@sema-agent/server 7.137.0 → 7.139.0

package/dist/hooks/hook-runner.js

@@ -32,20 +32,13 @@ export const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10_000;
 const MIN_HOOK_CONTEXT_PARTIAL_CHARS = 256;
 const MAX_TOOL_RESPONSE_CHARS = 32_768;
 const MAX_TOOL_INPUT_CHARS = 262_144;
-const HOOK_ENV_ALLOWLIST = [
-    "PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ",
-    "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR",
-];
-function hookBaseEnv(spawning) {
-    return spawning
-        ? hostSubprocessEnv({ site: "server.hooks.spawn-env", policy: [...HOOK_ENV_ALLOWLIST], allow: [] })
-        : composeHostSubprocessEnv({ policy: [...HOOK_ENV_ALLOWLIST], allow: [] });
-}
-function hookEnvOverBase(layer, spawning) {
-    return { ...hookBaseEnv(spawning), ...layer };
+const HOOK_ENV_ALLOWLIST = ["PATH", "HOME", "SHELL", "USER", "LOGNAME", "TERM", "TZ", "LANG", "LC_ALL", "LC_CTYPE", "LC_MESSAGES", "TMPDIR"];
+function hookChildEnv(layer, spawning) {
+    const o = { policy: [...HOOK_ENV_ALLOWLIST], allow: [], grants: [layer] };
+    return spawning ? hostSubprocessEnv({ site: "server.hooks.spawn-env", ...o }) : composeHostSubprocessEnv(o);
 }
 function hookEnv(ctx) {
-    return hookEnvOverBase(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
+    return hookChildEnv(composeHookEnvLayer(ctx.shellEnv, ctx.cwd, undefined), false);
 }
 export const SETTINGS_HOOK_STATIONS = {
     PreToolUse: ["classic.PreToolUse"],
@@ -754,7 +747,7 @@ function buildHookContextField(parts) {
     return text === undefined ? {} : { additionalContext: text };
 }
 function spawnPlannedCommand(plan, ctx, stdio) {
-    const env = hookEnvOverBase(plan.env, true);
+    const env = hookChildEnv(plan.env, true);
     if (plan.kind === "exec")
         return spawn(plan.file, [...plan.args], { cwd: ctx.cwd, env, stdio, detached: true });
     const sh = hostShell();
@@ -1006,7 +999,14 @@ async function runLlmHook(entry, payload, ctx, extra) {
 const MAX_BLANKED_REFERENCES_LOGGED = 16;
 async function runHttpHook(entry, payload, ctx, event) {
     const timeoutMs = Math.min(entry.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS, MAX_HOOK_TIMEOUT_SECONDS) * 1000;
-    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookEnv(ctx));
+    let hookChildVars;
+    try {
+        hookChildVars = hookEnv(ctx);
+    }
+    catch (e) {
+        return { code: null, stdout: "", stderr: "", timedOut: false, spawnError: String(e) };
+    }
+    const interpolated = interpolateHookEnvVars(entry.headers ?? {}, entry.allowedEnvVars ?? [], hookChildVars);
     if (interpolated.blanked.length > 0) {
         ctx.logger.warn("hook_http_header_env_blanked", {
             event,

package/dist/hosted-posture.d.ts

@@ -17,7 +17,7 @@
  *       `multiTenant` 的反面 ⇒ 采纳,否则忽略(**不看车道**,任何 `REMOTE_EXEC` 都一样);
  *     · `additionalDirectories` / `additionalReadDirectories` —— 表行 `callerOwnsWorkerDisk`(手在本 worker 盘上 ∧ 单主 = 今天只有 host);
  *     · `settings.env` / `cwd` —— 表行 `callerCwd`(读能力表 `callerCwd` 位:host 单主才开,**device 不读租户**:那条路径落在
- *       **发起者自己的设备**上,归属由 `device_session` 绑定行验过 ⇒ 跨租户面结构性不存在)。
+ *       **发起者自己的设备**上,归属由根会话行执行格上的设备绑定验过 ⇒ 跨租户面结构性不存在)。
  *
  * ⇒ 先把这个判定位铸成**一处**,再让各条腿都读它(clay 裁定③,2026-09-22):**不许各自加特判**——
  * 每加一条特判,「这台机器算不算托管」在本仓就多一个可以自己漂的答案。
@@ -106,7 +106,7 @@ export declare const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
  * [ref] 前还有腿③(`approverPosture`,忽略 + 留声),随那个请求键一起退役。射程只铸在这一处,同族声明读同一只。
  *
  * 🔴 **device 车道不适用(clay 裁定③ 2026-09-22)**:device 车道上 host 闸防的那个跨租户宿主穿越**结构性不存在**
- * (路径落在**发起者自己的设备**上,归属由 `device_session` 绑定行 + 准入链的 owner 谓词验过),叠加 clay [ref]
+ * (路径落在**发起者自己的设备**上,归属由根会话行执行格上的设备绑定 + 准入链的 owner 谓词验过),叠加 clay [ref]
  * 「device 零额外审批」⇒ 在那条车道上拿租户声明当判据就是**用错轴**。与 `settings.env` / `cwd` 两键在那条车道上的既有臂同源同形。
  * [ref] 起射程判据 = 部署形表行 `taskHostPostureDeclarations`(device 车道 ∨ 单主;轴列 lane + principal);下面是它读的键集(托管证据 + 车道)。
  */

package/dist/http/admission.js

@@ -1,4 +1,4 @@
-import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
+import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
@@ -20,7 +20,7 @@ import { echoCallerText, quotedCallerText } from "../caller-text-echo.js";
 import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
-import { resolveDevicePlacementIntent } from "./device-placement.js";
+import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { sendError, sendHttpError } from "./send.js";
@@ -88,7 +88,7 @@ function userSkillShapeIssue(item, index) {
 }
 export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 const MAX_IMAGES_PER_REQUEST = 20;
-const MAX_IMAGE_BASE64_BYTES = MCP_IMAGE_MAX_BASE64;
+const MAX_IMAGE_BASE64_BYTES = IMAGE_ADMISSION.hard.imageBase64Chars;
 function mentionableNames(config, catalog) {
     return Object.keys(catalog).filter((n) => n !== "default" && isAtMentionable(n, catalog, config.atMention, config.modelRefusals));
 }
@@ -433,10 +433,6 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        if (body.rewindFiles !== undefined && typeof body.rewindFiles !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
-            return null;
-        }
         if (body.restoreFiles !== undefined && typeof body.restoreFiles !== "boolean") {
             sendError(res, 400, "request.field_invalid", "restoreFiles must be a boolean");
             return null;
@@ -743,26 +739,21 @@ export function createAdmission(ctx) {
             }
         }
         const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const lease = deps.peerDesk.lease("fresh");
         try {
-            const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
+            const auth = await deps.authorize({ req, body: admitted });
+            const execution = await resolveExecutionContext(deps, { kind: "fresh", root: auth.sessionId, principal: auth.principal, judged: auth.head, req, deviceId: admitted.deviceId });
             const engineNotices = [];
-            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
-            const bindingIntent = await resolveDevicePlacementIntent({
-                config: deps.config,
-                req,
-                rootSessionId: spec.sessionId,
-                deviceId: admitted.deviceId,
-                store: deps.deviceStore,
-                enrollment: deps.deviceEnrollment,
-            });
+            const spec = stampSpecRoot(await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n), lease, execution }), execution);
             const model = modelIdOf(spec.model);
-            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
+            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, ...(model !== undefined ? { model } : {}) });
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, peerLease: lease, execution, ...(pendingNotices.length > 0 ? { engineNotices: pendingNotices } : {}), ...(warnings.length > 0 ? { warnings } : {}) };
         }
         catch (err) {
+            lease.release();
             if (err instanceof HttpError) {
                 if (onTypedFailure) {
                     onTypedFailure(err);

package/dist/http/checkpoint-ctx.d.ts

@@ -32,10 +32,15 @@
  * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
  *
  * ## 第四问(7.137.0):体里的退役请求键
- * 请求键退役之后(今天一只:`promptProfile` 换成布尔 `promptLean`,{@link RETIRED_REQUEST_KEYS}),新提交带它在键闭集门 400;存体里的旧键由一次性迁移在起服时原地改写
- * (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
- * 旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
- * 也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
+ * 请求键退役之后({@link RETIRED_REQUEST_KEYS}:今天两只 —— `promptProfile` 换成布尔 `promptLean`,`rewindFiles` 是退役的旧文件还原拼法),新提交带它在键闭集门 400。存体里的旧键怎么办,闭集里每个键有
+ * **一个处置格**,住在哪张表就是哪个处置:**拒**表({@link REPLAY_REFUSED_RETIRED_KEYS},今天 `promptProfile`)是塑形过任务本身的键,**惰性**表({@link INERT_RETIRED_KEYS},今天 `rewindFiles`)是一次性键。
+ *  · 拒表的键:存体里的旧键由一次性迁移在起服时原地改写
+ *    (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
+ *    旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ *    也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
+ *  · 惰性表的键:一次性键 —— 只在提交的那一拍起作用(文件还原的一次性动作),续跑重建里没有任何一条腿读它,存体里留着它不要求任何事、不改变重放要做的事 ⇒ 不拒、不改写、续跑照常。
+ *    这不是上面那条「旧键无人读、静默续跑」的臂:那一臂的前提是读不出旧键会让续跑做一件提交时没要的事,惰性格的判据恰是「没有这个键,重放做的事一字不差」。
+ * 加一个退役键必须选格 —— 进拒表 ⇒ {@link retiredRequestKeyRefusal} 的 switch 与 `stored-body-replay.ts` 的迁移 id 表编译红,直到给它一句拒句和改写它的迁移;进惰性表 ⇒ 改动里要写明它为什么是一次性的。
  *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
  * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
@@ -117,13 +122,17 @@ export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean
  */
 export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
 /**
- * 第四问:**退役的请求键**闭集(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下、一次性迁移没改写到的)。加一个 ⇒ 加一行,
- * {@link retiredRequestKeyRefusal} 的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
+ * 第四问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注第四问。
+ * 拒表:存体仍带它 ⇒ 续跑重放拒({@link retiredRequestKeyRefusal});加一个 ⇒ 加一行,那只函数的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
  */
-export declare const RETIRED_REQUEST_KEYS: readonly ["promptProfile"];
+export declare const REPLAY_REFUSED_RETIRED_KEYS: readonly ["promptProfile"];
+export type ReplayRefusedRetiredKey = (typeof REPLAY_REFUSED_RETIRED_KEYS)[number];
+/** 惰性表:**一次性键**(只在提交那一拍起作用,续跑重建里没有任何一条腿读它)—— 存体里带着它不改变重放要做的事 ⇒ 不拒、不改写。今天一只:`rewindFiles`(旧的文件还原拼法;现役拼法 `restoreFiles` / `rewindFilesTo` 同为一次性动作,续跑重建整族剥掉)。 */
+export declare const INERT_RETIRED_KEYS: readonly ["rewindFiles"];
+export declare const RETIRED_REQUEST_KEYS: readonly ["promptProfile", "rewindFiles"];
 export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
-/** 存体顶层带的第一只退役请求键(闭集序);没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
-export declare function retiredRequestKeyOf(body: unknown): RetiredRequestKey | undefined;
+/** 存体顶层带的第一只**需要拒**的退役请求键(拒表序);惰性键不算,没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
+export declare function retiredRequestKeyOf(body: unknown): ReplayRefusedRetiredKey | undefined;
 /**
  * 第四问的拒答复 —— 码与落点同另两只读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
  * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
@@ -132,7 +141,7 @@ export declare function retiredRequestKeyOf(body: unknown): RetiredRequestKey |
  * 句子写绝对日期(过了这一天读句子的人一眼看出出路已关,不靠「本版发布日」这种随版漂的说法)。
  * 删法见登记表 M30 的 `removal`(唯一来源)。
  */
-export declare function retiredRequestKeyRefusal(key: RetiredRequestKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
+export declare function retiredRequestKeyRefusal(key: ReplayRefusedRetiredKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -166,7 +175,7 @@ export type StoredBodyReplayRefusal = {
     readonly writerVersion?: string;
 } | {
     readonly kind: "retired_request_key";
-    readonly key: RetiredRequestKey;
+    readonly key: ReplayRefusedRetiredKey;
     /** 改写这只退役键的一次性迁移窗的最后一天(UTC 日历日 YYYY-MM-DD)—— 登记表那一行的 `removableAfter`,由判据(`stored-body-replay.ts`)读来:本模块的闭包只许 node 内建 / 引擎包根,读不了登记表,日期只能由调用方交。 */
     readonly rewriteWindowEnd: string;
     readonly writerVersion?: string;
@@ -230,7 +239,7 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
-    key?: RetiredRequestKey;
+    key?: ReplayRefusedRetiredKey;
     note: string;
 };
 /**

package/dist/http/checkpoint-ctx.js

@@ -39,11 +39,13 @@ export function permissionModeReadingRefusal() {
         }),
     };
 }
-export const RETIRED_REQUEST_KEYS = ["promptProfile"];
+export const REPLAY_REFUSED_RETIRED_KEYS = ["promptProfile"];
+export const INERT_RETIRED_KEYS = ["rewindFiles"];
+export const RETIRED_REQUEST_KEYS = [...REPLAY_REFUSED_RETIRED_KEYS, ...INERT_RETIRED_KEYS];
 export function retiredRequestKeyOf(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return undefined;
-    return RETIRED_REQUEST_KEYS.find((key) => Object.hasOwn(body, key));
+    return REPLAY_REFUSED_RETIRED_KEYS.find((key) => Object.hasOwn(body, key));
 }
 export function retiredRequestKeyRefusal(key, rewriteWindowEnd) {
     switch (key) {

package/dist/http/claimed-run.d.ts

@@ -1,6 +1,6 @@
 /**
  * 一条提交腿**刚认领**的 run 在起跑之前就收场 —— 撤掉本请求建的东西的**唯一**写法。三个调用点:device 落点拒
- * (`device-placement.ts` `commitPlacement`)、续跑输入写不进(`submit-ctx.ts` `persistSubmitCtx`)与 workflow 决定行没落成
+ * (`execution-context.ts` `commitExecutionContext`)、续跑输入写不进(`submit-ctx.ts` `persistSubmitCtx`)与 workflow 决定行没落成
  * (`durable-run-leg.ts` 的 fresh 投递腿;此刻认领可能已被收割归了别人 —— 两步都按这一跑自己的 taskId,碰不到别人的认领)。
  *
  * 撤两步,**各自独立**(一步失败不拦另一步,残余最小):

package/dist/http/dispatch.d.ts

@@ -18,6 +18,10 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
+/** `/health` 的 `mods` 段(运维声明的 mod 包装上了几只;present-iff 装上了)—— 段的键集属主,自铸 wire 值登记表 `healthModsKey` 绑它。 */
+export interface HealthDeploymentModsSection {
+    readonly deploymentPackages: number;
+}
 /**
  * 🔴 [ref](test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。

package/dist/http/dispatch.js

@@ -9,6 +9,7 @@ import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
+import { deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -127,6 +128,7 @@ export function createDispatch(ctx) {
         if (req.method === "GET" && url === "/health") {
             const signal = mintEngineSignal(deps);
             const engineSignal = buildEngineSignal(signal);
+            const declaredMods = deploymentModPackagesFact(deps);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -149,6 +151,7 @@ export function createDispatch(ctx) {
                 startedAt: PROCESS_STARTED_AT_MS,
                 port: req.socket.localPort,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
+                ...(declaredMods.available ? { mods: { deploymentPackages: declaredMods.count } } : {}),
                 ...buildHealthSelfReport(deps),
                 ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),
                 ...(() => {

package/dist/http/durable-run-leg.js

@@ -1,11 +1,13 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
 import { HEARTBEAT_MS, runInBackground } from "../runs.js";
+import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
 import { cascadeConfig, runMeta } from "./run-meta.js";
 import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
-import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
+import { commitExecutionContext } from "./execution-context.js";
+import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
@@ -13,10 +15,11 @@ import { persistSubmitCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
 import { headReadOf } from "../session-incarnation.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
-    const sessionId = args.prepared.spec.sessionId ?? uuidv7();
+    const sessionId = args.prepared.spec.sessionId;
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
     const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
@@ -26,6 +29,8 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         recordResourceWindow(taskId, args.prepared.spec.resourceSuspend);
     if (created.existing)
         return { existing: created.existing };
+    if (created.sessionAbsent)
+        return rootSessionAbsentAnswer();
     if (!created.ok) {
         return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
     }
@@ -35,9 +40,9 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     }, HEARTBEAT_MS);
     preLaunchHeartbeat.unref?.();
     try {
-        const placementReject = await commitPlacement(deps, runStore, taskId, args.prepared.bindingIntent);
+        const placementReject = await commitExecutionContext(deps, { kind: "run", runStore, taskId }, args.prepared.execution);
         if (placementReject)
-            return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+            return placementReject;
         if (deps.checkpointStore) {
             const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
             if (ctxRefusal)
@@ -78,7 +83,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         sessionId,
         ...fleetRunLabels(args.prepared.spec.objective),
     });
-    void runInBackground(args.prepared.runner, { ...args.prepared.spec, sessionId }, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
+    void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, args.prepared.spec, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
         ? {
             coordinator: deps.toolApproval,
             streamApprovalOn: resolveStreamApprovalGate({
@@ -90,8 +95,9 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
+            executionLane: args.prepared.execution.lane,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(args.prepared.spec))));
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/execution-context.d.ts

@@ -0,0 +1,218 @@
+/**
+ * **执行上下文** —— 每条执行起点从这一只解析器取同一型上下文:根会话是谁、这一位住客在根会话行上的执行放置是什么、这条执行走哪条车道、
+ * 主体能不能用这条车道;认领之后的初始放置只有一只写口 {@link commitExecutionContext}。
+ *
+ * ## 规则(一句)
+ * 根只有一个来源 = authorizer(`ServiceCoreDeps.authorize` 必填席,唯一铸点即登记点),根进 spec 只有一个写者 = {@link stampSpecRoot};
+ * 执行放置**读只有一只** —— 会话店执行席 `seat.read(root)` 一次行读(住客 + 格),解析器读它、提交腿的门交来的 `judged` 比它、设备准入链判的也是这一读;
+ * **写只有一只** —— 认领之后的 {@link commitExecutionContext}(按解析器那一读的住客定址,0 行按住客复读分类,永不对现住客重试)。
+ *
+ * ## 解析步序(设计 §3.2 表 ①–④;⑤ 取 rig 不在本版)
+ *  ① 读:会话店不带执行席 ⇒ absent、`occupant` 缺(只一元车道表的部署可能);否则一次行读 —— 行不在 ⇒ 404 `resume.session_not_found`;`judged`(门判过的那一读)
+ *     在场而与行头不是同一位住客(化身 ∧ 属主,写口同一只判官 `sameOccupant`)⇒ 同 404(他人在门与解析之间删掉并同 id 重登记,或同一化身的属主变了 ——
+ *     local M10 认领 / identical 重戳 / SQL 导入提交点改属主 —— 判到新住客的车道就是错的);local 格是 `forking`
+ *     ⇒ 409 `conflict.fork_in_progress`;读故障抛(不吞成 absent)。解析器不建行、不铸根。
+ *  ② 定车道:`mirror` ⇒ 409 `conflict.session_mirror`(体带 `forkPath`);`writer(L)` 而 L 不在本部署的车道表 ⇒ 409 `execution_lane.not_served{boundLane}`;absent ⇒ 表首。
+ *  ③ 授权:主体的执行车道裁定(`gateExecutionLane`,判据与码同 `runtime-caps-resolver.ts`);服务形不判。
+ *  ④ 只 fresh:设备准入链(体 `deviceId` 只在 device 车道收;准入链三步 + 首绑目标三读,全读;判的是步 ① 那一读)。
+ *
+ * 入口三形(判别联合,{@link ExecutionEntry}):`fresh`(提交腿:根 = authorizer 交出的 `auth.sessionId`,`judged` = authorizer 判过的头)·
+ * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判)·
+ * `service`(服务 run:没有会话根)。
+ * `fresh` / `continuation` 两形型上恒带 `root: string`,`service` 形没有 `root` 键 —— 「按一只缺席的根去读行」在型上不可表达。
+ *
+ * ## 提交({@link commitExecutionContext};设计 §3.2「提交」)
+ * 只在认领之后(四个 `createRun` 点、续跑家族 `markResuming` 之后、停驻赎回 `claimParkedAgent` 之后)调,是认领之后改执行放置的唯一写口:
+ *  · 有设备意图(fresh ∧ device 车道)⇒ 首绑(设备店一只事务,按住客定址)或已绑臂的再断言(按住客再读 + 准入链再断言设备);
+ *  · absent ⇒ place(非 device 车道);命中 = 成立;0 行按住客复读分类:同值 = 成立 · 异车道 ⇒ `execution_lane.tree_bound` · mirror ⇒ `conflict.session_mirror` ·
+ *    gone(行不在或住客不是解析器那一位)⇒ 「会话不在」(提交腿 404 `resume.session_not_found`;停驻赎回答它自己的 `decide.not_parked`)—— **不对现住客重试**;
+ *  · writer ⇒ 按住客再读断言仍是 writer(L);
+ *  · 拒 ⇒ 先释放本次认领(run:终结 + 放认领 + 放幂等键;停驻:回滚认领)再交回拒答;店故障 ⇒ 释放后原样上抛(响亮,不当答案)。
+ * claim 之后每一次店往返都带 {@link placementWriteDeadlineMs} 硬时限。
+ *
+ * ## 便利度不变(clay [ref] 硬约束)
+ * 本文件**不产生任何审批**:只做「这条会话放在哪条车道 / 哪台设备上」的读、判与认领之后的一次写。device 车道上 `permissionMode: "bypassPermissions"` 的 run
+ * 与 host 车道同构造同读数(判据钉在 device-first-bind 测试的「零额外审批」格)。
+ */
+import type { IncomingMessage } from "node:http";
+import type { SessionHead, TaskSpec } from "@sema-agent/core";
+import { type DeviceOwner, type DeviceStore } from "../device-store.js";
+import { type DeviceEnrollment, type DeviceRejection } from "../device-enrollment.js";
+import type { ServiceConfig } from "../config.js";
+import type { RunStore } from "../plugins/store-backend.js";
+import { type ExecutionPlacementSeat } from "../execution-placement.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
+import type { ExecutionRuling } from "../web-admin-client/facade.js";
+import type { Logger } from "../observability/logger.js";
+import type { SessionFace } from "../session-incarnation.js";
+import { type RefusalBody } from "./refusal-body.js";
+/** 门判过的那一读(authorizer 的头;只 `fresh` 入口带):解析器拿它的住客(化身 ∧ 属主)与行头比 —— 判官 = 写口同一只 `sameOccupant`。 */
+export type JudgedOccupant = Pick<SessionHead, "owner" | "incarnation">;
+/** 执行起点交给解析器的入口。 */
+export type ExecutionEntry = {
+    readonly kind: "fresh";
+    readonly root: string;
+    /** 主体(授权步 ③ 按它问执行车道裁定)。 */
+    readonly principal: string | undefined;
+    /** authorizer 判过的头(属主门那一读;现铸臂是登记后那一读)。缺 = 店没有 `headOf`(只一元表无席形可达)。 */
+    readonly judged: JudgedOccupant | undefined;
+    /** 设备准入(步 ④)的两样输入:调用方的请求(判调用方域)与体里的 `deviceId`(原值,形在步 ④ 判)。 */
+    readonly req: IncomingMessage | undefined;
+    readonly deviceId: unknown;
+} | {
+    readonly kind: "continuation";
+    readonly root: string;
+    readonly principal: string | undefined;
+} | {
+    readonly kind: "service";
+};
+/** 解析器的产出:有会话根的两形与没有根的服务形。 */
+export type ExecutionContext = {
+    readonly kind: "fresh" | "continuation";
+    readonly root: string;
+    /** 步 ① 那一读的住客;会话店不带执行席 ⇒ 缺(提交无事可做)。 */
+    readonly occupant: SessionFace | undefined;
+    readonly placement: "absent" | "writer";
+    readonly lane: ExecutionLane;
+    /** 只 fresh ∧ device 车道:准入链判完的设备意图(认领之后由 {@link commitExecutionContext} 写或再断言)。 */
+    readonly device?: DevicePlacementIntent;
+} | {
+    readonly kind: "service";
+    readonly lane: ExecutionLane;
+    readonly placement: "absent";
+};
+/** 带根的上下文 —— 认领之后的提交、审批席的出处车道读这一形(服务 run 不认领)。 */
+export type RootedExecutionContext = Extract<ExecutionContext, {
+    readonly root: string;
+}>;
+/** 装配器(`resolveSpec`)收的那一半:根与入口形(它不判放置、不选车道)。 */
+export type ExecutionRoot = Pick<RootedExecutionContext, "kind" | "root">;
+/** 解析器读的部署件(全部取自同一只 `ServiceDeps`)。 */
+export interface ExecutionContextDeps {
+    readonly config: ServiceConfig;
+    /** 会话店:执行席 `executionPlacement` 是放置的唯一载体与唯一读。 */
+    readonly sessionStorage?: {
+        readonly executionPlacement?: ExecutionPlacementSeat;
+    } | undefined;
+    /** 主体的执行车道裁定(caps client;缺 = 无中心 ⇒ 不判,与已发同)。 */
+    readonly executionRuling?: ((principal: string | undefined) => Promise<ExecutionRuling | undefined>) | undefined;
+    readonly logger?: Logger | undefined;
+    readonly deviceStore?: DeviceStore | undefined;
+    readonly deviceEnrollment?: DeviceEnrollment | undefined;
+}
+/**
+ * **唯一的解析器**(设计 §3.2 步 ①–④)。同一入口、同一行、同一裁定恒得同一上下文;判别是穷举的(新入口形 = 编译错)。
+ * 拒一律抛 typed `HttpError`(提交腿原样答;续跑家族照它自己的折叠律答,`http/resume-legs.ts`)。
+ */
+export declare function resolveExecutionContext(deps: ExecutionContextDeps, entry: Extract<ExecutionEntry, {
+    readonly root: string;
+}>): Promise<RootedExecutionContext>;
+export declare function resolveExecutionContext(deps: ExecutionContextDeps, entry: ExecutionEntry): Promise<ExecutionContext>;
+/** 拒体里「继续在本处执行」的下一步路径(fork 口)—— 镜像拒体的 `forkPath` 唯一铸法(执行面与会话行写口 `PATCH /v1/sessions/:id` 同读)。 */
+export declare function forkPathOf(root: string): string;
+/** 解析器的拒是不是「会话不在」(停驻赎回腿把它答成自己既有的 `decide.not_parked`;判据只在这里认那只答复的码)。 */
+export declare function isRootSessionGoneError(err: unknown): boolean;
+/**
+ * 调用方 device 域的**唯一铸造点**。`undefined` = 判不出域(无 principal,或凭据不带 tenant claim)—— 消费点必须响亮拒,禁静默空视图。
+ *
+ * 🔴 位置即契约:`{owner_tenant, owner_subject}` 是 O11 的 device-lane-local 复合身份(全局 principal 一个字节不动)。subject = `gatedPrincipal`(verified 链),
+ * tenant = `ssoVerifiedScope`(registry auth-bridge JWT 的 `scope` claim)—— **两者都是签名真源,不是自报头**。管理面三读三写与首绑写协议全部从这一只函数取域;
+ * 派生第二份就是把 O11 的判据本体复制成一份会漂的孪生。
+ */
+export declare function deviceOwnerDomainOf(req: IncomingMessage, config: ServiceConfig): DeviceOwner | undefined;
+/**
+ * **已校验、未写库**的设备放置意图(device 车道的 fresh 上下文才带)。解析那一刻还不知道哪个并发请求会赢下会话的认领,所以它不写 ——
+ * 只把「如果我赢了,该写什么 / 该断言什么」算好交给 {@link commitExecutionContext}。
+ */
+export interface DevicePlacementIntent {
+    /** 绑定键 = **根**会话(后代无条件继承)。 */
+    readonly rootSessionId: string;
+    /** 步 ① 那一读的住客:首绑写按住客谓词;已绑臂的再断言先比住客。 */
+    readonly occupant: SessionFace;
+    /** 验证过的复合身份(恒取 verified 链,不取自可伪造头)。 */
+    readonly owner: DeviceOwner;
+    /**
+     * **准入链批准的那台设备** —— 提交的断言对象。身份留在意图里,已绑臂才有东西可断言(一条写了 `deviceId: A` 的提交在「准入过后、认领之前」被换绑到 B
+     * 时不许静默在 B 上跑完 —— 执行环境工厂读的是**当下**的绑定)。
+     */
+    readonly admittedDeviceId: string;
+    /** `true` = 解析那一读里还没有设备绑定 ⇒ 提交做那一次首绑(写);`false` = 已绑 ⇒ 提交不写,只再断言。 */
+    readonly firstBind: boolean;
+}
+/**
+ * 装配器的产物型:根不归装配器写。`{ sessionId?: never }` 让任何型上带 `string` 的 `sessionId`(字面量、变量、展开、`TaskSpec` 型值)都不可赋;
+ * 擦型(`any` / `as unknown as`)与 JS 嵌入方不归型管,由 {@link stampSpecRoot} 的运行时判兜。
+ */
+export type ResolvedTaskSpec = Omit<TaskSpec, "sessionId"> & {
+    sessionId?: never;
+};
+/** 盖过根的 spec:执行点、认领、续跑输入读的都是这一形(`sessionId` 恒在)。 */
+export type RootedTaskSpec = TaskSpec & {
+    readonly sessionId: string;
+};
+/**
+ * **根进 spec 的唯一写者。** 装配器交回的 spec 上 `sessionId` 缺席(或为 `undefined`)⇒ 盖上这条上下文的根;
+ * 在场且等于根 ⇒ 同值,照盖;在场而**不等** ⇒ 400 `request.precondition_unmet`(嵌入方的装配器另点了一只会话 —— 它在型上不能这么写,
+ * 走到这里只能是擦型或 JS 形;拒在建任何行之前)。续跑家族照它自己的折叠律把这只拒答成 409 `resume_blocked_by_policy`(`blockedBy` = 这只码,
+ * `http/resume-legs.ts` 的 `resolveResumeSpecOrBlocked`:装配期的每一只 `HttpError` 在续跑腿上都这么折),同样什么都没续。
+ */
+export declare function stampSpecRoot(spec: ResolvedTaskSpec, ctx: ExecutionRoot): RootedTaskSpec;
+/**
+ * run 店建行时根会话行已经不在(`CreateRunOutcome.sessionAbsent`:受理之后、认领之前会话被删)的**唯一**答复 ——
+ * 四个建行点(同步 / 流式 / durable / wake)、解析期的「行不在 / 住客换了」与提交期的 `gone` 同答 404 `resume.session_not_found`,什么都没建、什么都没跑。
+ */
+export declare function rootSessionAbsentAnswer(): {
+    status: 404;
+    body: RefusalBody;
+};
+/** 提交点的拒答(各建行点用自己协议的发送姿势,状态与体只有这一份)。 */
+export interface ExecutionRefusal {
+    readonly status: number;
+    readonly body: RefusalBody;
+}
+/**
+ * 本次认领 —— 提交拒时要释放的东西。`run` = 四个建行点与续跑家族认领的 run 行(释放 = 终结 + 放认领 + 放幂等键,唯一写法 `releaseClaimedRun`);
+ * `parked` = 停驻赎回的认领(释放 = 回滚认领;「会话不在」答那条腿既有的 `decide.not_parked`,不是提交腿的 404)。
+ */
+export type ExecutionClaim = {
+    readonly kind: "run";
+    readonly runStore: RunStore;
+    readonly taskId: string;
+} | {
+    readonly kind: "parked";
+    readonly taskId: string;
+    readonly rollback: (why: string) => Promise<unknown>;
+    readonly goneAnswer: ExecutionRefusal;
+};
+/** {@link commitExecutionContext} 的依赖 —— 逐字取自 `ServiceDeps` 的同名键(同一只 deps 对象喂进来)。 */
+export interface ExecutionCommitDeps {
+    readonly sessionStorage?: {
+        readonly executionPlacement?: ExecutionPlacementSeat;
+    } | undefined;
+    readonly deviceEnrollment?: DeviceEnrollment | undefined;
+    readonly config?: {
+        readonly runStaleSec?: number;
+    } | undefined;
+    readonly logger?: {
+        warn(msg: string, fields?: Record<string, unknown>): void;
+    } | undefined;
+    readonly metrics?: {
+        inc(name: string, labels?: Record<string, string>): void;
+    } | undefined;
+}
+/**
+ * claim 之后那一次写 / 再读的**硬时限**:从 `runStaleSec` 派生(不新铸旋钮)—— 它只回答「这次店往返会不会挂到 stale 回收把认领收走」。
+ * 取四分之一并夹在 `[1s, 15s]`。
+ */
+export declare function placementWriteDeadlineMs(runStaleSec: number | undefined): number;
+/** 拒绝的**唯一** wire 体铸点(各消费点各自用自己协议的发送姿势,但体的键集只有这一份)。 */
+export declare function devicePlacementErrorBody(rej: DeviceRejection): RefusalBody;
+/**
+ * **认领之后的唯一写口**(四个 `createRun` 点、续跑家族 `markResuming` 之后、停驻赎回 `claimParkedAgent` 之后)。返回 `null` = 放行;
+ * 否则本次认领已释放,调用方交回拒答。店故障 / 超时 ⇒ 释放后原样上抛(响亮,不当答案);设备意图那一支的注册簿故障答 {@link registryUnavailable}(设备闭集,同准入阶段)。
+ *
+ * 不变量(一句):**离开本函数的那一刻,这条会话(解析器那一位住客)的格就是这条执行的车道(device 车道:准入批准的那台设备);否则本次认领已释放、调用方拿到拒答。**
+ * 它不说「此后不变」:认领持有期间根行住客与放置不被换绑 / 导入改动,那是各写者写事务内锁根行后读认领的保证(规则句),不在本函数重复判。
+ */
+export declare function commitExecutionContext(deps: ExecutionCommitDeps, claim: ExecutionClaim, ctx: RootedExecutionContext): Promise<ExecutionRefusal | null>;
+//# sourceMappingURL=execution-context.d.ts.map