@sema-agent/server 7.137.0 → 7.138.0

package/dist/http/route-ctx.d.ts

@@ -31,6 +31,8 @@ import type { GateSighting } from "../approval-gate-currency.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
 import type { RunAbort } from "../run-cancel-context.js";
 import type { RunIdentity } from "../identity-source.js";
+import type { PeerLease } from "../peer-seat.js";
+import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -148,6 +150,12 @@ export interface PreparedTaskSubmission {
      * 不经提交门的内部车道(`/decide` 的宿主新 turn)铸一只不带标题器的座:不起标题。
      */
     acceptance: import("../run-acceptance.js").RunAcceptance;
+    /**
+     * 这次装配的**宿主租约**:受理漏斗在装配之前开(`peerDesk.lease("fresh")`),装配在它之下登记交给引擎的对端声明;漏斗成功即把它交到这里 ——
+     * 拿到本产物的那只函数紧接着写 `try { … } finally { prepared.peerLease.release() }`,其后每个出口(早退、合流败方、建行拒、驱动返回)按构造都放。
+     * 活过那段作用域的驱动(后台腿)经 `heldFor(prepared.peerLease, () => …)` 自持一只,自己落定才放。续跑家族的内部车道交它自己漏斗开的那一只。
+     */
+    peerLease: PeerLease;
 }
 /**
  * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
@@ -252,6 +260,11 @@ export interface DriveResumeArgs {
         sessionId: string;
         ctx: CheckpointCtx;
     };
+    /**
+     * 这条续跑的**宿主租约**(续跑漏斗 `resolveResumeSpecOrBlocked` 开、装配在它之下登记对端声明;调用方作用域的 `finally` 放)。
+     * 驱动腿经 `heldFor(args.peerLease, () => driveResumeLeg(…))` 自持一只:受理早回的那一形里,腿活过调用方作用域,自己落定才放。
+     */
+    peerLease: PeerLease;
     /** [ref]:续跑腿的执行 Runner。resume 会用同一条 resolveSpec 重解析场景,故与首跑选同一只 —— 否则
      *  一次续跑就把手带 band 重新 mount 回来(收窄只在首跑成立 = 没成立)。 */
     runner: Runner;
@@ -261,6 +274,12 @@ export interface DriveResumeArgs {
     taskConfig: Omit<TaskSpec, "objective" | "sessionId">;
     resumeObjective: string;
     outcome: ResumeOutcome;
+    /**
+     * 🔴 **这条腿到达边界时能证什么**(必填 —— 缺 = 编译错;闭集,语义属主 = `gate-settlement.ts` 的 {@link GateCommitment})。同一条驱动路径既续本请求点名的门
+     * (`/decide` 引擎臂、`/resume`、`/plan_review` ⇒ `gate_resolved`,带执行**前**从选中那一行捕获、过了信任边界的身份),也替宿主投递(wake ⇒ `delivered`)。
+     * 它只是分类:位由受理点与终局体两个边界按它铸,从不只凭这一句声明铸;缺席的取消出口(`checkpoint.resume_aborted` / 抛出臂)不铸。
+     */
+    commitment: GateCommitment;
     verifyRounds: VerifyRoundsSpec | undefined;
     /**
      * **R-1**(车CJ 收车档 §10 R-1;[ref] 批落地)—— 本条 resume 腿**装配期**铸下的用户面通告
@@ -433,10 +452,7 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
-        status: number;
-        body: object;
-    }>;
+    }): Promise<ResumeLegOutcome>;
     /** notify-wake 域:唤醒一条 parked checkpoint。 */
     resumeWake(sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/wake` 腿传 `true`
@@ -444,7 +460,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** 透传给 {@link DriveResumeArgs.workflowDecision}。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道投递腿的专用席,
      *  而两条腿共用这一条驱动路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿」的成文纪律。 */
-    workflowDecision?: WorkflowDecisionDelivery): Promise<HostLegOutcome>;
+    workflowDecision?: WorkflowDecisionDelivery): Promise<ResumeLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**([ref],7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -481,10 +497,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** [ref]:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定
      *  —— `approve` / `edit` —— 上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
-    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{
-        status: number;
-        body: object;
-    }>;
+    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<ResumeLegOutcome>;
 }
 /**
  * [ref] 件 S-2 —— resume 族**受理点的断连留痕**(裁定:维持 detach,补观察面)。
@@ -673,48 +686,13 @@ export type RouteDecl = RouteDispatchDecl | RouteGateDecl;
  * api-error-text-freeze 基线流程。
  */
 /**
- * resume 家族**引擎腿**的结局:HTTP 应答(`status` / `body`)+ 一位**进程内**事实(不上 wire)。workflow 宿主腿的结局另型({@link HostLegOutcome}),并集 = {@link ResumeLegOutcome}。
- *
- * `decisionCommitted` —— **这条腿的终局是在引擎受理了这次决定之后才结出来的**([ref] X5,7.112.0):本腿走到了「引擎交回结果」那一步
- * (`resumeStream` / `resumeWithVerification` 解析 = core 的全部 pre-CAS 门 + checkpoint resolve CAS 都过了 —— 受理点的判据属主
- * = {@link DriveResumeArgs.acceptEarly} 顶注),之后才收场。只由 `driveResumeLeg` 走完引擎那一步的终局出口铸;`CheckpointError` 臂、
- * 「中止抛穿」臂、一切 4xx / 拒绝出口一律**不铸**(缺席 ⇒ 证不出提交,读者按「没提交」读 —— fail-closed)。
- *
- * 读者:`/decide` 的两道「这次决定提交了没有」门 —— [ref] 迟到结算留痕(`noteLateSettleIfAccepted`)与 remember 豁免落店
- * (`routes/approvals-assistant.ts`)。它们原先只读 wire 体的 `errorCode !== "cancelled"`(「取消 = 决定没提交」),[ref] 给续跑腿补了
- * 「引擎受理之后才被取消」的取消终局之后,`cancelled` 不再等价「没提交」⇒ 两门改读本位:`200 ∧ (errorCode≠cancelled ∨ decisionCommitted)`。
- * 🔴 为什么不放进 `result.cancelContext`(主会话初稿的落点):那只快照的契约是「分诊材料,不是状态机输入:任何门 / CAS / resume 判定都不许
- * 读它」(`plugins/store-contracts.ts` `RunCancelContext` 顶注)—— 这两道门正是判定;而且门读的是 `/decide` 的平面体、看不到结果对象。
- * 受理与否是腿自己的控制流事实,在腿上说,零 wire 变更。
+ * resume 家族一条腿的结局:HTTP 应答(`status` / `body`)。「这次决定提交了没有」只有一种说法 —— 体上的结清证据 `decisionCommitted`
+ * (唯一铸点 / 唯一读法 = `gate-settlement.ts`);进程内不另带第二个提交位。
  */
-export interface EngineLegOutcome {
+export interface ResumeLegOutcome {
     status: number;
     body: object;
-    decisionCommitted?: true;
 }
-/**
- * **workflow 宿主腿的结局(wake / fresh)—— 型上就没有 `decisionCommitted`**([ref] ②,7.113.0;`never` 让「这条路径不铸」成为**编译事实**,不是靠人记)。
- *
- * 为什么这条路径不该有该位:`/decide` 的 workflow 第三条车道(`resumeCheckpoint` 的 parked 分流,`planWorkflowParkedDecide` 之后)与 `POST /v1/sessions/:id/wake`
- * 把决定 / 消息交给**宿主会话的下一跑**(`resumeWake` / `startFreshHostTurn`)。它们的 200 只到「已交给宿主的下一跑」—— 子代 checkpoint 的 resolve CAS 发生在
- * workflow 引擎自己驱动那一步,server 观察不到(`resume-legs.ts` 该分流处「刻意不落 `late_settle`」同源)。「这次决定被引擎受理了」这句话在这里**没有可说的对象**,
- * 于是 `decisionCommitted` 在这条路径上语义含混(修前:`resumeWake` 的收尾是 `driveResumeIntoRunLog` 的 `ResumeLegOutcome`,非受理点早返形(无 `acceptEarly`)下它会把
- * 引擎腿的 `decisionCommitted:true` 原样带出去 —— 型被声明返回型 `{status, body}` 擦掉了,运行期仍在)。读者核实:两道提交门(`noteLateSettleIfAccepted` 迟到结算留痕、
- * `/decide` 的 remember 豁免落店)在这条路径上今天**零读取**(前者该分流直接 `return`、不调;后者的 `pendingGrant` 只由引擎腿的 `onResumeCommitted` 回调置位,宿主腿不调它,且 `planWorkflowParkedDecide` 对 workflow 车道的 `remember` 本就 fail-closed 拒 —— `decide.workflow_remember_unsupported`,`parked-decide.ts`)——
- * 无读者 ⇒ 剥掉该位,而不是留一个「铸了也没人读、读了不知道什么意思」的位。出口经 {@link buildHostLegOutcome} 只带 `status` / `body`。
- */
-export interface HostLegOutcome {
-    status: number;
-    body: object;
-    decisionCommitted?: never;
-}
-/** resume 家族一条腿的结局:引擎腿(可带 `decisionCommitted`)∪ workflow 宿主腿(型上没有)。`out.decisionCommitted === true` 同时收窄到引擎腿。 */
-export type ResumeLegOutcome = EngineLegOutcome | HostLegOutcome;
-/** 把任意腿的结局折成宿主腿结局:**只带 `status` / `body`**(丢掉引擎腿的 `decisionCommitted` —— 见 {@link HostLegOutcome})。纯数据。 */
-export declare function buildHostLegOutcome(out: {
-    status: number;
-    body: object;
-}): HostLegOutcome;
 /**
  * **「决定/续跑已受理」那一枚 200 收据的单一铸点**([ref])。
  *
@@ -724,11 +702,12 @@ export declare function buildHostLegOutcome(out: {
  * 都不该加**;写成两份字面量,漂开的那天没有任何东西会说话。
  *
  * `bindingEnforced` 的语义不因铸点而变(「这次决定按绑定坐标受理,不是盲目放行」),故两腿同带。
+ *
+ * `evidence` = 结清证据(`gate-settlement.ts`):引擎续跑腿的受理点交 `buildSettlementEvidence({ at: "engine_accepted", … })` 铸的那一份
+ * (`gate_resolved` 腿 ⇒ 位 + 身份;wake 的 `delivered` ⇒ 空);没跨过任何边界的回执(宿主新一跑、同一决定重投)交 `NO_SETTLEMENT_EVIDENCE`。
+ * 调用方不手写证据键 —— 体上的两键只有那一只铸点。
  */
-export declare function acceptedResumingReceipt(taskId: string, sessionId: string): {
-    status: number;
-    body: object;
-};
+export declare function acceptedResumingReceipt(taskId: string, sessionId: string, evidence: GateSettlementEvidence): ResumeLegOutcome;
 /** 一条腿的结局是不是一张「已受理」回执,是 ⇒ 回执上那一跑的 `taskId`(同一张回执的读法与 {@link acceptedResumingReceipt} 住在一起;
  *  `/decide` 的 workflow 车道据它把投递那一跑记在决定行上)。 */
 export declare function acceptedTaskIdOf(out: {

package/dist/http/route-ctx.js

@@ -21,11 +21,8 @@ export function assertNever(x) {
     throw new Error(`unreachable route id: ${String(x)}`);
 }
 export const ROUTE_METHOD_ORDER = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-export function buildHostLegOutcome(out) {
-    return { status: out.status, body: out.body };
-}
-export function acceptedResumingReceipt(taskId, sessionId) {
-    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
+export function acceptedResumingReceipt(taskId, sessionId, evidence) {
+    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true, ...evidence } };
 }
 export function acceptedTaskIdOf(out) {
     const body = out.body;

package/dist/http/routes/a2a-serve.js

@@ -272,11 +272,17 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         const prepared = await ctx.legs.prepareSpec(req, res, body, (e) => {
             typed = e;
         });
-        if (typed)
-            throw rpcErrorFromTypedFailure(typed, skillId);
-        if (!prepared)
+        if (!prepared) {
+            if (typed)
+                throw rpcErrorFromTypedFailure(typed, skillId);
             return undefined;
-        receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        try {
+            receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        finally {
+            prepared.peerLease.release();
+        }
     }
     if (!receipt)
         return undefined;

package/dist/http/routes/agents-roster.d.ts

@@ -25,7 +25,7 @@
  *  · **能力位同源**:`capabilities.agentRoster` 与这里的 501 谓词是同一个 `deps.backgroundAgentStore`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { BackgroundAgentRowSummary } from "@sema-agent/core";
+import { type BackgroundAgentRowSummary } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 名册窗的扫描上限(与 fleet 的终态窗同姿势:读面要有界)。窗满时回体带 `truncated:true`,
  *  `total` 于是诚实地是「窗内行数」而不是租户全量 —— 一个悄悄封顶的 total 比没有 total 更坏。 */

package/dist/http/routes/agents-roster.js

@@ -1,7 +1,9 @@
+import { chosenAgentName } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { backgroundAgentNameOf } from "../../background-agent-name.js";
 export const ROSTER_SCAN_LIMIT = 500;
 const ROSTER_STATUSES = ["running", "parked", "completed", "failed", "killed"];
 const ROSTER_KEY_DISPOSITION = {
@@ -24,9 +26,11 @@ export function rosterAgentId(row) {
     return row.handle;
 }
 function projectRow(r) {
+    const name = backgroundAgentNameOf(r);
     return {
         handle: rosterAgentId(r),
-        ...(r.name !== undefined ? { name: r.name } : {}),
+        name,
+        ...(chosenAgentName(r.handle, name) === undefined ? { anonymous: true } : {}),
         ...(r.agentType !== undefined ? { agentType: r.agentType } : {}),
         status: r.status,
         spawnedAt: r.spawnedAt,

package/dist/http/routes/approvals-assistant.js

@@ -22,7 +22,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCaller
 import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
+import { grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -31,6 +31,7 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_CHECKPOINT_ID_CHARS, durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
+import { buildSettlementEvidence, decisionCommittedOf } from "../../gate-settlement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
@@ -259,6 +260,7 @@ async function decideIdempotentReplay(cs, args) {
             decision,
             bindingEnforced: true,
             ...(executionOutcome !== undefined ? { executionOutcome } : {}),
+            ...buildSettlementEvidence({ at: "replay_matched" }),
         },
     };
 }
@@ -352,8 +354,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                         sendError(res, 404, "request.route_unsupported", "not found");
                         return;
                     }
-                    const rows = await deps.approvalExemptionStore.list(exSessionId);
-                    sendJson(res, 200, { exemptions: rows.filter((r) => callGrantBindingOf({ toolName: r.toolName }).kind === "none") });
+                    sendJson(res, 200, { exemptions: await deps.approvalExemptionStore.list(exSessionId) });
                     return;
                 }
                 if (exToolName === undefined) {
@@ -870,8 +871,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
-            const outErrorCode = out.body.errorCode;
-            if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
+            if (pendingGrant !== undefined && decisionCommittedOf(out) && deps.approvalExemptionStore) {
                 try {
                     await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
                     rememberApplied = true;
@@ -954,7 +954,7 @@ function projectPendingForWire(row, deployment) {
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantBinding: questionGrantBindingOf(row, deploymentListQuestion),
+        grantBinding: grantBindingOf(row),
         classes: row.classes,
         deploymentListQuestion,
     });

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus, thinkingOffSpelled } from "@sema-agent/core";
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
@@ -12,7 +12,7 @@ import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
-import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
+import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, countMcpProbeDeclarations, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
@@ -87,6 +87,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,
                 approvalReadRootGrant: facts.readRootGrant(deps).available,
+                modsDeploymentPackages: facts.deploymentModPackages(deps).available ? true : undefined,
                 sessions: facts.sessionAuditView(deps).available,
                 deviceExecutor: facts.deviceLane(deps).available
                     ? {
@@ -249,7 +250,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
-            await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, scenarioName) ?? [], "deployment");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "deployment", specs: mcpForScenario(deps.config.mcpServers, scenarioName) ?? [] });
             return;
         }
         case "capability-mcp-probe": {
@@ -267,7 +268,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendMcpProbeRefusal(res, ctx, parsed.refusal, "bad_request");
                 return;
             }
-            await serveMcpProbeFace(res, ctx, principal, parsed.specs, "caller");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "caller", drafts: parsed.drafts });
             return;
         }
         case "models": {
@@ -282,6 +283,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 provider: m.provider,
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
+                supportsThinkingOff: thinkingOffSpelled(m),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
@@ -322,18 +324,18 @@ function sendMcpProbeRefusal(res, ctx, refusal, outcome, retryAfterSec) {
         ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
     });
 }
-async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
+async function serveMcpProbeFace(res, ctx, principal, input) {
     const { deps } = ctx;
     const local = ctx.local.capabilities.mcpProbe;
-    if (specs.length === 0) {
+    if (countMcpProbeDeclarations(input) === 0) {
         deps.metrics?.inc("mcp_probe_total", { outcome: "empty" });
         sendJson(res, 200, buildEmptyMcpProbeFace());
         return;
     }
-    const key = buildMcpProbeCacheKey(principal, specs);
+    const key = buildMcpProbeCacheKey(principal, input);
     const hit = local.cached(key, Date.now());
     if (hit !== undefined) {
-        await answerMcpProbe(res, ctx, hit, "cached", declaredBy);
+        await answerMcpProbe(res, ctx, hit, "cached", input.declaredBy);
         return;
     }
     if (local.inflight() >= MCP_PROBE_MAX_INFLIGHT) {
@@ -345,9 +347,9 @@ async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
         sendMcpProbeRefusal(res, ctx, buildMcpProbeRateRefusal(), "rate_limited", verdict.retryAfterSec);
         return;
     }
-    const walk = createMcpProbeWalk(specs, principal);
+    const walk = createMcpProbeWalk(input, principal, deps.peerDesk);
     local.remember(key, Date.now(), walk);
-    await answerMcpProbe(res, ctx, walk.answer, "probed", declaredBy);
+    await answerMcpProbe(res, ctx, walk.answer, "probed", input.declaredBy);
 }
 async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
     const { deps } = ctx;

package/dist/http/routes/mcp-reconnect.d.ts

@@ -25,8 +25,9 @@
  * `unsupported` 挂 409 更会把「这条 run 没有 MCP 面」谎报成一个活性问题。
  *
  * ── 下一步动作按 `status`,不解析 `reason`(core [ref] 键表逐字)────────────────────────────────
- * `status.errorCode` / `status.httpStatus` 是机器面(`http_status` 401 是一扇重新授权的门,`spawn_failed` 是
- * 缺二进制);`reason` 是**人读**的一句话(它可能嵌远端文本:引擎铸点抹过请求回显与同主体词表,本仓那一遍只读引擎没抹的段、定长截断后投出 —— `http/mcp-remote-text.ts`),
+ * `status.errorCode` / `status.httpStatus` 是机器面(`unauthorized` 是一扇要用户授权的门 —— 引擎 7.59.0 起 401 与带 `insufficient_scope` 的 403 读这个词、不再是
+ * `http_status` + 状态数;`spawn_failed` 是
+ * 缺二进制);`reason` 是**人读**的一句话(它可能嵌远端文本:引擎铸点抹过请求回显与同主体词表,出门经出口座 `mcp-remote-text` 行 —— 同一个脱敏器、界 200 —— 投出),
  * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
  *
  * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────

package/dist/http/routes/mcp-reconnect.js

@@ -7,7 +7,8 @@ import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { sessionOwnerCellOf } from "../../security.js";
-import { redactMcpRemoteText } from "../mcp-remote-text.js";
+import { seatText } from "../../trace/exit-seat.js";
+import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 function outcomeOf(coreOutcome) {
     switch (coreOutcome) {
@@ -24,8 +25,9 @@ function projectStatus(s) {
         ...(s.errorCode !== undefined ? { errorCode: s.errorCode } : {}),
         ...(s.httpStatus !== undefined ? { httpStatus: s.httpStatus } : {}),
         ...(s.delivered !== undefined ? { delivered: s.delivered } : {}),
+        ...((a) => (a !== undefined ? { authorization: a } : {}))(projectMcpAuthorization(s.authorization)),
         ...(s.serverInfo !== undefined ? { serverInfo: s.serverInfo } : {}),
-        ...(s.error !== undefined ? { error: redactMcpRemoteText(String(s.error)) } : {}),
+        ...(s.error !== undefined ? { error: seatText("mcp-remote-text", String(s.error)) } : {}),
         ...(s.transportClosed !== undefined ? { transportClosed: s.transportClosed } : {}),
     };
 }
@@ -34,7 +36,7 @@ function projectListingIncomplete(l) {
         reason: l.reason,
         pages: l.pages,
         ...(l.budgetMs !== undefined ? { budgetMs: l.budgetMs } : {}),
-        ...(l.error !== undefined ? { error: redactMcpRemoteText(l.error) } : {}),
+        ...(l.error !== undefined ? { error: seatText("mcp-remote-text", l.error) } : {}),
     };
 }
 function projectResult(r) {
@@ -46,7 +48,7 @@ function projectResult(r) {
         added: r.added,
         removed: r.removed,
         ...(r.tools !== undefined ? { toolNames: r.tools.map((t) => t.name) } : {}),
-        ...(r.reason !== undefined ? { reason: redactMcpRemoteText(r.reason) } : {}),
+        ...(r.reason !== undefined ? { reason: seatText("mcp-remote-text", r.reason) } : {}),
         ...(r.status !== undefined ? { status: projectStatus(r.status) } : {}),
         ...(r.listingIncomplete !== undefined ? { listingIncomplete: projectListingIncomplete(r.listingIncomplete) } : {}),
     };
@@ -112,7 +114,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {
                         case "mcp.reconnect_unavailable":
-                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: redactMcpRemoteText(msg) });
+                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: seatText("mcp-remote-text", msg) });
                             return;
                         case "steering.invalid_content":
                             sendError(res, 422, "steering.invalid_content", msg);

package/dist/http/routes/memory-consolidation.d.ts

@@ -24,7 +24,7 @@
  *  · 调用方显式给 `scope` ⇒ 用它 —— 哪怕它不在 `MEMORY_CONSOLIDATION_SCOPES` 里。
  *    🔴 那张表**不是授权边界**:本仓今天没有任何授权源能对一个 operator 收窄 scope(`gateMemoryScope`
  *    的 operator 支在查目录之前就 allow;`org-memory-admission` 明写 v1 不中央收窄 operator 声明的
- *    scope —— 全文见 `src/memory-operator-faces.ts` 的 `erasureEnvelopeRefusal` 头注)。在本层拿它当
+ *    scope —— 全文见 `src/memory-operator-faces.ts` `MemoryComplianceFaces.erase` 的「授权座只有一只」段)。在本层拿它当
  *    白名单就是**发明第二套授权语义**,与 `gateMemoryScope` 对同一个身份给出相反答案;
  *  · 省略 `scope` ⇒ 只有表**恰好一条**时才有缺省(那条就是这台部署的库);零条或两条以上一律 400,
  *    并把候选列进文案 —— 让运维一眼看到「我该点哪一个」。

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
+        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/rules.js

@@ -7,7 +7,7 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { hasControlOrBidi } from "@sema-agent/settings-schema";
 import { IMPORTED_SETTINGS_LAYERS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, RULE_ADD_ORIGINS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
-import { isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
+import { isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -50,9 +50,9 @@ const LocalImportRowSchema = z
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     behavior: z.enum(RULE_BEHAVIORS),
-    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
+    tool: z.string().min(1).max(190),
     match: z.enum(PERSISTED_RULE_MATCHES),
-    command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
+    command: z.string().max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
 })
     .strict();

package/dist/http/routes/runs.js

@@ -222,11 +222,16 @@ export async function handleRuns(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody);
         if (!prepared)
             return;
-        const resp = await createDurableRun(req, res, ctx, prepared, idem);
-        if (!resp)
+        try {
+            const resp = await createDurableRun(req, res, ctx, prepared, idem);
+            if (!resp)
+                return;
+            sendJson(res, resp.status, resp.body);
             return;
-        sendJson(res, resp.status, resp.body);
-        return;
+        }
+        finally {
+            prepared.peerLease.release();
+        }
     }
     if (match.decl.id === "run-detail" || match.decl.id === "run-events" || match.decl.id === "runs-by-idem") {
         const runs = facts.durableRuns(deps);
@@ -433,13 +438,12 @@ export async function handleRuns(req, res, match, ctx) {
         const text = body.text;
         const priority = body.priority;
         const steerIdemRaw = headerStr(req.headers["idempotency-key"]);
-        const steerInputId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : undefined;
-        const messageId = steerInputId ?? uuidv7();
+        const messageId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
         const trusted = explicitOperatorOk(principal, deps.config);
         const steerInput = () => ({
             text,
             trusted,
-            ...(steerInputId !== undefined ? { inputId: steerInputId } : {}),
+            inputId: messageId,
             ...(priority !== undefined ? { priority } : {}),
         });
         try {

package/dist/http/routes/sessions.js

@@ -3,7 +3,7 @@ import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js
 import { HttpError, isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { redactMcpRemoteText } from "../mcp-remote-text.js";
+import { seatText } from "../../trace/exit-seat.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
@@ -19,6 +19,7 @@ import { rosterAgentId } from "./agents-roster.js";
 import { projectSessionListRow } from "./sessions-list.js";
 import { readSessionRowPatch } from "../../session-row.js";
 import { buildBoundedToolNames } from "../../panel-tool-names.js";
+import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const A2A_STATUS_TTL_MS = 5_000;
 const A2A_MATERIALIZE_TIMEOUT_MS = 10_000;
@@ -171,7 +172,7 @@ export async function handleSessions(req, res, match, ctx) {
                     mcpStatusCache.clear();
                 const panel = (async () => {
                     const stopDial = new AbortController();
-                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal);
+                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal, undefined, deps.peerDesk.seat.answer);
                     const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
                         stopDial.abort();
@@ -186,7 +187,8 @@ export async function handleSessions(req, res, match, ctx) {
                                 status: s.status,
                                 ...(s.serverInfo ? { serverInfo: s.serverInfo } : {}),
                                 ...(s.toolNames ? { toolNames: s.toolNames } : {}),
-                                ...(s.error ? { error: redactMcpRemoteText(String(s.error)) } : {}),
+                                ...((a) => (a !== undefined ? { authorization: a } : {}))(projectMcpAuthorization(s.authorization)),
+                                ...(s.error ? { error: seatText("mcp-remote-text", String(s.error)) } : {}),
                             })),
                         };
                     }
@@ -219,7 +221,7 @@ export async function handleSessions(req, res, match, ctx) {
                 if (a2aStatusCache.size > 1024)
                     a2aStatusCache.clear();
                 const panel = (async () => {
-                    const matP = materializeA2aTools(specs, principal);
+                    const matP = materializeA2aTools(specs, principal, undefined, undefined, deps.peerDesk.seat.answer);
                     let timer;
                     const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), A2A_MATERIALIZE_TIMEOUT_MS); })]);
                     if (timer)

package/dist/http/routes/side-query.js

@@ -95,9 +95,8 @@ export async function handleSideQuery(req, res, match, ctx) {
                 };
                 try {
                     const result = await deps.sideQuery(spec);
-                    const rr = result;
-                    const modelId = typeof rr.model === "string" ? rr.model : "unknown";
-                    deps.sideQueryAccounting?.(principal, { model: modelId, usage: rr.usage });
+                    const modelId = typeof result.model === "string" ? result.model : "unknown";
+                    deps.sideQueryAccounting?.(principal, { model: modelId, usage: result.usage, account: result.account });
                     deps.metrics?.inc?.("side_query_total", { result: "ok" });
                     if (!res.writableEnded)
                         sendJson(res, 200, projectSideQueryResult(result));