@sema-agent/server 7.135.0 → 7.137.0

package/dist/http/routes/runs.js

@@ -3,7 +3,7 @@ import { redactHead, redactLedgerEventForRead } from "../../observability/run-te
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
-import { askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
+import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -22,7 +22,7 @@ import { invalidJsonError, sendJson, sendError, sendHttpError, sseHeaders } from
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { acceptedInputKindOf } from "../../user-input-ledger.js";
 import { INJECTION_TIERS } from "../../trace/injection-tier.js";
-import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, runIdentityOf } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
@@ -1345,7 +1345,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             askNotFound();
             return;
         }
-        const ownerOk = row0.owner === null || (principal !== undefined && row0.owner === principal);
+        const ownerOk = askOwnerAdmits(row0.owner, principal);
         const operatorOk = explicitOperatorOk(principal, deps.config);
         if (!ownerOk && !operatorOk) {
             askNotFound();
@@ -1603,6 +1603,7 @@ export async function createDurableRun(req, res, ctx, prepared, idem) {
             fleetScope: submitter ?? "default",
             elicitOwner: submitter ?? null,
             source,
+            identity: runIdentityOf(req, deps.config, prepared.auth?.principal ?? null),
         });
         return out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
     });

package/dist/http/routes/session-sync.js

@@ -8,6 +8,7 @@ import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
+import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
@@ -60,7 +61,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const mayTouch = face !== undefined && (scope.fleetWide || face.owner === scope.gateOwner || legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(sessionStorage, sessionId, face.owner)));
                 return { face, mayPull: mayTouch, mayPush: face === undefined || mayTouch };
             };
-            const gate = await judgeSessionGate();
+            let gate;
+            try {
+                gate = await judgeSessionGate();
+            }
+            catch (e) {
+                if (isPullPort(match.decl.id) && sendPullUnreadable(req, res, deps.logger, e))
+                    return;
+                throw e;
+            }
             const gateFace = gate.face;
             const owner = gateFace === undefined ? undefined : gateFace.owner;
             const sendSessionAbsent = () => sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
@@ -96,7 +105,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     out = await exportSessionManifest(sessionId, backend, historyStore);
                 }
                 catch (e) {
-                    if (sendSessionPolicyError(res, e) || sendFileHistoryUnreadable(res, e))
+                    if (sendSessionPolicyError(res, e) || sendPullUnreadable(req, res, deps.logger, e))
                         return;
                     throw e;
                 }
@@ -120,7 +129,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     }
                     afterSeq = n;
                 }
-                const it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                let it;
+                try {
+                    it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (it === null) {
                     sendSessionAbsent();
                     return;
@@ -167,7 +184,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     envelope = await exportedFileHistory(fs, sessionId);
                 }
                 catch (e) {
-                    if (sendFileHistoryUnreadable(res, e))
+                    if (sendPullUnreadable(req, res, deps.logger, e))
                         return;
                     throw e;
                 }
@@ -176,7 +193,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
                 }
-                const bytes = await fs.getBlob(hash);
+                let bytes;
+                try {
+                    bytes = await fs.getBlob(hash);
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (!bytes) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
@@ -569,13 +594,46 @@ export async function handleSessionSync(req, res, match, ctx) {
         }
     }
 }
-function sendFileHistoryUnreadable(res, e) {
-    if (!(e instanceof FileHistoryUnreadableError))
-        return false;
-    const permanence = e.failure.permanence;
-    const advice = permanence === "transient" ? "the history store judged the fault transient: retry later" : permanence === "terminal" ? "the history store judged the fault permanent: retrying will not help until the store is repaired" : "the history store did not judge whether retrying can help";
-    sendError(res, 503, "state.file_history_unreadable", `this session's file history cannot be read whole (${e.failure.code}), so nothing was exported — ${advice}`, permanence === undefined ? undefined : { permanence });
-    return true;
+function isPullPort(id) {
+    switch (id) {
+        case "session-sync-manifest":
+        case "session-sync-entries":
+        case "session-sync-history-blob":
+            return true;
+        case "session-sync-plan":
+        case "session-sync-import":
+        case "session-sync-import-entries":
+        case "session-sync-blob-put":
+            return false;
+        default:
+            return assertNever(id);
+    }
+}
+function sendPullUnreadable(req, res, logger, e) {
+    if (e instanceof FileHistoryUnreadableError) {
+        const permanence = e.failure.permanence;
+        const advice = permanence === "transient" ? "the history store judged the fault transient: retry later" : permanence === "terminal" ? "the history store judged the fault permanent: retrying will not help until the store is repaired" : "the history store did not judge whether retrying can help";
+        sendError(res, 503, "state.file_history_unreadable", `this session's file history cannot be read whole (${e.failure.code}), so nothing was exported — ${advice}`, permanence === undefined ? undefined : { permanence });
+        return true;
+    }
+    const fault = storeFaultClassOf(e);
+    switch (fault) {
+        case "connection":
+            logRequestError(logger, req, e);
+            sendError(res, 503, "state.file_history_unreadable", "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later", { permanence: "transient" });
+            return true;
+        case "deployment":
+            logRequestError(logger, req, e);
+            sendError(res, 503, "state.file_history_unreadable", "this session's stored state cannot be read: the store does not match what this deployment requires (a table is missing or the database account lacks a privilege), so nothing was exported — retrying will not help until an operator repairs the store", { permanence: "terminal" });
+            return true;
+        case "corrupt":
+        case "unclassified":
+            return false;
+        default: {
+            const unhandled = fault;
+            throw new Error(`store fault class without a session-sync pull-port answer: ${String(unhandled)}`);
+        }
+    }
 }
 function sendMissingBlob(res) {
     sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");

package/dist/http/routes/sessions.js

@@ -3,6 +3,7 @@ import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js
 import { HttpError, isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { redactMcpRemoteText } from "../mcp-remote-text.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
@@ -10,7 +11,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_EN
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
-import { headReadOf, sessionFaceOfHead } from "../../session-incarnation.js";
+import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
 import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -185,7 +186,7 @@ export async function handleSessions(req, res, match, ctx) {
                                 status: s.status,
                                 ...(s.serverInfo ? { serverInfo: s.serverInfo } : {}),
                                 ...(s.toolNames ? { toolNames: s.toolNames } : {}),
-                                ...(s.error ? { error: redactSecrets(String(s.error)).slice(0, 200) } : {}),
+                                ...(s.error ? { error: redactMcpRemoteText(String(s.error)) } : {}),
                             })),
                         };
                     }
@@ -272,7 +273,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, head.owner)))
                 return;
-            const leafId = head.leafId;
+            const leafId = leafOfAdmittedHead(head);
             const etag = `"${leafId ?? "empty"}"`;
             if (req.headers["if-none-match"] === etag) {
                 res.writeHead(304, { etag }).end();
@@ -290,7 +291,8 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const readOwner = async (id) => (await evFact.sessionStorage.headOf(id))?.owner;
+            const readHead = (id) => evFact.sessionStorage.headOf(id);
+            const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -326,13 +328,13 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const cellP = readOwner(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
-                void cellP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
+                const admissionP = readHead(evSession).then(async (head) => (head === undefined ? undefined : { head, cell: await sessionOwnerCellOf(evFact.sessionStorage, evSession, head.owner) }));
+                void admissionP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
-                let cell;
+                let admission;
                 try {
-                    cell = await Promise.race([
-                        cellP,
+                    admission = await Promise.race([
+                        admissionP,
                         new Promise((r) => { stallTimer = setTimeout(() => r("__stall__"), stallBound); stallTimer.unref?.(); }),
                     ]);
                 }
@@ -342,22 +344,23 @@ export async function handleSessions(req, res, match, ctx) {
                 }
                 if (closed)
                     return;
-                if (cell === "__stall__") {
+                if (admission === "__stall__") {
                     cleanup();
                     res.setHeader("retry-after", "5");
                     sendError(res, 503, "state.sse_owner_lookup_stalled", "session-events owner lookup stalled — retry");
                     return;
                 }
-                if (cell === undefined) {
+                if (admission === undefined) {
                     cleanup();
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!sessionOwnerOk(req, res, cell)) {
+                if (!sessionOwnerOk(req, res, admission.cell)) {
                     cleanup();
                     return;
                 }
-                const owner = cell.owner;
+                leafOfAdmittedHead(admission.head);
+                const owner = admission.cell.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -656,13 +659,15 @@ export async function handleSessions(req, res, match, ctx) {
         }
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
-        const face = sessionFaceOfHead(sessionId, await store.headOf(sessionId));
-        if (face === undefined) {
+        const head = await store.headOf(sessionId);
+        if (head === undefined) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
         }
+        const face = sessionFaceOfHead(sessionId, head);
         if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(store, sessionId, face.owner)))
             return;
+        leafOfAdmittedHead(head);
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
             sendError(res, 400, read.problem.code, read.problem.message);

package/dist/http/routes/tasks.js

@@ -25,7 +25,7 @@ import { approvalPreambleReplays, createApprovalCardEmitter, declaredApprovalFra
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
 import { commitSessionInheritEnv } from "../session-inherit-env.js";
-import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { headerStr, gatedPrincipal, explicitOperatorOk, runIdentityOf } from "../principal-gate.js";
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
@@ -33,6 +33,7 @@ import * as facts from "../../capability-facts.js";
 import { persistSubmitCtx } from "../submit-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
+import { runSkillsOf } from "../../capabilities/skills.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 import { refusalBody } from "../refusal-body.js";
@@ -166,6 +167,7 @@ export async function handleTasks(req, res, match, ctx) {
         const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
         let wiringReceipt;
         const instructionLeg = createInstructionSelectionLeg();
+        const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(prepared.spec) });
         const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
         if (liveStream) {
             if (prepared.verify || prepared.cascade) {
@@ -298,7 +300,7 @@ export async function handleTasks(req, res, match, ctx) {
                 };
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = earlyDurableTid ?? uuidv7();
-                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), idem: idem ?? null });
+                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
                     if (created.ok)
                         clearTurnActivity(tid);
                     if (created.ok)
@@ -338,7 +340,7 @@ export async function handleTasks(req, res, match, ctx) {
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), instructionsSegment: instructionLeg.segment });
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections });
                     usageKey = tid;
                     deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
@@ -589,7 +591,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     sseData(res, { type: "compaction_started", ...compactionStartedEventData(ev) });
                                 }
                                 else if (ev.type === "wiring_manifest") {
-                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
+                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, legWiringSections());
                                     wiringReceipt ??= wiringFace;
                                     sseData(res, { type: "wiring_manifest", ...wiringFace });
                                 }
@@ -890,7 +892,7 @@ export async function handleTasks(req, res, match, ctx) {
                 let durableHeartbeat;
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = uuidv7();
-                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), idem: idem ?? null });
+                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
                     if (created.ok)
                         clearTurnActivity(tid);
                     if (created.ok)
@@ -937,7 +939,7 @@ export async function handleTasks(req, res, match, ctx) {
                 const observeSyncLegEvent = (ev) => {
                     if (ev.type !== "wiring_manifest" || wiringReceipt !== undefined)
                         return;
-                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
+                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, legWiringSections());
                 };
                 let result;
                 counters.uncountedBillableInflight++;

package/dist/http/server.d.ts

@@ -695,6 +695,10 @@ export interface ServiceDeploymentDeps {
     /** [ref] ②:caps `centerWiring` 的读面(`capabilities/center-wiring.ts` `createCenterWiringReader`;入参 = 请求的已验 principal)。
      *  缺席 = 没接中心(或测试夹具)⇒ 键整个缺席。 */
     centerWiring?: (principal: string | undefined) => import("../capabilities/center-wiring.js").CenterWiring;
+    /** The member git-credential plane's one reading (`sandbox-git-plane.ts`; stage 5 computes it once — config premises + the boot's secret
+     *  seat answer + the static patch judge). Caps `credentialPlane.sandboxGit` projects it as is. Absent = not built by the composition root
+     *  (a fixture) ⇒ the same judge on config alone, the seat counted as not asked. */
+    sandboxGitPlane?: import("../sandbox-git-plane.js").SandboxGitPlane;
     /**
      * Graceful drain — shared mutable state between main.ts (flips `draining` on SIGTERM) and this server:
      *  • while `draining`, NEW model-running submissions (the billable submit paths) get 503 + Retry-After, so an

package/dist/http/stored-body-replay.d.ts

@@ -1,7 +1,7 @@
 /**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(三问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
  * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
- * 三问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
+ * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
  *
  * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
  * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
@@ -28,7 +28,7 @@ export type StoredReplayDeployment = LaneHomeDeployment & {
     readonly autonomy?: Autonomy | undefined;
 };
 /**
- * 三问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号(几问同中时答先中的那一问 ——
+ * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
  * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;

package/dist/http/stored-body-replay.js

@@ -4,13 +4,15 @@ import { entryProblemsFacts } from "../entry-problems.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
 import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
-import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated } from "./checkpoint-ctx.js";
+import { migrationWindowEnd } from "../plugins/one-time-migrations.js";
+import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
         return undefined;
     const stored = storedBodyPermissionMode(ctx.body);
     return entryPermissionMode(stored, floor).effective === stored ? undefined : { stored, floor };
 }
+const RETIRED_KEY_REWRITE_MIGRATION = { promptProfile: "M30" };
 const BUCKET_GATE_CODE = "request.field_invalid";
 function storedPermissions(body) {
     const permissions = body?.settings?.permissions;
@@ -52,6 +54,9 @@ export function storedBodyReplayRefusal(ctx, deployment) {
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));
     if (mode !== undefined)
         return { kind: "permission_mode_reading", ...mode, ...writer };
+    const retiredKey = retiredRequestKeyOf(ctx.body);
+    if (retiredKey !== undefined)
+        return { kind: "retired_request_key", key: retiredKey, rewriteWindowEnd: migrationWindowEnd(RETIRED_KEY_REWRITE_MIGRATION[retiredKey]), ...writer };
     return undefined;
 }
 //# sourceMappingURL=stored-body-replay.js.map

package/dist/http/submit-ctx.js

@@ -8,7 +8,7 @@ function unsealableRefusal(e) {
         status: 409,
         body: refusalBody({
             errorCode: "conflict.checkpoint_ctx_unsealable",
-            message: "this deployment cannot store this task's credentials (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, http hook headers, or command hook plugin options) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
+            message: "this deployment cannot store this task's credentials (static request headers, the command lines and environment values given to MCP stdio servers and command hooks, settings.env, or settings.webSearch.apiKey) for resuming it: they are kept only sealed, and this server has no sealed-key store — nothing was run; ask whoever operates this deployment to give the service a writable sealed-key directory (<data root>/sealed-key/), or submit the task without those credentials",
             facts: { field: e.field, reason: e.reason },
         }),
     };

package/dist/http/wire-types.d.ts

@@ -11,6 +11,31 @@ import type { RequestMcpServerSpec } from "../mcp-assertion-header.js";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 import type { EntryProblem } from "../entry-problems.js";
+/**
+ * 请求面上的一条技能 = core 的 `SkillSpec` 去掉 `mods`(core 7.56.0 [ref] 的技能座扩展注册:带 `register` 函数的代码对象,不是 wire 数据)。
+ * 带 `mods` 的请求技能受理门 400(`http/admission.ts` 的 `validateUserSkills`);本服务不编技能 hooks(能力位 `mods.skill_seat` 恒假)。
+ * 键集仍由 core 本体派生([ref]:core 加键,本型同批跟上;删 `mods` 是唯一的一处减法)。
+ */
+export type RequestSkill = Omit<SkillSpec, "mods">;
+/**
+ * `TaskRequestBody.attachments` 的子键集。本类型是这十个键在导出类型面上的**唯一**声明处;受理门(`http/admission.ts`)与重放翻译口
+ * (`spec-fields.ts` 的 `normalizeAttachments`)读 `spec-fields.ts` 的 `ATTACHMENT_KEY_KINDS` 那一张表,表与本接口互为差集门
+ * (`_GuardAttachmentKeys*`,漏一边 ⇒ tsc 红)。加 / 删一个键:本接口、那张表、`normalizeAttachments` 的逐键赋值三处同批改。
+ */
+export interface TaskRequestAttachments {
+    todoReminder?: boolean;
+    todoReminderMode?: "baseline" | "off";
+    changedFiles?: boolean | {
+        maxFiles?: number;
+    };
+    budgetUsd?: true;
+    backgroundTasks?: boolean;
+    toolsDelta?: boolean;
+    mcpInstructions?: true;
+    agentListing?: boolean;
+    skillsListing?: boolean;
+    mcpUnavailable?: boolean;
+}
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
@@ -114,20 +139,20 @@ export interface TaskRequestBody {
     jobId?: string;
     /** Personalization seam: the caller's OWN skills for this task, threaded into core's
      *  `TaskSpec.skills`. Merged AFTER the scenario's skills with SCENARIO-WINS on a name clash (the security
-     *  baseline can never be shadowed by user content — see mergeUserSkills). User skills are user-authored
+     *  baseline can never be shadowed by user content — see buildRunSkills). User skills are user-authored
      *  content in the user's OWN principal-isolated task (self-harm surface, not privilege widening);
      *  scenario/center skills remain the only trusted layer.
      *
      *  🔴 **类型 = core 的 `SkillSpec` 本体,不是它的手抄子集**([ref]):这里曾写死
      *  `{ name; description; content }` —— core 闭集六位里的三位,而 `manifest` / `files` / `baseDir`
-     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`mergeUserSkills` 原样透传到
+     *  三位在运行期一直是**收的**(受理门 `validateUserSkills` 不判未知键,`buildRunSkills` 原样透传到
      *  `TaskSpec.skills`)。一份会漂的手抄 = 声明面比真受理面**窄**,SDK 消费方按声明写代码就以为发不了,
      *  而 core 加键(7.20.0 [ref] 的 `baseDir`)时这里连红都不会红。改成 core 本体后,闭集由 tsc 看守。
      *  ⚠️ 受理**判据**(形/尺寸)仍在 `validateUserSkills` + `spec-fields.ts` 的 `SKILL_FIELD_SHAPES`——
      *  类型说「哪些键存在」,门说「值合不合法」,两者不是一件事。
      *  (旧注里的「Caps: ≤10 skills, content ≤32KB each」两条帽早已随 [ref] / core 1.293 退役,一并纠正:
      *   今天只剩 `content ≤ 1 MiB` 这一条 core 加载门孪生。) */
-    skills?: SkillSpec[];
+    skills?: RequestSkill[];
     /** §7 P0.5 (用户按需选像): the sandbox image PROFILE this task wants (e.g.
      *  "code-full" / "code-python"). An INTENT, never a digest — the service resolves it to a published digest with
      *  the caller's principal (fail-closed visibility re-admit) and applies it per-pod. Only supported on the k8s
@@ -247,19 +272,7 @@ export interface TaskRequestBody {
      *  boolean 透传(core DEFAULT-ON,explicit false 才关);budgetUsd/mcpInstructions 只认 literal true;
      *  limits 三个 opt-out 只认 literal false(normalizer 同判)。 */
     /** core 7.39.0 [ref]:`planModeReminder` 退役(硬破坏,零别名)—— 提交即 400 点名退役;plan 姿态由引擎从 `permissionMode:"plan"` 自己陈述。 */
-    attachments?: {
-        todoReminder?: boolean;
-        todoReminderMode?: "baseline" | "off";
-        changedFiles?: boolean | {
-            maxFiles?: number;
-        };
-        budgetUsd?: true;
-        backgroundTasks?: boolean;
-        toolsDelta?: boolean;
-        mcpInstructions?: true;
-        agentListing?: boolean;
-        skillsListing?: boolean;
-    };
+    attachments?: TaskRequestAttachments;
     /** C1 (core 1.219, subagent viewing pane): opt-in — forward a delegated child's live CONTENT events
      *  (text_delta/text_end/reasoning_delta/tool_start/tool_end, each stamped `parentToolCallId`) onto this run's stream/durable
      *  log, so a shell can render the child's transcript live ("enter 看详情"). Default OFF = progress-only (prior
@@ -337,9 +350,13 @@ export interface TaskRequestBody {
     /** [ref]② (core 1.314): [ref] 延迟披露清单(占位上 wire,ToolSearch 激活)——cli「Workflow 默认开
      *  不暴露」的承载位。同 excludeTools 的校验/继承姿势。 */
     deferTools?: string[];
-    /** [ref]/[ref] (core 1.328 R2): 提示词双形轴——simple(CC 212 短形,引擎缺省)| classic(长形,可按
-     *  任务/模型试分)。纯呈现轴无租户门;枚举 fail-loud at submit;缺省不挂键。 */
-    promptProfile?: "simple" | "classic";
+    /** core 7.56.0([ref]):提示词形的**唯一**任务开关 —— `true` 加 `lean_prompt` 特征(短形)、`false` 去掉它(长的 classic 形)、
+     *  缺省 = 模型目录条目自己的声明(引擎缺省 lean)。只动这一个特征,不碰其余特征;原样透传进 `TaskSpec.promptLean`,随引擎铸的每个子代走。
+     *  纯呈现轴无租户门;非布尔 400 fail-loud at submit;缺省不挂键。
+     *  退役键 `promptProfile`(7.136.x 及以前的 `"simple" | "classic"`)整键删、零别名:fresh 提交体仍带它 ⇒ 键闭集门 400 `request.body_shape`
+     *  (`unknownKeys:["promptProfile"]`);迁移 = `"classic"` ⇒ `promptLean: false`,`"simple"` ⇒ 不带键。续跑重放不过那道门:盘上 7.136.x 体里的旧键由一次性迁移 M30 在起服时按同一张映射原地改写(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表),
+     *  改写不到的残留行续跑 409(`http/stored-body-replay.ts` 第四问)—— 续跑腿不读旧键。 */
+    promptLean?: boolean;
     /** [ref]②(core 5.14.0 座已在,`TaskSpec.toolMaterializeStrategy`):deferred 工具在**激活之后**怎么给
      *  模型供 schema。`static` = 占位符形不变(激活只改可调用性,广告的 schema 仍是空对象);`swap` = 激活
      *  后下一轮把占位符换成真 schema。
@@ -352,7 +369,7 @@ export interface TaskRequestBody {
      *  core 把 `"static"` 重新定性为「a strict explicit opt-in」)。本注上一版还写着 `?? "static"`,照它推
      *  「不挂键 ⇒ 落 static」会反。缺省词的属主是 core,本仓不复述第二份——要确认取值去读 core 的
      *  `prepare-task` 与其 CHANGELOG。
-     *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 promptProfile/permissionMode 同姿势 ——
+     *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 permissionMode 同姿势 ——
      *  静默折缺省会让调用方以为切了策略却没切)。 */
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
@@ -363,7 +380,7 @@ export interface TaskRequestBody {
      *  `deniedBy:"mode"`); none can subtract from deployment/operator policy or the request's own deny / ask rules (tightenTaskSpec
      *  deny-wins). The top-level word wins over `settings.permissions.defaultMode` (the heavier bundle) — one precedence, read in one place.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
-     *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
+     *  toolMaterializeStrategy) instead of silently coercing to `default`; resume replay of a stored body stays lenient
      *  (coercePermissionMode).
      *  🔴 型与闭集的属主是 core 的 `PermissionMode` / `PERMISSION_MODES`(受理腿 `isPermissionMode` 与三句 400 文案同读那一份)—— 本仓不持词表。 */
     permissionMode?: PermissionMode;
@@ -432,7 +449,7 @@ export interface TaskRequestBody {
     cwd?: string;
     /**
      * [ref](7.106.0,core [ref] [ref] ②)—— 模型驱动的 host shell **继承多少用户环境**,由调用方按请求声明。
-     * 闭集两词(词表外 ⇒ 400 `request.field_invalid`,两腿同判,判据属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
+     * 闭集两词(词表外 ⇒ 400 `request.field_invalid` + 机读位 `field: "inheritEnv"` / `reason`〔`unknown_word` | `not_a_string`〕,两腿同判,判据与机读位的属主 `request-value-closure.ts` 的 `inheritEnvFieldIssue`):
      *  · `"all"` —— 整份用户环境**减本服务自有凭据名**(配置目录 secret 名 / 名单型旋钮名 / 模型条目 `apiKeyEnv`,起服向引擎声明一次,判在引擎;7.129.0 起,CC 交互形);只在**单用户**部署兑现,射程 = 写容纳面那一只
      *    部署形表行 `taskHostPostureDeclarations`(`deployment-shape.ts`)⇒ 托管部署(`REQUIRE_PRINCIPAL=true`)响亮拒
      *    422 `request.host_posture_refused`;
@@ -440,7 +457,7 @@ export interface TaskRequestBody {
      * **缺席 = 缺省清洗**:不带键的请求把本会话的绑定清掉(不继承上一条请求的声明 —— 这一位是「本条请求要什么」,
      * 粘到下一条上就是替一个没说话的请求放宽)。名单形(`string[]`)**不上 wire**(那是嵌入方构造执行环境的选项)。
      * 🔒 **只有 host 车道有消费点**:别的车道(e2b / k8s / local-docker / ssh / adb / device / in-process)带 `"all"` ⇒
-     * 400 `request.field_invalid`「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
+     * 400 `request.field_invalid`(`reason: lane_not_host`)「applies to the host lane only」,不静默忽略、不映射到别的车道的 env 名单;`"scrub"` 在那些车道上照受理(无消费点,无害)。
      * Rides the persisted body onto resume legs:重放照射程与车道重判(部署由单用户改托管后 revive ⇒ 同一只拒,
      * resume-legs 折成 `409 resume_blocked_by_policy`)。
      */
@@ -541,12 +558,14 @@ export interface TaskRequestBody {
      *  声明被接收、server 照常挂载但不带断言头,并有一行运维 info `mcp_assertion_header_not_sent { server }`;发送随引擎座。 */
     mcpServers?: RequestMcpServerSpec[];
     /** [DESIGN-269 车1] Caller-supplied per-request A2A peers (remote agents this task may call), aligned to
-     *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment that has neither locked the `a2a` key nor
-     *  had `a2a_peers` denied by its compliance posture (task-a2a.ts `a2aInjectionHonored`, the same three-veto
+     *  core `A2aServerSpec`. 🔒 honored on a SINGLE-USER deployment (task-a2a.ts `a2aInjectionHonored`, the same
      *  predicate `capabilities.a2aInjection` advertises) — the requester is the super-admin of their OWN worker,
      *  on ANY execution lane (an A2A call is a plain outbound HTTPS request from the worker, so the lane where
      *  tool calls run is irrelevant); IGNORED on multi-tenant (a tenant can't point the shared worker at an
-     *  agent of their choosing). A locked deployment refuses the whole request instead: 400 `config.locked_key`.
+     *  agent of their choosing). A2A has no operator lock and no compliance capability today. A new submission
+     *  with a malformed list or entry is refused 400 (`assertRequestA2aEntries`: not an array / over the 32-entry
+     *  cap / an entry that is not an object / a key outside {@link A2A_PEER_ENTRY_KEYS} / a key whose value is
+     *  unusable / a url or cardUrl carrying a credential) — the same refusal shape as `mcpServers`, whatever the lane.
      *  🔴 Every skill a peer advertises mounts `egress:true` + `effect:"write"` (core's ruling) — declaring a
      *  peer is declaring an outbound WRITE channel, not a data source. Validated + gated downstream; the
      *  center/config baseline wins on a name clash (the peer name IS the tool namespace). */
@@ -584,12 +603,20 @@ export type DecideBinding = {
      *  mints carry it verbatim when present — the engine owns what counts as written (blank = nothing) and judges it again pre-CAS. */
     feedback?: string;
 };
-/** [ref]([ref]④→[ref] 坐标轮换判定):409 `approval_stale` 拒体上的 additive 机读指路 ——
+/** 409 `approval_stale` 拒体的 additive 机读指路 `currentPending`:**本会话此刻在这道门上待决的那道门**的回显坐标 = 这道门的决断体回显的那几位
+ *  (一条规则,两道决断门各一形):`/decide` ⇒ {@link DecideStaleCurrentPending};计划审阅([ref])⇒ {@link PlanReviewStaleCurrentPending}。
+ *  🔴 恒**不含** checkpointToken(resume 凭证从不外发);只在当前门在场、属这道门的门型、且已过属主门的域内铸 —— 否则键缺席(不造键)。 */
+export type ApprovalStaleCurrentPending = DecideStaleCurrentPending | PlanReviewStaleCurrentPending;
+/** [ref]:计划审阅门的回显坐标 = 门身份 `checkpointId`(过信任边界的那个值;当前门说不出身份 ⇒ 整个 `currentPending` 缺席)。 */
+export type PlanReviewStaleCurrentPending = {
+    /** 当前待决 plan_review 门的非秘密身份 —— 壳据此重取那道门的计划给人看,再带它决。 */
+    checkpointId: string;
+};
+/** [ref]([ref]④→[ref] 坐标轮换判定):`/decide` 那一形 ——
  *  **本会话当前 pending** 的 D-1 回显坐标,让持旧坐标的壳一跳重定位(免重拉列表)。
  *  键名/键形与 GET /v1/approvals 的 pending 行逐字同名(壳复用同一解析)。
- *  🔴 恒**不含** checkpointToken(runs.ts §12-C:resume 凭证从不外发);只在当前 pending **在场**、
- *  属 tool_approval、且已过路由级 owner 门的域内铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
-export type ApprovalStaleCurrentPending = {
+ *  只在当前 pending 属 tool_approval 时铸 —— 无 pending / 非工具门 / 读失败 ⇒ 键缺席(不造键)。 */
+export type DecideStaleCurrentPending = {
     /** 当前 pending 被门住的工具名(与 pending 行的 `toolName` 同源同值)。 */
     toolName: string;
     /** 当前 pending 的 `pendingAction.toolCallId` —— 壳重定位后 decide 时回显的 D-1 锚。 */