@sema-agent/server 7.136.0 → 7.138.0

package/dist/gate-settlement.js

@@ -0,0 +1,40 @@
+export const NO_SETTLEMENT_EVIDENCE = Object.freeze({});
+const settled = (gate) => ({
+    decisionCommitted: true,
+    ...(gate.checkpointId !== undefined ? { checkpointId: gate.checkpointId } : {}),
+});
+export function buildSettlementEvidence(crossing) {
+    switch (crossing.at) {
+        case "engine_accepted":
+        case "engine_terminal": {
+            const c = crossing.commitment;
+            switch (c.kind) {
+                case "gate_resolved":
+                    return settled(c);
+                case "delivered":
+                    return NO_SETTLEMENT_EVIDENCE;
+                default: {
+                    const unhandled = c;
+                    throw new Error(`unhandled gate commitment: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+        case "replay_matched":
+            return settled({});
+        case "agent_revived":
+        case "card_voided":
+            return settled(crossing.gate);
+        default: {
+            const unhandled = crossing;
+            throw new Error(`unhandled settlement crossing: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function withoutSettlementEvidence(body) {
+    const { decisionCommitted: _committed, checkpointId: _identity, ...rest } = body;
+    return rest;
+}
+export function decisionCommittedOf(out) {
+    return out.status === 200 && out.body.decisionCommitted === true;
+}
+//# sourceMappingURL=gate-settlement.js.map

package/dist/hooks/classic-stations.d.ts

@@ -2,8 +2,8 @@
  * 引擎的 `classic.*` 站 —— 本仓挂 handler 的唯一入口(core 7.52.0 起扩展点 = mods 注册,`Hooks` 记录退役)。
  *
  * 三件事只写在这里:
- *  ① **事件名 → { `e` 型, 答案型 }**:core 逐个导出了每站的 `e` 型与答案型,但没有导出二者的映射(宿主侧配对是今天的唯一读法)。
- *     这张对位表是那一配对的唯一一份;core 导出映射型的那一版,本表改读它、删掉手写的十一行。
+ *  ① **事件名 → { `e` 型, 答案型 }**:读 core 的 `ClassicEventMap`(7.56.0 起包根导出;此前本文件手写十一行配对,随之删)。
+ *     每站的角色(链 / 观察)由 {@link CLASSIC_STATION_ROLE} 说,它在编译期对着 core 的答案形核:答案形是 `ObservedAnswer` 的站必须是 `observe`、其余是 `chain`。
  *  ② **handler 怎么挂**:链成员「无意见 ⇒ `next(e)`」(链 handler 返回 `undefined` 是站点违约,refuse 站上即 fail-closed 拒),
  *     观察者「恒返回 `undefined`」(观察者的判词不采纳、被引擎报告)。两条都在 {@link hangClassic} / {@link observeClassic} 里成形,
  *     调用方只写「这一站我答什么」或「这一站我看什么」,不再各自记得这两条。
@@ -13,55 +13,9 @@
  * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
  * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
  */
-import type { EngineDollar, On, PermissionDeniedPayload, PostCompactEvent, PostToolBatchEvent, PostToolBatchResult, PostToolUseEvent, PostToolUseFailureEvent, PostToolUseFailureResult, PostToolUseResult, PreCompactEvent, PreCompactResult, PreToolUseEvent, PreToolUseResult, StopEvent, StopFailureEvent, StopHookResult, UserPromptSubmitEvent, UserPromptSubmitResult } from "@sema-agent/core";
-/** 每一站的 `e` 型与答案型(答案 `void` = 观察站)。 */
-export interface ClassicStationTypes {
-    "classic.PreToolUse": {
-        e: PreToolUseEvent;
-        answer: PreToolUseResult;
-    };
-    "classic.PostToolUse": {
-        e: PostToolUseEvent;
-        answer: PostToolUseResult;
-    };
-    "classic.PostToolUseFailure": {
-        e: PostToolUseFailureEvent;
-        answer: PostToolUseFailureResult;
-    };
-    "classic.PostToolBatch": {
-        e: PostToolBatchEvent;
-        answer: PostToolBatchResult;
-    };
-    "classic.UserPromptSubmit": {
-        e: UserPromptSubmitEvent;
-        answer: UserPromptSubmitResult;
-    };
-    "classic.Stop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.SubagentStop": {
-        e: StopEvent;
-        answer: StopHookResult;
-    };
-    "classic.StopFailure": {
-        e: StopFailureEvent;
-        answer: void;
-    };
-    "classic.PreCompact": {
-        e: PreCompactEvent;
-        answer: PreCompactResult;
-    };
-    "classic.PostCompact": {
-        e: PostCompactEvent;
-        answer: void;
-    };
-    "classic.PermissionDenied": {
-        e: PermissionDeniedPayload;
-        answer: void;
-    };
-}
-export type ClassicStation = keyof ClassicStationTypes;
+import type { ClassicEventMap, ClassicEventName, EngineDollar, On } from "@sema-agent/core";
+/** 引擎有站的 `classic.*` 名(core 的 `ClassicEventMap` 键集)。 */
+export type ClassicStation = ClassicEventName;
 /** 每一站能挂什么:`chain` = 链成员(会作答)与观察者都可;`observe` = 只许观察者。 */
 export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PreToolUse": "chain";
@@ -71,21 +25,25 @@ export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.UserPromptSubmit": "chain";
     readonly "classic.Stop": "chain";
     readonly "classic.SubagentStop": "chain";
+    readonly "classic.SubagentStart": "chain";
     readonly "classic.StopFailure": "observe";
     readonly "classic.PreCompact": "chain";
     readonly "classic.PostCompact": "observe";
     readonly "classic.PermissionDenied": "observe";
 };
+/** 本仓 handler 体对一站作的答:观察站不作答(`void`);链站 = core 的答案形,去掉本仓从不作的 `null` / `false`(PreToolUse 的两个「不表态」词)。 */
+type StationAnswer<K extends ClassicStation> = (typeof CLASSIC_STATION_ROLE)[K] extends "observe" ? void : Exclude<ClassicEventMap[K]["answer"], null | false>;
 /**
  * 一站的 handler 体:读 `e`,答这一站的答案;`undefined` = 无意见(链成员由 {@link hangClassic} 交给 `next(e)`)。
  * `signal` = 引擎交给这只 handler 的 `next.signal`(预算到 ∪ 派发被取消;见头注 ③)。
  */
-export type ClassicAnswer<K extends ClassicStation> = (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => Promise<ClassicStationTypes[K]["answer"] | undefined>;
+export type ClassicAnswer<K extends ClassicStation> = (e: ClassicEventMap[K]["e"], signal: AbortSignal) => Promise<StationAnswer<K> | undefined>;
 /**
  * 按站的角色挂一只 handler:链站 ⇒ 链成员 `(await answer(e)) ?? next(e)`;观察站 ⇒ 观察者(体照跑、恒返回 `undefined`)。
- * `e` 的型由 {@link ClassicStationTypes} 给(引擎交来的是本站的 `e`;配对见头注 ①)。
+ * `e` 的型由 core 的 `ClassicEventMap` 给(引擎交来的是本站的 `e`;见头注 ①)。
  */
 export declare function hangClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, answer: ClassicAnswer<K>): void;
 /** 挂一只观察者(任何站都可):拿分离副本、不进链、恒返回 `undefined`;`signal` 同 {@link ClassicAnswer}。 */
-export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicStationTypes[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export declare function observeClassic<K extends ClassicStation>(on: On<EngineDollar>, station: K, watch: (e: ClassicEventMap[K]["e"], signal: AbortSignal) => void | Promise<void>): void;
+export {};
 //# sourceMappingURL=classic-stations.d.ts.map

package/dist/hooks/classic-stations.js

@@ -6,6 +6,7 @@ export const CLASSIC_STATION_ROLE = {
     "classic.UserPromptSubmit": "chain",
     "classic.Stop": "chain",
     "classic.SubagentStop": "chain",
+    "classic.SubagentStart": "chain",
     "classic.StopFailure": "observe",
     "classic.PreCompact": "chain",
     "classic.PostCompact": "observe",

package/dist/hooks/command-spawn.d.ts

@@ -26,7 +26,7 @@ export declare function commandLineChars(entry: {
 export declare function hookPluginEnv(p: HookPluginContext | undefined): Record<string, string>;
 /**
  * 起法:shell 形交回命令串(shell 由调用点落定),exec 形交回可执行名与参数,起不来交回真因(进调用点的 `spawnError`)。
- * `env` = 这条 hook 的**有效环境层**({@link composeHookEnvLayer} 的产物;调用点铺在基础 allowlist 之上,不再自己合并任何一层)。
+ * `env` = 这条 hook 的**有效环境层**({@link composeHookEnvLayer} 的产物;调用点把它作为授予交给宿主子进程的唯一组合,不再自己合并任何一层)。
  */
 export type CommandSpawnPlan = {
     readonly kind: "shell";
@@ -42,7 +42,7 @@ export type CommandSpawnPlan = {
     readonly error: string;
 };
 /**
- * 一条 command hook 的**有效环境层**(基础 allowlist 之上的那一层)—— **唯一铺法**,后铺者赢:`CLAUDE_PROJECT_DIR` 的缺省(`cwd`,hook 的工作目录;请求没写它才取)< 请求 `settings.env`(`requestEnv`;
+ * 一条 command hook 的**有效环境层**(继承之上的那一层授予)—— **唯一铺法**,后铺者赢:`CLAUDE_PROJECT_DIR` 的缺省(`cwd`,hook 的工作目录;请求没写它才取)< 请求 `settings.env`(`requestEnv`;
  * 请求自己写了 `CLAUDE_PROJECT_DIR` 就是它,空串也照用)< 条目自己的插件上下文({@link hookPluginEnv})。键的枚举顺序 = 请求的键在前、`CLAUDE_PROJECT_DIR` 缺省时接后、插件键最后。调用点传**原料**(工作目录与请求 env),不预先取舍 `CLAUDE_PROJECT_DIR`。
  * 「有没有值」的判据、exec 形的占位替换、shell 形子进程的环境都读这一个对象(见文件头);http 条目的 `$NAME` 插值取环境也走这一只(无插件上下文)。
  */

package/dist/hooks/hook-runner.js

@@ -32,20 +32,13 @@ export const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10_000;
 const MIN_HOOK_CONTEXT_PARTIAL_CHARS = 256;
 const MAX_TOOL_RESPONSE_CHARS = 32_768;
 const MAX_TOOL_INPUT_CHARS = 262_144;
-const HOOK_ENV_ALLOWLIST = [
-    "PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ",
-    "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR",
-];
-function hookBaseEnv(spawning) {
-    return spawning
-        ? hostSubprocessEnv({ site: "server.hooks.spawn-env", policy: [...HOOK_ENV_ALLOWLIST], allow: [] })
-        : composeHostSubprocessEnv({ policy: [...HOOK_ENV_ALLOWLIST], allow: [] });
-}
-function hookEnvOverBase(layer, spawning) {
-    return { ...hookBaseEnv(spawning), ...layer };
+const HOOK_ENV_ALLOWLIST = ["PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ", "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR"];
+function hookChildEnv(layer, spawning) {
+    const o = { policy: [...HOOK_ENV_ALLOWLIST], allow: [], grants: [layer] };
+    return spawning ? hostSubprocessEnv({ site: "server.hooks.spawn-env", ...o }) : composeHostSubprocessEnv(o);
 }
 function hookEnv(ctx) {
-    return hookEnvOverBase(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
+    return hookChildEnv(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
 }
 export const SETTINGS_HOOK_STATIONS = {
     PreToolUse: ["classic.PreToolUse"],
@@ -754,7 +747,7 @@ function buildHookContextField(parts) {
     return text === undefined ? {} : { additionalContext: text };
 }
 function spawnPlannedCommand(plan, ctx, stdio) {
-    const env = hookEnvOverBase(plan.env, true);
+    const env = hookChildEnv(plan.env, true);
     if (plan.kind === "exec")
         return spawn(plan.file, [...plan.args], { cwd: ctx.cwd, env, stdio, detached: true });
     const sh = hostShell();
@@ -1006,7 +999,14 @@ async function runLlmHook(entry, payload, ctx, extra) {
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookEnv(ctx));
+    let hookChildVars;
+    try {
+        hookChildVars = hookEnv(ctx);
+    }
+    catch (e) {
+        return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
+    }
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,

package/dist/http/admission.js

@@ -12,7 +12,7 @@ import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHisto
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
-import { normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
+import { ATTACHMENT_BOOLEAN_KEYS, ATTACHMENT_KEYS, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { allowSelectorWarningsOf, skillToolListsOverCap } from "../rule-entry-list.js";
 import { limitFacts, limitRefusal } from "../limit-refusal.js";
 import { fieldConflictFacts } from "../field-conflict.js";
@@ -78,6 +78,8 @@ function userSkillShapeIssue(item, index) {
     }
     if (skillCarriesRetiredManifest(s))
         return { message: SKILL_MANIFEST_RETIRED };
+    if (s["mods"] !== undefined)
+        return { message: "skill.mods is not a request key — skill registrations are code the deployment mounts, not request data (this server does not compile skill hooks: GET /v1/capabilities answers mods.skill_seat: false)" };
     for (const key of ["allowedTools", "disallowedTools"]) {
         if (s[key] !== undefined && !skillToolListOk(s[key]))
             return { message: `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))` };
@@ -457,7 +459,7 @@ export function createAdmission(ctx) {
         {
             const inheritEnvIssue = inheritEnvFieldIssue(body);
             if (inheritEnvIssue) {
-                sendError(res, 400, "request.field_invalid", inheritEnvIssue);
+                sendError(res, 400, "request.field_invalid", inheritEnvIssue.message, inheritEnvIssue.facts);
                 return null;
             }
         }
@@ -618,9 +620,9 @@ export function createAdmission(ctx) {
             }
         }
         {
-            const v = body.promptProfile;
-            if (v !== undefined && v !== "simple" && v !== "classic") {
-                sendError(res, 400, "request.field_invalid", 'promptProfile must be "simple" or "classic"');
+            const v = body.promptLean;
+            if (v !== undefined && typeof v !== "boolean") {
+                sendError(res, 400, "request.field_invalid", "promptLean must be a boolean");
                 return null;
             }
         }
@@ -687,7 +689,8 @@ export function createAdmission(ctx) {
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
+                const attachmentKeyList = ATTACHMENT_KEYS.map((k) => `${k}?`).join(", ");
+                sendError(res, 400, "request.field_invalid", `attachments must be an object { ${attachmentKeyList} }`);
                 return null;
             }
             const rec = a;
@@ -695,7 +698,7 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", 'attachments.planModeReminder was retired in core 7.39.0 — the engine now states plan posture itself whenever the permission mode is "plan" (first request, periodic reminders, exit frame); remove the key (send permissionMode "plan" for plan posture)');
                 return null;
             }
-            for (const k of ["todoReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
+            for (const k of ATTACHMENT_BOOLEAN_KEYS) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
                     sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;
@@ -740,10 +743,11 @@ export function createAdmission(ctx) {
             }
         }
         const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const lease = deps.peerDesk.lease("fresh");
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
-            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease });
             const bindingIntent = await resolveDevicePlacementIntent({
                 config: deps.config,
                 req,
@@ -757,9 +761,10 @@ export function createAdmission(ctx) {
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
+            lease.release();
             if (err instanceof HttpError) {
                 if (onTypedFailure) {
                     onTypedFailure(err);

package/dist/http/approval-sweeps.js

@@ -1,5 +1,6 @@
 import { redactHead } from "../observability/run-terminal.js";
 const errText = (e) => redactHead(e instanceof Error ? e.message : String(e), 2000);
+import { checkpointRevOf } from "@sema-agent/core";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
 import { hostDecisionFacts } from "../host-decision.js";
@@ -89,7 +90,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(token);
                 if (!cp)
                     return { token, parked: false, rev: undefined };
-                const rev = cp.rev ?? 0;
+                const rev = checkpointRevOf(cp);
                 if (!parkSources)
                     return { token, parked: false, rev };
                 const origin = await findParkOrigin({
@@ -120,7 +121,7 @@ export function createApprovalSweeps(ctx) {
                 const cp = await cs.get(cardToken);
                 if (!cp)
                     return;
-                if (cp.status !== "pending" || (cp.rev ?? 0) !== observedRev) {
+                if (cp.status !== "pending" || checkpointRevOf(cp) !== observedRev) {
                     deps.logger?.warn?.("deny_sweep_policy_blocked_expire_skipped", { sessionId, skipReason: cp.status !== "pending" ? "not_pending" : "card_changed", ...blockedScalars(body) });
                     return;
                 }
@@ -177,7 +178,7 @@ export function createApprovalSweeps(ctx) {
             deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
                 count: replaySkipped.length,
                 skipped: replaySkipped,
-                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind inert_tool_list: a tool-list entry (a skill disallowedTools, an agent definition's denyTools / allowTools or the request's excludeTools / allowTools) the engine reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (skipped[].kind names the rule that refused each one; the resume paths log the same kinds with a reason per kind), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/caller-trust.d.ts

@@ -8,7 +8,8 @@
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;
- *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读(与凭据门派 `source` 同序:`dispatch.ts` 先认 service 凭据);
+ *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读 —— 这不是本表的判:来源只有一只判定次序(`verifiedIdentitySource`,
+ *    service 凭据先;凭据门的 401 / 归因 / run 行身份元组读同一次的答案),本表只按来源词分档;
  *  · 多租 · 中心登录令牌,scope 角色 ≥ 契约 `domainWriteRole("governance")` ⇒ `global`:能写 scope 治理域(autonomy / commandPolicy / approvalRequire,全组织的免问面)
  *    的角色,放宽自己这一 run 是它的子集;门槛读契约,不手抄角色词;
  *  · 多租 · 其余(登录令牌角色低于它 / 不带 / 认不出;直连门 principal 令牌只证身份不证角色;没有验过的凭据)⇒ `project`:契约给非运维档作者的仓控来源的档,

package/dist/http/caller-trust.js

@@ -1,7 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
-import { systemFor, verifiedIdentitySource } from "./principal-gate.js";
+import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
         return { trust: "global", basis: "single_user" };
@@ -10,8 +10,6 @@ export function callerTrust(req, config) {
         case "service_token":
             return { trust: "global", basis: "service_credential" };
         case "sso": {
-            if (systemFor(req, config) !== undefined)
-                return { trust: "global", basis: "service_credential" };
             const role = ssoVerifiedRole(req);
             if (role === undefined || !isRole(role))
                 return { trust: "project", basis: "sign_in_role_unrecognized" };

package/dist/http/checkpoint-ctx.d.ts

@@ -31,8 +31,14 @@
  * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
  * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
  *
+ * ## 第四问(7.137.0):体里的退役请求键
+ * 请求键退役之后(今天一只:`promptProfile` 换成布尔 `promptLean`,{@link RETIRED_REQUEST_KEYS}),新提交带它在键闭集门 400;存体里的旧键由一次性迁移在起服时原地改写
+ * (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
+ * 旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ * 也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
+ *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
  * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
@@ -110,6 +116,23 @@ export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
  */
 export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
+/**
+ * 第四问:**退役的请求键**闭集(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下、一次性迁移没改写到的)。加一个 ⇒ 加一行,
+ * {@link retiredRequestKeyRefusal} 的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
+ */
+export declare const RETIRED_REQUEST_KEYS: readonly ["promptProfile"];
+export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
+/** 存体顶层带的第一只退役请求键(闭集序);没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
+export declare function retiredRequestKeyOf(body: unknown): RetiredRequestKey | undefined;
+/**
+ * 第四问的拒答复 —— 码与落点同另两只读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: <整句双引号字面 或 一只模板串>`,中间只许有空白(模板串形冻结的是骨架,`${…}` 折成一个洞)。
+ * **窗的日期不手写**:`rewriteWindowEnd` 由调用方交 —— 判据(`stored-body-replay.ts`)按「退役键 → 改写它的迁移」那张表读登记表该行的 `removableAfter`,窗只写在登记表一处;
+ * 句子写绝对日期(过了这一天读句子的人一眼看出出路已关,不靠「本版发布日」这种随版漂的说法)。
+ * 删法见登记表 M30 的 `removal`(唯一来源)。
+ */
+export declare function retiredRequestKeyRefusal(key: RetiredRequestKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -127,7 +150,7 @@ export declare function allowListReadingEraOf(ctx: CheckpointCtx): AllowListRead
 export declare function allowListReadingRefusal(era: AllowListReadingEra): ResumeRefusalAnswer;
 /**
  * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
- * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ * 答 `checkpoint.unsupported_version` 的三臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
  */
 export type StoredBodyReplayRefusal = {
     readonly kind: "allow_list_reading";
@@ -141,10 +164,16 @@ export type StoredBodyReplayRefusal = {
     readonly stored: PermissionMode | undefined;
     readonly floor: PermissionMode;
     readonly writerVersion?: string;
+} | {
+    readonly kind: "retired_request_key";
+    readonly key: RetiredRequestKey;
+    /** 改写这只退役键的一次性迁移窗的最后一天(UTC 日历日 YYYY-MM-DD)—— 登记表那一行的 `removableAfter`,由判据(`stored-body-replay.ts`)读来:本模块的闭包只许 node 内建 / 引擎包根,读不了登记表,日期只能由调用方交。 */
+    readonly rewriteWindowEnd: string;
+    readonly writerVersion?: string;
 };
 /**
- * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
- * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的三只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法 / 退役请求键三臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
  * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
  * (本模块零值依赖,不自取)。纯数据。
  */
@@ -201,11 +230,12 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
+    key?: RetiredRequestKey;
     note: string;
 };
 /**
  * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这三只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  *
  * 🔴 `cardPending` —— **调用方交出的事实**:这一次拒的时候,有没有一张待批卡仍在等。`retriable:true` 说的恰是「卡仍 pending」,所以它只在卡在时在场(经
@@ -356,9 +386,10 @@ export type StoredCheckpointCtx = Omit<CheckpointCtx, "body"> & {
 };
 declare const sealedCheckpointCtxBrand: unique symbol;
 /**
- * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移 M28 的行改写只收它 ⇒ 「写 ctx 只有封口一个写入面」由型面守,
+ * **封口铸出的**落盘形(品牌型):店的写口(`putCtx`)与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)只收它 ⇒ 「写 ctx 只有本模块的铸点一个写入面」由型面守,
  * 不再靠逐个数调用点(把开封形 / 裸对象直接交给写口 = 当场 tsc 红)。铸点闭集(都在本模块,都经 {@link mintSealedCheckpointCtx}):
- * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)与 {@link sealStoredCheckpointCtxM28}。零运行期变化。
+ * {@link sealCheckpointCtx}(新的持久化写经 {@link buildCheckpointCtx} 到它;续跑腿的写回)、{@link sealStoredCheckpointCtxM28} 与 {@link rewriteStoredBodyKeys}
+ * (存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)。零运行期变化。
  */
 export type SealedCheckpointCtx = StoredCheckpointCtx & {
     readonly [sealedCheckpointCtxBrand]: true;
@@ -407,5 +438,15 @@ export declare function sealStoredCheckpointCtxM28(stored: object, sealer: Check
     readonly ctx: SealedCheckpointCtx;
     readonly valuesSealed: number;
 } | undefined;
+/**
+ * 🔴 **一次性迁移对存量行非凭据顶层体键的改写**(品牌铸点之三;今天的调用方 = M30 的行改写 `stored-request-prompt-profile-m30.ts`):在一行落盘形的体上删 `drop` 里的顶层键、
+ * 设 `set` 里的顶层键,其余一个字节不动 —— 行上的读法记号(凭据封口的 `credentialSeal` / `credentialSlotGeneration` 与另两只记号)与凭据位上的值原样随行:封好的行仍是封好的,
+ * 更早写者留下的明文行仍是明文(读口照旧拒 `plaintext`,本口不替它洗白)。`drop` / `set` 碰到凭据位的根键(闭集各行路径的第一段)或 `__proto__` ⇒ 抛(程序错,不是数据错)。
+ * 体不是对象 ⇒ 抛(店的判形保证 ctx 是对象;体坏形的行由调用方先判、不交来)。
+ */
+export declare function rewriteStoredBodyKeys(stored: object, edit: {
+    readonly drop: readonly string[];
+    readonly set?: Readonly<Record<string, unknown>>;
+}): SealedCheckpointCtx;
 export {};
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -39,6 +39,28 @@ export function permissionModeReadingRefusal() {
         }),
     };
 }
+export const RETIRED_REQUEST_KEYS = ["promptProfile"];
+export function retiredRequestKeyOf(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    return RETIRED_REQUEST_KEYS.find((key) => Object.hasOwn(body, key));
+}
+export function retiredRequestKeyRefusal(key, rewriteWindowEnd) {
+    switch (key) {
+        case "promptProfile":
+            return {
+                status: 409,
+                body: refusalBody({
+                    errorCode: "checkpoint.unsupported_version",
+                    message: `this task was suspended by an earlier server version and its stored request still carries promptProfile, a request key this version no longer reads (it was replaced by the boolean promptLean: classic is promptLean: false, simple is leaving promptLean out), so continuing would run the task with a prompt form it was not submitted with. Nothing was decided and nothing was resumed. If whoever operates this deployment restarts this server on or before ${rewriteWindowEnd} (UTC), the stored request is rewritten in place and the same request can be sent again; otherwise submit the work again as a new task with promptLean in place of promptProfile, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).`,
+                }),
+            };
+        default: {
+            const unhandled = key;
+            throw new Error(`retired request key ${String(unhandled)} has no refusal sentence`);
+        }
+    }
+}
 export function allowListReadingUnstated(ctx) {
     if (!bodyCarriesAllowList(ctx.body))
         return false;
@@ -96,6 +118,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
+        case "retired_request_key":
+            return { kind: refusal.kind, key: refusal.key, note: "this session's stored request still carries a request key this version retired, and the one-time rewrite at startup did not reach it (no startup of this version inside its window since the row was written); it is not replayed — the task stays suspended until someone cancels it, or a restart of this version inside the window rewrites the row" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -117,6 +141,10 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
+        case "retired_request_key": {
+            const answer = retiredRequestKeyRefusal(refusal.key, refusal.rewriteWindowEnd);
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);
@@ -321,4 +349,16 @@ export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
         ? undefined
         : { ctx: mintSealedCheckpointCtx({ ...stored, body: sealed, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation }), valuesSealed };
 }
+const CREDENTIAL_SLOT_ROOTS = new Set(CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.path[0]));
+export function rewriteStoredBodyKeys(stored, edit) {
+    const touched = [...edit.drop, ...Object.keys(edit.set ?? {})];
+    const forbidden = touched.filter((key) => CREDENTIAL_SLOT_ROOTS.has(key) || key === "__proto__");
+    if (forbidden.length > 0)
+        throw new Error(`rewriteStoredBodyKeys: ${forbidden.join(", ")} is a credential-slot root (or __proto__) — a one-time body-key rewrite never touches those`);
+    const body = stored.body;
+    if (!isRecord(body))
+        throw new Error("rewriteStoredBodyKeys: the stored row's body is not an object");
+    const next = Object.fromEntries([...Object.entries(body).filter(([key]) => !edit.drop.includes(key)), ...Object.entries(edit.set ?? {})]);
+    return mintSealedCheckpointCtx({ ...stored, body: next });
+}
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/dispatch.d.ts

@@ -18,6 +18,10 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
+/** `/health` 的 `mods` 段(运维声明的 mod 包装上了几只;present-iff 装上了)—— 段的键集属主,自铸 wire 值登记表 `healthModsKey` 绑它。 */
+export interface HealthDeploymentModsSection {
+    readonly deploymentPackages: number;
+}
 /**
  * 🔴 [ref](test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。