@sema-agent/server 7.136.0 → 7.138.0

package/dist/http/route-ctx.d.ts

@@ -27,8 +27,12 @@ import type { CapabilitiesLocal } from "./routes/capabilities.js";
 import type { SessionsLocal } from "./routes/sessions.js";
 import type { SessionSyncLocal } from "./routes/session-sync.js";
 import type { PlanApprovePermissionModeAfter } from "../task-settings.js";
+import type { GateSighting } from "../approval-gate-currency.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
 import type { RunAbort } from "../run-cancel-context.js";
+import type { RunIdentity } from "../identity-source.js";
+import type { PeerLease } from "../peer-seat.js";
+import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -146,6 +150,12 @@ export interface PreparedTaskSubmission {
      * 不经提交门的内部车道(`/decide` 的宿主新 turn)铸一只不带标题器的座:不起标题。
      */
     acceptance: import("../run-acceptance.js").RunAcceptance;
+    /**
+     * 这次装配的**宿主租约**:受理漏斗在装配之前开(`peerDesk.lease("fresh")`),装配在它之下登记交给引擎的对端声明;漏斗成功即把它交到这里 ——
+     * 拿到本产物的那只函数紧接着写 `try { … } finally { prepared.peerLease.release() }`,其后每个出口(早退、合流败方、建行拒、驱动返回)按构造都放。
+     * 活过那段作用域的驱动(后台腿)经 `heldFor(prepared.peerLease, () => …)` 自持一只,自己落定才放。续跑家族的内部车道交它自己漏斗开的那一只。
+     */
+    peerLease: PeerLease;
 }
 /**
  * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
@@ -250,6 +260,11 @@ export interface DriveResumeArgs {
         sessionId: string;
         ctx: CheckpointCtx;
     };
+    /**
+     * 这条续跑的**宿主租约**(续跑漏斗 `resolveResumeSpecOrBlocked` 开、装配在它之下登记对端声明;调用方作用域的 `finally` 放)。
+     * 驱动腿经 `heldFor(args.peerLease, () => driveResumeLeg(…))` 自持一只:受理早回的那一形里,腿活过调用方作用域,自己落定才放。
+     */
+    peerLease: PeerLease;
     /** [ref]:续跑腿的执行 Runner。resume 会用同一条 resolveSpec 重解析场景,故与首跑选同一只 —— 否则
      *  一次续跑就把手带 band 重新 mount 回来(收窄只在首跑成立 = 没成立)。 */
     runner: Runner;
@@ -259,6 +274,12 @@ export interface DriveResumeArgs {
     taskConfig: Omit<TaskSpec, "objective" | "sessionId">;
     resumeObjective: string;
     outcome: ResumeOutcome;
+    /**
+     * 🔴 **这条腿到达边界时能证什么**(必填 —— 缺 = 编译错;闭集,语义属主 = `gate-settlement.ts` 的 {@link GateCommitment})。同一条驱动路径既续本请求点名的门
+     * (`/decide` 引擎臂、`/resume`、`/plan_review` ⇒ `gate_resolved`,带执行**前**从选中那一行捕获、过了信任边界的身份),也替宿主投递(wake ⇒ `delivered`)。
+     * 它只是分类:位由受理点与终局体两个边界按它铸,从不只凭这一句声明铸;缺席的取消出口(`checkpoint.resume_aborted` / 抛出臂)不铸。
+     */
+    commitment: GateCommitment;
     verifyRounds: VerifyRoundsSpec | undefined;
     /**
      * **R-1**(车CJ 收车档 §10 R-1;[ref] 批落地)—— 本条 resume 腿**装配期**铸下的用户面通告
@@ -281,11 +302,13 @@ export interface DriveResumeArgs {
     /** [ref]/[ref]:调用方声明「本腿的 park 是终局后纯 park,session claim 已随终局 finalize 删除」——
      *  getActiveTaskId 缺席时**铸新 canonical taskId + createRun 全生命周期行**(wake 续跑=同 session 新一轮
      *  turn),而不是无行裸跑(不可取消/无计费归因/无 durable append/fleet 不可见,且 core `spec.taskId ??
-     *  sessionId` fallback 会把 lastRunId 铸成 sessionId)。`source` 进 run 行元数据(runMeta 同列)。
+     *  sessionId` fallback 会把 lastRunId 铸成 sessionId)。`source` 进 run 行元数据(runMeta 同列,只作归因);`identity` = 新行的身份元组(调用方经
+     *  `runIdentityOf(req, config, 卡属主)` 读凭据门铸下的那一份:按下按钮的就是卡属主才有,否则空)。
      *  decide/answer/plan_review 腿**不设**此位:它们的 claim 在 park 期间特意保留,缺席=行被 reap 的竞态,
      *  维持既有兜底(checkpoint token 同拍过期 ⇒ resumeStream 拒),不铸新行。 */
     mintFreshRun?: {
         source: string;
+        identity: RunIdentity | null;
     };
     /** `/decide` 第三条车道交给本腿的那一件决定投递(语义属主 = {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊决定行(其余四条 resume 腿恒缺席)。 */
     workflowDecision?: WorkflowDecisionDelivery;
@@ -429,10 +452,7 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
-        status: number;
-        body: object;
-    }>;
+    }): Promise<ResumeLegOutcome>;
     /** notify-wake 域:唤醒一条 parked checkpoint。 */
     resumeWake(sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/wake` 腿传 `true`
@@ -440,7 +460,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** 透传给 {@link DriveResumeArgs.workflowDecision}。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道投递腿的专用席,
      *  而两条腿共用这一条驱动路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿」的成文纪律。 */
-    workflowDecision?: WorkflowDecisionDelivery): Promise<HostLegOutcome>;
+    workflowDecision?: WorkflowDecisionDelivery): Promise<ResumeLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**([ref],7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -457,7 +477,9 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
+    }, 
+    /** [ref]:决断方看到的那道门(决断体的 `checkpointId`);不是当前门 ⇒ `409 approval_stale`(`approval_stale` 律,语义属主 = `resume-legs.ts` 的同名形参顶注)。 */
+    sighting?: GateSighting): Promise<{
         readonly ok: false;
         readonly answer: {
             status: number;
@@ -475,10 +497,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** [ref]:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定
      *  —— `approve` / `edit` —— 上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
-    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{
-        status: number;
-        body: object;
-    }>;
+    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<ResumeLegOutcome>;
 }
 /**
  * [ref] 件 S-2 —— resume 族**受理点的断连留痕**(裁定:维持 detach,补观察面)。
@@ -667,48 +686,13 @@ export type RouteDecl = RouteDispatchDecl | RouteGateDecl;
  * api-error-text-freeze 基线流程。
  */
 /**
- * resume 家族**引擎腿**的结局:HTTP 应答(`status` / `body`)+ 一位**进程内**事实(不上 wire)。workflow 宿主腿的结局另型({@link HostLegOutcome}),并集 = {@link ResumeLegOutcome}。
- *
- * `decisionCommitted` —— **这条腿的终局是在引擎受理了这次决定之后才结出来的**([ref] X5,7.112.0):本腿走到了「引擎交回结果」那一步
- * (`resumeStream` / `resumeWithVerification` 解析 = core 的全部 pre-CAS 门 + checkpoint resolve CAS 都过了 —— 受理点的判据属主
- * = {@link DriveResumeArgs.acceptEarly} 顶注),之后才收场。只由 `driveResumeLeg` 走完引擎那一步的终局出口铸;`CheckpointError` 臂、
- * 「中止抛穿」臂、一切 4xx / 拒绝出口一律**不铸**(缺席 ⇒ 证不出提交,读者按「没提交」读 —— fail-closed)。
- *
- * 读者:`/decide` 的两道「这次决定提交了没有」门 —— [ref] 迟到结算留痕(`noteLateSettleIfAccepted`)与 remember 豁免落店
- * (`routes/approvals-assistant.ts`)。它们原先只读 wire 体的 `errorCode !== "cancelled"`(「取消 = 决定没提交」),[ref] 给续跑腿补了
- * 「引擎受理之后才被取消」的取消终局之后,`cancelled` 不再等价「没提交」⇒ 两门改读本位:`200 ∧ (errorCode≠cancelled ∨ decisionCommitted)`。
- * 🔴 为什么不放进 `result.cancelContext`(主会话初稿的落点):那只快照的契约是「分诊材料,不是状态机输入:任何门 / CAS / resume 判定都不许
- * 读它」(`plugins/store-contracts.ts` `RunCancelContext` 顶注)—— 这两道门正是判定;而且门读的是 `/decide` 的平面体、看不到结果对象。
- * 受理与否是腿自己的控制流事实,在腿上说,零 wire 变更。
- */
-export interface EngineLegOutcome {
-    status: number;
-    body: object;
-    decisionCommitted?: true;
-}
-/**
- * **workflow 宿主腿的结局(wake / fresh)—— 型上就没有 `decisionCommitted`**([ref] ②,7.113.0;`never` 让「这条路径不铸」成为**编译事实**,不是靠人记)。
- *
- * 为什么这条路径不该有该位:`/decide` 的 workflow 第三条车道(`resumeCheckpoint` 的 parked 分流,`planWorkflowParkedDecide` 之后)与 `POST /v1/sessions/:id/wake`
- * 把决定 / 消息交给**宿主会话的下一跑**(`resumeWake` / `startFreshHostTurn`)。它们的 200 只到「已交给宿主的下一跑」—— 子代 checkpoint 的 resolve CAS 发生在
- * workflow 引擎自己驱动那一步,server 观察不到(`resume-legs.ts` 该分流处「刻意不落 `late_settle`」同源)。「这次决定被引擎受理了」这句话在这里**没有可说的对象**,
- * 于是 `decisionCommitted` 在这条路径上语义含混(修前:`resumeWake` 的收尾是 `driveResumeIntoRunLog` 的 `ResumeLegOutcome`,非受理点早返形(无 `acceptEarly`)下它会把
- * 引擎腿的 `decisionCommitted:true` 原样带出去 —— 型被声明返回型 `{status, body}` 擦掉了,运行期仍在)。读者核实:两道提交门(`noteLateSettleIfAccepted` 迟到结算留痕、
- * `/decide` 的 remember 豁免落店)在这条路径上今天**零读取**(前者该分流直接 `return`、不调;后者的 `pendingGrant` 只由引擎腿的 `onResumeCommitted` 回调置位,宿主腿不调它,且 `planWorkflowParkedDecide` 对 workflow 车道的 `remember` 本就 fail-closed 拒 —— `decide.workflow_remember_unsupported`,`parked-decide.ts`)——
- * 无读者 ⇒ 剥掉该位,而不是留一个「铸了也没人读、读了不知道什么意思」的位。出口经 {@link buildHostLegOutcome} 只带 `status` / `body`。
+ * resume 家族一条腿的结局:HTTP 应答(`status` / `body`)。「这次决定提交了没有」只有一种说法 —— 体上的结清证据 `decisionCommitted`
+ * (唯一铸点 / 唯一读法 = `gate-settlement.ts`);进程内不另带第二个提交位。
  */
-export interface HostLegOutcome {
+export interface ResumeLegOutcome {
     status: number;
     body: object;
-    decisionCommitted?: never;
 }
-/** resume 家族一条腿的结局:引擎腿(可带 `decisionCommitted`)∪ workflow 宿主腿(型上没有)。`out.decisionCommitted === true` 同时收窄到引擎腿。 */
-export type ResumeLegOutcome = EngineLegOutcome | HostLegOutcome;
-/** 把任意腿的结局折成宿主腿结局:**只带 `status` / `body`**(丢掉引擎腿的 `decisionCommitted` —— 见 {@link HostLegOutcome})。纯数据。 */
-export declare function buildHostLegOutcome(out: {
-    status: number;
-    body: object;
-}): HostLegOutcome;
 /**
  * **「决定/续跑已受理」那一枚 200 收据的单一铸点**([ref])。
  *
@@ -718,11 +702,12 @@ export declare function buildHostLegOutcome(out: {
  * 都不该加**;写成两份字面量,漂开的那天没有任何东西会说话。
  *
  * `bindingEnforced` 的语义不因铸点而变(「这次决定按绑定坐标受理,不是盲目放行」),故两腿同带。
+ *
+ * `evidence` = 结清证据(`gate-settlement.ts`):引擎续跑腿的受理点交 `buildSettlementEvidence({ at: "engine_accepted", … })` 铸的那一份
+ * (`gate_resolved` 腿 ⇒ 位 + 身份;wake 的 `delivered` ⇒ 空);没跨过任何边界的回执(宿主新一跑、同一决定重投)交 `NO_SETTLEMENT_EVIDENCE`。
+ * 调用方不手写证据键 —— 体上的两键只有那一只铸点。
  */
-export declare function acceptedResumingReceipt(taskId: string, sessionId: string): {
-    status: number;
-    body: object;
-};
+export declare function acceptedResumingReceipt(taskId: string, sessionId: string, evidence: GateSettlementEvidence): ResumeLegOutcome;
 /** 一条腿的结局是不是一张「已受理」回执,是 ⇒ 回执上那一跑的 `taskId`(同一张回执的读法与 {@link acceptedResumingReceipt} 住在一起;
  *  `/decide` 的 workflow 车道据它把投递那一跑记在决定行上)。 */
 export declare function acceptedTaskIdOf(out: {

package/dist/http/route-ctx.js

@@ -21,11 +21,8 @@ export function assertNever(x) {
     throw new Error(`unreachable route id: ${String(x)}`);
 }
 export const ROUTE_METHOD_ORDER = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-export function buildHostLegOutcome(out) {
-    return { status: out.status, body: out.body };
-}
-export function acceptedResumingReceipt(taskId, sessionId) {
-    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
+export function acceptedResumingReceipt(taskId, sessionId, evidence) {
+    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true, ...evidence } };
 }
 export function acceptedTaskIdOf(out) {
     const body = out.body;

package/dist/http/routes/a2a-serve.js

@@ -272,11 +272,17 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         const prepared = await ctx.legs.prepareSpec(req, res, body, (e) => {
             typed = e;
         });
-        if (typed)
-            throw rpcErrorFromTypedFailure(typed, skillId);
-        if (!prepared)
+        if (!prepared) {
+            if (typed)
+                throw rpcErrorFromTypedFailure(typed, skillId);
             return undefined;
-        receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        try {
+            receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        finally {
+            prepared.peerLease.release();
+        }
     }
     if (!receipt)
         return undefined;

package/dist/http/routes/agents-roster.d.ts

@@ -25,7 +25,7 @@
  *  · **能力位同源**:`capabilities.agentRoster` 与这里的 501 谓词是同一个 `deps.backgroundAgentStore`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { BackgroundAgentRowSummary } from "@sema-agent/core";
+import { type BackgroundAgentRowSummary } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 名册窗的扫描上限(与 fleet 的终态窗同姿势:读面要有界)。窗满时回体带 `truncated:true`,
  *  `total` 于是诚实地是「窗内行数」而不是租户全量 —— 一个悄悄封顶的 total 比没有 total 更坏。 */

package/dist/http/routes/agents-roster.js

@@ -1,7 +1,9 @@
+import { chosenAgentName } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { backgroundAgentNameOf } from "../../background-agent-name.js";
 export const ROSTER_SCAN_LIMIT = 500;
 const ROSTER_STATUSES = ["running", "parked", "completed", "failed", "killed"];
 const ROSTER_KEY_DISPOSITION = {
@@ -24,9 +26,11 @@ export function rosterAgentId(row) {
     return row.handle;
 }
 function projectRow(r) {
+    const name = backgroundAgentNameOf(r);
     return {
         handle: rosterAgentId(r),
-        ...(r.name !== undefined ? { name: r.name } : {}),
+        name,
+        ...(chosenAgentName(r.handle, name) === undefined ? { anonymous: true } : {}),
         ...(r.agentType !== undefined ? { agentType: r.agentType } : {}),
         status: r.status,
         spawnedAt: r.spawnedAt,

package/dist/http/routes/approvals-assistant.js

@@ -22,29 +22,31 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCaller
 import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
+import { grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
-import { durableRowIdentity } from "../../checkpoint-identity.js";
+import { MAX_CHECKPOINT_ID_CHARS, durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
+import { buildSettlementEvidence, decisionCommittedOf } from "../../gate-settlement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "feedback", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
-    "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
+    "boundCallId", "checkpointId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
-const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason"];
+const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "checkpointId", "decision", "editedPlan", "permissionModeAfter", "reason"];
 const PLAN_REVIEW_NOT_IN_PROOF_KEYS = ["decidedBy"];
 const PROOF_SLOT_OF = {
     answer: "answer",
     boundCallId: "boundCallId",
     boundInputHash: "boundInputHash",
+    checkpointId: "checkpointId",
     decision: "decision",
     editedPlan: "boundInputHash",
     permissionModeAfter: "permissionModeAfter",
@@ -258,6 +260,7 @@ async function decideIdempotentReplay(cs, args) {
             decision,
             bindingEnforced: true,
             ...(executionOutcome !== undefined ? { executionOutcome } : {}),
+            ...buildSettlementEvidence({ at: "replay_matched" }),
         },
     };
 }
@@ -351,8 +354,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                         sendError(res, 404, "request.route_unsupported", "not found");
                         return;
                     }
-                    const rows = await deps.approvalExemptionStore.list(exSessionId);
-                    sendJson(res, 200, { exemptions: rows.filter((r) => callGrantBindingOf({ toolName: r.toolName }).kind === "none") });
+                    sendJson(res, 200, { exemptions: await deps.approvalExemptionStore.list(exSessionId) });
                     return;
                 }
                 if (exToolName === undefined) {
@@ -625,6 +627,17 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             const planNonce = typeof body.boundCallId === "string" ? body.boundCallId : undefined;
+            if (body.checkpointId !== undefined) {
+                if (typeof body.checkpointId !== "string" || body.checkpointId.length === 0) {
+                    sendError(res, 400, "request.field_invalid", "checkpointId must be a non-empty string (the identity of the plan gate you decided on: read terminal.checkpointId on the run result, or the checkpointId on its approvals / inbox entry)");
+                    return;
+                }
+                if (body.checkpointId.length > MAX_CHECKPOINT_ID_CHARS) {
+                    sendError(res, 400, "request.field_invalid", `checkpointId too large (max ${MAX_CHECKPOINT_ID_CHARS} chars)`);
+                    return;
+                }
+            }
+            const sighting = typeof body.checkpointId === "string" ? { face: "checkpointId", value: body.checkpointId } : undefined;
             const run = await runStore.getRun(taskId);
             if (!run) {
                 if (deps.config.directDoorActive) {
@@ -647,6 +660,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
                 const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
                     boundCallId: planNonce ?? null,
+                    checkpointId: sighting?.value,
                     decision,
                     editedPlan: decision === "edit" ? editedPlanBinding(body.editedPlan) : null,
                     permissionModeAfter: isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined,
@@ -665,7 +679,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const plan = await preparePlanReview(run.sessionId, { taskId, principalPresent: principal !== undefined }, { principal: deciderPrincipal, explicitOperator });
+            const plan = await preparePlanReview(run.sessionId, { taskId, principalPresent: principal !== undefined }, { principal: deciderPrincipal, explicitOperator }, sighting);
             if (!plan.ok) {
                 sendResumeOutcome(res, plan.answer, deps.logger);
                 return;
@@ -857,8 +871,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
-            const outErrorCode = out.body.errorCode;
-            if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
+            if (pendingGrant !== undefined && decisionCommittedOf(out) && deps.approvalExemptionStore) {
                 try {
                     await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
                     rememberApplied = true;
@@ -900,6 +913,7 @@ function approvalsReadFailureOf(err) {
         case "corrupt":
             return "approvals.read_corrupt";
         case "connection":
+        case "deployment":
         case "unclassified":
             return "approvals.read_unavailable";
         default: {
@@ -940,7 +954,7 @@ function projectPendingForWire(row, deployment) {
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantBinding: questionGrantBindingOf(row, deploymentListQuestion),
+        grantBinding: grantBindingOf(row),
         classes: row.classes,
         deploymentListQuestion,
     });

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus, thinkingOffSpelled } from "@sema-agent/core";
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
@@ -12,7 +12,7 @@ import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
-import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
+import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, countMcpProbeDeclarations, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
@@ -23,6 +23,7 @@ import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { judgeSandboxGitPlane, sandboxGitPlanePremisesOf } from "../../sandbox-git-plane.js";
 import { MCP_ASSERTION_HEADER_SENT } from "../../mcp-assertion-header.js";
 import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
@@ -86,9 +87,17 @@ export async function handleCapabilities(req, res, match, ctx) {
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,
                 approvalReadRootGrant: facts.readRootGrant(deps).available,
+                modsDeploymentPackages: facts.deploymentModPackages(deps).available ? true : undefined,
                 sessions: facts.sessionAuditView(deps).available,
                 deviceExecutor: facts.deviceLane(deps).available
-                    ? { enabled: true, protocolVersion: DEVICE_PROTOCOL_VERSION, maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4, wsPath: DEVICE_WS_PATH, management: facts.deviceManagement(deps).available }
+                    ? {
+                        enabled: true,
+                        protocolVersion: DEVICE_PROTOCOL_VERSION,
+                        maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4,
+                        wsPath: DEVICE_WS_PATH,
+                        management: facts.deviceManagement(deps).available,
+                        ...(deps.config.remoteExec?.provider === "device" && deps.config.remoteExec.relayUrl !== undefined ? { relayUrl: deps.config.remoteExec.relayUrl } : {}),
+                    }
                     : false,
                 sessionEvents: facts.sessionEventStream(deps).available,
                 fleet: facts.fleetStream(deps).available
@@ -180,6 +189,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalFrameFamilies: [...facts.approvalFrameFamilies(streamApprovalFact)],
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
+                planReviewCheckpointId: true,
                 permissionModes: [...PERMISSION_MODES],
                 sessionReadRedaction: true,
                 sideQuery: true,
@@ -224,6 +234,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 configCatalog: facts.configCatalog(deps).available,
                 sealedKey: projectSealedKeyCapability(deps.sealedKeyPublic),
                 workspaceSync: ((space, cache) => space.available || cache.available ? { ...(space.available ? space.policy : {}), ...(cache.available ? { cache: cache.cache } : {}) } : undefined)(facts.workspaceSpace(deps.config), facts.workspaceCache(deps.config)),
+                credentialPlane: { sandboxGit: deps.sandboxGitPlane ?? judgeSandboxGitPlane(sandboxGitPlanePremisesOf(deps.config, {})) },
             }));
             return;
         }
@@ -239,7 +250,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
-            await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, scenarioName) ?? [], "deployment");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "deployment", specs: mcpForScenario(deps.config.mcpServers, scenarioName) ?? [] });
             return;
         }
         case "capability-mcp-probe": {
@@ -257,7 +268,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendMcpProbeRefusal(res, ctx, parsed.refusal, "bad_request");
                 return;
             }
-            await serveMcpProbeFace(res, ctx, principal, parsed.specs, "caller");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "caller", drafts: parsed.drafts });
             return;
         }
         case "models": {
@@ -272,6 +283,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 provider: m.provider,
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
+                supportsThinkingOff: thinkingOffSpelled(m),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
@@ -312,18 +324,18 @@ function sendMcpProbeRefusal(res, ctx, refusal, outcome, retryAfterSec) {
         ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
     });
 }
-async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
+async function serveMcpProbeFace(res, ctx, principal, input) {
     const { deps } = ctx;
     const local = ctx.local.capabilities.mcpProbe;
-    if (specs.length === 0) {
+    if (countMcpProbeDeclarations(input) === 0) {
         deps.metrics?.inc("mcp_probe_total", { outcome: "empty" });
         sendJson(res, 200, buildEmptyMcpProbeFace());
         return;
     }
-    const key = buildMcpProbeCacheKey(principal, specs);
+    const key = buildMcpProbeCacheKey(principal, input);
     const hit = local.cached(key, Date.now());
     if (hit !== undefined) {
-        await answerMcpProbe(res, ctx, hit, "cached", declaredBy);
+        await answerMcpProbe(res, ctx, hit, "cached", input.declaredBy);
         return;
     }
     if (local.inflight() >= MCP_PROBE_MAX_INFLIGHT) {
@@ -335,9 +347,9 @@ async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
         sendMcpProbeRefusal(res, ctx, buildMcpProbeRateRefusal(), "rate_limited", verdict.retryAfterSec);
         return;
     }
-    const walk = createMcpProbeWalk(specs, principal);
+    const walk = createMcpProbeWalk(input, principal, deps.peerDesk);
     local.remember(key, Date.now(), walk);
-    await answerMcpProbe(res, ctx, walk.answer, "probed", declaredBy);
+    await answerMcpProbe(res, ctx, walk.answer, "probed", input.declaredBy);
 }
 async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
     const { deps } = ctx;

package/dist/http/routes/mcp-reconnect.d.ts

@@ -25,8 +25,9 @@
  * `unsupported` 挂 409 更会把「这条 run 没有 MCP 面」谎报成一个活性问题。
  *
  * ── 下一步动作按 `status`,不解析 `reason`(core [ref] 键表逐字)────────────────────────────────
- * `status.errorCode` / `status.httpStatus` 是机器面(`http_status` 401 是一扇重新授权的门,`spawn_failed` 是
- * 缺二进制);`reason` 是**人读**的一句话,经本仓 `redactSecrets` + 定长截断后投出(它可能嵌远端文本),
+ * `status.errorCode` / `status.httpStatus` 是机器面(`unauthorized` 是一扇要用户授权的门 —— 引擎 7.59.0 起 401 与带 `insufficient_scope` 的 403 读这个词、不再是
+ * `http_status` + 状态数;`spawn_failed` 是
+ * 缺二进制);`reason` 是**人读**的一句话(它可能嵌远端文本:引擎铸点抹过请求回显与同主体词表,出门经出口座 `mcp-remote-text` 行 —— 同一个脱敏器、界 200 —— 投出),
  * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
  *
  * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────

package/dist/http/routes/mcp-reconnect.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
-import { redactSecrets } from "../../trace/redact.js";
 import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
@@ -8,9 +7,9 @@ import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { sessionOwnerCellOf } from "../../security.js";
+import { seatText } from "../../trace/exit-seat.js";
+import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
-const NEUTRALIZED_TEXT_MAX = 200;
-const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
 function outcomeOf(coreOutcome) {
     switch (coreOutcome) {
         case "reconnected": return "accepted";
@@ -26,8 +25,9 @@ function projectStatus(s) {
         ...(s.errorCode !== undefined ? { errorCode: s.errorCode } : {}),
         ...(s.httpStatus !== undefined ? { httpStatus: s.httpStatus } : {}),
         ...(s.delivered !== undefined ? { delivered: s.delivered } : {}),
+        ...((a) => (a !== undefined ? { authorization: a } : {}))(projectMcpAuthorization(s.authorization)),
         ...(s.serverInfo !== undefined ? { serverInfo: s.serverInfo } : {}),
-        ...(s.error !== undefined ? { error: humanText(String(s.error)) } : {}),
+        ...(s.error !== undefined ? { error: seatText("mcp-remote-text", String(s.error)) } : {}),
         ...(s.transportClosed !== undefined ? { transportClosed: s.transportClosed } : {}),
     };
 }
@@ -36,7 +36,7 @@ function projectListingIncomplete(l) {
         reason: l.reason,
         pages: l.pages,
         ...(l.budgetMs !== undefined ? { budgetMs: l.budgetMs } : {}),
-        ...(l.error !== undefined ? { error: humanText(l.error) } : {}),
+        ...(l.error !== undefined ? { error: seatText("mcp-remote-text", l.error) } : {}),
     };
 }
 function projectResult(r) {
@@ -48,7 +48,7 @@ function projectResult(r) {
         added: r.added,
         removed: r.removed,
         ...(r.tools !== undefined ? { toolNames: r.tools.map((t) => t.name) } : {}),
-        ...(r.reason !== undefined ? { reason: humanText(r.reason) } : {}),
+        ...(r.reason !== undefined ? { reason: seatText("mcp-remote-text", r.reason) } : {}),
         ...(r.status !== undefined ? { status: projectStatus(r.status) } : {}),
         ...(r.listingIncomplete !== undefined ? { listingIncomplete: projectListingIncomplete(r.listingIncomplete) } : {}),
     };
@@ -114,7 +114,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {
                         case "mcp.reconnect_unavailable":
-                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: humanText(msg) });
+                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: seatText("mcp-remote-text", msg) });
                             return;
                         case "steering.invalid_content":
                             sendError(res, 422, "steering.invalid_content", msg);

package/dist/http/routes/memory-consolidation.d.ts

@@ -24,7 +24,7 @@
  *  · 调用方显式给 `scope` ⇒ 用它 —— 哪怕它不在 `MEMORY_CONSOLIDATION_SCOPES` 里。
  *    🔴 那张表**不是授权边界**:本仓今天没有任何授权源能对一个 operator 收窄 scope(`gateMemoryScope`
  *    的 operator 支在查目录之前就 allow;`org-memory-admission` 明写 v1 不中央收窄 operator 声明的
- *    scope —— 全文见 `src/memory-operator-faces.ts` 的 `erasureEnvelopeRefusal` 头注)。在本层拿它当
+ *    scope —— 全文见 `src/memory-operator-faces.ts` `MemoryComplianceFaces.erase` 的「授权座只有一只」段)。在本层拿它当
  *    白名单就是**发明第二套授权语义**,与 `gateMemoryScope` 对同一个身份给出相反答案;
  *  · 省略 `scope` ⇒ 只有表**恰好一条**时才有缺省(那条就是这台部署的库);零条或两条以上一律 400,
  *    并把候选列进文案 —— 让运维一眼看到「我该点哪一个」。

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
+        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/rules.js

@@ -7,7 +7,7 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { hasControlOrBidi } from "@sema-agent/settings-schema";
 import { IMPORTED_SETTINGS_LAYERS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, RULE_ADD_ORIGINS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
-import { isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
+import { isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -50,9 +50,9 @@ const LocalImportRowSchema = z
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     behavior: z.enum(RULE_BEHAVIORS),
-    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
+    tool: z.string().min(1).max(190),
     match: z.enum(PERSISTED_RULE_MATCHES),
-    command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
+    command: z.string().max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
 })
     .strict();