@sema-agent/server 7.134.0 → 7.136.0

package/dist/hosted-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-591 / S-564(车LT,7.95.0)→ S-671 / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
+ * [ref] / [ref](车LT,7.95.0)→ [ref] / B-10(车NB,7.99.0)—— **「这台部署是不是托管 / 多租」的单一铸点**。
  *
  * ## 为什么是一处
  *
@@ -11,14 +11,12 @@
  *    ⚠️ 这句话此前在本仓被抄成「`boot/resolve-spec.ts` 阶段④ 的 `partitions` 字面量」——`src/` 里**没有**
  *    那个字面量(全仓 `partitions` 的 src 命中全是注释;尺子:同目录 `config` 3721 命中)。手抄的**坐标**
  *    比手抄的值更难发现烂掉,[ref] 的第一排查点就是它;
- *  · 能力授予面的赦免挂在 **`requirePrincipal !== true`** 上 —— 但**三条面各有各的谓词,不是一只**
- *    (异源复核实测,别照「它们都一样」写):
- *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调),判据**只有**
- *       `requirePrincipal !== true` ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
- *     · `additionalDirectories` / `additionalReadDirectories` —— **只有** `cwdHonored`
- *       (= `provider === "host" ∧ requirePrincipal !== true`);
- *     · `settings.env` / `cwd` —— `cwdHonored ‖ deviceCwdHonored`,而
- *       **`deviceCwdHonored` 这一臂里没有 `requirePrincipal` 项**(`task-cwd.ts`:device 车道上那条路径落在
+ *  · 能力授予面的赦免挂在「单主」上 —— 但**三条面读的是部署形表(`deployment-shape.ts`)里三个不同的行**
+ *    (异源复核实测,别照「它们都一样」写;[ref] 起三行并排在一张表里,轴列即差异):
+ *     · `settings.hooks` —— `task-settings.ts` 的 `taskHooksHonored`(唯一属主;resolve-spec 装配 / 受理面 / 能力位三处同调)= 表行
+ *       `multiTenant` 的反面 ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
+ *     · `additionalDirectories` / `additionalReadDirectories` —— 表行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主 = 今天只有 host);
+ *     · `settings.env` / `cwd` —— 表行 `callerCwd`(读能力表 `callerCwd` 位:host 单主才开,**device 不读租户**:那条路径落在
  *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
  *
  * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
@@ -36,7 +34,7 @@
  * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
  * (`SEMA_WEB_ADMIN_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
  *
- * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
+ * 随两臂一起删掉的(按类删干净,规则集变小):[ref] 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
  * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
  * `run-local.ts` 为那两臂清 env 的清除口。
  *
@@ -85,7 +83,7 @@ export interface HostedPostureFacts {
     readonly evidence: readonly HostedEvidence[];
 }
 /**
- * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ `requirePrincipal === true`([ref] ①)。
+ * 判定位的**唯一**铸点(纯数据 ⇒ `build*`)。托管 ⇔ 部署形表行 `multiTenant`(= 运维声明 `REQUIRE_PRINCIPAL=true`,[ref] ①)。
  *
  * `evidence` 仍是数组(按词表顺序收**全部**命中):拒因逐字点它们,运维才知道改哪儿;词表是闭集,
  * 形状不随词数变。
@@ -99,7 +97,19 @@ export declare function hostedEvidenceNote(e: HostedEvidence): string;
 export type TaskWriteFaceInput = TaskHostPostureScope & Readonly<Pick<ServiceConfigFlat, "taskWriteFaceEscalation">>;
 /** 任务层宿主姿态声明被拒时的 wire 子码(附录 A 的 `request.` 族)。 */
 export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
-/** 射程判据读的键集(托管证据 + 车道)。 */
+/**
+ * **射程判据** —— 这台部署认不认「任务层替它声明的宿主姿态」?
+ *
+ * 两条腿读它,都是**真的开门**的声明 ⇒ 都响亮拒(同码 {@link HOST_POSTURE_REFUSED_CODE}、同状态 422):
+ *  · 腿② 写容纳面(bypassPermissions 开的写面)—— {@link taskWriteFaceRefusal};
+ *  · 腿④ [ref] host shell 继承整份用户环境(`inheritEnv:"all"`)—— {@link taskInheritEnvRefusal}。
+ * [ref] 前还有腿③(`approverPosture`,忽略 + 留声),随那个请求键一起退役。射程只铸在这一处,同族声明读同一只。
+ *
+ * 🔴 **device 车道不适用(clay 裁定③ 2026-09-22)**:device 车道上 host 闸防的那个跨租户宿主穿越**结构性不存在**
+ * (路径落在**发起者自己的设备**上,归属由 `device_session` 绑定行 + 准入链的 owner 谓词验过),叠加 clay [ref]
+ * 「device 零额外审批」⇒ 在那条车道上拿租户声明当判据就是**用错轴**。与 `settings.env` / `cwd` 两键在那条车道上的既有臂同源同形。
+ * [ref] 起射程判据 = 部署形表行 `taskHostPostureDeclarations`(device 车道 ∨ 单主;轴列 lane + principal);下面是它读的键集(托管证据 + 车道)。
+ */
 export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceConfigFlat, "remoteExec">>;
 /**
  * **腿②** —— 这条请求要掀开写围栏,这台部署给不给?返回拒因;`undefined` = 放行。
@@ -109,7 +119,7 @@ export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceCon
  * governance 的 `overrides.writeFace="roots"` 去压——实测 core 的 `tightenTaskSpec` 在
  * base `open` × override `roots` 上**静默**取 `roots`(该函数零回调形参 ⇒ 没有留痕通道)。
  *
- * 🔴 **射程(含 device 车道那条对位臂)在共用谓词 {@link hostPostureDeclarationsHonored} 上** ——
+ * 🔴 **射程(含 device 车道那条对位臂)在部署形表行 `taskHostPostureDeclarations` 上** ——
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;

package/dist/hosted-posture.js

@@ -1,9 +1,9 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
-import { deviceCwdHonored } from "./task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
-    if (c.requirePrincipal === true)
+    if (DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(c))
         evidence.push("require-principal");
     return { hosted: evidence.length > 0, evidence };
 }
@@ -17,11 +17,6 @@ function hostedBecause(facts) {
     return facts.evidence.map(hostedEvidenceNote).join("; ");
 }
 export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
-function hostPostureDeclarationsHonored(c) {
-    if (deviceCwdHonored(c))
-        return true;
-    return !buildHostedPosture(c).hosted;
-}
 export function taskWriteFaceRefusal(c) {
     switch (c.taskWriteFaceEscalation) {
         case "allow":
@@ -39,7 +34,7 @@ export function taskWriteFaceRefusal(c) {
                 `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
         }
     }
-    if (hostPostureDeclarationsHonored(c))
+    if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;
     const facts = buildHostedPosture(c);
     return (`permissionMode:"bypassPermissions" opens the WRITE containment face (the engine's bypassPermissions mode writes outside the write roots) — the run could write outside the task root. ` +
@@ -47,7 +42,7 @@ export function taskWriteFaceRefusal(c) {
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
 export function taskInheritEnvRefusal(c) {
-    if (hostPostureDeclarationsHonored(c))
+    if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;
     const facts = buildHostedPosture(c);
     return (`inheritEnv:"all" hands the model-driven host shell this machine's WHOLE environment (credential-shaped variables included — the host lane scrubs them by default). ` +

package/dist/http/admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * 提交准入(S-147 切片:`http/server.ts` 的 `prepareSpec` 与它的模块级校验词表逐字搬家,正文一字未改)。
+ * 提交准入([ref] 切片:`http/server.ts` 的 `prepareSpec` 与它的模块级校验词表逐字搬家,正文一字未改)。
  * 读体 → 验型 → 授权 → 建 spec 的**唯一**一条链;tasks / runs / A2A 三个提交面共用它(抄一份 = 抄一份会漂的 400)。
  * ctx 字段 3 只(`deps` / `readJson` / `runnerFor`),机器算(closure-free-vars)与手抄一致。
  */
@@ -59,7 +59,7 @@ export interface UserSkillsRefusal {
     readonly facts?: LimitFacts;
 }
 /**
- * core 7.41.0 #1303 —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
+ * core 7.41.0 [ref] —— 顶层技能带 `manifest` 的拒因句(单铸点)。出路只点本服务上**真存在**的旋钮:技能的两只清单
  * (`allowedTools` / `disallowedTools`)、圈工具 = deny 规则(请求 `settings.permissions.deny` / 运维 `APPROVAL_DENY`)或子代定义的
  * `agents[].allowTools`、圈写路径 = 会话规则 `allowDirs`(`PUT /v1/sessions/:id/policy`)。
  */

package/dist/http/admission.js

@@ -2,7 +2,7 @@ import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
@@ -10,8 +10,8 @@ import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
-import { buildHooksRefusal, parseHooksConfig, hooksMatcherIssue } from "../hooks/hook-runner.js";
-import { judgeRequestWebSearch } from "../plugins/web-search.js";
+import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
+import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
@@ -300,6 +300,21 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", refusal.message, { field: refusal.field, detail: refusal.detail });
                     return null;
                 }
+                {
+                    const hooksKeys = hooksKeyIssue(st.hooks, hooksParsed.config);
+                    if (hooksKeys) {
+                        sendError(res, 400, "request.body_shape", hooksKeys.message, { unknownKeys: hooksKeys.unknownKeys, unsupportedKeys: hooksKeys.unsupportedKeys });
+                        return null;
+                    }
+                }
+                {
+                    const hookUrl = hooksUrlCredentialIssue(hooksParsed.config);
+                    if (hookUrl !== undefined) {
+                        const refusal = buildHooksUrlCredentialRefusal(hookUrl);
+                        sendError(res, 400, "request.field_invalid", refusal.message, refusal.facts);
+                        return null;
+                    }
+                }
                 const toolMatcher = hooksMatcherIssue(hooksParsed.config, taskHooksHonored(deps.config) ? "regex" : "literal");
                 if (toolMatcher !== undefined) {
                     const refusal = buildHooksRefusal(toolMatcher);
@@ -308,9 +323,9 @@ export function createAdmission(ctx) {
                 }
             }
             {
-                const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
+                const webSearchVerdict = judgeFreshRequestWebSearch(st.webSearch);
                 if (webSearchVerdict.kind === "malformed") {
-                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue);
+                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue, webSearchVerdict.facts);
                     return null;
                 }
             }

package/dist/http/approval-sweeps.d.ts

@@ -1,5 +1,5 @@
 /**
- * 审批扫腿(S-147 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
+ * 审批扫腿([ref] 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
  * ①`denyExpiredApprovals`([ref] D-D,SLA 到期的 deny-sweep,main.ts 的 reaper 按拍调);
  * ②`redeemParkedAsk`([ref],live 回决腿的 PARKED 赎回席,装配层接进协调器的晚绑座)。
  * 两者都走 resume 家族的 `resumeCheckpoint`,所以它们的属主是「谁在无 HTTP 请求的情况下替人做决定」这件事,

package/dist/http/approval-sweeps.js

@@ -3,7 +3,8 @@ const errText = (e) => redactHead(e instanceof Error ? e.message : String(e), 20
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
 import { hostDecisionFacts } from "../host-decision.js";
-import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
+import {} from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS } from "../approval-content-kind.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { gatedPrincipal, hasServiceAuth } from "./principal-gate.js";
 import { costQuotaRefusalOf } from "./request-guards.js";

package/dist/http/checkpoint-ctx.d.ts

@@ -223,13 +223,17 @@ export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal,
  *    封签里装的是那个 JSON 值本身,开封逐字还原。字典位上的容器本身不是字典(串 / 数组 / `null` / 封签形对象)⇒ 整只容器当一个值封。
  *    于是落盘形里凭据位上**只有本封口铸的封签**,没有哪个值能「原样存下、续跑时被开成别的东西」(调用方送一只封签形对象 ⇒ 存的是再封一层,
  *    开出来还是那只对象 —— 与新提交腿看到的同一个值)。没有封签器而有值要封 ⇒ 抛 {@link CheckpointCtxUnsealableError}(`no_key_store`,调用方在写之前拒)。
- *  · **读法记号**(与本文件另两只记号同一条「写的人盖章」):封口铸出的每一份落盘形都带 `credentialSeal: CHECKPOINT_CTX_SEAL_ALG` —— 这一行的凭据位
- *    **全部**由本封口封过。没有记号的行是 7.134.0 之前的写者写下的:那时没有任何写者封值,所以它凭据位上的封签形对象只可能是调用方原样送来的,不是封签。
+ *  · **读法记号**(与本文件另两只记号同一条「写的人盖章」):封口铸出的每一份落盘形都带 `credentialSeal: CHECKPOINT_CTX_SEAL_ALG` 与
+ *    `credentialSlotGeneration`(= 这一行里**带值的**凭据位最新的那一代,最小 1)—— 这一行的凭据位全部由本封口封过,且它用到的位不比这一代新。
+ *    代数取「用到的」而不取「本版的」:不带新位值的行与上一代的写者写下的同形,回滚到上一代照读;代数比读者新 ⇒ 这一行**一定**带着读者不认识的位 ⇒ 读者整行拒。没有记号的行是 7.134.0 之前的写者写下的:
+ *    那时没有任何写者封值,所以它凭据位上的封签形对象只可能是调用方原样送来的,不是封签。代数缺席的带记号行是 7.134.0 的写者写下的 —— 它封的是第 1 代
+ *    (闭集每行的 `since`);某一位的 `since` 大于这一行封过的代数 ⇒ 那一位上的值不论长什么样都没被封过(一只恰好长成封签形的明文字典也是明文)。
  *    记号只在落盘形上(开口交出的开封形里没有它;写回再封时重新盖)。
  *  · **读**:一只开口 {@link openCheckpointCtx},唯一调用方 = 续跑上下文唯一读口 `resume-ctx-read.ts` 的 `readResumeCtx`(读出的 ctx 在任何消费者
- *    看到之前已开封)。行带当前记号:凭据位上封签 ⇒ 开(开不开 ⇒ 拒);带 `sealed` 键却不是本闭集的封签形(含将来的 `alg`)⇒ 拒 `unrecognized_seal`;
- *    其余任何值 ⇒ 拒 `plaintext`。行没有记号 ⇒ 凭据位上**任何**值(含封签形对象)⇒ 拒 `plaintext`(更早版本写下、M28 还没扫到);记号认不得(将来的格式)⇒
- *    凭据位上任何值 ⇒ 拒 `unrecognized_seal`。凭据位上没有值的行不论记号照常开。
+ *    看到之前已开封)。逐值判词 = {@link credentialValueReading}(开口与 M28 同一只):行带当前记号、这一位在它封过的那一代里:凭据位上封签 ⇒ 开(开不开 ⇒ 拒);
+ *    带 `sealed` 键却不是本闭集的封签形(含将来的 `alg`)⇒ 拒 `unrecognized_seal`;其余任何值 ⇒ 拒 `plaintext`。这一位比行封过的代数新 ⇒ 任何值 ⇒ 拒 `plaintext`。
+ *    行没有记号 ⇒ 凭据位上**任何**值(含封签形对象)⇒ 拒 `plaintext`(更早版本写下、M28 还没扫到);记号认不得(将来的格式)⇒
+ *    凭据位上任何值 ⇒ 拒 `unrecognized_seal`,凭据位上没有值的行不论记号照常开;代数认不得(比本版新 / 不是正整数)⇒ **整行**拒 `unrecognized_seal`(`field` = 记号位名),不看已知位上有没有值。
  *    **拒** = 读口第四态 `unsealable`(`field` = 哪一个凭据位,`reason` ∈ {@link CHECKPOINT_CTX_UNSEALABLE_REASONS}),各续跑入口答
  *    `409 conflict.checkpoint_ctx_unsealable`(`resume-ctx-read.ts` 的 `resumeCtxUnsealableAnswer`)。**没有**明文回落臂、**没有**静默丢键臂。
  *  · **装配**:`checkpointStore` 在场而封签器缺席 ⇒ 拒启({@link CHECKPOINT_CTX_SEALING_REQUIRED};`createHttpServer` 与起服第 6 段同一句)。
@@ -264,33 +268,68 @@ export interface CheckpointCtxSealing extends CheckpointCtxSealer, CheckpointCtx
 }
 /**
  * **凭据位闭集**(提交体里值为凭据的位置)。路径段 `*` = 那一格容器的**每一个成员**:数组的每一项、字典的每一个值(一只走法,不分容器种类 —— 字典成员的点名形
- * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据。
- * 入表判据(一条):请求面上**为承载凭据而设**的字段 —— 静态请求头(MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目)、
- * 交给子进程的 env(MCP stdio 传输、任务 shell 的 `settings.env`)、请求自带的搜索后端钥匙。http hook 的头与另两种静态头同判:契约包的条目形是
- * `headers: Record<string, string>`、受理面(`parseHooksConfig`)只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire ——
- * 头值可以就是字面的 `Authorization: Bearer …`。hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`,
- * 别的条目在那一段缺席、走法照常不往下走。**不入表**:命令行 / URL / 工具实参之类自由文本(不是凭据字段;它们里有没有秘密不是本层能判的)。
- * 加一位 = 加一行,读写两侧与一次性迁移 M28 共用 {@link mapCredentialSlots} 一只走法,自动覆盖。
+ * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据(不论是串、数组还是别的形,整只一个值)。
+ * 入表判据(一条):本服务替调用方**原样交出去**的配置值 —— **子进程的启动面**(命令行 `command` / `args` 与交给它的 env)、发往对端的**静态请求头**、
+ * 请求自带的**搜索后端钥匙**。值是不是秘密不是本层能判的,所以整格封、不判值形(`--token=…` / `-p …` 拆在两个元素里、shell 形的整行,都不靠认形)。
+ *  · 子进程两座:MCP stdio 传输(`command` / `args` / `env`)与 command hook 条目(`command` / `args`,插件选项 `plugin.options` 的每一个值就是 hook 子进程环境里的
+ *    `CLAUDE_PLUGIN_OPTION_<KEY>` —— `hooks/command-spawn.ts` 的 `hookPluginEnv`),外加任务 shell 的 `settings.env`。命令行与 env 同判:壳在投影前把 `${user_config.*}`
+ *    替成字面值(执行器不做这一替换),参照实现也把 sensitive 选项照样交进子进程,所以命令行里可以就是密钥。`args` 整只数组封成**一只**封签(不逐元素:逐元素判值形是第二只判官)。
+ *  · 静态头三座:MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目(契约包的条目形是 `headers: Record<string, string>`、受理面(`parseHooksConfig`)
+ *    只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire —— 头值可以就是字面的 `Authorization: Bearer …`)。
+ * hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`、只有 command 条目有 `command` / `args` / `plugin.options`,
+ * 别的条目在那一段缺席、走法照常不往下走。**不在本表、各归另一条规则**:值是 URL 的字段 —— 带凭据的 URL 在受理口就拒(凭据只许走头位;判官 = 契约包根的 `findUrlCredential`),
+ * 所以落盘的 URL 结构上不带凭据;交给模型的文本(目标 / 提示词 / 系统提示)—— 模型看得见的东西本来就进会话记录,封停驻档护不住它。
+ * 加一位 = 加一行,读写两侧与一次性迁移 M28 共用 {@link mapCredentialSlots} 一只走法:写侧与读侧立即覆盖;已落盘的行由 M28 补封 ——
+ * 新行的 `since` 取下一代:封口铸的落盘形盖「这一行里带值的位最新的那一代」(`credentialSlotGeneration`),读者据它判那一行用到、封过哪几位 —— 代数更早的行上新位的值一律是明文(记号本身不证明它封过新位)。
+ * M28 封的是「读口会答 `plaintext` 的每一个值」({@link credentialValueReading}),所以新加的一位上的明文在带记号的行里也被补封(只在 M28 的窗内;窗外加位要另起迁移)。
  */
 export declare const CHECKPOINT_CTX_CREDENTIAL_SLOTS: readonly [{
     readonly path: readonly ["mcpServers", "*", "transport", "headers"];
     readonly holds: "map";
+    readonly since: 1;
 }, {
     readonly path: readonly ["mcpServers", "*", "transport", "env"];
     readonly holds: "map";
+    readonly since: 1;
 }, {
     readonly path: readonly ["a2aPeers", "*", "headers"];
     readonly holds: "map";
+    readonly since: 1;
 }, {
     readonly path: readonly ["settings", "env"];
     readonly holds: "map";
+    readonly since: 1;
 }, {
     readonly path: readonly ["settings", "webSearch", "apiKey"];
     readonly holds: "value";
+    readonly since: 1;
 }, {
     readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "headers"];
     readonly holds: "map";
+    readonly since: 1;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"];
+    readonly holds: "map";
+    readonly since: 2;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "args"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "args"];
+    readonly holds: "value";
+    readonly since: 3;
 }];
+/** 本版闭集的代数 = 表里最大的 `since`(读者认得的最新一代)。落盘形的 `credentialSlotGeneration` 不大于它;大于它的行是更新的写者带着本版不认识的位写下的。 */
+export declare const CHECKPOINT_CTX_CREDENTIAL_GENERATION: number;
 /** 开不开 / 封不了的成因(闭集):`no_key_store` = 这台副本没有封签器(没有保管店);`key_not_held` = 封它的那把钥匙不在这台副本的保管店里
  *  (多副本不共享 `<数据根>/sealed-key/`,或保管目录被换过);`unopenable` = 钥匙在、开不开(密文坏 / 不是这一行封的 / 不是停驻行信封);
  *  `plaintext` = 凭据位上是明文(更早版本的写者);`unrecognized_seal` = 带 `sealed` 键却不是本闭集的封签形(含将来的 `alg`)。 */
@@ -312,6 +351,8 @@ export type StoredCheckpointCtx = Omit<CheckpointCtx, "body"> & {
         readonly [key: string]: unknown;
     };
     readonly credentialSeal?: typeof CHECKPOINT_CTX_SEAL_ALG;
+    /** 这一行的写者封过的闭集代数(读法记号的另一半;缺席 + 带 `credentialSeal` = 7.134.0 的写者 = 第 1 代)。 */
+    readonly credentialSlotGeneration?: number;
 };
 declare const sealedCheckpointCtxBrand: unique symbol;
 /**
@@ -323,7 +364,7 @@ export type SealedCheckpointCtx = StoredCheckpointCtx & {
     readonly [sealedCheckpointCtxBrand]: true;
 };
 /** 装配期拒启的那一句(`createHttpServer` 与起服第 6 段同调;一句、一个出口)。 */
-export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory \u2014 SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 /** 封签形的判官(恰三键、三值皆串、`alg` 是本闭集那一个词)。 */
 export declare function isSealedCheckpointValue(v: unknown): v is SealedCheckpointValue;
 /**
@@ -343,7 +384,7 @@ export type OpenedCheckpointCtx = {
 };
 /**
  * **开口**(读的一侧唯一的一只;唯一调用方 = 续跑上下文读口 `readResumeCtx`):落盘形 ⇒ 开封形。`opener` 缺席 = 这台副本没有保管店(体里有封签就
- * `no_key_store`;没有凭据的行照常开)。判词见本段头注。
+ * `no_key_store`;没有凭据的行照常开)。判词见本段头注与 {@link credentialValueReading}。
  */
 export declare function openCheckpointCtx(stored: StoredCheckpointCtx, opener: CheckpointCtxOpener | undefined, sessionId: string): OpenedCheckpointCtx;
 /**
@@ -354,9 +395,13 @@ export declare function openCheckpointCtx(stored: StoredCheckpointCtx, opener: C
 export declare function sealedCredentialFieldOf(stored: unknown): string | undefined;
 /**
  * 🔴 **一次性迁移 M28 的行改写**(窗与删法见 `plugins/one-time-migrations.ts` 登记表 M28;编排 = `checkpoint-ctx-seal-m28.ts`):一行存量 ctx
- * (持久化 JSON,不信型面)**没有读法记号**(= 7.134.0 之前的写者写下的)⇒ 凭据位上的**每一个值**(含调用方原样送来的封签形对象)用同一只封口封好、盖记号 ——
- * 与写侧 {@link sealCheckpointCtx} 同一条规则。带记号的行(本版写下的,或本条已改写过的)、记号认不得的行 ⇒ `undefined`(不写:第二跑零命中;认不得的留给读口拒);
- * 凭据位上没有值 ⇒ `undefined`(不写);体不是对象 ⇒ `undefined`(读口自己的形判接住)。其余位(另两只记号、写者版本、非凭据字段)原样。
+ * (持久化 JSON,不信型面)凭据位上**读口会答 `plaintext` 的每一个值**({@link credentialValueReading},与开口同一只判词)用同一只封口封好、盖记号 ——
+ * 与写侧 {@link sealCheckpointCtx} 同一条规则。两种存量行落在这一条里:
+ *  · 没有读法记号的行(7.134.0 之前的写者)—— 每一个值都是 `plaintext`(含调用方原样送来的封签形对象)⇒ 全封;
+ *  · 带当前记号、而某一位比行封过的代数新的行(7.134.0 的写者封第 1 代,没封第 2 代的 `plugin.options`)—— 那一位上的值不论长什么样都是明文 ⇒ 封
+ *    (恰好长成封签形的选项字典按字典容器整只封,开出来还是那只字典);行封过的那一代里的封签不动。改写后的行盖「带值的位最新的那一代」(与封口同一条)。
+ * 读口会答 `seal` / `unrecognized_seal` 的值不动(认不得的留给读口拒);一个值都没封 ⇒ `undefined`(不写:第二跑零命中;记号认不得的行因此一个字节不动);
+ * 体不是对象 ⇒ `undefined`(读口自己的形判接住)。其余位(另两只记号、写者版本、非凭据字段)原样。
  */
 export declare function sealStoredCheckpointCtxM28(stored: object, sealer: CheckpointCtxSealer, sessionId: string): {
     readonly ctx: SealedCheckpointCtx;

package/dist/http/checkpoint-ctx.js

@@ -125,13 +125,19 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
 }
 export const CHECKPOINT_CTX_SEAL_ALG = "checkpoint-ctx-sealedbox-v1";
 export const CHECKPOINT_CTX_CREDENTIAL_SLOTS = [
-    { path: ["mcpServers", "*", "transport", "headers"], holds: "map" },
-    { path: ["mcpServers", "*", "transport", "env"], holds: "map" },
-    { path: ["a2aPeers", "*", "headers"], holds: "map" },
-    { path: ["settings", "env"], holds: "map" },
-    { path: ["settings", "webSearch", "apiKey"], holds: "value" },
-    { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map" },
+    { path: ["mcpServers", "*", "transport", "headers"], holds: "map", since: 1 },
+    { path: ["mcpServers", "*", "transport", "env"], holds: "map", since: 1 },
+    { path: ["a2aPeers", "*", "headers"], holds: "map", since: 1 },
+    { path: ["settings", "env"], holds: "map", since: 1 },
+    { path: ["settings", "webSearch", "apiKey"], holds: "value", since: 1 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map", since: 1 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"], holds: "map", since: 2 },
+    { path: ["mcpServers", "*", "transport", "command"], holds: "value", since: 3 },
+    { path: ["mcpServers", "*", "transport", "args"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "command"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "args"], holds: "value", since: 3 },
 ];
+export const CHECKPOINT_CTX_CREDENTIAL_GENERATION = Math.max(...CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.since));
 export const CHECKPOINT_CTX_UNSEALABLE_REASONS = ["no_key_store", "key_not_held", "unopenable", "plaintext", "unrecognized_seal"];
 export class CheckpointCtxUnsealableError extends Error {
     field;
@@ -146,7 +152,7 @@ export class CheckpointCtxUnsealableError extends Error {
 function mintSealedCheckpointCtx(sealed) {
     return sealed;
 }
-export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory — SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 export function isSealedCheckpointValue(v) {
     if (!isRecord(v))
@@ -160,7 +166,7 @@ function defineOwn(target, key, value) {
 function mapCredentialSlots(body, visit) {
     let out = body;
     for (const slot of CHECKPOINT_CTX_CREDENTIAL_SLOTS)
-        out = mapAt(out, slot.path, 0, slot.holds, "", visit);
+        out = mapAt(out, slot.path, 0, slot.holds, "", (value, field) => visit(value, field, slot));
     return out;
 }
 function mapAt(node, path, i, holds, field, visit) {
@@ -213,42 +219,70 @@ function memberField(field, key) {
 }
 function sealBody(body, sealer, sessionId) {
     let valuesSealed = 0;
-    const sealed = mapCredentialSlots(body, (value, field) => {
+    let generation = 1;
+    const sealed = mapCredentialSlots(body, (value, field, slot) => {
         if (sealer === undefined)
             throw new CheckpointCtxUnsealableError(field, "no_key_store");
         valuesSealed += 1;
+        generation = Math.max(generation, slot.since);
         return sealer.seal(value, sessionId);
     });
-    return { body: sealed, valuesSealed };
+    return { body: sealed, valuesSealed, generation };
 }
 export function sealCheckpointCtx(ctx, sealer, sessionId) {
-    const { body } = sealBody(ctx.body, sealer, sessionId);
-    return mintSealedCheckpointCtx({ ...ctx, body: body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG });
+    const { body, generation } = sealBody(ctx.body, sealer, sessionId);
+    return mintSealedCheckpointCtx({ ...ctx, body: body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation });
+}
+const CREDENTIAL_GENERATION_FIELD = "credentialSlotGeneration";
+function credentialStampOf(stored) {
+    const stamp = stored.credentialSeal;
+    const raw = stored.credentialSlotGeneration;
+    const generation = raw === undefined ? 1 : Number.isInteger(raw) && raw >= 1 && raw <= CHECKPOINT_CTX_CREDENTIAL_GENERATION ? raw : undefined;
+    return { stamp, generation };
+}
+function credentialValueReading(row, slot, value) {
+    if (row.stamp === undefined)
+        return "plaintext";
+    if (row.stamp !== CHECKPOINT_CTX_SEAL_ALG || row.generation === undefined)
+        return "unrecognized_seal";
+    if (slot.since > row.generation)
+        return "plaintext";
+    if (isSealedCheckpointValue(value))
+        return "seal";
+    if (isRecord(value) && Object.hasOwn(value, "sealed"))
+        return "unrecognized_seal";
+    return "plaintext";
 }
 export function openCheckpointCtx(stored, opener, sessionId) {
-    const { credentialSeal, ...rest } = stored;
-    const stamp = credentialSeal;
+    const { credentialSeal: _stamp, credentialSlotGeneration: _generation, ...rest } = stored;
+    const row = credentialStampOf(stored);
+    if (row.stamp === CHECKPOINT_CTX_SEAL_ALG && row.generation === undefined)
+        return { kind: "unsealable", field: CREDENTIAL_GENERATION_FIELD, reason: "unrecognized_seal" };
     try {
-        const body = mapCredentialSlots(stored.body, (value, field) => {
-            if (stamp === undefined)
-                throw new CheckpointCtxUnsealableError(field, "plaintext");
-            if (stamp !== CHECKPOINT_CTX_SEAL_ALG)
-                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
-            if (isSealedCheckpointValue(value)) {
-                if (opener === undefined)
-                    throw new CheckpointCtxUnsealableError(field, "no_key_store");
-                if (!opener.holds(value.publicKeyId))
-                    throw new CheckpointCtxUnsealableError(field, "key_not_held");
-                try {
-                    return opener.open(value, sessionId);
+        const body = mapCredentialSlots(stored.body, (value, field, slot) => {
+            const reading = credentialValueReading(row, slot, value);
+            switch (reading) {
+                case "plaintext":
+                case "unrecognized_seal":
+                    throw new CheckpointCtxUnsealableError(field, reading);
+                case "seal": {
+                    const sealed = value;
+                    if (opener === undefined)
+                        throw new CheckpointCtxUnsealableError(field, "no_key_store");
+                    if (!opener.holds(sealed.publicKeyId))
+                        throw new CheckpointCtxUnsealableError(field, "key_not_held");
+                    try {
+                        return opener.open(sealed, sessionId);
+                    }
+                    catch {
+                        throw new CheckpointCtxUnsealableError(field, "unopenable");
+                    }
                 }
-                catch {
-                    throw new CheckpointCtxUnsealableError(field, "unopenable");
+                default: {
+                    const unreachable = reading;
+                    return unreachable;
                 }
             }
-            if (isRecord(value) && Object.hasOwn(value, "sealed"))
-                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
-            throw new CheckpointCtxUnsealableError(field, "plaintext");
         });
         return { kind: "ok", ctx: { ...rest, body: body } };
     }
@@ -270,12 +304,21 @@ export function sealedCredentialFieldOf(stored) {
     return first;
 }
 export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
-    if (stored.credentialSeal !== undefined)
-        return undefined;
+    const row = credentialStampOf(stored);
     const body = stored.body;
     if (!isRecord(body))
         return undefined;
-    const out = sealBody(body, sealer, sessionId);
-    return out.valuesSealed === 0 ? undefined : { ctx: mintSealedCheckpointCtx({ ...stored, body: out.body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG }), valuesSealed: out.valuesSealed };
+    let valuesSealed = 0;
+    let generation = 1;
+    const sealed = mapCredentialSlots(body, (value, _field, slot) => {
+        generation = Math.max(generation, slot.since);
+        if (credentialValueReading(row, slot, value) !== "plaintext")
+            return value;
+        valuesSealed += 1;
+        return sealer.seal(value, sessionId);
+    });
+    return valuesSealed === 0
+        ? undefined
+        : { ctx: mintSealedCheckpointCtx({ ...stored, body: sealed, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation }), valuesSealed };
 }
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/dispatch.d.ts

@@ -1,12 +1,12 @@
 /**
- * 请求流水线(S-147 切片:`http/server.ts` 的 `handle()` 与它的模块级词表搬家;S-146 再把「这是什么路由」
+ * 请求流水线([ref] 切片:`http/server.ts` 的 `handle()` 与它的模块级词表搬家;[ref] 再把「这是什么路由」
  * 整件事交给 `./route-table.ts`)。
  *
  * 住在这里的是**一条请求从进门到落地**的全过程,一件事一遍:admission 计数 / 附着登记 / CORS / /health /
  * /metrics / 鉴权桥 / 全局服务凭据门 / 无凭据写门 / drain 与 roster-pending 两道 503 / 破坏性会话写门 /
  * 两段分派 / 全局 404。
  *
- * 🔴 S-146 之后本文件**不再持有任何一份路由名单**:分派序、门侧、标签、三只门的判据全部读
+ * 🔴 [ref] 之后本文件**不再持有任何一份路由名单**:分派序、门侧、标签、三只门的判据全部读
  * `ROUTES` / `ROUTE_DECLARATIONS`(见 route-table.ts 头注)。三道门也不再「按行号插在 37 只 if 中间」——
  * 它们在门前段与门后段之间**恒定一处**执行,三段代码逐字未动,只是不再被域调用夹着。
  *
@@ -19,7 +19,7 @@ import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
 /**
- * 🔴 S-672(test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
+ * 🔴 [ref](test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。
  *
  * 病:这几族(trace-usage / workflows / fleet)排在全局门之前,理由只有一条 —— 只读 `TRACE_TOKEN` 单凭据的调用方

package/dist/http/dispatch.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { admitBridgeIdentity } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
@@ -212,15 +213,14 @@ export function createDispatch(ctx) {
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.webAdminJwtVerifier.verify(rawBearer);
-                if (v.ok) {
-                    setSsoPrincipal(req, v.identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    if (v.identity.scope)
-                        setSsoScope(req, v.identity.scope);
-                    if (v.identity.role)
-                        setSsoRole(req, v.identity.role);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
+                const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                if (identity) {
+                    setSsoPrincipal(req, identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
+                    setSsoScope(req, identity.scope);
+                    if (identity.role)
+                        setSsoRole(req, identity.role);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
         }

package/dist/http/durable-run-leg.js

@@ -12,6 +12,7 @@ import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmitCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
+import { headReadOf } from "../session-incarnation.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -59,10 +60,10 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     }
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     const anchorOwner = args.prepared.auth?.principal ?? null;
-    const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-    const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
+    const headOf = headReadOf(deps.sessionStorage);
+    const captureTurnAnchor = deps.resumeAnchorStore && headOf
         ? async (eventId) => {
-            const leaf = await getLeafId(sessionId);
+            const leaf = (await headOf(sessionId))?.leafId;
             if (leaf)
                 await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
         }