@sema-agent/server 7.128.0 → 7.129.0

package/dist/capability-facts.d.ts

@@ -328,5 +328,7 @@ export declare function workspaceCache(c: Pick<ServiceConfig, "remoteExec">): Fa
 }>;
 /** 自唤醒调度器挂在宿主 env 上:`SCHEDULER_ENABLED` ∧ 单用户 ∧ host 车道。装配(`boot/execution-env.ts`)与能力位同调。 */
 export declare function hostScheduler(c: Pick<ServiceConfig, "schedulerEnabled" | "requirePrincipal" | "remoteExec">): Fact<"scheduler_disabled" | "multi_tenant_deployment" | "not_host_lane">;
-export {};
+/** 引擎能力词的事实(core `ENGINE_CAPABILITIES` 每词一只谓词,值 = 本进程的事实;`/v1/capabilities` 以顶层布尔键展开它们)—— 住在
+ *  `capabilities/engine-capabilities.ts`,这里只是把它纳入「能力位只投影事实」的同一张读面,静态门认 `facts.engineCapabilityBits()` 这一只展开。 */
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.d.ts.map

package/dist/capability-facts.js

@@ -378,4 +378,5 @@ export function hostScheduler(c) {
         return no("not_host_lane");
     return YES;
 }
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.js.map

package/dist/config-types.d.ts

@@ -471,8 +471,9 @@ export interface ServiceConfigFlat {
      *  由 boot(config.ts)与热路径(apply-effective)同一只判据保证。 */
     gatewayBaseUrl?: string;
     /** `MODEL_API_KEY` —— **网关的**凭据,只与网关根配对([ref])。S-623:与 `gatewayBaseUrl` 同进同出 ——
-     *  没有网关就不装载(否则 brain 的声明根为空 ⇒ core 判 `unpinned` ⇒ 这把 key 会被送到每条自带 baseUrl 的
-     *  openai 条目),由 `model_gateway_key_unpaired` 启动通知说出来。 */
+     *  没有网关就不装载(否则 brain 的声明根为空:core 7.51.0 起判 `route.credential_mismatch`,每条自带 baseUrl、没有
+     *  per-model 凭据的 openai 条目被拒;7.51.0 前是 `unpinned`,key 随请求发往那些条目),由 `model_gateway_key_unpaired`
+     *  启动通知说出来。S-1561:brain 在构造时读它一次(core 收据律),本仓没有运行期写者 ⇒ 换值 = 重启。 */
     gatewayApiKey?: string;
     /** Secondary openai-compatible gateways for cross-gateway FAILOVER (same protocol + same model id).
      *  Tried in order after the primary when a gateway fails before streaming any content. */
@@ -1759,7 +1760,7 @@ export interface ServiceConfigFlat {
      *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
     /** S-699 —— host-lane language-server env **named allowlist** (`LSP_ENV_ALLOW=NAME,NAME`). The language server's env is
-     *  `scrubServerSecrets(process.env)`; each name here is put back **verbatim** from the service's own env on top of that
+     *  the engine's `inheritedHostEnv("scrub")` (shape rules + this deployment's declared own credentials); each name here is put back **verbatim** from the service's own env on top of that
      *  (`allowlistedEnv`, the same "named keys pass" predicate as the host shell's `inheritEnv:[names]`) — the deployer
      *  explicitly accepts handing that value to code the language server runs. Unnamed secret-shaped keys stay stripped.
      *  `[]` = nothing put back (the default: unset / empty string). A malformed list (empty segment / not an env-var name /

package/dist/egress-redirect.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 本服务**自己**发往配置端点的出站请求(hook 直连模型腿 `hooks/hook-llm.ts`、记忆 embedder `plugins/memory-embedder.ts`)的
+ * 重定向律 —— 与 core 7.51.0(#1531)一方 brain 的请求同一条:请求以 `redirect: "manual"` 发出,端点回重定向 ⇒ 拒;
+ * 不跟、不重试、拒句不点名目标。
+ *
+ * 为什么:请求只去被判过的那个根。传输层(undici)跟随 POST 307 / 308 时把请求体(用户内容 / 记忆正文)原样送到
+ * `Location`,跨 origin 只剥 `authorization` —— anthropic 形的 `x-api-key` 随行(`test/hook-llm.test.ts` 的 G1 格在
+ * 7.128.x 上实测送达重定向目标)。判据与拒句与 core 的 brain 请求门同形(`opaqueredirect` 或 3xx)。
+ */
+/** 端点回的是重定向 ⇒ 拒句(调用方在前面冠上自己的面名);否则 `undefined`。命中时丢弃响应体(不读、不留连接)。 */
+export declare function egressRedirectRefusal(res: Response, fix: string): string | undefined;
+//# sourceMappingURL=egress-redirect.d.ts.map

package/dist/egress-redirect.js

@@ -0,0 +1,7 @@
+export function egressRedirectRefusal(res, fix) {
+    if (res.type !== "opaqueredirect" && !(res.status >= 300 && res.status < 400))
+        return undefined;
+    void res.body?.cancel().catch(() => undefined);
+    return `endpoint answered with a redirect${res.status > 0 ? ` (HTTP ${res.status})` : ""}; it was not followed and no credential was sent anywhere else — ${fix}`;
+}
+//# sourceMappingURL=egress-redirect.js.map

package/dist/entry-mode-clamp-notice.d.ts

@@ -0,0 +1,30 @@
+/**
+ * S-1306 —— **入口地板钳制**通告(`engine_notice` 码 `permission.entry_mode_clamped`)的唯一铸点(core 7.51.0 #1527 入册:受众 user、
+ * 铸者 `NOTICE_MINTER` = `"server"`,引擎从不铸它)。
+ *
+ * ## 这件事为什么归本仓
+ * 运维 `AUTONOMY=plan` 的入口地板在**受理门**把调用方请求的模式词折回地板(`task-settings.ts` `stampEntryPermissionMode`,底下是
+ * `runtime-governance.ts` `entryPermissionMode` → core `clampPermissionMode`)—— 折叠发生在 run 到达引擎**之前**,所以引擎自己的
+ * `config.permission_mode_unavailable`(它只说它自己做的折叠)看不见这一折。修前 run 在另一个模式下起步,人一个字都看不到。
+ *
+ * ## 铸点(唯一)
+ * {@link buildEntryModeClampNotice} 是本码**唯一**的铸点;调用点只有一处:`http/admission.ts` 的 `prepareSpec`(提交入口,盖章之后、装配
+ * 之后 —— 那时会话 id 才定)。一次提交一次 ⇒ 一条 run 至多一帧(core 码册的去重单位「once per run」)。读的是盖章那一次求值的读数
+ * (`EntryPermissionMode`),不另判一遍「折没折」。续跑腿不铸:它们重放的是已盖过章的存储体,折叠只发生过一次。
+ * 装配期铸、腿开口那一拍投(`PreparedTaskSubmission.engineNotices` → `registerEngineNoticeLeg` 的 `pending`)—— 与请求腿 MCP 丢弃同一条投递路,
+ * 白名单 / 归属 / 消毒 / 隔离一个不绕。
+ *
+ * ## detail
+ * `{ requested, effective, ceiling, sessionId }` —— `requested` = 被折的那个词(体的生效词:顶层 `permissionMode` 或
+ * `settings.permissions.defaultMode`)、`effective` = run 起步的词、`ceiling` = 折它的地板,三个都是 core 的模式闭集词;`sessionId` = 归属键。
+ * 🔴 **无 `runId`**:钳制发生在受理门,引擎的 run 身份要到 prepare 才铸,这一刻不存在(core 码册那一行写了 `runId`;本仓不编造,
+ * 归属看它落在哪条 run 的流 / 账本上 —— 与 `instructions.source_changed` / `session.records_skipped` 同形)。
+ * 什么时候不铸:没有地板;没声明词(取地板本身不算改词,`clamped` 为假);请求的词不比地板松;会话 id 缺席(无处可投,宁缺不串)。
+ */
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+import type { EntryPermissionMode } from "./runtime-governance.js";
+/** 码常量型 = core 码册(#1527 入册:受众 user、铸者 `"server"`)。 */
+export declare const ENTRY_MODE_CLAMPED: EngineNoticeCode;
+/** 一次受理门盖章的读数 → 至多一条通告(读法见文件头)。 */
+export declare function buildEntryModeClampNotice(entry: EntryPermissionMode, sessionId: string | undefined): EngineNotice | undefined;
+//# sourceMappingURL=entry-mode-clamp-notice.d.ts.map

package/dist/entry-mode-clamp-notice.js

@@ -0,0 +1,13 @@
+export const ENTRY_MODE_CLAMPED = "permission.entry_mode_clamped";
+export function buildEntryModeClampNotice(entry, sessionId) {
+    const { requested, effective, floor, clamped } = entry;
+    if (!clamped || requested === undefined || floor === undefined || effective === undefined || sessionId === undefined || sessionId.length === 0)
+        return undefined;
+    return {
+        code: ENTRY_MODE_CLAMPED,
+        message: `This run starts in permission mode "${effective}", not the requested "${requested}": ` +
+            `the deployment's entry floor ("${floor}") clamps every submitted run's mode to it.`,
+        detail: { requested, effective, ceiling: floor, sessionId },
+    };
+}
+//# sourceMappingURL=entry-mode-clamp-notice.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -420,6 +420,13 @@ export interface BgNotification {
     seq?: number;
     status: "completed" | "failed" | "killed";
     summary?: string;
+    /** S-1296(core 7.51.0 #1482 / #1528):the child's REPORT — the same string the completion frame the parent's model reads carries
+     *  (core cuts it once at the frame's bound, redacting first), so a host that wakes an idle conversation reads it here instead of a
+     *  second, differently-cut copy. UNTRUSTED child text ⇒ `redactSecrets` at this wire boundary, exactly like `summary` on this frame
+     *  and `result` on the `task_notification` frame (one reading: the server redacts at its own boundary whatever upstream did).
+     *  Notification-only (the task ROW is state and never carries it). ABSENT when the frame carries none (a killed / failed leg with no
+     *  report, a withheld hand-back). */
+    result?: string;
     /** Background lifetime scope ([ref]), NOT the tenant scope. */
     scope: "task" | "session";
     parentTaskId?: string;

package/dist/fleet/fleet-bus.js

@@ -560,6 +560,7 @@ export function fleetBackgroundChildPublisher(bus, log) {
             ...(typeof e.seq === "number" ? { seq: e.seq } : {}),
             status: e.status ?? "failed",
             ...(e.summary ? { summary: redactSecrets(e.summary) } : {}),
+            ...(e.result !== undefined ? { result: redactSecrets(e.result) } : {}),
             scope: (m.sessionScoped || e.sessionScoped) ? "session" : "task",
             ...(m.parentTaskId ? { parentTaskId: m.parentTaskId } : m.resolvedParentId ? { parentTaskId: m.resolvedParentId } : {}),
             ...(e.completionId ? { completionId: e.completionId } : {}),

package/dist/hooks/hook-llm.js

@@ -2,6 +2,7 @@ import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyO
 import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
@@ -70,7 +71,7 @@ export function createHookLlm(deps) {
                     buildDisplaySafeRefusal(routeRefusalText(verdict), [pick.baseUrl, declaredRoot ?? ""]),
             };
         }
-        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
+        if (verdict.posture === "keyless" && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
             return {
                 ok: false,
                 error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
@@ -131,7 +132,10 @@ export function createHookLlm(deps) {
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });
             }
-            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal });
+            const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal, redirect: "manual" });
+            const redirected = egressRedirectRefusal(r, "declare the final endpoint as this route's base URL");
+            if (redirected !== undefined)
+                return { ok: false, error: `hook llm ${redirected}` };
             if (!r.ok)
                 return { ok: false, error: `hook llm HTTP ${r.status}` };
             let text;

package/dist/host-lsp-manager.d.ts

@@ -6,10 +6,10 @@
  * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
  * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
  * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
- * `scrubServerSecrets` 的结果)。
+ * 本仓唯一组合 `hostSubprocessEnv` 的结果 —— 引擎 `inheritedHostEnv("scrub")` ∪ 点名放回)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = `scrubServerSecrets`(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = 引擎 `inheritedHostEnv("scrub")`(形状剥 ∪ 本进程起服声明的自有凭据名)∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(当时是 `OTEL_EXPORTER_OTLP_HEADERS`,core 7.33.7 #1180 起 core 按名剥它;今天只剩名单型旋钮三只),那正是 S-684 当初的病形。
@@ -23,7 +23,7 @@
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
- * env = `scrubServerSecrets`(process.env) 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与 host shell
+ * env = 引擎 `inheritedHostEnv("scrub")` 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与沙箱三腿
  * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥 —— 7.103.0 起这件组合只有一只:{@link hostSubprocessEnv}
  * (`server-secret-env.ts`,bake-runner 的 `BAKE_ENV_ALLOW` 调同一只)。名单由 `config.ts` 解析(形错拒启;
  * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。

package/dist/http/admission.js

@@ -3,6 +3,7 @@ import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCata
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -629,7 +630,7 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
-        const admitted = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
@@ -644,7 +645,9 @@ export function createAdmission(ctx) {
             });
             const model = modelIdOf(spec.model);
             const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
+            const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/resume-legs.js

@@ -49,9 +49,8 @@ import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyRepl
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
-function isCheckpointReopenedFailure(r) {
-    const code = failureCodeOf(r.terminal);
-    return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
+function legMayHaveReopenedCheckpoint(r) {
+    return r.terminal.kind === "failed" && nestedPauseOf(r.terminal) === undefined;
 }
 function nestedParkStatusOf(r) {
     const paused = nestedPauseOf(r.terminal);
@@ -476,6 +475,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
+        const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
         const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, { ...resumeCtx.ctx, writerVersion: serviceVersion() }).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
@@ -562,6 +562,32 @@ export function createResumeLegs(ctx) {
                 return true;
             }
         };
+        const settleCardForCancel = async () => {
+            const cs2 = deps.checkpointStore;
+            if (!cs2)
+                return;
+            try {
+                const live = await cs2.get(token);
+                if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
+                    deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                }
+            }
+            catch (cancelSettleErr) {
+                deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
+                    taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
+                });
+            }
+        };
+        const reopenedAfterLeg = async (leg, cancelledAtDone) => {
+            if (freshRunClaimed || !legMayHaveReopenedCheckpoint(leg))
+                return false;
+            const pending = cancelledAtDone ? false : await confirmCheckpointReopened();
+            if (cancelledAtDone || cancelCtrl.cause() !== undefined) {
+                await settleCardForCancel();
+                return false;
+            }
+            return pending;
+        };
         let resumeHeartbeat;
         let resumeManifestLease = 0;
         let resumeStreamRef;
@@ -685,7 +711,7 @@ export function createResumeLegs(ctx) {
                     const vrNested = nestedPauseOf(vr.terminal);
                     const reParkStatus = nestedParkStatusOf(vr);
                     const reSuspended = vrNested !== undefined;
-                    const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
+                    const vrReopened = await reopenedAfterLeg(vr, vrCause !== undefined);
                     if (vrReopened)
                         reopenConfirmedPark = true;
                     if (taskId && deps.runStore) {
@@ -696,7 +722,7 @@ export function createResumeLegs(ctx) {
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
                                 const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
-                                await ap(reParkStatus ?? "suspended", { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
+                                await ap(reParkStatus ?? reparkStatus, { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -819,8 +845,12 @@ export function createResumeLegs(ctx) {
                     resumeStreamRef = stream;
                     if (taskId)
                         steerableRuns.set(taskId, stream);
-                    if (!taskId || !rs)
-                        return sealResultForExit(await stream.result());
+                    if (!taskId || !rs) {
+                        const rNoRow = await stream.result();
+                        if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
+                            reopenConfirmedPark = true;
+                        return sealResultForExit(rNoRow);
+                    }
                     onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
                     let causeAtDone;
                     for await (const ev of stream) {
@@ -951,10 +981,10 @@ export function createResumeLegs(ctx) {
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
-                    if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
+                    if (await reopenedAfterLeg(r, causeAtDone !== undefined)) {
                         reopenConfirmedPark = true;
                         try {
-                            await append("suspended", { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
+                            await append(reparkStatus, { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
@@ -1000,20 +1030,7 @@ export function createResumeLegs(ctx) {
                 const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, outcome.gate) : undefined;
                 const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
-                    const cs2 = deps.checkpointStore;
-                    if (cs2) {
-                        try {
-                            const live = await cs2.get(token);
-                            if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
-                                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
-                            }
-                        }
-                        catch (cancelSettleErr) {
-                            deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
-                                taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
-                            });
-                        }
-                    }
+                    await settleCardForCancel();
                     if (claimedRow && taskId && deps.runStore) {
                         const handleCause = cancelCtrl.cause();
                         if (handleCause === undefined)
@@ -1035,8 +1052,8 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                     else if (retriable) {
-                        await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
-                        settleFleet(outcome.gate === "plan_review" ? "needs_review" : "suspended");
+                        await (reparkStatus === "needs_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
+                        settleFleet(reparkStatus);
                     }
                     else {
                         await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
@@ -1099,14 +1116,16 @@ export function createResumeLegs(ctx) {
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
         if (taskId && deps.runStore) {
-            if (resumePlane.status === "suspended" || checkpointReopened)
+            if (checkpointReopened && reparkStatus === "needs_review")
+                await deps.runStore.setNeedsReview(taskId, null);
+            else if (resumePlane.status === "suspended" || checkpointReopened)
                 await deps.runStore.setSuspended(taskId, sealed.terminal.kind === "paused" ? sealed : null);
             else if (resumePlane.status === "needs_review")
                 await deps.runStore.setNeedsReview(taskId, sealed);
             else
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(sealed));
+        settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
             decisionCommitted: true,

package/dist/http/route-ctx.d.ts

@@ -128,7 +128,7 @@ export interface PreparedTaskSubmission {
     cascade?: boolean;
     jobId?: string;
     body: TaskRequestBody;
-    /** L-167:**装配期**铸下的、这条会话的用户面 `EngineNotice`(今天只有请求腿 MCP 注入被丢弃一族)。
+    /** L-167:**装配期**铸下的、这条会话的用户面 `EngineNotice`(今天两族:请求腿 MCP 注入被丢弃;入口地板钳制 `permission.entry_mode_clamped`)。
      *  装配跑在这条腿的通告口开张之前,所以铸点交不出去 —— 由腿在 `registerEngineNoticeLeg` 那一拍
      *  经 `pending` 一起投(投递单点仍是那一只注册助手,不新开第二条机制)。缺席 = 本次装配没铸下任何通告。 */
     engineNotices?: readonly EngineNotice[];

package/dist/http/routes/approvals-assistant.js

@@ -18,7 +18,7 @@ import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
-import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
+import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -321,7 +321,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                         return;
                     }
                     const rows = await deps.approvalExemptionStore.list(exSessionId);
-                    sendJson(res, 200, { exemptions: rows.filter((r) => !answerGrantsBeyondCall({ toolName: r.toolName })) });
+                    sendJson(res, 200, { exemptions: rows.filter((r) => callGrantBindingOf({ toolName: r.toolName }).kind === "none") });
                     return;
                 }
                 if (exToolName === undefined) {
@@ -360,6 +360,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
                     ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
                     ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
+                    ...(s.boundGrantAbsence !== undefined ? { boundGrantAbsence: s.boundGrantAbsence } : {}),
                     objective,
                     input,
                 };
@@ -840,13 +841,14 @@ function projectPendingForWire(row, deployment) {
     const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
+    const deploymentListQuestion = carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes);
     const rememberRefused = !standingAnswerDurablyRecordable({
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantBinding: grantBindingOf(row),
+        grantBinding: questionGrantBindingOf(row, deploymentListQuestion),
         classes: row.classes,
-        deploymentListQuestion: carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes),
+        deploymentListQuestion,
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -73,6 +73,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
+                ...facts.engineCapabilityBits(),
                 asyncRuns: facts.durableRuns(deps).available,
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,

package/dist/http/routes/session-sync.js

@@ -14,7 +14,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
-import { readSessionRulesRecords, describeSessionRulesRecordProblem, legacyToolNameProblemOf } from "../../session-policy-wire.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
@@ -232,9 +232,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const policyRead = readSessionRulesRecords(body.policy);
                 if (policyRead.problem !== undefined) {
-                    const legacy = legacyToolNameProblemOf(policyRead.problem);
-                    if (legacy !== undefined) {
-                        sendError(res, 400, "rules.legacy_tool_name", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`, { ...legacy });
+                    if (policyRead.problem.kind === "rules") {
+                        sendSessionPolicyError(res, policyRead.problem.refusal, `policy: [${policyRead.problem.index}].rules: `);
                         return;
                     }
                     sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);

package/dist/http/routes/sessions.js

@@ -7,7 +7,7 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
+import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
@@ -819,22 +819,9 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const read = readWritableSessionPermissionRules(body.rules);
-            if (read.problem !== undefined) {
-                switch (read.problem.kind) {
-                    case "not-an-object":
-                        sendError(res, 400, "request.body_shape", describeSessionPermissionRulesProblem(read.problem));
-                        return;
-                    case "field-not-rule-list":
-                        sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
-                        return;
-                    case "legacy-tool-name":
-                        sendError(res, 400, "rules.legacy_tool_name", describeSessionPermissionRulesProblem(read.problem), { ...read.problem.refusal });
-                        return;
-                    default: {
-                        const unhandled = read.problem;
-                        throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
-                    }
-                }
+            if (read.refusal !== undefined) {
+                sendSessionPolicyError(res, read.refusal);
+                return;
             }
             if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
                 sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");

package/dist/http/send.d.ts

@@ -84,7 +84,7 @@ export declare function httpErrorCode(status: number, code?: string): string;
  * 域外通用臂 ⇒ `500 internal.error "internal error"`:码丢,连带**修复路径**也丢(同一行 `PUT` 却答
  * `500 corrupt` 并点名那一列)。一只腿之后,新站点只会忘记调它,不会再各自发明一份映射。
  */
-export declare function sendSessionPolicyError(res: ServerResponse, e: unknown): boolean;
+export declare function sendSessionPolicyError(res: ServerResponse, e: unknown, sentencePrefix?: string): boolean;
 /**
  * S-612 —— core `SessionError` → 应答,经 {@link sessionErrorHttp} 那**一只**映射(`src/session-error-wire.ts`)。
  * 回 `true` = 已应答,调用点 `return`;`false` = 不是 `SessionError`,或这个词在这一面上是登记过的留白(站点的既有

package/dist/http/send.js

@@ -1,5 +1,5 @@
 import { SessionError, SessionPolicyError } from "@sema-agent/core";
-import { sessionPolicyErrorHttp } from "../session-policy-wire.js";
+import { sessionPolicyErrorFacts, sessionPolicyErrorHttp, sessionPolicyErrorSentence } from "../session-policy-wire.js";
 import { sessionErrorHttp } from "../session-error-wire.js";
 import { redactErrorMessage } from "../observability/run-terminal.js";
 export const SSE_RESPONSE_MARK = Symbol("sema.http.sse-response");
@@ -48,11 +48,12 @@ export function httpErrorCode(status, code) {
         default: return status >= 500 ? "internal.error" : "request.rejected";
     }
 }
-export function sendSessionPolicyError(res, e) {
+export function sendSessionPolicyError(res, e, sentencePrefix = "") {
     if (!(e instanceof SessionPolicyError))
         return false;
     const h = sessionPolicyErrorHttp(e.code);
-    sendError(res, h.status, h.errorCode, redactErrorMessage(e.message) ?? "session policy error");
+    const facts = sessionPolicyErrorFacts(e);
+    sendError(res, h.status, h.errorCode, redactErrorMessage(`${sentencePrefix}${sessionPolicyErrorSentence(e)}`) ?? "session policy error", facts === undefined ? undefined : { ...facts });
     return true;
 }
 export function sendSessionError(res, e, face) {

package/dist/http/wire-types.d.ts

@@ -312,7 +312,8 @@ export interface TaskRequestBody {
     excludeTools?: string[];
     /** S-1448(core 7.49.0 #1623,[ref]):引擎的**可用性选择器** —— 这一 run 只用列出的工具(wire 名、别名、`Tool(content)` 整只、
      *  `mcp__srv` / `mcp__srv__*` / 工具段通配;`"*"` = 本层不设名单;`[]` = 什么都不给)。宿主**原样透传**进 `TaskSpec.allowTools`:
-     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
+     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
+   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
      *  `excludeTools` 是同一只运算的减项(deny 赢)。值形:字符串数组(受理门 400 `request.field_invalid`,与 `excludeTools` 同一只门);
      *  装着的引擎不认该座 ⇒ 400 `request.field_invalid` 点名所需引擎版本(不静默丢)。无租户门(收窄)。 */
     allowTools?: string[];
@@ -415,7 +416,7 @@ export interface TaskRequestBody {
     /**
      * S-895(7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
      * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
-     *  · `"all"` —— 整份继承(`{ ...process.env }` 逐字原样,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
+     *  · `"all"` —— 整份用户环境**减本服务自有凭据名**(配置目录 secret 名 / 名单型旋钮名 / 模型条目 `apiKeyEnv`,起服向引擎声明一次,判在引擎;7.129.0 起,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
      *    `hostPostureDeclarationsHonored`(`hosted-posture.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
      *    422 `request.host_posture_refused`;
      *  · `"scrub"` —— 缺省清洗(剥凭据形变量),**任何车道、任何部署**都受理(它就是缺省;7.106.0 合并复审 X7)。

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export { createAuthorizer, principalFrom, HttpError, type AuthContext, type Owne
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export type { TaskRequestBody } from "./http/wire-types.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
-export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
+export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";

package/dist/index.js

@@ -21,7 +21,7 @@ export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
-export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
+export { createSideQueryLane } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";