
                     return "duplicate-key";
                 }
                 throw e;
             }
         };
         const sendQueueFull = () => sendError(res, 409, "steering.queue_full", parkQueueFull ?? "the parked steering queue on this checkpoint is full");
-        const sendDuplicateKey = () => sendError(res, 409, "steering.duplicate_input_id", parkDuplicateKey ?? "this Idempotency-Key is already parked with different steering content — reissue with a fresh key");
+        const sendDuplicateKey = () => sendSteerReplayRefusal(res, parkDuplicateKey);
         const sendParked = (status) => sendJson(res, 202, { taskId, status, delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const live = steerableRuns.get(taskId);
         if (live) {
-            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live });
+            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live, tier: priority });
             if (acceptance === "refused")
                 return;
             try {
@@ -526,7 +537,7 @@ export async function handleRuns(req, res, match, ctx) {
                     return;
                 }
                 if (code === "steering.duplicate_input_id") {
-                    parkDuplicateKey = e instanceof Error ? e.message : undefined;
+                    parkDuplicateKey = e;
                     sendDuplicateKey();
                     return;
                 }
@@ -601,7 +612,7 @@ export async function handleRuns(req, res, match, ctx) {
                         return;
                     }
                     if (e instanceof CheckpointError && e.code === "steering.duplicate_input_id") {
-                        parkDuplicateKey = e.message;
+                        parkDuplicateKey = e;
                         mintResult.duplicateKey = true;
                         return;
                     }
@@ -831,7 +842,7 @@ export async function handleRuns(req, res, match, ctx) {
             });
             return;
         }
-        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream });
+        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream, tier: "now" });
         if (acceptance === "refused")
             return;
         try {
@@ -848,7 +859,7 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             if (code === "steering.duplicate_input_id") {
-                sendError(res, 409, "steering.duplicate_input_id", e instanceof Error ? e.message : "this Idempotency-Key was already accepted with different content or at a different tier — reissue with a fresh key");
+                sendSteerReplayRefusal(res, e);
                 return;
             }
             if (code !== "steering.not_running")
@@ -1221,7 +1232,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     return;
                 }
                 const messageId = uuidv7();
-                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle });
+                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle, tier: undefined });
                 if (acceptance === "refused")
                     return;
                 const marker = await relayAcceptedInput(deps, acceptance, () => handle.steer(redacted));
@@ -1361,33 +1372,26 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const parsedBody = AskDecisionBodySchema.safeParse(rawBody);
         if (!parsedBody.success) {
-            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / settledBy");
+            sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / decidedBy");
             return;
         }
         const body = parsedBody.data;
-        const settledByVerdict = judgeSettledByBody(body.settledBy, body.decision, deps.config.directDoorActive);
-        switch (settledByVerdict.kind) {
+        const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+        switch (decidedByReading.kind) {
             case "not_in_proof":
-                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
-                return;
-            case "deny_only":
-                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
-                return;
-            case "not_string":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
                 return;
-            case "too_wide":
-                sendError(res, 400, "request.field_invalid", SETTLED_BY_TOO_WIDE);
+            case "outside_closed_set":
+                sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
                 return;
-            case "absent":
             case "accepted":
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
-        const settledBy = settledByVerdict.kind === "accepted" ? settledByVerdict.settledBy : undefined;
+        const decidedBy = decidedByReading.decidedBy;
         const hasUpdatedInput = typeof rawBody === "object" && rawBody !== null && "updatedInput" in rawBody;
         const taskId = match.params.taskId;
         const askId = match.params.askId;
@@ -1513,6 +1517,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendTerminal(row0);
             return;
         }
+        if (policyCannotAllow(decidedBy, body.decision === "approve", storedCardDemandsAPerson(row0.cardJson))) {
+            sendError(res, 400, "request.field_conflict", POLICY_CANNOT_ALLOW_PERSON_ASK);
+            return;
+        }
         let outcome;
         const releaseEditMark = body.decision === "approve" && hasUpdatedInput ? deps.toolApproval?.markEditedDecisionInFlight(askId) : undefined;
         try {
@@ -1521,7 +1529,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 decisionActor: actor,
                 decisionNote: body.note ?? null,
                 idempotencyKey: body.idempotencyKey ?? null,
-                ...(settledBy !== undefined ? { settledBy: respondSettledBy({ settledBy }) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(decidedBy)),
                 ...(body.decision === "approve" && hasUpdatedInput ? { updatedInput: body.updatedInput } : {}),
             });
         }

package/dist/http/routes/sessions.d.ts

@@ -6,7 +6,7 @@
  *
  * 单域独占状态(lens1 §C2 的 12 条里的 5 条)全部收进 `SessionsLocal`,每个 server 实例一份:
  * SSE 连接坑计数 `sseConnections`、owner 查探许可 `sseOwnerLookups`、`/mcp` 面板的短 TTL single-flight
- * 缓存 `mcpStatusCache` 与它的两个时限常量。
+ * 缓存 `mcpStatusCache` 与它的时限常量(应答期限 `MCP_DIAL_DEADLINE_MS` 与 `POST …/mcp/reconnect` 共读,见 `../mcp-dial-deadline.ts`)。
  *
  * ⚠️ 搬运例外(仅此一处,语义等价):两个原为闭包 `let` 的计数器进了 local 盒子,于是 6 个使用点写成
  * `sse.sseConnections` / `sse.sseOwnerLookups`——`let` 无法跨模块共享自增。判据/时机/配对释放逐字未动。

package/dist/http/routes/sessions.js

@@ -4,6 +4,7 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
@@ -13,7 +14,6 @@ import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
 const MCP_STATUS_TTL_MS = 5_000;
-const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
 const A2A_MATERIALIZE_TIMEOUT_MS = 10_000;
 const MEMORY_STATUS_TTL_MS = 5_000;
@@ -154,10 +154,7 @@ export async function handleSessions(req, res, match, ctx) {
                     mcpStatusCache.clear();
                 const panel = (async () => {
                     const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations);
-                    let timer;
-                    const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), MCP_MATERIALIZE_TIMEOUT_MS); })]);
-                    if (timer)
-                        clearTimeout(timer);
+                    const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
                         void matP.then((m) => m?.dispose().catch(() => undefined)).catch(() => undefined);
                         return { servers: [], asOf: new Date().toISOString(), degraded: true };
@@ -530,7 +527,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             catch (err) {
                 const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
-                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }))
+                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }, deps.logger))
                     return;
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");

package/dist/http/routes/workflows.js

@@ -254,6 +254,8 @@ function projectParkRow(p) {
         sessionId: p.sessionId,
         originRunId: p.originRunId,
         ...(p.originUnconfirmed === true ? { originUnconfirmed: true } : {}),
+        ...(p.parkedBy !== undefined ? { parkedBy: p.parkedBy } : {}),
+        ...(p.generation !== undefined ? { generation: p.generation } : {}),
     };
 }
 function summarizeWorkflowDetail(run) {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, McpServerSpec, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, SkillSpec } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "../task-settings.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
@@ -466,6 +466,11 @@ export interface TaskRequestBody {
      *  typeof read. Declared per [ref] 件1 ([ref] boundary-must-schema): the submit chain reads this key, and an
      *  undeclared read is a bare cast the exported type cannot audit (embedders could not even write it). */
     interactiveTools?: boolean;
+    /** core 7.43.0 `TaskSpec.approvalReach`: the run declares that NOBODY on it can be asked to approve (the only word: `"none"`; closed set and
+     *  predicate are core's `APPROVAL_REACH` / `isApprovalReach`). Passed to the spec untranslated (boot/resolve-spec.ts) and to the per-leg
+     *  interactive-posture judgment (an interactive posture beside it is refused by the engine); absent ⇒ key omitted (byte-identical); an
+     *  unreadable value is a 400 on submit (admission.ts). Not checkpointed by the engine ⇒ resume legs re-supply it from the persisted body. */
+    approvalReach?: ApprovalReach;
     /** The caller's per-request settings stamp (the client-side `SemaSettings` shape). The KEY SET is deliberately
      *  NOT mirrored here — a hand-written second shape on this interface would be the classic mirror-drift form.
      *  Per-key ownership is split, not single: `parseTaskSettings` (src/task-settings.ts) defensively owns the

package/dist/memory-store-refusal.d.ts

@@ -1,18 +1,21 @@
 /**
- * core 7.31.1 #1094 —— **`memory.target_outside_store`** 在本仓的唯一读法属主(纯叶:零 http / 零 boot 依赖)。
- *
- * ## 这个码说的是什么(core `docs/wire-consumption/7.31.1.md` 逐 face 表,tag v7.31.1 亲读)
- * 记忆 store 里的一个目录经软链通到了 store **外**(或 store 根在 backend 打开 / 引擎首次挂载之后被改指)⇒ 引擎对落点在外的
- * 删 / 写 / 重放 / 自身写一律**不做**,抛普通 `Error` + `.code`(文案以码领头,点名动作、路径、解析到哪)。core 的读法原话:
- * operator 要处置的拒(去掉那只目录链),**不是**可重试的 IO 故障,也**不是**对调用方的裁决;链去掉之前重发恒拒。
+ * **店形拒**(store-form refusal)在本仓的唯一读法属主(纯叶:零 http / 零 boot 依赖)—— core 一只铸点(`layout.ts` `storeFormRefusal`)的**两码一族**:
+ *  · `memory.target_outside_store`(core 7.31.1 #1094):记忆 store 里的一个目录经软链通到了 store **外**(或 store 根在 backend 打开 / 引擎首次
+ *    挂载之后被改指)⇒ 引擎对落点在外的删 / 写 / 重放 / 自身写一律**不做**;
+ *  · `memory.scope_home_not_directory`(core 7.44.0 #1368):一只 scope home(`<memoryDir>/<label>`)不是真目录 —— 被换成软链 / 普通文件 / 特殊文件
+ *    (`detail.form` ∈ `symlink` | `file` | `other`,`lstat` 判、不跟链)。修前 core 对这一形抛不带码的 `ControlPlaneCorruptError`(与真控制面损坏同类同形),
+ *    平铺布局(条目直接住在 home 里)于是答 500,而同一换法在嵌套布局下一层答 409 —— 现在两布局同答这一码。
+ * 两码的形相同:普通 `Error` + `.code` + `.detail`(`{ path }`;home 那一码多 `form`),**句子以码领头、不含任何宿主路径**(core 7.44.0 起,
+ * 路径只在 `detail.path`)。core 的读法:operator 要处置的盘形(去掉那只链 / 放回真目录),**不是**可重试的 IO 故障,也**不是**对调用方的裁决;
+ * 盘形修好之前重发恒拒。本仓据此一条规则:两码同族、409、码原样;路径只进运维行(HTTP 映射一处,见 `http/memory-store-refusal-reply.ts`)。
  *
  * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
  *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
- *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
+ *     ⇒ {@link storeFormRefusalOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
  *     `http/memory-compliance-failure-reply.ts`(合规面两受众的那一只;会话所有者受众换固定句,S-930)。
  *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
- *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
- *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**
+ *     `memory commit refused: <码>: …` / `memory control plane refused: <码>: …`(core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字;
+ *     7.44.0 安装树 `engine.js` 两处 incident 铸点同形,home 那一码经同一只 `writeFailureText` 到这里)⇒ {@link storeFormRefusalInIncident} 只认**这两个 lead 紧跟码**
  *     的位置:lead 与码都是 core 铸的字面,路径与引用数据全在码之后。🔴 不做全文子串找(codex 一审 C2:一条真控制面损坏若在
  *     它引用的坏数据里恰好带着这串字,子串找会把它标成目录链 —— 两者运维动作相反)。不读散文、不猜语义;结构化码位
  *     (`HarvestReport.incident` / `.warnings` 带码)是向 core 索取的欠账。
@@ -20,19 +23,41 @@
  *     那几行的前缀是**条目路径**(模型可写)—— 本仓今天不读 warnings 车道(既有面,不是本批回归),也不在模型可写的文本上
  *     找码;这一半候 core 的结构化码位(登记在案,codex 一审 C3)。
  *
- * ## 不是这个码的三形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂)
- *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`;
+ * ## 不是这一族的三形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂)
+ *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`
+ *    (core 7.44.0 起 scope home 非目录**不再**走这一类 —— 它有了自己的码,见上;`ControlPlaneCorruptError` 只剩真控制面损坏);
  *  · 引擎原地写撞硬链(nlink>1)⇒ 文本 `has N names (a hard link)`、无码(KL-1094-g / #1105)⇒ 走该写点既有的失败车道(harvest
  *    warnings / 挂载失败),抛出面够不着;
  *  · 解析故障(`EACCES` / `ELOOP` / `ENOTDIR`)⇒ 以 errno 本身抛 ⇒ 路由未分类 500 + 运维 warn(`String(err)` 带 core 补救句)。
+ *
+ * ## 运维行也在这里铸(两受众同一只,{@link logStoreFormRefusal})
+ * 路径不上 wire,只进这一条运维 warn —— 它是**日志行**不是 wire 错误体,所以铸点跟读法属主住在一起(不住 `http/`:`http/` 全树门
+ * `test/error-code-key-gate.test.ts` 咬的是错误体里的 `code:` 键位,日志字段名不该借 wire 层的目录去过它)。
  */
-/** core 的码(`src/core/memory-engine/layout.ts` `TARGET_OUTSIDE_STORE`;core 不在包根导出它,本常量是它在本仓的唯一写点)。 */
+import type { Logger } from "./observability/logger.js";
+/** core 的两码(`dist/core/memory-engine/layout.js` `TARGET_OUTSIDE_STORE` / `SCOPE_HOME_NOT_DIRECTORY`;core 不在包根导出它们,这两个常量是它们在本仓的唯一写点)。 */
 export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-/** 抛出面:`err` 是这一拒 ⇒ 原样交回(已窄化成 `Error`,调用方要它的 `message`);否则 `undefined`。形 = core 的 `Error` + `.code`。 */
-export declare function targetOutsideStoreOf(err: unknown): Error | undefined;
-/** 报告面:harvest `incident` 是这一拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成链)。 */
-export declare function targetOutsideStoreInIncident(incident: {
+export declare const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+/** 店形拒族(闭集;core 加第三码 ⇒ 它落未分类 500 + 运维 warn,由人裁归不归这一族)。 */
+export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
+export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
+/** 一次店形拒的读数(纯数据)。`path` / `form` 取自 core 的 `detail`(读不出 ⇒ `undefined`,不猜、不从句子里抠)。 */
+export interface StoreFormRefusal {
+    readonly code: StoreFormRefusalCode;
+    /** core 原句(以码领头;7.44.0 起不含宿主路径)。 */
+    readonly message: string;
+    /** `detail.path`:落点 / 被改指的根 / 不是目录的 scope home —— **只给运维行**。 */
+    readonly path: string | undefined;
+    /** `detail.form`(只在 home 那一码上):原样字符串,不镜像 core 的闭集(本仓只把它写进运维行,不按它分支)。 */
+    readonly form: string | undefined;
+}
+/** 抛出面:`err` 是店形拒 ⇒ 读数;否则 `undefined`。形 = core 的 `Error` + `.code` + `.detail`。 */
+export declare function storeFormRefusalOf(err: unknown): StoreFormRefusal | undefined;
+/** 两受众共用的运维行(一处铸点):码 + core `detail` 里的宿主路径与 home 形。`logger` 缺席(只有不接 logger 的测试装配)⇒ 不落。 */
+export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusal): void;
+/** 报告面:harvest `incident` 是这一族拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成店形拒)。 */
+export declare function storeFormRefusalInIncident(incident: {
     readonly kind: string;
     readonly detail: string;
-}): typeof TARGET_OUTSIDE_STORE | undefined;
+}): StoreFormRefusalCode | undefined;
 //# sourceMappingURL=memory-store-refusal.d.ts.map

package/dist/memory-store-refusal.js

@@ -1,14 +1,33 @@
 export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export function targetOutsideStoreOf(err) {
+export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+export const STORE_FORM_REFUSAL_CODES = [TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY];
+const isStoreFormRefusalCode = (code) => typeof code === "string" && STORE_FORM_REFUSAL_CODES.includes(code);
+export function storeFormRefusalOf(err) {
     if (!(err instanceof Error))
         return undefined;
-    const { code } = err;
-    return code === TARGET_OUTSIDE_STORE ? err : undefined;
+    const { code, detail } = err;
+    if (!isStoreFormRefusalCode(code))
+        return undefined;
+    const d = typeof detail === "object" && detail !== null ? detail : {};
+    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: typeof d.form === "string" ? d.form : undefined };
+}
+export function logStoreFormRefusal(logger, refusal) {
+    logger?.warn("memory_store_form_refused", {
+        code: refusal.code,
+        ...(refusal.path !== undefined ? { path: refusal.path } : {}),
+        ...(refusal.form !== undefined ? { form: refusal.form } : {}),
+    });
 }
-const INCIDENT_PREFIXES = [`memory commit refused: ${TARGET_OUTSIDE_STORE}: `, `memory control plane refused: ${TARGET_OUTSIDE_STORE}: `];
-export function targetOutsideStoreInIncident(incident) {
+const INCIDENT_LEADS = ["memory commit refused: ", "memory control plane refused: "];
+export function storeFormRefusalInIncident(incident) {
     if (incident.kind !== "sidecar_corrupt")
         return undefined;
-    return INCIDENT_PREFIXES.some((p) => incident.detail.startsWith(p)) ? TARGET_OUTSIDE_STORE : undefined;
+    for (const lead of INCIDENT_LEADS) {
+        if (!incident.detail.startsWith(lead))
+            continue;
+        const rest = incident.detail.slice(lead.length);
+        return STORE_FORM_REFUSAL_CODES.find((code) => rest.startsWith(`${code}: `));
+    }
+    return undefined;
 }
 //# sourceMappingURL=memory-store-refusal.js.map

package/dist/model-unreachable-notice.d.ts

@@ -23,7 +23,7 @@
  * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId }` ——
  * `proxyInUse` 只在这一跳走了代理时在场,且只是**变量名**(代理地址是基础设施细节,不上租户 wire,与 `OutboundProxyError` 的
  * F3 裁定同一条)。`targetHost`(模型端点的 `host:port`)对 user 受众是**新披露的部署事实**(F7 裁定:它是部署自己声明的模型端点,
- * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下 core 终局句展开到代理根因、不含模型主机,
+ * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下终局句只带码与 `via outbound proxy (from <变量>)`、不含任何主机地址,
  * 辅助调用形下 run 可 completed、租户面本无主机句。
  */
 import type { Brain } from "@sema-agent/core";