@sema-agent/server 7.132.0 → 7.134.0

package/dist/http/checkpoint-ctx.js

@@ -12,8 +12,8 @@ export function bodyCarriesAllowList(body) {
     const allow = permissions["allow"];
     return Array.isArray(allow) && allow.length > 0;
 }
-export function buildCheckpointCtx(fields) {
-    return {
+export function buildCheckpointCtx(fields, sealer, sessionId) {
+    const ctx = {
         body: fields.body,
         writerVersion: fields.writerVersion,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
@@ -21,6 +21,7 @@ export function buildCheckpointCtx(fields) {
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
         permissionModeReading: "entry_word",
     };
+    return sealCheckpointCtx(ctx, sealer, sessionId);
 }
 export function withPermissionModeRewritten(ctx, body) {
     return { ...ctx, body, permissionModeReading: "entry_word" };
@@ -32,10 +33,10 @@ export function permissionModeReadingStated(ctx) {
 export function permissionModeReadingRefusal() {
     return {
         status: 409,
-        body: {
-            error: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
+        body: refusalBody({
             errorCode: "checkpoint.unsupported_version",
-        },
+            message: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
+        }),
     };
 }
 export function allowListReadingUnstated(ctx) {
@@ -53,18 +54,18 @@ export function allowListReadingRefusal(era) {
         case "list":
             return {
                 status: 409,
-                body: {
-                    error: "this task was suspended by an earlier server version that did not record how it read settings.permissions.allow (7.114.0 and earlier read it as a whitelist: every tool not on the list was refused); this version hands that list to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+                body: refusalBody({
                     errorCode: "checkpoint.unsupported_version",
-                },
+                    message: "this task was suspended by an earlier server version that did not record how it read settings.permissions.allow (7.114.0 and earlier read it as a whitelist: every tool not on the list was refused); this version hands that list to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+                }),
             };
         case "statement":
             return {
                 status: 409,
-                body: {
-                    error: "this task was suspended by an earlier server version (7.115.0 to 7.116.x) that read settings.permissions.allow as a statement that the named tools are allowed, which answered only the question nobody else had answered and never cleared an ordinary question such as a file write or a shell command; this version hands that list to the engine's allow layer, where an entry also clears those ordinary questions, so continuing would run calls without asking that the task was submitted to ask about. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+                body: refusalBody({
                     errorCode: "checkpoint.unsupported_version",
-                },
+                    message: "this task was suspended by an earlier server version (7.115.0 to 7.116.x) that read settings.permissions.allow as a statement that the named tools are allowed, which answered only the question nobody else had answered and never cleared an ordinary question such as a file write or a shell command; this version hands that list to the engine's allow layer, where an entry also clears those ordinary questions, so continuing would run calls without asking that the task was submitted to ask about. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+                }),
             };
         default: {
             const unhandled = era;
@@ -78,9 +79,12 @@ export function buildCheckpointVersionKeys(writerVersion, readerVersion) {
 export function resumeBlockedByPolicyAnswer(inner) {
     return {
         status: 409,
-        body: refusalBody({ errorCode: "resume_blocked_by_policy", message: `resume blocked by an admission policy change: ${inner.message}`, facts: { blockedBy: inner.errorCode, ...inner.facts } }),
+        body: refusalBody({ errorCode: "resume_blocked_by_policy", message: `resume blocked by an admission policy change: ${inner.message} — nothing was resumed; if the task is still suspended on its approval, cancel it (POST /v1/runs/:id/cancel) to end it without another model turn`, facts: { blockedBy: inner.errorCode, ...inner.facts } }),
     };
 }
+export function isResumeBlockedByPolicy(answer) {
+    return answer.status === 409 && typeof answer.body === "object" && answer.body !== null && answer.body.errorCode === "resume_blocked_by_policy";
+}
 export function resumeRefusalWithCard(answer, cardPending) {
     return cardPending ? { status: answer.status, body: { ...answer.body, retriable: true } } : answer;
 }
@@ -119,4 +123,159 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
         }
     }
 }
+export const CHECKPOINT_CTX_SEAL_ALG = "checkpoint-ctx-sealedbox-v1";
+export const CHECKPOINT_CTX_CREDENTIAL_SLOTS = [
+    { path: ["mcpServers", "*", "transport", "headers"], holds: "map" },
+    { path: ["mcpServers", "*", "transport", "env"], holds: "map" },
+    { path: ["a2aPeers", "*", "headers"], holds: "map" },
+    { path: ["settings", "env"], holds: "map" },
+    { path: ["settings", "webSearch", "apiKey"], holds: "value" },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map" },
+];
+export const CHECKPOINT_CTX_UNSEALABLE_REASONS = ["no_key_store", "key_not_held", "unopenable", "plaintext", "unrecognized_seal"];
+export class CheckpointCtxUnsealableError extends Error {
+    field;
+    reason;
+    constructor(field, reason) {
+        super(`checkpoint ctx credential at ${field} cannot be ${reason === "no_key_store" ? "sealed or opened without a sealed-key store" : `opened (${reason})`}`);
+        this.name = "CheckpointCtxUnsealableError";
+        this.field = field;
+        this.reason = reason;
+    }
+}
+function mintSealedCheckpointCtx(sealed) {
+    return sealed;
+}
+export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export function isSealedCheckpointValue(v) {
+    if (!isRecord(v))
+        return false;
+    const keys = Object.keys(v);
+    return keys.length === 3 && v["alg"] === CHECKPOINT_CTX_SEAL_ALG && typeof v["publicKeyId"] === "string" && typeof v["sealed"] === "string";
+}
+function defineOwn(target, key, value) {
+    Object.defineProperty(target, key, { value, enumerable: true, writable: true, configurable: true });
+}
+function mapCredentialSlots(body, visit) {
+    let out = body;
+    for (const slot of CHECKPOINT_CTX_CREDENTIAL_SLOTS)
+        out = mapAt(out, slot.path, 0, slot.holds, "", visit);
+    return out;
+}
+function mapAt(node, path, i, holds, field, visit) {
+    if (i === path.length) {
+        if (holds === "value")
+            return visit(node, field);
+        if (!isRecord(node) || isSealedCheckpointValue(node))
+            return visit(node, field);
+        let copy;
+        for (const [k, v] of Object.entries(node)) {
+            const next = visit(v, memberField(field, k));
+            if (next !== v)
+                defineOwn((copy ??= { ...node }), k, next);
+        }
+        return copy ?? node;
+    }
+    const seg = path[i];
+    if (seg === "*") {
+        if (Array.isArray(node)) {
+            let copy;
+            node.forEach((el, idx) => {
+                const next = mapAt(el, path, i + 1, holds, `${field}[${idx}]`, visit);
+                if (next !== el)
+                    (copy ??= [...node])[idx] = next;
+            });
+            return copy ?? node;
+        }
+        if (!isRecord(node))
+            return node;
+        let copy;
+        for (const [k, v] of Object.entries(node)) {
+            const next = mapAt(v, path, i + 1, holds, memberField(field, k), visit);
+            if (next !== v)
+                defineOwn((copy ??= { ...node }), k, next);
+        }
+        return copy ?? node;
+    }
+    if (!isRecord(node) || !Object.hasOwn(node, seg))
+        return node;
+    const child = node[seg];
+    const next = mapAt(child, path, i + 1, holds, memberField(field, seg), visit);
+    if (next === child)
+        return node;
+    const copy = { ...node };
+    defineOwn(copy, seg, next);
+    return copy;
+}
+function memberField(field, key) {
+    return field === "" ? key : `${field}.${key}`;
+}
+function sealBody(body, sealer, sessionId) {
+    let valuesSealed = 0;
+    const sealed = mapCredentialSlots(body, (value, field) => {
+        if (sealer === undefined)
+            throw new CheckpointCtxUnsealableError(field, "no_key_store");
+        valuesSealed += 1;
+        return sealer.seal(value, sessionId);
+    });
+    return { body: sealed, valuesSealed };
+}
+export function sealCheckpointCtx(ctx, sealer, sessionId) {
+    const { body } = sealBody(ctx.body, sealer, sessionId);
+    return mintSealedCheckpointCtx({ ...ctx, body: body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG });
+}
+export function openCheckpointCtx(stored, opener, sessionId) {
+    const { credentialSeal, ...rest } = stored;
+    const stamp = credentialSeal;
+    try {
+        const body = mapCredentialSlots(stored.body, (value, field) => {
+            if (stamp === undefined)
+                throw new CheckpointCtxUnsealableError(field, "plaintext");
+            if (stamp !== CHECKPOINT_CTX_SEAL_ALG)
+                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
+            if (isSealedCheckpointValue(value)) {
+                if (opener === undefined)
+                    throw new CheckpointCtxUnsealableError(field, "no_key_store");
+                if (!opener.holds(value.publicKeyId))
+                    throw new CheckpointCtxUnsealableError(field, "key_not_held");
+                try {
+                    return opener.open(value, sessionId);
+                }
+                catch {
+                    throw new CheckpointCtxUnsealableError(field, "unopenable");
+                }
+            }
+            if (isRecord(value) && Object.hasOwn(value, "sealed"))
+                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
+            throw new CheckpointCtxUnsealableError(field, "plaintext");
+        });
+        return { kind: "ok", ctx: { ...rest, body: body } };
+    }
+    catch (e) {
+        if (e instanceof CheckpointCtxUnsealableError)
+            return { kind: "unsealable", field: e.field, reason: e.reason };
+        throw e;
+    }
+}
+export function sealedCredentialFieldOf(stored) {
+    if (!isRecord(stored))
+        return undefined;
+    let first;
+    mapCredentialSlots(stored["body"], (value, field) => {
+        if (first === undefined && isSealedCheckpointValue(value))
+            first = field;
+        return value;
+    });
+    return first;
+}
+export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
+    if (stored.credentialSeal !== undefined)
+        return undefined;
+    const body = stored.body;
+    if (!isRecord(body))
+        return undefined;
+    const out = sealBody(body, sealer, sessionId);
+    return out.valuesSealed === 0 ? undefined : { ctx: mintSealedCheckpointCtx({ ...stored, body: out.body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG }), valuesSealed: out.valuesSealed };
+}
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/claimed-run.d.ts

@@ -1,11 +1,12 @@
 /**
- * 一条提交腿**刚认领**的 run 在起跑之前就收场 —— 撤掉本请求建的东西的**唯一**写法。两个调用点:device 落点拒
- * (`device-placement.ts` `commitPlacement`)与续跑输入写不进(`submit-ctx.ts` `persistSubmitCtx`)。
+ * 一条提交腿**刚认领**的 run 在起跑之前就收场 —— 撤掉本请求建的东西的**唯一**写法。三个调用点:device 落点拒
+ * (`device-placement.ts` `commitPlacement`)、续跑输入写不进(`submit-ctx.ts` `persistSubmitCtx`)与 workflow 决定行没落成
+ * (`durable-run-leg.ts` 的 fresh 投递腿;此刻认领可能已被收割归了别人 —— 两步都按这一跑自己的 taskId,碰不到别人的认领)。
  *
  * 撤两步,**各自独立**(一步失败不拦另一步,残余最小):
  *  · 终结这条 run 行(`setTerminal` 是按 taskId 的 CAS,首写者赢 ⇒ 重复调用是 no-op)—— 随之释放它的 `task_active` 认领;
  *  · 放开它占的提交幂等键(拒绝答复邀请重试;同键重试必须真跑,不是回放这次拒绝 —— `RunStore.releaseIdemKey`)。
- * 撤不掉不致命、但要响:每一步的失败各交给调用方按自己的名字留痕(`onFailure`)。终结没落下 ⇒ 此刻心跳还没起来,`reapStale`
+ * 撤不掉不致命、但要响:每一步的失败各交给调用方按自己的名字留痕(`onFailure`)。终结没落下 ⇒ 起跑前的心跳随调用腿收场停下(或从没起过),`reapStale`
  * 在 `REAP_RUN_STALE_SEC` 之后把这条行翻 failed 并释放会话;幂等键没放开 ⇒ 同键重提回放这条行的回执(两形都是修前每一次的样子)。
  */
 import type { RunStore } from "../plugins/store-backend.js";

package/dist/http/device-placement.d.ts

@@ -53,6 +53,7 @@ import { type DeviceOwner } from "../device-store.js";
 import { type DeviceEnrollment, type DeviceRejection } from "../device-enrollment.js";
 import type { ServiceConfig } from "../config.js";
 import type { RunStore } from "../plugins/store-backend.js";
+import { type RefusalBody } from "./refusal-body.js";
 /**
  * 调用方 device 域的**唯一铸造点**。`undefined` = 判不出域(无 principal,或凭据不带 tenant claim)——
  * 消费点必须响亮拒,禁静默空视图。
@@ -170,8 +171,5 @@ export declare function placementWriteDeadlineMs(runStaleSec: number | undefined
  */
 export declare function commitPlacement(ctx: PlacementCommitCtx, runStore: RunStore, taskId: string, intent: DevicePlacementIntent | undefined): Promise<DeviceRejection | null>;
 /** 拒绝的**唯一** wire 体铸点(四个消费点各自用自己协议的发送姿势,但体的键集只有这一份)。 */
-export declare function devicePlacementErrorBody(rej: DeviceRejection): {
-    error: string;
-    errorCode: string;
-};
+export declare function devicePlacementErrorBody(rej: DeviceRejection): RefusalBody;
 //# sourceMappingURL=device-placement.d.ts.map

package/dist/http/device-placement.js

@@ -3,6 +3,7 @@ import { gatedPrincipal } from "./principal-gate.js";
 import { DEVICE_ERROR_CODES, assertDeviceIdShape, } from "../device-store.js";
 import { buildDeviceRejection } from "../device-enrollment.js";
 import { releaseClaimedRun } from "./claimed-run.js";
+import { refusalBody } from "./refusal-body.js";
 export function deviceOwnerDomainOf(req, config) {
     const subject = gatedPrincipal(req, config);
     if (subject === undefined)
@@ -139,6 +140,6 @@ export async function commitPlacement(ctx, runStore, taskId, intent) {
     return rejection;
 }
 export function devicePlacementErrorBody(rej) {
-    return { error: rej.message, errorCode: rej.code };
+    return refusalBody({ errorCode: rej.code, message: rej.message });
 }
 //# sourceMappingURL=device-placement.js.map

package/dist/http/dispatch.js

@@ -1,21 +1,21 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
-import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
+import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
-import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
+import { actsForDeployment, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
     if (!hasServiceAuth(config))
         return true;
     if (verifiedIdentitySource(req, config) !== undefined)
         return true;
-    return config.traceToken !== undefined && config.traceToken !== "" && authorized(req, config.traceToken);
+    return traceTokenPresented(req, config);
 }
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
@@ -51,10 +51,10 @@ export function createDispatch(ctx) {
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
         deps.drainState.endSubscriptions = () => {
-            const { errorCode, message } = billableRefusalOf("draining").body;
+            const frame = billableRefusalFrame(billableRefusalOf("draining"));
             for (const r of [...openSubscriptions])
                 if (isSseResponse(r))
-                    endSseWithError(r, { errorCode, message });
+                    endSseWithError(r, frame);
         };
     }
     async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
@@ -159,6 +159,10 @@ export function createDispatch(ctx) {
                     const credential = deps.centerCredentialState?.();
                     return credential ? { centerCredential: credential } : {};
                 })(),
+                ...(() => {
+                    const identityNotice = deps.centerIdentityNoticeState?.();
+                    return identityNotice ? { centerIdentityNotice: identityNotice } : {};
+                })(),
                 ...(() => {
                     const modelRefusals = deps.modelRefusalsState?.();
                     return modelRefusals ? { modelRefusals } : {};
@@ -187,7 +191,7 @@ export function createDispatch(ctx) {
             }
             const mt = deps.config.metricsToken;
             const devOpen = devOpenDeployment(deps) && !mt;
-            const ok = devOpen || systemFor(req, deps.config) !== undefined || (!!mt && authorized(req, mt));
+            const ok = devOpen || (!!mt && authorized(req, mt)) || actsForDeployment(req, deps.config, () => gatedPrincipal(req, deps.config));
             if (!ok) {
                 sendUnauthorized(res, "operator");
                 return;
@@ -214,6 +218,8 @@ export function createDispatch(ctx) {
                     req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
                     if (v.identity.scope)
                         setSsoScope(req, v.identity.scope);
+                    if (v.identity.role)
+                        setSsoRole(req, v.identity.role);
                     deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
                 }
             }

package/dist/http/durable-run-leg.d.ts

@@ -1,35 +1,6 @@
-/**
- * **一条 durable run 的「建行 + 驱动」单一属主**(S-218 提取;此前整段住在 `routes/runs.ts` 的
- * `createDurableRun` 里,只服务 HTTP/A2A 两条提交门)。
- *
- * 🔴 为什么提成模块:`/decide` 的 workflow 第三条车道在**宿主不在 park 上**时,同样要在宿主会话上起
- * 一跑新 turn 把决定交给宿主的模型(S-218)。这条链上挂着 `createRun` 的会话 claim(以及它唯一诚实的
- * 409 出路)、checkpoint ctx 落库、fleet 行发布、resume/rewind 两族锚点捕获、审批 ALS、通告投递……
- * 手抄第二份 = 把这十来件事复制成两份会漂的实现,而漂开的那天没有任何东西会说话(`createDurableRun`
- * 当年从路由体里提取出来时,头注写的就是同一条判词)。方向:`routes/runs.ts` 与 `http/server.ts`
- * 都 import 本模块,本模块谁都不 import —— 与 `http/run-meta.ts` 同一条「两个域共用一件 ⇒ 单独成文件」。
- *
- * 边界(本腿**不**含的东西,留给各自的门):同键重放的回执(`http/submit-replay.ts`)、`Idempotency-Key` 的在飞合流、
- * lease / 治理窗 pre-admission、属主门。它们是**提交面**的判据(读请求、写响应),而本腿只吃已经备好的
- * `PreparedTaskSubmission` 并交回一份收据 —— 这正是它能被一条没有 `ServerResponse` 的内部车道复用的原因。
- */
-import { type RunInternals } from "@sema-agent/core";
 import type { RunStore } from "../plugins/store-backend.js";
 import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
-import type { PreparedTaskSubmission, RouteCtxBase } from "./route-ctx.js";
-/**
- * 🔴 **TRUSTED run internals** —— 由**部署方**(不是模型、不是请求体、不是工具参数)铸给这一跑的
- * core 内部席位。今天唯一成员 `workflowParkedResume` = 人对一条 parked workflow 子代的决定
- * (语义属主 = core `RunInternals.workflowParkedResume` 的 d.ts 顶注:「A host that decided a workflow
- * child's parked checkpoint launches the run that re-invokes `Workflow({resumeFromRunId})` with the
- * decision here」)。
- *
- * 为什么单独命名而不是直接摊 `RunInternals`:`RunInternals` 里绝大多数席位是**执行腿自己**铸的
- * (onForwardEvent / onTaskNotification / onActivity …),把整只类型开给调用方等于邀请第二个写者;
- * 本类型只开「部署方可以决定的那一格」,新增一格时**必须**在这里显式点名,编译期看得见。
- * 缺席 ⇒ 对两条腿都是完整 no-op。
- */
-export type TrustedRunInternals = Pick<RunInternals, "workflowParkedResume">;
+import type { PreparedTaskSubmission, RouteCtxBase, WorkflowDecisionDelivery } from "./route-ctx.js";
 export interface DurableRunLegArgs {
     /** `prepareSpec` 的产物,或内部车道按同一条 `resolveSpec` 装配出来的等价形。 */
     prepared: PreparedTaskSubmission;
@@ -49,8 +20,9 @@ export interface DurableRunLegArgs {
     elicitOwner: string | null;
     /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。 */
     source: string | null;
-    /** 见 {@link TrustedRunInternals}。缺席 ⇒ 与本位存在之前逐字相同。 */
-    trustedInternals?: TrustedRunInternals;
+    /** `/decide` 第三条车道的 fresh 投递腿交来的那一件决定投递(带着的决定 + 起跑之前落行的那一笔;语义与 TRUSTED 纪律的属主 =
+     *  `route-ctx.ts` 的 {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊本会话已受理的决定行。 */
+    workflowDecision?: WorkflowDecisionDelivery;
 }
 /**
  * 本腿的结局:一份收据,或「这次提交的一把幂等钥匙已经指向一条行」(店的原子赢或观察的**观察**臂 —— 本腿不碰

package/dist/http/durable-run-leg.js

@@ -1,20 +1,23 @@
 import { uuidv7 } from "@sema-agent/core";
-import { runInBackground } from "../runs.js";
+import { heldWorkflowParkDecisions } from "../parked-decide.js";
+import { HEARTBEAT_MS, runInBackground } from "../runs.js";
 import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
 import { cascadeConfig, runMeta } from "./run-meta.js";
-import { resolveStreamApprovalGate } from "../tool-approval.js";
+import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmitCtx } from "./submit-ctx.js";
+import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
     const sessionId = args.prepared.spec.sessionId ?? uuidv7();
     const taskId = args.clientTaskId ?? uuidv7();
+    const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
     const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), idem: args.idem ?? null });
     if (created.ok)
         clearTurnActivity(taskId);
@@ -25,13 +28,34 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     if (!created.ok) {
         return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
     }
-    const placementReject = await commitPlacement(deps, runStore, taskId, args.prepared.bindingIntent);
-    if (placementReject)
-        return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
-    if (deps.checkpointStore) {
-        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
-        if (ctxRefusal)
-            return ctxRefusal;
+    const owner = args.prepared.auth?.principal ?? null;
+    const preLaunchHeartbeat = setInterval(() => {
+        void runStore.heartbeat(taskId, owner).catch(() => { deps.metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
+    }, HEARTBEAT_MS);
+    preLaunchHeartbeat.unref?.();
+    try {
+        const placementReject = await commitPlacement(deps, runStore, taskId, args.prepared.bindingIntent);
+        if (placementReject)
+            return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+        if (deps.checkpointStore) {
+            const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+            if (ctxRefusal)
+                return ctxRefusal;
+        }
+        if (args.workflowDecision !== undefined) {
+            try {
+                await args.workflowDecision.commitBeforeLaunch(taskId);
+            }
+            catch (err) {
+                await releaseClaimedRun(runStore, taskId, `the workflow decision this run delivers could not be recorded: ${err instanceof Error ? err.message : String(err)}`, (releaseErr, step) => {
+                    deps.logger?.warn?.("workflow_decision_run_release_failed", { taskId, sessionId, step, err: releaseErr instanceof Error ? releaseErr.message : String(releaseErr) });
+                });
+                throw err;
+            }
+        }
+    }
+    finally {
+        clearInterval(preLaunchHeartbeat);
     }
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     const anchorOwner = args.prepared.auth?.principal ?? null;
@@ -60,12 +84,13 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
                 toolApprovalEnabled: true,
                 streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
-                parkFacility: deps.checkpointStore !== undefined,
+                checkpointStore: deps.checkpointStore,
             }).active,
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
+            declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger, args.prepared.acceptance);
-    return { status: 202, body: { taskId, sessionId, status: "running" } };
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance);
+    return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/idempotency.d.ts

@@ -80,11 +80,11 @@ export declare function idemIdentityOf(caller: IdemCaller): string;
 export declare function idemKeyOf(raw: string, caller: IdemCaller, family: IdemFamily): string;
 /**
  * 一次提交的**请求体指纹** —— HTTP 三条提交腿(`POST /v1/tasks` · `/v1/tasks/stream` · `/v1/runs`)同一只规范化函数:
- * `sha256(canonicalJson(体 − taskId))` 的 hex(定宽 64)。
+ * `sha256(canonicalJsonStringify(体 − taskId))` 的 hex(定宽 64)。
  *
  * 幂等 = 同一调用方、同一键、**同一请求**:账本行记下绑定 `Idempotency-Key` 的那次请求的指纹(`task_run.idem_body_fingerprint`),
  * 同键再投而指纹不同 ⇒ 唯一回执函数答 409(`http/submit-replay.ts`)。规范化只有两步:
- *  · JSON 按键递归排序(唯一序列化器 `canonicalJson`;值为 `undefined` 的键与缺席同义)—— 键序不同的同一份体是同一请求;
+ *  · JSON 按键递归排序(唯一序列化器 core `canonicalJsonStringify`;值为 `undefined` 的键与缺席同义)—— 键序不同的同一份体是同一请求;
  *  · 去掉 `taskId` —— 它是同一条律的**另一把钥匙**(调用方自铸的主键),由回执函数的「钥匙指向别的行 ⇒ `conflict.run_exists`」判,
  *    不是请求内容(换腿重投:流式腿不带 → durable 腿带回 `x-task-id`,仍是同一请求)。
  * 头一概不进:身份已在键里(`idemKeyOf` 的身份位),其余头(`Idempotency-Key` 本身、`x-detach-on-disconnect` 一类连接语义)不是提交内容。

package/dist/http/idempotency.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { canonicalJson } from "../canonical-json.js";
+import { canonicalJsonStringify } from "@sema-agent/core";
 import { gatedPrincipal } from "./principal-gate.js";
 export class IdempotencyCache {
     ttlMs;
@@ -80,7 +80,7 @@ export function idemKeyOf(raw, caller, family) {
 }
 export function submissionFingerprintOf(body) {
     const content = body !== null && typeof body === "object" && !Array.isArray(body) ? { ...body, taskId: undefined } : body;
-    return createHash("sha256").update(canonicalJson(content)).digest("hex");
+    return createHash("sha256").update(canonicalJsonStringify(content)).digest("hex");
 }
 export function submissionIdemOf(raw, caller, body) {
     return { key: idemKeyOf(raw, caller, "run"), bodyFingerprint: submissionFingerprintOf(body) };

package/dist/http/owner-access.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 🔴 **属主存取器**(S-487 RH-3 第一期)——「这个调用方读得到这一行 run / 会话吗」的行只经这里取得。
+ *
+ * ## 律(一条)
+ * 判官只有一只:run 行 = `principal-gate.ts` 的 `runOwnerReadable`(三条放行臂,含 [ref] C8 窄互认),会话行 = `sessionOwnerReadable`
+ * (dev-open 不钉人;无主行经 `security.ts` 的 `ownerlessRowOpen`;有主行就是 run 那一只)。本模块**不判第二遍、不另写一条**:它只做三件事 ——
+ *  · 取行(或收下调用点已读到的行)并把行上的属主铸成 `DurableOwnerKey`(品牌铸点之一,见 `security.ts`);
+ *  · 过判官,读不到 ⇒ `undefined` —— 与「没有这一行」**同一个值**,路由手里拿不到它无权看的行,也就没有第二种拒绝形可漏存在性;
+ *  · operator 臂由调用点以闭集 {@link OwnerArm} 声明,这里统一并 `explicitOperatorOk`(此前各口手抄 `explicitOperatorOk(...) || owner === principal`)。
+ *
+ * ## 射程(第一期)
+ * 迁进来的口:leader 登记表的读与幂等重放、A2A `tasks/get`、preempt、审批豁免面;`request-guards.ts` 的 `runOwnerOk` 与提交撞键的回执函数
+ * (`submit-replay.ts`)经 {@link runRowReadable} 读同一只判官。其余按 run / 会话寻址的口(`runOwnerOk` 16 处、`sessionOwnerOk` 10 处)第二期整体换成
+ * {@link readOwnedRun} / {@link readOwnedSession} 并删两只 helper;裸 store 读口按文件计数钉在 `test/owner-gate-single-owner.test.ts`(增即红)。
+ */
+import type { ServiceConfig } from "../config-types.js";
+import type { RunRecord } from "../plugins/store-contracts.js";
+import { type OwnerAwareSessionStore, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
+import { type IdentityWiring, type OperatorRoster } from "./principal-gate.js";
+/** 调用点挂哪条臂(闭集):`owner` = 只有属主判官;`owner_or_operator` = 属主判官 ∨ 显式运维(`explicitOperatorOk`,唯一读法)。 */
+export type OwnerArm = "owner" | "owner_or_operator";
+/** 存取器读的配置格:判官要 `requirePrincipal`(C8 臂的单用户条件),operator 臂要运维名册。 */
+export type OwnerAccessConfig = Pick<ServiceConfig, "requirePrincipal"> & OperatorRoster;
+/**
+ * 一行 run 行的属主过判官。`owner`:串 = 有主,`null` = 无主(开放);**`undefined` = 属主格坏了**(型上是 `string | null`,盘上的 run.json 少了这个键时
+ * 运行期会读成缺席 —— 文件店的形判据不验它)⇒ 谁都读不到(fail-closed,不猜成无主;operator 臂照常并)。leader 登记行的 `owner` 是可选键、缺席 = 无主,
+ * 那是 leader 记录型自己的语义,由 {@link createLeaderRunVisibility} 在 leader 边界上显式折成 `null`,不在这里混读。
+ */
+export declare function runRowReadable(config: OwnerAccessConfig, principal: Principal | undefined, owner: string | null | undefined, arm: OwnerArm): boolean;
+/**
+ * 按**会话**寻址的面上读一行 run 行(会话面板的上一腿 MCP 投影:读的是这只会话最新那条 run 的账本行):判官 = 会话面那一只(`sessionOwnerReadable`:
+ * dev-open 不钉人,与会话列表同读);run 行不是委派子代的 placed 会话行 ⇒ 无主时 `placed: false`(与 run 面对无主 run 的读法同)。
+ */
+export declare function runRowReadableOnSessionFace(w: IdentityWiring & {
+    readonly config: OwnerAccessConfig;
+}, caller: SessionCaller, owner: string | null, arm: OwnerArm): boolean;
+/** run 行读口:行 | `undefined`(没有这一行 ≡ 读不到,同一个值)。 */
+export declare function readOwnedRun(config: OwnerAccessConfig, runStore: {
+    getRun(taskId: string): Promise<RunRecord | undefined>;
+}, principal: Principal | undefined, taskId: string, arm: OwnerArm): Promise<RunRecord | undefined>;
+/**
+ * 会话行读口:属主一读 + 无主时 placement 一格(`sessionOwnerCellOf`,S-1770)+ 会话面判官。`undefined` = 没有这只会话(`ownerOf` 答 `undefined`)≡ 读不到。
+ * 读回的那一格交给调用点(要按属主作答的口用它)。店的读失败照常抛(500,绝不当成「读不到」或「读得到」)。
+ */
+export declare function readOwnedSession(w: IdentityWiring & {
+    readonly config: OwnerAccessConfig;
+}, store: Pick<OwnerAwareSessionStore, "placementOf"> & {
+    ownerOf(sessionId: string): Promise<string | null | undefined>;
+}, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
+/**
+ * leader 登记表的判官形(boot 装配一次,`createLeaderEndpoint` 的必填席)—— leader 模块不再自判属主(修前它手抄 `owner == null || owner === requester`,
+ * 缺 C8 窄互认臂而注称 mirrors runOwnerOk)。leader 腿的调用方身份经幂等身份结构(`IdemCaller.principal`,即 `gatedPrincipal` 的回值)转手而来,
+ * 这里是 `Principal` 的「上游已验」适配铸点(第二期随那只结构带品牌而删)。`config` 是活的配置对象(每次调用现读)。
+ */
+export declare function createLeaderRunVisibility(config: OwnerAccessConfig): (principal: string | null | undefined, owner: string | null | undefined) => boolean;
+//# sourceMappingURL=owner-access.d.ts.map

package/dist/http/owner-access.js

@@ -0,0 +1,42 @@
+import { mintDurableOwnerKey, mintPrincipal, sessionOwnerCellOf } from "../security.js";
+import { explicitOperatorOk, runOwnerReadable, sessionOwnerReadable } from "./principal-gate.js";
+function operatorArmHolds(config, principal, arm) {
+    switch (arm) {
+        case "owner":
+            return false;
+        case "owner_or_operator":
+            return explicitOperatorOk(principal, config);
+        default: {
+            const unknownArm = arm;
+            throw new Error(`owner access: unknown arm ${String(unknownArm)}`);
+        }
+    }
+}
+export function runRowReadable(config, principal, owner, arm) {
+    if (operatorArmHolds(config, principal, arm))
+        return true;
+    if (owner === undefined)
+        return false;
+    return runOwnerReadable(principal, owner === null ? null : mintDurableOwnerKey(owner), config);
+}
+export function runRowReadableOnSessionFace(w, caller, owner, arm) {
+    if (operatorArmHolds(w.config, caller.principal, arm))
+        return true;
+    const cell = owner === null ? { owner: null, placed: false } : { owner: mintDurableOwnerKey(owner) };
+    return sessionOwnerReadable(caller, cell, w);
+}
+export async function readOwnedRun(config, runStore, principal, taskId, arm) {
+    const row = await runStore.getRun(taskId);
+    return row !== undefined && runRowReadable(config, principal, row.owner, arm) ? row : undefined;
+}
+export async function readOwnedSession(w, store, caller, sessionId, arm) {
+    const owner = await store.ownerOf(sessionId);
+    if (owner === undefined)
+        return undefined;
+    const cell = await sessionOwnerCellOf(store, sessionId, owner);
+    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? cell : undefined;
+}
+export function createLeaderRunVisibility(config) {
+    return (principal, owner) => runRowReadable(config, principal == null ? undefined : mintPrincipal(principal), owner ?? null, "owner");
+}
+//# sourceMappingURL=owner-access.js.map