@sema-agent/server 7.136.0 → 7.138.0

package/deploy/sema-up/README.md

@@ -170,6 +170,20 @@ server 的 `<数据根>/sealed-key/` 存着停驻任务续跑上下文里请求
 - PVC 的 `accessModes` 建好后不可改:副本数跨过 1 的边界时 `helm upgrade` 会撞「spec is immutable」;卷里是私钥,换卷前先结掉停驻行或备份钥匙文件。
   PVC 带 `helm.sh/resource-policy: keep`:`helm uninstall` 与把 `enabled` 改成 `false` 的 upgrade 都不删它(确认不要了再 `kubectl -n <ns> delete pvc sema-server-sealed-key`)。
 
+## 升级时的副本更新(7.137.0:停驻任务的请求体改写)
+
+7.137.0 起服时把 7.136.x 及以前停驻的任务存下的请求体原地改写(请求键 `promptProfile` 换成布尔 `promptLean`;窗内每次起服都扫,细节见随包 `MIGRATION.md` 7.137.0 节第 4 条)。
+改写过的体 7.136.x 读不懂,所以升级序是**先停光 7.136.x 副本,再起第一个 7.137.0 副本** —— 滚动更新做不到这一点。
+
+**升级前先缩光副本,按安装路径分三种**(滚动更新做不到「先停光 7.136.x、再起第一个本版副本」;下面三段各管一种安装路径,照你的那一种做):
+
+- **Helm 形安装**(`kube-up.sh` 的 `--kube=existing` / `--kube=k3s`;`--kube=machines` 下设了 `STACK_ENGINE=helm`):图表只在钥匙卷是 `ReadWriteOnce` 时给 Deployment 写 `Recreate`;缺省的多副本(`server.replicas: 3`、`ReadWriteMany`)不写更新策略,`helm upgrade` 走 Kubernetes 缺省的滚动更新 —— 第一只本版 pod 起服改写存体时 7.136.x 副本还在跑。所以升级前先 `kubectl -n <命名空间> scale deploy/sema-server --replicas=0`(启用 `serverV4pro` 时同样缩 `deploy/sema-server-v4pro`),等旧 pod 退光,再 `helm upgrade`(重跑 `sema-up` / `kube-up.sh` 在这些安装形上走的就是这条),升完核副本数回到 `server.replicas`。
+- **`--kube=machines` 缺省形**(不设 `STACK_ENGINE` = `render`;`cluster-up.sh` 渲染清单后 `kubectl apply`,不是 Helm):清单里 `sema-server` 的副本数按机器数取 2(少于 3 台)或 3(3 台及以上),没有 `strategy` 键 = Kubernetes 缺省的滚动更新,也没有 `serverV4pro`。所以升级前先 `kubectl -n sema scale deploy/sema-server --replicas=0`(第一台机器上写 `k3s kubectl`),等旧 pod 退光,再 `kubectl apply`(重跑 `sema-up` 做的就是这一步;清单里的 `replicas` 把副本数写回 2 或 3),升完核副本数。
+- **compose 两档**(`--profile=full-single` / `local-plus`):`server` 服务只有一只容器、没有副本数键 —— 没有第二只旧副本在滚动更新里陪跑,零动作。
+
+已经滚动升过的:等最后一只 7.136.x 副本退出之后,`kubectl -n <命名空间> rollout restart deploy/sema-server`(启用 `serverV4pro` 时再加 `deploy/sema-server-v4pro`)重起一轮本版副本 —— 起服即改写窗内没改写到的任务(重启用的配置里须 `DURABLE_APPROVAL=true` —— 多租户部署缺省关,要显式写,且多租户还需 `OPERATOR_PRINCIPALS` 非空,否则起服拒(拒句点名出路);起服日志里 `checkpoint_ctx_prompt_profile_rewritten`(M30)与 `checkpoint_ctx_credentials_sealed`(M28)两行都出现、且 M30 那一行是 `"window":"open"`,才说明守卫过了、改写跑过 —— M28 的窗先关,窗关后它那一行 `"window":"closed"` 属正常)。
+Helm 形里,未启用 `serverV4pro`、钥匙卷是 `ReadWriteOnce` 的形(`server.replicas=1`、或随包 `values-full-single.yaml` 这类显式盖 `ReadWriteOnce` 的形)图表对 `deploy/sema-server` 本来用 `Recreate`,旧 pod 先停,零动作;启用 `serverV4pro` 时两只 Deployment 各自 `Recreate`、互不等待,仍按上面 Helm 形一条先把两只都缩到 0。
+
 ## 凭据纪律
 
 全部凭据生成一次、落 `~/.sema-up/<project>/.env`(0600),重跑**绝不轮换**;

package/deploy/sema-up/chart/templates/sandbox-rbac.yaml

@@ -1,4 +1,4 @@
-# ── 沙箱 lane RBAC(k8s+kata;pod 五动词 + 缓存卷四动词 + 出网自检的两只只读:本 ns 的 NetworkPolicy、集群的节点表)────────────────────────────────
+# ── 沙箱 lane RBAC(k8s+kata;pod 五动词 + 缓存卷四动词 + 沙箱秘密座 create + 出网自检的两只只读:本 ns 的 NetworkPolicy、集群的节点表)────────────────────────────────
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -33,6 +33,12 @@ rules:
   - apiGroups: [""]
     resources: [persistentvolumeclaims]
     verbs: [get, create, delete, deletecollection]
+  # 沙箱秘密座:K8S_SANDBOX_ENV 点名的值只进每只 pod 自己的 Secret(pod spec 只带 secretKeyRef;Secret 属于 pod,随 pod 由集群回收)
+  # 动词 = 适配器为 env Secret 真发的调用:create;不读回(无 get)、不删(随属主 pod 由集群 GC)。名单非空而缺它 ⇒ server 起服拒(起服 SelfSubjectAccessReview 问的正是它)
+  # 成员 git 凭据平面(本版恒关)打开时,租约 Secret 还要 patch —— 那时再加
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create]
   # 起服的出网自检读本 ns 的 NetworkPolicy(只读)
   - apiGroups: [networking.k8s.io]
     resources: [networkpolicies]

package/deploy/sema-up/stack/sema-stack-cluster.yaml

@@ -92,7 +92,7 @@ kind: Service
 metadata: { name: sema-minio, namespace: sema }
 spec: { selector: { app: sema-minio }, ports: [{ name: s3, port: 9000 }, { name: console, port: 9001 }] }
 ---
-# ── 沙箱 lane RBAC(k8s+kata;测试机同款五动词 + 缓存卷 + 出网自检两只只读)────────────────────────────────
+# ── 沙箱 lane RBAC(k8s+kata;pod 五动词 + 缓存卷四动词 + 沙箱秘密座 create + 出网自检的两只只读:本 ns 的 NetworkPolicy、集群的节点表)────────────────────────────────
 apiVersion: v1
 kind: ServiceAccount
 metadata: { name: sema-runner, namespace: sema-sandbox }
@@ -122,6 +122,12 @@ rules:
   - apiGroups: [""]
     resources: [persistentvolumeclaims]
     verbs: [get, create, delete, deletecollection]
+  # 沙箱秘密座:K8S_SANDBOX_ENV 点名的值只进每只 pod 自己的 Secret(pod spec 只带 secretKeyRef;Secret 属于 pod,随 pod 由集群回收)
+  # 动词 = 适配器为 env Secret 真发的调用:create;不读回(无 get)、不删(随属主 pod 由集群 GC)。名单非空而缺它 ⇒ server 起服拒(起服 SelfSubjectAccessReview 问的正是它)
+  # 成员 git 凭据平面(本版恒关)打开时,租约 Secret 还要 patch —— 那时再加
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create]
   # 起服的出网自检读本 ns 的 NetworkPolicy(只读)
   - apiGroups: [networking.k8s.io]
     resources: [networkpolicies]

package/dist/approval-card.d.ts

@@ -84,6 +84,7 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     rule: z.ZodString;
     match: z.ZodEnum<{
         name: "name";
+        tool: "tool";
         host: "host";
         path: "path";
         exact: "exact";
@@ -102,6 +103,7 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
             name: "name";
+            tool: "tool";
             host: "host";
             path: "path";
             exact: "exact";
@@ -552,21 +554,21 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     approvalCard: z.ZodOptional<z.ZodEnum<{
         question: "question";
-        plan: "plan";
         skill: "skill";
+        plan: "plan";
         shell: "shell";
         workflow: "workflow";
-        "file-edit": "file-edit";
+        fetch: "fetch";
         "file-write": "file-write";
+        "file-edit": "file-edit";
         "notebook-edit": "notebook-edit";
-        fetch: "fetch";
         generic: "generic";
     }>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
-            hook: "hook";
             skill: "skill";
+            hook: "hook";
             deployment: "deployment";
             request: "request";
             persisted: "persisted";
@@ -579,6 +581,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
             name: "name";
+            tool: "tool";
             host: "host";
             path: "path";
             exact: "exact";
@@ -597,6 +600,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
                 name: "name";
+                tool: "tool";
                 host: "host";
                 path: "path";
                 exact: "exact";
@@ -665,8 +669,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -704,21 +708,21 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         approvalCard: z.ZodOptional<z.ZodEnum<{
             question: "question";
-            plan: "plan";
             skill: "skill";
+            plan: "plan";
             shell: "shell";
             workflow: "workflow";
-            "file-edit": "file-edit";
+            fetch: "fetch";
             "file-write": "file-write";
+            "file-edit": "file-edit";
             "notebook-edit": "notebook-edit";
-            fetch: "fetch";
             generic: "generic";
         }>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
-                hook: "hook";
                 skill: "skill";
+                hook: "hook";
                 deployment: "deployment";
                 request: "request";
                 persisted: "persisted";
@@ -731,6 +735,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
                 name: "name";
+                tool: "tool";
                 host: "host";
                 path: "path";
                 exact: "exact";
@@ -749,6 +754,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 rule: z.ZodString;
                 match: z.ZodEnum<{
                     name: "name";
+                    tool: "tool";
                     host: "host";
                     path: "path";
                     exact: "exact";
@@ -817,8 +823,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "probe" | "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -933,7 +939,8 @@ export declare function buildApprovalRequestFrame(input: {
 /**
  * 🔴 **呈卡帧的活面事实座**(呈卡腿上旧族退役之后,开卡帧的全部事实都由本族承载)。
  *
- * 这十个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位(`approvalCard` 7.136.0 起也在卡上,见本注末段):
+ * 这十一个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位(`approvalCard` 7.136.0 起也在卡上,见本注末段;
+ * `requestedBy` = 扩展经 `$.tool.call` 自己发起的调用是谁要的,部署座装运维声明的 mod 包之后可达):
  * 卡外的事实此前只骑活卡帧,呈卡腿的消费方靠「两帧按 approvalId 合读」拿到它们。呈卡腿自此只发本族帧 ⇒ 它们挪到**活铸**的
  * 呈卡帧顶层,同名同型同值 —— 值取自同一只帧对象(活卡帧的那一次铸定,`tool-approval.ts` 的 `askBroadcast`),本仓不另算一遍。
  *
@@ -946,7 +953,7 @@ export declare function buildApprovalRequestFrame(input: {
  * 同一次读定、同值)。按上一句的规矩它该离表(活铸帧顶层这一份退役 —— wire BREAKING,下游 sdk 的孪生表同改),本版按 additive 交付、未退役:
  * 一个事实两处读,登记为待收的债,收法 = 离表 + 消费方改读 `card.approvalCard`,不是在这里加第三处。
  */
-export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason"];
+export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason", "requestedBy"];
 /** 呈卡帧活面事实座的类型面 = 活卡帧同名座的 `Pick`(同型由构造保证,不手抄)。 */
 export type ApprovalRequestLiveFacts = Pick<ToolApprovalFrame, (typeof APPROVAL_REQUEST_LIVE_FACT_KEYS)[number]>;
 /**

package/dist/approval-card.js

@@ -540,6 +540,7 @@ export const APPROVAL_REQUEST_LIVE_FACT_KEYS = [
     "approvalCard",
     "readRootCandidate",
     "probeReason",
+    "requestedBy",
 ];
 function pickApprovalRequestLiveFacts(src) {
     const out = {};

package/dist/approval-content-kind.d.ts

@@ -19,6 +19,12 @@
  * 不是卡的渲染读法,不在本模块的规则里。
  */
 export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
+/**
+ * core 7.56.0 [ref]:停驻行是不是**引擎自己的问题工具**的(content-ask)—— 读**行的记录**:引擎铸的挂载点 `pendingAction.engineMounted: true` 与保留名同在。
+ * 调用方自己挂的同名工具不带挂载点(引擎只给引擎挂载的工具铸这一位),本版之前停驻的行也没有 ⇒ 都不是。读者:两只决定铸点(顶层 `/decide` 与停驻子代赎回腿)——
+ * 引擎问题工具的决定**不转** `updatedInput`(解析器忽略它,而认领前的编辑复判会在问题专用的 resume-edit 策略下把它拒成 `resume.constraint_rejected`)。
+ */
+export declare function isEngineQuestionRow(pendingAction: unknown): boolean;
 import { PAUSE_REGISTRY, type GateKind, type ToolApprovalCard } from "@sema-agent/core";
 /**
  * 一格卡词的**闭集窄读**(三个载体共用这一只:活 ask、LOCAL 店的停驻门、SQL 店读出的门子树)。成员 ⇒ 那个词;缺席 ⇒ `undefined`(不计);

package/dist/approval-content-kind.js

@@ -1,4 +1,11 @@
 export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
+import { ASK_USER_QUESTION_TOOL_NAME as QUESTION_TOOL_NAME } from "@sema-agent/core";
+export function isEngineQuestionRow(pendingAction) {
+    if (pendingAction === null || typeof pendingAction !== "object")
+        return false;
+    const pa = pendingAction;
+    return pa.kind === "tool_approval" && pa.engineMounted === true && pa.toolName === QUESTION_TOOL_NAME;
+}
 import { PAUSE_REGISTRY, TOOL_APPROVAL_CARDS, facetOf, isGateKind, parkedApprovalCardOf } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";

package/dist/approval-gate-currency.d.ts

@@ -8,10 +8,26 @@
  *
  * ## 判官
  * 问题:**这把 gate token 是不是该会话当前待决的审批门?**(应答口的答法:`resumeCheckpoint` 的 stale 臂 —— 回显的 token ≠ 该会话当前待决的审批门 ⇒ `409 approval_stale`。)
+ *  · {@link sightsCurrentGate} —— 「决断方回显的**门身份**(token / `checkpointId`)是不是当前门的同一面」的**唯一**比较(`approval_stale` 律,两道决断门一条,见下一节);
+ *    本仓每一处拿**决断方 / 读口给的那把**门身份比「是不是当前门」都经它(`/decide` 的 token 回显、计划审阅的身份回显、下面的 {@link readGateCurrency});
+ *    服务端对**自己选出的那张卡**的复核不是回显比较,不经它(`drivePlanReview` 的卡令牌复核答认领输家 `409 conflict.not_resumable`、唤醒腿的赢家比较);
+ *    射程:本判官问的是「**哪扇门**」;`/decide` 的 [ref] 第二源问的是「**哪只调用**」(回显的 `boundCallId` vs 载入行的 `toolCallId`)—— 两问不同,所以是两条比较,
+ *    不是「不能并」:它们共用同一个 409 答复,缺值规则各按各的问题定(说不出门身份 ⇒ 判「不是」;行上没有 `toolCallId` ⇒ 那一问不判,交引擎的绑定等值校验 fail-closed 兜)。
+ *    过期决断的 409 一族(门身份 / 调用绑定两问怎么排成一族、老行那一形答哪个码)是 7.138.0 的设计票(DEBTS-server,主会话开票);
  *  · {@link currentApprovalGateToken} —— 该会话当前待决的审批门(审批门型优先,没有再退到任一待决行);应答口读它,读口读它,别处不再内联第二份;
  *  · {@link readGateCurrency} —— 一把 token 对着它的读数:`current`(带那一行)/ `absent`(店里没有这一行)/ `settled`(行在,但不再是当前待决门:已结算、已过期、被取代);
  *  · {@link createParkedGateRead} —— 协调器读口的门读席:把读数译成读口要的四种读法({@link ParkedGateReading}),`state` 闭集不加字。
  *
+ * ## `approval_stale` 律(两道决断门一条;[ref] 把计划审阅收进来)
+ * 一句话:**决断体带了「决断方看到的那道门」,而它不是该会话此刻在这道门上待决的那道门 ⇒ `409 approval_stale`,不落决断,拒体带当前门的回显坐标;不带 ⇒ 照旧受理。**
+ * 门的身份有两个面,**同一次铸**在同一行上(core 的每个停驻铸点把 `token` 与 `checkpointId` 一起铸;重开翻的是同一行、两面都不变)⇒ 在带身份的行上两面一一对应:
+ *  · 能力面 `checkpointToken` —— 秘密,永不外发;`/decide` 的老回显键(直连门上拒收);
+ *  · 身份面 `checkpointId` —— 非秘密(park 结果的 `terminal.checkpointId`、运维队列 / 收件行上的那一个);计划审阅能回显的只有它。
+ *    读法只有 `checkpoint-identity.ts` 的信任边界那一只:core 5.42.0 之前铸的老行没有它、没过边界的值不算它 ⇒ 这样的门**说不出**自己的身份面。
+ * 判官 {@link sightsCurrentGate} 只做一件事:回显的那一面 = 当前门的同一面。当前门没有那一面(老行 / 不可信值 / 调用方没读行)⇒ 不是(fail-closed:拒,不放)。
+ * 「当前门」由每道门按**自己的门型**选(`/decide` = {@link currentApprovalGateToken};计划审阅 = 它的选卡读),判官门型无关。
+ * 不把能力面先解成身份面再比:两面在同一行上同生同灭,比能力面就是比这一行;先解一次只会在快路上多一次店读,并在老行上(两边都读不出身份面)把两道不同的门判成同一道。
+ *
  * ## 一个读数只取自一个时刻([ref])
  * 门身份就是 token:引擎重开一张门(`reopen`:续跑腿在被批准的动作开跑之前失败)翻的是**同一行**(resolved → pending,token 不变)。所以「这张卡此刻在哪」可以在两次店读之间
  * 来回变(待决 → 被决 → 被重开);判官的分类只用**同一时刻成立**的读数:
@@ -33,8 +49,10 @@
  *    表明说 `decided` ⇒ 往下读;明说 `void` ⇒ `void`(没有人决过它,答案无处兑现 —— 已过期〔取消 / 收割〕、仍待决却不是当前门〔被取代,应答口答 stale〕、
  *    结算种类是引擎窗到期 / 宿主 SLA 扫 / 无人可答的失败族);**表外 ⇒ `unknown`**(读不懂的词撑不起「有人决过」,也撑不起「没有人决过它」);
  *  ② 结算赢家的门记录 `resolvedOutcome.gateOutcome` 先过 core 唯一的门记录筛 `screenGateOutcome`(**档案读法**:读回的耐久行,闭集 = 今日成员 ∪ 已退役词;
- *    坏形记缺陷、绝不抛;本仓 `trace/project.ts` 投影同一种记录也只经这一只筛),有缺陷 ⇒ `unknown`,过了筛才读它的成员;
- *  ③ 分类之前记录要**读得全**:有结算记录、时刻(引擎写进赢家的 `settlement.when`)是有限数、赢家绑的是这一行的调用且判词是 allow / deny(与
+ *    坏形记缺陷、绝不抛;本仓 `trace/project.ts` 投影同一种记录也只经这一只筛),有缺陷 ⇒ `unknown`,过了筛才读它的成员。core 7.56.0 [ref] 起筛自己判
+ *    I10(`settlement.when` 是有限数)与 I11(调用方把赢家的 `decision` 一并交给筛:它是赢家拿得出的词,方向与记录的结算种类 / 处置同向)—— 本判官在同一次筛调用里
+ *    交 `winnerDecision`,时刻与方向的手判随之退役;
+ *  ③ 分类之前记录要**读得全**:有结算记录、赢家绑的是这一行的调用且判词是 allow / deny(与
  *    `findDecidedApprovalsForBinding` 同一只 {@link approvalDecisionOfWinner})—— 缺一个都是 `unknown`(**不编一个首决**;读口答 404,应答口对已结算的门答 409 `approval_stale`,两口不同判;
  *    `void` 也要读得全:绑在别的调用上的结算说的不是这张卡);读全了再按**结算种类**表分类:人 / 策略的四个种类 ⇒ `decided`(理由取自赢家的 `reason`),其余十个 ⇒ `void`
  *    (按种类不按当事方:跨版本稳定的是种类词,变过义的是当事方词 —— 此前版本的策略拒记 `policy_refused` + `who.party:"none"`,此后记 `"policy"`,按当事方查会把那一代合法历史记录读成 `void`);
@@ -42,14 +60,38 @@
  * `unknown` 的这一类(`decision_unreadable`)带上读不出的那几处(缺陷句,非空):读口答 404 `tool_approval.not_pending`,并记一行 error(首句 + 计数)。
  * 行没了 ⇒ `unknown`(`row_absent`;应答口 PARKED 臂的 404 `not_found.approval` 同判)。
  *
- * ## 盲区(core 的筛不判的两处,如实写下:一处本判官手判有限数,一处本判官也不核)
- *  · 结算时刻 `settlement.when`:筛不判,本判官手判「有限数」;而本仓另一个读同一种记录的读者(trace 投影)把 `when` 原样放上 wire —— 同一个坏时刻,两个读者两种答法;
- *  · 方向与配对:赢家的方向(`resolvedOutcome.decision`)与记录自己的种类 / 处置说的方向是否一致,以及种类 × 当事方的配对 —— 筛不判,本判官也不核:读口以赢家的方向为准、读的是种类。
- * 只有坏行 / 手改行才走得到这两处。候引擎的筛把时刻、方向与种类 × 当事方配对一并判了,两个读者同时退掉各自的手判(配对今天没有手判可退 —— 它无人判)。
+ * ## 盲区(core 的筛仍不判的一处,如实写下)
+ *  · 种类 × 当事方的配对(结算种类与 `settlement.who` 的当事方是否相配)—— 筛不判(core KL-1265-b),本判官也不核:读的是种类。只有坏行 / 手改行才走得到。
+ *  (时刻与方向两处自 core 7.56.0 [ref] 起由筛判:I10 / I11。trace 投影读同一种记录、经同一只筛,零改即得 I10 —— 坏时刻在两个读者那里是同一个答法。)
  */
 import { type Checkpoint, type CheckpointToken, type SettlementKind } from "@sema-agent/core";
 import { type PendingRowBinding } from "./plugins/checkpoint-store-sql.js";
 import { type ParkedGateRead } from "./tool-approval.js";
+/**
+ * 决断方回显的「我看到的那道门」—— 门的两个身份面之一(两面的来历与读法见模块头注「`approval_stale` 律」)。
+ * `face` 就是回显它的那个体键名:`/decide` 的 `checkpointToken`,计划审阅的 `checkpointId`。
+ */
+export type GateSighting = {
+    readonly face: "checkpointToken" | "checkpointId";
+    readonly value: string;
+};
+/**
+ * 当前门的身份面。能力面恒在;身份面在场 ⇔ 行上的 `checkpointId` 过了信任边界 —— 老行 / 没过边界 / 调用方没读行时缺席,
+ * 缺席读作「说不出它的身份面」(判官据此对身份面回显答「不是」),**不**读作「没有门」。
+ */
+export interface CurrentGateFaces {
+    readonly checkpointToken: string;
+    readonly checkpointId?: string;
+}
+/** 一道已载入的当前门 → 它的两个身份面(身份面只经 {@link trustedCheckpointId};它含 token 的形在这里就被当成缺席,永不上比较、永不上 wire)。 */
+export declare function currentGateFacesOf(token: string, row: {
+    readonly checkpointId?: unknown;
+}): CurrentGateFaces;
+/**
+ * `approval_stale` 律的**唯一**判官:回显的那一面是不是当前门的同一面(律全文见模块头注)。没有当前门(`null` / `undefined`)⇒ 不是;
+ * 当前门说不出回显的那一面 ⇒ 不是(fail-closed)。调用点:`/decide` 的 token 回显、计划审阅的身份回显、本模块的 {@link readGateCurrency}。
+ */
+export declare function sightsCurrentGate(sighting: GateSighting, current: CurrentGateFaces | null | undefined): boolean;
 /** 判官要的两个店口(三后端同形;窄接口让测试与装配都不必拿整只店)。 */
 export interface GateCurrencyStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;

package/dist/approval-gate-currency.js

@@ -1,13 +1,21 @@
-import { REOPEN_REASONS, screenGateOutcome } from "@sema-agent/core";
+import { REOPEN_REASONS, checkpointRevOf, screenGateOutcome } from "@sema-agent/core";
 import { approvalDecisionOfWinner } from "./plugins/checkpoint-store-sql.js";
 import {} from "./tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "./approval-content-kind.js";
+import { trustedCheckpointId } from "./checkpoint-identity.js";
+export function currentGateFacesOf(token, row) {
+    const checkpointId = trustedCheckpointId(row.checkpointId, token);
+    return checkpointId === undefined ? { checkpointToken: token } : { checkpointToken: token, checkpointId };
+}
+export function sightsCurrentGate(sighting, current) {
+    if (current === null || current === undefined)
+        return false;
+    const face = current[sighting.face];
+    return face !== undefined && face === sighting.value;
+}
 export async function currentApprovalGateToken(cs, sessionId) {
     return (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
 }
-function revisionOf(cp) {
-    return cp.rev ?? 0;
-}
 const GATE_READ_ROUNDS = 3;
 export async function readGateCurrency(cs, gateToken) {
     const token = gateToken;
@@ -17,10 +25,11 @@ export async function readGateCurrency(cs, gateToken) {
             return { kind: "absent" };
         if (row.status !== "pending")
             return { kind: "settled", checkpoint: row };
-        const isCurrent = (await currentApprovalGateToken(cs, row.sessionId)) === gateToken;
+        const currentToken = await currentApprovalGateToken(cs, row.sessionId);
+        const isCurrent = sightsCurrentGate({ face: "checkpointToken", value: gateToken }, currentToken ? { checkpointToken: currentToken } : null);
         const again = await cs.get(token);
         if (again !== null && again.status === "pending") {
-            if (revisionOf(again) === revisionOf(row))
+            if (checkpointRevOf(again) === checkpointRevOf(row))
                 return isCurrent ? { kind: "current", checkpoint: again } : { kind: "settled", checkpoint: again };
             if (round === GATE_READ_ROUNDS)
                 throw new Error(`the checkpoint row moved between reads in ${GATE_READ_ROUNDS} rounds in a row (decided and reopened each time): there is no single-instant reading of its gate`);
@@ -68,14 +77,12 @@ function decisionReading(checkpoint, gateBoundCallId) {
 function readWinner(checkpoint, gateBoundCallId) {
     const winner = checkpoint.resolvedOutcome;
     const recorded = winner?.gateOutcome;
-    const [defect, ...more] = screenGateOutcome(recorded, { reading: "archive" });
+    const [defect, ...more] = screenGateOutcome(recorded, { reading: "archive", ...(winner !== undefined ? { winnerDecision: winner.decision } : {}) });
     if (defect !== undefined)
         return unreadable([defect, ...more]);
     const settlement = recorded?.settlement;
     if (settlement === undefined)
         return unreadable(["the gate record carries no settlement: no decider and no time"]);
-    if (!Number.isFinite(settlement.when))
-        return unreadable(["settlement.when is not a finite epoch-ms time"]);
     const boundCallId = gateBoundCallId ?? (checkpoint.pendingAction.kind === "tool_approval" ? checkpoint.pendingAction.toolCallId : "");
     const direction = approvalDecisionOfWinner(winner, boundCallId);
     if (direction === null)

package/dist/approval-hmac.d.ts

@@ -20,6 +20,8 @@ import type { ApprovalHmacKey } from "./auth-keys.js";
  * `reason`,以及 [ref] 起的 `permissionModeAfter`)。⇒ 「同一张卡上把 approve 的档偷偷调宽」这件事,
  * 结构上只有 HMAC 这一把拦得住;往 `cnf.bnd` 里加位既不解决它,还会把一份合法 JWT 绑死在一个它签发时
  * 根本不知道的值上。**本次([ref] F1)只动 HMAC 这一把,`approvalBnd` 一个字节不动。**
+ * [ref] 同一判断:`plan_review` 的门身份 `checkpointId` 进 HMAC 的扩展对象,不进 `cnf.bnd` —— 计划审阅的 `cnf.bnd` 绑的是会话(它的第二位是一次性 nonce),
+ * 签发 JWT 的一方不知道此刻是哪道计划门;知道的是作决断的那一方,而 HMAC 正是它签的。
  *
  * ── 🔴 字节构造规则(权威定义;跨仓签名器照此实现,docs/ASSISTANT-WIRE-CONTRACT.md §6.2 同源)──────────
  * 被 HMAC 的是下面这个字符串的 **UTF-8 字节**:
@@ -81,7 +83,7 @@ export declare function questionAnswerFromProjection(p: QuestionAnswerProjection
  * 下面那两条编译期门当场红。**不许有第三种在场判**:恒 `!== undefined`(不是真值判、也不是 `?? null`
  * 折叠)—— `null` 与缺席在扩展位上是两个不同的被签值(「签名方明说这次不动」≠「签名方不知道有这个键」)。
  */
-export declare const APPROVAL_ENVELOPE_EXT_KEYS: readonly ["answer", "permissionModeAfter"];
+export declare const APPROVAL_ENVELOPE_EXT_KEYS: readonly ["answer", "checkpointId", "permissionModeAfter"];
 export type ApprovalEnvelopeExtKey = (typeof APPROVAL_ENVELOPE_EXT_KEYS)[number];
 /** The canonical envelope both {@link approvalHmacMessage} (the signer's/verifier's shared byte-rule) and
  *  {@link verifyApprovalHmac} take — ONE named type so the two signatures cannot silently drift into two
@@ -105,6 +107,16 @@ export interface ApprovalEnvelope {
      * 值是 {@link projectQuestionAnswer} 的产物,不是请求体上那个对象(理由见该函数)。
      */
     answer?: QuestionAnswerProjection;
+    /**
+     * 🔴 **[ref](7.137.0)—— `plan_review` 决断方看到的那道门(`checkpointId`)进签名载荷。**
+     *
+     * 计划审阅的证明只绑会话(`cnf.bnd` = 会话 + 一次性 nonce + 内容哈希),不绑门 ⇒ 决断体上的门身份是这次决断**落在哪道门**的唯一陈述
+     * (不是当前门 ⇒ `409 approval_stale`)。不签它,能改写线上字节的一方就能把它摘掉(陈旧保护整个不在)或换掉;拒收它则把这项保护在直连门部署上整个关掉。
+     * 判据扩成一句:**凡决定这次决断落在哪道门、续跑能做什么 / 落什么账的决裁字段都在签名信封里**。
+     * 与 `permissionModeAfter` 同形:在场才进扩展对象,缺席 ⇒ 字节与不认识它的签名器逐字相同(既有签名器零改动);带了不签 ⇒ `401 approval_mac_invalid`。
+     * `/decide` 不送它(那道门的门身份是 `boundCallId` / `boundInputHash`,已在前五位)。
+     */
+    checkpointId?: string;
     /**
      * 🔴 **[ref] 合并复审 F1 [high]**(7.86.0 立,[ref] 把它从裸尾位挪进扩展对象)—— `plan_review` 的
      * `permissionModeAfter` 选的是**批准之后这条 run 有没有手**(`acceptEdits` = 工作目录内的写不再逐次

package/dist/approval-hmac.js

@@ -5,7 +5,7 @@ export function projectQuestionAnswer(a) {
 export function questionAnswerFromProjection(p) {
     return { answers: p.map(([header, selected, note]) => ({ header, selected: [...selected], ...(note === null ? {} : { note }) })) };
 }
-export const APPROVAL_ENVELOPE_EXT_KEYS = ["answer", "permissionModeAfter"];
+export const APPROVAL_ENVELOPE_EXT_KEYS = ["answer", "checkpointId", "permissionModeAfter"];
 const APPROVAL_ENVELOPE_HEAD_KEYS = ["sessionId", "boundCallId", "boundInputHash", "decision", "reason"];
 export function approvalHmacMessage(env) {
     const head = [env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null];

package/dist/approval.js

@@ -1,4 +1,4 @@
-import { createApprovalPolicy, isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
+import { createApprovalPolicy, isCoveringRuleName, ruleNameCovers } from "@sema-agent/core";
 import { operatorAlwaysHumanAsk, operatorAsk, requestAlwaysHumanAsk } from "./operator-ask.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
@@ -116,10 +116,10 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
 }
 function createNameSetMatcher(names) {
     const exact = new Set(names);
-    const covering = names.filter((name) => isNamespacedCoveringRuleName(name, NAME_TABLE_BEHAVIOR));
+    const covering = names.filter((name) => isCoveringRuleName(name, NAME_TABLE_BEHAVIOR));
     if (covering.length === 0)
         return (toolName) => exact.has(toolName);
-    return (toolName) => exact.has(toolName) || covering.some((rule) => namespacedRuleNameCovers(rule, toolName));
+    return (toolName) => exact.has(toolName) || covering.some((rule) => ruleNameCovers(rule, toolName));
 }
 export const AUTO_APPROVE_BUDGET_APPROVER = "auto_approve_budget";
 function budgetSeatAnswer(req, requireHit, signal) {

package/dist/audit.js

@@ -126,6 +126,7 @@ const MESSAGE_READ_TREATMENT = {
     user: {
         role: "verbatim", content: "verbatim", timestamp: "verbatim", enginePrefixChars: "verbatim", engineSegments: "verbatim",
         engineMinted: "verbatim", engineNoteKey: "verbatim", provenance: "verbatim", actor: "verbatim",
+        runOrigin: "verbatim",
         taskId: "verbatim",
         attachment: "verbatim",
     },

package/dist/auth-bridge.js

@@ -2,6 +2,7 @@ import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { centerJwksFetch } from "./web-admin-client/center-request.js";
 export function authBridgeIssuerOf(config) {
     if (config.authBridgeIssuer !== undefined)
         return { issuer: config.authBridgeIssuer, source: "explicit" };
@@ -49,7 +50,6 @@ export function createWebAdminJwtVerifier(opts) {
     const refreshMin = opts.jwksRefreshMinIntervalSec ?? DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC;
     const offlineGraceSec = opts.offlineGraceSec ?? DEFAULT_OFFLINE_GRACE_SEC;
     const jwksTtlSec = opts.jwksTtlSec ?? DEFAULT_JWKS_TTL_SEC;
-    const doFetch = opts.fetchImpl ?? fetch;
     const now = opts.nowMs ?? Date.now;
     const keys = new Map();
     let lastFetchAttemptMs;
@@ -66,7 +66,7 @@ export function createWebAdminJwtVerifier(opts) {
         inflight = (async () => {
             lastFetchAttemptMs = now();
             try {
-                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS) });
+                const res = await centerJwksFetch(jwksUrl, { timeoutMs: JWKS_FETCH_TIMEOUT_MS, fetchImpl: opts.fetchImpl });
                 if (!res.ok)
                     throw new Error(`jwks HTTP ${res.status}`);
                 const cl = Number(res.headers.get("content-length"));

package/dist/background-agent-name.d.ts

@@ -0,0 +1,5 @@
+export declare function backgroundAgentNameOf(row: {
+    readonly name?: string;
+    readonly handle: string;
+}): string;
+//# sourceMappingURL=background-agent-name.d.ts.map

package/dist/background-agent-name.js

@@ -0,0 +1,5 @@
+import { engineAgentName } from "@sema-agent/core";
+export function backgroundAgentNameOf(row) {
+    return row.name ?? engineAgentName(row.handle);
+}
+//# sourceMappingURL=background-agent-name.js.map

package/dist/boot/budget-tracing.d.ts

@@ -28,18 +28,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
-    sideQueryAccounting: (principal: string | undefined, r: {
-        model: string;
-        usage?: {
-            input?: number;
-            output?: number;
-            cacheRead?: number;
-            cacheWrite?: number;
-            cost?: {
-                total?: number;
-            };
-        };
-    }) => void;
+    sideQueryAccounting: import("../budget.js").SideQueryAccounting;
     toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;