@sema-agent/server 7.140.0 → 7.141.0

package/dist/execution-lane-caps.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { StubExecutionEnv } from "@sema-agent/core";
-import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES, isBlankCoordinate } from "@sema-agent/settings-schema/execution-lanes";
+import { EXECUTION_LANE_WORDS as DECLARABLE_LANE_WORDS, EXECUTION_LANES, isBlankCoordinate, retiredLaneWordRefusal } from "@sema-agent/settings-schema/execution-lanes";
 import { DECLARE_HOME_REMEDY, LANE_HOME_UNDECLARED_EVENT, LANE_HOME_UNMEASURED_EVENT, buildHomeAbsentNote, buildHomeUnmeasuredNote } from "./lane-home-probe.js";
 const NO = "unsupported";
 const YES = "supported";
@@ -97,27 +97,61 @@ export function executionLaneCaps(lane) {
             };
     }
 }
+export const SANDBOX_READ_FLOOR_ENV = "SANDBOX_READ_FLOOR";
+export const SANDBOX_READ_FLOOR_WORDS = ["keep", "off"];
+export const SANDBOX_READ_FLOOR_DEFAULT = "keep";
+export function readFloorStateOf(knob, served) {
+    switch (knob) {
+        case "off":
+            return "off";
+        case "keep":
+            return served ? "kept" : "unserved";
+    }
+}
+export function sandboxReadFloorState(lane, knob) {
+    const k = knob ?? SANDBOX_READ_FLOOR_DEFAULT;
+    switch (lane) {
+        case "e2b":
+            return readFloorStateOf(k, false);
+        case "k8s":
+            return readFloorStateOf(k, false);
+        case "local-docker":
+            return readFloorStateOf(k, false);
+    }
+}
 const IN_PROCESS_BLOCK = new StubExecutionEnv().capabilities;
 const HOST_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: true, canonicalPathAuthoritative: true, hostLocalPaths: true, externalContentTarget: false, io: true, keepsReadFloor: false });
-const E2B_BLOCK = Object.freeze({ isolation: true, suspendable: true, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
-const K8S_BLOCK = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
-const K8S_SNAPSHOT_BLOCK = Object.freeze({ ...K8S_BLOCK, suspendable: true });
-const LOCAL_DOCKER_BLOCK = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
+const E2B_SHAPE = Object.freeze({ isolation: true, suspendable: true, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+const K8S_SNAPSHOT_SHAPE = Object.freeze({ ...K8S_SHAPE, suspendable: true });
+const LOCAL_DOCKER_SHAPE = Object.freeze({ isolation: true, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true });
+function sandboxBlock(shape, state) {
+    return Object.freeze({ ...shape, keepsReadFloor: state === "kept" });
+}
+function sandboxShape(lane, snapshotStore) {
+    switch (lane) {
+        case "e2b":
+            return E2B_SHAPE;
+        case "k8s":
+            return snapshotStore ? K8S_SNAPSHOT_SHAPE : K8S_SHAPE;
+        case "local-docker":
+            return LOCAL_DOCKER_SHAPE;
+    }
+}
 const SSH_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
 const ADB_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false });
 const DEVICE_BLOCK = Object.freeze({ isolation: false, suspendable: false, sharesProcessTable: false, canonicalPathAuthoritative: true, hostLocalPaths: false, externalContentTarget: true, io: true, keepsReadFloor: false });
-function laneBlock(lane, snapshotStore) {
+const NO_SUB_KNOBS = Object.freeze({ snapshotStore: false, sandboxReadFloor: undefined });
+function laneBlock(lane, sub) {
     switch (lane) {
         case "in-process":
             return IN_PROCESS_BLOCK;
         case "host":
             return HOST_BLOCK;
         case "e2b":
-            return E2B_BLOCK;
         case "k8s":
-            return snapshotStore ? K8S_SNAPSHOT_BLOCK : K8S_BLOCK;
         case "local-docker":
-            return LOCAL_DOCKER_BLOCK;
+            return sandboxBlock(sandboxShape(lane, sub.snapshotStore), sandboxReadFloorState(lane, sub.sandboxReadFloor));
         case "ssh":
             return SSH_BLOCK;
         case "adb":
@@ -130,7 +164,24 @@ export function capabilitiesFor(deployment) {
     const lane = executionLaneOf(deployment.remoteExec?.provider);
     if (lane === undefined)
         return undefined;
-    return laneBlock(lane, lane === "k8s" && Boolean(deployment.remoteExec?.s3Snapshot));
+    return laneBlock(lane, { snapshotStore: lane === "k8s" && Boolean(deployment.remoteExec?.s3Snapshot), sandboxReadFloor: deployment.sandboxReadFloor });
+}
+export function laneSandboxReadFloorState(deployment) {
+    const lane = executionLaneOf(deployment.remoteExec?.provider);
+    if (lane === undefined)
+        return undefined;
+    switch (lane) {
+        case "e2b":
+        case "k8s":
+        case "local-docker":
+            return sandboxReadFloorState(lane, deployment.sandboxReadFloor);
+        case "in-process":
+        case "host":
+        case "ssh":
+        case "adb":
+        case "device":
+            return undefined;
+    }
 }
 export const ALL_EXECUTION_LANES = Object.freeze(["in-process", ...DECLARABLE_LANE_WORDS]);
 const EXECUTION_LANE_SET = new Set(ALL_EXECUTION_LANES);
@@ -166,6 +217,32 @@ export function isBlankRequiredEnvValue(value) {
 export function laneMissingEnv(lane, env) {
     return laneRequiredEnv(lane).filter((name) => isBlankRequiredEnvValue(env[name]));
 }
+export function readDeclaredLaneTable(raw) {
+    const segments = raw.split(",");
+    const lanes = [];
+    for (const [i, segment] of segments.entries()) {
+        if (segment === "") {
+            return { refusal: `REMOTE_EXEC="${raw}" has an empty entry at position ${i + 1} — it is an ordered, comma-separated list of execution lanes (the first is the default) with no blank entries; valid lanes: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}.` };
+        }
+        const lane = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === segment);
+        const retired = lane === undefined ? retiredLaneWordRefusal(segment) : undefined;
+        if (retired !== undefined)
+            return { refusal: `REMOTE_EXEC="${raw}": ${retired}.` };
+        if (lane === undefined) {
+            return {
+                refusal: `REMOTE_EXEC="${raw}"${segments.length > 1 ? ` lists "${segment}", which` : ""} is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
+                    `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`,
+            };
+        }
+        if (lanes.includes(lane))
+            return { refusal: `REMOTE_EXEC="${raw}" lists "${lane}" twice — each execution lane appears once (the first one is the default).` };
+        lanes.push(lane);
+    }
+    const [first, ...rest] = lanes;
+    if (first === undefined)
+        throw new Error(`readDeclaredLaneTable: "${raw}" split into no segments`);
+    return { lanes: [first, ...rest] };
+}
 export function executionLaneRequiredRefusal(deployment) {
     if (!deployment.requireExecutionLane || executionLaneOf(deployment.remoteExec?.provider) !== "in-process")
         return undefined;
@@ -189,7 +266,7 @@ export function deployedExecutionLanes(config) {
     return [executionLaneOf(config.remoteExec?.provider)];
 }
 export function handsOnWorkerFilePlane(lane) {
-    const block = laneBlock(lane, false);
+    const block = laneBlock(lane, NO_SUB_KNOBS);
     return block.io && block.hostLocalPaths;
 }
 export function laneBindsReads(lane) {
@@ -236,10 +313,10 @@ export function laneReadFaceDefault(lane) {
 }
 export const LANE_OPEN_READ_FACE_CAUTION = "a deployment that mounts host paths or shared volumes into the sandbox (hostPath, bind mount) exposes those host files to reads on an open face — pin READ_FACE=roots or add read-deny rows (READ_DENY_PATTERNS) for them";
 export function laneIsolated(lane) {
-    return laneBlock(lane, false).isolation;
+    return laneBlock(lane, NO_SUB_KNOBS).isolation;
 }
 export function laneWiresExecutionEnv(lane) {
-    return laneBlock(lane, false).io;
+    return laneBlock(lane, NO_SUB_KNOBS).io;
 }
 export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
 export const E2B_SANDBOX_HOME = "/home/user";

package/dist/execution-placement.d.ts

@@ -8,6 +8,7 @@
  *    `execution` 位(`plugins/local-session-store.ts`)。处处 `execution` 限定,与同行 `placement_*`(委派分区)不同义;执行格只在 `placement_kind IS NULL` 的行上 ——
  *    委派分区行读作「不在」。
  *  · **读只有一只**:会话店的执行席 {@link ExecutionPlacementSeat.read}(一次行读:住客 + 格;行不在 / 委派分区行 ⇒ `undefined`;读故障抛,不吞成 `absent`)。
+ *    跨行的聚合也只有一只:设备店的绑定数 `countDeviceBindings`(writer(device, D) 的格数 = {@link boundDeviceOf} 的聚合;只交数,不交根 id)。
  *  · **写只按住客谓词** `(root, incarnation, owner) ∧ placement_kind IS NULL`:住客换了(删后重建,哪怕同一属主;local M10 窗内的认领)= 这一格不在 ⇒ 落空;
  *    0 行一律按住客复读分类({@link settledPlaceOutcome} / {@link settledMirrorOutcome} / {@link settledDeviceBindOutcome}),**永不对现住客重试**。
  *  · **没有的转换**:writer ↔ mirror、writer(L) → writer(L')(device 车道的换绑 writer(device, D) → writer(device, D') 除外,它有自己的语句与门)。
@@ -248,6 +249,8 @@ export declare class InMemoryExecutionPlacementSeat implements ExecutionPlacemen
     read(root: string): Promise<ExecutionPlacementReading | undefined>;
     place(root: string, occupant: SessionFace, cell: ExecutionWriterCell): Promise<PlaceOutcome>;
     markMirror(root: string, occupant: SessionFace): Promise<MarkMirrorOutcome>;
+    /** 绑定数(SQL 孪生 `countDeviceBindingsOn` 的对位,同一只判官):{@link boundDeviceOf} 读得出设备的格数。 */
+    countDeviceBindings(): number;
     /** device 首绑(SQL `placeDeviceStatement` / `bindDeviceStatement` 的对位):absent 或 writer(device, ∅) ⇒ writer(device, D)、rev 0。 */
     bindDevice(root: string, occupant: SessionFace, device: {
         readonly id: string;

package/dist/execution-placement.js

@@ -175,6 +175,13 @@ export class InMemoryExecutionPlacementSeat {
         this.rows.set(root, { occupant, cell: { role: "mirror" } });
         return { outcome: "mirrored" };
     }
+    countDeviceBindings() {
+        let bindings = 0;
+        for (const row of this.rows.values())
+            if (boundDeviceOf(row.cell) !== undefined)
+                bindings += 1;
+        return bindings;
+    }
     bindDevice(root, occupant, device, placedAt) {
         const settled = settledDeviceBindOutcome(root, this.rows.get(root), occupant, device.id);
         if (settled !== WRITABLE)

package/dist/fleet/drain-entry.d.ts

@@ -30,6 +30,7 @@
  * 纯类型 + 纯函数叶(值 import 只有 scope 读法叶与 run 行判词叶)。
  */
 import type { DrainReceipt, DrainRequest, EngineDraining } from "@sema-agent/settings-schema/fleet";
+import type { EngineLeaseFacts } from "../boot/engine-lease.js";
 /**
  * 引擎自铸的动作号 —— **一张表**(排空事实与回执里不来自请求体的全部拼法;请求体的 `actionId` 由调用方自取):
  *  · {@link ENGINE_DRAIN_CAUSES}:没有请求承载的排空成因(停止信号 / SIGHUP 升级 / 附着租约自退);
@@ -89,6 +90,8 @@ export interface DrainState {
     lastActivityAt?: () => number;
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
+    /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */
+    engineLease?: () => EngineLeaseFacts | undefined;
 }
 /** 排空盒子里的排空事实(三键齐才是;入口整组写,所以「缺一」只出现在手搭的夹具上)。 */
 export declare function drainingFactOf(s: Pick<DrainState, "draining" | "since" | "actionId" | "deadlineAt">): EngineDraining | undefined;

package/dist/hosted-posture.d.ts

@@ -65,6 +65,7 @@
  * `docs/DEPLOY-PREREQS.md` 的「托管 / 多租部署」段把它写成部署前置,并列出忘设它的后果。
  */
 import { type ServiceConfigFlat } from "./config-types.js";
+import { type PermissionMode } from "@sema-agent/core";
 /** 托管/多租的**证据词表**(闭集;加词 ⇒ {@link hostedEvidenceNote} 的穷举 switch 编译红)。
  *  🔴 恰一词是裁定([ref] ①),不是暂时的:加回一条推断臂 = 翻案,先要新裁定。 */
 export declare const HOSTED_EVIDENCE_WORDS: readonly ["require-principal"];
@@ -123,6 +124,13 @@ export type TaskHostPostureScope = HostedPostureInput & Readonly<Pick<ServiceCon
  * 两条腿同射程、不同处置,射程只有一处答案。
  */
 export declare function taskWriteFaceRefusal(c: TaskWriteFaceInput): string | undefined;
+/**
+ * **腿② 的词形入口** —— 一个模式词在这台部署上会不会开出它掀不开的写围栏:词的模式列开写面(引擎模式表本尊,
+ * `modePolicyOf(word).writeFace === "open"`,今天只有 `bypassPermissions`)∧ {@link taskWriteFaceRefusal} 答拒 ⇒ 拒因;否则 `undefined`。
+ * 读者两个,同是受理判官的托管一步(`permission-mode-admission.ts` 顶注「两口的调用形」):在飞 run 的切档口经判官本体;提交口与续跑重放存储体经装配期那一判
+ * (`boot/resolve-spec.ts`,问盖过章的词)。哪天 core 让第二个模式也开写面,两处当场跟上,不是再手抄一个模式词。
+ */
+export declare function permissionModeWriteFaceRefusal(word: PermissionMode | undefined, c: TaskWriteFaceInput): string | undefined;
 /**
  * **腿④** —— 这条请求要让 host shell 继承整份用户环境(`inheritEnv:"all"`),这台部署给不给?返回拒因;`undefined` = 放行。
  * 调用方只在值为 `"all"` 时问(`"scrub"` 就是缺省,任何部署都受理)。

package/dist/hosted-posture.js

@@ -1,5 +1,6 @@
 import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
+import { modePolicyOf } from "@sema-agent/core";
 export const HOSTED_EVIDENCE_WORDS = ["require-principal"];
 export function buildHostedPosture(c) {
     const evidence = [];
@@ -41,6 +42,9 @@ export function taskWriteFaceRefusal(c) {
         `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
         `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
 }
+export function permissionModeWriteFaceRefusal(word, c) {
+    return word !== undefined && modePolicyOf(word).writeFace === "open" ? taskWriteFaceRefusal(c) : undefined;
+}
 export function taskInheritEnvRefusal(c) {
     if (DEPLOYMENT_SHAPE_PREDICATES.taskHostPostureDeclarations.holds(c))
         return undefined;

package/dist/http/admission.js

@@ -2,11 +2,11 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
-import { autonomyModeFloor } from "../runtime-governance.js";
+import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -738,7 +738,7 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
-        const { body: admitted, entry: entryMode } = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
+        const { body: admitted, entry: entryMode } = stampSubmissionEntryMode(body, deps.config);
         const lease = deps.peerDesk.lease("fresh");
         try {
             const auth = await deps.authorize({ req, body: admitted });

package/dist/http/caller-trust.d.ts

@@ -3,8 +3,9 @@
  *
  * ## 律
  * 契约(settings-schema `SAFETY_MERGE_SPEC.permissions` 的成员阶梯)按**层的信任档**准入每个成员:`allow` 放宽免问面(`loosen`),要 `global`;`deny` / `ask` 只收紧,
- * 文件层最低档 `local` 就收。wire 上没有层 —— 提交体是合并后的扁平结果,层只在合并端(cli 本地)存在;自报一个层 / 作者位不可验(引擎侧已拒立这种位)。所以本服务
- * 的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源 + 登录令牌的 scope 角色推,调用方说什么都不改档。
+ * 文件层最低档 `local` 就收。准入不读层:提交体是合并后的结果,层只在合并端(cli 本地)存在;deny / ask 条目可以带出处层(`{ rule, layer }`),但那个层只选这条规则的
+ * `/` 读在哪个根(`permission-rule-list.ts` 的 `layerRuleRoot`),自报的层不可验、**不进本判**。所以本服务准入的「层」= **这次请求验过的凭据**:档只由部署形 + 身份来源
+ * + 登录令牌的 scope 角色推,调用方说什么(含条目上的层)都不改档。
  *
  *  · 单用户 turnkey(`requirePrincipal !== true`,本仓 posture 判别式同一只)⇒ `global`:一台机一位超管;
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;

package/dist/http/caller-trust.js

@@ -1,6 +1,7 @@
 import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
+import { ruleTextOf } from "../permission-rule-list.js";
 import { verifiedIdentitySource } from "./principal-gate.js";
 export function callerTrust(req, config) {
     if (config.requirePrincipal !== true)
@@ -34,7 +35,7 @@ function effectiveRuleTables(t) {
         for (const member of membersOf("permissions")) {
             const entries = t.permissions[member];
             if (entries !== undefined)
-                out.push({ member, field: `settings.permissions.${member}`, entries, source: "settings" });
+                out.push({ member, field: `settings.permissions.${member}`, entries: entries.map(ruleTextOf), source: "settings" });
         }
     }
     if (t.skills !== undefined && t.userInvokedSkills !== undefined) {

package/dist/http/dispatch.js

@@ -138,6 +138,10 @@ export function createDispatch(ctx) {
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...healthDrainingKeys(signal),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
+                ...(() => {
+                    const lease = deps.drainState?.engineLease?.();
+                    return lease ? { engineLease: { lingerMs: lease.lingerMs, tickMs: lease.tickMs } } : {};
+                })(),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),
                 model: deps.config.model.id,

package/dist/http/live-frame.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `POST /v1/tasks/stream`(活流腿:新提交、同键重放、在飞合流的跟随方)的**唯一**帧写口。
+ *
+ * 律(一条):这条流上的每一帧都是 `[id: <eventId>\n]event: <type>\ndata: <json>\n\n`,事件名 = 载荷的 `type`。
+ * 心跳是同一只写口写的 `event: heartbeat` + `data: {}`。与 durable 尾(`http/sse-log.ts`)、sdk 的 `toSseResponse` 中继同形。
+ *
+ * `id:` 行(契约 §0.6):载荷带非空 string `eventId` 才发,值逐字 = `eventId`;没有就不发,EventSource 沿用上一游标 ——
+ * 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。`id:` 行是**每帧唯一**的续流游标,所以载荷的 `eventId` 必须是**本帧
+ * 自己的**身份(server 自铸帧的唯一铸点:`trace/model-segment.ts` 的 `reasoningSegmentEventId`)。三道门各管一段:
+ * {@link LiveFrame} 管「铸点说得出这两个键的型」;本函数的运行期判据管「真的是」(通体 `Record<string, unknown>` 的
+ * 构造器返回值进得来 —— `null` 读 `.length` 会把整条流摔掉、数组会被强转成一枚编出来的游标);`test/live-sse-cursor.test.ts`
+ * 的规则式全流判据管「同一条流内不重复」。
+ */
+import type { ServerResponse } from "node:http";
+/** 活流帧的载荷型:`type` 是事件名(必填,型说得出口);`eventId` 在场即**本帧自己的**续流游标。其余键由各自铸点白名单。 */
+export type LiveFrame = {
+    readonly type: string;
+    readonly eventId?: string;
+} & Record<string, unknown>;
+/** 写一帧。`type` 不是非空串 = 铸点违约(型门之外漏进来的通体记录),响亮抛 —— 写一行编出来的事件名是撒谎,不写事件名就回到两只形。 */
+export declare function writeLiveFrame(res: ServerResponse, payload: LiveFrame): void;
+/** 心跳:真帧,不是 SSE 注释(逐帧解析的 BFF 会丢注释行,下游看到的是一段零帧的窗)。没有监听心跳的 EventSource 客户端忽略它。 */
+export declare function writeLiveHeartbeat(res: ServerResponse): void;
+//# sourceMappingURL=live-frame.d.ts.map

package/dist/http/live-frame.js

@@ -0,0 +1,16 @@
+import { liveToolEndForBacklog } from "../trace/tool-output-media.js";
+function frameBytes(event, data, anchor) {
+    const idLine = typeof anchor === "string" && anchor.length > 0 ? `id: ${anchor}\n` : "";
+    return `${idLine}event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+}
+export function writeLiveFrame(res, payload) {
+    const name = payload.type;
+    if (typeof name !== "string" || name.length === 0)
+        throw new TypeError(`live SSE frame without a string type: ${JSON.stringify(name)}`);
+    const frame = name === "tool_end" ? liveToolEndForBacklog(payload, res.writableLength) : payload;
+    res.write(frameBytes(name, frame, payload.eventId));
+}
+export function writeLiveHeartbeat(res) {
+    res.write(frameBytes("heartbeat", {}, undefined));
+}
+//# sourceMappingURL=live-frame.js.map

package/dist/http/resume-legs.js

@@ -7,9 +7,10 @@ import { headReadOf } from "../session-incarnation.js";
 import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
-import { graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
-import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
+import { voidVerifierPauseCard } from "../verifier-pause-card.js";
+import { buildCancelledLedgerRow, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
 import { isTerminalRunStatus } from "../plugins/store-contracts.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
@@ -679,6 +680,7 @@ export function createResumeLegs(ctx) {
             fleetPub?.onTerminal(status, residuals);
         };
         let result;
+        let heldPark;
         let reopenConfirmedPark = false;
         const confirmCheckpointReopened = async () => {
             const store = deps.checkpointStore;
@@ -695,28 +697,32 @@ export function createResumeLegs(ctx) {
         const settleCardForCancel = async () => {
             const cs2 = deps.checkpointStore;
             if (!cs2)
-                return;
+                return false;
             try {
                 const live = await cs2.get(token);
-                if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
-                    deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
-                }
+                if (live?.status !== "pending")
+                    return false;
+                if (await cs2.expire(token, live.scope))
+                    return true;
+                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                return false;
             }
             catch (cancelSettleErr) {
                 deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
                     taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
                 });
+                return false;
             }
         };
         const reopenedAfterLeg = async (leg, cancelledAtDone) => {
             if (freshRunClaimed || !legMayHaveReopenedCheckpoint(leg))
-                return false;
+                return { reopened: false, leg };
             const pending = cancelledAtDone ? false : await confirmCheckpointReopened();
             if (cancelledAtDone || cancelCtrl.cause() !== undefined) {
-                await settleCardForCancel();
-                return false;
+                const expired = await settleCardForCancel();
+                return { reopened: false, leg: expired ? withCardSettledByCancelMessage(leg) : leg };
             }
-            return pending;
+            return { reopened: pending, leg };
         };
         let resumeHeartbeat;
         let resumeManifestLease = 0;
@@ -850,15 +856,18 @@ export function createResumeLegs(ctx) {
                     resumeLegLive = true;
                     const vrEngine = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
                     const vrCause = cancelCtrl.cause();
+                    await voidVerifierPauseCard(vrEngine, deps.checkpointStore);
                     const vrJudged = atHostBoundary(vrEngine, sessionId);
-                    const vr = vrCause !== undefined && taskId !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: vrJudged, cause: vrCause }) : vrJudged;
+                    if (vrJudged.terminal.kind === "paused")
+                        heldPark = vrJudged;
+                    const vrMinted = vrCause !== undefined && taskId !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: vrJudged, cause: vrCause }) : vrJudged;
                     await commitResumeCtx();
+                    const { reopened: vrReopened, leg: vr } = await reopenedAfterLeg(vrMinted, vrCause !== undefined);
                     let safe = sealResultForExit(vr);
                     const vrPaused = vr.terminal.kind === "paused" ? vr.terminal : undefined;
                     const vrParkWord = vrPaused !== undefined ? outwardPlane(vrPaused).status : undefined;
                     const reParkEvent = vrParkWord !== undefined && isParkLedgerEventType(vrParkWord) ? vrParkWord : undefined;
                     const reSuspended = reParkEvent !== undefined;
-                    const vrReopened = await reopenedAfterLeg(vr, vrCause !== undefined);
                     if (vrReopened)
                         reopenConfirmedPark = true;
                     if (taskId && deps.runStore) {
@@ -916,7 +925,7 @@ export function createResumeLegs(ctx) {
                 const captureUserMessageAnchor = deps.resumeAnchorStore && taskId
                     ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
                     : undefined;
-                const anchor = new TurnAnchorCapture(captureTurnAnchor, () => deps.metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
+                const anchor = new TurnAnchorCapture(captureTurnAnchor, "resume", captureUserMessageAnchor);
                 const flush = async () => {
                     if (reasoning) {
                         await append("reasoning", modelTextEventData({ text: reasoning, eventId: reasoningEventId }));
@@ -997,15 +1006,18 @@ export function createResumeLegs(ctx) {
                         for await (const ev of stream)
                             await resumeWorkspace.observe(ev);
                         const rNoRow = await stream.result();
-                        if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
+                        const noRowLeg = await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined);
+                        if (noRowLeg.reopened)
                             reopenConfirmedPark = true;
-                        return sealResultForExit(rNoRow);
+                        return sealResultForExit(noRowLeg.leg);
                     }
                     onAccepted?.(acceptedResumingReceipt(taskId, sessionId, buildSettlementEvidence({ at: "engine_accepted", commitment: args.commitment })));
                     let causeAtDone;
                     for await (const ev of stream) {
                         if (ev.type === "done")
                             causeAtDone = cancelCtrl.cause();
+                        if (ev.type === "done" && ev.result.terminal.kind === "paused")
+                            heldPark = ev.result;
                         recordTurnActivity(taskId);
                         fleetPub?.onEvent(ev);
                         await deps.userInputLedger?.observeLegEvent(stream, ev);
@@ -1125,6 +1137,8 @@ export function createResumeLegs(ctx) {
                     await flush();
                     const rEngine = await stream.result();
                     const r = causeAtDone !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: rEngine, cause: causeAtDone }) : rEngine;
+                    if (r.terminal.kind === "paused")
+                        heldPark = r;
                     const rPark = r.terminal.kind === "paused" ? outwardPlane(r.terminal).status : undefined;
                     if (rPark === "suspended") {
                         await append("suspended", parkEventData(await graftParkToolCallId(r, deps.checkpointStore)));
@@ -1136,7 +1150,8 @@ export function createResumeLegs(ctx) {
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
-                    if (await reopenedAfterLeg(r, causeAtDone !== undefined)) {
+                    const settledLeg = await reopenedAfterLeg(r, causeAtDone !== undefined);
+                    if (settledLeg.reopened) {
                         reopenConfirmedPark = true;
                         try {
                             await append(reparkStatus, parkEventData(r, failureCodeOf(r.terminal) ?? null));
@@ -1146,7 +1161,7 @@ export function createResumeLegs(ctx) {
                         }
                         return r;
                     }
-                    const safe = await attachModelUsage(sealResultForExit(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
+                    const safe = await attachModelUsage(sealResultForExit(settledLeg.leg), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
                     await append("done", { result: safe });
                     if (taskConfig.suggestNextPrompts && safe.terminal.kind === "completed") {
                         const suggestions = await stream.suggestions().catch(() => []);
@@ -1184,14 +1199,14 @@ export function createResumeLegs(ctx) {
             if (e instanceof CheckpointError) {
                 const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
-                    await settleCardForCancel();
+                    const abortedText = (await settleCardForCancel()) ? CARD_SETTLED_BY_CANCEL_MESSAGE : e.message;
                     if (claimedRow && taskId && deps.runStore) {
                         const handleCause = cancelCtrl.cause();
                         if (handleCause === undefined)
                             recordFailOpen("server.runs.abort-cause-missing", `task=${taskId} arm=resume-aborted`);
-                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: e.message, cause: handleCause ?? "cancel_verb" });
+                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: abortedText, cause: handleCause ?? "cancel_verb" });
                         await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-resume-aborted ${errorText(err)}`));
-                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
+                        await deps.runStore.setTerminal(taskId, "failed", c, abortedText).catch(() => undefined);
                     }
                     settleFleet("failed");
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
@@ -1219,6 +1234,7 @@ export function createResumeLegs(ctx) {
             const thrownCause = cancelCtrl.cause();
             if (thrownCause !== undefined) {
                 if (taskId && deps.runStore) {
+                    await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
                     const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", cause: thrownCause });
                     await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-thrown-cancel ${errorText(err)}`));
                     await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
@@ -1227,6 +1243,7 @@ export function createResumeLegs(ctx) {
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
             }
             if (claimedRow && taskId && deps.runStore) {
+                await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
                 await deps.runStore.setTerminal(taskId, "failed", null, errorText(e)).catch(() => undefined);
             }
             settleFleet("failed");

package/dist/http/route-table.js

@@ -29,6 +29,7 @@ import { handleNotifyWake, NOTIFY_WAKE_ROUTES } from "./routes/notify-wake.js";
 import { handleApprovalsAssistant, APPROVALS_ASSISTANT_ROUTES } from "./routes/approvals-assistant.js";
 import { handleRuns, handleRunVerbs, RUNS_ROUTES, RUN_VERBS_ROUTES } from "./routes/runs.js";
 import { handleRunMemoryCapture, RUN_MEMORY_CAPTURE_ROUTES } from "./routes/run-memory-capture.js";
+import { handlePermissionMode, RUN_PERMISSION_MODE_ROUTES } from "./routes/run-permission-mode.js";
 import { handleMcpReconnect, MCP_RECONNECT_ROUTES } from "./routes/mcp-reconnect.js";
 import { handleBackground, BACKGROUND_ROUTES } from "./routes/background.js";
 import { handleSideQuery, SIDE_QUERY_ROUTES } from "./routes/side-query.js";
@@ -51,6 +52,7 @@ export const ROUTES = [
     row({ handler: handleWorkflowAgentSteer, decls: WORKFLOW_AGENT_STEER_ROUTES, position: "post-credential", label: "workflow-agent-steer" }),
     row({ handler: handleRunVerbs, decls: RUN_VERBS_ROUTES, position: "post-credential", label: "run-verbs" }),
     row({ handler: handleRunMemoryCapture, decls: RUN_MEMORY_CAPTURE_ROUTES, position: "post-credential", label: "run-memory-capture" }),
+    row({ handler: handlePermissionMode, decls: RUN_PERMISSION_MODE_ROUTES, position: "post-credential", label: "permission-mode" }),
     row({ handler: handleMcpReconnect, decls: MCP_RECONNECT_ROUTES, position: "post-credential", label: "mcp-reconnect" }),
     row({ handler: handleBackground, decls: BACKGROUND_ROUTES, position: "post-credential", label: "background" }),
     row({ handler: handleLeader, decls: LEADER_ROUTES, position: "post-credential", label: "leader" }),

package/dist/http/routes/approvals-assistant.js

@@ -408,6 +408,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.mandate !== undefined ? { mandate: s.mandate } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
+                    ...(s.boundGrantDigest !== undefined ? { boundGrantDigest: s.boundGrantDigest } : {}),
                     ...skillCardFacts(s),
                     ...(s.boundGrantAbsence !== undefined ? { boundGrantAbsence: s.boundGrantAbsence } : {}),
                     objective,

package/dist/http/routes/capabilities.js

@@ -24,7 +24,7 @@ import { projectStoreCapability } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { judgeSandboxGitPlane, sandboxGitPlanePremisesOf } from "../../sandbox-git-plane.js";
-import { MCP_ASSERTION_HEADER_SENT } from "../../mcp-assertion-header.js";
+import { MCP_ASSERTION_HEADER_SENT, MCP_REQUEST_TRANSPORT_KINDS } from "../../mcp-assertion-header.js";
 import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
 import { workflowModelAllowlistFor } from "../../task-workflow.js";
@@ -96,7 +96,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                         maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4,
                         wsPath: DEVICE_WS_PATH,
                         management: facts.deviceManagement(deps).available,
-                        ...(deps.config.remoteExec?.provider === "device" && deps.config.remoteExec.relayUrl !== undefined ? { relayUrl: deps.config.remoteExec.relayUrl } : {}),
+                        ...(deps.config.remoteExec?.provider === "device" && deps.config.remoteExec.relay.kind === "url" ? { relayUrl: deps.config.remoteExec.relay.url } : {}),
                     }
                     : false,
                 sessionEvents: facts.sessionEventStream(deps).available,
@@ -133,7 +133,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 oneShot: true,
                 policy: true,
                 usage: Boolean(deps.costQuota),
-                permissionModeWrite: false,
+                permissionModeWrite: facts.permissionModeWrite(deps).available,
                 modelSelection: true,
                 effortSelection: true,
                 toolOutput: true,
@@ -143,7 +143,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
-                settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
+                settings: { permissions: { allowGrant: true, allowLayer: true, layers: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -181,6 +181,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 mcp: true,
                 mcpProbe: true,
                 mcpAssertionHeaderSent: MCP_ASSERTION_HEADER_SENT,
+                mcpTransportKinds: [...MCP_REQUEST_TRANSPORT_KINDS],
                 mcpElicitation: facts.elicitation(deps).available,
                 askUserQuestion: facts.askUserQuestion(deps).available,
                 toolApproval: facts.toolApproval(deps).available,