@sema-agent/server 7.135.0 → 7.136.0

package/dist/hooks/hook-runner.d.ts

@@ -1,11 +1,11 @@
 import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksDroppedPieceCode, type HooksRejection, type HooksRejectionCode } from "@sema-agent/settings-schema/hooks";
-import { type ConfigPath } from "@sema-agent/settings-schema";
+import { type ConfigPath, type UrlCredential } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import type { EngineDollar, ModRegistration } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookManagedUnrun, HookNoticeObservation } from "../fleet/fleet-bus.js";
 import { LIMIT_REASONS, type LimitMeasure } from "../limit-refusal.js";
-import { type UrlCredential, type UrlCredentialRefusal } from "../url-credential.js";
+import { type UrlCredentialRefusal } from "../url-credential-refusal.js";
 import { type HookGroupSource } from "./hook-source.js";
 import { type RunnableCommandHookEntry } from "./command-spawn.js";
 /** 服务侧防线上限(契约本身不设量纲;不设界=单请求可塞任意大配置/任意长命令)。超界=校验错(fail-loud)。 */
@@ -414,7 +414,7 @@ export interface HooksUrlCredentialIssue {
     readonly credential: UrlCredential;
 }
 /**
- * fresh 提交面专用判据([ref]):配置里第一条「url 带凭据」的 http 钩子 —— userinfo,或名字在日志脱敏器凭据名表里的 query / fragment 参数(判官 `url-credential.ts` 一只,
+ * fresh 提交面专用判据([ref]):配置里第一条「url 带凭据」的 http 钩子 —— userinfo,或名字在日志脱敏器凭据名表里的 query / fragment 参数(判官契约包根的 `findUrlCredential` 一只,
  * MCP `transport.url` · A2A 对端 · 搜索后端 `endpoint` · 包源六址同读);没有 ⇒ undefined。这一座有为凭据设的位(条目的 `headers`,停驻任务的续跑上下文里只以封签存在),
  * url 却照原样进停驻上下文、日志与读面 —— 凭据只许走前者(`$NAME` 引用 + `allowedEnvVars` 让配置本身不携带密钥值,见 USAGE 9.5c)。
  * 入参是 {@link parseHooksConfig} 已校验过的配置:**按配置序**(事件 → 组 → 条目)遇到的第一条定结局;只看 `type:"http"` 条目(别的条目型没有 `url`)。
@@ -425,7 +425,7 @@ export interface HooksUrlCredentialIssue {
 export declare function hooksUrlCredentialIssue(config: RunnableHooksConfig): HooksUrlCredentialIssue | undefined;
 /**
  * {@link hooksUrlCredentialIssue} 的判决 → 拒句 + 机读位。`field` 是这一条 `url` 在请求体里的全坐标(`settings.hooks.<事件>[g].hooks[h].url`,与封签位、本族别的 `field` 同一种写法),
- * 出路指到同一条的 `headers`。机读位的形与 MCP / A2A / 搜索后端三座同一只铸点(`url-credential.ts`),所以**不**走上面 {@link buildHooksRefusal} 的 `field:"settings.hooks"` + `detail` 形 ——
+ * 出路指到同一条的 `headers`。机读位的形与 MCP / A2A / 搜索后端三座同一只铸点(`url-credential-refusal.ts`),所以**不**走上面 {@link buildHooksRefusal} 的 `field:"settings.hooks"` + `detail` 形 ——
  * 那一形按 `detail.reason` 分形、属于配置读者与 matcher 判据;「URL 带凭据」是跨座位的一个事实,消费端按 `reason` 穷举读一次。
  */
 export declare function buildHooksUrlCredentialRefusal(issue: HooksUrlCredentialIssue): UrlCredentialRefusal;

package/dist/hooks/hook-runner.js

@@ -3,7 +3,7 @@ import { composeHostSubprocessEnv, hostSubprocessEnv } from "../server-secret-en
 import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild, killTreeSoft, killTreeHard } from "../plugins/host-platform.js";
 import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
-import { formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
+import { findUrlCredential, formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog } from "@sema-agent/core";
 import { hangClassic } from "./classic-stations.js";
@@ -17,7 +17,7 @@ import { canonicalJsonStringify } from "@sema-agent/core";
 import { ccPromptSystemFor, wrapCondition, parseCcVerdict, CC_EVALUATOR_MAX_OUTPUT_TOKENS } from "./cc-stop-prompt.js";
 import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
-import { buildRequestUrlCredentialRefusal, findUrlCredential, urlCredentialHeaderExit } from "../url-credential.js";
+import { buildRequestUrlCredentialRefusal, urlCredentialHeaderExit } from "../url-credential-refusal.js";
 import { HOOK_PHASES, HOOK_SOURCE_VOCABULARY_SENTENCE, hookPhaseOf, readHookGroupSource } from "./hook-source.js";
 import { commandLineChars, composeHookEnvLayer, hookPluginChars, planCommandSpawn, readHookArgs, readHookPlugin } from "./command-spawn.js";
 export const MAX_HOOK_ENTRIES_PER_EVENT = 32;

package/dist/http/checkpoint-ctx.d.ts

@@ -268,14 +268,17 @@ export interface CheckpointCtxSealing extends CheckpointCtxSealer, CheckpointCtx
 }
 /**
  * **凭据位闭集**(提交体里值为凭据的位置)。路径段 `*` = 那一格容器的**每一个成员**:数组的每一项、字典的每一个值(一只走法,不分容器种类 —— 字典成员的点名形
- * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据。
- * 入表判据(一条):请求面上**为承载凭据而设**的字段 —— 静态请求头(MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目)、
- * 交给子进程的 env(MCP stdio 传输、任务 shell 的 `settings.env`、command hook 条目的插件选项)、请求自带的搜索后端钥匙。http hook 的头与另两种静态头同判:契约包的条目形是
- * `headers: Record<string, string>`、受理面(`parseHooksConfig`)只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire ——
- * 头值可以就是字面的 `Authorization: Bearer …`。插件选项与 `settings.env` 同判:`plugin.options` 的每一个值就是 hook 子进程环境里的 `CLAUDE_PLUGIN_OPTION_<KEY>`
- * (`hooks/command-spawn.ts` 的 `hookPluginEnv`),参照实现也把 sensitive 选项照样交进这一族环境变量 —— 值是不是秘密不是本层能判的,所以整格封,不判值形。
- * hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`、只有带 `plugin` 的 command 条目有 `plugin.options`,
- * 别的条目在那一段缺席、走法照常不往下走。**不入表**:命令行 / URL / 工具实参之类自由文本(不是凭据字段;它们里有没有秘密不是本层能判的)。
+ * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据(不论是串、数组还是别的形,整只一个值)。
+ * 入表判据(一条):本服务替调用方**原样交出去**的配置值 —— **子进程的启动面**(命令行 `command` / `args` 与交给它的 env)、发往对端的**静态请求头**、
+ * 请求自带的**搜索后端钥匙**。值是不是秘密不是本层能判的,所以整格封、不判值形(`--token=…` / `-p …` 拆在两个元素里、shell 形的整行,都不靠认形)。
+ *  · 子进程两座:MCP stdio 传输(`command` / `args` / `env`)与 command hook 条目(`command` / `args`,插件选项 `plugin.options` 的每一个值就是 hook 子进程环境里的
+ *    `CLAUDE_PLUGIN_OPTION_<KEY>` —— `hooks/command-spawn.ts` 的 `hookPluginEnv`),外加任务 shell 的 `settings.env`。命令行与 env 同判:壳在投影前把 `${user_config.*}`
+ *    替成字面值(执行器不做这一替换),参照实现也把 sensitive 选项照样交进子进程,所以命令行里可以就是密钥。`args` 整只数组封成**一只**封签(不逐元素:逐元素判值形是第二只判官)。
+ *  · 静态头三座:MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目(契约包的条目形是 `headers: Record<string, string>`、受理面(`parseHooksConfig`)
+ *    只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire —— 头值可以就是字面的 `Authorization: Bearer …`)。
+ * hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`、只有 command 条目有 `command` / `args` / `plugin.options`,
+ * 别的条目在那一段缺席、走法照常不往下走。**不在本表、各归另一条规则**:值是 URL 的字段 —— 带凭据的 URL 在受理口就拒(凭据只许走头位;判官 = 契约包根的 `findUrlCredential`),
+ * 所以落盘的 URL 结构上不带凭据;交给模型的文本(目标 / 提示词 / 系统提示)—— 模型看得见的东西本来就进会话记录,封停驻档护不住它。
  * 加一位 = 加一行,读写两侧与一次性迁移 M28 共用 {@link mapCredentialSlots} 一只走法:写侧与读侧立即覆盖;已落盘的行由 M28 补封 ——
  * 新行的 `since` 取下一代:封口铸的落盘形盖「这一行里带值的位最新的那一代」(`credentialSlotGeneration`),读者据它判那一行用到、封过哪几位 —— 代数更早的行上新位的值一律是明文(记号本身不证明它封过新位)。
  * M28 封的是「读口会答 `plaintext` 的每一个值」({@link credentialValueReading}),所以新加的一位上的明文在带记号的行里也被补封(只在 M28 的窗内;窗外加位要另起迁移)。
@@ -308,6 +311,22 @@ export declare const CHECKPOINT_CTX_CREDENTIAL_SLOTS: readonly [{
     readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"];
     readonly holds: "map";
     readonly since: 2;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "args"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "args"];
+    readonly holds: "value";
+    readonly since: 3;
 }];
 /** 本版闭集的代数 = 表里最大的 `since`(读者认得的最新一代)。落盘形的 `credentialSlotGeneration` 不大于它;大于它的行是更新的写者带着本版不认识的位写下的。 */
 export declare const CHECKPOINT_CTX_CREDENTIAL_GENERATION: number;
@@ -345,7 +364,7 @@ export type SealedCheckpointCtx = StoredCheckpointCtx & {
     readonly [sealedCheckpointCtxBrand]: true;
 };
 /** 装配期拒启的那一句(`createHttpServer` 与起服第 6 段同调;一句、一个出口)。 */
-export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers, command hook plugin options) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory \u2014 SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 /** 封签形的判官(恰三键、三值皆串、`alg` 是本闭集那一个词)。 */
 export declare function isSealedCheckpointValue(v: unknown): v is SealedCheckpointValue;
 /**

package/dist/http/checkpoint-ctx.js

@@ -132,6 +132,10 @@ export const CHECKPOINT_CTX_CREDENTIAL_SLOTS = [
     { path: ["settings", "webSearch", "apiKey"], holds: "value", since: 1 },
     { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map", since: 1 },
     { path: ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"], holds: "map", since: 2 },
+    { path: ["mcpServers", "*", "transport", "command"], holds: "value", since: 3 },
+    { path: ["mcpServers", "*", "transport", "args"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "command"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "args"], holds: "value", since: 3 },
 ];
 export const CHECKPOINT_CTX_CREDENTIAL_GENERATION = Math.max(...CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.since));
 export const CHECKPOINT_CTX_UNSEALABLE_REASONS = ["no_key_store", "key_not_held", "unopenable", "plaintext", "unrecognized_seal"];
@@ -148,7 +152,7 @@ export class CheckpointCtxUnsealableError extends Error {
 function mintSealedCheckpointCtx(sealed) {
     return sealed;
 }
-export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers, command hook plugin options) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory — SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 export function isSealedCheckpointValue(v) {
     if (!isRecord(v))

package/dist/http/dispatch.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { admitBridgeIdentity } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
@@ -212,15 +213,14 @@ export function createDispatch(ctx) {
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.webAdminJwtVerifier.verify(rawBearer);
-                if (v.ok) {
-                    setSsoPrincipal(req, v.identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    if (v.identity.scope)
-                        setSsoScope(req, v.identity.scope);
-                    if (v.identity.role)
-                        setSsoRole(req, v.identity.role);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
+                const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                if (identity) {
+                    setSsoPrincipal(req, identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
+                    setSsoScope(req, identity.scope);
+                    if (identity.role)
+                        setSsoRole(req, identity.role);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
         }

package/dist/http/resume-ctx-read.d.ts

@@ -29,9 +29,8 @@
  * —— `key_not_held` 多半是多副本没共享保管目录,运维修好之后同一个决定原样重发即可),**不明文回落、不丢键**。
  * 开封要知道这一行的会话(封签绑会话)与开口(`ServiceDeps.checkpointCtxSealing`;缺席 = 本副本没有保管店):两件一起交({@link CheckpointCtxOpening})。
  *
- * **两种读法,一只读口**(第二个实参):① 开封形({@link CheckpointCtxOpening})—— 续跑重建 spec 的每一条腿;② {@link KEEP_SEALED}「信封原样留着」——
- * 只读**非凭据字段**的读者(今天 = inbox 的展示位 `objective`):不开封、不判凭据位(活凭据不为展示进内存),交回落盘形 `StoredCheckpointCtx`,
- * 结局里没有 `unsealable` 这一态(型面就没有;店边界的三态与开封形逐字同一段)。凭据位上的值在这种读法里仍是封签 —— 谁要用它们就必须走读法 ①。
+ * **一种读法**(第二个实参 = 开封的两件 {@link CheckpointCtxOpening}):读续跑上下文的只有续跑重建 spec 的那几条腿。7.136.0 起([ref])
+ * inbox 的展示位 `objective` 改读 run 行的目标预览,此前为它而设的第二种读法(「信封原样留着」,只读非凭据字段)随唯一的读者一起退役。
  */
 import type { CheckpointCtx } from "./route-ctx.js";
 import { type CheckpointCtxOpener, type CheckpointCtxUnsealableReason, type StoredCheckpointCtx } from "./checkpoint-ctx.js";
@@ -49,25 +48,12 @@ export type ResumeCtxRead = {
     readonly field: string;
     readonly reason: CheckpointCtxUnsealableReason;
 };
-/** 读法 ② 的结局:店边界的三态,`ok` 交落盘形(凭据位上仍是封签)。 */
-export type SealedResumeCtxRead = {
-    readonly kind: "ok";
-    readonly ctx: StoredCheckpointCtx;
-} | {
-    readonly kind: "absent";
-} | {
-    readonly kind: "corrupt";
-    readonly where: string;
-};
 /** 开封的两件:这一行的会话(= 交给店 `getCtx` 的那一个)与开口(缺席 = 本副本没有保管店)。 */
 export interface CheckpointCtxOpening {
     readonly sessionId: string;
     readonly opener: CheckpointCtxOpener | undefined;
 }
-/** 读法 ② 的词:信封原样留着(只读非凭据字段)。 */
-export declare const KEEP_SEALED = "keep_sealed";
 export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: CheckpointCtxOpening): Promise<ResumeCtxRead>;
-export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: typeof KEEP_SEALED): Promise<SealedResumeCtxRead>;
 /**
  * 开不开的对外答复([ref])—— 409 `conflict.checkpoint_ctx_unsealable`,机读 `field`(哪一个凭据位,提交体路径;键名不是秘密,值从不进来)+ `reason`
  * (闭集 `CHECKPOINT_CTX_UNSEALABLE_REASONS`)。句子说「这条任务的续跑上下文里带的凭据本服务开不开」、五种成因与出路(按 `reason` 修好保管目录后原样重发,

package/dist/http/resume-ctx-read.js

@@ -1,10 +1,9 @@
 import { openCheckpointCtx } from "./checkpoint-ctx.js";
 import { SqlJsonColumnError, StoreCorruptError } from "../plugins/sql-json-column.js";
 import { refusalBody } from "./refusal-body.js";
-export const KEEP_SEALED = "keep_sealed";
 export async function readResumeCtx(load, opening) {
     const read = await readStoredCtx(load);
-    if (read.kind !== "ok" || opening === KEEP_SEALED)
+    if (read.kind !== "ok")
         return read;
     const opened = openCheckpointCtx(read.ctx, opening.opener, opening.sessionId);
     return opened.kind === "ok" ? { kind: "ok", ctx: opened.ctx } : { kind: "unsealable", field: opened.field, reason: opened.reason };
@@ -28,7 +27,7 @@ export function resumeCtxUnsealableAnswer(read) {
         status: 409,
         body: refusalBody({
             errorCode: "conflict.checkpoint_ctx_unsealable",
-            message: "this task's stored resume context holds credentials from its request (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, http hook headers, or command hook plugin options) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+            message: "this task's stored resume context holds credentials from its request (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
             facts: {
                 field: read.field,
                 reason: read.reason,

package/dist/http/routes/approvals-assistant.d.ts

@@ -102,8 +102,6 @@ export type QuestionAnswerCheck = {
  * [ref] 起**同时闭键**:词表外的键(拼错 / 未来键 / `__proto__`)拒不丢。
  */
 export declare function checkQuestionAnswer(v: unknown): QuestionAnswerCheck;
-/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
- *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ApprovalsAssistantRouteId>, ctx: RouteCtx): Promise<void>;
 /**
  * 🔴 [ref]-2 / [ref]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**

package/dist/http/routes/approvals-assistant.js

@@ -1,6 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
+import { skillCardFacts } from "../../approval-card.js";
 import { hostDecisionFacts, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
+import { findParkedAgentForCheckpoint } from "../../parked-decide.js";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
@@ -24,8 +26,7 @@ import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answe
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { KEEP_SEALED, readResumeCtx } from "../resume-ctx-read.js";
-import { StoreCorruptError } from "../../plugins/sql-json-column.js";
+import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
@@ -260,6 +261,26 @@ async function decideIdempotentReplay(cs, args) {
         },
     };
 }
+async function gateObjectivePreview(reader, runStore, agentStore, gate) {
+    const previewOf = async (taskId) => readOwnedRun(reader.config, runStore, reader.principal, taskId, "owner_or_operator");
+    const own = (await runStore.getActiveTaskId(gate.sessionId)) ?? (await runStore.latestRunForSession(gate.sessionId))?.taskId;
+    if (own !== undefined)
+        return (await previewOf(own))?.objectivePreview ?? null;
+    if (agentStore === undefined)
+        return null;
+    let row = (await findParkedAgentForCheckpoint(agentStore, gate))?.row;
+    for (let hop = 0; row !== undefined && hop < MAX_DELEGATION_HOPS; hop++) {
+        const spawner = row.parentTaskId;
+        if (spawner === undefined)
+            return null;
+        const run = await previewOf(spawner);
+        if (run !== undefined)
+            return run.objectivePreview ?? null;
+        row = (await agentStore.get(spawner, row.scope)) ?? undefined;
+    }
+    return null;
+}
+const MAX_DELEGATION_HOPS = 8;
 export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
@@ -357,13 +378,18 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
+            const ledger = facts.durableRuns(deps);
+            const agentStore = deps.backgroundAgentStore;
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId), KEEP_SEALED);
-                if (ctxRead.kind === "corrupt")
-                    recordFailOpen("server.assistant-inbox.objective-ctx-corrupt", ctxRead.where);
-                const storedBody = ctxRead.kind === "ok" ? ctxRead.ctx.body : undefined;
-                const storedObjective = typeof storedBody === "object" && storedBody !== null ? storedBody.objective : undefined;
-                const objective = typeof storedObjective === "string" ? storedObjective : null;
+                let objective = null;
+                if (ledger.available) {
+                    try {
+                        objective = await gateObjectivePreview({ config: deps.config, principal }, ledger.runStore, agentStore, s);
+                    }
+                    catch (err) {
+                        recordFailOpen("server.assistant-inbox.objective-preview-unreadable", `run row read for the inbox row of session ${JSON.stringify(s.sessionId)} failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
@@ -380,9 +406,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
-                    ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
-                    ...(s.boundGrants !== undefined ? { boundGrants: s.boundGrants } : {}),
-                    ...(s.classifierNoRuling !== undefined ? { classifierNoRuling: s.classifierNoRuling } : {}),
+                    ...skillCardFacts(s),
                     ...(s.boundGrantAbsence !== undefined ? { boundGrantAbsence: s.boundGrantAbsence } : {}),
                     objective,
                     input,
@@ -871,7 +895,18 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
 }
 const APPROVALS_STREAM_POLL_MS = 3000;
 function approvalsReadFailureOf(err) {
-    return err instanceof StoreCorruptError ? "approvals.read_corrupt" : "approvals.read_unavailable";
+    const fault = storeFaultClassOf(err);
+    switch (fault) {
+        case "corrupt":
+            return "approvals.read_corrupt";
+        case "connection":
+        case "unclassified":
+            return "approvals.read_unavailable";
+        default: {
+            const unhandled = fault;
+            throw new Error(`store fault class without an approvals read answer: ${String(unhandled)}`);
+        }
+    }
 }
 function sendApprovalsReadFailure(req, res, logger, err) {
     logRequestError(logger, req, err);

package/dist/http/routes/runs.js

@@ -3,7 +3,7 @@ import { redactHead, redactLedgerEventForRead } from "../../observability/run-te
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
-import { askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
+import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -1345,7 +1345,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             askNotFound();
             return;
         }
-        const ownerOk = row0.owner === null || (principal !== undefined && row0.owner === principal);
+        const ownerOk = askOwnerAdmits(row0.owner, principal);
         const operatorOk = explicitOperatorOk(principal, deps.config);
         if (!ownerOk && !operatorOk) {
             askNotFound();

package/dist/http/routes/session-sync.js

@@ -8,6 +8,7 @@ import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
+import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
@@ -96,7 +97,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     out = await exportSessionManifest(sessionId, backend, historyStore);
                 }
                 catch (e) {
-                    if (sendSessionPolicyError(res, e) || sendFileHistoryUnreadable(res, e))
+                    if (sendSessionPolicyError(res, e) || sendPullUnreadable(req, res, deps.logger, e))
                         return;
                     throw e;
                 }
@@ -120,7 +121,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     }
                     afterSeq = n;
                 }
-                const it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                let it;
+                try {
+                    it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (it === null) {
                     sendSessionAbsent();
                     return;
@@ -167,7 +176,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     envelope = await exportedFileHistory(fs, sessionId);
                 }
                 catch (e) {
-                    if (sendFileHistoryUnreadable(res, e))
+                    if (sendPullUnreadable(req, res, deps.logger, e))
                         return;
                     throw e;
                 }
@@ -176,7 +185,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
                 }
-                const bytes = await fs.getBlob(hash);
+                let bytes;
+                try {
+                    bytes = await fs.getBlob(hash);
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (!bytes) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
@@ -569,12 +586,17 @@ export async function handleSessionSync(req, res, match, ctx) {
         }
     }
 }
-function sendFileHistoryUnreadable(res, e) {
-    if (!(e instanceof FileHistoryUnreadableError))
+function sendPullUnreadable(req, res, logger, e) {
+    if (e instanceof FileHistoryUnreadableError) {
+        const permanence = e.failure.permanence;
+        const advice = permanence === "transient" ? "the history store judged the fault transient: retry later" : permanence === "terminal" ? "the history store judged the fault permanent: retrying will not help until the store is repaired" : "the history store did not judge whether retrying can help";
+        sendError(res, 503, "state.file_history_unreadable", `this session's file history cannot be read whole (${e.failure.code}), so nothing was exported — ${advice}`, permanence === undefined ? undefined : { permanence });
+        return true;
+    }
+    if (storeFaultClassOf(e) !== "connection")
         return false;
-    const permanence = e.failure.permanence;
-    const advice = permanence === "transient" ? "the history store judged the fault transient: retry later" : permanence === "terminal" ? "the history store judged the fault permanent: retrying will not help until the store is repaired" : "the history store did not judge whether retrying can help";
-    sendError(res, 503, "state.file_history_unreadable", `this session's file history cannot be read whole (${e.failure.code}), so nothing was exported — ${advice}`, permanence === undefined ? undefined : { permanence });
+    logRequestError(logger, req, e);
+    sendError(res, 503, "state.file_history_unreadable", "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later", { permanence: "transient" });
     return true;
 }
 function sendMissingBlob(res) {

package/dist/http/routes/sessions.js

@@ -10,7 +10,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_EN
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
-import { headReadOf, sessionFaceOfHead } from "../../session-incarnation.js";
+import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
 import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -272,7 +272,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, head.owner)))
                 return;
-            const leafId = head.leafId;
+            const leafId = leafOfAdmittedHead(head);
             const etag = `"${leafId ?? "empty"}"`;
             if (req.headers["if-none-match"] === etag) {
                 res.writeHead(304, { etag }).end();
@@ -290,7 +290,8 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const readOwner = async (id) => (await evFact.sessionStorage.headOf(id))?.owner;
+            const readHead = (id) => evFact.sessionStorage.headOf(id);
+            const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -326,13 +327,13 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const cellP = readOwner(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
-                void cellP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
+                const admissionP = readHead(evSession).then(async (head) => (head === undefined ? undefined : { head, cell: await sessionOwnerCellOf(evFact.sessionStorage, evSession, head.owner) }));
+                void admissionP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
-                let cell;
+                let admission;
                 try {
-                    cell = await Promise.race([
-                        cellP,
+                    admission = await Promise.race([
+                        admissionP,
                         new Promise((r) => { stallTimer = setTimeout(() => r("__stall__"), stallBound); stallTimer.unref?.(); }),
                     ]);
                 }
@@ -342,22 +343,23 @@ export async function handleSessions(req, res, match, ctx) {
                 }
                 if (closed)
                     return;
-                if (cell === "__stall__") {
+                if (admission === "__stall__") {
                     cleanup();
                     res.setHeader("retry-after", "5");
                     sendError(res, 503, "state.sse_owner_lookup_stalled", "session-events owner lookup stalled — retry");
                     return;
                 }
-                if (cell === undefined) {
+                if (admission === undefined) {
                     cleanup();
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!sessionOwnerOk(req, res, cell)) {
+                if (!sessionOwnerOk(req, res, admission.cell)) {
                     cleanup();
                     return;
                 }
-                const owner = cell.owner;
+                leafOfAdmittedHead(admission.head);
+                const owner = admission.cell.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -656,13 +658,15 @@ export async function handleSessions(req, res, match, ctx) {
         }
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
-        const face = sessionFaceOfHead(sessionId, await store.headOf(sessionId));
-        if (face === undefined) {
+        const head = await store.headOf(sessionId);
+        if (head === undefined) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
         }
+        const face = sessionFaceOfHead(sessionId, head);
         if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(store, sessionId, face.owner)))
             return;
+        leafOfAdmittedHead(head);
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
             sendError(res, 400, read.problem.code, read.problem.message);

package/dist/http/submit-ctx.js

@@ -8,7 +8,7 @@ function unsealableRefusal(e) {
         status: 409,
         body: refusalBody({
             errorCode: "conflict.checkpoint_ctx_unsealable",
-            message: "this deployment cannot store this task's credentials (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, http hook headers, or command hook plugin options) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
+            message: "this deployment cannot store this task's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
             facts: { field: e.field, reason: e.reason },
         }),
     };

package/dist/http/wire-types.d.ts

@@ -541,12 +541,14 @@ export interface TaskRequestBody {
      *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`;发送随引擎座。 */
     mcpServers?: RequestMcpServerSpec[];
     /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
-     *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment that has neither locked the `a2a` key nor
-     *  had `a2a_peers` denied by its compliance posture (task-a2a.ts `a2aInjectionHonored`, the same three-veto
+     *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment (task-a2a.ts `a2aInjectionHonored`, the same
      *  predicate `capabilities.a2aInjection` advertises) — the requester is the super-admin of their OWN worker,
      *  on ANY execution lane (an A2A call is a plain outbound HTTPS request from the worker, so the lane where
      *  tool calls run is irrelevant); IGNORED on multi-tenant (a tenant can't point the shared worker at an
-     *  agent of their choosing). A locked deployment refuses the whole request instead: 400 `config.locked_key`.
+     *  agent of their choosing). A2A has no operator lock and no compliance capability today. A new submission
+     *  with a malformed list or entry is refused 400 (`assertRequestA2aEntries`: not an array / over the 32-entry
+     *  cap / an entry that is not an object / a key outside {@link A2A_PEER_ENTRY_KEYS} / a key whose value is
+     *  unusable / a url or cardUrl carrying a credential) — the same refusal shape as `mcpServers`, whatever the lane.
      *  🔴 Every skill a peer advertises mounts `egress:true` + `effect:"write"` (core's ruling) — declaring a
      *  peer is declaring an outbound WRITE channel, not a data source. Validated + gated downstream; the
      *  center/config baseline wins on a name clash (the peer name IS the tool namespace). */

package/dist/index.d.ts

@@ -34,4 +34,5 @@ export type { ModelRouteGap } from "./model-route-endpoint.js";
 export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRouteOptions, type ModelRouteEndpointVerdict } from "./model-route-endpoint.js";
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 export type { OrgDeliveryQuotaStore, OrgDeliveryQuotaPolicy } from "./plugins/org-delivery-quota-store.js";
+export { APPROVAL_GATE_KINDS, type ApprovalGateKind } from "./approval-content-kind.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -27,4 +27,5 @@ export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 export { judgeServedModelRoute } from "./model-route-endpoint.js";
+export { APPROVAL_GATE_KINDS } from "./approval-content-kind.js";
 //# sourceMappingURL=index.js.map