@sema-agent/server 7.15.0 → 7.16.0-rc.1

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
@@ -6,6 +7,7 @@ import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行
 import { sleep } from "../sse-log.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
+import { governanceOriginOf } from "../active-run-conflict.js";
 // design/80 seam #2 (assistant-scheduler): graceful preempt (durable yield) + resource_limit resume of one task.
 export const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
 export const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
@@ -61,16 +63,17 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             const scope = operator
                 ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
                 : (principal ?? "__none__");
-            await streamApprovals(req, res, cs, scope);
+            await streamApprovals(req, res, cs, scope, deps.config);
             return;
         }
         if (req.method === "GET" && url === "/v1/approvals") {
             const scope = operator
                 ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined) // operator: all (or ?owner)
                 : (principal ?? "__none__"); // non-operator: only its own scope (never others' pending)
-            // #209 件4:行整只上 wire(键集契约不变),但 `riskDescriptor.shadowedRule` 这一格先脱敏 ——
-            // 理由与 `/v1/approvals/stream` 共用同一个投影函数,见 `redactPendingDisclosures` 顶注。
-            sendJson(res, 200, { pending: (await cs.listPending(scope)).map(redactPendingDisclosures) });
+            // #209 件4 + [3684]②:行整只上 wire(键集契约照旧「整只透传、不按键投影」),但两格由投影函数
+            // 负责——`riskDescriptor.shadowedRule` 脱敏、`governanceForced` 归因。与 `/v1/approvals/stream`
+            // **共用同一个** `projectPendingForWire`(两条读面各投各的必漂,见其顶注)。
+            sendJson(res, 200, { pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)) });
             return;
         }
         // exemptions surface — the UI's "本会话不再询问" state (list) + revoke. Same authz shape as
@@ -214,7 +217,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 // so a running/suspended-only filter DROPPED exactly the HITL-gated tasks §3 promises to surface "needs-
                 // attention first" — the operator could never discover the very plan_review tasks §4c says to resolve.
                 // Same class as the inbox leak (handler vs contract drift). needs_review is a non-terminal park → include it.
-                .filter((r) => r.status === "running" || r.status === "suspended" || r.status === "needs_review")
+                // 判据取词表属主(合并码重扫):park 两个词由 `isParkedRunStatus` 穷举,手抄形对 core 加词无编译期钉。
+                .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
@@ -313,17 +317,43 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 // Durable flag FIRST (only flips a still-running row), abort after — if the run suspended/terminal'd in
                 // the getRun→here window the flag affects 0 rows, so re-read and answer by the ACTUAL state.
-                const flagged = await deps.runStore.requestPreempt(taskId, run.owner); // owner guard: single-DB defense-in-depth (owner-gate already enforced above)
-                if (!flagged) {
+                let flagged = await deps.runStore.requestPreempt(taskId, run.owner); // owner guard: single-DB defense-in-depth (owner-gate already enforced above)
+                // 🔴 抢跑输了(旗打空 0 行)⇒ 按 run 的**真实**状态**三向**重判(重扫二轮红先修;与 `runs.ts` 取消腿
+                // 的孪生臂 `CANCEL_RECLASSIFY_ATTEMPTS` 那一段同源同形)。旧形无论重读到什么都发 202 no-op,于是
+                // **同一条 park 行**:不经这个竞态窗时回 409 `conflict.already_suspended`(前置检查那一支,`403a841`),
+                // 经过它时回 202「task no longer running」。按状态码分支的调度器对同一个状态拿到两种答案,而契约文
+                // §4d 把它写成了绝对规则(parked ⇒ 409 / genuinely terminal ⇒ 202),只成文了其中一种。
+                //  · **park**(判据取词表属主 `isParkedRunStatus`,穷举 switch + never 臂)⇒ 409,`status` 带**行的真词**;
+                //  · **running**(park→running 二次跃迁真实存在:并发 approve 的恢复腿把行翻回来)⇒ **重挂旗**,
+                //    有界重试;行活过来正是该重挂旗的时刻,不是该撒谎的时刻;
+                //  · 真终局 ⇒ 照旧幂等 202 no-op(带真实状态)。
+                // 有界(park↔running 反复跳时不许把请求钉在这):次数用尽仍 running ⇒ 如实 409 让调用方重试,
+                // 码与取消腿的同名情形共用(同一件事:并发决议赢了,它的恢复腿正在跑)。
+                const PREEMPT_RECLASSIFY_ATTEMPTS = 3;
+                for (let attempt = 0; !flagged; attempt++) {
                     const now = await deps.runStore.getRun(taskId);
+                    if (now !== undefined && isParkedRunStatus(now.status)) {
+                        sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: now.status });
+                        return;
+                    }
+                    if (now?.status === "running" && attempt < PREEMPT_RECLASSIFY_ATTEMPTS) {
+                        flagged = await deps.runStore.requestPreempt(taskId, run.owner); // 行又活了 ⇒ 重挂 durable 旗(赢了就走下面的快路)
+                        continue;
+                    }
+                    if (now?.status === "running") {
+                        sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry preempt if it is still active", { taskId, status: now.status });
+                        return;
+                    }
                     sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "task no longer running — preempt is a no-op" });
                     return;
                 }
                 preemptableRuns.get(taskId)?.abort(); // fast path: preempt landed on the running instance → suspend now
                 sendJson(res, 202, { taskId, status: "preempting", note: "graceful durable yield — the task suspends at the next clean turn boundary if preempt-eligible; resume via POST /v1/assistant/tasks/:id/resume" });
             }
-            else if (run.status === "suspended") {
-                sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: "suspended" });
+            else if (isParkedRunStatus(run.status)) {
+                // 扫描P2 顺带件:park 是两个词(isParkedRunStatus 属主)——needs_review(plan_review/dry-run 门)
+                // 此前掉进 else 被谎报「already terminal — no-op」(无状态破坏,纯指路错)。extras.status 带真词。
+                sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: run.status });
             }
             else {
                 sendJson(res, 202, { taskId, status: run.status, note: "task already terminal — preempt is a no-op" });
@@ -687,6 +717,30 @@ function redactPendingDisclosures(row) {
         return row;
     return { ...row, riskDescriptor: { ...rd, shadowedRule: redactSecrets(rd.shadowedRule) } };
 }
+/**
+ * 🔴 [3683]-2 / [3684]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
+ * 投影 —— 脱敏(#209 件4)+ 出身归因(#220 的另一半)一次做完。
+ *
+ * 出身格的病灶如实记:`governanceForced` 此前只在 409 体上算(`buildActiveRunConflict`),而运维队列
+ * 的行不算 —— 同一道 park 门,客户端从 409 看得见「这是运维治理层下的」,从队列看不见。它**不是**一个
+ * 落库缺口:判据的两半(行上 `riskDescriptor.shellGateDoctrine` + 本部署的治理姿态)在这条读面上都够得着,
+ * 缺的只是**没有人算**。所以补法 = 让两面共用 `governanceOriginOf` 这一个属主(在读面算的已知失真、
+ * 以及「根治要 core 在 mint 写进行里」的登记,逐字在 `runtime-governance.ts` 那个函数的顶注,不复述)。
+ *
+ * 🔴 `true` 才写键,恒不写 `false` —— 与活卡帧 / 409 体 / `card_json` 同一条纪律:缺席 = 「没有治理来源
+ * 的证据」,不是「这不是治理门」。
+ *
+ * ⚠️ **`delegation` 刻意不在这里**(同批如实登记,禁编造键):park 行上**没有**这条信息 —— core 的
+ * `Checkpoint` / `PendingAction` / `CheckpointGate` 三个面都不带 `{parentToolCallId, depth, agentName}`
+ * (`Checkpoint.state.delegationProvenance` 是 design/180 的内容安全聚合 `{version, coverageStartTurn,
+ * sawExternal, incomplete}`,与 ask 的出处链是两件事)。同步腿的这一格来自 `AskRequest.delegation`,
+ * 那条路 park 时不随行。⇒ 无供给,诚实缺席;要它得先有 core 侧的属主面。
+ */
+function projectPendingForWire(row, governance) {
+    const redacted = redactPendingDisclosures(row);
+    const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
+    return governanceForced ? { ...redacted, governanceForced } : redacted;
+}
 /**
  * GET /v1/approvals/stream (design/80 native push): SSE — pushes pending-approval deltas so the portal
  * SUBSCRIBES ONCE instead of polling GET /v1/approvals every ~10s (better UX: near-real-time + no client poll
@@ -694,8 +748,12 @@ function redactPendingDisclosures(row) {
  * for a decided/expired/gone one. Cross-replica BY CONSTRUCTION — the poll reads the SHARED checkpoint table,
  * so a suspend on ANY replica is seen by an operator streaming on a DIFFERENT replica. A transient DB blip
  * heartbeats + retries (never kills the stream); a 15-min cap + req-close end it (parity with streamTaskTrace).
- * Poll-granularity caveat: a pending that resolves AND re-suspends on the same (session,toolCallId) within one
- * interval shows no delta — acceptable (the live snapshot is always eventually correct; no decision is missed).
+ * Poll-granularity caveat (**narrowed** by [3684]②): the delta now re-emits a `pending` frame whenever a key's
+ * WIRE PROJECTION changes (upsert), not only when the key enters — so a same-key re-suspend within one interval
+ * IS visible as long as anything on the row differs. What still shows no delta is the strictly degenerate case:
+ * a resolve + re-suspend on the same (session,toolCallId) whose projection is BYTE-IDENTICAL — indistinguishable
+ * by construction, and harmless (the card the operator sees is the card that is pending). Pins: the two halves of
+ * `test/wire-pairing-approvals-stream.test.ts` S3b (changed ⇒ re-emit with the NEW payload; unchanged ⇒ silence).
  *
  * A-002.19(2026-08-09 亲验定性=设计接受,非欠账):每连接自跑 pollMs 轮询打共享 checkpoint 表,
  * 之所以不建 fan-out/单轮询器基建——①消费方=portal 运营面,并发连接数量级为个位(不是用户面);
@@ -704,7 +762,10 @@ function redactPendingDisclosures(row) {
  * 数假设若被打破(portal 多开成常态),届时把 poll 收敛为进程内单轮询器多路复用——那是量级触发的
  * 演化,不是现在的缺陷。
  */
-export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_STREAM_POLL_MS) {
+export async function streamApprovals(req, res, cs, scope, 
+/** [3684]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
+ *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
+governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     // JSON-encode the (sessionId, toolCallId) pair so distinct pendings can NEVER collide into one Map key,
     // regardless of what a caller-supplied sessionId contains (any single-char delimiter — space OR even NUL — is
     // injectable by an adversarial id, masking/wrong-removing an approval card; adversarial finding). JSON escaping
@@ -720,13 +781,25 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
     const start = Date.now();
     let lastBeat = Date.now();
     let prev = new Map();
+    /**
+     * 🔴 [3684]② / codex 对抗复审 [medium](验真后修):**上一拍每行的 wire 投影字节**。
+     *
+     * 旧 delta 只判「键进/键出」——对一条内容**不变**的 park 行那是对的,而 `governanceForced` 是**派生位**,
+     * 它随 `config.autonomy`(config-center 的 `apply-effective` 就地热改)在**同一条行还挂着**的时候翻面。
+     * 只判键的话,常驻订阅的 portal 会一直渲着旧徽标(最长到 15 分钟 cap 重连),而同一时刻
+     * `GET /v1/approvals` 已经给出另一个答案 —— 两条本该同源的读面当场分家。
+     *
+     * ⇒ 判据改成**投影字节变了就重发**。`pending` 帧对同一 (sessionId, toolCallId) 键因此是 **upsert**
+     * 语义(消费端本来就按这个键建表);重复发一帧是无害的(幂等覆盖),漏发一帧是错的徽标。
+     */
+    let prevFrames = new Map();
     let first = true;
     while (!closed) {
         let pending;
         try {
-            // #209 件4:与 `GET /v1/approvals` **同一个**投影函数 —— 两条 durable 读面各洗各的就会漂
-            // (SSE 那条恰恰是 operator 常驻订阅的那条,漏掉它等于没修)。
-            pending = (await cs.listPending(scope)).map(redactPendingDisclosures);
+            // #209 件4 + [3684]②:与 `GET /v1/approvals` **同一个**投影函数(脱敏 + 出身归因)—— 两条 durable
+            // 读面各投各的就会漂(SSE 那条恰恰是 operator 常驻订阅的那条,漏掉它等于没修)。
+            pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
         }
         catch {
             // a transient TiDB blip must NOT kill the subscription — heartbeat + retry next tick (fail-soft)
@@ -736,22 +809,26 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
             continue;
         }
         const cur = new Map(pending.map((p) => [keyOf(p), p]));
+        // 一行只序列化一次:既是要发的帧体,也是与上一拍比对的判据(两处各算一遍必然漂)。
+        const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
         if (first) {
             // initial snapshot so a freshly-subscribed portal renders the current queue immediately (no first-poll gap)
-            for (const p of pending)
-                res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`);
+            for (const frame of curFrames.values())
+                res.write(`event: pending\ndata: ${frame}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
         else {
-            for (const [k, p] of cur)
-                if (!prev.has(k))
-                    res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`); // a new suspend
+            // 新 park **或**同一行的投影内容变了(见 `prevFrames` 顶注:派生位会在行不变时翻面)⇒ upsert 一帧
+            for (const [k, frame] of curFrames)
+                if (prevFrames.get(k) !== frame)
+                    res.write(`event: pending\ndata: ${frame}\n\n`);
             for (const [k, p] of prev)
                 if (!cur.has(k))
                     res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`); // decided/expired/gone
         }
         prev = cur;
+        prevFrames = curFrames;
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;

package/dist/http/routes/capabilities.js

@@ -1,4 +1,5 @@
-import { DEFAULT_EFFORT_LEVELS } from "@sema-agent/core";
+import { DEFAULT_EFFORT_LEVELS, expandTiers } from "@sema-agent/core";
+import { isModelAllowlisted } from "../../model-select.js";
 import { cwdHonored } from "../../task-cwd.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
@@ -394,6 +395,11 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
     // today = env-derived config.models; later the sema registry (sema-registry). The internal
     // `default` alias is hidden (it's a fallback ref, not a user-pickable model).
     if (req.method === "GET" && url === "/v1/models") {
+        // #233 / A-002.8 读面:名单**在场时**每行补 `atMentionable`(名单缺席/空 ⇒ 整个键不发 —— 缺省形的
+        // 字节逐字不变,消费端"没有这个键"= 这台没开名单治理,而不是"这行不能点")。判定与三个执法点同源
+        // (isModelAllowlisted + 增广目录):壳面板上灰掉的行与服务端真会拒的行永远是同一批。
+        const atCatalog = expandTiers(deps.config.models, deps.config.tiers ?? {}) ?? deps.config.models;
+        const atAllowlist = deps.config.atModelAllowlist ?? [];
         const models = Object.entries(deps.config.models)
             .filter(([name]) => name !== "default")
             .map(([name, m]) => ({
@@ -414,6 +420,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // model (effort doesn't apply). The accept-set on a request is broader (any core ThinkingLevel) — this is
             // the advertised picker default, not a hard allow-list.
             ...(m.reasoning ? { supportedEffortLevels: [...DEFAULT_EFFORT_LEVELS] } : {}),
+            ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
         }));
         // [865]③ id/name 撕裂消解:`default` 历史上是 **id 形**(壳面板行 value 却是 name 形,壳侧只能打补丁
         // 拼回)。additive 双给:`default` 保持 id 形字节不动(既有消费者),新 `defaultModel = { id, name }`

package/dist/http/routes/diagnostics.d.ts

@@ -80,5 +80,23 @@ export declare function buildStaticWiringAudit(facts: StaticWiringFacts): Static
 export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, logger: {
     warn: (msg: string, meta?: Record<string, unknown>) => void;
 } | undefined): StaticWiringAudit;
+/**
+ * [3399]③ clay 裁 (b)(2026-08-12,core [3648]④ + cli [3649]① 双背书):**零凭证 turnkey 形**的
+ * loopback 来源门判据(单一属主,端点与测试同吃)。
+ *
+ * 只在「operator 名单空 ∧ 非多租户 ∧ 全局 service-credential 门也不在场(没配 SERVICE_AUTH_TOKEN /
+ * AUTH_TOKENS)」的部署形上判——那正是全局门整个不设、诊断端点此前无认证可读的形。诊断面泄的是装配
+ * 拓扑(store 接线/能力位/治理姿态),对误暴露公网端口的 turnkey 机器构成侦察面。(b) 对本机自用零摩擦
+ * (壳缺省钉 BIND_HOST=127.0.0.1,local curl 照常),对远程侦察 fail-closed;配了 token 的部署远程读
+ * 走认证(全局门),不进本臂。
+ *
+ * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
+ * 是伪造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
+ * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
+ */
+export declare function zeroCredentialLoopbackDenied(remoteAddress: string | undefined, config: {
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}): boolean;
 export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/http/routes/diagnostics.js

@@ -91,6 +91,28 @@ export function assertStaticWiringConsistent(facts, logger) {
     }
     return audit;
 }
+/**
+ * [3399]③ clay 裁 (b)(2026-08-12,core [3648]④ + cli [3649]① 双背书):**零凭证 turnkey 形**的
+ * loopback 来源门判据(单一属主,端点与测试同吃)。
+ *
+ * 只在「operator 名单空 ∧ 非多租户 ∧ 全局 service-credential 门也不在场(没配 SERVICE_AUTH_TOKEN /
+ * AUTH_TOKENS)」的部署形上判——那正是全局门整个不设、诊断端点此前无认证可读的形。诊断面泄的是装配
+ * 拓扑(store 接线/能力位/治理姿态),对误暴露公网端口的 turnkey 机器构成侦察面。(b) 对本机自用零摩擦
+ * (壳缺省钉 BIND_HOST=127.0.0.1,local curl 照常),对远程侦察 fail-closed;配了 token 的部署远程读
+ * 走认证(全局门),不进本臂。
+ *
+ * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
+ * 是伪造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
+ * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
+ */
+export function zeroCredentialLoopbackDenied(remoteAddress, config) {
+    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+    if (anyServiceAuth)
+        return false; // 凭证在场 ⇒ 边界归全局 service-credential 门,本判不参与
+    const addr = remoteAddress ?? "";
+    const isLoopback = addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+    return !isLoopback;
+}
 export async function handleDiagnostics(req, res, url, ctx) {
     const miss = { fell: false };
     await handleDiagnosticsBody(req, res, url, ctx, miss);
@@ -122,6 +144,10 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 return;
             }
         }
+        else if (zeroCredentialLoopbackDenied(req.socket.remoteAddress, deps.config)) {
+            sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
+            return;
+        }
         // 静态半场是 **composition root 在 boot 算的**(与拒启自检同一份产物,不可能与它不同)。缺席 ⇒ 这个
         // 进程不是由 main.ts 装起来的(测试夹具形),此面诚实地不存在 —— 落到全局 404,而不是回一个空壳 200。
         if (!deps.staticWiring) {

package/dist/http/routes/runs.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
-import { isTerminalRunStatus } from "../../plugins/store-contracts.js";
+import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { runInBackground } from "../../runs.js";
@@ -522,7 +522,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                         // CAS lost — answer by the run's ACTUAL state, never pretend the cancel landed.
                         const now = await rs.getRun(taskId);
                         const st = now?.status;
-                        if (st === "suspended" || st === "needs_review" || st === "running") {
+                        // 判据取词表属主(合并码重扫):park 是两个词,手抄形对 core 的词表增删两向都没有编译期钉。
+                        if (st !== undefined && (isParkedRunStatus(st) || st === "running")) {
                             // 文案中性覆盖两因(复验镜头:输家可能是 decide 也可能是 reaper 的 expire——后者无人 resuming)
                             sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active", { taskId, status: st });
                         }
@@ -544,7 +545,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                     if (!claimed) {
                         const now = await rs.getRun(taskId);
                         const st = now?.status;
-                        if (st === "running" || st === "suspended" || st === "needs_review") {
+                        // 同上:词表属主判据(手抄形绕开 isParkedRunStatus 的 `never` 执法点)。
+                        if (st !== undefined && (st === "running" || isParkedRunStatus(st))) {
                             sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active", { taskId, status: st });
                         }
                         else {
@@ -609,15 +611,36 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             // Durable flag FIRST (only flips a still-running row), abort after: if the run suspended/terminal'd
             // between the getRun above and here, the flag write affects 0 rows — re-read and answer by the run's
             // ACTUAL state instead of lying "cancelling" about a run nothing will cancel.
-            const flagged = await deps.runStore.requestCancel(taskId, run.owner); // owner guard: single-DB defense-in-depth (HTTP gate already passed runOwnerOk)
-            if (!flagged) {
+            let flagged = await deps.runStore.requestCancel(taskId, run.owner); // owner guard: single-DB defense-in-depth (HTTP gate already passed runOwnerOk)
+            // 抢跑输了(旗打空 0 行)⇒ 按 run 的**真实**状态重判。三向,而且 `running` 那一向必须**重挂旗**
+            // 而不是回答:
+            //  · **park**(🔴 判据取词表属主 `store-contracts.ts` 的穷举 `isParkedRunStatus`,扫描P2):原地手抄的
+            //    `=== "suspended"` 漏掉 `needs_review`(plan_review / dry-run 门的 park 落名),一条抢跑停到计划
+            //    评审上的 run 会掉进 no-op 臂被谎报终局,而行还活着、`task_active` claim 一根手指都没动 ——
+            //    [868] 会话锁死指纹的同族第二例(直连分支早已认两个词,codex M1;这条孪生臂当时漏了)。
+            //  · **running**(codex 复审 round1 [high] 二,验真):`requestCancel` 只对 running 行生效,而
+            //    park→running 的**二次跃迁**真实存在——并发 approve 的 `markResuming` 会把行从 park 翻回
+            //    running。旧码只处理「重读到 park」,重读到 running 掉进 no-op 臂:旗没挂上、腿没 abort,
+            //    **被批准的活继续跑**,而调用方以为取消是空操作。行活过来正是该重挂旗的时刻,不是该撒谎的时刻。
+            //  · 真终局 ⇒ 照旧幂等 no-op(带真实状态)。
+            // 有界(park↔running 反复跳时不许把请求钉在这):次数用尽仍 running ⇒ 如实 409 让调用方重试。
+            const CANCEL_RECLASSIFY_ATTEMPTS = 3;
+            for (let attempt = 0; !flagged; attempt++) {
                 const now = await deps.runStore.getRun(taskId);
-                if (now?.status === "suspended") {
-                    await cancelSuspended(); // [868] lost race INTO suspended — same recovery handle as the direct branch
+                if (now !== undefined && isParkedRunStatus(now.status)) {
+                    await cancelSuspended(); // [868] lost race INTO a park — same recovery handle as the direct branch
+                    return;
                 }
-                else {
-                    sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "run already terminal — cancel is a no-op" });
+                if (now?.status === "running" && attempt < CANCEL_RECLASSIFY_ATTEMPTS) {
+                    flagged = await deps.runStore.requestCancel(taskId, run.owner); // 行又活了 ⇒ 重挂 durable 旗(赢了就走下面的快路)
+                    continue;
+                }
+                if (now?.status === "running") {
+                    // 文案与 cancelSuspended 的 CAS 输臂同源(同一件事:并发决议赢了,它的恢复腿正在跑)。
+                    sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active", { taskId, status: now.status });
+                    return;
                 }
+                sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "run already terminal — cancel is a no-op" });
                 return;
             }
             // fast path: cancel landed on the running instance → abort now. Label FIRST ([1.207 codex H2]) so the
@@ -628,10 +651,11 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             }
             sendJson(res, 202, { taskId, status: "cancelling" });
         }
-        else if (run.status === "suspended" || run.status === "needs_review") {
+        else if (isParkedRunStatus(run.status)) {
             // [868] settle the pending gate + terminalize + unlock (was a flat 409 dead-end). needs_review rides the
             // SAME handle (codex M1): a plan-review park holds the claim identically and the old else branch lied
-            // "already terminal" about it (claim never released).
+            // "already terminal" about it (claim never released). 判据同上取属主(扫描P2:两处原地手抄的同一张
+            // park 词表已收敛到 `isParkedRunStatus`,再加词由 tsc 逼人表态)。
             await cancelSuspended();
         }
         else {
@@ -790,7 +814,13 @@ async function handleRunsBody(req, res, url, ctx, miss) {
         };
         const sendQueueFull = () => sendError(res, 409, "steering.queue_full", parkQueueFull ?? "the parked steering queue on this checkpoint is full");
         const sendDuplicateKey = () => sendError(res, 409, "steering.duplicate_input_id", parkDuplicateKey ?? "this Idempotency-Key is already parked with different steering content — reissue with a fresh key");
-        const sendParked = () => sendJson(res, 202, { taskId, status: "suspended", delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
+        /**
+         * 202 park 回执。`status` 是**入参**而不是字面量(合并码重扫):park 是两个词,`403a841` 把 (b) 支的
+         * 判据拓成 `isParkedRunStatus` 之后 `needs_review` 行首次走进这条支,而回执还硬报 `"suspended"` ⇒ 同一
+         * 时刻 `GET /v1/runs/:id` 报 `needs_review`,按回执刷新本地行的消费端把「待评审」渲成「已挂起」。
+         * 姊妹位早就读真词(preempt 的 `extras.status`、本文件终局 cancel 与 wake-park 两处回执)。
+         */
+        const sendParked = (status) => sendJson(res, 202, { taskId, status, delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         // (a) Same-replica live path: the run is streaming here → inject now (drained at the next turn boundary).
         const live = steerableRuns.get(taskId);
@@ -811,9 +841,21 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 // Raced: the stream finished between the map lookup and steer(). It may have durably SUSPENDED in the SAME
                 // tick (core already wrote the pending checkpoint) — fall through to the durable park rather than a spurious
                 // 409 (the live→suspended transition window). Only a genuinely-terminal run → not_running.
+                // 🔴 回执的 status 要报「投递时刻 server 看到的行状态」,而手里那份快照是**进 handler 时**读的
+                // (这条腿上多半还是 `running`,park 发生在它之后)。所以在这里重读一次 —— 且**必须在 park 之前**
+                // (codex 复审二/三轮合并处置):
+                //  · 提交**后**再读 = 给一个已成功的写加提交后依赖。库降级时那次读可以永远挂着(`.catch` 只接
+                //    拒绝、接不住不返回),客户端拿不到 202 就重试,而不带 `Idempotency-Key` 的重试会**再追加一条**
+                //    同样的指令(队列只有 3 个位子)——把「回执更准」换成「指令重复入队」,方向反了。
+                //  · 提交**前**读则没有这个代价:此刻还没有任何东西入队,读挂了 = 这次请求超时,与 park 之前任何
+                //    一步超时同形,重试语义不变。
+                // 读不到(理论不可达:行必在)⇒ 退回快照,绝不硬编码一个 park 词。残余如实说:行的翻面与 core
+                // 写 checkpoint 不在同一步,所以这一腿仍可能读到 `running` ——判别键是 `delivery`(SDK/openapi 逐字
+                // 「branch on `delivery`, not the status」),不是 status。
+                const freshBeforePark = await deps.runStore.getRun(taskId).catch(() => undefined);
                 const raced = await tryPark();
                 if (raced === "parked") {
-                    sendParked();
+                    sendParked(freshBeforePark?.status ?? run.status);
                     return;
                 }
                 if (raced === "queue-full") {
@@ -828,15 +870,18 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 return;
             }
         }
-        // (b) Durably suspended → park the steer on the pending checkpoint (drained on resume).
-        if (run.status === "suspended") {
+        // (b) Durably PARKED → park the steer on the pending checkpoint (drained on resume). 判据取词表属主
+        // isParkedRunStatus(扫描P2 顺带件):只认 suspended 会把 needs_review park 漏到 (d) 终局支——消息
+        // 虽也 park 上同一张卡,但回执是 parked_for_wake+「run already ended,用 /wake 送」,指路错人
+        // (真相是本支的「injected when the run resumes」)。
+        if (isParkedRunStatus(run.status)) {
             const outcome = await tryPark();
             if (outcome === "no-store") {
                 sendError(res, 501, "capability.checkpoint_store_required", "steering a suspended run requires the checkpoint store");
                 return;
             }
             if (outcome === "parked") {
-                sendParked();
+                sendParked(run.status);
                 return;
             }
             if (outcome === "queue-full") {
@@ -847,7 +892,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 sendDuplicateKey();
                 return;
             }
-            sendNotRunning("run is no longer suspended (resolved or expired)");
+            // 文案按 park **两个词**中性化(旧句只说 suspended,对一条 needs_review park 说的是别人的事)。
+            sendNotRunning("run is no longer parked on a pending decision (resolved or expired)");
             return;
         }
         // (c) running-elsewhere (cross-replica, fast-follow seam) → not_running.

package/dist/http/routes/side-query.js

@@ -1,5 +1,6 @@
-import { isThinkingLevel } from "@sema-agent/core";
+import { expandTiers, isThinkingLevel } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
+import { isModelAllowlisted } from "../../model-select.js";
 import { cacheFamilyOfMirror } from "../../budget.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
@@ -135,6 +136,19 @@ async function handleSideQueryBody(req, res, url, ctx, miss) {
                 sendError(res, 400, "request.field_invalid", `invalid modelRole (expected one of: ${Object.keys(MODEL_ROLE_TABLE).join(", ")}) — a role only resolves a model when 'model' is absent`);
                 return;
             }
+            // #233 / A-002.8 第三执法点 —— side-query 的 `body.model` 是**计费提交面**上的用户逐 turn 选择
+            // 通道(直透传给 core 的路由),与任务面 `body.model` 同名单同拒形。归一走同一只
+            // `isModelAllowlisted`(增广目录:档位词/CC 别名/id 与 name 指同一只模型时不许绕门)。
+            // 不受限的是 `modelRole`(operator 的角色表选路,不是用户点的模型)——两者的辖域线与任务面一致。
+            // 本路由无 resume 腿(一次性问答),故只有 fresh 拒这一支。
+            if (typeof body.model === "string" && body.model.length > 0) {
+                const bare = deps.config.models ?? {};
+                const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
+                if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist)) {
+                    sendError(res, 400, "request.model_not_allowed", `model is not in this deployment's @-mention allowlist: "${body.model.slice(0, 120)}" — the allowlist is configured by the operator (config-center models.atModelAllowlist)`);
+                    return;
+                }
+            }
             if (ac.signal.aborted)
                 return; // client already gone — don't start the brain call at all
             const spec = {

package/dist/http/routes/tasks.js

@@ -20,6 +20,12 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
  *  前缀 `id: <eventId>` 行(SSE 游标=账本 eventId,壳/SDK 拿它锚进账本或断线换道 events tail 续读);
  *  无 eventId 的帧**不发行**,EventSource 沿用上一游标 —— 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。
  *  durable 腿的 `id:` 行在 sse-log.ts(同一契约的另半);行为钉=test/live-sse-cursor.test.ts(规则式全流判据)。 */
+/** #241([3731] 裁定 A):断连转 park 的有界宽限——ask 已被强转 park 路由后,给 core 从「收到
+ *  "unavailable"」走到「铸 checkpoint + done(suspended)」的时间。到点仍没收到 done ⇒ 照旧 abort,
+ *  交断连支既有的 findPendingTokenBySession 竞态卫兵兜底(checkpoint 已落盘则仍 park)。
+ *  取值:core 的 park 是本地 IO(checkpoint 写盘/写库)+一次 done 帧,秒级富余;不设旋钮——它不是
+ *  行为面选择,只是竞态兜底的等待上限(设长了唯一代价是极端卡死时 abort 晚到)。 */
+const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
     const idLine = typeof anchor === "string" && anchor.length > 0 ? `id: ${anchor}\n` : "";
@@ -161,6 +167,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             // 🔴 stoppedBy 归因的注册点在**下面**(createRun 认领成功之后),不在这里 —— #168 件3,见那里的注。
             let closed = false;
             let detachLogged = false; // [854]①b:detach 断连 info 只打一条(req/res 两个 close listener 都可能进来)
+            // #241([3731] 裁定 A):断连转 park 的宽限表——非空 = 已触发过 ask 转 park,断连支不再二次进臂。
+            let disconnectParkGrace;
             const onDisconnect = () => {
                 // [854]①b:detach opt-in 的断连分支 —— 不置 closed(for-await 继续消费到 done,终态走既有
                 // setTerminal 路径落 durable 账本)、不 abort(run 不杀)。断连后的 res.write 落在已 destroy 的
@@ -180,6 +188,26 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     }
                     return;
                 }
+                // #241([3731] 裁定 A「park 应跨壳死存活」,[3730] core 零改动承运;cli [3729] L3 真机复现=本臂
+                // 缺席时的行为):断连瞬间本 run 有**流内未决 ask** 且 park 设施在场 ⇒ 不立即 abort——先把 ask 按
+                // 窗到期同路强转 park(coordinator 交 `"unavailable"` ⇒ core 走 durable park ⇒ done(suspended)),
+                // 给 core 一个**有界宽限**走完 park:宽限内 done 到 ⇒ 循环自然收束、走上面的 setSuspended 臂
+                // (行 park、卡存活、resume 重呈闭环);宽限用尽(park 卡在半路)⇒ 照旧 closed+abort,下面既有的
+                // findPendingTokenBySession 竞态卫兵接手(checkpoint 已落盘则仍 park)。真算力中断(无未决 ask)
+                // 语义**不变**:立即 abort——那是这个断连臂存在的原始理由(dropped relay 不烧 token)。
+                if (deps.checkpointStore && earlyDurableTid && disconnectParkGrace === undefined) {
+                    const parked = deps.toolApproval?.parkOpenAsksForTask(earlyDurableTid) ?? 0;
+                    if (parked > 0) {
+                        res.on("error", () => undefined); // 断连后循环继续消费,死 socket 上的 write 错误按 detach 同形吞
+                        deps.logger?.info("stream_disconnect_ask_parked", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, asks: parked, graceMs: DISCONNECT_PARK_GRACE_MS });
+                        disconnectParkGrace = setTimeout(() => {
+                            closed = true;
+                            ac.abort();
+                        }, DISCONNECT_PARK_GRACE_MS);
+                        disconnectParkGrace.unref?.();
+                        return;
+                    }
+                }
                 closed = true;
                 ac.abort();
             };
@@ -1054,7 +1082,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         if (finalResult?.status === "suspended" && deps.checkpointStore)
                             await deps.runStore.setSuspended(durableTaskId);
                         else if (finalResult?.status === "needs_review" && deps.checkpointStore)
-                            await deps.runStore.setNeedsReview(durableTaskId); // D-B: park a review pause, keep the lock (resumable via /plan_review)
+                            await deps.runStore.setNeedsReview(durableTaskId); // D-B: park a review pause, keep the lock (a plan_review GATE resumes via /plan_review; a needs_review gate = dry-run review has no resolution endpoint today — [3683]-1, don't copy this comment as "needs_review → /plan_review")
                         else if (finalResult)
                             await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
                         else {
@@ -1345,8 +1373,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     return { status: 200, body: { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" } };
                 }
                 // design/80 D-B: a review pause (plan_review / dry_run_review) on the sync path — PARK it like a suspend
-                // (keep task_active) + return a pollable taskId so the /v1/assistant/tasks/:id/plan_review resume can
-                // claim it. NEVER the capability token (parity with the suspended branch above).
+                // (keep task_active) + return a pollable taskId. For a plan_review GATE the /v1/assistant/tasks/:id/plan_review
+                // resume claims it; a needs_review gate (dry-run review) has no resolution endpoint today ([3683]-1).
+                // NEVER the capability token (parity with the suspended branch above).
                 if (result.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setNeedsReview(durableTaskId);