@sema-agent/server 7.149.0 → 7.151.0

package/dist/http/dispatch.js

@@ -4,19 +4,19 @@ import { partsOf } from "../owner-brands.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { admitBridgeIdentity } from "../auth-bridge.js";
+import { admitBridgeIdentity, ssoForeignScope } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, sendHttpError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
-import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, memberLeaseOf, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { projectHealthBody } from "./health-reader.js";
 import { projectHealthStoreSection, unwiredStorePosture } from "../store-posture.js";
 import { autoBackgroundOnTimeout as autoBackgroundOnTimeoutFact, autoBackgroundOnTimeoutWord, deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { hostBackgroundShellEnabled } from "../config.js";
 import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, systemFor, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { hasServiceAuth, passesCredentialGate } from "../identity-source.js";
 import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -31,6 +31,18 @@ export function healthReaderOf(req, config) {
         return "open";
     return readCredentialOk(req, config) ? "credentialed" : "anonymous";
 }
+function credentialAttribution(req, credential, config) {
+    switch (credential) {
+        case "service_token":
+            return systemFor(req, config) ?? null;
+        case "sso":
+            return "sso";
+        default: {
+            const unknownCredential = credential;
+            throw new Error(`credential gate: credential ${String(unknownCredential)} has no attribution`);
+        }
+    }
+}
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
         return;
@@ -120,6 +132,11 @@ export function createDispatch(ctx) {
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
                 const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                const foreign = identity === undefined ? undefined : ssoForeignScope(identity, deps.config);
+                if (identity !== undefined && foreign !== undefined) {
+                    deps.logger?.warn?.("auth_bridge_scope_refused", { principal: identity.principal, tokenScope: foreign.tokenScope, boundScope: foreign.boundScope });
+                    return systemFor(req, deps.config) === undefined ? "foreign_scope" : undefined;
+                }
                 if (identity) {
                     setSsoPrincipal(req, identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
@@ -132,6 +149,7 @@ export function createDispatch(ctx) {
                 }
             }
         }
+        return undefined;
     }
     async function handle(req, res) {
         const startedAt = Date.now();
@@ -209,6 +227,7 @@ export function createDispatch(ctx) {
                             lingerMs: lease.lingerMs,
                             tickMs: lease.tickMs,
                             lane: lease.lane,
+                            attached: lease.attached,
                             ...(fa ? { firstAttach: { windowMs: fa.windowMs, since: fa.since, attachedAt: fa.attachedAt } } : {}),
                             ...(ho ? { handover: { since: ho.since, reason: ho.reason, lingerMs: ho.lingerMs, backgroundShells: ho.backgroundShells } } : {}),
                         },
@@ -294,51 +313,39 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        await attachBridgeIdentity(req);
+        if ((await attachBridgeIdentity(req)) === "foreign_scope") {
+            sendError(res, 403, "auth.scope_mismatch", "forbidden — the sign-in token was issued for a different scope than the one this worker serves: send a sign-in token issued for this worker's scope, or send this request to a worker of your token's scope");
+            return;
+        }
         if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx, undefined, false))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
         admitRunIdentity(req, identitySource, deps.logger);
-        let source = null;
-        const anyServiceAuth = hasServiceAuth(deps.config);
-        if (anyServiceAuth) {
-            switch (identitySource) {
-                case "service_token":
-                    source = systemFor(req, deps.config) ?? null;
-                    break;
-                case "sso":
-                    source = "sso";
-                    break;
-                case "direct_door_jwt":
-                case undefined:
-                    sendUnauthorized(res, "credential");
-                    return;
-                default: {
-                    const unknownSource = identitySource;
-                    throw new Error(`credential gate: identity source ${String(unknownSource)} has no gate row`);
-                }
-            }
+        const credential = passesCredentialGate(identitySource) ? identitySource : undefined;
+        if (credential === undefined && hasServiceAuth(deps.config)) {
+            sendUnauthorized(res, "credential");
+            return;
         }
-        reqState.source = source;
-        if (!anyServiceAuth &&
+        reqState.source = credential === undefined ? null : credentialAttribution(req, credential, deps.config);
+        if (credential === undefined &&
             !deps.config.allowUnauthedWrites &&
             ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
                 isCredentialGatedRewrite(req.method ?? "", url))) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions");
             return;
         }
         const billableKind = req.method === "POST" && !isMethodDispatchedSubmitPath(url) ? billableKindOf(url) : undefined;
         if (billableKind !== undefined) {
-            const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), billableKind);
+            const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), billableKind);
             if (refusal !== undefined) {
                 sendBillableRefusal(res, refusal);
                 return;
             }
         }
-        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
+        if (isDestructiveSessionWrite(req.method ?? "", url) && credential === undefined && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
         if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, search, method, allow.post, ctx))

package/dist/http/durable-run-leg.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
-import { runInBackground } from "../runs.js";
+import { createRunAnchorWriter, runInBackground } from "../runs.js";
 import { recheckClaimBeforeLaunch, refusalAfterLostClaim, startClaimHeartbeat } from "./claim-heartbeat.js";
 import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
@@ -11,12 +11,12 @@ import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext, faultedAnswerOf } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmissionCtx, SUBMIT_CTX_CLAIM_LOST } from "./submit-ctx.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
-import { headReadOf } from "../session-incarnation.js";
+import { sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
@@ -82,24 +82,24 @@ async function claimAndCommit(ctx, runStore, args, sessionId, taskId) {
     finally {
         stopPreLaunchHeartbeat();
     }
-    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
+    commitLegBindings(deps, undefined, args.prepared.spec.sessionId, args.prepared.legFacts?.sessionBindings);
     return { holdingLeg: created.legId };
 }
 function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInternals, legId) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
-    const anchorOwner = args.prepared.auth?.subject ?? null;
-    const headOf = headReadOf(deps.sessionStorage);
-    const captureTurnAnchor = deps.resumeAnchorStore && headOf
-        ? async (eventId) => {
-            const leaf = (await headOf(sessionId))?.leafId;
-            if (leaf)
-                await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
-        }
-        : undefined;
-    const captureUserMessageAnchor = deps.resumeAnchorStore
-        ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-        : undefined;
+    const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+    const anchors = createRunAnchorWriter({
+        seat: deps.backend?.landedAttendants(),
+        sessionId,
+        owner: args.prepared.auth?.subject ?? null,
+        promptKey: taskId,
+        witness: args.prepared.legFacts?.sessionWitness,
+        occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+        leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+    });
+    const captureTurnAnchor = anchors.turn;
+    const captureUserMessageAnchor = anchors.prompt;
     const fleetPub = fleetRunPublisher(deps.fleetBus, {
         runId: taskId,
         scope: args.fleetScope,
@@ -122,7 +122,7 @@ function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInterna
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
             origin: approvalLegOriginOf(args.prepared.execution),
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.registeredCwd));
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.sessionBindings.cwd));
     args.runSlot?.release();
     args.prepared.seat.markRecord();
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };

package/dist/http/health-self-report.d.ts

@@ -23,6 +23,9 @@
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
  *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
  *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
+ *  · `center.assertionToken` = web-admin 断言令牌的**声明读数**(配置 `webAdmin.assertionToken`,读口 `center-credential.ts` 的 `readWebAdminCredentialDeclaration`,
+ *    与主凭证同一只判官):`declared` ⇔ 两键之一设了,`absent` ⇔ 都没设;只在接了中心时在场(没接中心的部署不读这一对键,答不了)。只说声明,不说令牌
+ *    有效、也不说引擎向中心出示了它(本版不出示)。
  *
  * ## 无鉴权面
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
@@ -33,7 +36,8 @@
  * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
  *
  * ## 在场律
- * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
+ * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜;
+ * `center.assertionToken` 在场 ⇔ 接了中心(接了中心却缺席 = 老 worker)。
  */
 import type { FlatServiceDeps } from "./server.js";
 import { type IdentitySource } from "../identity-source.js";
@@ -43,6 +47,9 @@ export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
 /** `operator` 的词表。 */
 export declare const OPERATOR_PRESENCE_WORDS: readonly ["present", "absent"];
 export type OperatorPresence = (typeof OPERATOR_PRESENCE_WORDS)[number];
+/** `center.assertionToken` 的词表(声明读数:两键之一设了 / 都没设)。 */
+export declare const ASSERTION_TOKEN_DECLARATION_WORDS: readonly ["declared", "absent"];
+export type AssertionTokenDeclaration = (typeof ASSERTION_TOKEN_DECLARATION_WORDS)[number];
 /** `center.sessionsVisible` 的值域(两个布尔 + 一个词;`"unknown"` = 接线齐了,但会话归谁要看提交它的那次请求)。 */
 export declare const SESSIONS_VISIBLE_VALUES: readonly [true, false, "unknown"];
 export type SessionsVisible = (typeof SESSIONS_VISIBLE_VALUES)[number];
@@ -59,6 +66,7 @@ export interface HealthSelfReport {
         readonly issuer?: string;
         readonly webBaseUrl?: string;
         readonly sessionsVisible: SessionsVisible;
+        readonly assertionToken?: AssertionTokenDeclaration;
     };
 }
 /**

package/dist/http/health-self-report.js

@@ -5,6 +5,7 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
 export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
+export const ASSERTION_TOKEN_DECLARATION_WORDS = ["declared", "absent"];
 export const SESSIONS_VISIBLE_VALUES = [true, false, "unknown"];
 function carriesCallerIdentity(kind) {
     switch (kind) {
@@ -34,6 +35,7 @@ export function buildHealthSelfReport(deps) {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),
             ...(webBaseUrl !== undefined ? { webBaseUrl: buildDisplaySafeUrl(webBaseUrl) } : {}),
             sessionsVisible,
+            ...(config.webAdmin !== undefined ? { assertionToken: config.webAdmin.assertionToken !== undefined ? "declared" : "absent" } : {}),
         },
     };
 }