@sema-agent/server 7.130.0 → 7.132.0

package/dist/http/claimed-run.js

@@ -0,0 +1,15 @@
+export async function releaseClaimedRun(runStore, taskId, why, onFailure) {
+    try {
+        await runStore.setTerminal(taskId, "failed", null, why);
+    }
+    catch (err) {
+        onFailure(err, "terminal");
+    }
+    try {
+        await runStore.releaseIdemKey(taskId);
+    }
+    catch (err) {
+        onFailure(err, "idem_key");
+    }
+}
+//# sourceMappingURL=claimed-run.js.map

package/dist/http/device-placement.js

@@ -2,6 +2,7 @@ import { createCodedHttpError, ssoVerifiedScope } from "../security.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { DEVICE_ERROR_CODES, assertDeviceIdShape, } from "../device-store.js";
 import { buildDeviceRejection } from "../device-enrollment.js";
+import { releaseClaimedRun } from "./claimed-run.js";
 export function deviceOwnerDomainOf(req, config) {
     const subject = gatedPrincipal(req, config);
     if (subject === undefined)
@@ -89,16 +90,10 @@ export async function commitPlacement(ctx, runStore, taskId, intent) {
     if (intent === undefined)
         return null;
     const enrollment = ctx.deviceEnrollment;
-    const releaseRun = async (why) => {
-        try {
-            await runStore.setTerminal(taskId, "failed", null, why);
-            await runStore.releaseIdemKey(taskId);
-        }
-        catch (err) {
-            ctx.logger?.warn("device_placement_run_release_failed", { taskId, err: err instanceof Error ? err.message : String(err) });
-            ctx.metrics?.inc("device_placement_run_release_failed_total");
-        }
-    };
+    const releaseRun = (why) => releaseClaimedRun(runStore, taskId, why, (err, step) => {
+        ctx.logger?.warn("device_placement_run_release_failed", { taskId, step, err: err instanceof Error ? err.message : String(err) });
+        ctx.metrics?.inc("device_placement_run_release_failed_total");
+    });
     if (!enrollment) {
         await releaseRun("device placement could not be committed: the device lane's admission chain is not wired");
         throw new Error("commitPlacement: a device placement intent was minted without a DeviceEnrollment — assembly bug (both are read from the same ServiceDeps)");

package/dist/http/dispatch.d.ts

@@ -18,10 +18,6 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源。**单一属主**:`handle()` 的
- *  凭证门、[ref] 的 parked 赎回席、以及 [ref] 的 consolidation 阀门启动期告警读同一句(手抄迟早
- *  只改一处,而这条判据决定的是「无凭证部署上写口开不开」)。导出仅为最后一个消费点(main.ts)。 */
-export declare function hasServiceAuth(config: ServiceConfig): boolean;
 /**
  * 🔴 S-672(test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。

package/dist/http/dispatch.js

@@ -8,11 +8,8 @@ import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
-import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
-export function hasServiceAuth(config) {
-    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-}
 export function readCredentialOk(req, config) {
     if (!hasServiceAuth(config))
         return true;
@@ -149,9 +146,9 @@ export function createDispatch(ctx) {
                 configHash,
                 pid: process.pid,
                 startedAt: PROCESS_STARTED_AT_MS,
-                port: deps.config.port,
+                port: req.socket.localPort,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
-                ...buildHealthSelfReport(deps, hasServiceAuth(deps.config)),
+                ...buildHealthSelfReport(deps),
                 ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),
                 ...(() => {
                     const configHandoff = deps.configHandoffState?.();
@@ -188,10 +185,9 @@ export function createDispatch(ctx) {
                 sendError(res, 404, "feature.metrics_disabled", "metrics disabled");
                 return;
             }
-            const { authToken: t, metricsToken: mt } = deps.config;
-            const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-            const devOpen = !anyT && !mt && !deps.config.requirePrincipal;
-            const ok = devOpen || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
+            const mt = deps.config.metricsToken;
+            const devOpen = devOpenDeployment(deps) && !mt;
+            const ok = devOpen || systemFor(req, deps.config) !== undefined || (!!mt && authorized(req, mt));
             if (!ok) {
                 sendUnauthorized(res, "operator");
                 return;

package/dist/http/durable-run-leg.d.ts

@@ -72,7 +72,8 @@ export type DurableRunLegOutcome = {
 /**
  * 建行 + 驱动。返回 `202` = 新行已建并在跑(体带 `taskId`/`sessionId`);`409` = 会话被别的 run 占着,
  * **没有**建行(体 = `buildActiveRunConflict` 的既有形,含 `errorCode: "conflict.session_active_run"`);
- * `existing` = 这次提交的钥匙(`idem.key` / `clientTaskId`)已经指向一条行,没建新行。
+ * `existing` = 这次提交的钥匙(`idem.key` / `clientTaskId`)已经指向一条行,没建新行;落点拒(device 车道)与续跑输入一行装不下
+ * (`413 request.payload_too_large`,`submit-ctx.ts`)= 行建了又撤了(终结 + 放认领 + 放幂等键),什么都没跑。
  * 协议渲染归调用方(HTTP `sendJson` / A2A 协议对象 / `/decide` 的受理体)。
  */
 export declare function mintAndDriveDurableRun(ctx: RouteCtxBase, runStore: RunStore, args: DurableRunLegArgs): Promise<DurableRunLegOutcome>;

package/dist/http/durable-run-leg.js

@@ -8,7 +8,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
-import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { persistSubmitCtx } from "./submit-ctx.js";
 import { serviceVersion } from "../service-version.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
@@ -28,10 +28,12 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const placementReject = await commitPlacement(deps, runStore, taskId, args.prepared.bindingIntent);
     if (placementReject)
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
-    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
+        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+        if (ctxRefusal)
+            return ctxRefusal;
     }
+    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
     const captureTurnAnchor = deps.resumeAnchorStore && getLeafId

package/dist/http/health-self-report.d.ts

@@ -4,10 +4,12 @@
  *
  * ## 规则(一条):自报位是**投影**,不是第二份规则
  * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
- *  · `auth.required` = 全局凭据门的武装谓词(`hasServiceAuth`,由 `dispatch.ts` 交进来 —— 门与本位读同一次求值的同一只函数);
- *  · `auth.kinds` = {@link IDENTITY_SOURCES}(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词:
+ *  · `auth.kinds` = `IDENTITY_SOURCES`(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
+ *    (`principal-gate.ts`;「这台部署有没有身份边界」的门 `devOpenDeployment` 读同一只):
  *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
  *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *  · `auth.required` = kinds 里有没有 `service_token` —— 那一词接没接线就是全局凭据门的武装谓词(`hasServiceAuth`;`wiredIdentitySources` 的
+ *    `service_token` 臂读的正是它),所以 `required` 与 `kinds` 是同一次求值的两个投影,不是两个来源;
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
  *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
@@ -56,8 +58,8 @@ export interface HealthSelfReport {
     };
 }
 /**
- * 三键的**唯一铸点**(`build*`:纯数据)。`credentialGateArmed` 由 `dispatch.ts` 交进来 —— 它是全局凭据门自己的那一句
- * (`hasServiceAuth`),本模块不另求一遍(另求就是第二个写者)。
+ * 三键的**唯一铸点**(`build*`:纯数据)。只读装配本身:`auth` 三位都从一次 `wiredIdentitySources` 求值投出(`required` = 其中有 `service_token`),
+ * 不收调用方递进来的第二份布尔 —— 一个事实一次求值。
  */
-export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,4 +1,4 @@
-import { IDENTITY_SOURCES } from "./principal-gate.js";
+import { wiredIdentitySources } from "./principal-gate.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
 import { authBridgeIssuerOf } from "../auth-bridge.js";
 import { centerLaneConfigured } from "../web-admin-client/center-request.js";
@@ -19,29 +19,15 @@ function carriesCallerIdentity(kind) {
         }
     }
 }
-function identitySourceWired(kind, a) {
-    switch (kind) {
-        case "service_token":
-            return a.credentialGateArmed;
-        case "sso":
-            return a.bridgeWired;
-        case "direct_door_jwt":
-            return a.directDoorActive;
-        default: {
-            const unknownKind = kind;
-            throw new Error(`health self-report: unknown identity source ${String(unknownKind)}`);
-        }
-    }
-}
-export function buildHealthSelfReport(deps, credentialGateArmed) {
+export function buildHealthSelfReport(deps) {
     const { config } = deps;
     const bridgeWired = deps.webAdminJwtVerifier !== undefined;
-    const kinds = IDENTITY_SOURCES.filter((k) => identitySourceWired(k, { credentialGateArmed, bridgeWired, directDoorActive: config.directDoorActive }));
+    const kinds = wiredIdentitySources(deps);
     const issuer = authBridgeIssuerOf(config)?.issuer;
     const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;
     return {
-        auth: { required: credentialGateArmed, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },
+        auth: { required: kinds.includes("service_token"), kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },
         operator: operatorLane(deps).available ? "present" : "absent",
         center: {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),

package/dist/http/principal-gate.d.ts

@@ -92,20 +92,37 @@ export declare function sendUnauthorized(res: ServerResponse, face: Unauthorized
  * 那样「谁多给了 operator 一条路」在代码上看得见,而不是被偷偷塞进共享谓词里。
  */
 export declare function runOwnerReadable(principal: string | undefined, owner: string | null, config: ServiceConfig): boolean;
+/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源,也是身份来源 `service_token` 接没接线的那一句。**单一属主**:`handle()` 的
+ *  凭证门、[ref] 的 parked 赎回席、[ref] 的 consolidation 阀门启动期告警、以及下面 {@link wiredIdentitySources} 读同一句(手抄迟早只改一处,而这条判据
+ *  决定的是「无凭证部署上写口开不开」)。住在本叶(与 {@link systemFor} 同处)而不是 `dispatch.ts`:身份原语只依赖本叶。 */
+export declare function hasServiceAuth(config: ServiceConfig): boolean;
+/** {@link wiredIdentitySources} 读的装配:部署配置 + 入口预认证的鉴权桥(装了才挂身份;`FlatServiceDeps` 结构上满足)。 */
+export interface IdentityWiring {
+    readonly config: ServiceConfig;
+    readonly webAdminJwtVerifier?: object | undefined;
+}
 /**
- * 🔴 **「这台部署有没有身份边界」的唯一判据**(S-1452)。dev-open = 没配 service token(单一或 per-system)、没配只读 trace token、
- * 也没开 `REQUIRE_PRINCIPAL`:请求里没有任何东西替主体头作保,头是谁都能自报的**标签**(过滤 / 展示用),不是身份。
- * 三处读它、不各写一份:会话列表的 fleet-wide 第一臂(`isFleetWide`)、会话写面的 fleet-wide 第一臂(`sessionOwnerScopeForWrite`)、
- * 会话面的属主谓词({@link sessionOwnerReadable})—— 于是「调用方是谁」在列表与单会话面上只有一只读法。
+ * 🔴 **「这台部署的装配能回哪几个身份来源」的唯一读法**({@link IDENTITY_SOURCES} 里接了线的那几个词,序同表)。两处读它、不各写一份:
+ * `/health.auth`(自报位,`http/health-self-report.ts`:`kinds` 与 `required` 同一次求值 —— `required` = 其中有 `service_token`)与 {@link devOpenDeployment}(门)
+ * —— 于是「这台部署认不认身份、门武没武装」在自报面与门上只有一只答案。
  */
-export declare function devOpenDeployment(config: ServiceConfig): boolean;
+export declare function wiredIdentitySources(w: IdentityWiring): readonly IdentitySource[];
+/**
+ * 🔴 **「这台部署有没有身份边界」的唯一判据**(S-1452;S-1509 改读身份来源)。dev-open = 装配**没接任何身份来源**({@link wiredIdentitySources} 为空:
+ * 没配 service token、没装鉴权桥、没开直连门)、**也没声明**只读 trace token 或 `REQUIRE_PRINCIPAL`:请求里没有任何东西替主体头作保,头是谁都能自报的
+ * **标签**(过滤 / 展示用),不是身份。装了鉴权桥的部署(SSO 单开)带登录令牌的调用方是验过的身份 ⇒ 不是 dev-open(修前只看 token / `REQUIRE_PRINCIPAL`,
+ * 这一形被读成 dev-open,任何人 fleet-wide 读全部会话)。
+ * 四处读它、不各写一份:会话列表的 fleet-wide 第一臂(`isFleetWide`)、会话写面的 fleet-wide 第一臂(`sessionOwnerScopeForWrite`)、
+ * 会话面的属主谓词({@link sessionOwnerReadable})、`/metrics` 族的免凭据臂(`dispatch.ts`)—— 于是「调用方是谁」在列表、单会话面与指标面上只有一只读法。
+ */
+export declare function devOpenDeployment(w: IdentityWiring): boolean;
 /**
  * **「这个调用方能不能动这只会话」的唯一谓词**(会话面:视图 / head / 事件流 / 记忆状态与自助抹除 / 改名置顶 / 后台任务 / MCP 重连 /
  * 面板的上一腿 MCP 投影)。= {@link devOpenDeployment} ∨ {@link runOwnerReadable}:没有身份边界的部署上不钉任何人(与会话列表同读,
  * 列表把这只会话列给谁,谁就读得到它);有身份边界的部署上就是 run 面那一条谓词,一字不变。
  * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
  */
-export declare function sessionOwnerReadable(principal: string | undefined, owner: string | null, config: ServiceConfig): boolean;
+export declare function sessionOwnerReadable(principal: string | undefined, owner: string | null, w: IdentityWiring): boolean;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
  *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
  *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.

package/dist/http/principal-gate.js

@@ -93,12 +93,31 @@ export function runOwnerReadable(principal, owner, config) {
         return true;
     return !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
 }
-export function devOpenDeployment(config) {
-    const anyServiceToken = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-    return !anyServiceToken && !config.traceToken && !config.requirePrincipal;
+export function hasServiceAuth(config) {
+    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+}
+function identitySourceWired(kind, w) {
+    switch (kind) {
+        case "service_token":
+            return hasServiceAuth(w.config);
+        case "sso":
+            return w.webAdminJwtVerifier !== undefined;
+        case "direct_door_jwt":
+            return w.config.directDoorActive;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`identity sources: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
+export function wiredIdentitySources(w) {
+    return IDENTITY_SOURCES.filter((k) => identitySourceWired(k, w));
+}
+export function devOpenDeployment(w) {
+    return wiredIdentitySources(w).length === 0 && !w.config.traceToken && !w.config.requirePrincipal;
 }
-export function sessionOwnerReadable(principal, owner, config) {
-    return devOpenDeployment(config) || runOwnerReadable(principal, owner, config);
+export function sessionOwnerReadable(principal, owner, w) {
+    return devOpenDeployment(w) || runOwnerReadable(principal, owner, w.config);
 }
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);

package/dist/http/refusal-body.d.ts

@@ -0,0 +1,21 @@
+/**
+ * **全仓唯一的拒体组句器**(零依赖叶子模块 —— `http/checkpoint-ctx.ts` 的续跑折叠也读它,而那个模块经编译产物进随包排空脚本,闭包只许 node 内建 / 引擎包根)。
+ *
+ * 一只拒 = 三件事:机读码、给人读的句子、拒的机读事实(`field` / `reason` / `count` / `cap` / `detail` …;缺席 = 没有可机读的事实)。
+ * 拒体 = `{ error, errorCode, ...facts }`(机读事实原样随体、排在最后)。整面拒(`http/send.ts` 的 `sendError` / `sendHttpError`)、把同一只拒当**数据**带进 200 体的面板
+ * (`GET /v1/sessions/:id/mcp` 的 `scenarioRefusal`)、续跑把一只拒折成 409 的 `resume_blocked_by_policy`(`http/checkpoint-ctx.ts`)读的都是它 —— 同一只拒在几处渲出的成员逐字同。
+ * 判据只交这份数据,不自己拼体。
+ */
+export interface Refusal {
+    readonly errorCode: string;
+    readonly message: string;
+    readonly facts?: Readonly<Record<string, unknown>>;
+}
+/** {@link refusalBody} 的产物形:`error` + `errorCode` 恒在,机读事实随后。 */
+export type RefusalBody = {
+    readonly error: string;
+    readonly errorCode: string;
+} & Record<string, unknown>;
+/** 拒体:`{ error, errorCode, ...facts }`。 */
+export declare function refusalBody(r: Refusal): RefusalBody;
+//# sourceMappingURL=refusal-body.d.ts.map

package/dist/http/refusal-body.js

@@ -0,0 +1,4 @@
+export function refusalBody(r) {
+    return { error: r.message, errorCode: r.errorCode, ...r.facts };
+}
+//# sourceMappingURL=refusal-body.js.map

package/dist/http/request-guards.d.ts

@@ -7,6 +7,33 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { FlatServiceDeps } from "./server.js";
 import type { LeaseRefusalAdmission } from "../fleet-lease.js";
 import { type QuotaDecision } from "../observability/cost-quota.js";
+import { type SqlWallSource, type SqlWallsReading } from "../plugins/sql-driver.js";
+/**
+ * 受理口对一份提交体的库墙判决:被哪一堵墙拒、量到多少、门限多少。提交体要整只落进库 —— 会话日志的用户消息、durable 审批部署上的续跑输入 ——
+ * 所以每堵墙各量各的、**量的是店真正发出去的东西**,`null` 的墙不参与(PG 两堵都是 `null`;InnoDB 的行墙是 `null`、包墙在;TiDB 两堵都在):
+ *  · `row` —— 行里存的是体的**原字节**(不转义):体的 JSON 字节 ≤ `rowWallPayloadBytes(行墙, "json")`(行墙 − JSON 行的行内余量);
+ *  · `packet` —— 体经 mysql2 以一只字符串字面进语句,`" ' \` 与控制字符各多一个反斜杠字节:**转义后的语句字节**
+ *    (`escapedStatementBytes`,镜像被钉在 mysql2 自己的 `escape` 上)≤ `packetWallStatementBytes(包墙)`(包墙 − 语句余量)。提交体按原样进语句、
+ *    没有 blob 十六进制字面的 2× 膨胀,所以不折半;但引号 / 反斜杠密集的体会比自己的字节数长(至多 2×),这正是不能量原字节的原因。
+ * 两腿的折算与 SQL 快照 blob 的缺省帽读同一份(`plugins/sql-driver.ts`,余量各只在那里定义一次)。两腿都拒时报行墙那条(行墙句逐字沿用)。
+ * 入参是**已判好的墙**(`sql-driver.ts` `sqlWallsOf` —— 事实缺席时的落点只在那里定义,与 blob 帽同一只判官、同一个方向);本函数不读事实、不判缺席,
+ * 墙从哪来(`sources` 里**被拒的那一堵**的出处)原样带进判决(`wallSource`),拒句按它分两形:库报的墙点名库的上限与旋钮,假定的墙(事实还没建立,或事实在场但这一堵读失败、退了文档缺省)只说「库的这个上限没读到、按最保守的墙拒」。
+ * 两堵墙都不存在(PG / 没有 SQL 后端)⇒ `null`。一堵墙「够不着」(行墙门限 ≥ 请求体上限;包墙门限 ≥ 请求体上限的 2×,即转义上界也到不了)时那一腿不量,
+ * 两腿都够不着就连 `JSON.stringify` 都不调 —— 默认的 PG / MySQL 8(包墙 64 MiB)/ 无 SQL 后端部署零额外开销。
+ * 受理口(`admission.ts` `prepareSpec`)按它答 413 `request.payload_too_large`,句子按 `by` × `wallSource` 点名真正拒绝的那堵墙;两位都是闭集,加一臂 = 编译红。
+ */
+export interface SubmitBodyRefusal {
+    readonly by: "row" | "packet";
+    /** 这一腿量到的字节:`row` = 体的 JSON 字节;`packet` = 转义后的语句字节。 */
+    readonly bytes: number;
+    /** 这一腿的门限(同单位)。 */
+    readonly limitBytes: number;
+    /** 拒它的那堵墙(`maxRowBytes` / `maxPacketBytes`),进句子。 */
+    readonly wallBytes: number;
+    /** 拒它的那堵墙从哪来(`sqlWallsOf` 读数 `sources` 里同一堵的出处;上 wire 为拒体的 `wallSource`):`reported` = 库自己报的;`assumed` = 不是库报的(事实还没建立,或这一堵读失败、退了文档缺省)。 */
+    readonly wallSource: SqlWallSource;
+}
+export declare function refuseSubmitBody(walls: SqlWallsReading, body: unknown): SubmitBodyRefusal | null;
 /**
  * S-866 ③ —— 租约拒绝的应答形({@link leaseRefusalOf} 的产物;`{status, body}` 交回形 + 镜像头用的 `retryAfterSec`)。
  * 体键序固定 `error, errorCode, …`(冻结门 `FROZEN_RESULT_BODY` 按这个字面形锚)。

package/dist/http/request-guards.js

@@ -4,7 +4,28 @@ import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js
 import { sendError } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sessionOwnerReadable, devOpenDeployment, sendPrincipalRefusal } from "./principal-gate.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
+import { escapedStatementBytes, packetWallStatementBytes, rowWallPayloadBytes } from "../plugins/sql-driver.js";
 const MAX_BODY = 8 * 1024 * 1024;
+export function refuseSubmitBody(walls, body) {
+    const rowWall = walls.maxRowBytes;
+    const packetWall = walls.maxPacketBytes;
+    const row = rowWall === null ? null : { wallBytes: rowWall, limitBytes: rowWallPayloadBytes(rowWall, "json") };
+    const packet = packetWall === null ? null : { wallBytes: packetWall, limitBytes: packetWallStatementBytes(packetWall) };
+    const liveRow = row !== null && row.limitBytes < MAX_BODY ? row : null;
+    const livePacket = packet !== null && packet.limitBytes < 2 * MAX_BODY ? packet : null;
+    if (liveRow === null && livePacket === null)
+        return null;
+    const json = JSON.stringify(body);
+    const jsonBytes = Buffer.byteLength(json, "utf8");
+    if (liveRow !== null && jsonBytes > liveRow.limitBytes)
+        return { by: "row", bytes: jsonBytes, ...liveRow, wallSource: walls.sources.maxRowBytes };
+    if (livePacket !== null && jsonBytes * 2 > livePacket.limitBytes) {
+        const sentBytes = escapedStatementBytes(json);
+        if (sentBytes > livePacket.limitBytes)
+            return { by: "packet", bytes: sentBytes, ...livePacket, wallSource: walls.sources.maxPacketBytes };
+    }
+    return null;
+}
 export function leaseRefusalOf(adm) {
     switch (adm.reason) {
         case "budget_exhausted":
@@ -151,7 +172,7 @@ export function createRequestGuards(ctx) {
     }
     function isFleetWide(req) {
         const tt = deps.config.traceToken;
-        return devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined || (!!tt && authorized(req, tt));
+        return devOpenDeployment(deps) || systemFor(req, deps.config) !== undefined || (!!tt && authorized(req, tt));
     }
     function sessionOwnerScope(req) {
         const fleetWide = isFleetWide(req);
@@ -159,7 +180,7 @@ export function createRequestGuards(ctx) {
         return { fleetWide, gateOwner };
     }
     function sessionOwnerScopeForWrite(req) {
-        const fleetWide = devOpenDeployment(deps.config) || systemFor(req, deps.config) !== undefined;
+        const fleetWide = devOpenDeployment(deps) || systemFor(req, deps.config) !== undefined;
         const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
         return { fleetWide, gateOwner };
     }
@@ -179,7 +200,7 @@ export function createRequestGuards(ctx) {
         return ownerGate(req, res, (principal) => runOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE));
     }
     function sessionOwnerOk(req, res, owner) {
-        return ownerGate(req, res, (principal) => sessionOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
+        return ownerGate(req, res, (principal) => sessionOwnerReadable(principal, owner, deps), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
     }
     const sessionAssertAbsentWarned = new Set();
     function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {

package/dist/http/resume-legs.d.ts

@@ -22,12 +22,37 @@ import { type TrustedRunInternals } from "./durable-run-leg.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
+import { type ResumeRefusalAnswer } from "./checkpoint-ctx.js";
 /**
  * 🔴 **一次 `CheckpointError` 拒的处置 —— 唯一读口**:{@link CHECKPOINT_ERROR_DISPOSITION} 的读法(doctrine 在那张表头)。resume 腿的 catch 臂只调它一次,
  * 行的落点与 wire 的 `retriable` 都读这一个结果。纯函数,钉直接调。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 —— 型面上拼不出来)
  * ⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
  */
 export declare function resumeRefusalDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
+/**
+ * 🔴 **引擎拒一次续跑(`CheckpointError`)的 HTTP 答复 —— 唯一组句器**(S-1690 / S-1692,core 7.52.0;五条续跑腿〔`/decide` · `/resume` · `/wake` · `plan_review` ·
+ * workflow 决定在宿主会话上起的新一跑〕同经 `driveResumeLeg` 的 catch 臂到这里,SLA 拒扫腿与 PARKED 赎回席经 `resumeCheckpoint` 同得)。
+ *
+ * 规则(一条):**一次拒 = 一个答复形,与「谁发现的」无关**。引擎在认领前 / CAS 前拒的,与本服务在重放存量体之前自己拒的(`resume_blocked_by_policy`,
+ * `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`;续跑入口上卡仍 pending ⇒ 同样带 `retriable:true`)读同一组机读键;体经拒体组句器 `refusalBody` 铸,
+ * `retriable` 经续跑家族的唯一写点 `resumeRefusalWithCard` 追加。
+ * 一处如实例外:后台停驻子代的 parked 赎回不经本函数 —— 引擎的赎回回执只交成因词,`parked-decide.ts` 答 `422 parked_resume.startup_failed`,体只带 `cause`:
+ *  · `errorCode` —— 引擎码的原码镜像(`checkpoint.invalid_outcome` 按决断成因改铸,{@link decisionRefusalCauseOf});
+ *  · 引擎 `detail` 的三个机读判别位原样过境,键名与 `resume_blocked_by_policy` 同义:`detail.code` ⇒ `blockedBy`(挡住它的准入码 = 同一份坏配置在新跑上报的 `errorCode`;
+ *    今天只有 `checkpoint.config_refused` 带它)· `detail.field` ⇒ `field`(哪一侧 / 哪一格)· `detail.reason` ⇒ `reason`(同码多臂时哪一臂,闭集 `CheckpointErrorReason`)。
+ *    缺席不造键(引擎没给就是没给)。`detail` 的其余成员(`requires` / `differs`)不在这组判别位里,不上 wire;`retryAfterMs` 折成族口径的 `retryAfterSec`(下面);
+ *  · `retriable` —— 只在处置读口答 `retriable` 时在场(卡仍 pending、行重新 park;**不是**「原样重试会成功」—— 契约附录 A.1 注那一个意思,壳按它决定卡还挂不挂着)。
+ *    出路(改那一格再决 / 只能在停它的那一版 worker 上跑完或取消 / 等一会)由 `errorCode` + `field` + `blockedBy` + `reason` 与引擎的句子说;
+ *  · `error` —— 引擎的句子原样(它点名条目、哪一臂与出路);本层不另铸第二句;
+ *  · `taskId`(抢到行才在)/ `retryAfterSec`(两码闭集)/ 两版本键(只在 `checkpoint.unsupported_version`:调用方按那一码交 `buildCheckpointVersionKeys` 的产物,本函数原样铺)—— 键律照旧。
+ * 纯函数(钉直接调)。`retriable` 由调用方传入 —— 行的落点与 wire 的 `retriable` 读同一次求值(catch 臂一处),本函数不另判。
+ */
+export declare function checkpointRefusalAnswer(e: CheckpointError, at: {
+    readonly gate: string;
+    readonly retriable: boolean;
+    readonly taskId?: string;
+    readonly versionKeys: Readonly<Record<string, string>>;
+}): ResumeRefusalAnswer;
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];

package/dist/http/resume-legs.js

@@ -22,7 +22,7 @@ import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -45,9 +45,10 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { refusalBody } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
-import { httpErrorCode } from "./send.js";
+import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 function legMayHaveReopenedCheckpoint(r) {
     return r.terminal.kind === "failed" && nestedPauseOf(r.terminal) === undefined;
@@ -77,6 +78,15 @@ const WORKER_SWAP_REDEEMABLE = {
     installation_record_absent: true,
     installation_record_misaligned: false,
     installation_record_invalid: false,
+    unknown_name: true,
+    unsupported_pattern: true,
+    not_a_list: false,
+    not_a_string: false,
+    invalid_record: false,
+    renamed_mount: true,
+    registry_occupied: true,
+    unknown_model_ref: true,
+    not_a_model_ref: true,
 };
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
@@ -136,6 +146,7 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     taskConfig: "config",
+    deps: "config",
     inheritedGate: "config",
 };
 const FIELD_ROLE_CAUSE = {
@@ -161,6 +172,27 @@ function decisionRefusalCauseOf(e, gate) {
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
+export function checkpointRefusalAnswer(e, at) {
+    const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, at.gate) : undefined;
+    const detail = e.detail;
+    return resumeRefusalWithCard({
+        status: e.code === "checkpoint.not_found" ? 404 : 409,
+        body: refusalBody({
+            message: e.message,
+            errorCode: e.code === "checkpoint.invalid_outcome" ? (refusalCause !== undefined ? WIRE_CODE_OF_DECISION_REFUSAL[refusalCause] : UNCLASSIFIED_INVALID_OUTCOME_CODE) : e.code,
+            facts: {
+                ...(at.taskId !== undefined ? { taskId: at.taskId } : {}),
+                ...(detail?.code !== undefined ? { blockedBy: detail.code } : {}),
+                ...(detail?.field ? { field: detail.field } : {}),
+                ...(detail?.reason !== undefined ? { reason: detail.reason } : {}),
+                ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof detail?.retryAfterMs === "number" && Number.isFinite(detail.retryAfterMs) && detail.retryAfterMs > 0
+                    ? { retryAfterSec: Math.max(1, Math.ceil(detail.retryAfterMs / 1000)) }
+                    : {}),
+                ...at.versionKeys,
+            },
+        }),
+    }, at.retriable);
+}
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
@@ -422,11 +454,11 @@ export function createResumeLegs(ctx) {
         noteLateSettleIfAccepted(driven);
         return driven;
     }
-    const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
-    const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
+    const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments", "images"];
+    const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
     const resolveResumeSpec = async (ctx, req, auth) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, {
+        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
@@ -435,10 +467,10 @@ export function createResumeLegs(ctx) {
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
         deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
-        return storedBodyReplayAnswer(refusal, serviceVersion());
+        return storedBodyReplayAnswer(refusal, serviceVersion(), true);
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
@@ -447,7 +479,7 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             if (e instanceof HttpError) {
-                return { ok: false, answer: resumeBlockedByPolicyAnswer(e.message, httpErrorCode(e.status, e.code), e.extra) };
+                return { ok: false, answer: resumeRefusalWithCard(resumeBlockedByPolicyAnswer(httpErrorRefusal(e)), true) };
             }
             throw e;
         }
@@ -909,6 +941,10 @@ export function createResumeLegs(ctx) {
                                 await flush();
                                 await append("compaction_outcome", compactionOutcomeEventData(ev));
                                 break;
+                            case "compaction_started":
+                                await flush();
+                                await append("compaction_started", compactionStartedEventData(ev));
+                                break;
                             case "workspace_changed":
                                 await flush();
                                 await append("workspace_changed", workspaceChangedEventData(ev));
@@ -932,6 +968,7 @@ export function createResumeLegs(ctx) {
                                 break;
                             }
                             case "human_input":
+                                anchor.onHumanInput(ev);
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
                                 break;
@@ -1027,7 +1064,6 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
-                const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, outcome.gate) : undefined;
                 const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
                     await settleCardForCancel();
@@ -1060,21 +1096,7 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                 }
-                const status = e.code === "checkpoint.not_found" ? 404 : 409;
-                return {
-                    status,
-                    body: {
-                        ...(taskId !== undefined ? { taskId } : {}),
-                        error: e.message,
-                        errorCode: e.code === "checkpoint.invalid_outcome" ? (refusalCause !== undefined ? WIRE_CODE_OF_DECISION_REFUSAL[refusalCause] : UNCLASSIFIED_INVALID_OUTCOME_CODE) : e.code,
-                        ...(e.detail?.field ? { field: e.detail.field } : {}),
-                        ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
-                            ? { retryAfterSec: Math.max(1, Math.ceil(e.detail.retryAfterMs / 1000)) }
-                            : {}),
-                        ...(retriable ? { retriable: true } : {}),
-                        ...(e.code === "checkpoint.unsupported_version" ? buildCheckpointVersionKeys(resumeCtx.ctx.writerVersion, serviceVersion()) : {}),
-                    },
-                };
+                return checkpointRefusalAnswer(e, { gate: outcome.gate, retriable, ...(taskId !== undefined ? { taskId } : {}), versionKeys: e.code === "checkpoint.unsupported_version" ? buildCheckpointVersionKeys(resumeCtx.ctx.writerVersion, serviceVersion()) : {} });
             }
             const thrownCause = cancelCtrl.cause();
             if (thrownCause !== undefined) {
@@ -1400,7 +1422,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config.autonomy);
+        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };