@sema-agent/server 7.125.1 → 7.127.0

package/dist/hooks/hook-runner.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
-import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, } from "@sema-agent/settings-schema/hooks";
+import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -59,7 +59,8 @@ function toAssistantTurnError(errorKind) {
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
 export const MAX_MATCHER_EVAL_CHARS = MAX_HOOK_COMMAND_CHARS;
-export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 100;
+export const ADMISSION_MATCHER_EVAL_BUDGET_MS = 1_000;
+export const MATCHER_ECHO_CHARS = 200;
 const MATCHER_UNJUDGED_TAG = "server.hooks.matcher-unjudged";
 function matcherReadsWireToolName(event) {
     return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
@@ -81,10 +82,7 @@ function engineToolAliases() {
     return table;
 }
 let matcherEvalBox;
-function matcherSelectsWithin(matcher, name, budget) {
-    const remaining = budget.deadlineMs - budget.now();
-    if (remaining <= 0)
-        return "over_budget";
+function matcherSelectsWithin(matcher, name, budgetMs) {
     matcherEvalBox ??= {
         script: new vm.Script("hookMatcherSelects(matcher, name)"),
         context: vm.createContext({ hookMatcherSelects, matcher: "", name: "" }),
@@ -92,7 +90,7 @@ function matcherSelectsWithin(matcher, name, budget) {
     matcherEvalBox.context.matcher = matcher;
     matcherEvalBox.context.name = name;
     try {
-        const verdict = matcherEvalBox.script.runInContext(matcherEvalBox.context, { timeout: Math.max(1, Math.ceil(remaining)) });
+        const verdict = matcherEvalBox.script.runInContext(matcherEvalBox.context, { timeout: Math.max(1, Math.ceil(budgetMs)) });
         return verdict === true ? true : verdict === false ? false : "invalid";
     }
     catch (err) {
@@ -101,12 +99,21 @@ function matcherSelectsWithin(matcher, name, budget) {
         throw err;
     }
 }
+function matcherCompileSentence(matcher) {
+    try {
+        new RegExp(matcher);
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : String(err);
+    }
+    return "the pattern does not compile as a regular expression";
+}
 const MATCHER_EVALUATION = {
     literal: { regex: "inline", literal: "inline" },
     regex: { regex: "budgeted", literal: "not_applicable" },
     invalid: { regex: "unreadable", literal: "not_applicable" },
 };
-function deadAliasInMatcher(matcher, depth, budget) {
+function judgeMatcher(matcher, depth, budgetMs) {
     if (matcher.length > MAX_MATCHER_EVAL_CHARS)
         return { kind: "unjudged", reason: "oversize" };
     const evaluate = MATCHER_EVALUATION[hookMatcherForm(matcher)][depth];
@@ -114,7 +121,7 @@ function deadAliasInMatcher(matcher, depth, budget) {
         case "not_applicable":
             return undefined;
         case "unreadable":
-            return { kind: "unjudged", reason: "invalid_regex" };
+            return { kind: "invalid_regex" };
         case "inline":
         case "budgeted":
             break;
@@ -123,48 +130,74 @@ function deadAliasInMatcher(matcher, depth, budget) {
             return unreachable;
         }
     }
-    const selects = (name) => {
-        const verdict = evaluate === "inline" ? hookMatcherSelects(matcher, name) : matcherSelectsWithin(matcher, name, budget);
-        return verdict === "invalid" ? "invalid_regex" : verdict;
-    };
+    const selects = (name) => (evaluate === "inline" ? hookMatcherSelects(matcher, name) : matcherSelectsWithin(matcher, name, budgetMs));
+    const unanswered = (verdict) => (verdict === "over_budget" ? { kind: "over_budget" } : { kind: "invalid_regex" });
     for (const [alias, canonical] of engineToolAliases()) {
         const selectsAlias = selects(alias);
         if (typeof selectsAlias === "string")
-            return { kind: "unjudged", reason: selectsAlias };
+            return unanswered(selectsAlias);
         if (!selectsAlias)
             continue;
         const selectsCanonical = selects(canonical);
         if (typeof selectsCanonical === "string")
-            return { kind: "unjudged", reason: selectsCanonical };
+            return unanswered(selectsCanonical);
         if (!selectsCanonical)
             return { kind: "dead", alias, canonical };
     }
     return undefined;
 }
-export function buildDeadToolMatcherRefusal(issue) {
-    return {
-        message: `settings.hooks.${issue.event}: matcher "${issue.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${issue.canonical}"`,
-        field: "settings.hooks",
-        detail: { event: issue.event, alias: issue.alias, canonical: issue.canonical },
-    };
+export function buildToolMatcherRefusal(issue) {
+    switch (issue.reason) {
+        case "dead_alias":
+            return {
+                message: `settings.hooks.${issue.event}: matcher "${issue.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${issue.canonical}"`,
+                field: "settings.hooks",
+                detail: { reason: issue.reason, event: issue.event, alias: issue.alias, canonical: issue.canonical },
+            };
+        case "over_budget":
+            return {
+                message: `settings.hooks.${issue.event}[${issue.groupIndex}].matcher: evaluating the pattern did not finish within ${issue.budgetMs} ms (catastrophic regex backtracking) — rewrite it as a tool-name list or a pattern without nested repetition`,
+                field: "settings.hooks",
+                detail: { reason: issue.reason, event: issue.event, groupIndex: issue.groupIndex, budgetMs: issue.budgetMs },
+            };
+        case "invalid_regex":
+            return {
+                message: `settings.hooks.${issue.event}[${issue.groupIndex}].matcher: ${JSON.stringify(issue.matcher)} is not a valid regular expression (${issue.compileError}) — fix the pattern, or write the tool names as a list such as "Read|Edit"`,
+                field: "settings.hooks",
+                detail: { reason: issue.reason, event: issue.event, groupIndex: issue.groupIndex },
+            };
+        default: {
+            const unreachable = issue;
+            return unreachable;
+        }
+    }
 }
-export function deadToolMatcherIssue(config, depth, budget = {}) {
-    const now = budget.now ?? (() => performance.now());
-    const deadline = { deadlineMs: now() + (budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS), now };
+export function toolMatcherIssue(config, depth, budget = {}) {
+    const budgetMs = budget.budgetMs ?? ADMISSION_MATCHER_EVAL_BUDGET_MS;
     for (const [event, groups] of Object.entries(config)) {
         if (!matcherReadsWireToolName(event))
             continue;
-        for (const group of groups ?? []) {
+        for (const [groupIndex, group] of (groups ?? []).entries()) {
             if (group.matcher === undefined)
                 continue;
-            const verdict = deadAliasInMatcher(group.matcher, depth, deadline);
+            const verdict = judgeMatcher(group.matcher, depth, budgetMs);
             if (verdict === undefined)
                 continue;
-            if (verdict.kind === "unjudged") {
-                recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
-                continue;
+            switch (verdict.kind) {
+                case "dead":
+                    return { reason: "dead_alias", event, alias: verdict.alias, canonical: verdict.canonical };
+                case "over_budget":
+                    return { reason: "over_budget", event, groupIndex, budgetMs };
+                case "invalid_regex":
+                    return { reason: "invalid_regex", event, groupIndex, matcher: clip(group.matcher, MATCHER_ECHO_CHARS), compileError: clip(matcherCompileSentence(group.matcher), MATCHER_ECHO_CHARS) };
+                case "unjudged":
+                    recordFailOpen(MATCHER_UNJUDGED_TAG, `event=${event} reason=${verdict.reason} matcherChars=${group.matcher.length}`);
+                    break;
+                default: {
+                    const unreachable = verdict;
+                    return unreachable;
+                }
             }
-            return { event, alias: verdict.alias, canonical: verdict.canonical };
         }
     }
     return undefined;
@@ -558,19 +591,19 @@ async function runLlmHook(entry, payload, ctx, extra) {
             clearTimeout(hardTopTimer);
     }
 }
-async function runHttpHook(entry, payload, ctx) {
+const MAX_BLANKED_REFERENCES_LOGGED = 16;
+async function runHttpHook(entry, payload, ctx, event) {
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
-    const allowed = new Set(entry.allowedEnvVars ?? []);
-    const envSource = hookEnv(ctx);
-    const headers = { "content-type": "application/json" };
-    for (const [k, v] of Object.entries(entry.headers ?? {})) {
-        headers[k] = v.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (whole, name) => {
-            if (!allowed.has(name))
-                return whole;
-            const ev = envSource[name];
-            return typeof ev === "string" ? ev : whole;
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookEnv(ctx));
+    if (interpolated.blanked.length > 0) {
+        ctx.logger.warn("hook_http_header_env_blanked", {
+            event,
+            url: buildDisplaySafeUrl(entry.url),
+            blankedCount: interpolated.blanked.length,
+            blanked: interpolated.blanked.slice(0, MAX_BLANKED_REFERENCES_LOGGED).map(({ header, name, reason }) => ({ header, name, reason })),
         });
     }
+    const headers = { "content-type": "application/json", ...interpolated.headers };
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
     try {
@@ -732,7 +765,7 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                 onceFired.add(onceKey);
             if (entry.type === "prompt" || entry.type === "agent")
                 llmEntries++;
-            const run = entry.type === "http" ? await runHttpHook(entry, payload, ctx)
+            const run = entry.type === "http" ? await runHttpHook(entry, payload, ctx, event)
                 : entry.type === "prompt" || entry.type === "agent" ? await runLlmHook(entry, payload, ctx, entry.type === "prompt" ? llmExtra : { system: ccAgentHookSystemFor(event), event })
                     : await runCommandHook(entry, payload, ctx);
             if (run.spawnError) {

package/dist/http/admission.js

@@ -1,19 +1,20 @@
 import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
-import { HttpError } from "../security.js";
+import { HttpError, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
-import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
+import { buildToolMatcherRefusal, parseHooksConfig, toolMatcherIssue } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, skillToolListOk, skillToolListRefusal, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
+import { createRunAcceptance } from "../run-acceptance.js";
 import { sendError, httpErrorCode } from "./send.js";
 import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
@@ -62,6 +63,7 @@ function refuseUnavailableModel(res, config, field, ref) {
     sendError(res, 400, "request.model_unavailable", message);
     return true;
 }
+const modelIdOf = (model) => (typeof model === "string" ? model : model?.id);
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
     async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
@@ -85,9 +87,12 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
             return null;
         }
-        if (typeof body.sessionId === "string" && body.sessionId.length > 64) {
-            sendError(res, 400, "request.field_invalid", "sessionId must be at most 64 characters");
-            return null;
+        {
+            const sessionIdIssue = sessionIdShapeIssue(body.sessionId);
+            if (sessionIdIssue) {
+                sendError(res, 400, "request.id_invalid", sessionIdIssue);
+                return null;
+            }
         }
         if (typeof body.systemPrompt === "string" && body.systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
             sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
@@ -212,9 +217,9 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
-                const deadMatcher = deadToolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
-                if (deadMatcher !== undefined) {
-                    const refusal = buildDeadToolMatcherRefusal(deadMatcher);
+                const toolMatcher = toolMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
+                if (toolMatcher !== undefined) {
+                    const refusal = buildToolMatcherRefusal(toolMatcher);
                     sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
@@ -502,7 +507,7 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        for (const key of ["excludeTools", "deferTools"]) {
+        for (const key of ["allowTools", "excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
                 sendError(res, 400, "request.field_invalid", `${key} must be an array of non-empty tool-name strings`);
@@ -637,7 +642,9 @@ export function createAdmission(ctx) {
                 store: deps.deviceStore,
                 enrollment: deps.deviceEnrollment,
             });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            const model = modelIdOf(spec.model);
+            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/durable-run-leg.d.ts

@@ -15,7 +15,7 @@
  */
 import { type RunInternals } from "@sema-agent/core";
 import type { RunStore } from "../plugins/store-backend.js";
-import type { RunRecord } from "../plugins/store-contracts.js";
+import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { PreparedTaskSubmission, RouteCtxBase } from "./route-ctx.js";
 /**
  * 🔴 **TRUSTED run internals** —— 由**部署方**(不是模型、不是请求体、不是工具参数)铸给这一跑的
@@ -35,8 +35,9 @@ export interface DurableRunLegArgs {
     prepared: PreparedTaskSubmission;
     /** 调用方自带的 taskId(`POST /v1/runs` 的 `body.taskId` 幂等键);缺席 ⇒ 本腿铸 uuidv7。 */
     clientTaskId?: string;
-    /** 这次提交的幂等键(`idemKeyOf(raw, caller, "run")`)—— 落 `task_run.idem_key`;缺席 = 调用方没带 `Idempotency-Key`。 */
-    idemKey?: string;
+    /** 这次提交的账本绑定(键 `idemKeyOf(raw, caller, "run")` + 请求体指纹)—— 落 `task_run.idem_key` / `idem_body_fingerprint`;
+     *  缺席 = 调用方没带 `Idempotency-Key`。 */
+    idem?: RunIdemBinding;
     /** 🔒 这条 run 的 **fleet 行 scope** —— 必须与 `GET /v1/fleet/stream` 过滤用的是同一个身份,且绝不是
      *  自报的 `x-agent-principal` 头(自报头会把行打到受害者的 scope 上,或打到 `default` 而真属主的流把它
      *  过滤掉)。提交门传 `gatedPrincipal(req) ?? "default"`;`/decide` 的第三条车道传 resume 家族的
@@ -71,7 +72,7 @@ export type DurableRunLegOutcome = {
 /**
  * 建行 + 驱动。返回 `202` = 新行已建并在跑(体带 `taskId`/`sessionId`);`409` = 会话被别的 run 占着,
  * **没有**建行(体 = `buildActiveRunConflict` 的既有形,含 `errorCode: "conflict.session_active_run"`);
- * `existing` = 这次提交的钥匙(`idemKey` / `clientTaskId`)已经指向一条行,没建新行。
+ * `existing` = 这次提交的钥匙(`idem.key` / `clientTaskId`)已经指向一条行,没建新行。
  * 协议渲染归调用方(HTTP `sendJson` / A2A 协议对象 / `/decide` 的受理体)。
  */
 export declare function mintAndDriveDurableRun(ctx: RouteCtxBase, runStore: RunStore, args: DurableRunLegArgs): Promise<DurableRunLegOutcome>;

package/dist/http/durable-run-leg.js

@@ -15,13 +15,11 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
     const sessionId = args.prepared.spec.sessionId ?? uuidv7();
     const taskId = args.clientTaskId ?? uuidv7();
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), idemKey: args.idemKey ?? null });
+    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), idem: args.idem ?? null });
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)
         recordResourceWindow(taskId, args.prepared.spec.resourceSuspend);
-    if (created.ok)
-        deps.sessionTitler?.maybeTitle(sessionId, args.prepared.spec.objective, typeof args.prepared.spec.model === "string" ? args.prepared.spec.model : args.prepared.spec.model?.id);
     if (created.existing)
         return { existing: created.existing };
     if (!created.ok) {
@@ -65,7 +63,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger, args.prepared.acceptance);
     return { status: 202, body: { taskId, sessionId, status: "running" } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/idempotency.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import type { WiringManifestReceipt } from "./wire-types.js";
 import type { SubmitReplayFace } from "./submit-replay.js";
+import type { RunIdemBinding } from "../plugins/store-contracts.js";
 /**
  * 同进程的**在飞合流** —— 并发同键的提交共享同一个 promise(避免同一进程里双起)。它**不是**重放的真源。
  *
@@ -78,14 +79,35 @@ export declare function idemIdentityOf(caller: IdemCaller): string;
  */
 export declare function idemKeyOf(raw: string, caller: IdemCaller, family: IdemFamily): string;
 /**
- * 在飞合流的键 = 提交幂等键 × 这条腿的**回执形**(`durable` / `sync`)× 这次请求自带的 taskId。
+ * 一次提交的**请求体指纹** —— HTTP 三条提交腿(`POST /v1/tasks` · `/v1/tasks/stream` · `/v1/runs`)同一只规范化函数:
+ * `sha256(canonicalJson(体 − taskId))` 的 hex(定宽 64)。
  *
- * 合流交出的是**首个请求那条腿的结局**,所以只有「同一条 run、同一种回执形、同一把 taskId」的请求才许合流:durable 腿
- * 合到同步腿的在飞结局上会拿到 200 引擎结果而不是 202 收据;带另一个 taskId 的请求合进来就绕过了「key 指向别的行」
- * 那条 409。形不同(或 taskId 不同)的请求各自走到建行,由店的原子赢或观察 + 唯一回执函数作答 —— 仍是一条 run,
- * 各拿自己腿的回执形。同步腿与流式腿同形(流式腿把同一份体放进 `done.result`),合流照旧。
+ * 幂等 = 同一调用方、同一键、**同一请求**:账本行记下绑定 `Idempotency-Key` 的那次请求的指纹(`task_run.idem_body_fingerprint`),
+ * 同键再投而指纹不同 ⇒ 唯一回执函数答 409(`http/submit-replay.ts`)。规范化只有两步:
+ *  · JSON 按键递归排序(唯一序列化器 `canonicalJson`;值为 `undefined` 的键与缺席同义)—— 键序不同的同一份体是同一请求;
+ *  · 去掉 `taskId` —— 它是同一条律的**另一把钥匙**(调用方自铸的主键),由回执函数的「钥匙指向别的行 ⇒ `conflict.run_exists`」判,
+ *    不是请求内容(换腿重投:流式腿不带 → durable 腿带回 `x-task-id`,仍是同一请求)。
+ * 头一概不进:身份已在键里(`idemKeyOf` 的身份位),其余头(`Idempotency-Key` 本身、`x-detach-on-disconnect` 一类连接语义)不是提交内容。
+ * 入参是**线上收到的那份体**(`readJson` 的产物),不是 `prepareSpec` 之后服务端盖过章的体 —— 指纹只由调用方看得见的字节构成,
+ * 否则两台配置不同的副本对同一次重试算出两只指纹。
  */
-export declare function inflightKeyOf(idemKey: string, face: SubmitReplayFace, clientTaskId?: string): string;
+export declare function submissionFingerprintOf(body: unknown): string;
+/**
+ * HTTP 提交腿(`POST /v1/tasks` · `/v1/tasks/stream` · `/v1/runs`)的**账本绑定**唯一铸法:键 = `idemKeyOf(raw, caller, "run")`,
+ * 指纹 = {@link submissionFingerprintOf}(线上收到的那份体)。三条腿在读到 `Idempotency-Key` 的同一处调它 —— 键与指纹同铸,不各拼一份。
+ * (A2A 的绑定不经这里:它的原始键就是消息内容指纹,绑定 = `{ key: idemKeyOf(指纹, …), bodyFingerprint: 指纹 }`,见 `routes/a2a-serve.ts`。)
+ */
+export declare function submissionIdemOf(raw: string, caller: IdemCaller, body: unknown): RunIdemBinding;
+/**
+ * 在飞合流的键 = 这次提交的**账本绑定**(幂等键 × 请求体指纹)× 这条腿的**回执形**(`durable` / `sync`)× 这次请求自带的 taskId。
+ *
+ * 合流交出的是**首个请求那条腿的结局**,所以只有「同一请求、同一条 run、同一种回执形、同一把 taskId」的请求才许合流:同键异体的
+ * 请求合进来就是静默拿到别的请求的结局(正是 409 `conflict.idempotency_payload_mismatch` 要拦的那件事);durable 腿合到同步腿的在飞
+ * 结局上会拿到 200 引擎结果而不是 202 收据;带另一个 taskId 的请求合进来就绕过了「key 指向别的行」那条 409。不许合流的请求各自走到
+ * 读行 / 建行,由店的原子赢或观察 + 唯一回执函数作答 —— 同体的仍是一条 run、各拿自己腿的回执形,异体的拿 409。同步腿与流式腿同形
+ * (流式腿把同一份体放进 `done.result`),合流照旧。
+ */
+export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFace, clientTaskId?: string): string;
 /**
  * 提交腿的**运行结局**(在飞合流共享的那一只)—— `status` + `body` 是它一直以来的两位;S-528 起多一位
  * `wiringManifest`。

package/dist/http/idempotency.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { canonicalJson } from "../canonical-json.js";
 import { gatedPrincipal } from "./principal-gate.js";
 export class IdempotencyCache {
     ttlMs;
@@ -77,7 +78,14 @@ export function idemIdentityOf(caller) {
 export function idemKeyOf(raw, caller, family) {
     return createHash("sha256").update(`${idemIdentityOf(caller)}\x1f${idemFamilyTag(family)}\x1f${raw}`).digest("hex");
 }
-export function inflightKeyOf(idemKey, face, clientTaskId) {
-    return `${idemKey}\x1f${face}\x1f${clientTaskId ?? ""}`;
+export function submissionFingerprintOf(body) {
+    const content = body !== null && typeof body === "object" && !Array.isArray(body) ? { ...body, taskId: undefined } : body;
+    return createHash("sha256").update(canonicalJson(content)).digest("hex");
+}
+export function submissionIdemOf(raw, caller, body) {
+    return { key: idemKeyOf(raw, caller, "run"), bodyFingerprint: submissionFingerprintOf(body) };
+}
+export function inflightKeyOf(idem, face, clientTaskId) {
+    return `${idem.key}\x1f${idem.bodyFingerprint}\x1f${face}\x1f${clientTaskId ?? ""}`;
 }
 //# sourceMappingURL=idempotency.js.map

package/dist/http/principal-gate.d.ts

@@ -92,6 +92,20 @@ export declare function sendUnauthorized(res: ServerResponse, face: Unauthorized
  * 那样「谁多给了 operator 一条路」在代码上看得见,而不是被偷偷塞进共享谓词里。
  */
 export declare function runOwnerReadable(principal: string | undefined, owner: string | null, config: ServiceConfig): boolean;
+/**
+ * 🔴 **「这台部署有没有身份边界」的唯一判据**(S-1452)。dev-open = 没配 service token(单一或 per-system)、没配只读 trace token、
+ * 也没开 `REQUIRE_PRINCIPAL`:请求里没有任何东西替主体头作保,头是谁都能自报的**标签**(过滤 / 展示用),不是身份。
+ * 三处读它、不各写一份:会话列表的 fleet-wide 第一臂(`isFleetWide`)、会话写面的 fleet-wide 第一臂(`sessionOwnerScopeForWrite`)、
+ * 会话面的属主谓词({@link sessionOwnerReadable})—— 于是「调用方是谁」在列表与单会话面上只有一只读法。
+ */
+export declare function devOpenDeployment(config: ServiceConfig): boolean;
+/**
+ * **「这个调用方能不能动这只会话」的唯一谓词**(会话面:视图 / head / 事件流 / 记忆状态与自助抹除 / 改名置顶 / 后台任务 / MCP 重连 /
+ * 面板的上一腿 MCP 投影)。= {@link devOpenDeployment} ∨ {@link runOwnerReadable}:没有身份边界的部署上不钉任何人(与会话列表同读,
+ * 列表把这只会话列给谁,谁就读得到它);有身份边界的部署上就是 run 面那一条谓词,一字不变。
+ * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
+ */
+export declare function sessionOwnerReadable(principal: string | undefined, owner: string | null, config: ServiceConfig): boolean;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
  *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
  *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.

package/dist/http/principal-gate.js

@@ -93,6 +93,13 @@ export function runOwnerReadable(principal, owner, config) {
         return true;
     return !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
 }
+export function devOpenDeployment(config) {
+    const anyServiceToken = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+    return !anyServiceToken && !config.traceToken && !config.requirePrincipal;
+}
+export function sessionOwnerReadable(principal, owner, config) {
+    return devOpenDeployment(config) || runOwnerReadable(principal, owner, config);
+}
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
 }

package/dist/http/request-guards.d.ts

@@ -84,7 +84,8 @@ export declare function createRequestGuards(ctx: {
         fleetWide: boolean;
         gateOwner: string | null;
     };
-    runOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session") => boolean;
+    runOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null) => boolean;
+    sessionOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null) => boolean;
     runSessionAcceptOk: (req: IncomingMessage, res: ServerResponse, run: {
         sessionId: string | null;
     }, face: string, notFoundError?: string) => boolean;

package/dist/http/request-guards.js

@@ -2,7 +2,7 @@ import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
 import { HttpError, principalFrom } from "../security.js";
 import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { sendError } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sessionOwnerReadable, devOpenDeployment, sendPrincipalRefusal } from "./principal-gate.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
 const MAX_BODY = 8 * 1024 * 1024;
 export function leaseRefusalOf(adm) {
@@ -150,9 +150,8 @@ export function createRequestGuards(ctx) {
         }
     }
     function isFleetWide(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        return (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined) || (!!tt && authorized(req, tt));
+        const tt = deps.config.traceToken;
+        return devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined || (!!tt && authorized(req, tt));
     }
     function sessionOwnerScope(req) {
         const fleetWide = isFleetWide(req);
@@ -160,27 +159,28 @@ export function createRequestGuards(ctx) {
         return { fleetWide, gateOwner };
     }
     function sessionOwnerScopeForWrite(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        const fleetWide = (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined);
+        const fleetWide = devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined;
         const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
         return { fleetWide, gateOwner };
     }
-    function runOwnerOk(req, res, owner, notFoundForm = "run") {
+    function ownerGate(req, res, readable, notFound) {
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
             sendPrincipalRefusal(res, req, deps.config);
             return false;
         }
-        if (!runOwnerReadable(principal, owner, deps.config)) {
-            if (notFoundForm === "session")
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-            else
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!readable(principal)) {
+            notFound();
             return false;
         }
         return true;
     }
+    function runOwnerOk(req, res, owner) {
+        return ownerGate(req, res, (principal) => runOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE));
+    }
+    function sessionOwnerOk(req, res, owner) {
+        return ownerGate(req, res, (principal) => sessionOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
+    }
     const sessionAssertAbsentWarned = new Set();
     function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {
         if (!run.sessionId)
@@ -229,6 +229,6 @@ export function createRequestGuards(ctx) {
         }
         return Buffer.concat(chunks);
     }
-    return { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, runSessionAcceptOk, readJson, readRawBody };
+    return { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody };
 }
 //# sourceMappingURL=request-guards.js.map

package/dist/http/resume-legs.d.ts

@@ -15,7 +15,7 @@ import type { IncomingMessage } from "node:http";
 import { CheckpointError, type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
 import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
-import { type HostDecision } from "../host-decision.js";
+import type { HostDecision } from "../host-decision.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
 import { type TrustedRunInternals } from "./durable-run-leg.js";
@@ -74,7 +74,7 @@ export declare function createResumeLegs(ctx: {
         readonly ok: true;
         readonly prepared: PreparedPlanReview;
     }>;
-    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
+    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
         status: number;
         body: object;
     }>;