@sema-agent/server 7.125.1 → 7.127.0

package/dist/http/resume-legs.js

@@ -6,10 +6,9 @@ const sessionFaceUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
 };
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
-import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
-import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -23,10 +22,10 @@ import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
-import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
+import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
@@ -49,6 +48,7 @@ import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
+import { createRunAcceptance } from "../run-acceptance.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
     return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
@@ -68,6 +68,7 @@ const WORKER_SWAP_REDEEMABLE = {
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    requirements_damaged: false,
     read_face_damaged: false,
     read_face_forged: false,
     write_face_damaged: false,
@@ -162,7 +163,7 @@ function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
 export function createResumeLegs(ctx) {
-    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
     async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
@@ -769,10 +770,16 @@ export function createResumeLegs(ctx) {
                             if (!rs || !taskId)
                                 return;
                             const t = e.type;
-                            const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
+                            const warnAppend = (kind) => (err) => {
+                                createForwardAppendFailedNote(kind)(err);
+                                deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
+                            };
                             if (t === "task_progress") {
                                 void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
                             }
+                            else if (t === "task_started") {
+                                void append("task_started", taskStartedEventData(e)).catch(warnAppend(t));
+                            }
                             else if (t === "tool_start") {
                                 void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
                             }
@@ -901,6 +908,9 @@ export function createResumeLegs(ctx) {
                             case "message_committed":
                                 await anchor.onMessageCommitted(ev.role, ev.entryId);
                                 break;
+                            case "task_started":
+                                await append("task_started", taskStartedEventData(ev));
+                                break;
                             case "task_progress":
                                 await append("task_progress", taskProgressEventData(ev));
                                 break;
@@ -1085,7 +1095,6 @@ export function createResumeLegs(ctx) {
                 clearInterval(resumeHeartbeat);
             resumeLegLive = false;
         }
-        evictIfConflict(deps.runner, sessionId, result);
         const checkpointReopened = reopenConfirmedPark;
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
@@ -1214,7 +1223,7 @@ export function createResumeLegs(ctx) {
         const { spec, engineNotices } = resolved;
         const hostSpec = { ...spec, objective, sessionId };
         const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), ...(engineNotices.length > 0 ? { engineNotices } : {}) },
             fleetScope: resumeFleetScope(req, auth),
             elicitOwner: principal ?? null,
             source: "workflow_parked_decide",
@@ -1377,7 +1386,7 @@ export function createResumeLegs(ctx) {
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
-    async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {
+    async function drivePlanReview(prepared, decision, editedPlan, reason, hostDecision, req, acceptEarly, permissionModeAfter) {
         const { sessionId, token, cp, ctx } = prepared;
         if ((await deps.checkpointStore.findPendingTokenBySession(sessionId, undefined, { gateKinds: ["plan_review"] })) !== token)
             return notResumableAnswer();
@@ -1399,6 +1408,7 @@ export function createResumeLegs(ctx) {
             decision,
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
+            hostDecision,
         };
         const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         return out;
@@ -1406,7 +1416,7 @@ export function createResumeLegs(ctx) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview },
     };

package/dist/http/route-ctx.d.ts

@@ -72,11 +72,11 @@ export interface RouteHelpers {
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
     isFleetWide(req: IncomingMessage): boolean;
-    /** 属主门。`notFoundForm` 选 not-yours 臂的 404 拼法:缺省 `"run"`(not_found.run 长文,[ref]);**每一个 session
-     *  资源面都必须传 `"session"`**(not_found.session + {@link SESSION_NOT_FOUND_MESSAGE})与其 unknown 臂同码同串
-     *  (G52 [ref];S-989 补上了 detail / head / events 三个读口 —— 它们此前吃缺省 "run",单端点内 unknown / not-yours
-     *  两臂码与串都不同)。缺省 `"run"` 的语义不变:run 面不传。 */
-    runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session"): boolean;
+    /** run 面的属主门(谓词 `runOwnerReadable`;非属主 ⇒ 404 `not_found.run` + 长文,与 run 读口的 unknown 臂同码同串,[ref])。 */
+    runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
+    /** 会话面的属主门(谓词 `sessionOwnerReadable`,S-1452:没有身份边界的部署不钉人,与会话列表同读;非属主 ⇒ 404 `not_found.session` +
+     *  {@link SESSION_NOT_FOUND_MESSAGE},与会话读口的 unknown 臂同码同串 —— G52 [ref] / S-989)。每一个按会话寻址的属主判都走它。 */
+    sessionOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
     sessionOwnerScope(req: IncomingMessage): {
         fleetWide: boolean;
         gateOwner: string | null;
@@ -140,6 +140,12 @@ export interface PreparedTaskSubmission {
      * 成功点**必须**把它交给 `commitPlacement`(唯一写入属主;类级机器门钉住每个调用点都接了)。
      */
     bindingIntent?: import("./device-placement.js").DevicePlacementIntent;
+    /**
+     * 这次提交的**受理座**(`run-acceptance.ts`):标题器只在引擎受理之后起。提交门(`prepareSpec`)随 spec 一起铸;
+     * 三条提交腿只喂它(持流的形逐帧 `observe`,终局落行之后 `settle` 一次),不再各自判「什么时候起标题」。
+     * 不经提交门的内部车道(`/decide` 的宿主新 turn)铸一只不带标题器的座:不起标题。
+     */
+    acceptance: import("../run-acceptance.js").RunAcceptance;
 }
 /**
  * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
@@ -384,7 +390,7 @@ export interface RouteLegs {
         liveStream?: boolean;
     }): Promise<PreparedTaskSubmission | null>;
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
-    finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
+    finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
      *  `hostDecision` = **这次结算的事实**(谁结束了这次等待 + 通道自报的归属),必填:本腿有两个调用方
      *  (HTTP `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
@@ -461,7 +467,9 @@ export interface RouteLegs {
         readonly prepared: PreparedPlanReview;
     }>;
     /** plan_review 三态腿的**驱动段**(S-609):只吃 prepare 的结果,用它选定的 token,不再选卡、不再读 ctx。 */
-    drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
+    drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, 
+    /** core 7.49.0 #1396:决策事实(谁决定的 + 归属),语义属主 = `resume-legs.ts` 的同名形参顶注。 */
+    hostDecision: HostDecision, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
     acceptEarly?: boolean, 
     /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定

package/dist/http/routes/a2a-serve.js

@@ -123,7 +123,11 @@ function asNonEmptyString(v, what, max) {
         throw new RpcError(JSONRPC_INVALID_PARAMS, `${what} must be at most ${max} characters`);
     return v;
 }
-const MAX_CONTEXT_ID_CHARS = 64;
+function asString(v, what) {
+    if (typeof v !== "string")
+        throw new RpcError(JSONRPC_INVALID_PARAMS, `${what} must be a string`);
+    return v;
+}
 const MAX_MESSAGE_ID_CHARS = 200;
 const MAX_TASK_ID_CHARS = 128;
 const MAX_SKILL_ID_CHARS = 128;
@@ -224,7 +228,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     if (message.role !== "user")
         throw new RpcError(JSONRPC_INVALID_PARAMS, `params.message.role must be "user" (this is the inbound leg — an agent-role message has no meaning here)`);
     const objective = objectiveFromParts(message.parts);
-    const contextId = message.contextId === undefined ? undefined : asNonEmptyString(message.contextId, "params.message.contextId", MAX_CONTEXT_ID_CHARS);
+    const contextId = message.contextId === undefined ? undefined : asString(message.contextId, "params.message.contextId");
     const messageId = asNonEmptyString(message.messageId, "params.message.messageId", MAX_MESSAGE_ID_CHARS);
     const skill = skillFromMetadata(message.metadata, serve);
     const skillId = skill?.id;
@@ -238,19 +242,19 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         .update(skillId ?? "")
         .digest("hex");
     const submitter = caller.principal ?? undefined;
-    const idemKey = idemKeyOf(fingerprint, caller, "run");
+    const idem = { key: idemKeyOf(fingerprint, caller, "run"), bodyFingerprint: fingerprint };
     const body = {
         objective,
         taskId: durableIdempotencyTaskId(idemIdentityOf(caller), fingerprint),
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const keyed = (await runStore.getRunByIdem(idemKey).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
-    const replay = keyed ? await replayOfExistingRun(keyed, { principal: submitter, clientTaskId: body.taskId }, "durable", deps, runStore) : undefined;
+    const keyed = (await runStore.getRunByIdem(idem.key).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
+    const replay = keyed ? await replayOfExistingRun(keyed, { principal: submitter, clientTaskId: body.taskId, idem }, "durable", deps, runStore) : undefined;
     if (keyed && replay?.status === 202) {
         return taskFromRun(keyed, isStaleRun(keyed, deps.config.runStaleSec));
     }
-    const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idemKey, "durable", body.taskId)) : undefined;
+    const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idem, "durable", body.taskId)) : undefined;
     let receipt;
     if (replay !== undefined) {
         receipt = replay;
@@ -271,7 +275,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
             throw rpcErrorFromTypedFailure(typed, skillId);
         if (!prepared)
             return undefined;
-        receipt = await createDurableRun(req, res, ctx, prepared, idemKey);
+        receipt = await createDurableRun(req, res, ctx, prepared, idem);
     }
     if (!receipt)
         return undefined;

package/dist/http/routes/approvals-assistant.js

@@ -31,10 +31,10 @@ const DECIDE_BODY_DECLARED_KEYS = [
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
-    "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
+    "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
 const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason"];
-const PLAN_REVIEW_NOT_IN_PROOF_KEYS = [];
+const PLAN_REVIEW_NOT_IN_PROOF_KEYS = ["decidedBy"];
 const PROOF_SLOT_OF = {
     answer: "answer",
     boundCallId: "boundCallId",
@@ -522,6 +522,21 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
             }
+            const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
+            switch (decidedByReading.kind) {
+                case "not_in_proof":
+                    sendError(res, 400, "decided_by_not_in_proof", DECIDED_BY_NOT_IN_PROOF);
+                    return;
+                case "outside_closed_set":
+                    sendError(res, 400, "request.field_invalid", DECIDED_BY_OUTSIDE_CLOSED_SET);
+                    return;
+                case "accepted":
+                    break;
+                default: {
+                    const unreachable = decidedByReading;
+                    throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
+                }
+            }
             if (decision === "edit" && !isWellFormedUnicode(body.editedPlan)) {
                 sendError(res, 400, "request.field_invalid", "editedPlan must be well-formed Unicode text (a lone surrogate cannot be signed unambiguously)");
                 return;
@@ -626,7 +641,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
+            const out = await drivePlanReview(plan.prepared, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, hostDecisionFacts(decidedByReading.decidedBy, deciderPrincipal), req, true, isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined);
             sendResumeOutcome(res, out, deps.logger);
             return;
         }

package/dist/http/routes/background.d.ts

@@ -29,7 +29,7 @@
  * `rateLimited`。能力位 `background: { listFace, exitFaces }` 与两口的 501 从同一个谓词推导(会话属主面在场)。
  *
  * 🔴 **停止口在无凭据写门内**(`credentialGated: ["POST"]`;车OL F1 = 7.102.0 合并复审 gpt-6 腿 [high]):门的两个合取项它都中
- *   —— ① 授权的唯一输入是 principal 头(属主判 `runOwnerOk` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedPrincipal`,
+ *   —— ① 授权的唯一输入是 principal 头(属主判 `sessionOwnerOk` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedPrincipal`,
  *   无 service 凭证的部署上它收调用方自报的头);② 不可撤销、爆炸半径跨租户(知道会话 id + 自报它的属主 ⇒ 停掉那个会话的后台
  *   进程,`includeRetained:true` 连显式 retain 的活服务一起停)。于是无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的部署上它与
  *   其余改写门同码同句 503 `auth.service_token_required`(在路由之前,`dispatch.ts` 那一道),同一只会话级收敛函数的另一个调用点

package/dist/http/routes/background.js

@@ -68,7 +68,7 @@ export async function handleBackground(req, res, match, ctx) {
         return;
     }
     const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-    if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
+    if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
         return;
     const scope = owner ?? "default";
     switch (id) {

package/dist/http/routes/capabilities.js

@@ -1,6 +1,7 @@
 import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
+import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -205,7 +206,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 manualCompact: facts.durableRuns(deps).available,
                 configCatalog: facts.configCatalog(deps).available,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
-                workspaceSync: ((f) => (f.available ? f.policy : undefined))(facts.workspaceSpace(deps.config)),
+                workspaceSync: ((space, cache) => space.available || cache.available ? { ...(space.available ? space.policy : {}), ...(cache.available ? { cache: cache.cache } : {}) } : undefined)(facts.workspaceSpace(deps.config), facts.workspaceCache(deps.config)),
             }));
             return;
         }
@@ -256,7 +257,14 @@ export async function handleCapabilities(req, res, match, ctx) {
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
             const defaultName = (nonAlias.find(([, m]) => m === deps.config.model) ?? nonAlias.find(([, m]) => m.id === deps.config.model.id))?.[0];
-            sendJson(res, 200, { models, default: deps.config.model.id, defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) }, droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries) });
+            const candidateRejection = deps.candidateRejectionState?.();
+            sendJson(res, 200, {
+                models,
+                default: deps.config.model.id,
+                defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) },
+                droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries),
+                ...(candidateRejection !== undefined ? { candidateRejected: buildCandidateRejectedWire(candidateRejection) } : {}),
+            });
             return;
         }
         default:

package/dist/http/routes/mcp-reconnect.js

@@ -94,7 +94,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 return;
             }
             const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!isOperator && !ctx.helpers.runOwnerOk(req, res, owner, "session"))
+            if (!isOperator && !ctx.helpers.sessionOwnerOk(req, res, owner))
                 return;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);

package/dist/http/routes/runs.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RunIdemBinding } from "../../plugins/store-contracts.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 行上的 `decision_actor`(裸 JSON)投成回显形;形不认 ⇒ undefined(调用点省略该键,不 500)。
@@ -31,9 +32,9 @@ export declare function handleRunVerbs(req: IncomingMessage, res: ServerResponse
  *    防御性复检(缺席 ⇒ 501),但两个调用方都在自己的入口先判过,那才是各自面上的正确错误形。
  */
 export declare function createDurableRun(req: IncomingMessage, res: ServerResponse, ctx: RouteCtx, prepared: PreparedTaskSubmission, 
-/** 这次提交的幂等键(`idemKeyOf(…, "run")`:`POST /v1/runs` = `Idempotency-Key` 头派生;A2A = `message.messageId`
- *  + 内容指纹派生)—— 落 `task_run.idem_key`,同时是同进程在飞合流的键。undefined = 调用方没带键。 */
-idemKey: string | undefined): Promise<{
+/** 这次提交的账本绑定(键 `idemKeyOf(…, "run")` + 请求体指纹:`POST /v1/runs` = `Idempotency-Key` 头 + 线上收到的体;A2A =
+ *  `message.messageId` + 内容指纹)—— 落 `task_run.idem_key` / `idem_body_fingerprint`,键同时是同进程在飞合流的键。undefined = 调用方没带键。 */
+idem: RunIdemBinding | undefined): Promise<{
     status: number;
     body: unknown;
 } | null>;

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { liveToolEndForBacklog } from "../../trace/tool-output-media.js";
 import { redactHead, redactLedgerEventForRead } from "../../observability/run-terminal.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
@@ -7,7 +8,7 @@ import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
-import { idemCallerOf, idemKeyOf, inflightKeyOf } from "../idempotency.js";
+import { idemCallerOf, idemKeyOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
@@ -33,6 +34,7 @@ import { readResumeCtx } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { storedBodyReplayRefusal } from "../stored-body-replay.js";
+import { steerBodyKeyIssue } from "../../request-key-closure.js";
 const STEER_PRIORITY_WORDS = INJECTION_TIERS.map((tier) => `'${tier}'`);
 const STEER_PRIORITY_UNION = STEER_PRIORITY_WORDS.join(" | ");
 const STEER_PRIORITY_CHOICES = STEER_PRIORITY_WORDS.length <= 2 ? STEER_PRIORITY_WORDS.join(" or ") : `${STEER_PRIORITY_WORDS.slice(0, -1).join(", ")}, or ${STEER_PRIORITY_WORDS[STEER_PRIORITY_WORDS.length - 1]}`;
@@ -188,19 +190,18 @@ export async function handleRuns(req, res, match, ctx) {
         const runStore = runs.runStore;
         const rawIdem = headerStr(req.headers["idempotency-key"]);
         const submitter = gatedPrincipal(req, deps.config);
-        const idemKey = rawIdem ? idemKeyOf(rawIdem, idemCallerOf(req, ctx), "run") : undefined;
-        let keyedBody;
-        if (idemKey) {
-            keyedBody = await readJson(req);
+        const keyedBody = rawIdem ? await readJson(req) : undefined;
+        const idem = rawIdem ? submissionIdemOf(rawIdem, idemCallerOf(req, ctx), keyedBody) : undefined;
+        if (idem) {
             const clientTaskId = clientTaskIdOf(keyedBody);
             if (clientTaskId === false) {
                 sendError(res, 400, "request.id_invalid", "body.taskId must be a uuidv7 string (caller-minted idempotency key)");
                 return;
             }
-            const inflight = idemCache.peek(inflightKeyOf(idemKey, "durable", clientTaskId));
-            const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idemKey);
+            const inflight = idemCache.peek(inflightKeyOf(idem, "durable", clientTaskId));
+            const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idem.key);
             if (inflight || keyedRow) {
-                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { principal: submitter, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
+                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
                 sendJson(res, resp.status, resp.body);
                 return;
             }
@@ -210,7 +211,7 @@ export async function handleRuns(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody);
         if (!prepared)
             return;
-        const resp = await createDurableRun(req, res, ctx, prepared, idemKey);
+        const resp = await createDurableRun(req, res, ctx, prepared, idem);
         if (!resp)
             return;
         sendJson(res, resp.status, resp.body);
@@ -414,6 +415,13 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 400, "request.body_shape", `body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: ${STEER_PRIORITY_UNION} }`);
             return;
         }
+        {
+            const keyIssue = steerBodyKeyIssue(body, "run");
+            if (keyIssue) {
+                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                return;
+            }
+        }
         if (body.mode !== undefined && body.mode !== "all" && body.mode !== "one-at-a-time") {
             sendError(res, 400, "request.field_invalid", "mode must be 'all' or 'one-at-a-time' when present");
             return;
@@ -738,6 +746,11 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             text = interruptBody.text;
+            const keyIssue = steerBodyKeyIssue(interruptBody, "interrupt");
+            if (keyIssue) {
+                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                return;
+            }
         }
         const interruptIdemRaw = headerStr(req.headers["idempotency-key"]);
         const interruptInputId = interruptIdemRaw ? `idem-${idemKeyOf(interruptIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
@@ -1041,7 +1054,8 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 const n = await it.next();
                 if (n.done || closed || res.writableEnded)
                     break;
-                res.write(`event: forward\ndata: ${JSON.stringify(n.value)}\n\n`);
+                const frame = n.value.type === "tool_end" ? liveToolEndForBacklog(n.value, res.writableLength) : n.value;
+                res.write(`event: forward\ndata: ${JSON.stringify(frame)}\n\n`);
                 if (n.value.type === "task_settled")
                     break;
             }
@@ -1162,6 +1176,13 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.body_shape", "body must be { content: string (non-empty) }");
             return;
         }
+        {
+            const keyIssue = steerBodyKeyIssue(body, "content");
+            if (keyIssue) {
+                sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                return;
+            }
+        }
         if (body.content.length > STEER_IN_MAX_REQUEST_CHARS) {
             sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
             return;
@@ -1586,7 +1607,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
     }
     return assertNever(match.decl.id);
 }
-export async function createDurableRun(req, res, ctx, prepared, idemKey) {
+export async function createDurableRun(req, res, ctx, prepared, idem) {
     const { deps } = ctx;
     const { idemCache } = ctx.registry;
     const { leaseDenied, usageWindowDenied } = ctx.helpers;
@@ -1603,7 +1624,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
         return null;
     }
     const submitter = gatedPrincipal(req, deps.config);
-    const caller = { principal: submitter, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
+    const caller = { principal: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
     if (clientTaskId) {
         const existing = await runStore.getRun(clientTaskId);
         if (existing)
@@ -1611,11 +1632,11 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
     }
     if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
         return null;
-    return await idemCache.run(idemKey !== undefined ? inflightKeyOf(idemKey, "durable", clientTaskId) : undefined, async () => {
+    return await idemCache.run(idem !== undefined ? inflightKeyOf(idem, "durable", clientTaskId) : undefined, async () => {
         const out = await mintAndDriveDurableRun({ deps, registry: ctx.registry, helpers: ctx.helpers, local: ctx.local, legs: ctx.legs }, runStore, {
             prepared,
             ...(clientTaskId !== undefined ? { clientTaskId } : {}),
-            ...(idemKey !== undefined ? { idemKey } : {}),
+            ...(idem !== undefined ? { idem } : {}),
             fleetScope: submitter ?? "default",
             elicitOwner: submitter ?? null,
             source,

package/dist/http/routes/session-sync.js

@@ -44,7 +44,6 @@ export async function handleSessionSync(req, res, match, ctx) {
                 return;
             }
             const { backend, sessionStorage, historyStore } = sync;
-            const ownerOf = sessionStorage.ownerOf.bind(sessionStorage);
             const scope = sessionOwnerScopeForWrite(req);
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
@@ -55,7 +54,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const gateFace = await sessionStorage.sessionFaceOf(sessionId);
+            const owner = gateFace === undefined ? undefined : gateFace.owner;
             const ownsOrFleet = (o) => scope.fleetWide || o === scope.gateOwner;
             const pullGateOk = () => {
                 if (owner === undefined) {
@@ -75,13 +75,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 return true;
             };
-            const replaySessionRow = async (row, importedOwner) => {
+            const replaySessionRow = async (row, face) => {
                 if (Object.keys(row).length === 0)
-                    return;
-                const face = await sessionStorage.sessionFaceOf(sessionId);
-                if (face === undefined || face.owner !== importedOwner)
-                    return;
-                await sessionStorage.patchSessionMeta(sessionId, row, face);
+                    return true;
+                return face !== undefined && (await sessionStorage.patchSessionMeta(sessionId, row, face)) !== undefined;
             };
             if (match.decl.id === "session-sync-manifest") {
                 if (!pullGateOk())
@@ -331,7 +328,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
                             await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingP);
-                    await replaySessionRow(row, owner);
+                    if (!(await replaySessionRow(row, gateFace))) {
+                        sendError(res, 409, "conflict", "sync conflict");
+                        return;
+                    }
                     sendJson(res, 200, {
                         relation: "identical",
                         basis: payloadVerified ? "entry-ids+digest" : "entry-ids",
@@ -521,9 +521,13 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (anchorStore)
                         for (const a of pending.anchors)
                             await anchorStore.put(sessionId, a.eventId, a.entryId, pending.owner);
-                    await replaySessionRow(pending.row, pending.owner);
+                    const rowLanded = await replaySessionRow(pending.row, committed.face);
                     sessionStorage.evict?.(sessionId);
                     cleanupStaging(stagingId);
+                    if (!rowLanded) {
+                        sendError(res, 409, "conflict", "sync conflict");
+                        return;
+                    }
                     sendJson(res, 200, { relation: committed.relation });
                 }
                 catch (e) {
@@ -567,7 +571,6 @@ export async function handleSessionSync(req, res, match, ctx) {
 function sendSessionSyncUnavailable(res, why) {
     switch (why) {
         case "store_backend_absent":
-        case "session_owner_face_absent":
         case "session_row_faces_absent":
             sendError(res, 501, "capability.session_store_required", "session sync requires a durable session store");
             return;