@sema-agent/server 7.146.0 → 7.147.0

package/dist/hooks/hook-runner.js

@@ -20,7 +20,7 @@ import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
 import { buildRequestUrlCredentialRefusal, urlCredentialHeaderExit } from "../url-credential-refusal.js";
 import { HOOK_PHASES, HOOK_SOURCE_VOCABULARY_SENTENCE, hookLaneOf, hookPhaseOf, readHookGroupSource } from "./hook-source.js";
-import { commandLineChars, composeHookEnvLayer, hookPluginChars, planCommandSpawn, readHookArgs, readHookPlugin } from "./command-spawn.js";
+import { commandLineChars, composeHookEnvLayer, hookPluginChars, planCommandSpawn, readHookPlugin } from "./command-spawn.js";
 export const MAX_HOOK_ENTRIES_PER_EVENT = 32;
 export const MAX_HOOK_COMMAND_CHARS = 8_192;
 export const MAX_HOOK_TIMEOUT_SECONDS = 600;
@@ -235,7 +235,6 @@ const HOOKS_WIRE_KEY_SHAPE = {
     source: `source must be one of ${HOOK_SOURCE_VOCABULARY_SENTENCE}`,
     plugin: "plugin must be { name, root, dataDir?, options? } — name a non-empty string, root and dataDir absolute paths with no \"..\" segment and no NUL byte, " +
         "options an object of string values whose keys are identifiers ([A-Za-z_][A-Za-z0-9_]*); nothing else",
-    args: "args must be an array of strings without NUL bytes (exec form: command is the executable, args its arguments)",
 };
 function hooksCapIssue(limit, event, path, count) {
     const c = HOOKS_CAPS[limit];
@@ -432,16 +431,12 @@ export function parseHooksConfig(raw) {
                     return hooksRefused({ reason: "unsupported_entry_type", path: [...at, "type"], type: contractEntry.type });
                 let entry = contractEntry;
                 if (entry.type === "command") {
-                    const rawEntry = rawMember(rawMember(rawGroup, "hooks"), entryIndex);
-                    const rawArgs = rawMember(rawEntry, "args");
-                    const rawPlugin = rawMember(rawEntry, "plugin");
-                    const args = rawArgs === undefined ? undefined : readHookArgs(rawArgs);
-                    if (rawArgs !== undefined && args === undefined)
-                        return hooksRefused({ reason: "wire_key_invalid", path: [...at, "args"], key: "args" });
+                    const rawPlugin = rawMember(rawMember(rawMember(rawGroup, "hooks"), entryIndex), "plugin");
                     const plugin = rawPlugin === undefined ? undefined : readHookPlugin(rawPlugin);
                     if (rawPlugin !== undefined && plugin === undefined)
                         return hooksRefused({ reason: "wire_key_invalid", path: [...at, "plugin"], key: "plugin" });
-                    entry = { ...entry, ...(args !== undefined ? { args } : {}), ...(plugin !== undefined ? { plugin } : {}) };
+                    if (plugin !== undefined)
+                        entry = { ...entry, plugin };
                     const line = commandLineChars(entry);
                     if (line > MAX_HOOK_COMMAND_CHARS)
                         return hooksRefused(hooksCapIssue("command", event, [...at, "command"], line));
@@ -600,7 +595,7 @@ function noteMatcherOverBudget(ctx, args) {
         detail: `${what} \`${expression}\` did not finish within ${budgetMs} ms on \`${value}\`; treated as selected (${count} ${count === 1 ? "entry" : "entries"})`,
     });
 }
-function matcherGroupSelected(ctx, event, group, value, toolName) {
+function matcherGroupSelected(ctx, event, group, value, toolName, entries) {
     const answer = hookMatcherMatches(group.matcher, value);
     switch (answer) {
         case true:
@@ -611,7 +606,7 @@ function matcherGroupSelected(ctx, event, group, value, toolName) {
             ctx.logger.warn("hook_matcher_invalid", { event, matcher: echoCallerText(group.matcher ?? "", { maxChars: MATCHER_ECHO_CHARS }) });
             return "invalid";
         case "over_budget":
-            noteMatcherOverBudget(ctx, { event, scope: "matcher", expression: group.matcher ?? "", value, entries: group.hooks, ...(toolName !== undefined ? { toolName } : {}) });
+            noteMatcherOverBudget(ctx, { event, scope: "matcher", expression: group.matcher ?? "", value, entries, ...(toolName !== undefined ? { toolName } : {}) });
             return "over_budget";
         default: {
             const unreachable = answer;
@@ -654,6 +649,41 @@ export const PERMISSIVE_VERDICT_EVENTS = {
     PreModelSwitch: false,
     PostModelSwitch: false,
 };
+export const ON_FAILURE_BLOCK_EVENTS = {
+    PreToolUse: true,
+    PostToolUse: true,
+    PostToolUseFailure: true,
+    PostToolBatch: true,
+    Notification: true,
+    UserPromptSubmit: true,
+    UserPromptExpansion: true,
+    SessionStart: true,
+    SessionEnd: true,
+    Stop: false,
+    StopFailure: false,
+    SubagentStart: true,
+    SubagentStop: false,
+    PreCompact: true,
+    PostCompact: false,
+    PermissionRequest: true,
+    PermissionDenied: true,
+    Setup: true,
+    TeammateIdle: false,
+    TaskCreated: true,
+    TaskCompleted: false,
+    Elicitation: true,
+    ElicitationResult: true,
+    ConfigChange: true,
+    WorktreeCreate: true,
+    WorktreeRemove: true,
+    InstructionsLoaded: true,
+    CwdChanged: true,
+    FileChanged: true,
+    MessageDisplay: true,
+    DirectoryAdded: true,
+    PreModelSwitch: true,
+    PostModelSwitch: true,
+};
 const DISTRUST_DETAIL = {
     input_truncated: `the hook did not receive the whole payload (tool_input over ${MAX_TOOL_INPUT_CHARS} characters was replaced by a truncation marker, or a prompt / agent entry's payload text was clipped at that size); its allow / updatedInput are not honored`,
     matcher_over_budget: "the matcher (or the if condition's tool-name part) did not finish within its budget; the entry ran as selected, so its allow / updatedInput are not honored",
@@ -800,6 +830,9 @@ function withBelowContext(parts, below) {
     const tail = belowString(below, "additionalContext");
     return tail === undefined ? [...parts] : [...parts, tail];
 }
+function alsoAsks(below, own) {
+    return below === undefined || below === own ? own : `${below} (a managed PreToolUse hook also asks: ${own})`;
+}
 function readBelowPreToolUse(below) {
     const action = belowString(below, "action");
     const message = belowString(below, "message") ?? "a PreToolUse hook requires approval";
@@ -1190,18 +1223,39 @@ function boundedToolInputPayload(payload) {
     return bounded === p.tool_input ? payload : { ...p, tool_input: bounded };
 }
 function readHookStdout(ran, event, ctx, payload, ledger) {
-    const { run, entry } = ran;
-    const out = parseHookStdout(run.stdout);
+    const out = parseHookStdout(ran.run.stdout);
     if (out !== undefined)
         return out;
-    const t = run.stdout.trim();
-    if (t.startsWith("{") || t.startsWith("[")) {
-        ctx.logger.warn("hook_bad_json_output", { event, type: entry.type, preview: seatText("operator-log-text", t) });
-        noteHookFailure(ctx, { event, entry, reason: "bad_json", exitCode: run.code, stderr: run.stderr, toolName: toolNameOf(payload) });
-        ledger.unrun(ran.source, entry, "bad_json");
-    }
+    if (stdoutVerdictUnreadable(ran.run.stdout))
+        noteBadJson(ctx, ledger, event, ran, toolNameOf(payload));
     return undefined;
 }
+function stdoutVerdictUnreadable(stdout) {
+    if (parseHookStdout(stdout) !== undefined)
+        return false;
+    const t = stdout.trim();
+    return t.startsWith("{") || t.startsWith("[");
+}
+function noteBadJson(ctx, ledger, event, ran, toolName) {
+    const { run, entry } = ran;
+    ctx.logger.warn("hook_bad_json_output", { event, type: entry.type, preview: seatText("operator-log-text", run.stdout.trim()) });
+    noteHookFailure(ctx, { event, entry, reason: "bad_json", exitCode: run.code, stderr: run.stderr, toolName });
+    ledger.unrun(ran.source, entry, "bad_json");
+}
+const PERMISSION_DECISION_WORDS = new Set(["allow", "deny", "ask"]);
+function preToolUseDecisionOf(out) {
+    const hso = out?.hookSpecificOutput;
+    return hso !== null && typeof hso === "object" && hso.hookEventName === "PreToolUse" ? hso.permissionDecision : undefined;
+}
+function noteDecisionOutOfSet(ctx, ledger, ran, decision, toolName, effect) {
+    ctx.logger.warn("hook_permission_decision_unknown", {
+        event: "PreToolUse",
+        decision: seatText("operator-log-text", typeof decision === "string" ? decision : typeof decision),
+        tool: toolName,
+        effect,
+    });
+    ledger.unrun(ran.source, ran.entry, "decision_out_of_set");
+}
 function parseHookStdout(stdout) {
     const t = stdout.trim();
     if (!t.startsWith("{"))
@@ -1234,12 +1288,68 @@ function runRunnableEntry(entry, payload, ctx, event, llmExtra, halt) {
 function isSyncEntry(entry) {
     return !(entry.type === "command" && (entry.async === true || entry.asyncRewake === true));
 }
+function blocksOnFailure(entry, event) {
+    if (!ON_FAILURE_BLOCK_EVENTS[event] || !isSyncEntry(entry))
+        return false;
+    if (entry.type !== "command" && entry.type !== "http")
+        return false;
+    const word = entry.onFailure;
+    switch (word) {
+        case "block":
+            return true;
+        case "continue":
+        case undefined:
+            return false;
+        default: {
+            const unreachable = word;
+            void unreachable;
+            return true;
+        }
+    }
+}
+function blockingFailureRun(event, cause) {
+    return { code: 2, stdout: "", stderr: `${event} hook did not reach a verdict (${cause}); blocking because onFailure is "block"`, timedOut: false };
+}
+function ranVerdictFlaw(event, run) {
+    if (run.code === 2)
+        return undefined;
+    if (run.code !== 0)
+        return { reason: "exit_nonzero" };
+    if (stdoutVerdictUnreadable(run.stdout))
+        return { reason: "bad_json" };
+    if (event !== "PreToolUse")
+        return undefined;
+    const out = parseHookStdout(run.stdout);
+    if (out?.continue === false || out?.decision === "block")
+        return undefined;
+    const decision = preToolUseDecisionOf(out);
+    return decision !== undefined && !PERMISSION_DECISION_WORDS.has(decision) ? { reason: "decision_out_of_set", decision } : undefined;
+}
+function noteRanVerdictFlaw(ctx, ledger, event, ran, flaw, toolName) {
+    switch (flaw.reason) {
+        case "exit_nonzero":
+            noteExitNonzero(ctx, ledger, event, ran, toolName);
+            return;
+        case "bad_json":
+            noteBadJson(ctx, ledger, event, ran, toolName);
+            return;
+        case "decision_out_of_set":
+            noteDecisionOutOfSet(ctx, ledger, ran, flaw.decision, toolName, 'hook ruling not honored (closed word set is allow|deny|ask); the entry\'s onFailure is "block", so this call is denied');
+            return;
+        default: {
+            const unreachable = flaw;
+            void unreachable;
+        }
+    }
+}
 async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceFired, halt, deadlineAt, ledger, llmExtra) {
     const results = [];
     let llmEntries = 0;
     const toolName = toolNameOf(payload);
     const inputTruncated = boundedToolInputPayload(payload) !== payload;
     const truncatedFor = (entry) => (entry.type === "prompt" || entry.type === "agent" ? llmHookArguments(payload).truncated : inputTruncated);
+    const blockedBy = (entry, source, cause) => ({ entry, run: blockingFailureRun(event, cause), source });
+    let laneSpent = false;
     const settle = async (entry, onceKey) => {
         if (halt.signal.aborted)
             return { kind: "halted" };
@@ -1288,8 +1398,9 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
             void fireAsyncCommandHook(entry, payload, ctx, event, halt.signal);
             return { kind: "passed" };
         }
-        if (Date.now() > deadlineAt) {
-            ctx.logger.warn("hook_event_deadline_exceeded", { event, budgetSec: MAX_HOOK_EVENT_TOTAL_SECONDS });
+        if (laneSpent || Date.now() > deadlineAt) {
+            if (!laneSpent)
+                ctx.logger.warn("hook_event_deadline_exceeded", { event, budgetSec: MAX_HOOK_EVENT_TOTAL_SECONDS });
             return { kind: "unrun", reason: "budget_exhausted" };
         }
         if (entry.once)
@@ -1327,19 +1438,35 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
         return ifOverBudget ? { kind: "ran", run, overBudget: true } : { kind: "ran", run };
     };
     for (const { group, index } of groups) {
-        const selected = matcherGroupSelected(ctx, event, group, matchValue, toolName);
+        const pending = laneSpent ? group.hooks.filter((entry) => blocksOnFailure(entry, event)) : group.hooks;
+        if (laneSpent && pending.length === 0)
+            continue;
+        const selected = matcherGroupSelected(ctx, event, group, matchValue, toolName, pending);
         if (selected === "invalid") {
-            for (const entry of group.hooks)
-                if (isSyncEntry(entry))
+            for (const entry of pending) {
+                if (!isSyncEntry(entry))
+                    continue;
+                if (!laneSpent)
                     ledger.unrun(group.source, entry, "matcher_invalid");
+                if (blocksOnFailure(entry, event))
+                    results.push(blockedBy(entry, group.source, "matcher_invalid"));
+            }
             continue;
         }
         if (selected === false)
             continue;
         for (const [ei, entry] of group.hooks.entries()) {
+            if (laneSpent && !blocksOnFailure(entry, event))
+                continue;
             const fate = await settle(entry, `${event}:${index}:${ei}`);
             switch (fate.kind) {
                 case "ran": {
+                    const flaw = blocksOnFailure(entry, event) ? ranVerdictFlaw(event, fate.run) : undefined;
+                    if (flaw !== undefined) {
+                        noteRanVerdictFlaw(ctx, ledger, event, { entry, run: fate.run, source: group.source }, flaw, toolName);
+                        results.push(blockedBy(entry, group.source, flaw.reason));
+                        break;
+                    }
                     const distrust = !PERMISSIVE_VERDICT_EVENTS[event]
                         ? undefined
                         : truncatedFor(entry)
@@ -1353,9 +1480,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
                     break;
                 }
                 case "unrun":
-                    ledger.unrun(group.source, entry, fate.reason);
+                    if (!laneSpent)
+                        ledger.unrun(group.source, entry, fate.reason);
+                    if (blocksOnFailure(entry, event))
+                        results.push(blockedBy(entry, group.source, fate.reason));
                     if (fate.reason === "budget_exhausted")
-                        return results;
+                        laneSpent = true;
                     break;
                 case "passed":
                     break;
@@ -1521,7 +1651,7 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
                                 contexts[phase].push(clipDataText(h.additionalContext, MAX_HOOK_FEEDBACK_CHARS));
                                 spoke = true;
                             }
-                            const decision = h.permissionDecision;
+                            const decision = preToolUseDecisionOf(out);
                             if (decision === "deny") {
                                 const reason = clipDataText(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "denied by a PreToolUse hook", MAX_HOOK_FEEDBACK_CHARS);
                                 return { deny: { action: "deny", message: reason, ...contextField() } };
@@ -1532,7 +1662,7 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
                                 return { deny: { action: "deny", message: proposesRewrite ? MANAGED_REWRITE_UNSHOWN_REASON : MANAGED_ALLOW_UNJUDGED_REASON, ...contextField() } };
                             }
                             if (decision === "ask") {
-                                asked = clipDataText(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS);
+                                asked = alsoAsks(prior.asked ?? prior.unreadable?.message, clipDataText(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS));
                                 spoke = true;
                             }
                             if (decision === "allow" || decision === undefined) {
@@ -1552,16 +1682,10 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
                                     spoke = true;
                                 }
                             }
-                            else if (decision !== "deny" && decision !== "ask") {
+                            else if (!PERMISSION_DECISION_WORDS.has(decision)) {
                                 unknownDecision = true;
                                 spoke = true;
-                                ctx.logger.warn("hook_permission_decision_unknown", {
-                                    event: "PreToolUse",
-                                    decision: seatText("operator-log-text", typeof decision === "string" ? decision : typeof decision),
-                                    tool: toolName,
-                                    effect: "hook ruling not honored (closed word set is allow|deny|ask); this call falls back to the engine gate",
-                                });
-                                ledger.unrun(ran.source, entry, "decision_out_of_set");
+                                noteDecisionOutOfSet(ctx, ledger, ran, decision, toolName, "hook ruling not honored (closed word set is allow|deny|ask); this call falls back to the engine gate");
                             }
                         }
                     }

package/dist/http/approval-sweeps.d.ts

@@ -6,16 +6,13 @@
  * 不是请求流水线。`createWallClockJumpGuard` 建的 `denySweepClockGuard` 是 ① 的私有件,随它同居。
  * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `mayDiscloseRowError`),机器算(closure-free-vars)与手抄一致。
  */
-import { type ParkedAskRedeemRequest } from "../tool-approval.js";
+import { type ParkedAskRedeemRequest, type ParkedAskRedeemResult } from "../tool-approval.js";
 import type { createResumeLegs } from "./resume-legs.js";
 import type { FlatServiceDeps } from "./server.js";
 export declare function createApprovalSweeps(ctx: {
     deps: FlatServiceDeps;
 } & Pick<ReturnType<typeof createResumeLegs>, "resumeCheckpoint" | "mayDiscloseRowError">): {
     denyExpiredApprovals: (now: number) => Promise<void>;
-    redeemParkedAsk: (req: ParkedAskRedeemRequest) => Promise<{
-        status: number;
-        body: Record<string, unknown>;
-    }>;
+    redeemParkedAsk: (req: ParkedAskRedeemRequest) => Promise<ParkedAskRedeemResult>;
 };
 //# sourceMappingURL=approval-sweeps.d.ts.map

package/dist/http/approval-sweeps.js

@@ -231,8 +231,9 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
-        return { status: out.status, body: out.body };
+        const remember = req.remember === "session" ? { grantedBy: req.principal ?? null, laneCannotRecord: "decide_once" } : undefined;
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, { principal: req.principal, explicitOperator: false });
+        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}) };
     }
     return { denyExpiredApprovals, redeemParkedAsk };
 }

package/dist/http/checkpoint-ctx.d.ts

@@ -157,6 +157,14 @@ export type StoredBodyReplayRefusal =
  | {
     readonly kind: "settings_env_credential";
     readonly refusal: Refusal;
+}
+/** 存体里有本版读者读不出、而本部署会采纳的成员(hooks / settings.env / permissions / MCP transport / A2A headers …;判据 `unread-request-members.ts`):`refusal` = 拒点 `resolveSpec` 抛的那只 400
+ *  (`request.field_invalid`,`field` = 第一个坐标,句子点名全部坐标)的码、句子与机读位,答复折成 409 `resume_blocked_by_policy`;`members` = 判据交回的坐标(键路径与下标,不带值;与拒句同一个上限,截断由问点做),`memberCount` = 总数 —— 运维行读这两格。 */
+ | {
+    readonly kind: "unread_members";
+    readonly refusal: Refusal;
+    readonly members: readonly string[];
+    readonly memberCount: number;
 } | {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
@@ -202,6 +210,13 @@ export interface ResumeRefusalAnswer {
  * · (`retriable`,卡在才在)。
  */
 export declare function resumeBlockedByPolicyAnswer(inner: Refusal): ResumeRefusalAnswer;
+/**
+ * 续跑腿上认领之前一只 typed 拒的**唯一折法**(`resume-legs.ts` 的两处折叠口同调:装配 `resolveResumeSpec` 与停驻赎回的执行上下文)。一条律:
+ * 拒体自报这一拍答不出(`permanence: "transient"` —— 依赖此刻不可用,不是政策:今天 = 中心答不出场景裁定)⇒ 原码原状态原体(同一张卡在依赖恢复后可再决;
+ * SLA 拒扫腿按「其余 ≥400」逐拍重试,不把它当确定性拒过期掉);其余 ⇒ {@link resumeBlockedByPolicyAnswer}(准入策略挡住,`blockedBy` = 原码)。
+ * 两形之后都由调用方经 {@link resumeRefusalWithCard} 追加 `retriable`(卡仍 pending)。
+ */
+export declare function resumeAssemblyRefusalAnswer(status: number, inner: Refusal): ResumeRefusalAnswer;
 /**
  * 一次续跑的答复是不是 {@link resumeBlockedByPolicyAnswer} 铸的那一只(409 `resume_blocked_by_policy`)—— SLA 拒扫腿据此区分「同一份字节在本版永远被拒」与别的 ≥400
  * (后者可能是瞬时的,照旧逐拍重试)。码的写端与读端住在同一个模块,读端不在别处第二次手拼这个字面。
@@ -229,6 +244,8 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
     key?: ReplayRefusedRetiredKey;
+    members?: readonly string[];
+    memberCount?: number;
     note: string;
 };
 /**

package/dist/http/checkpoint-ctx.js

@@ -97,6 +97,9 @@ export function resumeBlockedByPolicyAnswer(inner) {
         body: refusalBody({ errorCode: "resume_blocked_by_policy", message: `resume blocked by an admission policy change: ${inner.message} — nothing was resumed; if the task is still suspended on its approval, cancel it (POST /v1/runs/:id/cancel) to end it without another model turn`, facts: { blockedBy: inner.errorCode, ...inner.facts } }),
     };
 }
+export function resumeAssemblyRefusalAnswer(status, inner) {
+    return inner.facts?.permanence === "transient" ? { status, body: refusalBody(inner) } : resumeBlockedByPolicyAnswer(inner);
+}
 export function isResumeBlockedByPolicy(answer) {
     return answer.status === 409 && typeof answer.body === "object" && answer.body !== null && answer.body.errorCode === "resume_blocked_by_policy";
 }
@@ -111,6 +114,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
         case "settings_env_credential":
             return { kind: refusal.kind, note: "this session's stored request carries credentials in settings.env (a credential variable name of this engine, or a value shaped like a secret) and the one-time window that dropped them on resume has closed; it is not replayed — the task stays suspended until someone cancels it and resubmits with the credentials moved into the engine's environment" };
+        case "unread_members":
+            return { kind: refusal.kind, members: refusal.members, memberCount: refusal.memberCount, note: "this session's stored request carries members this version's readers cannot take as written (named in the refusal: settings.hooks / settings.env / an MCP server's transport / an A2A peer's headers …) and this deployment would apply them; replaying it would run without them, so it is not replayed — the task stays suspended until someone cancels it and resubmits with those members in the current form" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         case "retired_request_key":
@@ -133,6 +138,7 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
         case "inert_tool_list":
             return resumeBlockedByPolicyAnswer(refusal.entry.extra === undefined ? { errorCode: refusal.entry.code, message: refusal.entry.message } : { errorCode: refusal.entry.code, message: refusal.entry.message, facts: refusal.entry.extra });
         case "settings_env_credential":
+        case "unread_members":
             return resumeBlockedByPolicyAnswer(refusal.refusal);
         case "permission_mode_reading": {
             const answer = permissionModeReadingRefusal();

package/dist/http/claim-latency.d.ts

@@ -0,0 +1,10 @@
+/** `step` 标签的闭集:一个往返一个词。 */
+export declare const EXECUTION_CLAIM_STEPS: readonly ["run_claim", "placement_commit"];
+export type ExecutionClaimStep = (typeof EXECUTION_CLAIM_STEPS)[number];
+/** 计时落点:`Metrics` 的 `observe` 子集(deps 上没有指标注册表、或只带计数的桩 ⇒ 不计,行为逐字不变)。 */
+export interface ClaimLatencySink {
+    observe?(name: string, value: number, labels?: Record<string, string>): void;
+}
+/** 量一次认领往返(秒)。`claim` 是刚发出的往返(调用点在实参位置发起它,时钟随即起);抛也计、上抛原错。 */
+export declare function timeClaim<T>(sink: ClaimLatencySink | undefined, step: ExecutionClaimStep, claim: Promise<T>): Promise<T>;
+//# sourceMappingURL=claim-latency.d.ts.map

package/dist/http/claim-latency.js

@@ -0,0 +1,12 @@
+import { EXECUTION_CLAIM_METRIC } from "../observability/metrics.js";
+export const EXECUTION_CLAIM_STEPS = ["run_claim", "placement_commit"];
+export async function timeClaim(sink, step, claim) {
+    const started = performance.now();
+    try {
+        return await claim;
+    }
+    finally {
+        sink?.observe?.(EXECUTION_CLAIM_METRIC, (performance.now() - started) / 1000, { step });
+    }
+}
+//# sourceMappingURL=claim-latency.js.map

package/dist/http/dispatch.js

@@ -131,7 +131,7 @@ export function createDispatch(ctx) {
             const engineSignal = buildEngineSignal(signal);
             const declaredMods = deploymentModPackagesFact(deps);
             const configHash = createHash("sha256")
-                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
+                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec.provider, port: deps.config.port }))
                 .digest("hex")
                 .slice(0, 16);
             sendJson(res, 200, {

package/dist/http/durable-run-leg.js

@@ -8,6 +8,7 @@ import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../too
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
+import { timeClaim } from "./claim-latency.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
@@ -21,7 +22,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const sessionId = args.prepared.spec.sessionId;
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
+    const created = await timeClaim(deps.metrics, "run_claim", runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null }));
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)

package/dist/http/execution-context.d.ts

@@ -19,7 +19,8 @@
  *  ④ 只 fresh:设备准入链(体 `deviceId` 只在 device 车道收;准入链三步 + 首绑目标三读,全读;判的是步 ① 那一读)。
  *
  * 入口三形(判别联合,{@link ExecutionEntry}):`fresh`(提交腿:根 = authorizer 交出的 `auth.sessionId`,`judged` = authorizer 判过的头)·
- * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判)·
+ * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判;
+ * run 外回退口 `POST /v1/sessions/:id/rewind-files` 同形:根 = 路径上的会话,它不认领、不提交放置,只取步 ①–③ 的拒)·
  * `service`(服务 run:没有会话根)。
  * `fresh` / `continuation` 两形型上恒带 `root: string`,`service` 形没有 `root` 键 —— 「按一只缺席的根去读行」在型上不可表达。
  *
@@ -202,6 +203,7 @@ export interface ExecutionCommitDeps {
     } | undefined;
     readonly metrics?: {
         inc(name: string, labels?: Record<string, string>): void;
+        observe?(name: string, value: number, labels?: Record<string, string>): void;
     } | undefined;
 }
 /**

package/dist/http/execution-context.js

@@ -8,6 +8,7 @@ import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { sessionIdRetiredFor } from "../deleted-session-ids.js";
 import { refusalBody } from "./refusal-body.js";
+import { timeClaim } from "./claim-latency.js";
 export async function resolveExecutionContext(deps, entry) {
     const lanes = deployedExecutionLanes(deps.config);
     switch (entry.kind) {
@@ -203,6 +204,9 @@ export async function commitExecutionContext(deps, claim, ctx) {
     if (ctx.occupant === undefined || seat === undefined)
         return null;
     const occupant = ctx.occupant;
+    return timeClaim(deps.metrics, "placement_commit", commitPlacement(deps, claim, ctx, seat, occupant));
+}
+async function commitPlacement(deps, claim, ctx, seat, occupant) {
     const release = (why) => releaseClaim(deps, claim, why);
     const deadlineMs = placementWriteDeadlineMs(deps.config?.runStaleSec);
     const withDeadline = async (work) => {

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -10,7 +10,7 @@
  *
  * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 [ref])/ `memory.scope_home_not_directory`(core 7.44.0 [ref])—— 跨面 store 状态码,409、码原样
+ *  ② **店形拒**一族(按族表读;成员举例 `memory.target_outside_store` / `memory.scope_home_not_directory` / 引擎 7.65.0 起 `memory.control_plane_links_unsupported`)—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
  *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义;映射本体在 `memory-control-plane-corrupt-reply.ts` 那一只,导出导入 / 外源 / 整理 / 合规各口同调);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。

package/dist/http/memory-compliance-failure-reply.js

@@ -63,6 +63,9 @@ export function sentMemoryComplianceFailure(res, err, audience, logger) {
                     case "memory.scope_home_not_directory":
                         sendError(res, 409, "memory.scope_home_not_directory", "session memory erasure refused — a scope directory in this deployment's memory store is not a real directory (it was replaced by a link or a file), so this erasure did not complete; ask the operator to put the real directory back, then resend with the same requestId");
                         return true;
+                    case "memory.control_plane_links_unsupported":
+                        sendError(res, 409, "memory.control_plane_links_unsupported", "session memory erasure refused — this deployment's memory control plane is on a file system that cannot make hard links, so its memory store does not open and this erasure changed nothing; ask the operator to move the control plane to a volume that supports hard links, then resend with the same requestId");
+                        return true;
                     default:
                         return assertNever(storeForm.code);
                 }

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,6 +1,6 @@
 /**
- * **店形拒**两码(`memory.target_outside_store` / `memory.scope_home_not_directory`,判据在 `src/memory-store-refusal.ts`)的
- * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— 唯一一处码字面量。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * **店形拒**一族(`memory.target_outside_store` / `memory.scope_home_not_directory` / `memory.control_plane_links_unsupported`,族表与判据在 `src/memory-store-refusal.ts`)的
+ * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— operator 面唯一一处码字面量(会话所有者面的逐码臂在 `http/memory-compliance-failure-reply.ts`;引擎加码 ⇒ 两处各补一臂)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
  * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
  * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里的 wire 句**(经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案),
@@ -8,7 +8,7 @@
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
  * (码进文案,附录 A 该行),这一族已在那条臂上,不再给它第二个码。
  *
- * ## 为什么 409(两码同一条)
+ * ## 为什么 409(一族同一条)
  * core 的读法:operator 要处置的盘形(去掉 store 里那只通到外面的目录链 / 把 scope home 放回真目录),不是可重试的 IO 故障,也不是对调用方的裁决。与
  * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
  * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在

package/dist/http/memory-store-refusal-reply.js

@@ -12,6 +12,9 @@ export function sentMemoryStoreRefusal(res, err, logger) {
         case "memory.scope_home_not_directory":
             sendError(res, 409, "memory.scope_home_not_directory", refusal.message);
             return true;
+        case "memory.control_plane_links_unsupported":
+            sendError(res, 409, "memory.control_plane_links_unsupported", refusal.message);
+            return true;
         default: {
             const unhandled = refusal.code;
             throw new Error(`unhandled store-form refusal word: ${String(unhandled)}`);

package/dist/http/owner-access.d.ts

@@ -16,6 +16,7 @@
 import type { ServiceConfig } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { RunRecord } from "../plugins/store-contracts.js";
+import type { SessionHead } from "@sema-agent/core";
 import { type OwnerAwareSessionStore, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
 import { type IdentityWiring, type OperatorRoster } from "./principal-gate.js";
 /** 调用点挂哪条臂(闭集):`owner` = 只有属主判官;`owner_or_operator` = 属主判官 ∨ 显式运维(`explicitOperatorOk`,唯一读法)。 */
@@ -46,6 +47,16 @@ export declare function readOwnedRun(config: OwnerAccessConfig, runStore: {
 export declare function readOwnedSession(w: IdentityWiring & {
     readonly config: OwnerAccessConfig;
 }, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
+/**
+ * 同一只读口,连头一起交回:门过了的调用点还要读这只会话的**内容**(坏档判据 `leafOfAdmittedHead` 读头的叶子;门之前不许读)或头上的属主原值时用它 ——
+ * 一次头读、一只判官,与 {@link readOwnedSession} 是同一读(那一只就是本函数取 `cell`)。`undefined` 的读法同上。
+ */
+export declare function readOwnedSessionHead(w: IdentityWiring & {
+    readonly config: OwnerAccessConfig;
+}, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<{
+    readonly cell: SessionOwnerCell;
+    readonly head: SessionHead;
+} | undefined>;
 /**
  * 🔴 **会话读面的属主读的第三个结局**:有主 / 无此行 / **属主读不出**(店交出具名拒 {@link SessionOwnerUnreadableError} —— 会话的行事实没有落下,补铸它要读的存档又用不了;
  * 谁也判不了「这是不是你的会话」)。第三个读作第二个:**与「没有这一行」同一个值**(`undefined`),调用点落的就是它们对「不存在 / 非属主」的那一臂 ——

package/dist/http/owner-access.js

@@ -32,11 +32,14 @@ export async function readOwnedRun(config, runStore, principal, taskId, arm) {
     return row !== undefined && runRowReadable(config, principal, row.owner, arm) ? row : undefined;
 }
 export async function readOwnedSession(w, store, caller, sessionId, arm) {
-    const owner = (await store.headOf(sessionId))?.owner;
-    if (owner === undefined)
+    return (await readOwnedSessionHead(w, store, caller, sessionId, arm))?.cell;
+}
+export async function readOwnedSessionHead(w, store, caller, sessionId, arm) {
+    const head = await store.headOf(sessionId);
+    if (head === undefined || head.owner === undefined)
         return undefined;
-    const cell = await sessionOwnerCellOf(store, sessionId, owner);
-    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? cell : undefined;
+    const cell = await sessionOwnerCellOf(store, sessionId, head.owner);
+    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? { cell, head } : undefined;
 }
 export async function foldOwnerUnreadable(logger, face, sessionId, read) {
     try {