@sema-agent/server 7.135.0 → 7.137.0

package/dist/http/checkpoint-ctx.d.ts

@@ -31,8 +31,14 @@
  * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
  * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
  *
+ * ## 第四问(7.137.0):体里的退役请求键
+ * 请求键退役之后(今天一只:`promptProfile` 换成布尔 `promptLean`,{@link RETIRED_REQUEST_KEYS}),新提交带它在键闭集门 400;存体里的旧键由一次性迁移在起服时原地改写
+ * (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
+ * 旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ * 也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
+ *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
  * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
@@ -110,6 +116,23 @@ export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
  */
 export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
+/**
+ * 第四问:**退役的请求键**闭集(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下、一次性迁移没改写到的)。加一个 ⇒ 加一行,
+ * {@link retiredRequestKeyRefusal} 的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
+ */
+export declare const RETIRED_REQUEST_KEYS: readonly ["promptProfile"];
+export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
+/** 存体顶层带的第一只退役请求键(闭集序);没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
+export declare function retiredRequestKeyOf(body: unknown): RetiredRequestKey | undefined;
+/**
+ * 第四问的拒答复 —— 码与落点同另两只读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: <整句双引号字面 或 一只模板串>`,中间只许有空白(模板串形冻结的是骨架,`${…}` 折成一个洞)。
+ * **窗的日期不手写**:`rewriteWindowEnd` 由调用方交 —— 判据(`stored-body-replay.ts`)按「退役键 → 改写它的迁移」那张表读登记表该行的 `removableAfter`,窗只写在登记表一处;
+ * 句子写绝对日期(过了这一天读句子的人一眼看出出路已关,不靠「本版发布日」这种随版漂的说法)。
+ * 删法见登记表 M30 的 `removal`(唯一来源)。
+ */
+export declare function retiredRequestKeyRefusal(key: RetiredRequestKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -127,7 +150,7 @@ export declare function allowListReadingEraOf(ctx: CheckpointCtx): AllowListRead
 export declare function allowListReadingRefusal(era: AllowListReadingEra): ResumeRefusalAnswer;
 /**
  * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
- * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ * 答 `checkpoint.unsupported_version` 的三臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
  */
 export type StoredBodyReplayRefusal = {
     readonly kind: "allow_list_reading";
@@ -141,10 +164,16 @@ export type StoredBodyReplayRefusal = {
     readonly stored: PermissionMode | undefined;
     readonly floor: PermissionMode;
     readonly writerVersion?: string;
+} | {
+    readonly kind: "retired_request_key";
+    readonly key: RetiredRequestKey;
+    /** 改写这只退役键的一次性迁移窗的最后一天(UTC 日历日 YYYY-MM-DD)—— 登记表那一行的 `removableAfter`,由判据(`stored-body-replay.ts`)读来:本模块的闭包只许 node 内建 / 引擎包根,读不了登记表,日期只能由调用方交。 */
+    readonly rewriteWindowEnd: string;
+    readonly writerVersion?: string;
 };
 /**
- * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
- * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的三只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法 / 退役请求键三臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
  * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
  * (本模块零值依赖,不自取)。纯数据。
  */
@@ -201,11 +230,12 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
+    key?: RetiredRequestKey;
     note: string;
 };
 /**
  * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这三只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  *
  * 🔴 `cardPending` —— **调用方交出的事实**:这一次拒的时候,有没有一张待批卡仍在等。`retriable:true` 说的恰是「卡仍 pending」,所以它只在卡在时在场(经
@@ -268,14 +298,17 @@ export interface CheckpointCtxSealing extends CheckpointCtxSealer, CheckpointCtx
 }
 /**
  * **凭据位闭集**(提交体里值为凭据的位置)。路径段 `*` = 那一格容器的**每一个成员**:数组的每一项、字典的每一个值(一只走法,不分容器种类 —— 字典成员的点名形
- * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据。
- * 入表判据(一条):请求面上**为承载凭据而设**的字段 —— 静态请求头(MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目)、
- * 交给子进程的 env(MCP stdio 传输、任务 shell 的 `settings.env`、command hook 条目的插件选项)、请求自带的搜索后端钥匙。http hook 的头与另两种静态头同判:契约包的条目形是
- * `headers: Record<string, string>`、受理面(`parseHooksConfig`)只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire ——
- * 头值可以就是字面的 `Authorization: Bearer …`。插件选项与 `settings.env` 同判:`plugin.options` 的每一个值就是 hook 子进程环境里的 `CLAUDE_PLUGIN_OPTION_<KEY>`
- * (`hooks/command-spawn.ts` 的 `hookPluginEnv`),参照实现也把 sensitive 选项照样交进这一族环境变量 —— 值是不是秘密不是本层能判的,所以整格封,不判值形。
- * hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`、只有带 `plugin` 的 command 条目有 `plugin.options`,
- * 别的条目在那一段缺席、走法照常不往下走。**不入表**:命令行 / URL / 工具实参之类自由文本(不是凭据字段;它们里有没有秘密不是本层能判的)。
+ * `field` 是 `.<键>`,数组是 `[<下标>]`)。`map` = 那一格是串值字典,**每一个值**都是凭据(不分哪一键);`value` = 那一格本身是凭据(不论是串、数组还是别的形,整只一个值)。
+ * 入表判据(一条):本服务替调用方**原样交出去**的配置值 —— **子进程的启动面**(命令行 `command` / `args` 与交给它的 env)、发往对端的**静态请求头**、
+ * 请求自带的**搜索后端钥匙**。值是不是秘密不是本层能判的,所以整格封、不判值形(`--token=…` / `-p …` 拆在两个元素里、shell 形的整行,都不靠认形)。
+ *  · 子进程两座:MCP stdio 传输(`command` / `args` / `env`)与 command hook 条目(`command` / `args`,插件选项 `plugin.options` 的每一个值就是 hook 子进程环境里的
+ *    `CLAUDE_PLUGIN_OPTION_<KEY>` —— `hooks/command-spawn.ts` 的 `hookPluginEnv`),外加任务 shell 的 `settings.env`。命令行与 env 同判:壳在投影前把 `${user_config.*}`
+ *    替成字面值(执行器不做这一替换),参照实现也把 sensitive 选项照样交进子进程,所以命令行里可以就是密钥。`args` 整只数组封成**一只**封签(不逐元素:逐元素判值形是第二只判官)。
+ *  · 静态头三座:MCP http 传输、A2A 对端〔引擎型注:「e.g. an auth bearer」〕、http hook 条目(契约包的条目形是 `headers: Record<string, string>`、受理面(`parseHooksConfig`)
+ *    只判条数与字数、`interpolateHookEnvVars` 只换 `$NAME` 引用而字面值原样上 wire —— 头值可以就是字面的 `Authorization: Bearer …`)。
+ * hooks 的形 = 事件名 → 匹配组数组 → 组的 `hooks` 数组 → 条目;只有 `type:"http"` 的条目有 `headers`、只有 command 条目有 `command` / `args` / `plugin.options`,
+ * 别的条目在那一段缺席、走法照常不往下走。**不在本表、各归另一条规则**:值是 URL 的字段 —— 带凭据的 URL 在受理口就拒(凭据只许走头位;判官 = 契约包根的 `findUrlCredential`),
+ * 所以落盘的 URL 结构上不带凭据;交给模型的文本(目标 / 提示词 / 系统提示)—— 模型看得见的东西本来就进会话记录,封停驻档护不住它。
  * 加一位 = 加一行,读写两侧与一次性迁移 M28 共用 {@link mapCredentialSlots} 一只走法:写侧与读侧立即覆盖;已落盘的行由 M28 补封 ——
  * 新行的 `since` 取下一代:封口铸的落盘形盖「这一行里带值的位最新的那一代」(`credentialSlotGeneration`),读者据它判那一行用到、封过哪几位 —— 代数更早的行上新位的值一律是明文(记号本身不证明它封过新位)。
  * M28 封的是「读口会答 `plaintext` 的每一个值」({@link credentialValueReading}),所以新加的一位上的明文在带记号的行里也被补封(只在 M28 的窗内;窗外加位要另起迁移)。
@@ -308,6 +341,22 @@ export declare const CHECKPOINT_CTX_CREDENTIAL_SLOTS: readonly [{
     readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"];
     readonly holds: "map";
     readonly since: 2;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["mcpServers", "*", "transport", "args"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "command"];
+    readonly holds: "value";
+    readonly since: 3;
+}, {
+    readonly path: readonly ["settings", "hooks", "*", "*", "hooks", "*", "args"];
+    readonly holds: "value";
+    readonly since: 3;
 }];
 /** 本版闭集的代数 = 表里最大的 `since`(读者认得的最新一代)。落盘形的 `credentialSlotGeneration` 不大于它;大于它的行是更新的写者带着本版不认识的位写下的。 */
 export declare const CHECKPOINT_CTX_CREDENTIAL_GENERATION: number;
@@ -337,15 +386,16 @@ export type StoredCheckpointCtx = Omit<CheckpointCtx, "body"> & {
 };
 declare const sealedCheckpointCtxBrand: unique symbol;
 /**
- * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移 M28 的行改写只收它 ⇒ 「写 ctx 只有封口一个写入面」由型面守,
+ * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)只收它 ⇒ 「写 ctx 只有本模块的铸点一个写入面」由型面守,
  * 不再靠逐个数调用点(把开封形 / 裸对象直接交给写口 = 当场 tsc 红)。铸点闭集(都在本模块,都经 {@link mintSealedCheckpointCtx}):
- * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)与 {@link sealStoredCheckpointCtxM28}。零运行期变化。
+ * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)、{@link sealStoredCheckpointCtxM28} 与 {@link rewriteStoredBodyKeys}
+ * (存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)。零运行期变化。
  */
 export type SealedCheckpointCtx = StoredCheckpointCtx & {
     readonly [sealedCheckpointCtxBrand]: true;
 };
 /** 装配期拒启的那一句(`createHttpServer` 与起服第 6 段同调;一句、一个出口)。 */
-export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers, command hook plugin options) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export declare const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all \u2014 give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory \u2014 SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning \u2014 make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 /** 封签形的判官(恰三键、三值皆串、`alg` 是本闭集那一个词)。 */
 export declare function isSealedCheckpointValue(v: unknown): v is SealedCheckpointValue;
 /**
@@ -388,5 +438,15 @@ export declare function sealStoredCheckpointCtxM28(stored: object, sealer: Check
     readonly ctx: SealedCheckpointCtx;
     readonly valuesSealed: number;
 } | undefined;
+/**
+ * 🔴 **一次性迁移对存量行非凭据顶层体键的改写**(品牌铸点之三;今天的调用方 = M30 的行改写 `stored-request-prompt-profile-m30.ts`):在一行落盘形的体上删 `drop` 里的顶层键、
+ * 设 `set` 里的顶层键,其余一个字节不动 —— 行上的读法记号(凭据封口的 `credentialSeal` / `credentialSlotGeneration` 与另两只记号)与凭据位上的值原样随行:封好的行仍是封好的,
+ * 更早写者留下的明文行仍是明文(读口照旧拒 `plaintext`,本口不替它洗白)。`drop` / `set` 碰到凭据位的根键(闭集各行路径的第一段)或 `__proto__` ⇒ 抛(程序错,不是数据错)。
+ * 体不是对象 ⇒ 抛(店的判形保证 ctx 是对象;体坏形的行由调用方先判、不交来)。
+ */
+export declare function rewriteStoredBodyKeys(stored: object, edit: {
+    readonly drop: readonly string[];
+    readonly set?: Readonly<Record<string, unknown>>;
+}): SealedCheckpointCtx;
 export {};
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -39,6 +39,28 @@ export function permissionModeReadingRefusal() {
         }),
     };
 }
+export const RETIRED_REQUEST_KEYS = ["promptProfile"];
+export function retiredRequestKeyOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    return RETIRED_REQUEST_KEYS.find((key) => Object.hasOwn(body, key));
+}
+export function retiredRequestKeyRefusal(key, rewriteWindowEnd) {
+    switch (key) {
+        case "promptProfile":
+            return {
+                status: 409,
+                body: refusalBody({
+                    errorCode: "checkpoint.unsupported_version",
+                    message: `this task was suspended by an earlier server version and its stored request still carries promptProfile, a request key this version no longer reads (it was replaced by the boolean promptLean: classic is promptLean: false, simple is leaving promptLean out), so continuing would run the task with a prompt form it was not submitted with. Nothing was decided and nothing was resumed. If whoever operates this deployment restarts this server on or before ${rewriteWindowEnd} (UTC), the stored request is rewritten in place and the same request can be sent again; otherwise submit the work again as a new task with promptLean in place of promptProfile, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).`,
+                }),
+            };
+        default: {
+            const unhandled = key;
+            throw new Error(`retired request key ${String(unhandled)} has no refusal sentence`);
+        }
+    }
+}
 export function allowListReadingUnstated(ctx) {
     if (!bodyCarriesAllowList(ctx.body))
         return false;
@@ -96,6 +118,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
+        case "retired_request_key":
+            return { kind: refusal.kind, key: refusal.key, note: "this session's stored request still carries a request key this version retired, and the one-time rewrite at startup did not reach it (no startup of this version inside its window since the row was written); it is not replayed — the task stays suspended until someone cancels it, or a restart of this version inside the window rewrites the row" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -117,6 +141,10 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
+        case "retired_request_key": {
+            const answer = retiredRequestKeyRefusal(refusal.key, refusal.rewriteWindowEnd);
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);
@@ -132,6 +160,10 @@ export const CHECKPOINT_CTX_CREDENTIAL_SLOTS = [
     { path: ["settings", "webSearch", "apiKey"], holds: "value", since: 1 },
     { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map", since: 1 },
     { path: ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"], holds: "map", since: 2 },
+    { path: ["mcpServers", "*", "transport", "command"], holds: "value", since: 3 },
+    { path: ["mcpServers", "*", "transport", "args"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "command"], holds: "value", since: 3 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "args"], holds: "value", since: 3 },
 ];
 export const CHECKPOINT_CTX_CREDENTIAL_GENERATION = Math.max(...CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.since));
 export const CHECKPOINT_CTX_UNSEALABLE_REASONS = ["no_key_store", "key_not_held", "unopenable", "plaintext", "unrecognized_seal"];
@@ -148,7 +180,7 @@ export class CheckpointCtxUnsealableError extends Error {
 function mintSealedCheckpointCtx(sealed) {
     return sealed;
 }
-export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers, command hook plugin options) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, settings.webSearch.apiKey) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it at boot in checkpoint-ctx-keys/ under the sealed-key custody directory — SEALED_KEY_DIR, default <data root>/sealed-key/; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 export function isSealedCheckpointValue(v) {
     if (!isRecord(v))
@@ -317,4 +349,16 @@ export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
         ? undefined
         : { ctx: mintSealedCheckpointCtx({ ...stored, body: sealed, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation }), valuesSealed };
 }
+const CREDENTIAL_SLOT_ROOTS = new Set(CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.path[0]));
+export function rewriteStoredBodyKeys(stored, edit) {
+    const touched = [...edit.drop, ...Object.keys(edit.set ?? {})];
+    const forbidden = touched.filter((key) => CREDENTIAL_SLOT_ROOTS.has(key) || key === "__proto__");
+    if (forbidden.length > 0)
+        throw new Error(`rewriteStoredBodyKeys: ${forbidden.join(", ")} is a credential-slot root (or __proto__) — a one-time body-key rewrite never touches those`);
+    const body = stored.body;
+    if (!isRecord(body))
+        throw new Error("rewriteStoredBodyKeys: the stored row's body is not an object");
+    const next = Object.fromEntries([...Object.entries(body).filter(([key]) => !edit.drop.includes(key)), ...Object.entries(edit.set ?? {})]);
+    return mintSealedCheckpointCtx({ ...stored, body: next });
+}
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/dispatch.js

@@ -1,14 +1,15 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { admitBridgeIdentity } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
-import { actsForDeployment, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
+import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
     if (!hasServiceAuth(config))
@@ -212,15 +213,14 @@ export function createDispatch(ctx) {
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.webAdminJwtVerifier.verify(rawBearer);
-                if (v.ok) {
-                    setSsoPrincipal(req, v.identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    if (v.identity.scope)
-                        setSsoScope(req, v.identity.scope);
-                    if (v.identity.role)
-                        setSsoRole(req, v.identity.role);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
+                const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                if (identity) {
+                    setSsoPrincipal(req, identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
+                    setSsoScope(req, identity.scope);
+                    if (identity.role)
+                        setSsoRole(req, identity.role);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: identity.principal, scope: identity.scope });
                 }
             }
         }
@@ -228,22 +228,27 @@ export function createDispatch(ctx) {
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
+        const identitySource = verifiedIdentitySource(req, deps.config);
+        admitRunIdentity(req, identitySource);
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {
-            const sys = systemFor(req, deps.config);
-            if (sys === undefined) {
-                if (ssoVerifiedPrincipal(req)) {
+            switch (identitySource) {
+                case "service_token":
+                    source = systemFor(req, deps.config) ?? null;
+                    break;
+                case "sso":
                     source = "sso";
-                }
-                else {
+                    break;
+                case "direct_door_jwt":
+                case undefined:
                     sendUnauthorized(res, "credential");
                     return;
+                default: {
+                    const unknownSource = identitySource;
+                    throw new Error(`credential gate: identity source ${String(unknownSource)} has no gate row`);
                 }
             }
-            else {
-                source = sys;
-            }
         }
         reqState.source = source;
         if (!anyServiceAuth &&

package/dist/http/durable-run-leg.d.ts

@@ -1,6 +1,7 @@
 import type { RunStore } from "../plugins/store-backend.js";
 import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { PreparedTaskSubmission, RouteCtxBase, WorkflowDecisionDelivery } from "./route-ctx.js";
+import type { RunIdentity } from "../identity-source.js";
 export interface DurableRunLegArgs {
     /** `prepareSpec` 的产物,或内部车道按同一条 `resolveSpec` 装配出来的等价形。 */
     prepared: PreparedTaskSubmission;
@@ -18,8 +19,11 @@ export interface DurableRunLegArgs {
      *  提交门传 `gatedPrincipal(req) ?? null` = 提交者本人;`/decide` 的第三条车道传**卡属主**(= 原提交者,
      *  不是代为按下按钮的 operator —— 与 resume 腿那条成文口径逐字同源)。`null` = 匿名/开放部署。 */
     elicitOwner: string | null;
-    /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。 */
+    /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。只作归因。 */
     source: string | null;
+    /** run 行身份元组(`RunRecord.identity`)—— 调用方经 `runIdentityOf(req, config, 属主)` 读凭据门铸下的那一份交进来(本腿不碰请求);
+     *  属主 = `prepared.auth.principal`(本腿建行写进 `owner` 的同一个值)。`/decide` 第三条车道同一只读法:按下按钮的不是卡属主 ⇒ 空。 */
+    identity: RunIdentity | null;
     /** `/decide` 第三条车道的 fresh 投递腿交来的那一件决定投递(带着的决定 + 起跑之前落行的那一笔;语义与 TRUSTED 纪律的属主 =
      *  `route-ctx.ts` 的 {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊本会话已受理的决定行。 */
     workflowDecision?: WorkflowDecisionDelivery;

package/dist/http/durable-run-leg.js

@@ -19,7 +19,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const sessionId = args.prepared.spec.sessionId ?? uuidv7();
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), idem: args.idem ?? null });
+    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)

package/dist/http/health-self-report.d.ts

@@ -4,7 +4,7 @@
  *
  * ## 规则(一条):自报位是**投影**,不是第二份规则
  * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
- *  · `auth.kinds` = `IDENTITY_SOURCES`(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
+ *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
  *    (`principal-gate.ts`;「这台部署有没有身份边界」的门 `devOpenDeployment` 读同一只):
  *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
  *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
@@ -33,7 +33,7 @@
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
  */
 import type { FlatServiceDeps } from "./server.js";
-import { type IdentitySource } from "./principal-gate.js";
+import type { IdentitySource } from "../identity-source.js";
 /** `auth.identityAttach` 的词表。 */
 export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
 export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];

package/dist/http/mcp-remote-text.d.ts

@@ -0,0 +1,5 @@
+/** 远端可控自由文本在这几面上的长度上界(字符)。 */
+export declare const MCP_REMOTE_TEXT_MAX = 200;
+/** 引擎铸过的 MCP 远端失败句 → 本服务出口的形:引擎没抹的段过本仓脱敏器、引擎的记号原样,截到 {@link MCP_REMOTE_TEXT_MAX}。 */
+export declare function redactMcpRemoteText(text: string): string;
+//# sourceMappingURL=mcp-remote-text.d.ts.map

package/dist/http/mcp-remote-text.js

@@ -0,0 +1,7 @@
+import { redactSecrets } from "../trace/redact.js";
+const ENGINE_REDACTION_MARK = "[redacted]";
+export const MCP_REMOTE_TEXT_MAX = 200;
+export function redactMcpRemoteText(text) {
+    return text.split(ENGINE_REDACTION_MARK).map((part) => redactSecrets(part)).join(ENGINE_REDACTION_MARK).slice(0, MCP_REMOTE_TEXT_MAX);
+}
+//# sourceMappingURL=mcp-remote-text.js.map

package/dist/http/principal-gate.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import { type DurableOwnerKey, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
+import { type IdentitySource, type RunIdentity } from "../identity-source.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
 export declare function headerStr(v: string | string[] | undefined): string | undefined;
 export declare function safeEqual(a: string, b: string): boolean;
@@ -18,19 +19,23 @@ export declare function traceTokenPresented(req: IncomingMessage, config: Servic
 /** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
 export declare function isLoopbackAddress(addr: string | undefined): boolean;
 /**
- * 验过的身份来源的**闭集**(序 = `/health.auth.kinds` 的出现序)。{@link verifiedIdentitySource} 的回值就是这张表的词;
- * `/health` 的自报位(`http/health-self-report.ts`)读同一张表,答「这台部署的装配**能**回哪几个词」—— 加一个来源 = 加一个词,
- * 两边各自的穷举 `switch` 不接就编译红。
+ * 🔴 **这次请求验过的身份来源 —— 全仓唯一的判定次序**:按 {@link IDENTITY_SOURCES} 的序逐词问,答第一个验得过的词(次序与它为什么是这个次序见
+ * `identity-source.ts` 头注律 1:出示了 service 凭据就是 `service_token`)。缺席 = 只有自述头或什么都没有。
+ * 读者:凭据门(`dispatch.ts`:401、归因 `source` 与 run 行身份元组读同一次的答案)、调用方信任档(`caller-trust.ts`)、门前读路谓词、
+ * off-box 诊断门(只判有无:名单只在有可验身份时才是身份,零凭据下它只是谁都能写的字符串)。
  */
-export declare const IDENTITY_SOURCES: readonly ["service_token", "sso", "direct_door_jwt"];
-export type IdentitySource = (typeof IDENTITY_SOURCES)[number];
+export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): IdentitySource | undefined;
 /**
- * 这次请求的身份是不是**密码学验过**的(而不是调用方自述的 header):`sso` = registry JWT(入口预认证的签名真源)/
- * `direct_door_jwt` = direct-door principal JWT 验过 / `service_token` = 出示了单一或 per-system service token。
- * 缺席 = 只有自述头或什么都没有。一处判定(7.63.0 codex [high]+[medium]):off-box 读 operator 面的门用它——名单只在
- * 有可验身份时才是身份,零凭据下它只是谁都能写的字符串;而 JWT 身份不依赖静态 token 的在场。
+ * 🔴 **run 行身份元组的唯一铸点**(律见 `identity-source.ts` 头注;唯一调用点 = `dispatch.ts` 的凭据门,机器门钉着)。`source` = 凭据门那一次
+ * {@link verifiedIdentitySource} 的答案 —— 这里不再判来源,只把来源连同它的 scope / 化身号定成元组,挂在这个请求上;建 run 行的点经 {@link runIdentityOf} 读它。
  */
-export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): IdentitySource | undefined;
+export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined): void;
+/**
+ * 建 run 行时写进行里的身份元组 —— 每个 `createRun` 调用点(或替它建行的腿的调用方)读这一只,原样写入(机器门:`src/http/**` 每处 `createRun` 都写明 `identity`)。
+ * 只在**受理请求验过的主体就是这一行的属主**时交出凭据门铸下的元组(提交面恒成立:行的属主就是这个主体);别人替属主按下的那一跑(唤醒、决定投递铸的
+ * 新一跑)⇒ 空 —— 属主本人的凭据没有在这次受理里出示过(律 3)。没有请求 / 请求没过凭据门 ⇒ 空。
+ */
+export declare function runIdentityOf(req: IncomingMessage | undefined, config: ServiceConfig, owner: string | null): RunIdentity | null;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): Principal | undefined;
 /**
  * 「**出示了凭证但验不过** ≠ **没出示**」在 **direct-door principal JWT** 面上的形 —— 本仓

package/dist/http/principal-gate.js

@@ -1,6 +1,7 @@
 import { timingSafeEqual } from "node:crypto";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ownerlessRowOpen, mintPrincipal } from "../security.js";
+import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
+import { IDENTITY_SOURCES, RUN_IDENTITY_SCOPE_MAX_CHARS } from "../identity-source.js";
 import { sendError } from "./send.js";
 export function headerStr(v) {
     return Array.isArray(v) ? v[0] : v;
@@ -41,15 +42,53 @@ export function traceTokenPresented(req, config) {
 export function isLoopbackAddress(addr) {
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-export const IDENTITY_SOURCES = ["service_token", "sso", "direct_door_jwt"];
+function identitySourceVerified(kind, req, config) {
+    switch (kind) {
+        case "service_token":
+            return systemFor(req, config) !== undefined;
+        case "sso":
+            return ssoVerifiedPrincipal(req) !== undefined;
+        case "direct_door_jwt":
+            return config.directDoorActive && verifiedPrincipal(req, config) !== undefined;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`verifiedIdentitySource: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
 export function verifiedIdentitySource(req, config) {
-    if (ssoVerifiedPrincipal(req))
-        return "sso";
-    if (systemFor(req, config) !== undefined)
-        return "service_token";
-    if (config.directDoorActive && verifiedPrincipal(req, config) !== undefined)
-        return "direct_door_jwt";
-    return undefined;
+    return IDENTITY_SOURCES.find((kind) => identitySourceVerified(kind, req, config));
+}
+const ADMITTED_RUN_IDENTITY = new WeakMap();
+export function admitRunIdentity(req, source) {
+    ADMITTED_RUN_IDENTITY.set(req, mintRunIdentity(req, source));
+}
+function mintRunIdentity(req, source) {
+    switch (source) {
+        case "service_token":
+        case "direct_door_jwt":
+            return { source, scope: null, principalInc: null };
+        case "sso": {
+            const scope = ssoVerifiedScope(req);
+            if (scope === undefined || [...scope].length > RUN_IDENTITY_SCOPE_MAX_CHARS)
+                return null;
+            return { source, scope, principalInc: null };
+        }
+        case undefined:
+            return null;
+        default: {
+            const unknownSource = source;
+            throw new Error(`admitRunIdentity: unknown identity source ${String(unknownSource)}`);
+        }
+    }
+}
+export function runIdentityOf(req, config, owner) {
+    if (req === undefined)
+        return null;
+    const admitted = ADMITTED_RUN_IDENTITY.get(req);
+    if (admitted === undefined || admitted === null)
+        return null;
+    return (gatedPrincipal(req, config) ?? null) === owner ? admitted : null;
 }
 export function gatedPrincipal(req, config) {
     if (bearerPresentedButUnverified(req, config))

package/dist/http/resume-ctx-read.d.ts

@@ -29,9 +29,8 @@
  * —— `key_not_held` 多半是多副本没共享保管目录,运维修好之后同一个决定原样重发即可),**不明文回落、不丢键**。
  * 开封要知道这一行的会话(封签绑会话)与开口(`ServiceDeps.checkpointCtxSealing`;缺席 = 本副本没有保管店):两件一起交({@link CheckpointCtxOpening})。
  *
- * **两种读法,一只读口**(第二个实参):① 开封形({@link CheckpointCtxOpening})—— 续跑重建 spec 的每一条腿;② {@link KEEP_SEALED}「信封原样留着」——
- * 只读**非凭据字段**的读者(今天 = inbox 的展示位 `objective`):不开封、不判凭据位(活凭据不为展示进内存),交回落盘形 `StoredCheckpointCtx`,
- * 结局里没有 `unsealable` 这一态(型面就没有;店边界的三态与开封形逐字同一段)。凭据位上的值在这种读法里仍是封签 —— 谁要用它们就必须走读法 ①。
+ * **一种读法**(第二个实参 = 开封的两件 {@link CheckpointCtxOpening}):读续跑上下文的只有续跑重建 spec 的那几条腿。7.136.0 起([ref])
+ * inbox 的展示位 `objective` 改读 run 行的目标预览,此前为它而设的第二种读法(「信封原样留着」,只读非凭据字段)随唯一的读者一起退役。
  */
 import type { CheckpointCtx } from "./route-ctx.js";
 import { type CheckpointCtxOpener, type CheckpointCtxUnsealableReason, type StoredCheckpointCtx } from "./checkpoint-ctx.js";
@@ -49,25 +48,12 @@ export type ResumeCtxRead = {
     readonly field: string;
     readonly reason: CheckpointCtxUnsealableReason;
 };
-/** 读法 ② 的结局:店边界的三态,`ok` 交落盘形(凭据位上仍是封签)。 */
-export type SealedResumeCtxRead = {
-    readonly kind: "ok";
-    readonly ctx: StoredCheckpointCtx;
-} | {
-    readonly kind: "absent";
-} | {
-    readonly kind: "corrupt";
-    readonly where: string;
-};
 /** 开封的两件:这一行的会话(= 交给店 `getCtx` 的那一个)与开口(缺席 = 本副本没有保管店)。 */
 export interface CheckpointCtxOpening {
     readonly sessionId: string;
     readonly opener: CheckpointCtxOpener | undefined;
 }
-/** 读法 ② 的词:信封原样留着(只读非凭据字段)。 */
-export declare const KEEP_SEALED = "keep_sealed";
 export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: CheckpointCtxOpening): Promise<ResumeCtxRead>;
-export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: typeof KEEP_SEALED): Promise<SealedResumeCtxRead>;
 /**
  * 开不开的对外答复([ref])—— 409 `conflict.checkpoint_ctx_unsealable`,机读 `field`(哪一个凭据位,提交体路径;键名不是秘密,值从不进来)+ `reason`
  * (闭集 `CHECKPOINT_CTX_UNSEALABLE_REASONS`)。句子说「这条任务的续跑上下文里带的凭据本服务开不开」、五种成因与出路(按 `reason` 修好保管目录后原样重发,

package/dist/http/resume-ctx-read.js

@@ -1,10 +1,9 @@
 import { openCheckpointCtx } from "./checkpoint-ctx.js";
 import { SqlJsonColumnError, StoreCorruptError } from "../plugins/sql-json-column.js";
 import { refusalBody } from "./refusal-body.js";
-export const KEEP_SEALED = "keep_sealed";
 export async function readResumeCtx(load, opening) {
     const read = await readStoredCtx(load);
-    if (read.kind !== "ok" || opening === KEEP_SEALED)
+    if (read.kind !== "ok")
         return read;
     const opened = openCheckpointCtx(read.ctx, opening.opener, opening.sessionId);
     return opened.kind === "ok" ? { kind: "ok", ctx: opened.ctx } : { kind: "unsealable", field: opened.field, reason: opened.reason };
@@ -28,7 +27,7 @@ export function resumeCtxUnsealableAnswer(read) {
         status: 409,
         body: refusalBody({
             errorCode: "conflict.checkpoint_ctx_unsealable",
-            message: "this task's stored resume context holds credentials from its request (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, http hook headers, or command hook plugin options) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+            message: "this task's stored resume context holds credentials from its request (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
             facts: {
                 field: read.field,
                 reason: read.reason,