@sema-agent/server 7.121.0 → 7.122.0

package/dist/http/routes/images.js

@@ -643,7 +643,7 @@ export const IMAGES_ROUTES = [
     { id: "image-bake-claim-next", path: "/v1/images/bakes/claim", methods: ["POST"] },
     { id: "image-select", path: "/v1/images/select", methods: ["POST"] },
     { id: "image-register", path: "/v1/images/register", methods: ["POST"] },
-    { id: "image-bake-events", pattern: /^\/v1\/images\/bakes\/(?<bakeId>[^/]+)\/events$/, label: "/v1/images/bakes/:id/events", methods: ["GET"] },
+    { id: "image-bake-events", pattern: /^\/v1\/images\/bakes\/(?<bakeId>[^/]+)\/events$/, label: "/v1/images/bakes/:id/events", methods: ["GET"], subscription: true },
     { id: "image-bake-cancel", pattern: /^\/v1\/images\/bakes\/(?<bakeId>[^/]+)\/cancel$/, label: "/v1/images/bakes/:id/cancel", methods: ["POST"] },
     { id: "image-bake-claim", pattern: /^\/v1\/images\/bakes\/(?<bakeId>[^/]+)\/claim$/, label: "/v1/images/bakes/:id/claim", methods: ["POST"] },
     { id: "image-bake-ingest", pattern: /^\/v1\/images\/bakes\/(?<bakeId>[^/]+)\/ingest$/, label: "/v1/images/bakes/:id/ingest", methods: ["POST"] },

package/dist/http/routes/leader.js

@@ -2,6 +2,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, headerStr, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 export const LEADER_SUBMIT_PATH = "/v1/leader";
 export async function handleLeader(req, res, match, ctx) {
     switch (match.decl.id) {
@@ -35,6 +36,11 @@ export async function handleLeader(req, res, match, ctx) {
             sendError(res, 400, "request.invalid_json", "invalid JSON body");
             return;
         }
+        const laneRefusal = leaderEntryRefusal(leaderRunEntry(deps.config.autonomy));
+        if (laneRefusal !== undefined) {
+            sendError(res, 422, "request.autonomy_lane_refused", laneRefusal);
+            return;
+        }
         const r = await endpoint.handle("POST", LEADER_SUBMIT_PATH, body, requester, headerStr(req.headers["idempotency-key"]) ?? null);
         if (r) {
             sendJson(res, r.status, r.body);

package/dist/http/routes/runs.d.ts

@@ -72,6 +72,7 @@ export declare const RUNS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/runs/:id/events";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "run-detail";
     readonly pattern: RegExp;
@@ -90,6 +91,7 @@ export declare const RUN_VERBS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/runs/:id/subagents/:sub/*";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "run-subagent-steer";
     readonly pattern: RegExp;

package/dist/http/routes/runs.js

@@ -33,7 +33,8 @@ import { mintAndDriveDurableRun } from "../durable-run-leg.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
-import { storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "../checkpoint-ctx.js";
+import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "../stored-body-replay.js";
 const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
 const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
 const STEER_PRIORITY_CHOICES = STEER_PRIORITY_WORDS.length <= 2 ? STEER_PRIORITY_WORDS.join(" or ") : `${STEER_PRIORITY_WORDS.slice(0, -1).join(", ")}, or ${STEER_PRIORITY_WORDS[STEER_PRIORITY_WORDS.length - 1]}`;
@@ -647,7 +648,7 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.noResumeCtx = true;
                     return;
                 }
-                const unservable = storedBodyReplayRefusal(resumeRead.ctx);
+                const unservable = storedBodyReplayRefusal(resumeRead.ctx, deps.config.autonomy);
                 if (unservable !== undefined) {
                     mintResult.unservable = unservable;
                     return;
@@ -1662,12 +1663,12 @@ export const RUNS_ROUTES = [
     { id: "run-detach", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/detach$/, label: "/v1/runs/:id/detach", methods: ["POST"] },
     { id: "run-cancel", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/cancel$/, label: "/v1/runs/:id/cancel", methods: ["POST"] },
     { id: "run-compact", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/compact$/, label: "/v1/runs/:id/compact", methods: ["POST"] },
-    { id: "run-events", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/events$/, label: "/v1/runs/:id/events", methods: ["GET"] },
+    { id: "run-events", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/events$/, label: "/v1/runs/:id/events", methods: ["GET"], subscription: true },
     { id: "run-detail", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)$/, label: "/v1/runs/:id", methods: ["GET"] },
 ];
 export const RUN_VERBS_ROUTES = [
     { id: "run-subagent-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/output$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
-    { id: "run-subagent-stream", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/stream$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
+    { id: "run-subagent-stream", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/stream$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"], subscription: true },
     { id: "run-subagent-steer", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/steer$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["POST"] },
     { id: "run-subagent-resume", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/resume$/, label: "/v1/runs/:id/subagents/:sub/*", billable: "resume", methods: ["POST"] },
     { id: "run-task-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/tasks\/(?<tid>[^/]+)\/output$/, label: "/v1/runs/:id/tasks/:tid/*", methods: ["GET"] },

package/dist/http/routes/sessions.d.ts

@@ -79,6 +79,7 @@ export declare const SESSIONS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/sessions/:id/$verb";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "session-fork";
     readonly pattern: RegExp;

package/dist/http/routes/sessions.js

@@ -844,7 +844,7 @@ export const SESSIONS_ROUTES = [
     { id: "session-mcp", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/mcp$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
     { id: "session-a2a", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/a2a$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
     { id: "session-head", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/head$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
-    { id: "session-events", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/events$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
+    { id: "session-events", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/events$/, label: "/v1/sessions/:id/$verb", methods: ["GET"], subscription: true },
     { id: "session-fork", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/fork$/, label: "/v1/sessions/:id/$verb", methods: ["POST"] },
     { id: "session-policy-get", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/policy$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
     { id: "session-policy-put", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/policy$/, label: "/v1/sessions/:id/$verb", methods: ["PUT"] },

package/dist/http/routes/trace-usage.d.ts

@@ -38,6 +38,7 @@ export declare const TRACE_USAGE_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/tasks/:id/$sub";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "task-trace-artifacts";
     readonly pattern: RegExp;

package/dist/http/routes/trace-usage.js

@@ -302,7 +302,7 @@ export const TRACE_USAGE_ROUTES = [
     { id: "task-trace-list", path: "/v1/tasks", methods: ["GET"] },
     { id: "task-tool-result", pattern: /^\/v1\/tasks\/(?<taskId>[^/]+)\/tool-results\/(?<ref>[^/]+)$/, label: "/v1/tasks/:id/tool-results/:ref", methods: ["GET"] },
     { id: "task-trace-turns", pattern: /^\/v1\/tasks\/(?<taskId>[^/]+)\/turns$/, label: "/v1/tasks/:id/$sub", methods: ["GET"] },
-    { id: "task-trace-stream", pattern: /^\/v1\/tasks\/(?<taskId>[^/]+)\/stream$/, label: "/v1/tasks/:id/$sub", methods: ["GET"] },
+    { id: "task-trace-stream", pattern: /^\/v1\/tasks\/(?<taskId>[^/]+)\/stream$/, label: "/v1/tasks/:id/$sub", methods: ["GET"], subscription: true },
     { id: "task-trace-artifacts", pattern: /^\/v1\/tasks\/(?<taskId>[^/]+)\/artifacts$/, label: "/v1/tasks/:id/$sub", methods: ["GET"] },
     { id: "usage-analytics", pattern: /^\/v1\/usage\/(?<sub>summary|series|breakdown)$/, label: "/v1/usage/$sub", methods: ["GET"] },
 ];

package/dist/http/routes/workflows.d.ts

@@ -15,6 +15,7 @@ export declare const WORKFLOWS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/workflows/:id/$sub";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "workflow-journal";
     readonly pattern: RegExp;

package/dist/http/routes/workflows.js

@@ -416,7 +416,7 @@ function sendWorkflowsUnavailable(res, why) {
 }
 export const WORKFLOWS_ROUTES = [
     { id: "workflows-list", path: "/v1/workflows", methods: ["GET"] },
-    { id: "workflow-stream", pattern: /^\/v1\/workflows\/(?<runId>[^/]+)\/stream$/, label: "/v1/workflows/:id/$sub", methods: ["GET"] },
+    { id: "workflow-stream", pattern: /^\/v1\/workflows\/(?<runId>[^/]+)\/stream$/, label: "/v1/workflows/:id/$sub", methods: ["GET"], subscription: true },
     { id: "workflow-journal", pattern: /^\/v1\/workflows\/(?<runId>[^/]+)\/journal$/, label: "/v1/workflows/:id/$sub", methods: ["GET"] },
     { id: "workflow-detail", pattern: /^\/v1\/workflows\/(?<runId>[^/]+)$/, label: "/v1/workflows/:id", methods: ["GET"] },
 ];

package/dist/http/send.d.ts

@@ -47,6 +47,19 @@ export declare const SSE_MAX_STREAM_MS: number;
  * 要么给 approvals 减 type=消费端破坏),属候裁,不在本批的零行为码范围内。
  */
 export declare const SSE_HEARTBEAT_IDLE_MS = 15000;
+/**
+ * S-1281 —— 服务端**主动**收一条已开的 SSE 流:一帧 `event: error`(帧形与流帽那一帧同一套 `{type:"error", errorCode, message}`,
+ * 消费端按既有「服务端收流 ⇒ 重连」协议处置,SDK 的流读口把它当一帧事件交出再重连)后 `end()`。
+ *
+ * 收流的是分派器,不是流自己的泵:泵此刻可能正停在一次 await 上,醒来还会写一帧。Node 上 `end()` 之后、`close` 之前的那一写会发一个
+ * `error` 事件(实测 v24.2.0:无监听 ⇒ 进程级未捕获;`close` 之后的写只回 `false`,不再发)。⇒ 先挂一只**只吸收这一种**
+ * (`ERR_STREAM_WRITE_AFTER_END`)的监听再 `end()`:那一帧本来就无处可去(连接是我们关的),别的错照旧抛(不改既有失败形)。
+ * 已收尾的流不碰(幂等;排空入口与硬停起点各调一次)。
+ */
+export declare function endSseWithError(res: ServerResponse, frame: {
+    readonly errorCode: string;
+    readonly message: string;
+}): void;
 export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
 /** A6([ref] lens1 §C3/lens3 §C3a): canonical error-response sender for sites that already carry a
  *  machine `errorCode` — `errorCode` is a required positional arg (not optional-bag) so a call site

package/dist/http/send.js

@@ -17,6 +17,15 @@ export function sseHeaders(res, extra) {
 }
 export const SSE_MAX_STREAM_MS = 15 * 60 * 1000;
 export const SSE_HEARTBEAT_IDLE_MS = 15_000;
+export function endSseWithError(res, frame) {
+    if (res.writableEnded || res.destroyed)
+        return;
+    res.on("error", (err) => {
+        if (err.code !== "ERR_STREAM_WRITE_AFTER_END")
+            throw err;
+    });
+    res.end(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: frame.errorCode, message: frame.message })}\n\n`);
+}
 export function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));

package/dist/http/server.d.ts

@@ -684,6 +684,9 @@ export interface ServiceDeploymentDeps {
      *  • [ref]:`attachedStreams` 同样 ASSIGNED BY createServer —— 本副本当前打开着的 SSE 流条数
      *    (= 引擎附着租约集的大小)。消费方是 `boot/engine-lease.ts` 的自退判据;与 `inflight` 同族,
      *    同一个共享盒子,不另开第二条 main↔server 的通道。
+     *  • S-1281:`inflight` 只数**工作** —— 只读订阅流(路由表 `subscription` 列的八条 GET SSE 读面)不进 admission 计数,只进
+     *    `attachedStreams`;`endSubscriptions`(同样 ASSIGNED BY createServer)发 `draining` 终帧后关掉它们,收尾链在排空进入那一拍与
+     *    硬停起点各调一次。
      */
     drainState?: import("../fleet/drain-entry.js").DrainState;
     /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端

package/dist/http/stored-body-replay.d.ts

@@ -0,0 +1,27 @@
+/**
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(三问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
+ * 三问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
+ *
+ * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
+ * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
+ * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,前两问的谓词照旧住在各自属主里。
+ */
+import { type PermissionMode } from "@sema-agent/core";
+import { type Autonomy } from "../runtime-governance.js";
+import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
+import type { CheckpointCtx } from "./route-ctx.js";
+/**
+ * 第三问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词被地板钳会变
+ * (core `clampPermissionMode`,与提交入口的盖章同一只钳)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
+ */
+export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor: PermissionMode | undefined): {
+    stored: PermissionMode | undefined;
+    floor: PermissionMode;
+} | undefined;
+/**
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 技能拒侧读成空 → 模式词读法记号(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`autonomy` = 本部署**此刻**的 `config.autonomy`(活 config:热改即生效);地板由它的唯一属主算,问点不自己算。
+ */
+export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, autonomy: Autonomy | undefined): StoredBodyReplayRefusal | undefined;
+//# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -0,0 +1,23 @@
+import { clampPermissionMode } from "@sema-agent/core";
+import { storedBodyPermissionMode } from "../task-settings.js";
+import { autonomyModeFloor } from "../runtime-governance.js";
+import { skillDenyInertEntryOf } from "../rule-entry-list.js";
+import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
+export function permissionModeReadingUnstated(ctx, floor) {
+    if (floor === undefined || permissionModeReadingStated(ctx))
+        return undefined;
+    const stored = storedBodyPermissionMode(ctx.body);
+    return clampPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
+}
+export function storedBodyReplayRefusal(ctx, autonomy) {
+    if (allowListReadingUnstated(ctx))
+        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
+    const entry = skillDenyInertEntryOf(ctx.body);
+    if (entry !== undefined)
+        return { kind: "skill_deny_inert", entry };
+    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(autonomy));
+    if (mode !== undefined)
+        return { kind: "permission_mode_reading", ...mode };
+    return undefined;
+}
+//# sourceMappingURL=stored-body-replay.js.map

package/dist/leader/leader.d.ts

@@ -15,7 +15,8 @@
 import { type RunnerLike, type WorkerReport } from "./fanout.js";
 import { type ExecStreamLike } from "./diffout.js";
 import { type MergeDeps, type MergeResult } from "./merge.js";
-import { type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type PermissionMode, type TaskSpec, type VerifyConfig, type CheckpointToken, type TerminalCause, type ToolSpec, type RepairTerminal, type OracleTier, type RepairResult } from "@sema-agent/core";
+import { type UnattendedLegSpec } from "../unattended-permission-mode.js";
 /** [ref] Slice 6: drive a worker's resource-suspend auto-resume to a terminal (or bound) state. Exported
  *  for unit tests. Loops `resume(token, slice)` WHILE the result's terminal cause is a park on a
  *  `resource_limit` gate. Exits on: a terminal cause that is not a park, a park on any OTHER gate
@@ -64,7 +65,27 @@ export interface ProvisionedWorker {
      *  python3/tests → PARTIAL. Provision a read-effect exec/probe tool here so the verifier can actually verify. */
     verifierTools?: ToolSpec[];
 }
+/**
+ * 一条 leader run 的**入口体**(提交体去掉 objective 的那一半)—— 运维 `AUTONOMY` 的模式词地板在这条 run 出生的那一拍读一次、经受理门同一只盖章
+ * 盖出来的结果(`run-entry.ts` `leaderRunEntry`);地板缺席 ⇒ `{}`。leader 请求不带调用方的模式词,所以入口词就是地板本身(与 run-local 同)。
+ * 本 run 铸的每一条 spec 经 {@link withLeaderLeg} 从这一份取词;worker 的续跑体由它展开(`{ ...entry, objective }`)⇒ 首跑、续跑、修复腿同一个词。
+ * 入口词是 `plan` 的 run 进不了这条车道(`run-entry.ts` `leaderEntryRefusal`:worker 会话没有计划审阅通道)—— 受理口与出生处同判,到不了 worker。
+ * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run 保持它出生时盖下的这一份。
+ */
+export interface LeaderRunEntry {
+    readonly permissionMode?: PermissionMode;
+}
+/**
+ * leader 车道铸 spec 的**唯一**合并口:入口体的词写进 spec,再交给无人值守腿的合并口(`withUnattendedLeg` 的 `default` 钳在入口词之下)。
+ * 入口体无词 ⇒ spec 原物交给 `withUnattendedLeg`,与不经本口逐字同。本车道的 spec 自己不带模式词(子任务体只有 objective,其余并进的键是预算 / 审批 / 身份),
+ * 所以这里是「写」而不是「钳」。五个出生点(worker 首跑的工厂 / 静态两条车道、集成修复、模块门修复、单代理修复环)都调它、不直调 `withUnattendedLeg`
+ * (`test/leader-entry-floor.test.ts` 按语法树数调用点):「这条腿的词从哪来」只有入口体一个答案。
+ */
+export declare function withLeaderLeg<S extends Partial<TaskSpec>>(spec: S, entry: LeaderRunEntry): S & UnattendedLegSpec;
 export interface LeaderDeps {
+    /** 本 run 的入口体({@link LeaderRunEntry}:运维地板在 run 出生时盖一次)。必填:没有地板的装配写 `{}` —— 缺席不是「没有地板」的合法拼法。
+     *  模块门修复与单代理修复环这两个出生点从这里取词(经 {@link withLeaderLeg})。 */
+    entry: LeaderRunEntry;
     /** Plan a task into N disjoint-file sub-tasks (MVP: simple/hand-authored; adaptive replan = scale). */
     plan: (task: string) => Promise<SubtaskSpec[]>;
     /** Provision a leader-owned worker (its env seeded with base at `branch` + an env-bound runner). */

package/dist/leader/leader.js

@@ -16,6 +16,9 @@ export async function autoResumeOnResource(initial, signal, resume, maxSlices =
     }
     return vr;
 }
+export function withLeaderLeg(spec, entry) {
+    return withUnattendedLeg(entry.permissionMode === undefined ? spec : { ...spec, permissionMode: entry.permissionMode });
+}
 export async function runLeaderTask(task, durableBaseSha, deps) {
     let subs;
     try {
@@ -201,7 +204,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` })).result();
+                        const rr = await w.runner.runTaskStream(withLeaderLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.entry)).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.d.ts

@@ -31,7 +31,7 @@
 import { type Runner, type TaskSpec, type ExecutionEnv, type ExecStep, type OracleTier, type RepairResult, type RepairBundle, type RepairTerminal } from "@sema-agent/core";
 import { type WorkerDiff } from "./repair-oracle.js";
 import type { GraderHandle } from "./grader-env-factory.js";
-import type { LeaderDeps, ProvisionedWorker, SubtaskSpec } from "./leader.js";
+import { type LeaderDeps, type ProvisionedWorker, type SubtaskSpec } from "./leader.js";
 import type { WorkerReport } from "./fanout.js";
 /** The per-run inputs the leader's single-agent repair loop needs, resolved by the wire (§3.3). */
 export interface RepairWireCfg {

package/dist/leader/repair-wire.js

@@ -1,8 +1,8 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
+import { withLeaderLeg } from "./leader.js";
 import { outwardPlane } from "../terminal.js";
 import { redactHead } from "../observability/run-terminal.js";
-import { withUnattendedLeg } from "../unattended-permission-mode.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId });
+            const implSpec = withLeaderLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.entry);
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/run-entry.d.ts

@@ -0,0 +1,27 @@
+/**
+ * 一条 leader run 的**入口体**与「它进不进得了 leader 车道」的唯一判据。
+ *
+ * 规则(与受理门、run-local 同一条):运维 `AUTONOMY=plan` 是提交入口的模式词地板,盖在每一个 spec 出生点。leader 请求不带调用方的模式词,
+ * 所以入口体是一份空体盖上地板(受理门同一只盖章 `task-settings.ts` `stampEntryPermissionMode`;地板的唯一属主 `runtime-governance.ts`
+ * `autonomyModeFloor`)。
+ *
+ * `plan` 是**生命周期词**:它靠人审通道(`plan_review`)出口 —— 一个人批准计划,run 才离开 plan。leader 的 worker 会话**没有**那条通道
+ * (计划审阅口按 HTTP run 行找卡,worker 会话没有 run 行;审批回决口答不是工具审批、续跑口也拒)⇒ 入口词是 `plan` 的 leader run 交出计划就停在
+ * 一张没有端点能决的卡上,写也无人可答。所以这一档在 leader 车道上**响亮拒**(fail-closed):不静默降级成别的模式、不换成只读手、不给 leader 另造审阅口。
+ *
+ * 问点两个,调同一只 {@link leaderEntryRefusal}:HTTP 受理口(`http/routes/leader.ts`,422,一条 run 都不建)与 run 出生处(`leader/wire.ts`,
+ * 受理之后才被热改成 plan 的那一窄窗,以及不经 HTTP 的调用方 —— run 以同一句拒收场,一只 worker 都不 provision)。
+ */
+import { type Autonomy } from "../runtime-governance.js";
+import type { LeaderRunEntry } from "./leader.js";
+/** 一条 leader run 的入口体:地板读一次、受理门同一只盖章(地板缺席 ⇒ `{}`)。调用方读**活** config(热改只影响之后起的 run)。 */
+export declare function leaderRunEntry(autonomy: Autonomy | undefined): LeaderRunEntry;
+/** 拒句:原因(运维的 plan 地板 × 这条车道没有计划审阅通道)+ 两条出路(改走有计划审阅的 run 车道 / 运维换档)。不含任何配置值之外的回显。
+ *  受理口(HTTP 422 的 `error`)与 run 出生处(run 的 `error`)读的是这一份;字节由 `test/api-error-text-freeze.test.ts` 的常量锚格冻。 */
+export declare const LEADER_PLAN_ENTRY_REFUSAL: string;
+/**
+ * 入口词进不进得了 leader 车道 —— **唯一**判据。返回拒句;`undefined` = 进得了。闭集穷尽 switch:引擎的模式词表加一词 ⇒ 这里编译红,
+ * 逼着回答「那个词靠不靠人审通道出口」。
+ */
+export declare function leaderEntryRefusal(entry: LeaderRunEntry): string | undefined;
+//# sourceMappingURL=run-entry.d.ts.map

package/dist/leader/run-entry.js

@@ -0,0 +1,29 @@
+import { autonomyModeFloor } from "../runtime-governance.js";
+import { stampEntryPermissionMode } from "../task-settings.js";
+export function leaderRunEntry(autonomy) {
+    return stampEntryPermissionMode({}, autonomyModeFloor(autonomy));
+}
+export const LEADER_PLAN_ENTRY_REFUSAL = "this deployment runs with AUTONOMY=plan, which starts every task in plan mode and lets it out of plan mode only when a person approves its plan through plan review; " +
+    "a leader task's workers have no plan review channel, so they could neither write nor hand their plan to anyone who can approve it. Nothing was started. " +
+    "Submit the work as a run instead (POST /v1/runs, whose plan is reviewed through POST /v1/assistant/tasks/:id/plan_review), " +
+    "or ask the operator to set AUTONOMY=read-only or AUTONOMY=ask, under which leader tasks run.";
+export function leaderEntryRefusal(entry) {
+    const mode = entry.permissionMode;
+    if (mode === undefined)
+        return undefined;
+    switch (mode) {
+        case "plan":
+            return LEADER_PLAN_ENTRY_REFUSAL;
+        case "default":
+        case "acceptEdits":
+        case "auto":
+        case "bypassPermissions":
+        case "dontAsk":
+            return undefined;
+        default: {
+            const unhandled = mode;
+            throw new Error(`leader entry word "${String(unhandled)}" has no lane arm`);
+        }
+    }
+}
+//# sourceMappingURL=run-entry.js.map

package/dist/leader/wire.d.ts

@@ -1,4 +1,5 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
+import type { Autonomy } from "../runtime-governance.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -63,6 +64,15 @@ export interface LeaderWireConfig {
      * fail-OPEN。改成函数席之后每只 Runner 构造时现读,与主车道经 swap 门换代**同代**;已经准备好的腿
      * 保留它准备时的那一份(core 的自然快照语义,两条腿同律)。 */
     deploymentPosture?: () => DeploymentPostureSeats;
+    /**
+     * 运维 `AUTONOMY`(活 config 的那一位)—— 本车道每条 leader run **出生那一拍**读一次,经 `run-entry.ts` 的 `leaderRunEntry`(入口地板 + 受理门同一只盖章)
+     * 盖成这条 run 的入口体(`LeaderDeps.entry`);本 run 铸的每一条 spec 与 worker 的续跑体都从它取词。入口词是 `plan` 的 run 进不了这条车道
+     * (`leaderEntryRefusal`:worker 会话没有计划审阅通道)⇒ 出生处即以拒句收场;HTTP 受理口用同一只判据先答 422。
+     *
+     * 🔴 **函数席**(与 `deploymentPosture` / `durable` 同一条先例):`config.autonomy` 被 config-center 原地热改,boot 期取一次值会把这条腿钉在起服那一刻。
+     * **必填**:没有 AUTONOMY 的装配递 `() => undefined` —— 缺席不是「没有地板」的合法拼法(权限轴上不许静默放宽)。
+     */
+    autonomy: () => Autonomy | undefined;
     /**
      * [ref]([ref])—— **计费/遥测追踪席**,原样递给本车道的每一只 Runner。唯一属主 =
      * `boot/budget-tracing.ts` 的 `createTracer(...)`(主 runner / subRunner / hook runner 经共享基座吃的

package/dist/leader/wire.js

@@ -5,7 +5,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
-import { withUnattendedLeg } from "../unattended-permission-mode.js";
+import { leaderEntryRefusal, leaderRunEntry } from "./run-entry.js";
 import { buildCheckpointCtx } from "../http/checkpoint-ctx.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
@@ -14,7 +14,7 @@ import { gitSubprocessEnv } from "../server-secret-env.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
 import { buildUploadScript, buildUploadLoopScript, uploadLoopCommand, uploadLoopScriptPath, uploadStepSuffix, fetchUploadedDiff, withStaging, UPLOAD_LOOP_PERIOD_SEC } from "./diffup.js";
 import { pullDiff, safeRev } from "./diffout.js";
-import { runLeaderTask } from "./leader.js";
+import { runLeaderTask, withLeaderLeg } from "./leader.js";
 import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
@@ -171,7 +171,7 @@ export function createLeaderRunner(cfg) {
         const p = currentPrincipal();
         return p ? { principal: p } : {};
     };
-    const mkRepair = (rawEnv, repoDir, oracleFiles) => {
+    const mkRepair = (rawEnv, repoDir, oracleFiles, entry) => {
         if (repairRounds <= 0)
             return undefined;
         return {
@@ -194,12 +194,12 @@ export function createLeaderRunner(cfg) {
                         delimitUntrusted("FAILING OUTPUT (untrusted)", errorText),
                     ].join("\n");
                     const res = await runner
-                        .runTaskStream(withUnattendedLeg({
+                        .runTaskStream(withLeaderLeg({
                         objective,
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    }))
+                    }, entry))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -226,6 +226,10 @@ export function createLeaderRunner(cfg) {
         if (!safeRev(body.baseSha)) {
             return { ok: false, reports: [], cancelled: false, error: "baseSha must be a plain git rev (sha/branch token)" };
         }
+        const entry = leaderRunEntry(cfg.autonomy());
+        const refused = leaderEntryRefusal(entry);
+        if (refused !== undefined)
+            return { ok: false, reports: [], cancelled: false, error: refused };
         const injectOracles = async (env) => {
             const ofs = body.oracleFiles ?? [];
             if (ofs.length === 0)
@@ -268,7 +272,7 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = buildCheckpointCtx({ body: { objective: sub.spec.objective }, unattendedLeg: true });
+            const resumeCtx = buildCheckpointCtx({ body: { ...entry, objective: sub.spec.objective }, unattendedLeg: true });
             let durableSpec = {};
             if (durable) {
                 const d = durable;
@@ -353,7 +357,7 @@ export function createLeaderRunner(cfg) {
                         },
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }),
+                    spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, resumeCtx.body),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -368,7 +372,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }),
+                spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeCtx.body),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -386,7 +390,7 @@ export function createLeaderRunner(cfg) {
                 }
                 const rawEnv = env;
                 const oracleFiles = body.oracleFiles ?? [];
-                const repair = mkRepair(rawEnv, repo, oracleFiles);
+                const repair = mkRepair(rawEnv, repo, oracleFiles, entry);
                 return { env: asIntegrationEnv(env), destroy: reap, ...(repair ? { repair } : {}) };
             }
             if (!cfg.e2bApiKey)
@@ -404,10 +408,11 @@ export function createLeaderRunner(cfg) {
                 await env.destroy().catch(() => { });
                 throw e;
             }
-            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}) };
+            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? [], entry) ? { repair: mkRepair(env, repo, body.oracleFiles ?? [], entry) } : {}) };
         };
         const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
+            entry,
             plan,
             provisionWorker,
             provisionIntegrationSandbox,

package/dist/model-route-url.d.ts

@@ -1,7 +1,7 @@
 /** 机读码(拼法随 `config.<键名蛇形>_*` 既有族:`config.model_provider_invalid` / `config.retention_policy_invalid`)。 */
 export declare const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
-/** 同族第二码(S-483 座⑨):这一位根本不是一个层级式绝对 URL。三根键共用一码,与上面那只同纪律
- *  (码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
+/** 同族第二码(S-483 座⑨):这一位不是一个层级式 http(s) URL(不透明 / 解析不动 / 非 http(s) —— S-1269 起后者同码)。三根键共用一码,
+ *  与上面那只同纪律(码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
 export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
 /**
  * 🔴 **第三条臂的机读码(S-514;core 7.24.2 / [ref] 提货)——请求根带 `#fragment`**。
@@ -12,26 +12,19 @@ export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_inva
  */
 export declare const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
 /**
- * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— **这三根键的唯一判官**。
- *
- * 两臂,顺序即语义,**两臂都经 display-safe 铸点**:
- *  ① **不是一个层级式绝对 URL** ⇒ `config.model_route_url_invalid`;
- *  ② 是,但带 userinfo ⇒ `config.gateway_url_userinfo`。
- *
- * 🔴 ① 为什么必须在这里、而不是「由别的门管」(S-483 座⑨,与 ME/A2A 两座**同病镜像**):本函数此前先问
- * 凭据位、并把「解析不动」读成**没有**凭据(`urlCarriesUserinfo` 的 `return false`),旁注写着「不是 URL 由
- * 别的门管」—— 而 config 层对这三根**没有**那道门(`config.ts` 与 `config-invariants.ts` 只调本函数)。
- * 于是半写 userinfo `http://user:pass@`(`URL.canParse` 假)与 `alice:pw@host:8000`(不透明 URL,
- * `username`/`password` 恒空)两形被当「无凭据」放行,一路到 brain 装配期才由 core 拒;core 那一臂
- * 今天不回显原值 —— 但**「恰好不漏」不是防线**,而且拒启点越晚,运维越读不出是哪根旋钮配错了。
- * ⇒ 判据改成与铸点**同一只** {@link isHierarchicalUrl}:两处再也不可能各判各的。
- *
- * 🚧 **未闭环(不在本车射程)**:层级式但**非 http(s)** 的形(`ftp://h/v1`,不带 userinfo)今天仍放行 ——
- * `fetch` 对它同样必然失败,但那是第三条臂、是一次新的行为面拒启,按三问另开车(S-483 收车档已登记)。
- *
- * 拒因四件齐:**码** + **哪个 env 键** + **洗过的 URL**(host/port/path 逐字,userinfo 与凭据参数成记号 ——
+ * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— 判由 `url-shape.ts` 那一只,本函数按**首个**拒因选码与出路句:
+ *  ① 不是层级式 http(s) URL ⇒ `config.model_route_url_invalid`;
+ *  ② 带 userinfo ⇒ `config.gateway_url_userinfo`;
+ *  ③ 带 `#fragment` ⇒ `config.model_route_url_fragment`。
+ * 拒因四件齐:**码** + **哪个 env 键** + **值的样子**(判官的 `buildRefusalShownUrl`:层级式只到 `scheme://host[:port]` + `/…`,不透明形整只成记号 ——
  * 运维要靠 host 认出是哪一条路由,而密码一个字节都不许进启动错误)+ **出路一句**(点名真实旋钮)。
  *
+ * ① 为什么在**声明关口**而不是「由别的门管」(S-483 座⑨):半写 userinfo `http://user:pass@`(解析不动)与 `alice:pw@host:8000`
+ * (不透明 URL,`username`/`password` 恒空)两形若被当「无凭据」放行,一路到 brain 装配期才由 core 拒,拒启点越晚运维越读不出
+ * 是哪根旋钮配错了;层级式非 http(s)(`ftp://h/v1`)对 `fetch` 同样必然失败(S-1269 起同判,修前放行)。
+ * ③ 判在声明关口而不是留给 core 的 brain 构造期(S-514):core 的拒因只过位置律、pathname 逐字,`…/v1/sk-…#note` 那一形的
+ * core 拒因会把 path 上的令牌原文打进启动日志 —— 值在到达 core 之前就被这里拒掉,那条文本根本不由 core 铸。
+ *
  * @param envKey 出问题的那根 env 旋钮的名字(CSV 键上还带第几项)。
  * @param credentialKnob 这条路由把凭据放哪儿 —— 出路一句点名的旋钮名。
  */