@sema-agent/server 7.140.0 → 7.141.0

package/dist/http/routes/diagnostics.d.ts

@@ -73,25 +73,6 @@ export interface StaticWiringFacts {
     /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
     backendKind: "mysql" | "pg" | "local" | undefined;
 }
-/**
- * 三项对表(设计稿件二)。判据全是**两个独立谓词对同一件事的答案**,矛盾即装配谎言 —— 装配谎言不是
- * 「配置不理想」,是「服务端对自己接了什么线的两套说法互斥」,继续启动只会把矛盾带进运行期的每一条腿。
- *
- *  ① park 设施:core 从 `spec.checkpointStore ?? deps.checkpointStore` 判 `parkLane.capable`,我方从
- *     `backend.checkpoint ∧ DURABLE_APPROVAL` 判 `parkFacility` 并据此决定流内审批协议上不上场。两者
- *     不等 ⇒ 协议按「窗到期能 park」上场而引擎侧根本不 park(结局是 core fail-closed deny),或反之
- *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
- *     park,窗到期依旧无降级目的地。
- *  ② 会话店持久性:manifest 声明 `declared_durable` 而后端是 local / 根本没有后端 ⇒ 「重启存活」的声明
- *     没有介质兑现。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。
- *  ③ interaction posture 声明 `interactive` 却没有任何 question 投递面 ⇒ 只 **warn**:core 在 prepare 时
- *     会按腿拒,boot 先一步把话说成人话。不拒启,因为部署形本身可能只是暂时没接活体面,而 core 侧已有
- *     兜底门 —— 拒启会把一个可运行的部署挡在门外。
- *  ④ park 车道的持久性读数不可信时 ⇒ **warn**(理由与这条判据为什么不是拒启,见其行内注)。
- *
- * 判决分两级是有判据的:**拒启**留给「两个谓词对同一件事互斥」(其中一个必错,继续跑就是带着谎言服务);
- * **警告**留给「读数不可信/声明不完整」(信号本身还不足以断定谁错,据此拒启会挡住正常部署)。
- */
 export declare function buildStaticWiringAudit(facts: StaticWiringFacts): StaticWiringAudit;
 /**
  * boot 消费口:`refusals` 非空即抛(拒启,与 memory+durable 两条既有拒启同族的 fail-loud 形),

package/dist/http/routes/diagnostics.js

@@ -43,6 +43,20 @@ export function buildServerWiringGates(input) {
         approvalGrant: [...input.approvalGrant],
     };
 }
+function durableSessionMedium(kind) {
+    switch (kind) {
+        case "mysql":
+        case "pg":
+        case "local":
+            return true;
+        case undefined:
+            return false;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`durableSessionMedium: no ruling for store backend kind ${JSON.stringify(unknownKind)}`);
+        }
+    }
+}
 export function buildStaticWiringAudit(facts) {
     const refusals = [];
     const warnings = [];
@@ -56,9 +70,9 @@ export function buildStaticWiringAudit(facts) {
         refusals.push(`park facility contradiction: this server assembled its approval gates with parkFacility=true, but the engine's static wiring resolves parkLane.effective=${JSON.stringify(park.effective)} (reasons: ${park.reasons.join(", ") || "none"}). ` +
             `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
     }
-    if (facts.manifest.session.store === "declared_durable" && facts.backendKind !== "mysql" && facts.backendKind !== "pg") {
+    if (facts.manifest.session.store === "declared_durable" && !durableSessionMedium(facts.backendKind)) {
         refusals.push(`session store durability contradiction: the engine's static wiring reports session.store="declared_durable" while the store backend is ${facts.backendKind === undefined ? "absent (env-only worker)" : `"${facts.backendKind}"`}. ` +
-            `A durable declaration with no durable medium is a claim nothing can honor — refusing to start. Wire DB_BACKEND=mysql|pg, or fix the store's durability declaration.`);
+            `A durable declaration with no durable medium is a claim nothing can honor — refusing to start. Wire DB_BACKEND=mysql|pg|local, or fix the store's durability declaration.`);
     }
     if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +

package/dist/http/routes/memory-bundle.d.ts

@@ -20,12 +20,12 @@
  * 不该从「这个部署有没有记忆引擎」上读出部署形态。
  *
  * ── 能力面的诚实形(与 GET 面**方向相反**,这不是笔误)──────────────────────────────────────
- * `GET /v1/memory/export` 要的是 **DB 记忆平面**(pg|tidb),file 形态 501。本面要的是 core 的
+ * `GET /v1/memory/export` 要的是 **DB 记忆平面**(pg|mysql),file 形态 501。本面要的是 core 的
  * **bundle 复合面**(`exportSnapshotOf` / `importBundleCommit`),而它今天只在 core 自带的 **File**
  * 后端上实装:本仓的两只 SQL 记忆孪生(plugins/memory-engine-{pg,tidb}.ts)没有实现这两个可选面。
  * 因此**两个成因同落 501** `capability.memory_engine_required`(都是「换部署形态才行」,消费端分支相同):
  *  · 记忆引擎整个没接线(`MEMORY_ENGINE=off` / 多租 file 底座等暗态);
- *  · 引擎接了但后端没有 bundle 复合面(pg/tidb 孪生)—— 这一支在**挂载期**就判掉了
+ *  · 引擎接了但后端没有 bundle 复合面(pg/mysql 孪生)—— 这一支在**挂载期**就判掉了
  *    (`createMemoryBundleFaces` 返回 undefined ⇒ 两口整个不挂),能力位 `memoryBundle` 因此与「路由真能用」
  *    严格同真。🔴 首版把它当运行期事实(照常挂载、让 core 每次抛 409/422),被 codex 交叉复审驳倒并改此形:
  *    面在不在是一次**属性检查**、boot 期判得出、且是**永久**缺席 ⇒ 照常挂着就是一个恒假的 yes,

package/dist/http/routes/memory-bundle.js

@@ -83,7 +83,7 @@ export async function handleMemoryBundle(req, res, match, ctx) {
     if (!fact.available) {
         switch (fact.why) {
             case "memory_bundle_faces_absent":
-                sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/tidb memory backends do not");
+                sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/mysql memory backends do not");
                 return;
             case "operator_principals_empty":
                 sendOperatorPrincipalsRequired(res);

package/dist/http/routes/memory-compliance.js

@@ -39,7 +39,7 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
     if (!fact.available) {
         switch (fact.why) {
             case "memory_compliance_faces_absent":
-                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             case "operator_principals_empty":
                 sendOperatorPrincipalsRequired(res);

package/dist/http/routes/memory-policy.js

@@ -74,7 +74,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 return;
             }
             if (deps.config.memoryEngineBackend === "file" || !deps.memoryExport) {
-                sendError(res, 501, "capability.memory_store_required", "memory export requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)");
+                sendError(res, 501, "capability.memory_store_required", "memory export requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|mysql)");
                 return;
             }
             const q = new URLSearchParams(match.search);
@@ -136,7 +136,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 return;
             }
             if (deps.config.memoryEngineBackend === "file" || !deps.memorySync) {
-                sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)");
+                sendError(res, 501, "capability.memory_store_required", "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|mysql)");
                 return;
             }
             const scope = safeDecode(match.params.scope);

package/dist/http/routes/run-permission-mode.d.ts

@@ -0,0 +1,75 @@
+/**
+ * 在飞 run 的**权限模式切档口** —— 引擎动词 `TaskStream.setPermissionMode(word)` 的 wire 面:
+ *
+ *   `POST /v1/runs/:id/permission-mode`  body `{ mode }`(`mode` ∈ 引擎 `PERMISSION_MODES` 闭集)
+ *     → 200 `{ taskId, sessionId, status: "running", permissionMode, admission?, persisted, persistMiss? }`
+ *
+ * 语义 = 引擎的切档:改写这条腿的请求词,部署的折叠(`RuntimeCaps` 拒位 / 分类器席缺席)由引擎重判,**下一次**工具调用按新档仲裁;
+ * 进 `auto` 当场武装分类器,武装失败 ⇒ 引擎回滚(被替换的词照旧)并拒。`permissionMode` 是引擎回执原样(`{ requested?, effective, foldedBy? }`,
+ * 与 `wiring_manifest.permissionMode` 同形):每次都回,动没动都回 —— 壳渲染引擎说的,不渲染它自己发的。
+ *
+ * ── 一条规则:切档口与提交口是同一只受理判官(`permission-mode-admission.ts`)───────────────────────────────
+ * 交给引擎的不是调用方的原词,是受理判官对它的答:本任务 settings 的 kill-switch 折叠(读这条 run 的**存储体**)→ 运维 `AUTONOMY` 入口地板钳
+ * → 托管写围栏拒。提交口在受理时拒过 / 折过的词,切档口同样拒 / 折(两口一张表的钉在 `test/run-permission-mode-admission.test.ts`);
+ * 引擎在根腿上没有这三问的拒位,所以它们必须在这里答。折了 ⇒ 回执旁带 `admission: { requested, admitted, foldedBy }`(present-iff:本判官改了词);
+ * 拒 ⇒ 422 `request.host_posture_refused`(与提交口同码同句)。
+ *
+ * ── 回写:准入的词写回存储体(run 模式词的唯一来源)────────────────────────────────────────────────────────
+ * 续跑腿(停驻后续跑 / 重启后续跑)按存储体顶层 `permissionMode` 重建 spec;不写回 = 下一腿回到切档前的词。写回走**认领栅栏**
+ * (checkpoint 店的 `rewriteCtxWhileClaimed`:只在**接下切档的那条腿**此刻仍持有这条 run 时写,只改既有行)—— 这条 run 终局放掉认领、同会话新 run
+ * 已写下它自己的存储体之后,或这条 run 停驻、续跑的新腿(同一个 taskId 回到 running、认领仍在)已写下它续跑用的体之后,迟到的回写零写,
+ * 不会拿旧腿的体盖掉新腿的。腿身份 = {@link switchLegHolds}(栅栏里问)。同一条腿上的切档在本进程按活流对象串行(引擎受理序 = 落盘序;活流只在本副本)。
+ * 写不进(`persisted:false` + `persistMiss` ∈ {@link PERMISSION_MODE_PERSIST_MISSES})⇒ 本腿的切档照样生效、下一腿读到的是切档前的词:
+ * 一行运维 warn + fail-open 计数(`server.run-permission-mode.write-back-unpersisted`),壳据 `persisted` 判要不要在续跑后重切。
+ *
+ * ── 门(与 steer 同一组)──────────────────────────────────────────────────────────────────────────────
+ * 零模型工作(不进 billable);mutating ⇒ `rateLimited`。属主门与 steer / interrupt 同一组放行臂(行经属主存取器 `readOwnedRun` 取,`owner_or_operator`):
+ * 显式 operator 可切任一租户的 run(监督动作),普通调用方只切自己的(非属主 404 同串,不给存在性 oracle);`?session=` 的受理期断言同族。非 live 四臂一码 409 `steering.not_running`
+ * (停驻 / 终局 / 他副本 / 本副本无活流);坏词 422 `steering.invalid_content`(引擎同码,受理前判)。能力位 `permissionModeWrite`
+ * = 事实 `permissionModeWrite`(持久 run 账面 ∧ checkpoint 店),与两道 501 同一只。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PermissionMode, PermissionModeReceipt } from "@sema-agent/core";
+import { type FencedRun } from "../../plugins/store-contracts.js";
+import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import { type PermissionModeAdmissionFold } from "../../permission-mode-admission.js";
+/** 回写没落定的成因(闭集;wire `persistMiss`):`claim_released` 接下切档的那条腿这一刻已不持有这条 run(终局 / 停驻 / 已由续跑的新腿接手);
+ *  `context_absent` 持有但会话没有存储体行;`store_failed` 店写抛(库抖 / 一行装不下 / 封签失败)。 */
+export declare const PERMISSION_MODE_PERSIST_MISSES: readonly ["claim_released", "context_absent", "store_failed"];
+export type PermissionModePersistMiss = (typeof PERMISSION_MODE_PERSIST_MISSES)[number];
+/**
+ * **接下切档的那条腿此刻是否仍持有这条 run** —— 回写的腿身份,在认领栅栏里问(`rewriteCtxWhileClaimed` 的 `legHolds`,锁住 / 同步段里那一行的 {@link FencedRun})。
+ * 认领与 `running` 只认 taskId,续跑腿让同一个 taskId 停驻之后回到 `running`、认领仍在(ABA);分开两条腿的是:
+ *  · run 行仍在本副本(`runProvenElsewhere` 的反面 —— 别的副本续跑了它,续跑的 CAS 赢点把行上的副本改成它自己);
+ *  · 本副本这条 run 此刻登记的活流仍是接下切档的那一只(本副本上续跑的新腿登记的是另一只流对象;腿收场时按对象身份摘掉自己的)。
+ */
+export declare function switchLegHolds<S extends object>(fenced: FencedRun, thisInstanceId: string | undefined, liveNow: S | undefined, switched: S): boolean;
+/** 本判官改了词时回执旁的那一格(`admission`)。 */
+interface PermissionModeAdmissionNote {
+    readonly requested: PermissionMode;
+    readonly admitted: PermissionMode;
+    readonly foldedBy: PermissionModeAdmissionFold;
+}
+/** 200 体(键集属主:`trace/self-minted-wire.ts` 的 `permissionModeVerbBodyKey` 按它的键 `satisfies`)。`permissionMode` = 引擎回执原样。 */
+export interface PermissionModeVerbReply {
+    readonly taskId: string;
+    readonly sessionId: string;
+    readonly status: "running";
+    readonly permissionMode: PermissionModeReceipt;
+    /** present-iff 受理判官改了词。 */
+    readonly admission?: PermissionModeAdmissionNote;
+    readonly persisted: boolean;
+    /** present-iff `persisted: false`。 */
+    readonly persistMiss?: PermissionModePersistMiss;
+}
+export declare function handlePermissionMode(req: IncomingMessage, res: ServerResponse, match: RouteMatch<RunPermissionModeRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const RUN_PERMISSION_MODE_ROUTES: readonly [{
+    readonly id: "run-permission-mode";
+    readonly pattern: RegExp;
+    readonly label: "/v1/runs/:id/permission-mode";
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type RunPermissionModeRouteId = RouteIdsOf<typeof RUN_PERMISSION_MODE_ROUTES>;
+export {};
+//# sourceMappingURL=run-permission-mode.d.ts.map

package/dist/http/routes/run-permission-mode.js

@@ -0,0 +1,170 @@
+import { z } from "zod";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { readOwnedRun } from "../owner-access.js";
+import { runNotFoundMessage } from "../route-ctx.js";
+import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { PERMISSION_MODE_WORDS, coercePermissionModeStrict, parseTaskSettings } from "../../task-settings.js";
+import { admitPermissionModeWord } from "../../permission-mode-admission.js";
+import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "../resume-ctx-read.js";
+import { sealCheckpointCtx, withPermissionModeRewritten } from "../checkpoint-ctx.js";
+import { serviceVersion } from "../../service-version.js";
+import { recordFailOpen } from "../../observability/fail-open.js";
+export const PERMISSION_MODE_PERSIST_MISSES = ["claim_released", "context_absent", "store_failed"];
+const BodySchema = z.object({ mode: z.string() }).strict();
+const switchChains = new WeakMap();
+function serialOnStream(stream, work) {
+    const prior = switchChains.get(stream) ?? Promise.resolve();
+    const job = prior.then(work, work);
+    switchChains.set(stream, job.catch(() => undefined));
+    return job;
+}
+export function switchLegHolds(fenced, thisInstanceId, liveNow, switched) {
+    return !runProvenElsewhere(fenced, thisInstanceId) && liveNow === switched;
+}
+export async function handlePermissionMode(req, res, match, ctx) {
+    const { deps } = ctx;
+    switch (match.decl.id) {
+        case "run-permission-mode": {
+            if (ctx.helpers.rateLimited(req, res))
+                return;
+            const seat = facts.permissionModeWrite(deps);
+            if (!seat.available) {
+                switch (seat.why) {
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "changing a running run's permission mode requires a durable run store (DB_BACKEND=mysql|pg|local)");
+                        return;
+                    case "checkpoint_store_absent":
+                        sendError(res, 501, "capability.checkpoint_store_required", "changing a running run's permission mode requires the checkpoint store (DURABLE_APPROVAL): the run's stored request is where its permission mode lives and where the task's own settings are read");
+                        return;
+                    default:
+                        return assertNever(seat.why);
+                }
+            }
+            const { runStore, checkpointStore } = seat;
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && principal === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            const taskId = match.params.taskId;
+            const parsed = BodySchema.safeParse((await ctx.helpers.readJson(req)) ?? {});
+            if (!parsed.success) {
+                sendError(res, 400, "request.body_shape", `body must be { mode: ${PERMISSION_MODE_WORDS} } — the permission-mode verb takes no other keys`);
+                return;
+            }
+            const word = coercePermissionModeStrict(parsed.data.mode);
+            if (word === undefined) {
+                sendError(res, 422, "steering.invalid_content", `mode must be one of ${PERMISSION_MODE_WORDS} (got ${JSON.stringify(parsed.data.mode.slice(0, 64))})`);
+                return;
+            }
+            const run = await readOwnedRun(deps.config, runStore, principal, taskId, "owner_or_operator");
+            if (!run) {
+                sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
+                return;
+            }
+            if (!ctx.helpers.runSessionAcceptOk(req, res, run, "run.permission_mode"))
+                return;
+            const live = ctx.registry.steerableRuns.get(taskId);
+            if (!live) {
+                if (isParkedRunStatus(run.status)) {
+                    sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the permission-mode verb changes a running run; when it resumes, its mode is rebuilt from the run's stored request (a plan review's approval names the mode it continues in)");
+                    return;
+                }
+                if (isTerminalRunStatus(run.status)) {
+                    sendError(res, 409, "steering.not_running", "run already ended — the permission-mode verb changes a running run; submit the next turn of this session with the permissionMode you want");
+                    return;
+                }
+                if (runProvenElsewhere(run, deps.instanceId)) {
+                    sendError(res, 409, "steering.not_running", "run is live on another replica — the permission-mode verb must reach the replica holding the stream; resend it there");
+                    return;
+                }
+                sendError(res, 409, "steering.not_running", "no live steerable face for this run on this replica — a verify or cascade submission exposes none, so the permission-mode verb has nothing to switch");
+                return;
+            }
+            const sessionId = run.sessionId;
+            const out = await serialOnStream(live, async () => {
+                const read = await readResumeCtx(checkpointStore.getCtx(sessionId), { sessionId, opener: deps.checkpointCtxSealing });
+                if (read.kind === "corrupt" || read.kind === "unsealable") {
+                    const { status, body: { error, errorCode, ...facts } } = read.kind === "corrupt" ? resumeCtxCorruptAnswer(read.where) : resumeCtxUnsealableAnswer(read);
+                    sendError(res, status, errorCode, error, facts);
+                    return { kind: "answered" };
+                }
+                if (read.kind === "absent") {
+                    sendError(res, 409, "conflict.resume_context_unavailable", "this run's stored request is missing — its permission mode cannot be changed (the task's settings are read from it and the new mode is written back to it)");
+                    return { kind: "answered" };
+                }
+                const stored = read.ctx;
+                const admission = admitPermissionModeWord(word, { deployment: deps.config, settings: parseTaskSettings(stored.body.settings).settings });
+                if (admission.kind === "refused") {
+                    sendError(res, admission.status, admission.code, admission.message);
+                    return { kind: "answered" };
+                }
+                const admitted = admission.admitted ?? word;
+                let receipt;
+                try {
+                    receipt = await live.setPermissionMode(admitted);
+                }
+                catch (e) {
+                    const code = e.code;
+                    if (code === "steering.invalid_content") {
+                        sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : String(e));
+                        return { kind: "answered" };
+                    }
+                    if (code === "steering.not_running") {
+                        sendError(res, 409, "steering.not_running", "run just finished — the permission-mode verb needs a running run; submit the next turn of this session with the permissionMode you want");
+                        return { kind: "answered" };
+                    }
+                    throw e;
+                }
+                let persistMiss;
+                try {
+                    const next = sealCheckpointCtx({ ...withPermissionModeRewritten(stored, { ...stored.body, permissionMode: admitted }), writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
+                    const rewrite = await checkpointStore.rewriteCtxWhileClaimed(sessionId, taskId, next, (fenced) => switchLegHolds(fenced, deps.instanceId, ctx.registry.steerableRuns.get(taskId), live));
+                    persistMiss = rewrite === "written" ? undefined : rewrite;
+                }
+                catch (e) {
+                    persistMiss = "store_failed";
+                    deps.logger?.warn?.("run_permission_mode_write_back_failed", { taskId, sessionId, err: e instanceof Error ? e.message : String(e) });
+                }
+                if (persistMiss !== undefined) {
+                    recordFailOpen("server.run-permission-mode.write-back-unpersisted", `miss=${persistMiss} mode=${admitted}`);
+                    deps.logger?.warn?.("run_permission_mode_unpersisted", { taskId, sessionId, mode: admitted, miss: persistMiss });
+                }
+                return {
+                    kind: "switched",
+                    receipt,
+                    ...(admission.foldedBy !== undefined ? { admission: { requested: word, admitted, foldedBy: admission.foldedBy } } : {}),
+                    ...(persistMiss !== undefined ? { persistMiss } : {}),
+                };
+            });
+            switch (out.kind) {
+                case "answered":
+                    return;
+                case "switched": {
+                    const reply = {
+                        taskId,
+                        sessionId,
+                        status: "running",
+                        permissionMode: out.receipt,
+                        ...(out.admission !== undefined ? { admission: out.admission } : {}),
+                        persisted: out.persistMiss === undefined,
+                        ...(out.persistMiss !== undefined ? { persistMiss: out.persistMiss } : {}),
+                    };
+                    sendJson(res, 200, reply);
+                    return;
+                }
+                default:
+                    return assertNever(out);
+            }
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const RUN_PERMISSION_MODE_ROUTES = [
+    { id: "run-permission-mode", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/permission-mode$/, label: "/v1/runs/:id/permission-mode", methods: ["POST"] },
+];
+//# sourceMappingURL=run-permission-mode.js.map

package/dist/http/routes/session-sync.d.ts

@@ -9,7 +9,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionRulesRecord, type FileHistoryExport } from "@sema-agent/core";
-import { type StagingHandle } from "../../session-sync-kernel.js";
+import { type ImportAnchor, type StagingHandle } from "../../session-sync-kernel.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 import { type SessionRowPatch } from "../../session-row.js";
 export type PendingStaging = {
@@ -21,11 +21,8 @@ export type PendingStaging = {
     /** [ref]: the session's file-history envelope (or null — no history travelled). Replaces the E19 per-key manifests. */
     fileHistory: FileHistoryExport | null;
     policy: SessionRulesRecord[];
-    anchors: Array<{
-        eventId: string;
-        entryId: string;
-        owner: string | null;
-    }>;
+    /** 已在 Phase A 入口判过的锚(`readImportAnchors`:每条 `entryId` 都在 `declaredEntryIds` 里)—— 提交后的重放腿只迭代它,不再判;owner 不带(重钉到 `owner`)。 */
+    anchors: ImportAnchor[];
     /** 会话行的两位可写位(Phase A 体里带了哪几键就重放哪几键;老客户端不带 ⇒ `{}`,目的端两位不动)。提交后经会话店唯一写口落。 */
     row: SessionRowPatch;
     /** 交叉复查 A-3(HIGH):Phase A's DECLARED entry-id set — Phase B verifies the streamed NDJSON matches it

package/dist/http/routes/session-sync.js

@@ -4,7 +4,7 @@ import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator
 import { StringDecoder } from "node:string_decoder";
 import { FileHistoryUnreadableError, blobGetterOf, exportSessionManifest, exportedFileHistory, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
 import * as facts from "../../capability-facts.js";
-import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
@@ -307,6 +307,11 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.body_shape", "malformed import metadata");
                     return;
                 }
+                const anchorsRead = readImportAnchors(body.anchors, body.entryIds);
+                if ("problem" in anchorsRead) {
+                    sendError(res, 400, "request.field_invalid", anchorsRead.problem);
+                    return;
+                }
                 const policyRead = readSessionRulesRecords(body.policy);
                 if (policyRead.problem !== undefined) {
                     if (policyRead.problem.kind === "rules") {
@@ -350,7 +355,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
                 const entryIds = body.entryIds;
                 const policy = policyRead.records;
-                const anchors = body.anchors;
+                const anchors = anchorsRead.anchors;
                 const dstIds = (await sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);
                 if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {

package/dist/http/routes/sessions.js

@@ -526,14 +526,14 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const auditFact = facts.sessionAuditView(deps);
             if (!auditFact.available) {
-                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             if ((await readOwnedSessionView(auditFact.sessionAudit, sessionId)) === undefined)
                 return;
             const faces = deps.memoryCompliance;
             if (faces === undefined) {
-                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             const raw = (await readJson(req));
@@ -585,14 +585,14 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const auditFact = facts.sessionAuditView(deps);
             if (!auditFact.available) {
-                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             if ((await readOwnedSessionView(auditFact.sessionAudit, sessionId)) === undefined)
                 return;
             const face = deps.sessionMemoryStatus;
             if (face === undefined) {
-                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             const query = new URLSearchParams(match.search);
@@ -619,6 +619,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, {
                     sessionId,
                     autoConsolidationArmed: deps.memoryAutoConsolidationArmed,
+                    ...(deps.memorySyncLeg !== undefined ? { memorySync: { parked: deps.memorySyncLeg.parked().map((p) => ({ scope: p.scope, wayOut: p.wayOut })) } } : {}),
                     ...(s.captureOptedOut !== undefined ? { captureOptedOut: s.captureOptedOut } : {}),
                     ...(s.committedCount !== undefined ? { committedCount: s.committedCount } : {}),
                     ...(s.foldedCount !== undefined ? { foldedCount: s.foldedCount } : {}),