@sema-agent/server 7.142.0 → 7.144.0

package/dist/http/memory-compliance-failure-reply.js

@@ -3,7 +3,6 @@ import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
-import { MemoryErasureStoreUnjudged } from "../memory-operator-faces.js";
 function sentCoreCode(res, coreCode, coreMessage, audience) {
     switch (coreCode) {
         case "config.memory_erasure_request":
@@ -18,8 +17,11 @@ function sentCoreCode(res, coreCode, coreMessage, audience) {
         case "memory.erasure_selector_mismatch":
             sendError(res, 409, "memory.erasure_selector_mismatch", textFor(audience, coreMessage, "session memory erasure refused — this requestId already names a different erasure; resend with a new requestId"));
             return true;
+        case "config.memory_scope_key":
+            sendError(res, 400, "request.memory_layer", textFor(audience, coreMessage, "session memory erasure refused — the request names a memory layer this deployment cannot read; correct it and resend"));
+            return true;
         case "memory.erasure_census_incomplete":
-            sendError(res, 409, "memory.erasure_census_incomplete", textFor(audience, coreMessage, "session memory erasure refused — the memory store could not be read completely, so nothing was erased and nothing was recorded; ask the operator to repair it, then resend with the same requestId"));
+            sendError(res, 409, "memory.erasure_census_incomplete", textFor(audience, coreMessage, "session memory erasure refused — a memory store could not be read completely, so that store erased nothing; where this deployment keeps memory in two stores the other store may already have carried out this erasure — ask the operator to repair the store, then resend with the same requestId to complete it"));
             return true;
         default:
             return false;
@@ -43,10 +45,6 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 export function sentMemoryComplianceFailure(res, err, audience, logger) {
-    if (err instanceof MemoryErasureStoreUnjudged) {
-        sendError(res, 409, "memory.erasure_store_unjudged", textFor(audience, err.message, "session memory erasure refused — this erasure reaches memory kept in this deployment's second memory store, which this build does not erase from (an erasure requestId is judged on the deployment's main store only); nothing was erased — it becomes available with the next engine update, or ask the operator"));
-        return true;
-    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
         return true;

package/dist/http/owner-access.d.ts

@@ -14,6 +14,7 @@
  * {@link readOwnedRun} / {@link readOwnedSession} 并删两只 helper;裸 store 读口按文件计数钉在 `test/owner-gate-single-owner.test.ts`(增即红)。
  */
 import type { ServiceConfig } from "../config-types.js";
+import type { Logger } from "../observability/logger.js";
 import type { RunRecord } from "../plugins/store-contracts.js";
 import { type OwnerAwareSessionStore, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
 import { type IdentityWiring, type OperatorRoster } from "./principal-gate.js";
@@ -45,6 +46,16 @@ export declare function readOwnedRun(config: OwnerAccessConfig, runStore: {
 export declare function readOwnedSession(w: IdentityWiring & {
     readonly config: OwnerAccessConfig;
 }, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
+/**
+ * 🔴 **会话读面的属主读的第三个结局**:有主 / 无此行 / **属主读不出**(店交出具名拒 {@link SessionOwnerUnreadableError} —— 会话的行事实没有落下,补铸它要读的存档又用不了;
+ * 谁也判不了「这是不是你的会话」)。第三个读作第二个:**与「没有这一行」同一个值**(`undefined`),调用点落的就是它们对「不存在 / 非属主」的那一臂 ——
+ * 读者拿不到「这个 id 在盘上、且坏了」这件事(对非属主、对属主、对不存在的会话是同一只 404 `not_found.session`,同码同文),也就没有第二种拒绝形可漏存在性。
+ * 原故障(码与句)进运维日志一行 `session_owner_unreadable`:这是拒,不是兜底,不走 `recordFailOpen`;被折的读不再经全局兜底,日志里不能因此少一行。
+ *
+ * 只折这一个具名拒:别的读故障(I/O 级、边档整只拒、SQL 店的读故障、别的 `SessionError`)一概照旧上抛 —— 折的是「属主读不出」这件确定的事,不是「头读抛了」。
+ * 读面的所有属主读(会话视图三口共段 / 头探针 / 事件流 / 执行放置)经这一只;写口的属主读不在本只射程(它们对这一形仍答原故障的 500,契约 §17.2)。
+ */
+export declare function foldOwnerUnreadable<T>(logger: Pick<Logger, "warn"> | undefined, face: string, sessionId: string, read: () => Promise<T | undefined>): Promise<T | undefined>;
 /**
  * leader 登记表的判官形(boot 装配一次,`createLeaderEndpoint` 的必填席)—— leader 模块不再自判属主(修前它手抄 `owner == null || owner === requester`,
  * 缺 C8 窄互认臂而注称 mirrors runOwnerOk)。leader 腿的调用方身份经幂等身份结构(`IdemCaller.principal`,即 `gatedPrincipal` 的回值)转手而来,

package/dist/http/owner-access.js

@@ -1,4 +1,6 @@
 import { mintDurableOwnerKey, mintPrincipal, sessionOwnerCellOf } from "../security.js";
+import { openFaceFaultWire, SessionOwnerUnreadableError } from "../session-error-wire.js";
+import { seatText } from "../trace/exit-seat.js";
 import { explicitOperatorOk, runOwnerReadable, sessionOwnerReadable } from "./principal-gate.js";
 function operatorArmHolds(config, principal, arm) {
     switch (arm) {
@@ -36,6 +38,17 @@ export async function readOwnedSession(w, store, caller, sessionId, arm) {
     const cell = await sessionOwnerCellOf(store, sessionId, owner);
     return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? cell : undefined;
 }
+export async function foldOwnerUnreadable(logger, face, sessionId, read) {
+    try {
+        return await read();
+    }
+    catch (e) {
+        if (!(e instanceof SessionOwnerUnreadableError))
+            throw e;
+        logger?.warn("session_owner_unreadable", { face, sessionId, errorCode: openFaceFaultWire(e).errorCode, err: seatText("operator-log-text", e.message) });
+        return undefined;
+    }
+}
 export function createLeaderRunVisibility(config) {
     return (principal, owner) => runRowReadable(config, principal == null ? undefined : mintPrincipal(principal), owner ?? null, "owner");
 }

package/dist/http/principal-gate.d.ts

@@ -159,7 +159,7 @@ export declare function fleetViewOf(req: IncomingMessage, w: IdentityWiring, fac
  * 有身份边界的部署上:
  *  · **无主的行**经无主臂的唯一判据 `ownerlessRowOpen`(`security.ts`):普通会话照旧对任何调用方开放;委派子代的 placed 行只对 fleet 调用方
  *    ({@link sessionCallerOf})开放 —— 任何具名主体、没有 service 凭据的无身份调用方都与别人的行同体(调用点答 404)([ref])。
- *    代价如实:属主还没定下的子代行连它将来的属主也暂时读不到(由一次性迁移 M23 / 那一行的下一次停驻定下);
+ *    代价如实:升级前写下、属主还没定下的存量子代行连它将来的属主也暂时读不到(SQL 两店由一次性迁移 M23 在窗内每次起服回填;本机文件店没有回填臂;7.144.0 起没有任何店在停驻时定属主 —— 属主只由建行那一笔记下引擎交来的 `placement.owner`);
  *  · 有主的行就是 run 面那一条谓词({@link runOwnerReadable}),一字不变。
  * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
  */

package/dist/http/refusal-body.d.ts

@@ -19,15 +19,19 @@ export type RefusalBody = {
 /** 拒体:`{ error, errorCode, ...facts }`。 */
 export declare function refusalBody(r: Refusal): RefusalBody;
 /**
- * 引擎拒一次续跑时的**三个机读判别位** → 拒体的同名事实键(唯一读法;续跑家族的每一只拒答都读它):
- * `detail.code` ⇒ `blockedBy`(挡住它的准入码)· `detail.field` ⇒ `field`(哪一侧 / 哪一格)· `detail.reason` ⇒ `reason`(同码多臂时哪一臂)。
+ * 引擎拒一次续跑时的**机读事实位** → 拒体的同名事实键(唯一读法;续跑家族的每一只拒答都读它):
+ * `detail.code` ⇒ `blockedBy`(挡住它的准入码)· `detail.field` ⇒ `field`(哪一侧 / 哪一格)· `detail.reason` ⇒ `reason`(同码多臂时哪一臂)·
+ * `detail.thrownName` ⇒ `thrownName`(引擎 7.62.0 起,只在 `reason: requirements_damaged` 的拒上:判官读这一行时被抛出的东西的名字,有界、不带 message ——
+ * 在场 = 引擎缺陷〔判官被一个读时会抛的成员绊倒〕,缺席 = 行的内容与它自述的对不上〔数据损坏〕,运维凭这一位分诊)。
  * 一员在场 ⇔ 它是非空串;其余(缺席、非串、空串)一律不铸键 —— 引擎没说就是没说,本层不编值,也不把一个非串原样推上 wire。
  * 载体有两种,读法同一只:同步腿的 `CheckpointError.detail`(`http/resume-legs.ts` `checkpointRefusalAnswer`),与后台停驻子代赎回回执的
- * `details.detail`(`parked-decide.ts` 的 422 `parked_resume.startup_failed`;引擎 7.54.0 起它把认领前那只失败的同三位交到回执上)。
+ * `details.detail`(`parked-decide.ts` 的 422 `parked_resume.startup_failed`;引擎 7.54.0 起它把认领前那只失败的 `code` / `field` / `reason` 交到回执上 ——
+ * 回执只带这三位,`thrownName` 今天不在回执里,所以这条腿的体上它恒缺席;回执哪天多带,同一只读法自然过境)。
  */
 export declare function resumeRefusalFacts(detail: unknown): {
     blockedBy?: string;
     field?: string;
     reason?: string;
+    thrownName?: string;
 };
 //# sourceMappingURL=refusal-body.d.ts.map

package/dist/http/refusal-body.js

@@ -10,6 +10,7 @@ export function resumeRefusalFacts(detail) {
         ...(word(d.code) ? { blockedBy: d.code } : {}),
         ...(word(d.field) ? { field: d.field } : {}),
         ...(word(d.reason) ? { reason: d.reason } : {}),
+        ...(word(d.thrownName) ? { thrownName: d.thrownName } : {}),
     };
 }
 //# sourceMappingURL=refusal-body.js.map

package/dist/http/resume-legs.d.ts

@@ -13,7 +13,7 @@
  */
 import type { IncomingMessage } from "node:http";
 import { CheckpointError, type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
-import type { DecideBinding } from "./wire-types.js";
+import type { DecideBinding, DecidedAction } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import type { HostDecision } from "../host-decision.js";
 import { type GateSighting } from "../approval-gate-currency.js";
@@ -23,6 +23,7 @@ import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
 import { type ResumeRefusalAnswer } from "./checkpoint-ctx.js";
+import { type ResumeRestatement } from "./resume-restatement.js";
 /**
  * 🔴 **一次 `CheckpointError` 拒的处置 —— 唯一读口**:{@link CHECKPOINT_ERROR_DISPOSITION} 的读法(doctrine 在那张表头)。resume 腿的 catch 臂只调它一次,
  * 行的落点与 wire 的 `retriable` 都读这一个结果。纯函数,钉直接调。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 —— 型面上拼不出来)
@@ -35,18 +36,30 @@ export declare function checkpointRefusalAnswer(e: CheckpointError, at: {
     readonly taskId?: string;
     readonly versionKeys: Readonly<Record<string, string>>;
 }): ResumeRefusalAnswer;
+/**
+ * 一个答案只属于它被展示的那一个动作 —— 决断绑定的**唯一判官**:决断方点名它看到的那一对(`boundCallId` + `boundInputHash`,
+ * 队列行上展示的原值),两位都是非空串才成一只 {@link DecidedAction};缺哪位就点名哪位(序 = 体键序)。
+ * 不从当前停驻行补:补上的是此刻停在门上的动作,不是决断方看到的那一个(7.142.x 及以前的旧形 —— 同一调用 id 换了入参的新停驻会接住旧决定)。
+ */
+export declare function decidedActionOf(binding: Pick<DecideBinding, "boundCallId" | "boundInputHash">): {
+    readonly action: DecidedAction;
+    readonly missingKeys?: undefined;
+} | {
+    readonly action?: undefined;
+    readonly missingKeys: readonly ("boundCallId" | "boundInputHash")[];
+};
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];
 } & RunRegistry & RouteHelpers & Pick<RouteLegs, "prepareSpec" | "finalizeTaskResult"> & Pick<ReturnType<typeof createRequestGuards>, "ownerCostQuotaDenied" | "ownerFleetLeaseDenied" | "usageWindowDenialFor">): {
     routeCtxBase: RouteCtxBase;
-    resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (grant: {
+    resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, answer: QuestionAnswer | undefined, binding: DecideBinding, onResumeCommitted?: (grant: {
         overrideSessionId?: string;
         rememberableToolName: string | null;
     }) => Promise<void>, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }) => Promise<ResumeLegOutcome>;
+    }, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     driveResumeIntoRunLog: (args: DriveResumeArgs) => Promise<ResumeLegOutcome>;
     driveResumeLeg: (args: DriveResumeArgs, onAccepted?: (receipt: {
         status: number;
@@ -59,9 +72,9 @@ export declare function createResumeLegs(ctx: {
     resumePreempted: (sessionId: string, req: IncomingMessage | undefined, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }) => Promise<ResumeLegOutcome>;
-    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string) => Promise<ResumeLegOutcome>;
-    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string) => Promise<ResumeLegOutcome>;
+    }, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
+    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
+    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
         principalPresent?: boolean;
@@ -78,6 +91,7 @@ export declare function createResumeLegs(ctx: {
         readonly ok: true;
         readonly prepared: PreparedPlanReview;
     }>;
-    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<ResumeLegOutcome>;
+    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
+    sessionNotifyDoor: import("../session-notify-door.js").SessionNotifyDoor;
 };
 //# sourceMappingURL=resume-legs.d.ts.map