@sema-agent/server 7.130.0 → 7.131.0

package/dist/http/routes/sessions.js

@@ -1,6 +1,6 @@
 import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js";
-import { isUuidShape, legacyUnownedSessionOk } from "../../security.js";
+import { HttpError, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
@@ -8,7 +8,7 @@ import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
-import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
+import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -144,10 +144,21 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const lastLegMcp = await lastLegMcpFor(deps, safeDecode(match.params.sessionId), principal);
-            const specs = mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario);
-            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
+            const ledgerHalf = lastLegMcp === undefined ? {} : { lastLegMcp };
+            let scenarioName;
+            try {
+                scenarioName = await deps.scenarioGate(principal, undefined);
+            }
+            catch (e) {
+                if (!(e instanceof HttpError))
+                    throw e;
+                sendJson(res, 200, { asOf: new Date().toISOString(), ...ledgerHalf, scenarioRefusal: httpErrorBody(e) });
+                return;
+            }
+            const specs = mcpForScenario(deps.config.mcpServers, scenarioName);
+            const cacheKey = `${scenarioName}::${principal ?? ""}`;
             if (!specs || specs.length === 0) {
-                sendJson(res, 200, { servers: [], asOf: new Date().toISOString(), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
+                sendJson(res, 200, { servers: [], asOf: new Date().toISOString(), ...ledgerHalf });
                 return;
             }
             const cached = mcpStatusCache.get(cacheKey);
@@ -179,23 +190,24 @@ export async function handleSessions(req, res, match, ctx) {
                 })();
                 mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
             }
-            sendJson(res, 200, { ...(await mcpStatusCache.get(cacheKey).panel), ...(lastLegMcp === undefined ? {} : { lastLegMcp }) });
+            sendJson(res, 200, { ...(await mcpStatusCache.get(cacheKey).panel), ...ledgerHalf });
             return;
         }
     }
     {
         if (match.decl.id === "session-a2a") {
-            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const specs = a2aForScenario(deps.config.a2aPeers, deps.config.defaultScenario);
+            const scenarioName = await deps.scenarioGate(principal, undefined);
+            const specs = a2aForScenario(deps.config.a2aPeers, scenarioName);
             if (!specs || specs.length === 0) {
                 sendJson(res, 200, { peers: [], asOf: new Date().toISOString() });
                 return;
             }
-            const principal = gatedPrincipal(req, deps.config);
-            const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
+            const cacheKey = `${scenarioName}::${principal ?? ""}`;
             const cached = a2aStatusCache.get(cacheKey);
             if (!cached || Date.now() - cached.at > A2A_STATUS_TTL_MS) {
                 if (a2aStatusCache.size > 1024)

package/dist/http/routes/tasks.js

@@ -1,13 +1,13 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
-import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, releaseKeyIfZeroWorkRefusal, HEARTBEAT_MS } from "../../runs.js";
+import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
-import { createLedgerSink } from "../../trace/ledger-sink.js";
+import { createLedgerSink, createLedgerTwinEmit } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../../run-cancel-context.js";
@@ -249,6 +249,7 @@ export async function handleTasks(req, res, match, ctx) {
                 let durableHeartbeat;
                 const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: errorMessage, cause });
                 let userMsgEntryId;
+                const promptCommit = createPromptCommitReader();
                 let anchorPut = false;
                 const putRewindAnchor = () => {
                     if (anchorPut || !userMsgEntryId || !durableTaskId || !prepared.spec.sessionId || !deps.resumeAnchorStore)
@@ -457,8 +458,9 @@ export async function handleTasks(req, res, match, ctx) {
                                     break;
                                 for (const end of ev.type === "done" ? [...childReasoning.cut(), ...topReasoning.cut()] : topReasoning.onEvent(ev))
                                     sseData(res, end);
-                                if (ev.type === "message_committed" && ev.role === "user")
-                                    userMsgEntryId = ev.entryId;
+                                const promptEntryId = promptCommit(ev);
+                                if (promptEntryId !== undefined)
+                                    userMsgEntryId = promptEntryId;
                                 const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
                                 await deps.userInputLedger?.observeLegEvent(liveStream, ev);
                                 prepared.acceptance.observe(ev);
@@ -594,6 +596,14 @@ export async function handleTasks(req, res, match, ctx) {
                         }
                         res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
                     };
+                    const faceAlive = () => !res.writableEnded && !res.destroyed;
+                    const emitElicitation = createLedgerTwinEmit({ sink: ledgerSink, writeLive: emitAsk, liveReachable: faceAlive });
+                    const writeQuestionLive = (frame) => {
+                        if (!faceAlive())
+                            throw new Error("live stream ended — question frame undeliverable");
+                        emitAsk(frame);
+                    };
+                    const emitQuestion = createLedgerTwinEmit({ sink: ledgerSink, writeLive: writeQuestionLive, liveReachable: faceAlive });
                     await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, prepared.spec.sessionId, askOwner, (frame) => {
                         if (closed || res.writableEnded || res.destroyed)
                             throw new Error("stream ended before the completion frame was written");
@@ -604,15 +614,10 @@ export async function handleTasks(req, res, match, ctx) {
                         sseData(res, frame);
                     }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
                     const withElicit = deps.elicitation
-                        ? () => deps.elicitation.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitAsk, abortSignal: ac.signal }, streamBody)
+                        ? () => deps.elicitation.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitElicitation, abortSignal: ac.signal }, streamBody)
                         : streamBody;
-                    const emitQuestion = (frame) => {
-                        if (res.writableEnded || res.destroyed)
-                            throw new Error("live stream ended — question frame undeliverable");
-                        emitAsk(frame);
-                    };
                     const withQuestion = () => deps.question
-                        ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitQuestion, abortSignal: ac.signal, deliverable: () => !res.writableEnded && !res.destroyed }, withElicit)
+                        ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitQuestion, abortSignal: ac.signal, deliverable: faceAlive }, withElicit)
                         : withElicit();
                     const emitApproval = (frame) => {
                         if (res.writableEnded || res.destroyed)

package/dist/http/scenario-read-face.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 「本部署没有这个场景」的唯一答复(A9 叶:只依赖 `send.ts`)—— 场景详情读面(`GET /v1/capabilities/scenarios/:name`,名字不在 `scenarioDetails` 里)答它。
+ *
+ * 回答「此主体在此场景能看见哪些 MCP 服务器 / A2A 对端」的读口不经过这里:它们的场景名只由 `deps.scenarioGate` 给
+ * (`ServiceCoreDeps` 的必填件,`capabilities/scenarios.ts` `createScenarioGate` 铸的那一只),点名与缺席都问,拒就是门的 typed 错 —— 读口没有第二个场景名来源。
+ */
+import type { ServerResponse } from "node:http";
+/**
+ * 「本部署没有这个场景」的唯一答复。一句话、一个码,不各写一份。
+ * [ref] 信封统一:本答复曾是全站唯一对象形 error(`{error:{code}}`)——SDK toApiError 对它特判过一轮 TypeError 加固;统一为「字符串 error + 顶层 errorCode」邻位形
+ * (cancel/decide 同款),机器判据保留。
+ */
+export declare function sendScenarioNotFound(res: ServerResponse): void;
+//# sourceMappingURL=scenario-read-face.d.ts.map

package/dist/http/scenario-read-face.js

@@ -0,0 +1,5 @@
+import { sendError } from "./send.js";
+export function sendScenarioNotFound(res) {
+    sendError(res, 404, "scenario_not_found", "scenario not found");
+}
+//# sourceMappingURL=scenario-read-face.js.map

package/dist/http/send.d.ts

@@ -9,6 +9,7 @@
  */
 import type { ServerResponse } from "node:http";
 import { type SessionErrorFace } from "../session-error-wire.js";
+import type { HttpError } from "../security.js";
 /**
  * [ref](黑板 [ref]②)—— 一条响应「是 SSE 流」的**在场标记**。
  *
@@ -74,6 +75,15 @@ export declare function sendError(res: ServerResponse, status: number, errorCode
  *  throw 点里只有 3 个带。为了让「errorCode 恒在」在这些站点也成立(而不是靠豁免表放行),按**状态码**
  *  给一个诚实的粗码:它只声明「这类拒绝」,不冒充比 throw 点更细的语义。带 `code` 的 throw 点原样优先。 */
 export declare function httpErrorCode(status: number, code?: string): string;
+/**
+ * 一只 `HttpError` 的**拒体成员**:`{ error, errorCode, ...extra }` —— 码经 {@link httpErrorCode}(带码的 throw 原样优先,否则按状态给粗码),
+ * 句 = `message`,`extra`(拒的机读事实,如场景门的 `detail: { scenario, source }`)原样随体、排在最后。**全仓唯一组句器**:整面拒({@link sendHttpError}:
+ * 全局兜底 catch 与准入段的 typed 拒)与把同一只拒当**数据**带进 200 体的面板(`GET /v1/sessions/:id/mcp` 的 `scenarioRefusal`)读的是它 ——
+ * 同一只错在两处渲出的成员逐字同,面板不自己拼 `{ errorCode, error }`(拼了就丢 `extra`:壳分不出这次门拒是中心指派漂了还是部署缺省悬空)。
+ */
+export declare function httpErrorBody(e: HttpError): Record<string, unknown>;
+/** 整面拒:状态 = `e.status`,体 = {@link httpErrorBody}。 */
+export declare function sendHttpError(res: ServerResponse, e: HttpError): void;
 /**
  * 🔴 B1 / S-535 —— `SessionPolicyError` → 应答,经 {@link sessionPolicyErrorHttp} 那**一只**映射
  * (`src/session-policy-wire.ts`)。回 `true` = 已应答,调用点 `return`。

package/dist/http/send.js

@@ -48,6 +48,12 @@ export function httpErrorCode(status, code) {
         default: return status >= 500 ? "internal.error" : "request.rejected";
     }
 }
+export function httpErrorBody(e) {
+    return { error: e.message, errorCode: httpErrorCode(e.status, e.code), ...e.extra };
+}
+export function sendHttpError(res, e) {
+    sendJson(res, e.status, httpErrorBody(e));
+}
 export function sendSessionPolicyError(res, e, sentencePrefix = "") {
     if (!(e instanceof SessionPolicyError))
         return false;

package/dist/http/server.d.ts

@@ -58,7 +58,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填三件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填五件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -66,8 +66,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填四件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席。
- *  四者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填五件**——引擎、部署配置、请求→TaskSpec 的映射、side-query 执行席、读口场景门。
+ *  五者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -123,6 +123,18 @@ export interface ServiceCoreDeps {
      * `runnerFor: () => runner` —— 那是一句表态,不是一个回落。
      */
     runnerFor: (spec: TaskSpec) => Runner;
+    /**
+     * 读口的场景名过门 —— `capabilities/scenarios.ts` `createScenarioGate` 铸的**那一只**(与 `resolveSpec` 同一个工厂、同一张场景表、同一份
+     * `principalCaps`、同一份部署缺省):凡回答「此主体在此场景能看见哪些 MCP 服务器 / A2A 对端」的口 —— `GET /v1/capabilities/mcp` 的状态面、
+     * `GET /v1/sessions/:id/mcp` 与 `…/a2a` 两张会话面板 —— 的场景名都由它给,**点名与缺席都问**:点名 ⇒ 判在册 / allowlist,
+     * 拒体(400 `scenario_unknown` 附在册词表 / 400 `scenario_not_allowed` 附 allowlist)与任务提交腿逐字同;缺席 ⇒ 指派链(中心 ruling 胜者,
+     * 否则部署缺省),与这位主体 run 时同一读法(指派悬空 ⇒ 503 `state.scenario_assignment_unknown`,同提交腿)。
+     * 读面上这只门走**只读腿**(`createScenarioGate(…, "peek")`):问中心裁定时 center 抖动的那一拍,不替这个主体的真提交留下 fail-closed 降级项
+     * (提交腿自己是 `"enforce"`)。
+     * 🔴 **必填**:读口的场景名只有这一个来源,没有「缺接缝 ⇒ 读部署缺省 / 点名 404」这类第二种读法 —— 漏接是**编译错**(嵌入方自己装配时,工厂与它的型从包根导出:
+     * `createScenarioGate` / `ScenarioGate` / `ScenarioGateLeg` / `ScenarioGateSources`)。
+     */
+    scenarioGate: import("../capabilities/scenarios.js").ScenarioGate;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -563,14 +575,6 @@ export interface ServiceSeamDeps {
      *  per-principal 查询走 caps client 的 executionRuling 同车(零额外 RTT);absent = 无 center(单用户/
      *  dry-run)⇒ 观测面不接线,零行为差。fail-open:观测失败绝不影响 sync 面本身。 */
     sessionMirrorRuling?: (principal: string | undefined) => Promise<SessionMirrorRuling | undefined>;
-    /** 请求点名的场景名过门 —— `capabilities/scenarios.ts` `createScenarioGate` 铸的**那一只**(与 `resolveSpec` 同一个工厂、同一张场景表、同一份
-     *  `principalCaps`、同一份部署缺省):`GET /v1/capabilities/mcp?scenario=<名>` 的状态面靠它回答「这个场景名在不在册、这位 principal 放不放行」,
-     *  拒体(400 `scenario_unknown` 附在册词表 / 400 `scenario_not_allowed` 附 allowlist)因此与任务提交腿逐字同。
-     *  读面上这只门走**只读腿**(`createScenarioGate(…, "peek")`):问中心裁定时 center 抖动的那一拍,不替这个主体的真提交留下 fail-closed 降级项
-     *  (提交腿自己是 `"enforce"`)。只在请求**点名了**场景时才问(缺席 ⇒ 部署缺省场景,不问门、不多一次中心往返;点名空串也交门答,与提交腿 `scenario: ""` 同码)。
-     *  本接缝缺席 = 嵌入方的 HTTP 面没有场景表可问:状态面点名场景答 404 `scenario_not_found`,与场景详情读面({@link scenarioDetails} 缺席)同一个答复,
-     *  不另造空表门、不静默回缺省集。 */
-    scenarioGate?: import("../capabilities/scenarios.js").ScenarioGate;
     /** Degenerate-output a/b instrument: on errorCode=output.degenerate, inspect the session's turns to
      *  classify where the salvageable answer was (counter + log). Fire-and-forget; no-op otherwise. */
     instrumentDegenerate?: (result: TaskResult) => void;
@@ -838,7 +842,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填三件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填五件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/server.js

@@ -17,7 +17,7 @@ import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendError, sendSessionError, httpErrorCode, msg } from "./send.js";
+import { sendError, sendHttpError, sendSessionError, msg } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
@@ -121,7 +121,7 @@ export function createHttpServer(rawDeps) {
         void handle(req, res).catch((err) => {
             if (err instanceof HttpError) {
                 if (!res.headersSent)
-                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
+                    sendHttpError(res, err);
                 else
                     res.end();
                 return;

package/dist/http/stored-body-replay.d.ts

@@ -9,6 +9,7 @@
  */
 import type { PermissionMode } from "@sema-agent/core";
 import { type Autonomy } from "../runtime-governance.js";
+import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
 /**
@@ -21,8 +22,14 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
     floor: PermissionMode;
 } | undefined;
 /**
- * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 技能拒侧读成空 → 模式词读法记号(几问同中时答先中的那一问 ——
- * 任一问中都不重放,句子只需一句)。`autonomy` = 本部署**此刻**的 `config.autonomy`(活 config:热改即生效);地板由它的唯一属主算,问点不自己算。
+ * 预判读的部署配置:`autonomy`(第三问的模式词地板)与执行车道的 home 两位(`~/` 形规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
-export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, autonomy: Autonomy | undefined): StoredBodyReplayRefusal | undefined;
+export type StoredReplayDeployment = LaneHomeDeployment & {
+    readonly autonomy?: Autonomy | undefined;
+};
+/**
+ * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号(几问同中时答先中的那一问 ——
+ * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
+ */
+export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;
 //# sourceMappingURL=stored-body-replay.d.ts.map

package/dist/http/stored-body-replay.js

@@ -1,6 +1,8 @@
-import { storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
-import { skillDenyInertEntryOf } from "../rule-entry-list.js";
+import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
+import { httpErrorCode } from "./send.js";
 import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
@@ -8,14 +10,33 @@ export function permissionModeReadingUnstated(ctx, floor) {
     const stored = storedBodyPermissionMode(ctx.body);
     return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
 }
-export function storedBodyReplayRefusal(ctx, autonomy) {
+const BUCKET_GATE_CODE = "request.field_invalid";
+function storedPermissions(body) {
+    const permissions = body?.settings?.permissions;
+    return permissions !== null && typeof permissions === "object" && !Array.isArray(permissions) ? permissions : undefined;
+}
+function storedPermissionBucketRefusal(body) {
+    const issue = settingsPermissionBucketIssue(storedPermissions(body));
+    if (issue === null)
+        return undefined;
+    return replayInertEntry(issue.fields.field, issue.fields.field === "settings.permissions.allow" ? "allow" : "deny", BUCKET_GATE_CODE, issue.message, { ...issue.fields });
+}
+function storedRulePolicyRefusal(body, deployment) {
+    const permissions = storedPermissions(body);
+    if (permissions === undefined)
+        return undefined;
+    const home = executionLaneHomeDir(deployment);
+    const refused = rulePolicyBucketsRefusal({ ...(Array.isArray(permissions["ask"]) ? { ask: permissions["ask"] } : {}), ...(Array.isArray(permissions["deny"]) ? { deny: permissions["deny"] } : {}) }, home !== undefined ? { home } : {});
+    return refused === undefined ? undefined : replayInertEntry(`settings.permissions.${refused.bucket}`, "deny", httpErrorCode(422), `${REQUEST_SETTINGS_REFUSAL_PREFIX}${refused.message}`);
+}
+export function storedBodyReplayRefusal(ctx, deployment) {
     const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
     if (allowListReadingUnstated(ctx))
         return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
-    const entry = skillDenyInertEntryOf(ctx.body);
+    const entry = storedPermissionBucketRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
     if (entry !== undefined)
-        return { kind: "skill_deny_inert", entry };
-    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(autonomy));
+        return { kind: "inert_tool_list", entry };
+    const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
     if (mode !== undefined)
         return { kind: "permission_mode_reading", ...mode, ...writer };
     return undefined;

package/dist/http/wire-types.d.ts

@@ -33,6 +33,12 @@ export interface TaskRequestBody {
     } | {
         url: string;
     }>;
+    /** 请求层用户附件(引擎 `TaskSpec.userAttachments`,至多 20 条):挂在**这次提交的目标**上,原样交给引擎 —— 每条以引擎铸的消息紧随目标送到模型,
+     *  交付结局在 `human_input{carrier:"objective"}.attachments` 报一次。条目形 = 引擎的 `UserAttachment`(`{ path, lines? }` 读本次 run 的工作区 /
+     *  `{ name, text, startLine? }` / `{ name, image: { data, mimeType } }` 宿主持有的字节)。**形判属主 = 引擎**:本服务不另判,坏形 / 超 Read 上限的
+     *  text / 过不了图片准入 / 无工作区的 path 由引擎在第一次模型调用之前拒 `config.user_attachment_invalid`(同步腿 400)。只随目标走:送话口不收
+     *  (400 `request.body_shape`,键落 `unsupportedKeys`),续跑 / 投递腿的重建不带它(`http/resume-legs.ts` 的一次性键表)。能力位 `userAttachments`。 */
+    userAttachments?: TaskSpec["userAttachments"];
     /** D-1 通用文件上传:预上传附件的句柄数组(POST /v1/attachments 的 `id`)。提交时绑定到会话并在
      *  执行环境工作目录 `attachments/` 下物化;objective 尾部追加告知(名字/mime/尺寸,内容不进流)。
      *  上限 16/task;未知或他人 id → 400(fresh 腿)。⚠️ 名为 `attachmentIds` 而非 `attachments`——
@@ -308,12 +314,15 @@ export interface TaskRequestBody {
      *  坏形不挂键。不投递技能正文(正文照旧由 `Skill` 工具 / 调用方负责)。 */
     userInvokedSkills?: string[];
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
-     *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
+     *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。
+     *  读成空的条目(退役拼法 `bash`、大小写孪生 `BASH`、任何工具名都不可能有的拼法、`*`)7.131.0 起受理口 400 `config.tool_face_control` 并点名现名
+     *  (拒侧读成空 = 放行,不照跑);读得出的名字与真未知名(拼写合法、没有近似也没有退役对应)照收。 */
     excludeTools?: string[];
     /** S-1448(core 7.49.0 #1623,[ref]):引擎的**可用性选择器** —— 这一 run 只用列出的工具(wire 名、别名、`Tool(content)` 整只、
      *  `mcp__srv` / `mcp__srv__*` / 工具段通配;`"*"` = 本层不设名单;`[]` = 什么都不给)。宿主**原样透传**进 `TaskSpec.allowTools`:
-     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;没有任何工具答应的名字照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
-   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400)。
+     *  不算补集、不过滤、不与 `settings.permissions.allow`(免问)混词;真未知名(拼写合法、没有近似也没有退役对应:懒挂载的合法形)照跑(原样保留,今天什么都不准,之后挂上同名工具即生效;引擎告知运维一次),
+   *  任何工具名都不可能有的拼法由引擎开跑前拒(`config.tool_face_control`,同步腿 400);7.131.0 起受理口另拒近似名(大小写孪生 `BASH`:想放的什么也没放 = 静默收窄,句子点名现名);
+   *  放行侧的退役名(`bash` · `Task`)、内容形(`Agent(Explore)`)与文法读不出照旧受理、交引擎既有通告。
      *  `excludeTools` 是同一只运算的减项(deny 赢)。值形:字符串数组(受理门 400 `request.field_invalid`,与 `excludeTools` 同一只门);
      *  装着的引擎不认该座 ⇒ 400 `request.field_invalid` 点名所需引擎版本(不静默丢)。无租户门(收窄)。 */
     allowTools?: string[];
@@ -501,15 +510,19 @@ export interface TaskRequestBody {
      *  worker, not the exec env); IGNORED on multi-tenant deployments (can't make the shared worker run an arbitrary
      *  command). Validated + gated downstream; the center/config baseline wins on a name clash.
      *
+     *  每个受理键一条律:新提交(fresh)腿上,条目的任一受理键(`name` / `transport` 及其子键 / `allowTools` / `toolAxes` / `toolFaces` / `contentOrigin` / `elicitation` / `source`)
+     *  在场却判不出形 ⇒ 同步 400 `request.field_invalid`,拒句点名 `mcpServers[i].<键路径>`、server 名与该键判官的原因句(不回显值),整份请求不收;键缺席恒合法。
+     *  耐久 resume 重放存量 body 的腿不拒(会砖死已 park 任务):坏硬键整条 server 不进 + 运维 warn,坏软键丢键、server 照挂。
+     *
      *  [ref](core 5.60.0):条目上可选的 `contentOrigin`(`"local"|"execution"|"external"`)= **内容
      *  出处声明**,只影响记忆写治理(会话污染标记),对审批门/策略/角色表零作用。缺席 = pre-378 逐字节
      *  现行为(判 external)。🔴 **新提交(fresh)腿上,词表外的值 ⇒ 同步 400 `request.field_invalid`** ——
      *  静默丢会把一次信任边界声明变成探针。⚠️ **耐久 resume 腿上不拒**:那条腿重放的是存量 body,4xx 会把
      *  一条 parked 任务永久砖死(折成 `409 resume_blocked_by_policy`),所以坏值在那里**降级**为「键缺席」+
-     *  一条 `mcp_content_class_dropped` warn(本仓三处 `opts.leg` 先例的同款姿势)。两条腿上 server 本体都
+     *  一条 `mcp_content_class_dropped` warn(本仓三处 `opts.leg` 先例的同款姿势)。重放腿上 server 本体
      *  保留 —— 丢的只是声明。core 把这个键定性为**部署面**的键,本仓对它的 reject-or-strip 义务由既有的单用户闸
      *  **结构性**兑现:多租户腿整只 `mcpServers` 被忽略 ⇒ 租户够不着;单用户腿 = core 明文豁免的超管面
-     *  (完整论证见 `task-mcp.ts` 的 `assertRequestMcpContentOrigin` 顶注)。部署面的正门是 center 下发的
+     *  (完整论证见 `task-mcp.ts` 的 `assertRequestMcpEntries` 顶注)。部署面的正门是 center 下发的
      *  `CenterMcpServer.contentOrigin`。
      *
      *  S-1515:`transport.kind:"http"` 的条目可选 `assertionHeader`(托管连接器断言头的**头名**,契约包 settings-schema ≥12.2.0 同键)。

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export { RateLimiter, type RateDecision } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo, type GitApiKind, type RepoCoords, type RepoReadClient } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioRequest, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, type Scenario, type ScenarioBundle, type ScenarioContext, type ScenarioDeps, type ScenarioGate, type ScenarioGateLeg, type ScenarioGateSources, type ScenarioRequest, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS, type TaskListLane, type TaskListLaneBackend, type TaskListLaneOpts } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
@@ -30,5 +30,6 @@ export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type Mode
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
 export { judgeModelRouteGap, type ModelRouteGapReading, type ModelRouteGapOptions } from "./model-route-gap.js";
 export type { ModelRouteGap } from "./model-route-endpoint.js";
+export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRouteOptions, type ModelRouteEndpointVerdict } from "./model-route-endpoint.js";
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -15,7 +15,7 @@ export { RateLimiter } from "./observability/rate-limit.js";
 export { GiteaClient, GitHubClient, createRepoClient, GIT_API_KINDS, isGitApiKind, repoToolsFor, parseRepo } from "./capabilities/repo-tools.js";
 export { nowTool } from "./capabilities/builtin-tools.js";
 export { loadSkills, skillsForScenario } from "./capabilities/skills.js";
-export { buildScenarios, selectScenario, } from "./capabilities/scenarios.js";
+export { buildScenarios, selectScenario, createScenarioGate, } from "./capabilities/scenarios.js";
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
@@ -26,4 +26,5 @@ export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 export { judgeModelRouteGap } from "./model-route-gap.js";
+export { judgeServedModelRoute } from "./model-route-endpoint.js";
 //# sourceMappingURL=index.js.map

package/dist/mcp-assertion-header.d.ts

@@ -66,8 +66,8 @@ export declare function readMcpIdentityHeaders(transport: Record<string, unknown
 };
 /** 同设的拒句 —— 对契约包解析期那一句**逐字**(`server` = 条目名,调用方负责清洗后传入)。 */
 export declare function describeMcpIdentityHeadersConflict(server: string): string;
-/** `assertionHeader` 值不是字符串的拒句(值的形状只说种类,不回显值本身:它是一个调用方写的头名位置,可能是任何东西)。 */
-export declare function describeMcpAssertionHeaderNotAString(server: string, value: unknown): string;
+/** `assertionHeader` 值不是字符串的**原因句**(不带条目名与键路径:点名由请求面统一的拒形 `entryFieldRefusal` 负责;值的形状只说种类,不回显值本身:它是一个调用方写的头名位置,可能是任何东西)。 */
+export declare function describeMcpAssertionHeaderNotAString(value: unknown): string;
 /** 这一条请求面条目是否声明了 `assertionHeader`(= 铸 core 规格时会被剥掉、需要说一行的那一类)。 */
 export declare function declaresMcpAssertionHeader(spec: RequestMcpServerSpec): boolean;
 /** 请求面条目 → 交给引擎的规格:剥掉 `assertionHeader`(引擎无座);其余逐字不动。声明过它的条目由调用方另说一行 info。 */

package/dist/mcp-assertion-header.js

@@ -16,9 +16,9 @@ export function readMcpIdentityHeaders(transport) {
 export function describeMcpIdentityHeadersConflict(server) {
     return `mcp server "${server}" sets both principalHeader and assertionHeader — an http entry names ONE header for the identity it sends: keep principalHeader (the end-user principal) or assertionHeader (the connector assertion), not both`;
 }
-export function describeMcpAssertionHeaderNotAString(server, value) {
-    const kind = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
-    return `mcp server "${server}" sets assertionHeader to a ${kind} — it must be a string (the HTTP header NAME the connector assertion travels in); omit the key to send no assertion header`;
+export function describeMcpAssertionHeaderNotAString(value) {
+    const kind = value === null ? "null" : Array.isArray(value) ? "an array" : `a ${typeof value}`;
+    return `must be a string (the HTTP header NAME the connector assertion travels in) — got ${kind}; omit the key to send no assertion header`;
 }
 export function declaresMcpAssertionHeader(spec) {
     return spec.transport.kind === "http" && spec.transport.assertionHeader !== undefined;

package/dist/model-entry-refusal.d.ts

@@ -1,5 +1,6 @@
 import { type ModelEntryRefusalCode, type ModelPlaneRefusalCode, type ModelRefusalsSignal } from "@sema-agent/settings-schema";
 import { type DroppedCatalogEntry } from "./web-admin-client/read-warnings.js";
+import { type ModelTableLeg } from "./model-select.js";
 /**
  * 条目拒因码 → 本仓铸它的成因 —— **以码为键**(S-768):码闭集的属主是 settings-schema(`MODEL_ENTRY_REFUSAL_CODES`,6.2.0 起;此前本仓
  * 自持一份同名码表,撞名已消灭、零别名)。那边加一个条目码 ⇒ 本表缺键 ⇒ 本仓 tsc 红(只拿 `satisfies` 约束码值证明的是「子集」,
@@ -126,13 +127,6 @@ export interface DefaultModelView {
     readonly models: Readonly<Record<string, unknown>>;
     readonly modelRefusals: Readonly<Record<string, ModelEntryRefusal>>;
 }
-/**
- * 这张表是从哪条腿来的(闭集 —— 拒因句的出路按腿分:加腿不补 {@link defaultModelRefusal} 的臂 = 编译红)。
- *  · `env` —— 进程此刻服务的表**没有目录在管**(没配目录 / 目录迟到且无 LKG / 目录的模型面这一组被拒):`MODEL_ID` 是出路之一;
- *  · `catalog` —— 判的是一份**目录候选**(模型面 stage):目录一旦生效就整张换掉 env 表,`MODEL_ID` 救不了这份候选 ——
- *    出路只在目录里(修条目 / 换绑)。opus 腿 ④(7.101.0 合并复审):此前两腿同一句,目录腿教「设 MODEL_ID 即可」是假话。
- */
-export type ModelTableLeg = "env" | "catalog";
 /**
  * 🔴 S-705 —— **这张模型表有没有一只缺省模型**(`models.default`)。`undefined` = 有。
  *