@sema-agent/server 7.132.0 → 7.133.0

package/dist/http/request-guards.js

@@ -1,8 +1,11 @@
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
-import { HttpError, principalFrom } from "../security.js";
+import { createCodedHttpError, principalFrom } from "../security.js";
 import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
-import { sendError } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sessionOwnerReadable, devOpenDeployment, sendPrincipalRefusal } from "./principal-gate.js";
+import { invalidJsonError, sendError } from "./send.js";
+import { refusalBody } from "./refusal-body.js";
+import { limitFactsUnmeasured } from "../limit-refusal.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sessionCallerOf, devOpenDeployment, sendPrincipalRefusal } from "./principal-gate.js";
+import { runRowReadable } from "./owner-access.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
 import { escapedStatementBytes, packetWallStatementBytes, rowWallPayloadBytes } from "../plugins/sql-driver.js";
 const MAX_BODY = 8 * 1024 * 1024;
@@ -29,11 +32,15 @@ export function refuseSubmitBody(walls, body) {
 export function leaseRefusalOf(adm) {
     switch (adm.reason) {
         case "budget_exhausted":
-            return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) }, retryAfterSec: adm.retryAfterSec };
+            return { status: 429, body: refusalBody({ errorCode: "quota_exhausted", message: "budget exhausted (quota lease)", facts: { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) } }), retryAfterSec: adm.retryAfterSec };
         case "lease_unavailable":
             return {
                 status: 503,
-                body: { error: "quota lease unavailable — this deployment enforces budgets fail-closed and could not confirm this caller's budget with the quota center, so nothing was run; retry after retryAfterSec seconds", errorCode: "fleet.lease_unavailable", reason: adm.cause, retryAfterSec: adm.retryAfterSec },
+                body: refusalBody({
+                    errorCode: "fleet.lease_unavailable",
+                    message: "quota lease unavailable — this deployment enforces budgets fail-closed and could not confirm this caller's budget with the quota center, so nothing was run; retry after retryAfterSec seconds",
+                    facts: { reason: adm.cause, retryAfterSec: adm.retryAfterSec },
+                }),
                 retryAfterSec: adm.retryAfterSec,
             };
         default: {
@@ -45,9 +52,16 @@ export function leaseRefusalOf(adm) {
 export function costQuotaRefusalOf(d) {
     return {
         status: 429,
-        body: { error: "cost quota exceeded", errorCode: "limit.cost_quota_exceeded", usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec, windowResetsAt: quotaWindowResetsAt(d) },
+        body: refusalBody({
+            errorCode: "limit.cost_quota_exceeded",
+            message: "cost quota exceeded",
+            facts: { usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec, windowResetsAt: quotaWindowResetsAt(d) },
+        }),
     };
 }
+function bodyTooLargeError(message, cap) {
+    return createCodedHttpError(413, "request.payload_too_large", message, limitFactsUnmeasured("body", "bytes", cap));
+}
 function sendLeaseRefusal(res, refusal) {
     const { error, errorCode, ...extra } = refusal.body;
     res.setHeader("retry-after", String(refusal.retryAfterSec));
@@ -67,7 +81,7 @@ export function createRequestGuards(ctx) {
         deps.metrics?.inc("cost_quota_rejected_total");
         const { status, body } = costQuotaRefusalOf(d);
         const { error, errorCode, ...extra } = body;
-        res.setHeader("retry-after", String(body.retryAfterSec));
+        res.setHeader("retry-after", String(d.retryAfterSec));
         sendError(res, status, errorCode, error, extra);
         return true;
     }
@@ -140,7 +154,7 @@ export function createRequestGuards(ctx) {
         deps.metrics?.inc("usage_window_rejected_total");
         deps.logger?.info?.("usage_window_exhausted", { hasPrincipal: key !== GLOBAL_USAGE_KEY, retryAfterMs });
         const retryAfterSec = Math.max(1, Math.ceil(retryAfterMs / 1000));
-        return { status: 429, body: { error: "usage window exhausted (deployment token governance)", errorCode: "usage.window_exhausted", retryAfterSec }, retryAfterSec };
+        return { status: 429, body: refusalBody({ errorCode: "usage.window_exhausted", message: "usage window exhausted (deployment token governance)", facts: { retryAfterSec } }), retryAfterSec };
     }
     async function usageWindowDenied(req, res) {
         const denial = await usageWindowDenialFor(gatedPrincipal(req, deps.config) || GLOBAL_USAGE_KEY);
@@ -197,10 +211,11 @@ export function createRequestGuards(ctx) {
         return true;
     }
     function runOwnerOk(req, res, owner) {
-        return ownerGate(req, res, (principal) => runOwnerReadable(principal, owner, deps.config), () => sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE));
+        return ownerGate(req, res, (principal) => runRowReadable(deps.config, principal, owner, "owner"), () => sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE));
     }
-    function sessionOwnerOk(req, res, owner) {
-        return ownerGate(req, res, (principal) => sessionOwnerReadable(principal, owner, deps), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
+    function sessionOwnerOk(req, res, cell) {
+        const caller = sessionCallerOf(req, deps);
+        return ownerGate(req, res, () => sessionOwnerReadable(caller, cell, deps), () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE));
     }
     const sessionAssertAbsentWarned = new Set();
     function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {
@@ -216,7 +231,7 @@ export function createRequestGuards(ctx) {
         }
         if (asserted === run.sessionId)
             return true;
-        if (explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals))
+        if (explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config))
             return true;
         sendError(res, 404, "not_found.run", notFoundError);
         return false;
@@ -227,7 +242,7 @@ export function createRequestGuards(ctx) {
         for await (const c of req) {
             size += c.length;
             if (size > MAX_BODY)
-                throw new HttpError(413, "request body too large");
+                throw bodyTooLargeError("request body too large", MAX_BODY);
             chunks.push(c);
         }
         if (chunks.length === 0)
@@ -236,7 +251,7 @@ export function createRequestGuards(ctx) {
             return JSON.parse(Buffer.concat(chunks).toString("utf8")) ?? {};
         }
         catch {
-            throw new HttpError(400, "invalid JSON body");
+            throw invalidJsonError("not_json");
         }
     }
     async function readRawBody(req, max) {
@@ -245,7 +260,7 @@ export function createRequestGuards(ctx) {
         for await (const c of req) {
             size += c.length;
             if (size > max)
-                throw new HttpError(413, "blob too large");
+                throw bodyTooLargeError("blob too large", max);
             chunks.push(c);
         }
         return Buffer.concat(chunks);

package/dist/http/resume-ctx-read.d.ts

@@ -23,6 +23,7 @@
  * 恰好没折码,把列错误漏了出来 = 巧合式正确)。两条车道现在同一份拒绝契约,本口只认它。
  */
 import type { CheckpointCtx } from "./route-ctx.js";
+import { type RefusalBody } from "./refusal-body.js";
 export type ResumeCtxRead = {
     readonly kind: "ok";
     readonly ctx: CheckpointCtx;
@@ -37,10 +38,6 @@ export declare function readResumeCtx(load: Promise<CheckpointCtx | null>): Prom
  *  文案只说「哪一行读不出来 + 该找谁」,不把店层 detail 拼上 wire(内部机件不上 wire,S-376 同律)。 */
 export declare function resumeCtxCorruptAnswer(where: string): {
     status: number;
-    body: {
-        error: string;
-        errorCode: string;
-        where: string;
-    };
+    body: RefusalBody;
 };
 //# sourceMappingURL=resume-ctx-read.d.ts.map

package/dist/http/resume-ctx-read.js

@@ -1,4 +1,5 @@
 import { SqlJsonColumnError, StoreCorruptError } from "../plugins/sql-json-column.js";
+import { refusalBody } from "./refusal-body.js";
 export async function readResumeCtx(load) {
     try {
         const ctx = await load;
@@ -15,11 +16,13 @@ export async function readResumeCtx(load) {
 export function resumeCtxCorruptAnswer(where) {
     return {
         status: 500,
-        body: {
-            error: "the stored resume context for this session cannot be read — nothing was decided and nothing was resumed. Ask whoever operates this deployment to look at the row named in `where`: it has to be repaired or removed before this session can resume.",
+        body: refusalBody({
             errorCode: "corrupt",
-            where,
-        },
+            message: "the stored resume context for this session cannot be read — nothing was decided and nothing was resumed. Ask whoever operates this deployment to look at the row named in `where`: it has to be repaired or removed before this session can resume.",
+            facts: {
+                where,
+            },
+        }),
     };
 }
 //# sourceMappingURL=resume-ctx-read.js.map

package/dist/http/resume-legs.d.ts

@@ -17,8 +17,7 @@ import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import type { HostDecision } from "../host-decision.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
-import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
-import { type TrustedRunInternals } from "./durable-run-leg.js";
+import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome, WorkflowDecisionDelivery } from "./route-ctx.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
@@ -81,8 +80,8 @@ export declare function createResumeLegs(ctx: {
         status: number;
         body: object;
     }>;
-    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, trustedInternals: TrustedRunInternals, runId: string) => Promise<HostLegOutcome>;
-    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowParkedResume?: DriveResumeArgs["workflowParkedResume"], ownerLeaseAdmittedFor?: string) => Promise<HostLegOutcome>;
+    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string) => Promise<HostLegOutcome>;
+    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string) => Promise<HostLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
         principalPresent?: boolean;