@sema-agent/server 7.133.0 → 7.134.0

package/dist/http/routes/session-sync.js

@@ -5,10 +5,10 @@ import { StringDecoder } from "node:string_decoder";
 import { exportSessionManifest, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
 import * as facts from "../../capability-facts.js";
 import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
-import { isUuidShape } from "../../security.js";
+import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
-import { gatedPrincipal, explicitOperatorOk, sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
@@ -34,7 +34,7 @@ export function createSessionSyncLocal() {
 }
 export async function handleSessionSync(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, readRawBody, safeDecode, sessionOwnerScopeForWrite, rateLimited } = ctx.helpers;
+    const { readJson, readRawBody, safeDecode, rateLimited } = ctx.helpers;
     const { pendingStagings, importLeases, touchImportLease, cleanupStaging } = ctx.local.sessionSync;
     {
         {
@@ -44,7 +44,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 return;
             }
             const { backend, sessionStorage, historyStore } = sync;
-            const scope = sessionOwnerScopeForWrite(req);
+            const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -54,23 +54,25 @@ export async function handleSessionSync(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const gateFace = await sessionStorage.sessionFaceOf(sessionId);
+            const judgeSessionGate = async () => {
+                const face = await sessionStorage.sessionFaceOf(sessionId);
+                const mayTouch = face !== undefined && (scope.fleetWide || face.owner === scope.gateOwner || legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(sessionStorage, sessionId, face.owner)));
+                return { face, mayPull: mayTouch, mayPush: face === undefined || mayTouch };
+            };
+            const gate = await judgeSessionGate();
+            const gateFace = gate.face;
             const owner = gateFace === undefined ? undefined : gateFace.owner;
-            const ownsOrFleet = (o) => scope.fleetWide || o === scope.gateOwner;
+            const sendSessionAbsent = () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             const pullGateOk = () => {
-                if (owner === undefined) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                    return false;
-                }
-                if (!ownsOrFleet(owner)) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                if (!gate.mayPull) {
+                    sendSessionAbsent();
                     return false;
                 }
                 return true;
             };
             const pushGateOk = () => {
-                if (owner !== undefined && !ownsOrFleet(owner)) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                if (!gate.mayPush) {
+                    sendSessionAbsent();
                     return false;
                 }
                 return true;
@@ -93,7 +95,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     throw e;
                 }
                 if (out === null) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                    sendSessionAbsent();
                     return;
                 }
                 sendJson(res, 200, { manifest: out.manifest });
@@ -114,7 +116,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
                 if (it === null) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                    sendSessionAbsent();
                     return;
                 }
                 res.writeHead(200, { "content-type": "application/x-ndjson", "transfer-encoding": "chunked" });
@@ -387,7 +389,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 importLeases.set(sessionId, { at: Date.now(), stagingId });
                 pendingStagings.set(stagingId, {
                     handle, realSessionId: sessionId, owner: importingPrincipal, ...(resolution ? { resolution } : {}), operatorOk,
-                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: scope.gateOwner, openedFleetWide: scope.fleetWide,
+                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: scope.gateOwner, expectedOwner: owner,
                 });
                 sendJson(res, 200, { stagingId, relation: relA.relation });
                 return;
@@ -403,7 +405,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 404, "not_found.staging", "staging not found");
                     return;
                 }
-                if (!pending.openedFleetWide && !scope.fleetWide && pending.openedBy !== scope.gateOwner) {
+                if (!scope.fleetWide && pending.openedBy !== scope.gateOwner) {
                     sendError(res, 404, "not_found.staging", "staging not found");
                     return;
                 }
@@ -485,7 +487,23 @@ export async function handleSessionSync(req, res, match, ctx) {
                         return;
                     throw e;
                 }
-                const activeAtCommit = await deps.runStore?.getActiveTaskId(sessionId);
+                let mayPushAtCommit;
+                let activeAtCommit;
+                try {
+                    mayPushAtCommit = (await judgeSessionGate()).mayPush;
+                    activeAtCommit = mayPushAtCommit ? await deps.runStore?.getActiveTaskId(sessionId) : undefined;
+                }
+                catch (e) {
+                    await pending.handle.abort().catch(() => undefined);
+                    cleanupStaging(stagingId);
+                    throw e;
+                }
+                if (!mayPushAtCommit) {
+                    await pending.handle.abort().catch(() => undefined);
+                    cleanupStaging(stagingId);
+                    sendSessionAbsent();
+                    return;
+                }
                 if (activeAtCommit) {
                     await pending.handle.abort().catch(() => undefined);
                     cleanupStaging(stagingId);
@@ -493,7 +511,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     return;
                 }
                 try {
-                    const committed = await pending.handle.commit(pending.owner, pending.resolution ? { resolution: pending.resolution } : undefined);
+                    const committed = await pending.handle.commit(pending.owner, { expectedOwner: pending.expectedOwner, ...(pending.resolution ? { resolution: pending.resolution } : {}) });
                     if (pending.resolution === "overwrite-dst" && (committed.relation === "fork" || committed.relation === "stale")) {
                         await wipeSessionAttendants({ fileHistoryStore: historyStore, sessionPolicyStore: deps.sessionPolicyStore, resumeAnchorStore: deps.resumeAnchorStore }, sessionId);
                     }

package/dist/http/routes/sessions-list.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— 会话列表 / 发件链接列表。
  *
  * 路由:`GET /v1/sessions`(CC /resume picker,keyset 分页)、`GET /v1/sendfile-links`。
- * owner-scope 与 trace 列表同一权威模型(system/traceToken=fleet-wide,principal=钉住本人)。本域零可变状态。
+ * owner-scope 与 trace 列表同一权威模型(`fleetViewOf` 读档:service 凭据不报主体 / 只读 trace 凭据 / dev-open = fleet-wide;带验过的主体 = 钉住那位主体)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionListItem } from "../../security.js";

package/dist/http/routes/sessions-list.js

@@ -1,16 +1,15 @@
 import { isUuidV7, legacyUnownedAmnestyOpen } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
-import { sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
 import { sessionTempoOfRunStatus } from "../../plugins/store-contracts.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleSessionsList(req, res, match, ctx) {
     const { deps } = ctx;
-    const { isFleetWide, sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "sessions-list": {
-            const { fleetWide, gateOwner } = sessionOwnerScope(req);
+            const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
             if (!fleetWide && gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -26,7 +25,7 @@ export async function handleSessionsList(req, res, match, ctx) {
             return;
         }
         case "sendfile-links": {
-            const { fleetWide, gateOwner } = sessionOwnerScope(req);
+            const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
             if (!fleetWide && gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;

package/dist/http/routes/sessions.js

@@ -9,7 +9,7 @@ import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -71,7 +71,7 @@ async function readLastLegMcp(deps, sessionId, caller) {
 }
 export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, safeDecode, sessionOwnerOk, sessionOwnerScopeForWrite } = ctx.helpers;
+    const { readJson, safeDecode, sessionOwnerOk } = ctx.helpers;
     const readOwnedSessionView = async (sessionAudit, sessionId, readOpts) => {
         const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
         if (ownerOf !== undefined) {
@@ -699,7 +699,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const fork = forkFact.sessionStorage.fork.bind(forkFact.sessionStorage);
             const ownerOf = forkFact.sessionStorage.ownerOf.bind(forkFact.sessionStorage);
-            const scope = sessionOwnerScopeForWrite(req);
+            const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -737,7 +737,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const purge = deleteFact.purge;
             const ownerOf = deleteFact.sessionStorage.ownerOf.bind(deleteFact.sessionStorage);
-            const scope = sessionOwnerScopeForWrite(req);
+            const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;

package/dist/http/routes/tasks.js

@@ -21,7 +21,7 @@ import { replayOfExistingRun } from "../submit-replay.js";
 import { httpErrorCode, sendJson, sendError, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { approvalPreambleReplays, createApprovalCardEmitter, declaredApprovalFrameFamilies, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
 import { commitSessionInheritEnv } from "../session-inherit-env.js";
@@ -150,6 +150,18 @@ export async function handleTasks(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody, undefined, { liveStream });
         if (!prepared)
             return;
+        const declaredFamilies = declaredApprovalFrameFamilies(prepared.body.settings);
+        const approvalLegInput = (streamApprovalOn) => {
+            const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
+            return {
+                streamApprovalOn,
+                windowMs: deps.config.streamApproval?.windowMs,
+                windowMarginMs: deps.config.streamAskWindowMarginMs,
+                ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
+                declaredFamilies,
+            };
+        };
+        const assembleApprovalLeg = (streamApprovalOn) => resolveApprovalLeg({ ...approvalLegInput(streamApprovalOn), nowMonotonicMs: performance.now() });
         const principal = prepared.auth?.principal;
         const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
         let wiringReceipt;
@@ -215,9 +227,9 @@ export async function handleTasks(req, res, match, ctx) {
                 toolApprovalEnabled: Boolean(deps.toolApproval),
                 streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
-                parkFacility: deps.checkpointStore !== undefined,
+                checkpointStore: deps.checkpointStore,
             });
-            const replaySessionId = replayGate.active ? prepared.spec.sessionId : undefined;
+            const replaySessionId = approvalPreambleReplays(approvalLegInput(replayGate.active)) ? prepared.spec.sessionId : undefined;
             const presentedOnConnection = new Set();
             const presentedCompleted = new Set();
             const admitPresentedComplete = (askId) => {
@@ -663,18 +675,11 @@ export async function handleTasks(req, res, match, ctx) {
                         toolApprovalEnabled: Boolean(deps.toolApproval),
                         streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                         backend: deps.backend,
-                        parkFacility: deps.checkpointStore !== undefined,
+                        checkpointStore: deps.checkpointStore,
                     }).active;
-                    const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
-                    const approvalLeg = resolveApprovalLeg({
-                        streamApprovalOn,
-                        windowMs: deps.config.streamApproval?.windowMs,
-                        windowMarginMs: deps.config.streamAskWindowMarginMs,
-                        ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
-                        nowMonotonicMs: performance.now(),
-                    });
+                    const approvalLeg = assembleApprovalLeg(streamApprovalOn);
                     const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-                    const windowZero = approvalLeg.windowZero;
+                    const unattended = approvalLeg.unattended;
                     const emitCard = createApprovalCardEmitter({
                         ...(ledgerSink
                             ? {
@@ -696,7 +701,7 @@ export async function handleTasks(req, res, match, ctx) {
                         if (!res.writableEnded && !res.destroyed)
                             emitAsk(frame);
                     };
-                    const approvalCtx = deps.toolApproval && !windowZero
+                    const approvalCtx = deps.toolApproval && unattended === undefined
                         ? {
                             taskId: askTaskId,
                             owner: askOwner,
@@ -714,8 +719,8 @@ export async function handleTasks(req, res, match, ctx) {
                         : undefined;
                     if (deps.toolApproval) {
                         const toolApproval = deps.toolApproval;
-                        prepared.spec.onAsk = windowZero
-                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })
+                        prepared.spec.onAsk = unattended
+                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }, unattended)
                             : toolApproval.boundAsk({
                                 owner: askOwner,
                                 taskId: askTaskId,

package/dist/http/routes/trace-usage.js

@@ -6,16 +6,16 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
-import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 const TOOL_RESULT_LIMIT_CAP = 262_144;
 const TOOL_RESULT_OFFSET_CAP = 2_147_483_646;
 export async function handleTraceUsage(req, res, match, ctx) {
     const { deps } = ctx;
-    const { isFleetWide, safeDecode } = ctx.helpers;
+    const { safeDecode } = ctx.helpers;
     if (match.decl.id === "tasks-source-summary") {
-        if (!isFleetWide(req)) {
+        if (!fleetViewOf(req, deps, "read").fleetWide) {
             sendUnauthorized(res, "operator");
             return;
         }
@@ -35,8 +35,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
         match.decl.id === "task-trace-stream" ||
         match.decl.id === "task-trace-artifacts" ||
         match.decl.id === "task-tool-result") {
-        const fleetWide = isFleetWide(req);
-        const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
+        const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
         if (!fleetWide && gateOwner === null) {
             sendUnauthorized(res, "identity");
             return;
@@ -89,9 +88,8 @@ export async function handleTraceUsage(req, res, match, ctx) {
                 return;
             }
             const runStore = runs.runStore;
-            const fleetWide = isFleetWide(req);
-            const jwtOwner = fleetWide ? undefined : gatedPrincipal(req, deps.config);
-            if (!fleetWide && !jwtOwner) {
+            const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
+            if (!fleetWide && gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
             }
@@ -109,7 +107,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
                 sendError(res, 400, "request.query_invalid", "invalid from/to (ISO-8601 or epoch-ms; from < to)");
                 return;
             }
-            const owner = jwtOwner ?? (q.get("principal") ?? undefined);
+            const owner = gateOwner ?? (q.get("principal") ?? undefined);
             try {
                 const scan = await runStore.usageScan(from, to, owner !== undefined ? { owner } : undefined);
                 const base = { from: new Date(from).toISOString(), to: new Date(to).toISOString(), ...(scan.truncated ? { truncated: true } : {}) };

package/dist/http/run-declared-families.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 一条 run 的**持久化声明**读口(H5):它声明了哪些审批开卡帧族(`settings.approvalFrameFamilies`)。
+ *
+ * 声明随受理过的提交体落盘 —— 提交腿(`POST /v1/tasks` 两腿 / `POST /v1/runs` / A2A)在 run 认领之后把整份提交体写进续跑输入(`checkpoint_ctx`,会话键,
+ * `http/submit-ctx.ts` 的 `persistSubmitCtx`),所以**事后**才发生的读(耐久事件流的开流 preamble)读得到「这条 run 当初声明了什么」。读法只有一个:
+ * `declaredApprovalFrameFamilies`(S-1914 的唯一读者;缺席 / 形坏 ⇒ 空集),本模块不另判声明的合法性。
+ *
+ * 失效方向是**不重放**:续跑输入不在 / 体读不出 ⇒ 空集 ⇒ preamble 零帧(与「未声明」同形;空集 = 这条腿没有活审批通道)。店与会话 id 由类型保证在场:
+ * 唯一的调用方(`routes/runs.ts` 事件流 preamble)只在上场门为真时读 —— 上场门的 park 设施项就是「checkpoint 店在场」,run 行的会话 id 是必填串。
+ * 体读不出(店的拒绝契约)时报一次 `onUnreadable(where)`,让「为什么这条 run 的卡没被重放」在运维日志里有迹可循;店抖动 / 连接错按读口的刻意保守折成「不在」(`readResumeCtx` 头注)。
+ * 读的是 `KEEP_SEALED` 形:`approvalFrameFamilies` 不是凭据位,不为一个声明位开封任何凭据。
+ */
+import type { ApprovalFrameFamily } from "../tool-approval.js";
+import type { CheckpointStoreFull } from "../plugins/store-backend.js";
+export declare function readRunDeclaredFamilies(cs: Pick<CheckpointStoreFull, "getCtx">, sessionId: string, onUnreadable?: (where: string) => void): Promise<ReadonlySet<ApprovalFrameFamily>>;
+//# sourceMappingURL=run-declared-families.d.ts.map

package/dist/http/run-declared-families.js

@@ -0,0 +1,12 @@
+import { declaredApprovalFrameFamilies } from "../tool-approval.js";
+import { KEEP_SEALED, readResumeCtx } from "./resume-ctx-read.js";
+export async function readRunDeclaredFamilies(cs, sessionId, onUnreadable) {
+    const read = await readResumeCtx(cs.getCtx(sessionId), KEEP_SEALED);
+    if (read.kind === "corrupt")
+        onUnreadable?.(read.where);
+    if (read.kind !== "ok")
+        return new Set();
+    const body = read.ctx.body;
+    return declaredApprovalFrameFamilies(typeof body === "object" && body !== null ? Reflect.get(body, "settings") : undefined);
+}
+//# sourceMappingURL=run-declared-families.js.map

package/dist/http/server.d.ts

@@ -153,6 +153,12 @@ export interface ServiceStoreDeps {
     /** Durable-checkpoint store ([ref], core 1.67): durable F4 suspend/resume. When present, the resume
      *  endpoint + suspended-run surfacing are active. Set only when DURABLE_APPROVAL + a TiDB pool. */
     checkpointStore?: CheckpointStoreFull;
+    /** S-1907:停驻行凭据的**封签器**(`sealed-key.ts` `ensureCheckpointCtxSealing`,这一域自己的保管店 `<数据根>/sealed-key/checkpoint-ctx-keys/`;规则属主 = `checkpoint-ctx.ts` 末段
+     *  「凭据位密封」)。提交体里请求面凭据位上的值在 `checkpoint_ctx` 里只以封签存在:写 ctx 的每一笔经它封、续跑上下文读口经它开。
+     *  🔴 **与 `checkpointStore` 同在**:店在而它缺席 ⇒ `createHttpServer` 拒启(句子 = `CHECKPOINT_CTX_SEALING_REQUIRED`)—— 凭据只以封签落盘,
+     *  封不了就不落,没有「明文照写」的第二种装配。嵌入方:`checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir)`
+     *  (保管目录要跨重启持久、多副本各副本是同一份钥匙,否则封它的那把钥匙不在 ⇒ 409 `conflict.checkpoint_ctx_unsealable` `reason:"key_not_held"`)。 */
+    checkpointCtxSealing?: import("./checkpoint-ctx.js").CheckpointCtxSealing;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). Enables PUT/GET /v1/sessions/:id/policy
      *  when present; core reads the rules at prepare-time (subtract-only) via RunnerDeps.sessionPolicyStore (wired separately). */
     sessionPolicyStore?: ServiceSessionPolicyStore;

package/dist/http/server.js

@@ -21,6 +21,7 @@ import { sendError, sendHttpError, sendSessionError, logRequestError } from "./s
 import { createRequestGuards } from "./request-guards.js";
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
+import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
 import { retiredServiceDepsRefusal } from "./retired-service-deps.js";
 import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
 import { createResumeLegs } from "./resume-legs.js";
@@ -85,6 +86,8 @@ export function createHttpServer(rawDeps) {
         if (refusal !== undefined)
             throw new Error(`createHttpServer: ${refusal}`);
     }
+    if (deps.checkpointStore !== undefined && deps.checkpointCtxSealing === undefined)
+        throw new Error(`createHttpServer: ${CHECKPOINT_CTX_SEALING_REQUIRED}`);
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
     const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
@@ -140,9 +143,9 @@ export function createHttpServer(rawDeps) {
             }
         };
     }
-    const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
+    const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {

package/dist/http/submit-ctx.d.ts

@@ -1,11 +1,11 @@
 import type { RunStore } from "../plugins/store-backend.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
-import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { buildCheckpointCtx, type CheckpointCtxSealer, type SealedCheckpointCtx } from "./checkpoint-ctx.js";
 import { type RefusalBody } from "./refusal-body.js";
 /** 写不进的那一种可答复的结局(各腿把它交回自己的出口:同步 / durable 腿直接回,活流腿编码成终帧)。 */
 export interface SubmitCtxRefusal {
-    readonly status: 413;
+    readonly status: 413 | 409;
     readonly body: RefusalBody;
 }
 /**
@@ -14,10 +14,11 @@ export interface SubmitCtxRefusal {
  * 返回 `undefined` = 写进了,腿照常起跑。
  */
 export declare function persistSubmitCtx(store: {
-    putCtx(sessionId: string, ctx: object): Promise<void>;
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
 }, deps: {
     readonly logger?: Logger | undefined;
     readonly metrics?: Metrics | undefined;
+    readonly checkpointCtxSealing?: CheckpointCtxSealer | undefined;
 }, claim: {
     readonly runStore: RunStore;
     readonly taskId: string;

package/dist/http/submit-ctx.js

@@ -1,8 +1,18 @@
 import { StoreRowTooLargeError } from "../plugins/sql-errors.js";
 import { releaseClaimedRun } from "./claimed-run.js";
-import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { buildCheckpointCtx, CheckpointCtxUnsealableError } from "./checkpoint-ctx.js";
 import { refusalBody } from "./refusal-body.js";
 import { limitFactsUnmeasured } from "../limit-refusal.js";
+function unsealableRefusal(e) {
+    return {
+        status: 409,
+        body: refusalBody({
+            errorCode: "conflict.checkpoint_ctx_unsealable",
+            message: "this deployment cannot store this task's credentials (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, or http hook headers) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
+            facts: { field: e.field, reason: e.reason },
+        }),
+    };
+}
 function rowTooLargeRefusal(tooLarge) {
     switch (tooLarge.wall) {
         case "row":
@@ -19,18 +29,24 @@ function rowTooLargeRefusal(tooLarge) {
 }
 export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
     try {
-        await store.putCtx(sessionId, buildCheckpointCtx(fields));
+        await store.putCtx(sessionId, buildCheckpointCtx(fields, deps.checkpointCtxSealing, sessionId));
         return undefined;
     }
     catch (err) {
         const tooLarge = err instanceof StoreRowTooLargeError ? err : undefined;
+        const unsealable = err instanceof CheckpointCtxUnsealableError ? err : undefined;
+        const known = tooLarge ?? unsealable;
         if (claim !== undefined) {
-            const why = tooLarge !== undefined ? tooLarge.message : `the run's resume inputs could not be stored: ${err instanceof Error ? err.message : String(err)}`;
+            const why = known !== undefined ? known.message : `the run's resume inputs could not be stored: ${err instanceof Error ? err.message : String(err)}`;
             await releaseClaimedRun(claim.runStore, claim.taskId, why, (releaseErr, step) => {
                 deps.logger?.warn("submit_ctx_run_release_failed", { taskId: claim.taskId, sessionId, step, err: releaseErr instanceof Error ? releaseErr.message : String(releaseErr) });
                 deps.metrics?.inc("submit_ctx_run_release_failed_total", { step });
             });
         }
+        if (unsealable !== undefined) {
+            deps.logger?.warn("submit_ctx_unsealable", { sessionId, taskId: claim?.taskId, field: unsealable.field, reason: unsealable.reason });
+            return unsealableRefusal(unsealable);
+        }
         if (tooLarge === undefined)
             throw err;
         deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });

package/dist/http/wire-types.d.ts

@@ -402,10 +402,10 @@ export interface TaskRequestBody {
      *  记忆面暗的部署(引擎未接线 / 多租户)上 `memory` 整键本就缺席,本声明无处落也无事可关。
      *  Rides the persisted body onto resume legs(与 `memoryWrite` 同姿势)。
      *  ✅ **子代地板自 core 7.22.0 到货,本仓零接线**:core 的 `parentSpecSeatOf` 从**这条 run 自己的**
-     *  `spec.memory.enabled === false` 铸 `ParentSpecSeat.memoryOff`,`applyParentSpecSeat` 作**无条件
-     *  REMOVAL** 施加(改写成 `{ …子代自己的 scopes, enabled:false }`,永不删键)⇒ 父关 ⇒ 子代 / 孙代 /
+     *  `spec.memory.enabled === false` 铸座位的 `memory: { enabled: false }`(core 7.54.0 起是夹表座的一行;此前叫 `memoryOff`,已退役),
+     *  `applyParentSpecSeat` 按表**夹**到子代上(改写成 `{ …子代自己的 scopes, enabled:false }`,永不删键;子代的 `enabled:true` 抬不起)⇒ 父关 ⇒ 子代 / 孙代 /
      *  workflow 子 spec / 跨 run 唤醒与保留 resume 一律无记忆面。🚧 **tier-3 耐久复活不带**(core 已记残余)。
-     *  链路的机器锚:`test/memory-off-request.test.ts` ⑥ 段(亲读 core dist 的铸点与施加点)。 */
+     *  链路的机器锚:`test/memory-off-request.test.ts` ⑥ 段(经 core 包根 `parentSpecSeatOf` / `applyParentSpecSeat` 读铸与施)。 */
     memory?: "off";
     /** 142-S4 projectId 线程化([ref] §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个
@@ -572,6 +572,10 @@ export type DecideBinding = {
     boundInputHash?: string;
     /** [ref] edit: operator-corrected tool args, applied by core AFTER the binding check, on approve only. */
     updatedInput?: unknown;
+    /** core 7.54.0: the words the approving person wrote on the card ("and tell the agent what to do next"). The decide door admits
+     *  the key only on a person's `approve` (a `deny` or a policy decide with it is a 400 `request.field_conflict`), and the outcome
+     *  mints carry it verbatim when present — the engine owns what counts as written (blank = nothing) and judges it again pre-CAS. */
+    feedback?: string;
 };
 /** [ref]([ref]④→[ref] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
  *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task
 export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export type { TaskRequestBody } from "./http/wire-types.js";
+export { ensureCheckpointCtxSealing } from "./sealed-key.js";
+export type { CheckpointCtxSealing } from "./http/checkpoint-ctx.js";
 export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 export { createSideQueryLane, type KeyResolver, type SideQueryLane, type SideQueryLaneCtx } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";

package/dist/index.js

@@ -20,6 +20,7 @@ export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS } from "./bo
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
+export { ensureCheckpointCtxSealing } from "./sealed-key.js";
 export { createHttpServer, } from "./http/server.js";
 export { createSideQueryLane } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";

package/dist/leader/wire.d.ts

@@ -1,5 +1,6 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
 import type { Autonomy } from "../runtime-governance.js";
+import { type CheckpointCtxSealer } from "../http/checkpoint-ctx.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -7,6 +8,9 @@ import type { LeaderRequestBody } from "./endpoint.js";
 /** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
 export interface LeaderDurableSeat {
     readonly checkpointStore: CheckpointStoreFull;
+    /** S-1907:写 worker 续跑上下文的封口(`ServiceDeps.checkpointCtxSealing` 同一只;规则属主 `http/checkpoint-ctx.ts` 末段「凭据位密封」)。
+     *  worker 的续跑体只有入口词 + 子任务 objective、不带凭据位 ⇒ 实际不封任何值,但写 ctx 的每一笔都经同一只封口(没有不封的第二种写法)。 */
+    readonly ctxSealer: CheckpointCtxSealer | undefined;
     readonly requireApproval: string[];
     readonly deny?: string[];
     readonly ttlMs?: number;

package/dist/leader/wire.js

@@ -274,9 +274,10 @@ export function createLeaderRunner(cfg) {
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
             const durable = cfg.durable?.();
-            const resumeCtx = buildCheckpointCtx({ body: { ...entry, objective: sub.spec.objective }, unattendedLeg: true, writerVersion: serviceVersion() });
+            const resumeBody = { ...entry, objective: sub.spec.objective };
+            const storedResumeCtx = durable !== undefined ? buildCheckpointCtx({ body: resumeBody, unattendedLeg: true, writerVersion: serviceVersion() }, durable.ctxSealer, sessionId) : undefined;
             let durableSpec = {};
-            if (durable) {
+            if (durable && storedResumeCtx !== undefined) {
                 const d = durable;
                 durableSpec = {
                     toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval: d.requireApproval, ...(d.deny ? { deny: d.deny } : {}), ...(d.autoBudget ? { autoBudget: d.autoBudget } : {}), ...(d.neverAuto ? { neverAuto: d.neverAuto } : {}) })),
@@ -284,7 +285,7 @@ export function createLeaderRunner(cfg) {
                     durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },
                     onQuestion: QUESTION_AWAITS_RESUME,
                 };
-                await d.checkpointStore.putCtx(sessionId, resumeCtx).catch((e) => {
+                await d.checkpointStore.putCtx(sessionId, storedResumeCtx).catch((e) => {
                     cfg.logger?.warn?.("leader_putctx_failed", { workerId: sub.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                 });
             }
@@ -313,13 +314,13 @@ export function createLeaderRunner(cfg) {
             }
             const keepCtxWarm = (runner) => {
                 const d = durable;
-                if (!d)
+                if (!d || storedResumeCtx === undefined)
                     return runner;
                 const orig = runner.runTaskStream.bind(runner);
                 runner.runTaskStream = (spec, resume) => {
                     const stream = orig(spec, resume);
                     const iv = setInterval(() => {
-                        void d.checkpointStore.putCtx(sessionId, resumeCtx).catch(() => { });
+                        void d.checkpointStore.putCtx(sessionId, storedResumeCtx).catch(() => { });
                     }, 45_000);
                     iv.unref?.();
                     void stream.result().then(() => clearInterval(iv), () => clearInterval(iv));
@@ -359,7 +360,7 @@ export function createLeaderRunner(cfg) {
                         },
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, resumeCtx.body),
+                    spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, resumeBody),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -374,7 +375,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeCtx.body),
+                spec: withLeaderLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, resumeBody),
             };
         };
         const provisionIntegrationSandbox = async () => {