@sema-agent/server 7.120.0 → 7.122.0

package/dist/http/server.js

@@ -31,6 +31,23 @@ export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDis
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
 import { explicitOperatorOk, isOperator } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
+class DrainYieldingPreemptBook extends Map {
+    drainingNow;
+    constructor(drainingNow) {
+        super();
+        this.drainingNow = drainingNow;
+    }
+    set(taskId, ctrl) {
+        super.set(taskId, ctrl);
+        if (this.drainingNow())
+            ctrl.abort();
+        return this;
+    }
+    yieldAll() {
+        for (const ctrl of this.values())
+            ctrl.abort();
+    }
+}
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
     if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
@@ -44,7 +61,7 @@ export function createHttpServer(rawDeps) {
     }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
-    const preemptableRuns = new Map();
+    const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
@@ -58,6 +75,8 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    if (deps.drainState)
+        deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
             try {

package/dist/http/stored-body-replay.d.ts

@@ -0,0 +1,27 @@
+/**
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(三问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
+ * 三问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
+ *
+ * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
+ * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
+ * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,前两问的谓词照旧住在各自属主里。
+ */
+import { type PermissionMode } from "@sema-agent/core";
+import { type Autonomy } from "../runtime-governance.js";
+import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
+import type { CheckpointCtx } from "./route-ctx.js";
+/**
+ * 第三问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词被地板钳会变
+ * (core `clampPermissionMode`,与提交入口的盖章同一只钳)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
+ */
+export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor: PermissionMode | undefined): {
+    stored: PermissionMode | undefined;
+    floor: PermissionMode;
+} | undefined;
+/**
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 技能拒侧读成空 → 模式词读法记号(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`autonomy` = 本部署**此刻**的 `config.autonomy`(活 config:热改即生效);地板由它的唯一属主算,问点不自己算。
+ */
+export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, autonomy: Autonomy | undefined): StoredBodyReplayRefusal | undefined;
+//# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -0,0 +1,23 @@
+import { clampPermissionMode } from "@sema-agent/core";
+import { storedBodyPermissionMode } from "../task-settings.js";
+import { autonomyModeFloor } from "../runtime-governance.js";
+import { skillDenyInertEntryOf } from "../rule-entry-list.js";
+import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
+export function permissionModeReadingUnstated(ctx, floor) {
+    if (floor === undefined || permissionModeReadingStated(ctx))
+        return undefined;
+    const stored = storedBodyPermissionMode(ctx.body);
+    return clampPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
+}
+export function storedBodyReplayRefusal(ctx, autonomy) {
+    if (allowListReadingUnstated(ctx))
+        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
+    const entry = skillDenyInertEntryOf(ctx.body);
+    if (entry !== undefined)
+        return { kind: "skill_deny_inert", entry };
+    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(autonomy));
+    if (mode !== undefined)
+        return { kind: "permission_mode_reading", ...mode };
+    return undefined;
+}
+//# sourceMappingURL=stored-body-replay.js.map

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -63,6 +63,12 @@ export interface TaskRequestBody {
      *  question (raised on the board). Rejected fail-loud when `systemPrompt` is an already-assembled prompt
      *  (anchors detected) — that assembler arm cannot mount the rider (silent drop would belie the capability bit). */
     appendSystemPrompt?: string;
+    /** 7.121.0:输出风格的**每轮一句**(引擎 `TaskSpec.outputStyle`,core 7.39.0 起):原样投给引擎,引擎在每个附件周期用自己的标记帧陈述
+     *  `"<name> output style is active. <turnReminder>"`(`turnReminder` 缺席 ⇒ 引擎的缺省句),回声为 `steering_injected` `source:"output_style"`。
+     *  **一个事实一个座位**:风格的**正文**(指南全文)走 `settings.outputStyle`(折进 `appendSystemPrompt` 那一块),这里只放名字与每轮那一句;
+     *  只在非缺省风格时声明。值形的属主是引擎(`{ name, turnReminder? }` 恰两键、`name` 非空且 ≤ `OUTPUT_STYLE_NAME_MAX`、`turnReminder` 在场即非空串):
+     *  本服务**不另判**,坏值在 prepare 被引擎拒 `config.output_style_invalid`(不会被静默忽略)。能力位 `outputStyle`。 */
+    outputStyle?: TaskSpec["outputStyle"];
     /** Explicit model selection (CLI `/model` picker + `run --model <ref>`). An INTENT by catalog
      *  name (e.g. "deepseek-pro") — resolveSpec gates it against the SAME allow-list as an inline `@name` mention
      *  (config.models keys), so it picks WHICH configured model but can never inject one. Wins over an inline

package/dist/leader/leader.d.ts

@@ -15,7 +15,8 @@
 import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
-import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type PermissionMode, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type UnattendedLegSpec } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -64,7 +65,27 @@ export interface ProvisionedWorker {
      *  python3/tests → PARTIAL. Provision a read-effect exec/probe tool here so the verifier can actually verify. */
     verifierTools?: ToolSpec[];
 }
+/**
+ * 一条 leader run 的**入口体**(提交体去掉 objective 的那一半)—— 运维 `AUTONOMY` 的模式词地板在这条 run 出生的那一拍读一次、经受理门同一只盖章
+ * 盖出来的结果(`run-entry.ts` `leaderRunEntry`);地板缺席 ⇒ `{}`。leader 请求不带调用方的模式词,所以入口词就是地板本身(与 run-local 同)。
+ * 本 run 铸的每一条 spec 经 {@link withLeaderLeg} 从这一份取词;worker 的续跑体由它展开(`{ ...entry, objective }`)⇒ 首跑、续跑、修复腿同一个词。
+ * 入口词是 `plan` 的 run 进不了这条车道(`run-entry.ts` `leaderEntryRefusal`:worker 会话没有计划审阅通道)—— 受理口与出生处同判,到不了 worker。
+ * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run 保持它出生时盖下的这一份。
+ */
+export interface LeaderRunEntry {
+    readonly permissionMode?: PermissionMode;
+}
+/**
+ * leader 车道铸 spec 的**唯一**合并口:入口体的词写进 spec,再交给无人值守腿的合并口(`withUnattendedLeg` 的 `default` 钳在入口词之下)。
+ * 入口体无词 ⇒ spec 原物交给 `withUnattendedLeg`,与不经本口逐字同。本车道的 spec 自己不带模式词(子任务体只有 objective,其余并进的键是预算 / 审批 / 身份),
+ * 所以这里是「写」而不是「钳」。五个出生点(worker 首跑的工厂 / 静态两条车道、集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`
+ * (`test/leader-entry-floor.test.ts` 按语法树数调用点):「这条腿的词从哪来」只有入口体一个答案。
+ */
+export declare function withLeaderLeg<S extends Partial<TaskSpec>>(spec: S, entry: LeaderRunEntry): S & UnattendedLegSpec;
 export interface LeaderDeps {
+    /** 本 run 的入口体({@link LeaderRunEntry}:运维地板在 run 出生时盖一次)。必填:没有地板的装配写 `{}` —— 缺席不是「没有地板」的合法拼法。
+     *  模块门修复与单代理修复环这两个出生点从这里取词(经 {@link withLeaderLeg})。 */
+    entry: LeaderRunEntry;
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */

package/dist/leader/leader.js

@@ -16,6 +16,9 @@ export async function autoResumeOnResource(initial, signal, resume, maxSlices =
     }
     return vr;
 }
+export function withLeaderLeg(spec, entry) {
+    return withUnattendedLeg(entry.permissionMode === undefined ? spec : { ...spec, permissionMode: entry.permissionMode });
+}
 export async function runLeaderTask(task, durableBaseSha, deps) {
     let subs;
     try {
@@ -201,7 +204,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` })).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.entry)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.d.ts

@@ -31,7 +31,7 @@
 import { type Runner, type TaskSpec, type ExecutionEnv, type ExecStep, type OracleTier, type RepairResult, type RepairBundle, type RepairTerminal } from "@sema-agent/core";
 import { type WorkerDiff } from "./repair-oracle.js";
 import type { GraderHandle } from "./grader-env-factory.js";
-import type { LeaderDeps, ProvisionedWorker, SubtaskSpec } from "./leader.js";
+import { type LeaderDeps, type ProvisionedWorker, type SubtaskSpec } from "./leader.js";
 import type { WorkerReport } from "./fanout.js";
 /** The per-run inputs the leader's single-agent repair loop needs, resolved by the wire (§3.3). */
 export interface RepairWireCfg {

package/dist/leader/repair-wire.js

@@ -1,8 +1,8 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
+import { withLeaderLeg } from "./leader.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
-import { withUnattendedLeg } from "../unattended-permission-mode.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId });
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.entry);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/run-entry.d.ts

@@ -0,0 +1,27 @@
+/**
+ * 一条 leader run 的**入口体**与「它进不进得了 leader 车道」的唯一判据。
+ *
+ * 规则(与受理门、run-local 同一条):运维 `AUTONOMY=plan` 是提交入口的模式词地板,盖在每一个 spec 出生点。leader 请求不带调用方的模式词,
+ * 所以入口体是一份空体盖上地板(受理门同一只盖章 `task-settings.ts` `stampEntryPermissionMode`;地板的唯一属主 `runtime-governance.ts`
+ * `autonomyModeFloor`)。
+ *
+ * `plan` 是**生命周期词**:它靠人审通道(`plan_review`)出口 —— 一个人批准计划,run 才离开 plan。leader 的 worker 会话**没有**那条通道
+ * (计划审阅口按 HTTP run 行找卡,worker 会话没有 run 行;审批回决口答不是工具审批、续跑口也拒)⇒ 入口词是 `plan` 的 leader run 交出计划就停在
+ * 一张没有端点能决的卡上,写也无人可答。所以这一档在 leader 车道上**响亮拒**(fail-closed):不静默降级成别的模式、不换成只读手、不给 leader 另造审阅口。
+ *
+ * 问点两个,调同一只 {@link leaderEntryRefusal}:HTTP 受理口(`http/routes/leader.ts`,422,一条 run 都不建)与 run 出生处(`leader/wire.ts`,
+ * 受理之后才被热改成 plan 的那一窄窗,以及不经 HTTP 的调用方 —— run 以同一句拒收场,一只 worker 都不 provision)。
+ */
+import { type Autonomy } from "../runtime-governance.js";
+import type { LeaderRunEntry } from "./leader.js";
+/** 一条 leader run 的入口体:地板读一次、受理门同一只盖章(地板缺席 ⇒ `{}`)。调用方读**活** config(热改只影响之后起的 run)。 */
+export declare function leaderRunEntry(autonomy: Autonomy | undefined): LeaderRunEntry;
+/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换档)。不含任何配置值之外的回显。
+ *  受理口(HTTP 422 的 `error`)与 run 出生处(run 的 `error`)读的是这一份;字节由 `test/api-error-text-freeze.test.ts` 的常量锚格冻。 */
+export declare const LEADER_PLAN_ENTRY_REFUSAL: string;
+/**
+ * 入口词进不进得了 leader 车道 —— **唯一**判据。返回拒句;`undefined` = 进得了。闭集穷尽 switch:引擎的模式词表加一词 ⇒ 这里编译红,
+ * 逼着回答「那个词靠不靠人审通道出口」。
+ */
+export declare function leaderEntryRefusal(entry: LeaderRunEntry): string | undefined;
+//# sourceMappingURL=run-entry.d.ts.map

package/dist/leader/run-entry.js

@@ -0,0 +1,29 @@
+import { autonomyModeFloor } from "../runtime-governance.js";
+import { stampEntryPermissionMode } from "../task-settings.js";
+export function leaderRunEntry(autonomy) {
+    return stampEntryPermissionMode({}, autonomyModeFloor(autonomy));
+}
+export const LEADER_PLAN_ENTRY_REFUSAL = "this deployment runs with AUTONOMY=plan, which starts every task in plan mode and lets it out of plan mode only when a person approves its plan through plan review; " +
+    "a leader task's workers have no plan review channel, so they could neither write nor hand their plan to anyone who can approve it. Nothing was started. " +
+    "Submit the work as a run instead (POST /v1/runs, whose plan is reviewed through POST /v1/assistant/tasks/:id/plan_review), " +
+    "or ask the operator to set AUTONOMY=read-only or AUTONOMY=ask, under which leader tasks run.";
+export function leaderEntryRefusal(entry) {
+    const mode = entry.permissionMode;
+    if (mode === undefined)
+        return undefined;
+    switch (mode) {
+        case "plan":
+            return LEADER_PLAN_ENTRY_REFUSAL;
+        case "default":
+        case "acceptEdits":
+        case "auto":
+        case "bypassPermissions":
+        case "dontAsk":
+            return undefined;
+        default: {
+            const unhandled = mode;
+            throw new Error(`leader entry word "${String(unhandled)}" has no lane arm`);
+        }
+    }
+}
+//# sourceMappingURL=run-entry.js.map

package/dist/leader/wire.d.ts

@@ -1,4 +1,5 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import type { Autonomy } from "../runtime-governance.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -63,6 +64,15 @@ export interface LeaderWireConfig {
      * fail-OPEN。改成函数席之后每只 Runner 构造时现读,与主车道经 swap 门换代**同代**;已经准备好的腿
      * 保留它准备时的那一份(core 的自然快照语义,两条腿同律)。 */
     deploymentPosture?: () => DeploymentPostureSeats;
+    /**
+     * 运维 `AUTONOMY`(活 config 的那一位)—— 本车道每条 leader run **出生那一拍**读一次,经 `run-entry.ts` 的 `leaderRunEntry`(入口地板 + 受理门同一只盖章)
+     * 盖成这条 run 的入口体(`LeaderDeps.entry`);本 run 铸的每一条 spec 与 worker 的续跑体都从它取词。入口词是 `plan` 的 run 进不了这条车道
+     * (`leaderEntryRefusal`:worker 会话没有计划审阅通道)⇒ 出生处即以拒句收场;HTTP 受理口用同一只判据先答 422。
+     *
+     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 config-center 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
+     * **必填**:没有 AUTONOMY 的装配递 `() => undefined` —— 缺席不是「没有地板」的合法拼法(权限轴上不许静默放宽)。
+     */
+    autonomy: () => Autonomy | undefined;
     /**
      * [ref]([ref])—— **计费/遥测追踪席**,原样递给本车道的每一只 Runner。唯一属主 =
      * `boot/budget-tracing.ts` 的 `createTracer(...)`(主 runner / subRunner / hook runner 经共享基座吃的

package/dist/leader/wire.js

@@ -5,7 +5,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
-import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { leaderEntryRefusal, leaderRunEntry } from "./run-entry.js";
 import { buildCheckpointCtx } from "../http/checkpoint-ctx.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
@@ -14,7 +14,7 @@ import { gitSubprocessEnv } from "../server-secret-env.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
 import { buildUploadScript, buildUploadLoopScript, uploadLoopCommand, uploadLoopScriptPath, uploadStepSuffix, fetchUploadedDiff, withStaging, UPLOAD_LOOP_PERIOD_SEC } from "./diffup.js";
 import { pullDiff, safeRev } from "./diffout.js";
-import { runLeaderTask } from "./leader.js";
+import { runLeaderTask, withLeaderLeg } from "./leader.js";
 import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
@@ -171,7 +171,7 @@ export function createLeaderRunner(cfg) {
         const p = currentPrincipal();
         return p ? { principal: p } : {};
     };
-    const mkRepair = (rawEnv, repoDir, oracleFiles) => {
+    const mkRepair = (rawEnv, repoDir, oracleFiles, entry) => {
         if (repairRounds <= 0)
             return undefined;
         return {
@@ -194,12 +194,12 @@ export function createLeaderRunner(cfg) {
                         delimitUntrusted("FAILING OUTPUT (untrusted)", errorText),
                     ].join("\n");
                     const res = await runner
-                        .runTaskStream(withUnattendedLeg({
+                        .runTaskStream(withLeaderLeg({
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    }))
+                    }, entry))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -226,6 +226,10 @@ export function createLeaderRunner(cfg) {
         if (!safeRev(body.baseSha)) {
             return { ok: false, reports: [], cancelled: false, error: "baseSha must be a plain git rev (sha/branch token)" };
         }
+        const entry = leaderRunEntry(cfg.autonomy());
+        const refused = leaderEntryRefusal(entry);
+        if (refused !== undefined)
+            return { ok: false, reports: [], cancelled: false, error: refused };
         const injectOracles = async (env) => {
             const ofs = body.oracleFiles ?? [];
             if (ofs.length === 0)
@@ -268,7 +272,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = buildCheckpointCtx({ body: { objective: sub.spec.objective }, unattendedLeg: true });
+            const resumeCtx = buildCheckpointCtx({ body: { ...entry, objective: sub.spec.objective }, unattendedLeg: true });
             let durableSpec = {};
             if (durable) {
                 const d = durable;
@@ -353,7 +357,7 @@ export function createLeaderRunner(cfg) {
                         },
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }),
+                    spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, resumeCtx.body),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -368,7 +372,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }),
+                spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeCtx.body),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -386,7 +390,7 @@ export function createLeaderRunner(cfg) {
                 }
                 const rawEnv = env;
                 const oracleFiles = body.oracleFiles ?? [];
-                const repair = mkRepair(rawEnv, repo, oracleFiles);
+                const repair = mkRepair(rawEnv, repo, oracleFiles, entry);
                 return { env: asIntegrationEnv(env), destroy: reap, ...(repair ? { repair } : {}) };
             }
             if (!cfg.e2bApiKey)
@@ -404,10 +408,11 @@ export function createLeaderRunner(cfg) {
                 await env.destroy().catch(() => { });
                 throw e;
             }
-            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}) };
+            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? [], entry) ? { repair: mkRepair(env, repo, body.oracleFiles ?? [], entry) } : {}) };
         };
         const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
+            entry,
             plan,
             provisionWorker,
             provisionIntegrationSandbox,

package/dist/model-reach-scope.d.ts

@@ -3,7 +3,8 @@
  *
  * 两层,一只 `AsyncLocalStorage`:
  *  · **腿层**(`withModelReachScope`,三条带用户面投递口的 run 腿各包一次:流式 `POST /v1/tasks/stream`、后台 `POST /v1/runs`、续跑):
- *    带着这条腿的 `sessionId`(通告归属键)与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
+ *    带着这条腿的两枚身份 —— `sessionId`(通告归属键)与 `taskId`(这条腿的 run 资源 id,= 本腿交给引擎的 `spec.taskId`;7.121.0)——
+ *    与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
  *  · **调用层**(`createModelReachBrain` 每次模型调用包一次):一只可变的 {@link ModelCallReach},出网观察者
  *    (`outbound-dispatcher.ts` 的 undici 诊断通道订阅)把这次调用发出的每一条请求的**结局**记在上面 —— 最后一条是
  *    「连上了、有了回答」还是「建连就失败了」。
@@ -33,6 +34,12 @@ export interface ModelCallReach {
 /** 一条 run 腿的作用域。 */
 export interface ModelReachLegScope {
     readonly sessionId: string;
+    /**
+     * 7.121.0:这条腿的 **run 资源 id** —— 与本腿交给引擎的 `spec.taskId` 同值(流式腿 = `X-Task-Id` / `meta.taskId`,后台腿 = 提交回执的
+     * `taskId`,续跑腿 = 被续的那条 run 行 id)。缺席 = 这条腿没有 run 资源(没有 run 店的部署上的流式腿)。不是引擎的 run 身份
+     * (`TaskResult.runId`,每次 prepare 一铸)—— 那一枚在模型调用这一层读不到。
+     */
+    readonly taskId?: string;
     /** 本腿已经通告过的目标(`targetHost`)—— 去重单位 = 每腿每目标一次。 */
     readonly announced: Set<string>;
 }
@@ -43,9 +50,14 @@ export interface ModelReachStore {
 export declare const modelReachContext: AsyncLocalStorage<ModelReachStore>;
 /**
  * 腿层入口:每条腿都开**自己的**作用域 —— `sessionId` 缺席(无会话腿)⇒ 空作用域(没有归属键就没有用户面可投;也不继承外层腿的
- * 归属键 —— codex r1 旁注:修前缺席即原样执行、会沿用外层腿)。嵌套时内层覆盖外层 —— 归属跟着「这一轮是谁的腿」走。
+ * 归属键 —— codex r1 旁注:修前缺席即原样执行、会沿用外层腿)。嵌套时内层覆盖外层 —— 归属跟着「这一轮是谁的腿」走,两枚身份一起走
+ * (内层没有 run 资源就是没有,不借外层的)。两键都是**必填形参**(值可 `undefined`):三个调用点各自说清这条腿有没有 run 资源,
+ * 漏传一枚 = 编译红,不会静默变成「没有」。
  */
-export declare function withModelReachScope<T>(sessionId: string | undefined, fn: () => T): T;
+export declare function withModelReachScope<T>(leg: {
+    readonly sessionId: string | undefined;
+    readonly taskId: string | undefined;
+}, fn: () => T): T;
 /** 调用层入口(`createModelReachBrain` 用):在当前腿作用域(可能缺席)之上开一只新的调用观察。 */
 export declare function withModelCallReach<T>(call: ModelCallReach, fn: () => T): T;
 /** 观察者读口:当前异步上下文里的模型调用观察(作用域外 ⇒ `undefined`)。 */

package/dist/model-reach-scope.js

@@ -1,7 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 export const modelReachContext = new AsyncLocalStorage();
-export function withModelReachScope(sessionId, fn) {
-    return modelReachContext.run(sessionId === undefined || sessionId.length === 0 ? {} : { leg: { sessionId, announced: new Set() } }, fn);
+export function withModelReachScope(leg, fn) {
+    const { sessionId, taskId } = leg;
+    return modelReachContext.run(sessionId === undefined || sessionId.length === 0 ? {} : { leg: { sessionId, ...(taskId !== undefined && taskId.length > 0 ? { taskId } : {}), announced: new Set() } }, fn);
 }
 export function withModelCallReach(call, fn) {
     const outer = modelReachContext.getStore();

package/dist/model-route-url.d.ts

@@ -1,7 +1,7 @@
 /** 机读码(拼法随 `config.<键名蛇形>_*` 既有族:`config.model_provider_invalid` / `config.retention_policy_invalid`)。 */
 export declare const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
-/** 同族第二码(S-483 座⑨):这一位根本不是一个层级式绝对 URL。三根键共用一码,与上面那只同纪律
- *  (码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
+/** 同族第二码(S-483 座⑨):这一位不是一个层级式 http(s) URL(不透明 / 解析不动 / 非 http(s) —— S-1269 起后者同码)。三根键共用一码,
+ *  与上面那只同纪律(码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
 export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
 /**
  * 🔴 **第三条臂的机读码(S-514;core 7.24.2 / [ref] 提货)——请求根带 `#fragment`**。
@@ -12,26 +12,19 @@ export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_inva
  */
 export declare const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
 /**
- * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— **这三根键的唯一判官**。
- *
- * 两臂,顺序即语义,**两臂都经 display-safe 铸点**:
- *  ① **不是一个层级式绝对 URL** ⇒ `config.model_route_url_invalid`;
- *  ② 是,但带 userinfo ⇒ `config.gateway_url_userinfo`。
- *
- * 🔴 ① 为什么必须在这里、而不是「由别的门管」(S-483 座⑨,与 ME/A2A 两座**同病镜像**):本函数此前先问
- * 凭据位、并把「解析不动」读成**没有**凭据(`urlCarriesUserinfo` 的 `return false`),旁注写着「不是 URL 由
- * 别的门管」—— 而 config 层对这三根**没有**那道门(`config.ts` 与 `config-invariants.ts` 只调本函数)。
- * 于是半写 userinfo `http://user:pass@`(`URL.canParse` 假)与 `alice:pw@host:8000`(不透明 URL,
- * `username`/`password` 恒空)两形被当「无凭据」放行,一路到 brain 装配期才由 core 拒;core 那一臂
- * 今天不回显原值 —— 但**「恰好不漏」不是防线**,而且拒启点越晚,运维越读不出是哪根旋钮配错了。
- * ⇒ 判据改成与铸点**同一只** {@link isHierarchicalUrl}:两处再也不可能各判各的。
- *
- * 🚧 **未闭环(不在本车射程)**:层级式但**非 http(s)** 的形(`ftp://h/v1`,不带 userinfo)今天仍放行 ——
- * `fetch` 对它同样必然失败,但那是第三条臂、是一次新的行为面拒启,按三问另开车(S-483 收车档已登记)。
- *
- * 拒因四件齐:**码** + **哪个 env 键** + **洗过的 URL**(host/port/path 逐字,userinfo 与凭据参数成记号 ——
+ * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— 判由 `url-shape.ts` 那一只,本函数按**首个**拒因选码与出路句:
+ *  ① 不是层级式 http(s) URL ⇒ `config.model_route_url_invalid`;
+ *  ② 带 userinfo ⇒ `config.gateway_url_userinfo`;
+ *  ③ 带 `#fragment` ⇒ `config.model_route_url_fragment`。
+ * 拒因四件齐:**码** + **哪个 env 键** + **值的样子**(判官的 `buildRefusalShownUrl`:层级式只到 `scheme://host[:port]` + `/…`,不透明形整只成记号 ——
  * 运维要靠 host 认出是哪一条路由,而密码一个字节都不许进启动错误)+ **出路一句**(点名真实旋钮)。
  *
+ * ① 为什么在**声明关口**而不是「由别的门管」(S-483 座⑨):半写 userinfo `http://user:pass@`(解析不动)与 `alice:pw@host:8000`
+ * (不透明 URL,`username`/`password` 恒空)两形若被当「无凭据」放行,一路到 brain 装配期才由 core 拒,拒启点越晚运维越读不出
+ * 是哪根旋钮配错了;层级式非 http(s)(`ftp://h/v1`)对 `fetch` 同样必然失败(S-1269 起同判,修前放行)。
+ * ③ 判在声明关口而不是留给 core 的 brain 构造期(S-514):core 的拒因只过位置律、pathname 逐字,`…/v1/sk-…#note` 那一形的
+ * core 拒因会把 path 上的令牌原文打进启动日志 —— 值在到达 core 之前就被这里拒掉,那条文本根本不由 core 铸。
+ *
  * @param envKey 出问题的那根 env 旋钮的名字(CSV 键上还带第几项)。
  * @param credentialKnob 这条路由把凭据放哪儿 —— 出路一句点名的旋钮名。
  */

package/dist/model-route-url.js

@@ -1,33 +1,37 @@
-import { buildDisplaySafeUrl, isHierarchicalUrl } from "./trace/redact.js";
+import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
 export const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
 export const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
 export const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
+const MODEL_ROUTE_FORBIDS = ["userinfo", "fragment"];
 export function modelRouteUrlRefusal(envKey, raw, credentialKnob) {
     if (raw === "")
         return undefined;
-    if (!isHierarchicalUrl(raw)) {
-        return (`env ${envKey} is not a parseable absolute URL (${buildDisplaySafeUrl(raw)}) [${MODEL_ROUTE_URL_INVALID_CODE}] — ` +
-            "a model-route base URL is consumed by fetch, which requires an absolute hierarchical URL " +
-            "(scheme://host[:port][/path]); half-written forms like \"http://user:pass@\" and opaque forms like " +
-            "\"host:8000\" are not one, and they also hide any credentials they carry from every credential-position check. " +
-            `Set ${envKey} to a full scheme://host URL (and put the credential in ${credentialKnob}, never in the URL).`);
-    }
-    const u = new URL(raw);
-    if (u.username !== "" || u.password !== "")
-        return (`env ${envKey} carries credentials in the URL userinfo (${buildDisplaySafeUrl(raw)}) [${GATEWAY_URL_USERINFO_CODE}] — ` +
-            "WHATWG forbids constructing a fetch Request from a URL with credentials, so EVERY model call on this route " +
-            "fails deterministically at request-construction time (it used to look like a slow network flake: the error was " +
-            "retried for ~3 minutes before surfacing). " +
-            `Put the credential in ${credentialKnob} (or the matching header knob) instead of the URL, and keep the URL to ` +
-            "scheme/host/port/path.");
-    if (u.hash !== "") {
-        return (`env ${envKey} carries a URL fragment (${buildDisplaySafeUrl(raw)}#…) [${MODEL_ROUTE_URL_FRAGMENT_CODE}] — ` +
-            "a fragment is never sent on the wire, so this route would silently target the root's own path and every " +
-            "endpoint suffix (/chat/completions, /v1/messages) would land inside the discarded part: the request goes out, " +
-            "may even return 200, and points somewhere else without saying so. " +
-            `Drop everything from the "#" on in ${envKey}. A per-deployment QUERY is fully supported and rides every ` +
-            "request (a gateway's `?api-version=…`); a fragment cannot be.");
+    const flaws = httpUrlFlaws(raw, MODEL_ROUTE_FORBIDS);
+    const first = flaws[0];
+    if (first === undefined)
+        return undefined;
+    const head = buildHttpUrlRefusal(`env ${envKey}`, raw, flaws);
+    switch (first) {
+        case "not-http-url":
+            return (`${head} [${MODEL_ROUTE_URL_INVALID_CODE}] — ` +
+                "a model-route base URL is consumed by fetch, which only sends to an absolute hierarchical http(s) URL; " +
+                "half-written forms like \"http://user:pass@\", opaque forms like \"host:8000\" and other schemes are not one, and the first two also hide " +
+                "any credentials they carry from every credential-position check. " +
+                `Set ${envKey} to a full http(s)://host URL (and put the credential in ${credentialKnob}, never in the URL).`);
+        case "userinfo":
+            return (`${head} [${GATEWAY_URL_USERINFO_CODE}] — ` +
+                "WHATWG forbids constructing a fetch Request from a URL with credentials, so EVERY model call on this route " +
+                "fails deterministically at request-construction time (it used to look like a slow network flake: the error was " +
+                "retried for ~3 minutes before surfacing). " +
+                `Put the credential in ${credentialKnob} (or the matching header knob) instead of the URL, and keep the URL to ` +
+                "scheme/host/port/path.");
+        case "fragment":
+            return (`${head} [${MODEL_ROUTE_URL_FRAGMENT_CODE}] — ` +
+                "a fragment is never sent on the wire, so this route would silently target the root's own path and every " +
+                "endpoint suffix (/chat/completions, /v1/messages) would land inside the discarded part: the request goes out, " +
+                "may even return 200, and points somewhere else without saying so. " +
+                `Drop everything from the "#" on in ${envKey}. A per-deployment QUERY is fully supported and rides every ` +
+                "request (a gateway's `?api-version=…`); a fragment cannot be.");
     }
-    return undefined;
 }
 //# sourceMappingURL=model-route-url.js.map

package/dist/model-unreachable-notice.d.ts

@@ -20,7 +20,8 @@
  * 没有归属键 ⇒ 不铸(运维日志 `outbound_connect_failed` 照有)。腿里的**辅助**调用(WebFetch 摘要器、压实、提示建议、分类器 …)与
  * 主循环**同一条规则**:本帧说的是「这个模型端点够不着」,不是「这条 run 失败了」(措辞如此,不暗示终态);不设豁免名单 —— codex r1 / r2
  * 两轮证明豁免名单结构上开放(core 自己发起的辅助调用本仓包不到)。按 **run 终态**归属是另一种设计,候裁(收车档 ⑤)。去重单位 = **每腿每目标一次**(同一条腿里
- * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId }` ——
+ * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId, taskId? }` ——
+ * `taskId`(7.121.0)= 这条腿的 run 资源 id,腿没有 run 资源时缺席;引擎的 run 身份 `runId` 在这一层读不到,本码不带 ——
  * `proxyInUse` 只在这一跳走了代理时在场,且只是**变量名**(代理地址是基础设施细节,不上租户 wire,与 `OutboundProxyError` 的
  * F3 裁定同一条)。`targetHost`(模型端点的 `host:port`)对 user 受众是**新披露的部署事实**(F7 裁定:它是部署自己声明的模型端点,
  * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下终局句只带码与 `via outbound proxy (from <变量>)`、不含任何主机地址,

package/dist/model-unreachable-notice.js

@@ -17,6 +17,7 @@ function announceModelUnreachable(leg, failure, router = defaultEngineNoticeRout
             ...(failure.proxyInUse !== null ? { proxyInUse: failure.proxyInUse } : {}),
             remedy: MODEL_UNREACHABLE_REMEDY,
             sessionId: leg.sessionId,
+            ...(leg.taskId !== undefined ? { taskId: leg.taskId } : {}),
         },
         sessionId: leg.sessionId,
     });