@sema-agent/server 7.133.0 → 7.134.0

package/dist/http/resume-legs.js

@@ -17,7 +17,8 @@ import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
+import { currentApprovalGateToken } from "../approval-gate-currency.js";
+import { createApprovalCardEmitter, declaredApprovalFrameFamilies, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { serviceVersion } from "../service-version.js";
@@ -47,9 +48,9 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
-import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
-import { refusalBody } from "./refusal-body.js";
+import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "./resume-ctx-read.js";
+import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
@@ -125,6 +126,9 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
+function windowZeroSeatOf(toolApproval) {
+    return (identity) => toolApproval.boundUnattendedAsk(identity, { arm: "window_zero" });
+}
 export function resumeRefusalDisposition(e) {
     const word = Object.hasOwn(CHECKPOINT_ERROR_DISPOSITION, e.code) ? CHECKPOINT_ERROR_DISPOSITION[e.code] : undefined;
     switch (word) {
@@ -186,9 +190,7 @@ export function checkpointRefusalAnswer(e, at) {
             errorCode: e.code === "checkpoint.invalid_outcome" ? (refusalCause !== undefined ? WIRE_CODE_OF_DECISION_REFUSAL[refusalCause] : UNCLASSIFIED_INVALID_OUTCOME_CODE) : e.code,
             facts: {
                 ...(at.taskId !== undefined ? { taskId: at.taskId } : {}),
-                ...(detail?.code !== undefined ? { blockedBy: detail.code } : {}),
-                ...(detail?.field ? { field: detail.field } : {}),
-                ...(detail?.reason !== undefined ? { reason: detail.reason } : {}),
+                ...resumeRefusalFacts(detail),
                 ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof detail?.retryAfterMs === "number" && Number.isFinite(detail.retryAfterMs) && detail.retryAfterMs > 0
                     ? { retryAfterSec: Math.max(1, Math.ceil(detail.retryAfterMs / 1000)) }
                     : {}),
@@ -198,11 +200,12 @@ export function checkpointRefusalAnswer(e, at) {
     }, at.retriable);
 }
 export function createResumeLegs(ctx) {
-    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const ctxOpening = (sessionId) => ({ sessionId, opener: deps.checkpointCtxSealing });
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
     async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
+        const token = await currentApprovalGateToken(cs, sessionId);
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
             let seenUnreadable = false;
             const seen = await cs.get(binding.checkpointToken).catch((e) => {
@@ -386,7 +389,7 @@ export function createResumeLegs(ctx) {
             const parkedReq = {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
                 decision, hostDecision, ...(reason !== undefined ? { reason } : {}),
-                ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
+                ...(binding !== undefined ? { binding: (({ checkpointToken: _staleGuardOnly, ...rest }) => rest)(binding) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
                 ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
             };
@@ -399,7 +402,7 @@ export function createResumeLegs(ctx) {
                     sessionFaceOf: deps.sessionStorage?.sessionFaceOf ? deps.sessionStorage.sessionFaceOf.bind(deps.sessionStorage) : sessionFaceUnavailable,
                     ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
-                    ...(deps.toolApproval ? { approverSeatFor: deps.toolApproval.boundUnattendedAsk } : {}),
+                    ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
                 }, parkedReq, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
@@ -463,9 +466,11 @@ export function createResumeLegs(ctx) {
                 return out;
             }
         }
-        const ctxRead0 = await readResumeCtx(ctxPromise);
+        const ctxRead0 = await readResumeCtx(ctxPromise, ctxOpening(sessionId));
         if (ctxRead0.kind === "corrupt")
             return resumeCtxCorruptAnswer(ctxRead0.where);
+        if (ctxRead0.kind === "unsealable")
+            return resumeCtxUnsealableAnswer(ctxRead0);
         const ctx = ctxRead0.kind === "ok" ? ctxRead0.ctx : null;
         if (!ctx)
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
@@ -492,6 +497,7 @@ export function createResumeLegs(ctx) {
             decision: decision === "approve" ? "allow" : "deny",
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
+            ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
             ...(answer !== undefined ? { answer } : {}),
             hostDecision,
         };
@@ -554,7 +560,7 @@ export function createResumeLegs(ctx) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
-        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, { ...resumeCtx.ctx, writerVersion: serviceVersion() }).catch((e) => {
+        const commitResumeCtx = () => Promise.resolve().then(() => deps.checkpointStore.putCtx(resumeCtx.sessionId, sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId))).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
         });
@@ -563,7 +569,7 @@ export function createResumeLegs(ctx) {
             toolApprovalEnabled: Boolean(deps.toolApproval),
             streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
             backend: deps.backend,
-            parkFacility: deps.checkpointStore !== undefined,
+            checkpointStore: deps.checkpointStore,
         }).active;
         const approvalLeg = resolveApprovalLeg({
             streamApprovalOn,
@@ -571,6 +577,7 @@ export function createResumeLegs(ctx) {
             windowMarginMs: deps.config.streamAskWindowMarginMs,
             ...(typeof taskConfig.limits?.maxWalltimeMs === "number" ? { legWalltimeMs: taskConfig.limits.maxWalltimeMs } : {}),
             nowMonotonicMs: performance.now(),
+            declaredFamilies: declaredApprovalFrameFamilies(resumeCtx.ctx.body.settings),
         });
         const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
         const ownerQuotaDenial = args.callerInitiated === true ? ownerCostQuotaDenied(principal) : undefined;
@@ -609,8 +616,8 @@ export function createResumeLegs(ctx) {
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
-            resumeTaskConfig.onAsk = approvalLeg.windowZero
-                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId })
+            resumeTaskConfig.onAsk = approvalLeg.unattended
+                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId }, approvalLeg.unattended)
                 : toolApproval.boundAsk({
                     owner: principal ?? null,
                     taskId,
@@ -1097,7 +1104,7 @@ export function createResumeLegs(ctx) {
                     const { type, ...rest } = frame;
                     return append(type, rest);
                 };
-                const withApproval = () => deps.toolApproval && taskId && approvalLeg.active && !approvalLeg.windowZero
+                const withApproval = () => deps.toolApproval && taskId && approvalLeg.active && approvalLeg.unattended === undefined
                     ? deps.toolApproval.runWithContext({
                         taskId,
                         owner: principal ?? null,
@@ -1274,9 +1281,11 @@ export function createResumeLegs(ctx) {
         if (gateKind !== RESUMABLE_GATE_KIND) {
             return { status: 409, body: refusalBody({ errorCode: "gate_not_resumable", message: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide` }) };
         }
-        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId), ctxOpening(sessionId));
         if (ctxRead.kind === "corrupt")
             return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "unsealable")
+            return resumeCtxUnsealableAnswer(ctxRead);
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const ctx = ctxRead.ctx;
@@ -1294,9 +1303,11 @@ export function createResumeLegs(ctx) {
         if (!deps.runStore) {
             return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
         }
-        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId), ctxOpening(sessionId));
         if (ctxRead.kind === "corrupt")
             return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "unsealable")
+            return resumeCtxUnsealableAnswer(ctxRead);
         const ctx = ctxRead.kind === "ok" ? ctxRead.ctx : null;
         if (!ctx) {
             return {
@@ -1385,9 +1396,11 @@ export function createResumeLegs(ctx) {
                 throw e;
             }
         }
-        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId), ctxOpening(sessionId));
         if (ctxRead.kind === "corrupt")
             return resumeCtxCorruptAnswer(ctxRead.where);
+        if (ctxRead.kind === "unsealable")
+            return resumeCtxUnsealableAnswer(ctxRead);
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const ctx = ctxRead.ctx;
@@ -1474,9 +1487,11 @@ export function createResumeLegs(ctx) {
                 }),
             });
         }
-        const ctxRead = await readResumeCtx(cs.getCtx(sessionId));
+        const ctxRead = await readResumeCtx(cs.getCtx(sessionId), ctxOpening(sessionId));
         if (ctxRead.kind === "corrupt")
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
+        if (ctxRead.kind === "unsealable")
+            return refuse(resumeCtxUnsealableAnswer(ctxRead));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) });
         const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config);
@@ -1514,7 +1529,7 @@ export function createResumeLegs(ctx) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview },
     };

package/dist/http/route-ctx.d.ts

@@ -73,21 +73,12 @@ export interface RouteHelpers {
     /** [ref]-T1:治理窗 pre-admission(异步 202 车道的唯一 429 出路;key 公式与 core 单源)。 */
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
-    isFleetWide(req: IncomingMessage): boolean;
     /** run 面的属主门(谓词 `runOwnerReadable`;非属主 ⇒ 404 `not_found.run` + 长文,与 run 读口的 unknown 臂同码同串,[ref])。 */
     runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;
     /** 会话面的属主门(谓词 `sessionOwnerReadable`,S-1452:没有身份边界的部署不钉人,与会话列表同读;非属主 ⇒ 404 `not_found.session` +
      *  {@link SESSION_NOT_FOUND_MESSAGE},与会话读口的 unknown 臂同码同串 —— G52 [ref] / S-989)。每一个按会话寻址的属主判都走它。
      *  `cell` = 调用点经 `security.ts` 的 `sessionOwnerCellOf` 读出的那一格(S-1770:无主的委派子代 placed 行只对 fleet 调用方放行,判据 `ownerlessRowOpen`)。 */
     sessionOwnerOk(req: IncomingMessage, res: ServerResponse, cell: SessionOwnerCell): boolean;
-    sessionOwnerScope(req: IncomingMessage): {
-        fleetWide: boolean;
-        gateOwner: string | null;
-    };
-    sessionOwnerScopeForWrite(req: IncomingMessage): {
-        fleetWide: boolean;
-        gateOwner: string | null;
-    };
     runSessionAcceptOk(req: IncomingMessage, res: ServerResponse, run: {
         sessionId: string | null;
     }, face: string, notFoundError?: string): boolean;

package/dist/http/routes/agents-roster.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const ROSTER_SCAN_LIMIT = 500;
@@ -56,10 +56,9 @@ function decodeCursor(raw) {
 }
 export async function handleAgentRoster(req, res, match, ctx) {
     const { deps } = ctx;
-    const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "agents-roster": {
-            const { fleetWide, gateOwner } = sessionOwnerScope(req);
+            const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
             if (!fleetWide && gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;

package/dist/http/routes/approvals-assistant.js

@@ -14,7 +14,7 @@ import { redactRiskDescriptor } from "../../observability/run-terminal.js";
 import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
+import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
 import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
@@ -23,17 +23,17 @@ import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answe
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { readResumeCtx } from "../resume-ctx-read.js";
+import { KEEP_SEALED, readResumeCtx } from "../resume-ctx-read.js";
 import { StoreCorruptError } from "../../plugins/sql-json-column.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "feedback", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -285,8 +285,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : ownScope;
+            let durableRows;
+            try {
+                durableRows = await cs.listPending(scope);
+            }
+            catch (err) {
+                if (!isApprovalsReadCorrupt(err))
+                    throw err;
+                logRequestError(deps.logger, req, err);
+                sendError(res, 500, "approvals.read_corrupt", "a stored approval row cannot be read - retrying this request will fail the same way until an operator repairs or removes the row");
+                return;
+            }
             sendJson(res, 200, {
-                pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
+                pending: durableRows.map((r) => projectPendingForWire(r, deps.config)),
                 serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
@@ -342,10 +353,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator && ownerParam ? ownerParam : ownScope;
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId));
+                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId), KEEP_SEALED);
                 if (ctxRead.kind === "corrupt")
                     recordFailOpen("server.assistant-inbox.objective-ctx-corrupt", ctxRead.where);
-                const objective = ctxRead.kind === "ok" ? (ctxRead.ctx.body?.objective ?? null) : null;
+                const storedBody = ctxRead.kind === "ok" ? ctxRead.ctx.body : undefined;
+                const storedObjective = typeof storedBody === "object" && storedBody !== null ? storedBody.objective : undefined;
+                const objective = typeof storedObjective === "string" ? storedObjective : null;
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
@@ -655,7 +668,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }", retiredDecisionKeyFacts(body)?.extra);
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy?, feedback? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
@@ -719,6 +732,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
+            if (body.feedback !== undefined && typeof body.feedback !== "string") {
+                sendError(res, 400, "request.field_invalid", "feedback must be a string (the words the approving person wrote on the card; omit the key when there are none)");
+                return;
+            }
             if (deps.config.directDoorActive && body.updatedInput !== undefined) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
@@ -727,6 +744,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.feedback !== undefined) {
+                sendError(res, 400, "feedback_not_in_proof", "feedback is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
             const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
             switch (decidedByReading.kind) {
                 case "not_in_proof":
@@ -743,11 +764,20 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             const decidedBy = decidedByReading.decidedBy;
+            if (body.feedback !== undefined && decision !== "approve") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid with decision 'approve' — the words of a denial are its reason", fieldConflictFacts("approval_feedback", ["feedback", "decision"]));
+                return;
+            }
+            if (body.feedback !== undefined && decidedBy !== "person") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid on a person's decision — the agent reads it as the user's own words, which a policy decision cannot carry", fieldConflictFacts("approval_feedback", ["feedback", "decidedBy"]));
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
                 boundInputHash: body.boundInputHash,
                 updatedInput: body.updatedInput,
+                ...(typeof body.feedback === "string" ? { feedback: body.feedback } : {}),
             };
             let deciderPrincipal = principal;
             if (deps.config.directDoorActive) {
@@ -811,6 +841,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
                     ...(answer !== undefined ? { answer } : {}),
                     ...((r) => (r !== undefined ? { reason: r } : {}))(decisionReasonOf(body)),
+                    ...(binding.feedback !== undefined ? { feedback: binding.feedback } : {}),
                 },
                 deciderPrincipal,
                 explicitOperator,
@@ -827,6 +858,9 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
     return assertNever(match.decl.id);
 }
 const APPROVALS_STREAM_POLL_MS = 3000;
+function isApprovalsReadCorrupt(err) {
+    return err instanceof StoreCorruptError;
+}
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
     if (rd === null || rd === undefined)
@@ -898,7 +932,7 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
             snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
         catch (err) {
-            if (err instanceof StoreCorruptError) {
+            if (isApprovalsReadCorrupt(err)) {
                 if (!res.writableEnded)
                     res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_corrupt", message: "a stored approval row cannot be read - this stream is closing, and reconnecting will fail the same way until an operator repairs or removes the row" })}\n\n`);
                 break;

package/dist/http/routes/capabilities.js

@@ -131,7 +131,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
                 settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,

package/dist/http/routes/diagnostics.d.ts

@@ -43,8 +43,8 @@ export interface ServerWiringGateInput {
     streamApprovalEnabled: boolean;
     /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
     backend: StreamApprovalGateInput["backend"];
-    /** 在场性即事实;本面不取实例,故 `unknown` 足够(取窄型会把整棵 store 类型树拖进诊断域)。 */
-    checkpointStore: unknown;
+    /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
+    checkpointStore: StreamApprovalGateInput["checkpointStore"];
     durableApproval: boolean;
     /** S-178:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
     durableApprovalSource: PostureSource;
@@ -68,7 +68,7 @@ export interface StaticWiringAudit {
 export interface StaticWiringFacts {
     /** core `describeStaticWiring(deps, specTemplate)` 的产物。 */
     manifest: WiringManifest;
-    /** 我方喂给 `resolveStreamApprovalGate` 的 `parkFacility` 实参(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
+    /** 我方喂给 `resolveStreamApprovalGate` 的 `checkpointStore` 实参的在场性(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
     parkFacility: boolean;
     /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
     backendKind: "mysql" | "pg" | "local" | undefined;

package/dist/http/routes/diagnostics.js

@@ -12,7 +12,7 @@ export function buildServerWiringGates(input) {
         toolApprovalEnabled: input.toolApprovalEnabled,
         streamApprovalEnabled: input.streamApprovalEnabled,
         backend: input.backend,
-        parkFacility: input.checkpointStore !== undefined,
+        checkpointStore: input.checkpointStore,
     });
     const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
     const noLaneArm = (knob) => `this knob has no execution-lane default — ${knob} does not depend on which execution lane this deployment runs`;

package/dist/http/routes/fleet.js

@@ -2,12 +2,11 @@ import { hookNoticeWire } from "../../fleet/fleet-bus.js";
 import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
     const { deps } = ctx;
-    const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "fleet-stream": {
             const fleet = facts.fleetStream(deps);
@@ -15,7 +14,7 @@ export async function handleFleet(req, res, match, ctx) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
-            const { fleetWide } = sessionOwnerScope(req);
+            const { fleetWide } = fleetViewOf(req, deps, "read");
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal && !fleetWide) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -77,7 +76,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             return rest;
         };
         const SCOPED_WORKFLOW_KEY_DISPOSITION = {
-            id: "keep", status: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
+            id: "keep", status: "keep", errorCode: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
             startedCount: "keep", elapsedMs: "keep", tokens: "keep",
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub",
@@ -90,6 +89,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     id: rest.id,
                     status: rest.status,
                     name: "(unattributed)",
+                    ...(rest.errorCode !== undefined ? { errorCode: rest.errorCode } : {}),
                     ...(rest.doneCount !== undefined ? { doneCount: rest.doneCount } : {}),
                     ...(rest.totalCount !== undefined ? { totalCount: rest.totalCount } : {}),
                     ...(rest.failedCount !== undefined ? { failedCount: rest.failedCount } : {}),

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/rules.js

@@ -6,8 +6,8 @@ import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { hasControlOrBidi } from "@sema-agent/settings-schema";
-import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
+import { IMPORTED_SETTINGS_LAYERS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, RULE_ADD_ORIGINS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
+import { isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -23,7 +23,7 @@ const CcImportPrepareBodySchema = z
     layers: z
         .array(z
         .object({
-        layer: z.enum(["userSettings", "projectSettings", "localSettings"]),
+        layer: z.enum(IMPORTED_SETTINGS_LAYERS),
         path: z.string().min(1).max(1024),
         root: z.string().max(1024),
         content: z.string().max(MAX_LAYER_CONTENT_CHARS),
@@ -41,7 +41,7 @@ const CcImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict
 const LocalImportAddSchema = z
     .object({
     dot: z.object({ actor: z.string().min(1).max(190), counter: z.number().int().nonnegative().safe() }).strict(),
-    origin: z.enum(["user", "imported-cc", "starter"]),
+    origin: z.enum(RULE_ADD_ORIGINS),
     createdAt: z.string().min(1).max(64),
 })
     .strict();

package/dist/http/routes/runs.js

@@ -13,7 +13,8 @@ import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
-import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { readRunDeclaredFamilies } from "../run-declared-families.js";
 import { MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "../../approval-ask-machine.js";
 import { causeOfAskRow } from "../../approval-deny-reasons.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
@@ -109,17 +110,26 @@ function sendHandleMiss(res, run, thisInstanceId) {
     }
     return false;
 }
-async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
+async function streamRunEvents(req, res, deps, runStore, taskId, sessionId, staleMs) {
     await streamSseLog(req, res, {
         preamble: async (signal) => {
             const gate = resolveStreamApprovalGate({
                 toolApprovalEnabled: Boolean(deps.toolApproval),
                 streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
-                parkFacility: deps.checkpointStore !== undefined,
+                checkpointStore: deps.checkpointStore,
             });
             if (!gate.active)
                 return [];
+            const declaredFamilies = await readRunDeclaredFamilies(gate.checkpointStore, sessionId, (where) => deps.logger?.warn?.("approval_preamble_declaration_unreadable", { taskId, where, face: "run.events" }));
+            if (!approvalPreambleReplays({
+                streamApprovalOn: gate.active,
+                windowMs: deps.config.streamApproval?.windowMs,
+                windowMarginMs: deps.config.streamAskWindowMarginMs,
+                declaredFamilies,
+            })) {
+                return [];
+            }
             const store = gate.askStore;
             const rows = await store.listPendingByTask(taskId, signal);
             const { frames, skipped, dropped } = buildApprovalPreamble(rows, Date.now(), deps.config.streamApproval.replayMax);
@@ -255,7 +265,7 @@ export async function handleRuns(req, res, match, ctx) {
         if (!runSessionAcceptOk(req, res, run, match.decl.id === "run-events" ? "run.events" : "run.poll"))
             return;
         if (match.decl.id === "run-events") {
-            await streamRunEvents(req, res, deps, runStore, taskId, deps.config.runStaleSec * 1000);
+            await streamRunEvents(req, res, deps, runStore, taskId, run.sessionId, deps.config.runStaleSec * 1000);
         }
         else {
             sendJson(res, 200, await readRunFace(deps, runStore, run));
@@ -613,11 +623,15 @@ export async function handleRuns(req, res, match, ctx) {
                 const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
-                const resumeRead = await readResumeCtx(cs.getCtx(run.sessionId));
+                const resumeRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing });
                 if (resumeRead.kind === "corrupt") {
                     mintResult.corruptCtxWhere = resumeRead.where;
                     return;
                 }
+                if (resumeRead.kind === "unsealable") {
+                    mintResult.unsealableCtx = resumeRead;
+                    return;
+                }
                 if (resumeRead.kind === "absent") {
                     mintResult.noResumeCtx = true;
                     return;
@@ -641,10 +655,13 @@ export async function handleRuns(req, res, match, ctx) {
                     createdAt: Date.now(),
                     sourceTaskId: taskId,
                 });
-                const stillRead = await readResumeCtx(cs.getCtx(run.sessionId));
-                if (stillRead.kind === "corrupt") {
-                    await withdrawWakeCard(wakeToken, cpScope, "resume_context_corrupt");
-                    mintResult.corruptCtxWhere = stillRead.where;
+                const stillRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing });
+                if (stillRead.kind === "corrupt" || stillRead.kind === "unsealable") {
+                    await withdrawWakeCard(wakeToken, cpScope, stillRead.kind === "corrupt" ? "resume_context_corrupt" : "resume_context_unsealable");
+                    if (stillRead.kind === "corrupt")
+                        mintResult.corruptCtxWhere = stillRead.where;
+                    else
+                        mintResult.unsealableCtx = stillRead;
                     return;
                 }
                 if (stillRead.kind !== "ok") {
@@ -681,6 +698,10 @@ export async function handleRuns(req, res, match, ctx) {
                 sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
                 return;
             }
+            if (mintResult.unsealableCtx !== undefined) {
+                sendError(res, 409, "conflict.checkpoint_ctx_unsealable", "run already ended and this session's stored resume context holds credentials this server cannot unseal (reason says why) — nothing was queued, because POST /v1/sessions/:id/wake could not resume it; restore the sealed-key directory that sealed them, restart this server (it reads its keys only at startup) and steer again, or submit a new task instead", { field: mintResult.unsealableCtx.field, reason: mintResult.unsealableCtx.reason });
+                return;
+            }
             if (mintResult.unservable !== undefined) {
                 deps.logger?.warn?.("steer_wake_park_refused_stored_body", { taskId, sessionId: run.sessionId, ...storedBodyReplayLogFields(mintResult.unservable) });
                 const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable, serviceVersion(), false);

package/dist/http/routes/session-sync.d.ts

@@ -34,8 +34,9 @@ export type PendingStaging = {
     declaredEntryIds: string[];
     /** The principal that opened this staging — a different caller may not drive it (404, no oracle). */
     openedBy: string | null;
-    /** Fleet-wide caller (ops on-behalf) — bypasses the openedBy identity check (like the route's owner gates). */
-    openedFleetWide: boolean;
+    /** The owner cell the gate judged when it opened this staging (`ownerOf` reading: `undefined` = no such session) — the commit lands only on
+     *  this same cell (`StagedCommitOptions.expectedOwner`, `session-sync-kernel.ts`); `owner` above (the re-stamped importing principal) is derived from it for a fleet caller. */
+    expectedOwner: string | null | undefined;
 };
 /** 单域独占状态 + 它的两个操作。每个 server 实例一份。 */
 export interface SessionSyncLocal {