@sema-agent/server 7.127.2 → 7.129.0

package/dist/egress-redirect.js

@@ -0,0 +1,7 @@
+export function egressRedirectRefusal(res, fix) {
+    if (res.type !== "opaqueredirect" && !(res.status >= 300 && res.status < 400))
+        return undefined;
+    void res.body?.cancel().catch(() => undefined);
+    return `endpoint answered with a redirect${res.status > 0 ? ` (HTTP ${res.status})` : ""}; it was not followed and no credential was sent anywhere else — ${fix}`;
+}
+//# sourceMappingURL=egress-redirect.js.map

package/dist/entry-mode-clamp-notice.d.ts

@@ -0,0 +1,30 @@
+/**
+ * S-1306 —— **入口地板钳制**通告(`engine_notice` 码 `permission.entry_mode_clamped`)的唯一铸点(core 7.51.0 #1527 入册:受众 user、
+ * 铸者 `NOTICE_MINTER` = `"server"`,引擎从不铸它)。
+ *
+ * ## 这件事为什么归本仓
+ * 运维 `AUTONOMY=plan` 的入口地板在**受理门**把调用方请求的模式词折回地板(`task-settings.ts` `stampEntryPermissionMode`,底下是
+ * `runtime-governance.ts` `entryPermissionMode` → core `clampPermissionMode`)—— 折叠发生在 run 到达引擎**之前**,所以引擎自己的
+ * `config.permission_mode_unavailable`(它只说它自己做的折叠)看不见这一折。修前 run 在另一个模式下起步,人一个字都看不到。
+ *
+ * ## 铸点(唯一)
+ * {@link buildEntryModeClampNotice} 是本码**唯一**的铸点;调用点只有一处:`http/admission.ts` 的 `prepareSpec`(提交入口,盖章之后、装配
+ * 之后 —— 那时会话 id 才定)。一次提交一次 ⇒ 一条 run 至多一帧(core 码册的去重单位「once per run」)。读的是盖章那一次求值的读数
+ * (`EntryPermissionMode`),不另判一遍「折没折」。续跑腿不铸:它们重放的是已盖过章的存储体,折叠只发生过一次。
+ * 装配期铸、腿开口那一拍投(`PreparedTaskSubmission.engineNotices` → `registerEngineNoticeLeg` 的 `pending`)—— 与请求腿 MCP 丢弃同一条投递路,
+ * 白名单 / 归属 / 消毒 / 隔离一个不绕。
+ *
+ * ## detail
+ * `{ requested, effective, ceiling, sessionId }` —— `requested` = 被折的那个词(体的生效词:顶层 `permissionMode` 或
+ * `settings.permissions.defaultMode`)、`effective` = run 起步的词、`ceiling` = 折它的地板,三个都是 core 的模式闭集词;`sessionId` = 归属键。
+ * 🔴 **无 `runId`**:钳制发生在受理门,引擎的 run 身份要到 prepare 才铸,这一刻不存在(core 码册那一行写了 `runId`;本仓不编造,
+ * 归属看它落在哪条 run 的流 / 账本上 —— 与 `instructions.source_changed` / `session.records_skipped` 同形)。
+ * 什么时候不铸:没有地板;没声明词(取地板本身不算改词,`clamped` 为假);请求的词不比地板松;会话 id 缺席(无处可投,宁缺不串)。
+ */
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+import type { EntryPermissionMode } from "./runtime-governance.js";
+/** 码常量型 = core 码册(#1527 入册:受众 user、铸者 `"server"`)。 */
+export declare const ENTRY_MODE_CLAMPED: EngineNoticeCode;
+/** 一次受理门盖章的读数 → 至多一条通告(读法见文件头)。 */
+export declare function buildEntryModeClampNotice(entry: EntryPermissionMode, sessionId: string | undefined): EngineNotice | undefined;
+//# sourceMappingURL=entry-mode-clamp-notice.d.ts.map

package/dist/entry-mode-clamp-notice.js

@@ -0,0 +1,13 @@
+export const ENTRY_MODE_CLAMPED = "permission.entry_mode_clamped";
+export function buildEntryModeClampNotice(entry, sessionId) {
+    const { requested, effective, floor, clamped } = entry;
+    if (!clamped || requested === undefined || floor === undefined || effective === undefined || sessionId === undefined || sessionId.length === 0)
+        return undefined;
+    return {
+        code: ENTRY_MODE_CLAMPED,
+        message: `This run starts in permission mode "${effective}", not the requested "${requested}": ` +
+            `the deployment's entry floor ("${floor}") clamps every submitted run's mode to it.`,
+        detail: { requested, effective, ceiling: floor, sessionId },
+    };
+}
+//# sourceMappingURL=entry-mode-clamp-notice.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -420,6 +420,13 @@ export interface BgNotification {
     seq?: number;
     status: "completed" | "failed" | "killed";
     summary?: string;
+    /** S-1296(core 7.51.0 #1482 / #1528):the child's REPORT — the same string the completion frame the parent's model reads carries
+     *  (core cuts it once at the frame's bound, redacting first), so a host that wakes an idle conversation reads it here instead of a
+     *  second, differently-cut copy. UNTRUSTED child text ⇒ `redactSecrets` at this wire boundary, exactly like `summary` on this frame
+     *  and `result` on the `task_notification` frame (one reading: the server redacts at its own boundary whatever upstream did).
+     *  Notification-only (the task ROW is state and never carries it). ABSENT when the frame carries none (a killed / failed leg with no
+     *  report, a withheld hand-back). */
+    result?: string;
     /** Background lifetime scope ([ref]), NOT the tenant scope. */
     scope: "task" | "session";
     parentTaskId?: string;

package/dist/fleet/fleet-bus.js

@@ -560,6 +560,7 @@ export function fleetBackgroundChildPublisher(bus, log) {
             ...(typeof e.seq === "number" ? { seq: e.seq } : {}),
             status: e.status ?? "failed",
             ...(e.summary ? { summary: redactSecrets(e.summary) } : {}),
+            ...(e.result !== undefined ? { result: redactSecrets(e.result) } : {}),
             scope: (m.sessionScoped || e.sessionScoped) ? "session" : "task",
             ...(m.parentTaskId ? { parentTaskId: m.parentTaskId } : m.resolvedParentId ? { parentTaskId: m.resolvedParentId } : {}),
             ...(e.completionId ? { completionId: e.completionId } : {}),

package/dist/hooks/hook-llm.js

@@ -2,6 +2,7 @@ import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyO
 import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
@@ -70,7 +71,7 @@ export function createHookLlm(deps) {
                     buildDisplaySafeRefusal(routeRefusalText(verdict), [pick.baseUrl, declaredRoot ?? ""]),
             };
         }
-        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
+        if (verdict.posture === "keyless" && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
             return {
                 ok: false,
                 error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
@@ -131,7 +132,10 @@ export function createHookLlm(deps) {
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });
             }
-            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal });
+            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal, redirect: "manual" });
+            const redirected = egressRedirectRefusal(r, "declare the final endpoint as this route's base URL");
+            if (redirected !== undefined)
+                return { ok: false, error: `hook llm ${redirected}` };
             if (!r.ok)
                 return { ok: false, error: `hook llm HTTP ${r.status}` };
             let text;

package/dist/hooks/hook-runner.d.ts

@@ -2,6 +2,7 @@ import { HooksConfig, type HookEventName } from "@sema-agent/settings-schema/hoo
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";
+/** 服务侧防线上限(契约本身不设量纲;不设界=单请求可塞任意大配置/任意长命令)。超界=校验错(fail-loud)。 */
 export declare const MAX_HOOK_ENTRIES_PER_EVENT = 32;
 export declare const MAX_HOOK_COMMAND_CHARS = 8192;
 /** 单条 hook 超时上限(秒;条目可自设 timeout,但被此值夹住——一个 86400 的 timeout 会挂死工具门)。 */

package/dist/hooks/hook-runner.js

@@ -9,7 +9,6 @@ import { redactSecrets, buildDisplaySafeUrl } from "../trace/redact.js";
 import { ccPromptSystemFor, wrapCondition, parseCcVerdict, CC_EVALUATOR_MAX_OUTPUT_TOKENS } from "./cc-stop-prompt.js";
 import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
-void resolveHostShell().catch(() => undefined);
 export const MAX_HOOK_ENTRIES_PER_EVENT = 32;
 export const MAX_HOOK_COMMAND_CHARS = 8_192;
 export const MAX_HOOK_TIMEOUT_SECONDS = 600;
@@ -391,7 +390,13 @@ function buildHookContextField(parts) {
     const text = buildHookContext(parts);
     return text === undefined ? {} : { additionalContext: text };
 }
-function runCommandHook(entry, payload, ctx) {
+async function runCommandHook(entry, payload, ctx) {
+    try {
+        await resolveHostShell();
+    }
+    catch (e) {
+        return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
+    }
     return new Promise((resolve) => {
         const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
         let child;
@@ -454,10 +459,11 @@ function runCommandHook(entry, payload, ctx) {
         child.stdin?.end(`${JSON.stringify(boundedToolInputPayload(payload))}\n`);
     });
 }
-function fireAsyncCommandHook(entry, payload, ctx, event) {
+async function fireAsyncCommandHook(entry, payload, ctx, event) {
     try {
         const rewake = entry.asyncRewake === true;
         const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
+        await resolveHostShell();
         const sh = hostShell();
         const child = spawn(sh.shell, [...sh.args, entry.command], {
             cwd: ctx.cwd,
@@ -754,7 +760,7 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
             if (entry.type === "command" && (entry.async || entry.asyncRewake)) {
                 if (entry.once)
                     onceFired.add(onceKey);
-                fireAsyncCommandHook(entry, payload, ctx, event);
+                void fireAsyncCommandHook(entry, payload, ctx, event);
                 continue;
             }
             if (Date.now() > deadlineAt) {

package/dist/host-lsp-manager.d.ts

@@ -6,10 +6,10 @@
  * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
  * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
  * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
- * `scrubServerSecrets` 的结果)。
+ * 本仓唯一组合 `hostSubprocessEnv` 的结果 —— 引擎 `inheritedHostEnv("scrub")` ∪ 点名放回)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = `scrubServerSecrets`(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(当时是 `OTEL_EXPORTER_OTLP_HEADERS`,core 7.33.7 #1180 起 core 按名剥它;今天只剩名单型旋钮三只),那正是 S-684 当初的病形。
@@ -23,7 +23,7 @@
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
- * env = `scrubServerSecrets`(process.env) 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与 host shell
+ * env = 引擎 `inheritedHostEnv("scrub")` 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与沙箱三腿
  * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥 —— 7.103.0 起这件组合只有一只:{@link hostSubprocessEnv}
  * (`server-secret-env.ts`,bake-runner 的 `BAKE_ENV_ALLOW` 调同一只)。名单由 `config.ts` 解析(形错拒启;
  * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。

package/dist/http/admission.js

@@ -3,6 +3,7 @@ import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCata
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -629,7 +630,7 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
-        const admitted = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
@@ -644,7 +645,9 @@ export function createAdmission(ctx) {
             });
             const model = modelIdOf(spec.model);
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
+            const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/resume-legs.js

@@ -49,9 +49,8 @@ import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyRepl
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
-function isCheckpointReopenedFailure(r) {
-    const code = failureCodeOf(r.terminal);
-    return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
+function legMayHaveReopenedCheckpoint(r) {
+    return r.terminal.kind === "failed" && nestedPauseOf(r.terminal) === undefined;
 }
 function nestedParkStatusOf(r) {
     const paused = nestedPauseOf(r.terminal);
@@ -476,6 +475,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
+        const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
         const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, { ...resumeCtx.ctx, writerVersion: serviceVersion() }).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
@@ -562,6 +562,32 @@ export function createResumeLegs(ctx) {
                 return true;
             }
         };
+        const settleCardForCancel = async () => {
+            const cs2 = deps.checkpointStore;
+            if (!cs2)
+                return;
+            try {
+                const live = await cs2.get(token);
+                if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
+                    deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                }
+            }
+            catch (cancelSettleErr) {
+                deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
+                    taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
+                });
+            }
+        };
+        const reopenedAfterLeg = async (leg, cancelledAtDone) => {
+            if (freshRunClaimed || !legMayHaveReopenedCheckpoint(leg))
+                return false;
+            const pending = cancelledAtDone ? false : await confirmCheckpointReopened();
+            if (cancelledAtDone || cancelCtrl.cause() !== undefined) {
+                await settleCardForCancel();
+                return false;
+            }
+            return pending;
+        };
         let resumeHeartbeat;
         let resumeManifestLease = 0;
         let resumeStreamRef;
@@ -685,7 +711,7 @@ export function createResumeLegs(ctx) {
                     const vrNested = nestedPauseOf(vr.terminal);
                     const reParkStatus = nestedParkStatusOf(vr);
                     const reSuspended = vrNested !== undefined;
-                    const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
+                    const vrReopened = await reopenedAfterLeg(vr, vrCause !== undefined);
                     if (vrReopened)
                         reopenConfirmedPark = true;
                     if (taskId && deps.runStore) {
@@ -696,7 +722,7 @@ export function createResumeLegs(ctx) {
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
                                 const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
-                                await ap(reParkStatus ?? "suspended", { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
+                                await ap(reParkStatus ?? reparkStatus, { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -819,8 +845,12 @@ export function createResumeLegs(ctx) {
                     resumeStreamRef = stream;
                     if (taskId)
                         steerableRuns.set(taskId, stream);
-                    if (!taskId || !rs)
-                        return sealResultForExit(await stream.result());
+                    if (!taskId || !rs) {
+                        const rNoRow = await stream.result();
+                        if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
+                            reopenConfirmedPark = true;
+                        return sealResultForExit(rNoRow);
+                    }
                     onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
                     let causeAtDone;
                     for await (const ev of stream) {
@@ -951,10 +981,10 @@ export function createResumeLegs(ctx) {
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
-                    if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
+                    if (await reopenedAfterLeg(r, causeAtDone !== undefined)) {
                         reopenConfirmedPark = true;
                         try {
-                            await append("suspended", { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
+                            await append(reparkStatus, { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
@@ -1000,20 +1030,7 @@ export function createResumeLegs(ctx) {
                 const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, outcome.gate) : undefined;
                 const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
-                    const cs2 = deps.checkpointStore;
-                    if (cs2) {
-                        try {
-                            const live = await cs2.get(token);
-                            if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
-                                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
-                            }
-                        }
-                        catch (cancelSettleErr) {
-                            deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
-                                taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
-                            });
-                        }
-                    }
+                    await settleCardForCancel();
                     if (claimedRow && taskId && deps.runStore) {
                         const handleCause = cancelCtrl.cause();
                         if (handleCause === undefined)
@@ -1035,8 +1052,8 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                     else if (retriable) {
-                        await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
-                        settleFleet(outcome.gate === "plan_review" ? "needs_review" : "suspended");
+                        await (reparkStatus === "needs_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
+                        settleFleet(reparkStatus);
                     }
                     else {
                         await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
@@ -1099,14 +1116,16 @@ export function createResumeLegs(ctx) {
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
         if (taskId && deps.runStore) {
-            if (resumePlane.status === "suspended" || checkpointReopened)
+            if (checkpointReopened && reparkStatus === "needs_review")
+                await deps.runStore.setNeedsReview(taskId, null);
+            else if (resumePlane.status === "suspended" || checkpointReopened)
                 await deps.runStore.setSuspended(taskId, sealed.terminal.kind === "paused" ? sealed : null);
             else if (resumePlane.status === "needs_review")
                 await deps.runStore.setNeedsReview(taskId, sealed);
             else
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(sealed));
+        settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
             decisionCommitted: true,

package/dist/http/route-ctx.d.ts

@@ -128,7 +128,7 @@ export interface PreparedTaskSubmission {
     cascade?: boolean;
     jobId?: string;
     body: TaskRequestBody;
-    /** L-167:**装配期**铸下的、这条会话的用户面 `EngineNotice`(今天只有请求腿 MCP 注入被丢弃一族)。
+    /** L-167:**装配期**铸下的、这条会话的用户面 `EngineNotice`(今天两族:请求腿 MCP 注入被丢弃;入口地板钳制 `permission.entry_mode_clamped`)。
      *  装配跑在这条腿的通告口开张之前,所以铸点交不出去 —— 由腿在 `registerEngineNoticeLeg` 那一拍
      *  经 `pending` 一起投(投递单点仍是那一只注册助手,不新开第二条机制)。缺席 = 本次装配没铸下任何通告。 */
     engineNotices?: readonly EngineNotice[];

package/dist/http/routes/approvals-assistant.js

@@ -18,7 +18,7 @@ import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
-import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
+import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -321,7 +321,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                         return;
                     }
                     const rows = await deps.approvalExemptionStore.list(exSessionId);
-                    sendJson(res, 200, { exemptions: rows.filter((r) => !answerGrantsBeyondCall({ toolName: r.toolName })) });
+                    sendJson(res, 200, { exemptions: rows.filter((r) => callGrantBindingOf({ toolName: r.toolName }).kind === "none") });
                     return;
                 }
                 if (exToolName === undefined) {
@@ -360,6 +360,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
                     ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
                     ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
+                    ...(s.boundGrantAbsence !== undefined ? { boundGrantAbsence: s.boundGrantAbsence } : {}),
                     objective,
                     input,
                 };
@@ -840,13 +841,14 @@ function projectPendingForWire(row, deployment) {
     const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
+    const deploymentListQuestion = carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes);
     const rememberRefused = !standingAnswerDurablyRecordable({
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantBinding: grantBindingOf(row),
+        grantBinding: questionGrantBindingOf(row, deploymentListQuestion),
         classes: row.classes,
-        deploymentListQuestion: carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes),
+        deploymentListQuestion,
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -73,6 +73,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
+                ...facts.engineCapabilityBits(),
                 asyncRuns: facts.durableRuns(deps).available,
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,

package/dist/http/routes/session-sync.js

@@ -14,7 +14,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
-import { readSessionRulesRecords, describeSessionRulesRecordProblem, legacyToolNameProblemOf } from "../../session-policy-wire.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
@@ -232,9 +232,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const policyRead = readSessionRulesRecords(body.policy);
                 if (policyRead.problem !== undefined) {
-                    const legacy = legacyToolNameProblemOf(policyRead.problem);
-                    if (legacy !== undefined) {
-                        sendError(res, 400, "rules.legacy_tool_name", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`, { ...legacy });
+                    if (policyRead.problem.kind === "rules") {
+                        sendSessionPolicyError(res, policyRead.problem.refusal, `policy: [${policyRead.problem.index}].rules: `);
                         return;
                     }
                     sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);

package/dist/http/routes/sessions.js

@@ -7,7 +7,7 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
+import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
@@ -819,22 +819,9 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const read = readWritableSessionPermissionRules(body.rules);
-            if (read.problem !== undefined) {
-                switch (read.problem.kind) {
-                    case "not-an-object":
-                        sendError(res, 400, "request.body_shape", describeSessionPermissionRulesProblem(read.problem));
-                        return;
-                    case "field-not-rule-list":
-                        sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
-                        return;
-                    case "legacy-tool-name":
-                        sendError(res, 400, "rules.legacy_tool_name", describeSessionPermissionRulesProblem(read.problem), { ...read.problem.refusal });
-                        return;
-                    default: {
-                        const unhandled = read.problem;
-                        throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
-                    }
-                }
+            if (read.refusal !== undefined) {
+                sendSessionPolicyError(res, read.refusal);
+                return;
             }
             if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
                 sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");

package/dist/http/send.d.ts

@@ -84,7 +84,7 @@ export declare function httpErrorCode(status: number, code?: string): string;
  * 域外通用臂 ⇒ `500 internal.error "internal error"`:码丢,连带**修复路径**也丢(同一行 `PUT` 却答
  * `500 corrupt` 并点名那一列)。一只腿之后,新站点只会忘记调它,不会再各自发明一份映射。
  */
-export declare function sendSessionPolicyError(res: ServerResponse, e: unknown): boolean;
+export declare function sendSessionPolicyError(res: ServerResponse, e: unknown, sentencePrefix?: string): boolean;
 /**
  * S-612 —— core `SessionError` → 应答,经 {@link sessionErrorHttp} 那**一只**映射(`src/session-error-wire.ts`)。
  * 回 `true` = 已应答,调用点 `return`;`false` = 不是 `SessionError`,或这个词在这一面上是登记过的留白(站点的既有

package/dist/http/send.js

@@ -1,5 +1,5 @@
 import { SessionError, SessionPolicyError } from "@sema-agent/core";
-import { sessionPolicyErrorHttp } from "../session-policy-wire.js";
+import { sessionPolicyErrorFacts, sessionPolicyErrorHttp, sessionPolicyErrorSentence } from "../session-policy-wire.js";
 import { sessionErrorHttp } from "../session-error-wire.js";
 import { redactErrorMessage } from "../observability/run-terminal.js";
 export const SSE_RESPONSE_MARK = Symbol("sema.http.sse-response");
@@ -48,11 +48,12 @@ export function httpErrorCode(status, code) {
         default: return status >= 500 ? "internal.error" : "request.rejected";
     }
 }
-export function sendSessionPolicyError(res, e) {
+export function sendSessionPolicyError(res, e, sentencePrefix = "") {
     if (!(e instanceof SessionPolicyError))
         return false;
     const h = sessionPolicyErrorHttp(e.code);
-    sendError(res, h.status, h.errorCode, redactErrorMessage(e.message) ?? "session policy error");
+    const facts = sessionPolicyErrorFacts(e);
+    sendError(res, h.status, h.errorCode, redactErrorMessage(`${sentencePrefix}${sessionPolicyErrorSentence(e)}`) ?? "session policy error", facts === undefined ? undefined : { ...facts });
     return true;
 }
 export function sendSessionError(res, e, face) {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,8 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
+import type { RequestMcpServerSpec } from "../mcp-assertion-header.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -311,7 +312,8 @@ export interface TaskRequestBody {
     excludeTools?: string[];
     /** S-1448(core 7.49.0 #1623,[ref]):引擎的**可用性选择器** —— 这一 run 只用列出的工具(wire 名、别名、`Tool(content)` 整只、
      *  `mcp__srv` / `mcp__srv__*` / 工具段通配;`"*"` = 本层不设名单;`[]` = 什么都不给)。宿主**原样透传**进 `TaskSpec.allowTools`:
-     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
+     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
+   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
      *  `excludeTools` 是同一只运算的减项(deny 赢)。值形:字符串数组(受理门 400 `request.field_invalid`,与 `excludeTools` 同一只门);
      *  装着的引擎不认该座 ⇒ 400 `request.field_invalid` 点名所需引擎版本(不静默丢)。无租户门(收窄)。 */
     allowTools?: string[];
@@ -414,7 +416,7 @@ export interface TaskRequestBody {
     /**
      * S-895(7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
      * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
-     *  · `"all"` —— 整份继承(`{ ...process.env }` 逐字原样,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
+     *  · `"all"` —— 整份用户环境**减本服务自有凭据名**(配置目录 secret 名 / 名单型旋钮名 / 模型条目 `apiKeyEnv`,起服向引擎声明一次,判在引擎;7.129.0 起,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
      *    `hostPostureDeclarationsHonored`(`hosted-posture.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
      *    422 `request.host_posture_refused`;
      *  · `"scrub"` —— 缺省清洗(剥凭据形变量),**任何车道、任何部署**都受理(它就是缺省;7.106.0 合并复审 X7)。
@@ -508,8 +510,15 @@ export interface TaskRequestBody {
      *  保留 —— 丢的只是声明。core 把这个键定性为**部署面**的键,本仓对它的 reject-or-strip 义务由既有的单用户闸
      *  **结构性**兑现:多租户腿整只 `mcpServers` 被忽略 ⇒ 租户够不着;单用户腿 = core 明文豁免的超管面
      *  (完整论证见 `task-mcp.ts` 的 `assertRequestMcpContentOrigin` 顶注)。部署面的正门是 center 下发的
-     *  `CenterMcpServer.contentOrigin`。 */
-    mcpServers?: McpServerSpec[];
+     *  `CenterMcpServer.contentOrigin`。
+     *
+     *  S-1515:`transport.kind:"http"` 的条目可选 `assertionHeader`(托管连接器断言头的**头名**,契约包 settings-schema ≥12.2.0 同键)。
+     *  与 `principalHeader` **互斥**:同设 ⇒ 新提交腿同步 400 `request.body_shape`(拒句与契约包解析期那一句逐字相同);值不是字符串 ⇒ 400
+     *  `request.field_invalid`。耐久 resume 腿不拒(重放存量 body),也**不摘 server**(摘了,park 在它工具审批上的任务批准后撞 `resume.tool_unavailable`
+     *  且每次重试重放同一份 body):降级到升级前的读法 —— server 照挂、`principalHeader` 胜、`assertionHeader` 不生效,一行 warn `mcp_assertion_header_ignored`。
+     *  ⚠️ 本版**只承载、不发送**:引擎的 http 传输尚无断言头座,
+     *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`;发送随引擎座。 */
+    mcpServers?: RequestMcpServerSpec[];
     /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
      *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment that has neither locked the `a2a` key nor
      *  had `a2a_peers` denied by its compliance posture (task-a2a.ts `a2aInjectionHonored`, the same three-veto

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export { createAuthorizer, principalFrom, HttpError, type AuthContext, type Owne
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export type { TaskRequestBody } from "./http/wire-types.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
-export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
+export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";

package/dist/index.js

@@ -21,7 +21,7 @@ export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
-export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
+export { createSideQueryLane } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";

package/dist/main.js

@@ -4,6 +4,7 @@ import { runStage02 } from "./boot/stage-02-web-admin-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
 import { runStage04 } from "./boot/stage-04-stores.js";
 import { runStage05 } from "./boot/stage-05-execution-env.js";
+import { settleHostLaneShell } from "./boot/execution-lane.js";
 import { runStage06 } from "./boot/stage-06-runners.js";
 import { runStage07 } from "./boot/stage-07-capability-layer.js";
 import { runStage08 } from "./boot/stage-08-reapers.js";
@@ -15,6 +16,7 @@ async function main() {
     const s03 = await runStage03(s02);
     const s04 = await runStage04(s03);
     const s05 = runStage05(s04);
+    await settleHostLaneShell(s05.config, s05.logger);
     const s06 = runStage06(s05);
     const s07 = await runStage07(s06);
     const s08 = runStage08(s07);