@sema-agent/server 7.125.1 → 7.126.0

package/dist/http/request-guards.d.ts

@@ -84,7 +84,8 @@ export declare function createRequestGuards(ctx: {
         fleetWide: boolean;
         gateOwner: string | null;
     };
-    runOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session") => boolean;
+    runOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null) => boolean;
+    sessionOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null) => boolean;
     runSessionAcceptOk: (req: IncomingMessage, res: ServerResponse, run: {
         sessionId: string | null;
     }, face: string, notFoundError?: string) => boolean;

package/dist/http/request-guards.js

@@ -2,7 +2,7 @@ import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
 import { HttpError, principalFrom } from "../security.js";
 import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { sendError } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sessionOwnerReadable, devOpenDeployment, sendPrincipalRefusal } from "./principal-gate.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
 const MAX_BODY = 8 * 1024 * 1024;
 export function leaseRefusalOf(adm) {
@@ -150,9 +150,8 @@ export function createRequestGuards(ctx) {
         }
     }
     function isFleetWide(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        return (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined) || (!!tt && authorized(req, tt));
+        const tt = deps.config.traceToken;
+        return devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined || (!!tt && authorized(req, tt));
     }
     function sessionOwnerScope(req) {
         const fleetWide = isFleetWide(req);
@@ -160,27 +159,28 @@ export function createRequestGuards(ctx) {
         return { fleetWide, gateOwner };
     }
     function sessionOwnerScopeForWrite(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        const fleetWide = (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined);
+        const fleetWide = devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined;
         const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
         return { fleetWide, gateOwner };
     }
-    function runOwnerOk(req, res, owner, notFoundForm = "run") {
+    function ownerGate(req, res, readable, notFound) {
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
             sendPrincipalRefusal(res, req, deps.config);
             return false;
         }
-        if (!runOwnerReadable(principal, owner, deps.config)) {
-            if (notFoundForm === "session")
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-            else
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!readable(principal)) {
+            notFound();
             return false;
         }
         return true;
     }
+    function runOwnerOk(req, res, owner) {
+        return ownerGate(req, res, (principal) => runOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE));
+    }
+    function sessionOwnerOk(req, res, owner) {
+        return ownerGate(req, res, (principal) => sessionOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
+    }
     const sessionAssertAbsentWarned = new Set();
     function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {
         if (!run.sessionId)
@@ -229,6 +229,6 @@ export function createRequestGuards(ctx) {
         }
         return Buffer.concat(chunks);
     }
-    return { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, runSessionAcceptOk, readJson, readRawBody };
+    return { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody };
 }
 //# sourceMappingURL=request-guards.js.map

package/dist/http/resume-legs.d.ts

@@ -15,7 +15,7 @@ import type { IncomingMessage } from "node:http";
 import { CheckpointError, type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
 import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
-import { type HostDecision } from "../host-decision.js";
+import type { HostDecision } from "../host-decision.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
 import { type TrustedRunInternals } from "./durable-run-leg.js";
@@ -74,7 +74,7 @@ export declare function createResumeLegs(ctx: {
         readonly ok: true;
         readonly prepared: PreparedPlanReview;
     }>;
-    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
+    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/resume-legs.js

@@ -9,7 +9,6 @@ import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../se
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
-import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -68,6 +67,7 @@ const WORKER_SWAP_REDEEMABLE = {
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    requirements_damaged: false,
     read_face_damaged: false,
     read_face_forged: false,
     write_face_damaged: false,
@@ -162,7 +162,7 @@ function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
 export function createResumeLegs(ctx) {
-    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
     async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
@@ -1377,7 +1377,7 @@ export function createResumeLegs(ctx) {
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
-    async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {
+    async function drivePlanReview(prepared, decision, editedPlan, reason, hostDecision, req, acceptEarly, permissionModeAfter) {
         const { sessionId, token, cp, ctx } = prepared;
         if ((await deps.checkpointStore.findPendingTokenBySession(sessionId, undefined, { gateKinds: ["plan_review"] })) !== token)
             return notResumableAnswer();
@@ -1399,6 +1399,7 @@ export function createResumeLegs(ctx) {
             decision,
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
+            hostDecision,
         };
         const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         return out;
@@ -1406,7 +1407,7 @@ export function createResumeLegs(ctx) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview },
     };

package/dist/http/route-ctx.d.ts

@@ -72,11 +72,11 @@ export interface RouteHelpers {
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
     isFleetWide(req: IncomingMessage): boolean;
-    /** 属主门。`notFoundForm` 选 not-yours 臂的 404 拼法:缺省 `"run"`(not_found.run 长文,[ref]);**每一个 session
-     *  资源面都必须传 `"session"`**(not_found.session + {@link SESSION_NOT_FOUND_MESSAGE})与其 unknown 臂同码同串
-     *  (G52 [ref];S-989 补上了 detail / head / events 三个读口 —— 它们此前吃缺省 "run",单端点内 unknown / not-yours
-     *  两臂码与串都不同)。缺省 `"run"` 的语义不变:run 面不传。 */
-    runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session"): boolean;
+    /** run 面的属主门(谓词 `runOwnerReadable`;非属主 ⇒ 404 `not_found.run` + 长文,与 run 读口的 unknown 臂同码同串,[ref])。 */
+    runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
+    /** 会话面的属主门(谓词 `sessionOwnerReadable`,S-1452:没有身份边界的部署不钉人,与会话列表同读;非属主 ⇒ 404 `not_found.session` +
+     *  {@link SESSION_NOT_FOUND_MESSAGE},与会话读口的 unknown 臂同码同串 —— G52 [ref] / S-989)。每一个按会话寻址的属主判都走它。 */
+    sessionOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
     sessionOwnerScope(req: IncomingMessage): {
         fleetWide: boolean;
         gateOwner: string | null;
@@ -461,7 +461,9 @@ export interface RouteLegs {
         readonly prepared: PreparedPlanReview;
     }>;
     /** plan_review 三态腿的**驱动段**(S-609):只吃 prepare 的结果,用它选定的 token,不再选卡、不再读 ctx。 */
-    drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
+    drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, 
+    /** core 7.49.0 #1396:决策事实(谁决定的 + 归属),语义属主 = `resume-legs.ts` 的同名形参顶注。 */
+    hostDecision: HostDecision, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
     acceptEarly?: boolean, 
     /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定

package/dist/http/routes/a2a-serve.js

@@ -123,7 +123,11 @@ function asNonEmptyString(v, what, max) {
         throw new RpcError(JSONRPC_INVALID_PARAMS, `${what} must be at most ${max} characters`);
     return v;
 }
-const MAX_CONTEXT_ID_CHARS = 64;
+function asString(v, what) {
+    if (typeof v !== "string")
+        throw new RpcError(JSONRPC_INVALID_PARAMS, `${what} must be a string`);
+    return v;
+}
 const MAX_MESSAGE_ID_CHARS = 200;
 const MAX_TASK_ID_CHARS = 128;
 const MAX_SKILL_ID_CHARS = 128;
@@ -224,7 +228,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     if (message.role !== "user")
         throw new RpcError(JSONRPC_INVALID_PARAMS, `params.message.role must be "user" (this is the inbound leg — an agent-role message has no meaning here)`);
     const objective = objectiveFromParts(message.parts);
-    const contextId = message.contextId === undefined ? undefined : asNonEmptyString(message.contextId, "params.message.contextId", MAX_CONTEXT_ID_CHARS);
+    const contextId = message.contextId === undefined ? undefined : asString(message.contextId, "params.message.contextId");
     const messageId = asNonEmptyString(message.messageId, "params.message.messageId", MAX_MESSAGE_ID_CHARS);
     const skill = skillFromMetadata(message.metadata, serve);
     const skillId = skill?.id;
@@ -238,19 +242,19 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         .update(skillId ?? "")
         .digest("hex");
     const submitter = caller.principal ?? undefined;
-    const idemKey = idemKeyOf(fingerprint, caller, "run");
+    const idem = { key: idemKeyOf(fingerprint, caller, "run"), bodyFingerprint: fingerprint };
     const body = {
         objective,
         taskId: durableIdempotencyTaskId(idemIdentityOf(caller), fingerprint),
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const keyed = (await runStore.getRunByIdem(idemKey).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
-    const replay = keyed ? await replayOfExistingRun(keyed, { principal: submitter, clientTaskId: body.taskId }, "durable", deps, runStore) : undefined;
+    const keyed = (await runStore.getRunByIdem(idem.key).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
+    const replay = keyed ? await replayOfExistingRun(keyed, { principal: submitter, clientTaskId: body.taskId, idem }, "durable", deps, runStore) : undefined;
     if (keyed && replay?.status === 202) {
         return taskFromRun(keyed, isStaleRun(keyed, deps.config.runStaleSec));
     }
-    const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idemKey, "durable", body.taskId)) : undefined;
+    const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idem, "durable", body.taskId)) : undefined;
     let receipt;
     if (replay !== undefined) {
         receipt = replay;
@@ -271,7 +275,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
             throw rpcErrorFromTypedFailure(typed, skillId);
         if (!prepared)
             return undefined;
-        receipt = await createDurableRun(req, res, ctx, prepared, idemKey);
+        receipt = await createDurableRun(req, res, ctx, prepared, idem);
     }
     if (!receipt)
         return undefined;

package/dist/http/routes/approvals-assistant.js

@@ -31,10 +31,10 @@ const DECIDE_BODY_DECLARED_KEYS = [
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
-    "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
+    "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
 const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason"];
-const PLAN_REVIEW_NOT_IN_PROOF_KEYS = [];
+const PLAN_REVIEW_NOT_IN_PROOF_KEYS = ["decidedBy"];
 const PROOF_SLOT_OF = {
     answer: "answer",
     boundCallId: "boundCallId",
@@ -522,6 +522,21 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
             }
+            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            switch (decidedByReading.kind) {
+                case "not_in_proof":
+                    sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
+                    return;
+                case "outside_closed_set":
+                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
+                    return;
+                case "accepted":
+                    break;
+                default: {
+                    const unreachable = decidedByReading;
+                    throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
+                }
+            }
             if (decision === "edit" && !isWellFormedUnicode(body.editedPlan)) {
                 sendError(res, 400, "request.field_invalid", "editedPlan must be well-formed Unicode text (a lone surrogate cannot be signed unambiguously)");
                 return;
@@ -626,7 +641,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
+            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, hostDecisionFacts(decidedByReading.decidedBy, deciderPrincipal), req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }

package/dist/http/routes/background.d.ts

@@ -29,7 +29,7 @@
  * `rateLimited`。能力位 `background: { listFace, exitFaces }` 与两口的 501 从同一个谓词推导(会话属主面在场)。
  *
  * 🔴 **停止口在无凭据写门内**(`credentialGated: ["POST"]`;车OL F1 = 7.102.0 合并复审 gpt-6 腿 [high]):门的两个合取项它都中
- *   —— ① 授权的唯一输入是 principal 头(属主判 `runOwnerOk` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedPrincipal`,
+ *   —— ① 授权的唯一输入是 principal 头(属主判 `sessionOwnerOk` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedPrincipal`,
  *   无 service 凭证的部署上它收调用方自报的头);② 不可撤销、爆炸半径跨租户(知道会话 id + 自报它的属主 ⇒ 停掉那个会话的后台
  *   进程,`includeRetained:true` 连显式 retain 的活服务一起停)。于是无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的部署上它与
  *   其余改写门同码同句 503 `auth.service_token_required`(在路由之前,`dispatch.ts` 那一道),同一只会话级收敛函数的另一个调用点

package/dist/http/routes/background.js

@@ -68,7 +68,7 @@ export async function handleBackground(req, res, match, ctx) {
         return;
     }
     const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-    if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
+    if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
         return;
     const scope = owner ?? "default";
     switch (id) {

package/dist/http/routes/capabilities.js

@@ -1,6 +1,7 @@
 import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
+import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -205,7 +206,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 manualCompact: facts.durableRuns(deps).available,
                 configCatalog: facts.configCatalog(deps).available,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
-                workspaceSync: ((f) => (f.available ? f.policy : undefined))(facts.workspaceSpace(deps.config)),
+                workspaceSync: ((space, cache) => space.available || cache.available ? { ...(space.available ? space.policy : {}), ...(cache.available ? { cache: cache.cache } : {}) } : undefined)(facts.workspaceSpace(deps.config), facts.workspaceCache(deps.config)),
             }));
             return;
         }
@@ -256,7 +257,14 @@ export async function handleCapabilities(req, res, match, ctx) {
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
             const defaultName = (nonAlias.find(([, m]) => m === deps.config.model) ?? nonAlias.find(([, m]) => m.id === deps.config.model.id))?.[0];
-            sendJson(res, 200, { models, default: deps.config.model.id, defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) }, droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries) });
+            const candidateRejection = deps.candidateRejectionState?.();
+            sendJson(res, 200, {
+                models,
+                default: deps.config.model.id,
+                defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) },
+                droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries),
+                ...(candidateRejection !== undefined ? { candidateRejected: buildCandidateRejectedWire(candidateRejection) } : {}),
+            });
             return;
         }
         default:

package/dist/http/routes/mcp-reconnect.js

@@ -94,7 +94,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 return;
             }
             const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
+            if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
                 return;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);

package/dist/http/routes/runs.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RunIdemBinding } from "../../plugins/store-contracts.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 行上的 `decision_actor`(裸 JSON)投成回显形;形不认 ⇒ undefined(调用点省略该键,不 500)。
@@ -31,9 +32,9 @@ export declare function handleRunVerbs(req: IncomingMessage, res: ServerResponse
  *    防御性复检(缺席 ⇒ 501),但两个调用方都在自己的入口先判过,那才是各自面上的正确错误形。
  */
 export declare function createDurableRun(req: IncomingMessage, res: ServerResponse, ctx: RouteCtx, prepared: PreparedTaskSubmission, 
-/** 这次提交的幂等键(`idemKeyOf(…, "run")`:`POST /v1/runs` = `Idempotency-Key` 头派生;A2A = `message.messageId`
- *  + 内容指纹派生)—— 落 `task_run.idem_key`,同时是同进程在飞合流的键。undefined = 调用方没带键。 */
-idemKey: string | undefined): Promise<{
+/** 这次提交的账本绑定(键 `idemKeyOf(…, "run")` + 请求体指纹:`POST /v1/runs` = `Idempotency-Key` 头 + 线上收到的体;A2A =
+ *  `message.messageId` + 内容指纹)—— 落 `task_run.idem_key` / `idem_body_fingerprint`,键同时是同进程在飞合流的键。undefined = 调用方没带键。 */
+idem: RunIdemBinding | undefined): Promise<{
     status: number;
     body: unknown;
 } | null>;

package/dist/http/routes/runs.js

@@ -7,7 +7,7 @@ import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
-import { idemCallerOf, idemKeyOf, inflightKeyOf } from "../idempotency.js";
+import { idemCallerOf, idemKeyOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
@@ -188,19 +188,18 @@ export async function handleRuns(req, res, match, ctx) {
         const runStore = runs.runStore;
         const rawIdem = headerStr(req.headers["idempotency-key"]);
         const submitter = gatedPrincipal(req, deps.config);
-        const idemKey = rawIdem ? idemKeyOf(rawIdem, idemCallerOf(req, ctx), "run") : undefined;
-        let keyedBody;
-        if (idemKey) {
-            keyedBody = await readJson(req);
+        const keyedBody = rawIdem ? await readJson(req) : undefined;
+        const idem = rawIdem ? submissionIdemOf(rawIdem, idemCallerOf(req, ctx), keyedBody) : undefined;
+        if (idem) {
             const clientTaskId = clientTaskIdOf(keyedBody);
             if (clientTaskId === false) {
                 sendError(res, 400, "request.id_invalid", "body.taskId must be a uuidv7 string (caller-minted idempotency key)");
                 return;
             }
-            const inflight = idemCache.peek(inflightKeyOf(idemKey, "durable", clientTaskId));
-            const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idemKey);
+            const inflight = idemCache.peek(inflightKeyOf(idem, "durable", clientTaskId));
+            const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idem.key);
             if (inflight || keyedRow) {
-                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { principal: submitter, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
+                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
                 sendJson(res, resp.status, resp.body);
                 return;
             }
@@ -210,7 +209,7 @@ export async function handleRuns(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody);
         if (!prepared)
             return;
-        const resp = await createDurableRun(req, res, ctx, prepared, idemKey);
+        const resp = await createDurableRun(req, res, ctx, prepared, idem);
         if (!resp)
             return;
         sendJson(res, resp.status, resp.body);
@@ -1586,7 +1585,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
     }
     return assertNever(match.decl.id);
 }
-export async function createDurableRun(req, res, ctx, prepared, idemKey) {
+export async function createDurableRun(req, res, ctx, prepared, idem) {
     const { deps } = ctx;
     const { idemCache } = ctx.registry;
     const { leaseDenied, usageWindowDenied } = ctx.helpers;
@@ -1603,7 +1602,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
         return null;
     }
     const submitter = gatedPrincipal(req, deps.config);
-    const caller = { principal: submitter, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
+    const caller = { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
     if (clientTaskId) {
         const existing = await runStore.getRun(clientTaskId);
         if (existing)
@@ -1611,11 +1610,11 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
     }
     if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
         return null;
-    return await idemCache.run(idemKey !== undefined ? inflightKeyOf(idemKey, "durable", clientTaskId) : undefined, async () => {
+    return await idemCache.run(idem !== undefined ? inflightKeyOf(idem, "durable", clientTaskId) : undefined, async () => {
         const out = await mintAndDriveDurableRun({ deps, registry: ctx.registry, helpers: ctx.helpers, local: ctx.local, legs: ctx.legs }, runStore, {
             prepared,
             ...(clientTaskId !== undefined ? { clientTaskId } : {}),
-            ...(idemKey !== undefined ? { idemKey } : {}),
+            ...(idem !== undefined ? { idem } : {}),
             fleetScope: submitter ?? "default",
             elicitOwner: submitter ?? null,
             source,

package/dist/http/routes/session-sync.js

@@ -44,7 +44,6 @@ export async function handleSessionSync(req, res, match, ctx) {
                 return;
             }
             const { backend, sessionStorage, historyStore } = sync;
-            const ownerOf = sessionStorage.ownerOf.bind(sessionStorage);
             const scope = sessionOwnerScopeForWrite(req);
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
@@ -55,7 +54,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const gateFace = await sessionStorage.sessionFaceOf(sessionId);
+            const owner = gateFace === undefined ? undefined : gateFace.owner;
             const ownsOrFleet = (o) => scope.fleetWide || o === scope.gateOwner;
             const pullGateOk = () => {
                 if (owner === undefined) {
@@ -75,13 +75,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 return true;
             };
-            const replaySessionRow = async (row, importedOwner) => {
+            const replaySessionRow = async (row, face) => {
                 if (Object.keys(row).length === 0)
-                    return;
-                const face = await sessionStorage.sessionFaceOf(sessionId);
-                if (face === undefined || face.owner !== importedOwner)
-                    return;
-                await sessionStorage.patchSessionMeta(sessionId, row, face);
+                    return true;
+                return face !== undefined && (await sessionStorage.patchSessionMeta(sessionId, row, face)) !== undefined;
             };
             if (match.decl.id === "session-sync-manifest") {
                 if (!pullGateOk())
@@ -331,7 +328,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
                             await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingP);
-                    await replaySessionRow(row, owner);
+                    if (!(await replaySessionRow(row, gateFace))) {
+                        sendError(res, 409, "conflict", "sync conflict");
+                        return;
+                    }
                     sendJson(res, 200, {
                         relation: "identical",
                         basis: payloadVerified ? "entry-ids+digest" : "entry-ids",
@@ -521,9 +521,13 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (anchorStore)
                         for (const a of pending.anchors)
                             await anchorStore.put(sessionId, a.eventId, a.entryId, pending.owner);
-                    await replaySessionRow(pending.row, pending.owner);
+                    const rowLanded = await replaySessionRow(pending.row, committed.face);
                     sessionStorage.evict?.(sessionId);
                     cleanupStaging(stagingId);
+                    if (!rowLanded) {
+                        sendError(res, 409, "conflict", "sync conflict");
+                        return;
+                    }
                     sendJson(res, 200, { relation: committed.relation });
                 }
                 catch (e) {
@@ -567,7 +571,6 @@ export async function handleSessionSync(req, res, match, ctx) {
 function sendSessionSyncUnavailable(res, why) {
     switch (why) {
         case "store_backend_absent":
-        case "session_owner_face_absent":
         case "session_row_faces_absent":
             sendError(res, 501, "capability.session_store_required", "session sync requires a durable session store");
             return;

package/dist/http/routes/sessions.js

@@ -9,7 +9,7 @@ import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
@@ -54,7 +54,7 @@ async function readLastLegMcp(deps, sessionId, principal) {
     const latest = await runStore.latestRunForSession(sessionId);
     if (latest === undefined)
         return undefined;
-    if (!runOwnerReadable(principal, latest.owner, deps.config) && !explicitOperatorOk(principal, deps.config.operatorPrincipals))
+    if (!sessionOwnerReadable(principal, latest.owner, deps.config) && !explicitOperatorOk(principal, deps.config.operatorPrincipals))
         return undefined;
     const events = await runStore.getEvents(latest.taskId, 0);
     for (let i = events.length - 1; i >= 0; i--) {
@@ -70,7 +70,7 @@ async function readLastLegMcp(deps, sessionId, principal) {
 }
 export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, safeDecode, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite } = ctx.helpers;
+    const { readJson, safeDecode, sessionOwnerOk, sessionOwnerScopeForWrite } = ctx.helpers;
     const readOwnedSessionView = async (sessionAudit, sessionId, readOpts) => {
         const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
         if (ownerOf !== undefined) {
@@ -79,7 +79,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return undefined;
             }
-            if (!runOwnerOk(req, res, owner, "session"))
+            if (!sessionOwnerOk(req, res, owner))
                 return undefined;
         }
         let audit;
@@ -95,7 +95,7 @@ export async function handleSessions(req, res, match, ctx) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return undefined;
         }
-        if (!runOwnerOk(req, res, audit.owner, "session"))
+        if (!sessionOwnerOk(req, res, audit.owner))
             return undefined;
         return audit;
     };
@@ -265,7 +265,7 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 owner = head.owner;
-                if (!runOwnerOk(req, res, owner ?? null, "session"))
+                if (!sessionOwnerOk(req, res, owner ?? null))
                     return;
                 leafId = head.leafId;
             }
@@ -275,7 +275,7 @@ export async function handleSessions(req, res, match, ctx) {
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!runOwnerOk(req, res, owner ?? null, "session"))
+                if (!sessionOwnerOk(req, res, owner ?? null))
                     return;
                 leafId = await getLeafId(headSession);
             }
@@ -359,7 +359,7 @@ export async function handleSessions(req, res, match, ctx) {
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!runOwnerOk(req, res, owner ?? null, "session")) {
+                if (!sessionOwnerOk(req, res, owner ?? null)) {
                     cleanup();
                     return;
                 }
@@ -666,7 +666,7 @@ export async function handleSessions(req, res, match, ctx) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
         }
-        if (!runOwnerOk(req, res, face.owner, "session"))
+        if (!sessionOwnerOk(req, res, face.owner))
             return;
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {