@sema-agent/server 7.135.0 → 7.137.0

package/dist/fleet-lease.js

@@ -1,5 +1,5 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
-import { CenterCredentialUnavailableError } from "./center-credential.js";
+import { CenterCredentialUnavailableError, createIdentityBins, pinAccountingIdentity } from "./center-credential.js";
 import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
@@ -23,8 +23,7 @@ const LEASE_HEALTH_BY_OUTCOME = {
 };
 export class FleetLeaseManager {
     opts;
-    state = new Map();
-    inflight = new Map();
+    binNow;
     f;
     now;
     failStreak = 0;
@@ -35,10 +34,19 @@ export class FleetLeaseManager {
         this.f = opts.fetchImpl ?? fetch;
         this.now = opts.now ?? Date.now;
         this.failMode = opts.failMode;
+        this.binNow = createIdentityBins(opts.center.credential, (pinned) => ({
+            state: new Map(),
+            inflight: new Map(),
+            center: { ...opts.center, credential: pinned },
+        })).accounting;
+    }
+    pinExecution() {
+        pinAccountingIdentity(this.opts.center.credential);
     }
     async admit(principal) {
+        const bin = this.binNow();
         const now = this.now();
-        const st = this.state.get(principal);
+        const st = bin.state.get(principal);
         if (st?.kind === "not-lease" && now < st.until)
             return { ok: true };
         if (st?.kind === "exhausted" && now < st.until) {
@@ -46,15 +54,15 @@ export class FleetLeaseManager {
         }
         if (st?.kind === "lease" && !leaseExhausted(st.lease, now)) {
             if (shouldRenewLease(st.lease, now))
-                void this.issueOrRenew(principal).catch(() => undefined);
+                void this.issueOrRenew(bin, principal).catch(() => undefined);
             return { ok: true };
         }
-        return this.issueOrRenew(principal);
+        return this.issueOrRenew(bin, principal);
     }
     recordSpend(principal, d) {
         if (!principal)
             return;
-        const st = this.state.get(principal);
+        const st = this.binNow().state.get(principal);
         if (st?.kind !== "lease")
             return;
         st.lease.consumed.weightedTokens += d.weightedTokens ?? 0;
@@ -62,7 +70,7 @@ export class FleetLeaseManager {
     }
     snapshot(principal, now) {
         const leaseHealth = LEASE_HEALTH_BY_OUTCOME[this.lastAdmit];
-        const st = principal === undefined ? undefined : this.state.get(principal);
+        const st = principal === undefined ? undefined : this.binNow().state.get(principal);
         if (st === undefined)
             return { leaseHealth, caller: { lease: "unobserved" } };
         switch (st.kind) {
@@ -97,25 +105,25 @@ export class FleetLeaseManager {
             }
         }
     }
-    set(principal, st) {
-        if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
-            const oldest = this.state.keys().next().value;
-            this.state.delete(oldest);
+    set(bin, principal, st) {
+        if (!bin.state.has(principal) && bin.state.size >= LEASE_PRINCIPAL_CAP) {
+            const oldest = bin.state.keys().next().value;
+            bin.state.delete(oldest);
         }
-        this.state.delete(principal);
-        this.state.set(principal, st);
+        bin.state.delete(principal);
+        bin.state.set(principal, st);
     }
-    issueOrRenew(principal) {
-        const existing = this.inflight.get(principal);
+    issueOrRenew(bin, principal) {
+        const existing = bin.inflight.get(principal);
         if (existing)
             return existing;
-        const p = this.issueOrRenewInner(principal).finally(() => this.inflight.delete(principal));
-        this.inflight.set(principal, p);
+        const p = this.issueOrRenewInner(bin, principal).finally(() => bin.inflight.delete(principal));
+        bin.inflight.set(principal, p);
         return p;
     }
-    async issueOrRenewInner(principal) {
+    async issueOrRenewInner(bin, principal) {
         try {
-            const { res } = await centerFetch(this.opts.center, { kind: "fleet-leases" }, {
+            const { res } = await centerFetch(bin.center, { kind: "fleet-leases" }, {
                 method: "POST",
                 json: { principal, worker: this.opts.center.worker },
                 timeoutMs: LEASE_FETCH_TIMEOUT_MS,
@@ -124,7 +132,7 @@ export class FleetLeaseManager {
             if (res.status === 200) {
                 const body = (await res.json());
                 const lease = QuotaLease.parse(body.lease);
-                this.set(principal, { kind: "lease", lease });
+                this.set(bin, principal, { kind: "lease", lease });
                 if (this.failStreak > 0)
                     this.opts.logger?.info?.("fleet_lease_recovered", { after: this.failStreak });
                 this.failStreak = 0;
@@ -145,11 +153,11 @@ export class FleetLeaseManager {
                         ...(body.pool !== undefined ? { pool: body.pool } : {}),
                     };
                     const hasDetail = Object.keys(detail).length > 0;
-                    this.set(principal, { kind: "exhausted", until, ...(hasDetail ? { detail } : {}) });
+                    this.set(bin, principal, { kind: "exhausted", until, ...(hasDetail ? { detail } : {}) });
                     this.opts.metrics?.inc("fleet_lease_exhausted_total");
                     return { ok: false, reason: "budget_exhausted", retryAfterSec: Math.ceil(EXHAUSTED_RETRY_MS / 1000), ...(hasDetail ? { detail } : {}) };
                 }
-                this.set(principal, { kind: "not-lease", until: this.now() + NOT_LEASE_TTL_MS });
+                this.set(bin, principal, { kind: "not-lease", until: this.now() + NOT_LEASE_TTL_MS });
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {

package/dist/hooks/classic-stations.d.ts

@@ -2,8 +2,8 @@
  * 引擎的 `classic.*` 站 —— 本仓挂 handler 的唯一入口(core 7.52.0 起扩展点 = mods 注册,`Hooks` 记录退役)。
  *
  * 三件事只写在这里:
- *  ① **事件名 → { `e` 型, 答案型 }**:core 逐个导出了每站的 `e` 型与答案型,但没有导出二者的映射(宿主侧配对是今天的唯一读法)。
- *     这张对位表是那一配对的唯一一份;core 导出映射型的那一版,本表改读它、删掉手写的十一行。
+ *  ① **事件名 → { `e` 型, 答案型 }**:读 core 的 `ClassicEventMap`(7.56.0 起包根导出;此前本文件手写十一行配对,随之删)。
+ *     每站的角色(链 / 观察)由 {@link CLASSIC_STATION_ROLE} 说,它在编译期对着 core 的答案形核:答案形是 `ObservedAnswer` 的站必须是 `observe`、其余是 `chain`。
  *  ② **handler 怎么挂**:链成员「无意见 ⇒ `next(e)`」(链 handler 返回 `undefined` 是站点违约,refuse 站上即 fail-closed 拒),
  *     观察者「恒返回 `undefined`」(观察者的判词不采纳、被引擎报告)。两条都在 {@link hangClassic} / {@link observeClassic} 里成形,
  *     调用方只写「这一站我答什么」或「这一站我看什么」,不再各自记得这两条。
@@ -13,55 +13,9 @@
  * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
  * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
  */
-import type { EngineDollar, On, PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "@sema-agent/core";
-/** 每一站的 `e` 型与答案型(答案 `void` = 观察站)。 */
-export interface ClassicStationTypes {
-    "classic.PreToolUse": {
-        e: PreToolUseEvent;
-        answer: PreToolUseResult;
-    };
-    "classic.PostToolUse": {
-        e: PostToolUseEvent;
-        answer: PostToolUseResult;
-    };
-    "classic.PostToolUseFailure": {
-        e: PostToolUseFailureEvent;
-        answer: PostToolUseFailureResult;
-    };
-    "classic.PostToolBatch": {
-        e: PostToolBatchEvent;
-        answer: PostToolBatchResult;
-    };
-    "classic.UserPromptSubmit": {
-        e: UserPromptSubmitEvent;
-        answer: UserPromptSubmitResult;
-    };
-    "classic.Stop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.SubagentStop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.StopFailure": {
-        e: StopFailureEvent;
-        answer: void;
-    };
-    "classic.PreCompact": {
-        e: PreCompactEvent;
-        answer: PreCompactResult;
-    };
-    "classic.PostCompact": {
-        e: PostCompactEvent;
-        answer: void;
-    };
-    "classic.PermissionDenied": {
-        e: PermissionDeniedPayload;
-        answer: void;
-    };
-}
-export type ClassicStation = keyof ClassicStationTypes;
+import type { ClassicEventMap, ClassicEventName, EngineDollar, On } from "@sema-agent/core";
+/** 引擎有站的 `classic.*` 名(core 的 `ClassicEventMap` 键集)。 */
+export type ClassicStation = ClassicEventName;
 /** 每一站能挂什么:`chain` = 链成员(会作答)与观察者都可;`observe` = 只许观察者。 */
 export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PreToolUse": "chain";
@@ -76,16 +30,19 @@ export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PostCompact": "observe";
     readonly "classic.PermissionDenied": "observe";
 };
+/** 本仓 handler 体对一站作的答:观察站不作答(`void`);链站 = core 的答案形,去掉本仓从不作的 `null` / `false`(PreToolUse 的两个「不表态」词)。 */
+type StationAnswer<K extends ClassicStation> = (typeof CLASSIC_STATION_ROLE)[K] extends "observe" ? void : Exclude<ClassicEventMap[K]["answer"], null | false>;
 /**
  * 一站的 handler 体:读 `e`,答这一站的答案;`undefined` = 无意见(链成员由 {@link hangClassic} 交给 `next(e)`)。
  * `signal` = 引擎交给这只 handler 的 `next.signal`(预算到 ∪ 派发被取消;见头注 ③)。
  */
-export type ClassicAnswer<K extends ClassicStation> = (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => Promise<ClassicStationTypes[K]["answer"] | undefined>;
+export type ClassicAnswer<K extends ClassicStation> = (e: ClassicEventMap[K]["e"], signal: AbortSignal) => Promise<StationAnswer<K> | undefined>;
 /**
  * 按站的角色挂一只 handler:链站 ⇒ 链成员 `(await answer(e)) ?? next(e)`;观察站 ⇒ 观察者(体照跑、恒返回 `undefined`)。
- * `e` 的型由 {@link ClassicStationTypes} 给(引擎交来的是本站的 `e`;配对见头注 ①)。
+ * `e` 的型由 core 的 `ClassicEventMap` 给(引擎交来的是本站的 `e`;见头注 ①)。
  */
 export declare function hangClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, answer: ClassicAnswer<K>): void;
 /** 挂一只观察者(任何站都可):拿分离副本、不进链、恒返回 `undefined`;`signal` 同 {@link ClassicAnswer}。 */
-export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicEventMap[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export {};
 //# sourceMappingURL=classic-stations.d.ts.map

package/dist/hooks/hook-llm.js

@@ -2,6 +2,7 @@ import { admitRouteRequest, BrainError, joinRequestUrl, resolveRouteCredential,
 import { matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { anthropicLaneCredentialOf } from "../model-route-gap.js";
 import { anthropicRouteRoot, brainLaneFor, routeTableOf } from "../model-provider.js";
 import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
@@ -33,6 +34,16 @@ function gateRefusal(pick, e, declaredRoot) {
         error: `hook model "${pick.catalogRef}" cannot be routed (${code}) — ` + buildDisplaySafeRefusal(text, [pick.baseUrl, declaredRoot ?? ""]),
     };
 }
+function routeCredentialHeader(credential) {
+    if (credential === undefined)
+        return {};
+    switch (credential.kind) {
+        case "x-api-key":
+            return { "x-api-key": credential.value };
+        case "bearer":
+            return { authorization: `Bearer ${credential.value}` };
+    }
+}
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
     const anthropicRouteBaseUrl = () => anthropicRouteRoot(config.anthropic ?? {});
@@ -122,9 +133,10 @@ export function createHookLlm(deps) {
             let admitted;
             let declaredRoot;
             if (pick.api === "anthropic-messages") {
+                const routeCredential = anthropicLaneCredentialOf(config.anthropic ?? {});
                 const routeBase = anthropicRouteBaseUrl();
                 declaredRoot = routeBase;
-                const routed = judgeRoute(pick, perModelKey, config.anthropic?.authToken ?? config.anthropic?.apiKey, routeBase);
+                const routed = judgeRoute(pick, perModelKey, routeCredential?.value, routeBase);
                 if (!routed.ok)
                     return routed;
                 admitted = routed.admission;
@@ -132,13 +144,7 @@ export function createHookLlm(deps) {
                 headers = {
                     "content-type": "application/json",
                     "anthropic-version": config.anthropic?.version ?? "2023-06-01",
-                    ...(routed.credential.source === "per-model"
-                        ? { "x-api-key": routed.credential.apiKey ?? "" }
-                        : config.anthropic?.authToken
-                            ? { authorization: `Bearer ${config.anthropic.authToken}` }
-                            : config.anthropic?.apiKey
-                                ? { "x-api-key": config.anthropic.apiKey }
-                                : {}),
+                    ...(routed.credential.source === "per-model" ? { "x-api-key": routed.credential.apiKey ?? "" } : routeCredentialHeader(routeCredential)),
                 };
                 const want = maxOutputTokens ?? 1024;
                 const maxTokens = Math.min(config.models[pick.catalogRef]?.maxTokens ?? want, want);

package/dist/hooks/hook-runner.d.ts

@@ -1,11 +1,11 @@
 import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksDroppedPieceCode, type HooksRejection, type HooksRejectionCode } from "@sema-agent/settings-schema/hooks";
-import { type ConfigPath } from "@sema-agent/settings-schema";
+import { type ConfigPath, type UrlCredential } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import type { EngineDollar, ModRegistration } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookManagedUnrun, HookNoticeObservation } from "../fleet/fleet-bus.js";
 import { LIMIT_REASONS, type LimitMeasure } from "../limit-refusal.js";
-import { type UrlCredential, type UrlCredentialRefusal } from "../url-credential.js";
+import { type UrlCredentialRefusal } from "../url-credential-refusal.js";
 import { type HookGroupSource } from "./hook-source.js";
 import { type RunnableCommandHookEntry } from "./command-spawn.js";
 /** 服务侧防线上限(契约本身不设量纲;不设界=单请求可塞任意大配置/任意长命令)。超界=校验错(fail-loud)。 */
@@ -414,7 +414,7 @@ export interface HooksUrlCredentialIssue {
     readonly credential: UrlCredential;
 }
 /**
- * fresh 提交面专用判据([ref]):配置里第一条「url 带凭据」的 http 钩子 —— userinfo,或名字在日志脱敏器凭据名表里的 query / fragment 参数(判官 `url-credential.ts` 一只,
+ * fresh 提交面专用判据([ref]):配置里第一条「url 带凭据」的 http 钩子 —— userinfo,或名字在日志脱敏器凭据名表里的 query / fragment 参数(判官契约包根的 `findUrlCredential` 一只,
  * MCP `transport.url` · A2A 对端 · 搜索后端 `endpoint` · 包源六址同读);没有 ⇒ undefined。这一座有为凭据设的位(条目的 `headers`,停驻任务的续跑上下文里只以封签存在),
  * url 却照原样进停驻上下文、日志与读面 —— 凭据只许走前者(`$NAME` 引用 + `allowedEnvVars` 让配置本身不携带密钥值,见 USAGE 9.5c)。
  * 入参是 {@link parseHooksConfig} 已校验过的配置:**按配置序**(事件 → 组 → 条目)遇到的第一条定结局;只看 `type:"http"` 条目(别的条目型没有 `url`)。
@@ -425,7 +425,7 @@ export interface HooksUrlCredentialIssue {
 export declare function hooksUrlCredentialIssue(config: RunnableHooksConfig): HooksUrlCredentialIssue | undefined;
 /**
  * {@link hooksUrlCredentialIssue} 的判决 → 拒句 + 机读位。`field` 是这一条 `url` 在请求体里的全坐标(`settings.hooks.<事件>[g].hooks[h].url`,与封签位、本族别的 `field` 同一种写法),
- * 出路指到同一条的 `headers`。机读位的形与 MCP / A2A / 搜索后端三座同一只铸点(`url-credential.ts`),所以**不**走上面 {@link buildHooksRefusal} 的 `field:"settings.hooks"` + `detail` 形 ——
+ * 出路指到同一条的 `headers`。机读位的形与 MCP / A2A / 搜索后端三座同一只铸点(`url-credential-refusal.ts`),所以**不**走上面 {@link buildHooksRefusal} 的 `field:"settings.hooks"` + `detail` 形 ——
  * 那一形按 `detail.reason` 分形、属于配置读者与 matcher 判据;「URL 带凭据」是跨座位的一个事实,消费端按 `reason` 穷举读一次。
  */
 export declare function buildHooksUrlCredentialRefusal(issue: HooksUrlCredentialIssue): UrlCredentialRefusal;

package/dist/hooks/hook-runner.js

@@ -3,7 +3,7 @@ import { composeHostSubprocessEnv, hostSubprocessEnv } from "../server-secret-en
 import vm from "node:vm";
 import { hostShell, resolveHostShell, adoptHostForegroundChild, killTreeSoft, killTreeHard } from "../plugins/host-platform.js";
 import { classifyHooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_ENTRY_TYPES, HOOK_EVENTS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, hookMatcherForm, hookMatcherSelects, interpolateHookEnvVars, } from "@sema-agent/settings-schema/hooks";
-import { formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
+import { findUrlCredential, formatConfigPath, outgoingPath } from "@sema-agent/settings-schema";
 import { ENGINE_OWNED_HOOK_EVENTS } from "@sema-agent/settings-schema/hooks";
 import { describeToolCatalog } from "@sema-agent/core";
 import { hangClassic } from "./classic-stations.js";
@@ -17,7 +17,7 @@ import { canonicalJsonStringify } from "@sema-agent/core";
 import { ccPromptSystemFor, wrapCondition, parseCcVerdict, CC_EVALUATOR_MAX_OUTPUT_TOKENS } from "./cc-stop-prompt.js";
 import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
-import { buildRequestUrlCredentialRefusal, findUrlCredential, urlCredentialHeaderExit } from "../url-credential.js";
+import { buildRequestUrlCredentialRefusal, urlCredentialHeaderExit } from "../url-credential-refusal.js";
 import { HOOK_PHASES, HOOK_SOURCE_VOCABULARY_SENTENCE, hookPhaseOf, readHookGroupSource } from "./hook-source.js";
 import { commandLineChars, composeHookEnvLayer, hookPluginChars, planCommandSpawn, readHookArgs, readHookPlugin } from "./command-spawn.js";
 export const MAX_HOOK_ENTRIES_PER_EVENT = 32;

package/dist/http/admission.js

@@ -12,7 +12,7 @@ import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHisto
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
-import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { ATTACHMENT_BOOLEAN_KEYS, ATTACHMENT_KEYS, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
 import { fieldConflictFacts } from "../field-conflict.js";
@@ -78,6 +78,8 @@ function userSkillShapeIssue(item, index) {
     }
     if (skillCarriesRetiredManifest(s))
         return { message: SKILL_MANIFEST_RETIRED };
+    if (s["mods"] !== undefined)
+        return { message: "skill.mods is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)" };
     for (const key of ["allowedTools", "disallowedTools"]) {
         if (s[key] !== undefined && !skillToolListOk(s[key]))
             return { message: `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))` };
@@ -457,7 +459,7 @@ export function createAdmission(ctx) {
         {
             const inheritEnvIssue = inheritEnvFieldIssue(body);
             if (inheritEnvIssue) {
-                sendError(res, 400, "request.field_invalid", inheritEnvIssue);
+                sendError(res, 400, "request.field_invalid", inheritEnvIssue.message, inheritEnvIssue.facts);
                 return null;
             }
         }
@@ -618,9 +620,9 @@ export function createAdmission(ctx) {
             }
         }
         {
-            const v = body.promptProfile;
-            if (v !== undefined && v !== "simple" && v !== "classic") {
-                sendError(res, 400, "request.field_invalid", 'promptProfile must be "simple" or "classic"');
+            const v = body.promptLean;
+            if (v !== undefined && typeof v !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "promptLean must be a boolean");
                 return null;
             }
         }
@@ -687,7 +689,8 @@ export function createAdmission(ctx) {
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
+                const attachmentKeyList = ATTACHMENT_KEYS.map((k) => `${k}?`).join(", ");
+                sendError(res, 400, "request.field_invalid", `attachments must be an object { ${attachmentKeyList} }`);
                 return null;
             }
             const rec = a;
@@ -695,7 +698,7 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", 'attachments.planModeReminder was retired in core 7.39.0 — the engine now states plan posture itself whenever the permission mode is "plan" (first request, periodic reminders, exit frame); remove the key (send permissionMode "plan" for plan posture)');
                 return null;
             }
-            for (const k of ["todoReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
+            for (const k of ATTACHMENT_BOOLEAN_KEYS) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
                     sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;

package/dist/http/approval-sweeps.js

@@ -1,5 +1,6 @@
 import { redactHead } from "../observability/run-terminal.js";
 const errText = (e) => redactHead(e instanceof Error ? e.message : String(e), 2000);
+import { checkpointRevOf } from "@sema-agent/core";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
 import { hostDecisionFacts } from "../host-decision.js";
@@ -89,7 +90,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(token);
                 if (!cp)
                     return { token, parked: false, rev: undefined };
-                const rev = cp.rev ?? 0;
+                const rev = checkpointRevOf(cp);
                 if (!parkSources)
                     return { token, parked: false, rev };
                 const origin = await findParkOrigin({
@@ -120,7 +121,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(cardToken);
                 if (!cp)
                     return;
-                if (cp.status !== "pending" || (cp.rev ?? 0) !== observedRev) {
+                if (cp.status !== "pending" || checkpointRevOf(cp) !== observedRev) {
                     deps.logger?.warn?.("deny_sweep_policy_blocked_expire_skipped", { sessionId, skipReason: cp.status !== "pending" ? "not_pending" : "card_changed", ...blockedScalars(body) });
                     return;
                 }
@@ -177,7 +178,7 @@ export function createApprovalSweeps(ctx) {
             deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
                 count: replaySkipped.length,
                 skipped: replaySkipped,
-                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind inert_tool_list: a tool-list entry (a skill disallowedTools, an agent definition's denyTools / allowTools or the request's excludeTools / allowTools) the engine reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (skipped[].kind names the rule that refused each one; the resume paths log the same kinds with a reason per kind), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/caller-trust.d.ts

@@ -8,7 +8,8 @@
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;
- *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读(与凭据门派 `source` 同序:`dispatch.ts` 先认 service 凭据);
+ *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读 —— 这不是本表的判:来源只有一只判定次序(`verifiedIdentitySource`,
+ *    service 凭据先;凭据门的 401 / 归因 / run 行身份元组读同一次的答案),本表只按来源词分档;
  *  · 多租 · 中心登录令牌,scope 角色 ≥ 契约 `domainWriteRole("governance")` ⇒ `global`:能写 scope 治理域(autonomy / commandPolicy / approvalRequire,全组织的免问面)
  *    的角色,放宽自己这一 run 是它的子集;门槛读契约,不手抄角色词;
  *  · 多租 · 其余(登录令牌角色低于它 / 不带 / 认不出;直连门 principal 令牌只证身份不证角色;没有验过的凭据)⇒ `project`:契约给非运维档作者的仓控来源的档,

package/dist/http/caller-trust.js

@@ -1,7 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
-import { systemFor, verifiedIdentitySource } from "./principal-gate.js";
+import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
         return { trust: "global", basis: "single_user" };
@@ -10,8 +10,6 @@ export function callerTrust(req, config) {
         case "service_token":
             return { trust: "global", basis: "service_credential" };
         case "sso": {
-            if (systemFor(req, config) !== undefined)
-                return { trust: "global", basis: "service_credential" };
             const role = ssoVerifiedRole(req);
             if (role === undefined || !isRole(role))
                 return { trust: "project", basis: "sign_in_role_unrecognized" };