@sema-agent/server 7.136.0 → 7.137.0

package/dist/file-history-disclosure.js

@@ -46,6 +46,8 @@ function faultOfClass(cls) {
     switch (cls) {
         case "connection":
             return { permanence: "transient" };
+        case "deployment":
+            return { permanence: "terminal" };
         case "corrupt":
         case "unclassified":
             return {};

package/dist/hooks/classic-stations.d.ts

@@ -2,8 +2,8 @@
  * 引擎的 `classic.*` 站 —— 本仓挂 handler 的唯一入口(core 7.52.0 起扩展点 = mods 注册,`Hooks` 记录退役)。
  *
  * 三件事只写在这里:
- *  ① **事件名 → { `e` 型, 答案型 }**:core 逐个导出了每站的 `e` 型与答案型,但没有导出二者的映射(宿主侧配对是今天的唯一读法)。
- *     这张对位表是那一配对的唯一一份;core 导出映射型的那一版,本表改读它、删掉手写的十一行。
+ *  ① **事件名 → { `e` 型, 答案型 }**:读 core 的 `ClassicEventMap`(7.56.0 起包根导出;此前本文件手写十一行配对,随之删)。
+ *     每站的角色(链 / 观察)由 {@link CLASSIC_STATION_ROLE} 说,它在编译期对着 core 的答案形核:答案形是 `ObservedAnswer` 的站必须是 `observe`、其余是 `chain`。
  *  ② **handler 怎么挂**:链成员「无意见 ⇒ `next(e)`」(链 handler 返回 `undefined` 是站点违约,refuse 站上即 fail-closed 拒),
  *     观察者「恒返回 `undefined`」(观察者的判词不采纳、被引擎报告)。两条都在 {@link hangClassic} / {@link observeClassic} 里成形,
  *     调用方只写「这一站我答什么」或「这一站我看什么」,不再各自记得这两条。
@@ -13,55 +13,9 @@
  * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
  * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
  */
-import type { EngineDollar, On, PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "@sema-agent/core";
-/** 每一站的 `e` 型与答案型(答案 `void` = 观察站)。 */
-export interface ClassicStationTypes {
-    "classic.PreToolUse": {
-        e: PreToolUseEvent;
-        answer: PreToolUseResult;
-    };
-    "classic.PostToolUse": {
-        e: PostToolUseEvent;
-        answer: PostToolUseResult;
-    };
-    "classic.PostToolUseFailure": {
-        e: PostToolUseFailureEvent;
-        answer: PostToolUseFailureResult;
-    };
-    "classic.PostToolBatch": {
-        e: PostToolBatchEvent;
-        answer: PostToolBatchResult;
-    };
-    "classic.UserPromptSubmit": {
-        e: UserPromptSubmitEvent;
-        answer: UserPromptSubmitResult;
-    };
-    "classic.Stop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.SubagentStop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.StopFailure": {
-        e: StopFailureEvent;
-        answer: void;
-    };
-    "classic.PreCompact": {
-        e: PreCompactEvent;
-        answer: PreCompactResult;
-    };
-    "classic.PostCompact": {
-        e: PostCompactEvent;
-        answer: void;
-    };
-    "classic.PermissionDenied": {
-        e: PermissionDeniedPayload;
-        answer: void;
-    };
-}
-export type ClassicStation = keyof ClassicStationTypes;
+import type { ClassicEventMap, ClassicEventName, EngineDollar, On } from "@sema-agent/core";
+/** 引擎有站的 `classic.*` 名(core 的 `ClassicEventMap` 键集)。 */
+export type ClassicStation = ClassicEventName;
 /** 每一站能挂什么:`chain` = 链成员(会作答)与观察者都可;`observe` = 只许观察者。 */
 export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PreToolUse": "chain";
@@ -76,16 +30,19 @@ export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PostCompact": "observe";
     readonly "classic.PermissionDenied": "observe";
 };
+/** 本仓 handler 体对一站作的答:观察站不作答(`void`);链站 = core 的答案形,去掉本仓从不作的 `null` / `false`(PreToolUse 的两个「不表态」词)。 */
+type StationAnswer<K extends ClassicStation> = (typeof CLASSIC_STATION_ROLE)[K] extends "observe" ? void : Exclude<ClassicEventMap[K]["answer"], null | false>;
 /**
  * 一站的 handler 体:读 `e`,答这一站的答案;`undefined` = 无意见(链成员由 {@link hangClassic} 交给 `next(e)`)。
  * `signal` = 引擎交给这只 handler 的 `next.signal`(预算到 ∪ 派发被取消;见头注 ③)。
  */
-export type ClassicAnswer<K extends ClassicStation> = (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => Promise<ClassicStationTypes[K]["answer"] | undefined>;
+export type ClassicAnswer<K extends ClassicStation> = (e: ClassicEventMap[K]["e"], signal: AbortSignal) => Promise<StationAnswer<K> | undefined>;
 /**
  * 按站的角色挂一只 handler:链站 ⇒ 链成员 `(await answer(e)) ?? next(e)`;观察站 ⇒ 观察者(体照跑、恒返回 `undefined`)。
- * `e` 的型由 {@link ClassicStationTypes} 给(引擎交来的是本站的 `e`;配对见头注 ①)。
+ * `e` 的型由 core 的 `ClassicEventMap` 给(引擎交来的是本站的 `e`;见头注 ①)。
  */
 export declare function hangClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, answer: ClassicAnswer<K>): void;
 /** 挂一只观察者(任何站都可):拿分离副本、不进链、恒返回 `undefined`;`signal` 同 {@link ClassicAnswer}。 */
-export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicEventMap[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export {};
 //# sourceMappingURL=classic-stations.d.ts.map

package/dist/http/admission.js

@@ -12,7 +12,7 @@ import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHisto
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
-import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { ATTACHMENT_BOOLEAN_KEYS, ATTACHMENT_KEYS, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
 import { fieldConflictFacts } from "../field-conflict.js";
@@ -78,6 +78,8 @@ function userSkillShapeIssue(item, index) {
     }
     if (skillCarriesRetiredManifest(s))
         return { message: SKILL_MANIFEST_RETIRED };
+    if (s["mods"] !== undefined)
+        return { message: "skill.mods is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)" };
     for (const key of ["allowedTools", "disallowedTools"]) {
         if (s[key] !== undefined && !skillToolListOk(s[key]))
             return { message: `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))` };
@@ -457,7 +459,7 @@ export function createAdmission(ctx) {
         {
             const inheritEnvIssue = inheritEnvFieldIssue(body);
             if (inheritEnvIssue) {
-                sendError(res, 400, "request.field_invalid", inheritEnvIssue);
+                sendError(res, 400, "request.field_invalid", inheritEnvIssue.message, inheritEnvIssue.facts);
                 return null;
             }
         }
@@ -618,9 +620,9 @@ export function createAdmission(ctx) {
             }
         }
         {
-            const v = body.promptProfile;
-            if (v !== undefined && v !== "simple" && v !== "classic") {
-                sendError(res, 400, "request.field_invalid", 'promptProfile must be "simple" or "classic"');
+            const v = body.promptLean;
+            if (v !== undefined && typeof v !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "promptLean must be a boolean");
                 return null;
             }
         }
@@ -687,7 +689,8 @@ export function createAdmission(ctx) {
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
+                const attachmentKeyList = ATTACHMENT_KEYS.map((k) => `${k}?`).join(", ");
+                sendError(res, 400, "request.field_invalid", `attachments must be an object { ${attachmentKeyList} }`);
                 return null;
             }
             const rec = a;
@@ -695,7 +698,7 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", 'attachments.planModeReminder was retired in core 7.39.0 — the engine now states plan posture itself whenever the permission mode is "plan" (first request, periodic reminders, exit frame); remove the key (send permissionMode "plan" for plan posture)');
                 return null;
             }
-            for (const k of ["todoReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
+            for (const k of ATTACHMENT_BOOLEAN_KEYS) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
                     sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;

package/dist/http/approval-sweeps.js

@@ -1,5 +1,6 @@
 import { redactHead } from "../observability/run-terminal.js";
 const errText = (e) => redactHead(e instanceof Error ? e.message : String(e), 2000);
+import { checkpointRevOf } from "@sema-agent/core";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
 import { hostDecisionFacts } from "../host-decision.js";
@@ -89,7 +90,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(token);
                 if (!cp)
                     return { token, parked: false, rev: undefined };
-                const rev = cp.rev ?? 0;
+                const rev = checkpointRevOf(cp);
                 if (!parkSources)
                     return { token, parked: false, rev };
                 const origin = await findParkOrigin({
@@ -120,7 +121,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(cardToken);
                 if (!cp)
                     return;
-                if (cp.status !== "pending" || (cp.rev ?? 0) !== observedRev) {
+                if (cp.status !== "pending" || checkpointRevOf(cp) !== observedRev) {
                     deps.logger?.warn?.("deny_sweep_policy_blocked_expire_skipped", { sessionId, skipReason: cp.status !== "pending" ? "not_pending" : "card_changed", ...blockedScalars(body) });
                     return;
                 }
@@ -177,7 +178,7 @@ export function createApprovalSweeps(ctx) {
             deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
                 count: replaySkipped.length,
                 skipped: replaySkipped,
-                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind inert_tool_list: a tool-list entry (a skill disallowedTools, an agent definition's denyTools / allowTools or the request's excludeTools / allowTools) the engine reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (skipped[].kind names the rule that refused each one; the resume paths log the same kinds with a reason per kind), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/caller-trust.d.ts

@@ -8,7 +8,8 @@
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;
- *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读(与凭据门派 `source` 同序:`dispatch.ts` 先认 service 凭据);
+ *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读 —— 这不是本表的判:来源只有一只判定次序(`verifiedIdentitySource`,
+ *    service 凭据先;凭据门的 401 / 归因 / run 行身份元组读同一次的答案),本表只按来源词分档;
  *  · 多租 · 中心登录令牌,scope 角色 ≥ 契约 `domainWriteRole("governance")` ⇒ `global`:能写 scope 治理域(autonomy / commandPolicy / approvalRequire,全组织的免问面)
  *    的角色,放宽自己这一 run 是它的子集;门槛读契约,不手抄角色词;
  *  · 多租 · 其余(登录令牌角色低于它 / 不带 / 认不出;直连门 principal 令牌只证身份不证角色;没有验过的凭据)⇒ `project`:契约给非运维档作者的仓控来源的档,

package/dist/http/caller-trust.js

@@ -1,7 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
-import { systemFor, verifiedIdentitySource } from "./principal-gate.js";
+import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
         return { trust: "global", basis: "single_user" };
@@ -10,8 +10,6 @@ export function callerTrust(req, config) {
         case "service_token":
             return { trust: "global", basis: "service_credential" };
         case "sso": {
-            if (systemFor(req, config) !== undefined)
-                return { trust: "global", basis: "service_credential" };
             const role = ssoVerifiedRole(req);
             if (role === undefined || !isRole(role))
                 return { trust: "project", basis: "sign_in_role_unrecognized" };

package/dist/http/checkpoint-ctx.d.ts

@@ -31,8 +31,14 @@
  * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
  * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
  *
+ * ## 第四问(7.137.0):体里的退役请求键
+ * 请求键退役之后(今天一只:`promptProfile` 换成布尔 `promptLean`,{@link RETIRED_REQUEST_KEYS}),新提交带它在键闭集门 400;存体里的旧键由一次性迁移在起服时原地改写
+ * (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
+ * 旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ * 也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
+ *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
  * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
@@ -110,6 +116,23 @@ export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
  */
 export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
+/**
+ * 第四问:**退役的请求键**闭集(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下、一次性迁移没改写到的)。加一个 ⇒ 加一行,
+ * {@link retiredRequestKeyRefusal} 的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
+ */
+export declare const RETIRED_REQUEST_KEYS: readonly ["promptProfile"];
+export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
+/** 存体顶层带的第一只退役请求键(闭集序);没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
+export declare function retiredRequestKeyOf(body: unknown): RetiredRequestKey | undefined;
+/**
+ * 第四问的拒答复 —— 码与落点同另两只读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: <整句双引号字面 或 一只模板串>`,中间只许有空白(模板串形冻结的是骨架,`${…}` 折成一个洞)。
+ * **窗的日期不手写**:`rewriteWindowEnd` 由调用方交 —— 判据(`stored-body-replay.ts`)按「退役键 → 改写它的迁移」那张表读登记表该行的 `removableAfter`,窗只写在登记表一处;
+ * 句子写绝对日期(过了这一天读句子的人一眼看出出路已关,不靠「本版发布日」这种随版漂的说法)。
+ * 删法见登记表 M30 的 `removal`(唯一来源)。
+ */
+export declare function retiredRequestKeyRefusal(key: RetiredRequestKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -127,7 +150,7 @@ export declare function allowListReadingEraOf(ctx: CheckpointCtx): AllowListRead
 export declare function allowListReadingRefusal(era: AllowListReadingEra): ResumeRefusalAnswer;
 /**
  * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
- * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ * 答 `checkpoint.unsupported_version` 的三臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
  */
 export type StoredBodyReplayRefusal = {
     readonly kind: "allow_list_reading";
@@ -141,10 +164,16 @@ export type StoredBodyReplayRefusal = {
     readonly stored: PermissionMode | undefined;
     readonly floor: PermissionMode;
     readonly writerVersion?: string;
+} | {
+    readonly kind: "retired_request_key";
+    readonly key: RetiredRequestKey;
+    /** 改写这只退役键的一次性迁移窗的最后一天(UTC 日历日 YYYY-MM-DD)—— 登记表那一行的 `removableAfter`,由判据(`stored-body-replay.ts`)读来:本模块的闭包只许 node 内建 / 引擎包根,读不了登记表,日期只能由调用方交。 */
+    readonly rewriteWindowEnd: string;
+    readonly writerVersion?: string;
 };
 /**
- * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
- * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的三只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法 / 退役请求键三臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
  * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
  * (本模块零值依赖,不自取)。纯数据。
  */
@@ -201,11 +230,12 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
+    key?: RetiredRequestKey;
     note: string;
 };
 /**
  * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这三只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  *
  * 🔴 `cardPending` —— **调用方交出的事实**:这一次拒的时候,有没有一张待批卡仍在等。`retriable:true` 说的恰是「卡仍 pending」,所以它只在卡在时在场(经
@@ -356,9 +386,10 @@ export type StoredCheckpointCtx = Omit<CheckpointCtx, "body"> & {
 };
 declare const sealedCheckpointCtxBrand: unique symbol;
 /**
- * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移 M28 的行改写只收它 ⇒ 「写 ctx 只有封口一个写入面」由型面守,
+ * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)只收它 ⇒ 「写 ctx 只有本模块的铸点一个写入面」由型面守,
  * 不再靠逐个数调用点(把开封形 / 裸对象直接交给写口 = 当场 tsc 红)。铸点闭集(都在本模块,都经 {@link mintSealedCheckpointCtx}):
- * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)与 {@link sealStoredCheckpointCtxM28}。零运行期变化。
+ * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)、{@link sealStoredCheckpointCtxM28} 与 {@link rewriteStoredBodyKeys}
+ * (存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)。零运行期变化。
  */
 export type SealedCheckpointCtx = StoredCheckpointCtx & {
     readonly [sealedCheckpointCtxBrand]: true;
@@ -407,5 +438,15 @@ export declare function sealStoredCheckpointCtxM28(stored: object, sealer: Check
     readonly ctx: SealedCheckpointCtx;
     readonly valuesSealed: number;
 } | undefined;
+/**
+ * 🔴 **一次性迁移对存量行非凭据顶层体键的改写**(品牌铸点之三;今天的调用方 = M30 的行改写 `stored-request-prompt-profile-m30.ts`):在一行落盘形的体上删 `drop` 里的顶层键、
+ * 设 `set` 里的顶层键,其余一个字节不动 —— 行上的读法记号(凭据封口的 `credentialSeal` / `credentialSlotGeneration` 与另两只记号)与凭据位上的值原样随行:封好的行仍是封好的,
+ * 更早写者留下的明文行仍是明文(读口照旧拒 `plaintext`,本口不替它洗白)。`drop` / `set` 碰到凭据位的根键(闭集各行路径的第一段)或 `__proto__` ⇒ 抛(程序错,不是数据错)。
+ * 体不是对象 ⇒ 抛(店的判形保证 ctx 是对象;体坏形的行由调用方先判、不交来)。
+ */
+export declare function rewriteStoredBodyKeys(stored: object, edit: {
+    readonly drop: readonly string[];
+    readonly set?: Readonly<Record<string, unknown>>;
+}): SealedCheckpointCtx;
 export {};
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -39,6 +39,28 @@ export function permissionModeReadingRefusal() {
         }),
     };
 }
+export const RETIRED_REQUEST_KEYS = ["promptProfile"];
+export function retiredRequestKeyOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    return RETIRED_REQUEST_KEYS.find((key) => Object.hasOwn(body, key));
+}
+export function retiredRequestKeyRefusal(key, rewriteWindowEnd) {
+    switch (key) {
+        case "promptProfile":
+            return {
+                status: 409,
+                body: refusalBody({
+                    errorCode: "checkpoint.unsupported_version",
+                    message: `this task was suspended by an earlier server version and its stored request still carries promptProfile, a request key this version no longer reads (it was replaced by the boolean promptLean: classic is promptLean: false, simple is leaving promptLean out), so continuing would run the task with a prompt form it was not submitted with. Nothing was decided and nothing was resumed. If whoever operates this deployment restarts this server on or before ${rewriteWindowEnd} (UTC), the stored request is rewritten in place and the same request can be sent again; otherwise submit the work again as a new task with promptLean in place of promptProfile, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).`,
+                }),
+            };
+        default: {
+            const unhandled = key;
+            throw new Error(`retired request key ${String(unhandled)} has no refusal sentence`);
+        }
+    }
+}
 export function allowListReadingUnstated(ctx) {
     if (!bodyCarriesAllowList(ctx.body))
         return false;
@@ -96,6 +118,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
+        case "retired_request_key":
+            return { kind: refusal.kind, key: refusal.key, note: "this session's stored request still carries a request key this version retired, and the one-time rewrite at startup did not reach it (no startup of this version inside its window since the row was written); it is not replayed — the task stays suspended until someone cancels it, or a restart of this version inside the window rewrites the row" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -117,6 +141,10 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
+        case "retired_request_key": {
+            const answer = retiredRequestKeyRefusal(refusal.key, refusal.rewriteWindowEnd);
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);
@@ -321,4 +349,16 @@ export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
         ? undefined
         : { ctx: mintSealedCheckpointCtx({ ...stored, body: sealed, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation }), valuesSealed };
 }
+const CREDENTIAL_SLOT_ROOTS = new Set(CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.path[0]));
+export function rewriteStoredBodyKeys(stored, edit) {
+    const touched = [...edit.drop, ...Object.keys(edit.set ?? {})];
+    const forbidden = touched.filter((key) => CREDENTIAL_SLOT_ROOTS.has(key) || key === "__proto__");
+    if (forbidden.length > 0)
+        throw new Error(`rewriteStoredBodyKeys: ${forbidden.join(", ")} is a credential-slot root (or __proto__) — a one-time body-key rewrite never touches those`);
+    const body = stored.body;
+    if (!isRecord(body))
+        throw new Error("rewriteStoredBodyKeys: the stored row's body is not an object");
+    const next = Object.fromEntries([...Object.entries(body).filter(([key]) => !edit.drop.includes(key)), ...Object.entries(edit.set ?? {})]);
+    return mintSealedCheckpointCtx({ ...stored, body: next });
+}
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/dispatch.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { setSsoPrincipal, setSsoScope, setSsoRole, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity } from "../auth-bridge.js";
@@ -9,7 +9,7 @@ import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
-import { actsForDeployment, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
+import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
     if (!hasServiceAuth(config))
@@ -228,22 +228,27 @@ export function createDispatch(ctx) {
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx))
             return;
+        const identitySource = verifiedIdentitySource(req, deps.config);
+        admitRunIdentity(req, identitySource);
         let source = null;
         const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {
-            const sys = systemFor(req, deps.config);
-            if (sys === undefined) {
-                if (ssoVerifiedPrincipal(req)) {
+            switch (identitySource) {
+                case "service_token":
+                    source = systemFor(req, deps.config) ?? null;
+                    break;
+                case "sso":
                     source = "sso";
-                }
-                else {
+                    break;
+                case "direct_door_jwt":
+                case undefined:
                     sendUnauthorized(res, "credential");
                     return;
+                default: {
+                    const unknownSource = identitySource;
+                    throw new Error(`credential gate: identity source ${String(unknownSource)} has no gate row`);
                 }
             }
-            else {
-                source = sys;
-            }
         }
         reqState.source = source;
         if (!anyServiceAuth &&

package/dist/http/durable-run-leg.d.ts

@@ -1,6 +1,7 @@
 import type { RunStore } from "../plugins/store-backend.js";
 import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { PreparedTaskSubmission, RouteCtxBase, WorkflowDecisionDelivery } from "./route-ctx.js";
+import type { RunIdentity } from "../identity-source.js";
 export interface DurableRunLegArgs {
     /** `prepareSpec` 的产物,或内部车道按同一条 `resolveSpec` 装配出来的等价形。 */
     prepared: PreparedTaskSubmission;
@@ -18,8 +19,11 @@ export interface DurableRunLegArgs {
      *  提交门传 `gatedPrincipal(req) ?? null` = 提交者本人;`/decide` 的第三条车道传**卡属主**(= 原提交者,
      *  不是代为按下按钮的 operator —— 与 resume 腿那条成文口径逐字同源)。`null` = 匿名/开放部署。 */
     elicitOwner: string | null;
-    /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。 */
+    /** run 行元数据的 `source` 列(调用方的系统身份;内部车道传自己的车道名)。只作归因。 */
     source: string | null;
+    /** run 行身份元组(`RunRecord.identity`)—— 调用方经 `runIdentityOf(req, config, 属主)` 读凭据门铸下的那一份交进来(本腿不碰请求);
+     *  属主 = `prepared.auth.principal`(本腿建行写进 `owner` 的同一个值)。`/decide` 第三条车道同一只读法:按下按钮的不是卡属主 ⇒ 空。 */
+    identity: RunIdentity | null;
     /** `/decide` 第三条车道的 fresh 投递腿交来的那一件决定投递(带着的决定 + 起跑之前落行的那一笔;语义与 TRUSTED 纪律的属主 =
      *  `route-ctx.ts` 的 {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊本会话已受理的决定行。 */
     workflowDecision?: WorkflowDecisionDelivery;

package/dist/http/durable-run-leg.js

@@ -19,7 +19,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const sessionId = args.prepared.spec.sessionId ?? uuidv7();
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), idem: args.idem ?? null });
+    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)

package/dist/http/health-self-report.d.ts

@@ -4,7 +4,7 @@
  *
  * ## 规则(一条):自报位是**投影**,不是第二份规则
  * 每一位读的是**门本身读的那只谓词 / 那只取值口**,本模块不判任何东西:
- *  · `auth.kinds` = `IDENTITY_SOURCES`(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
+ *  · `auth.kinds` = `IDENTITY_SOURCES`(`identity-source.ts`;`verifiedIdentitySource` 的回值闭集,序 = 判定次序)里,这台部署的装配**能**回的那几个词 —— 取唯一读法 `wiredIdentitySources`
  *    (`principal-gate.ts`;「这台部署有没有身份边界」的门 `devOpenDeployment` 读同一只):
  *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
  *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
@@ -33,7 +33,7 @@
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
  */
 import type { FlatServiceDeps } from "./server.js";
-import { type IdentitySource } from "./principal-gate.js";
+import type { IdentitySource } from "../identity-source.js";
 /** `auth.identityAttach` 的词表。 */
 export declare const IDENTITY_ATTACH_WORDS: readonly ["available", "unavailable"];
 export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];

package/dist/http/mcp-remote-text.d.ts

@@ -0,0 +1,5 @@
+/** 远端可控自由文本在这几面上的长度上界(字符)。 */
+export declare const MCP_REMOTE_TEXT_MAX = 200;
+/** 引擎铸过的 MCP 远端失败句 → 本服务出口的形:引擎没抹的段过本仓脱敏器、引擎的记号原样,截到 {@link MCP_REMOTE_TEXT_MAX}。 */
+export declare function redactMcpRemoteText(text: string): string;
+//# sourceMappingURL=mcp-remote-text.d.ts.map

package/dist/http/mcp-remote-text.js

@@ -0,0 +1,7 @@
+import { redactSecrets } from "../trace/redact.js";
+const ENGINE_REDACTION_MARK = "[redacted]";
+export const MCP_REMOTE_TEXT_MAX = 200;
+export function redactMcpRemoteText(text) {
+    return text.split(ENGINE_REDACTION_MARK).map((part) => redactSecrets(part)).join(ENGINE_REDACTION_MARK).slice(0, MCP_REMOTE_TEXT_MAX);
+}
+//# sourceMappingURL=mcp-remote-text.js.map

package/dist/http/principal-gate.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import { type DurableOwnerKey, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
+import { type IdentitySource, type RunIdentity } from "../identity-source.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
 export declare function headerStr(v: string | string[] | undefined): string | undefined;
 export declare function safeEqual(a: string, b: string): boolean;
@@ -18,19 +19,23 @@ export declare function traceTokenPresented(req: IncomingMessage, config: Servic
 /** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
 export declare function isLoopbackAddress(addr: string | undefined): boolean;
 /**
- * 验过的身份来源的**闭集**(序 = `/health.auth.kinds` 的出现序)。{@link verifiedIdentitySource} 的回值就是这张表的词;
- * `/health` 的自报位(`http/health-self-report.ts`)读同一张表,答「这台部署的装配**能**回哪几个词」—— 加一个来源 = 加一个词,
- * 两边各自的穷举 `switch` 不接就编译红。
+ * 🔴 **这次请求验过的身份来源 —— 全仓唯一的判定次序**:按 {@link IDENTITY_SOURCES} 的序逐词问,答第一个验得过的词(次序与它为什么是这个次序见
+ * `identity-source.ts` 头注律 1:出示了 service 凭据就是 `service_token`)。缺席 = 只有自述头或什么都没有。
+ * 读者:凭据门(`dispatch.ts`:401、归因 `source` 与 run 行身份元组读同一次的答案)、调用方信任档(`caller-trust.ts`)、门前读路谓词、
+ * off-box 诊断门(只判有无:名单只在有可验身份时才是身份,零凭据下它只是谁都能写的字符串)。
  */
-export declare const IDENTITY_SOURCES: readonly ["service_token", "sso", "direct_door_jwt"];
-export type IdentitySource = (typeof IDENTITY_SOURCES)[number];
+export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): IdentitySource | undefined;
 /**
- * 这次请求的身份是不是**密码学验过**的(而不是调用方自述的 header):`sso` = registry JWT(入口预认证的签名真源)/
- * `direct_door_jwt` = direct-door principal JWT 验过 / `service_token` = 出示了单一或 per-system service token。
- * 缺席 = 只有自述头或什么都没有。一处判定(7.63.0 codex [high]+[medium]):off-box 读 operator 面的门用它——名单只在
- * 有可验身份时才是身份,零凭据下它只是谁都能写的字符串;而 JWT 身份不依赖静态 token 的在场。
+ * 🔴 **run 行身份元组的唯一铸点**(律见 `identity-source.ts` 头注;唯一调用点 = `dispatch.ts` 的凭据门,机器门钉着)。`source` = 凭据门那一次
+ * {@link verifiedIdentitySource} 的答案 —— 这里不再判来源,只把来源连同它的 scope / 化身号定成元组,挂在这个请求上;建 run 行的点经 {@link runIdentityOf} 读它。
  */
-export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): IdentitySource | undefined;
+export declare function admitRunIdentity(req: IncomingMessage, source: IdentitySource | undefined): void;
+/**
+ * 建 run 行时写进行里的身份元组 —— 每个 `createRun` 调用点(或替它建行的腿的调用方)读这一只,原样写入(机器门:`src/http/**` 每处 `createRun` 都写明 `identity`)。
+ * 只在**受理请求验过的主体就是这一行的属主**时交出凭据门铸下的元组(提交面恒成立:行的属主就是这个主体);别人替属主按下的那一跑(唤醒、决定投递铸的
+ * 新一跑)⇒ 空 —— 属主本人的凭据没有在这次受理里出示过(律 3)。没有请求 / 请求没过凭据门 ⇒ 空。
+ */
+export declare function runIdentityOf(req: IncomingMessage | undefined, config: ServiceConfig, owner: string | null): RunIdentity | null;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): Principal | undefined;
 /**
  * 「**出示了凭证但验不过** ≠ **没出示**」在 **direct-door principal JWT** 面上的形 —— 本仓