@sema-agent/server 7.150.0 → 7.151.0

package/dist/entry-mode-clamp-notice.d.ts

@@ -10,7 +10,8 @@
  * ## 铸点(唯一)
  * {@link buildEntryModeClampNotice} 是本码**唯一**的铸点;调用点只有一处:`http/admission.ts` 的 `prepareSpec`(提交入口,盖章之后、装配
  * 之后 —— 那时会话 id 才定)。一次提交一次 ⇒ 一条 run 至多一帧(core 码册的去重单位「once per run」)。读的是盖章那一次求值的读数
- * (`EntryPermissionMode`),不另判一遍「折没折」。续跑腿不铸:它们重放的是已盖过章的存储体,折叠只发生过一次。
+ * (`EntryPermissionMode`),不另判一遍「折没折」。续跑腿不铸:续跑口按**现**地板钳存储体的词时(`permission-mode-admission.ts` `stampReplayEntryMode`),
+ * 那一腿的生效词由它的 `wiring_manifest.permissionMode` 说(引擎收到的就是钳过的词);本码只说受理门那一折(per run 一帧)。
  * 装配期铸、腿开口那一拍投(`PreparedTaskSubmission.engineNotices` → `registerEngineNoticeLeg` 的 `pending`)—— 与请求腿 MCP 丢弃同一条投递路,
  * 白名单 / 归属 / 消毒 / 隔离一个不绕。
  *

package/dist/execution-env-refusal.d.ts

@@ -0,0 +1,23 @@
+/**
+ * 本仓自铸的**执行环境拒码**闭集(`env.*` 族)的唯一属主(纯叶:零值依赖)。
+ *
+ * 一族一句:**这只执行环境没开,而且再问也是同一个答** —— 部署状态(或会话数据)与这条 run 冲突,原样重试不改判,出路在部署。两处产出、同一族:
+ *  · host 车道的工厂在铸环境之前拒(读数在构造时就到手:`lane-home-probe.ts` 的 `laneHomeRefusal`),引擎在准备期原样再抛;
+ *  · 远端车道在建连时答的**立定拒**(这只环境此后每一次建连都答同一个拒,适配器记住它):码由 `plugins/remote-env-connect-seat.ts` 的拒因表从事实词拼出
+ *    —— 那张表是远端车道拼本族码的唯一入口,立定 ⇔ 码在引擎可重试表之外 ⇔ 记住。
+ * 同步提交腿按零工作拒落档(`runs.ts` 的 `EXECUTION_ENV_REFUSAL_HTTP_STATUS`,按本闭集键控:加一员而档没跟 ⇒ tsc 红)。
+ *  · `env.home_unconfirmed` —— 家目录主张证不了(`judgeLaneHome` 的三形拒句:读不出 / 不是绝对路径 / 与实测不一致;远端车道只在环境**答了**的两形上记住它)。
+ *    三形一个码:出路都在部署(声明、环境里的 `HOME`,或会话 `settings.env` 里的 `HOME`),消费端不按形分岔;是哪一形、怎么改,句子里说。
+ *  · `env.snapshot_bucket_missing` —— k8s 车道的工作区快照桶不在(对象存储对 `latest` 或归档的读答 `404 NoSuchBucket`):建桶,或把
+ *    `WORKSPACE_SNAPSHOT_BUCKET` 指向已有的桶,或 `WORKSPACE_PERSIST=off`。
+ *  · `env.occupant_missing` —— k8s 车道读这条 run 的会话住客:会话行在、却不带住客令牌(存储数据缺陷,重发不改判):给行补令牌或删会话,或关掉要它的旋钮。
+ *  · `env.sandbox_refused` —— 隔离车道(k8s / e2b / local-docker)替这条 run 建的沙箱被立定地拒:集群在准入时拒了 pod、成员凭据中继建不起来、
+ *    快照归档在桶里却取不回、工作区的填充(会话附件 / 项目包种子)放不进且换一台机器也是同一个答。是哪一件、怎么改,句子里说。
+ *  · `env.host_key_rejected` —— ssh 车道:目标机出示的主机密钥过不了部署钉的判(`SSH_HOST_FINGERPRINT` / `SSH_KNOWN_HOSTS`:指纹不符、条目换了钥、被吊销、没有条目)。
+ *    改钉或查明对面为什么换了钥;同一配置同一主机每次同答。
+ */
+export declare const EXECUTION_ENV_REFUSAL_CODES: readonly ["env.home_unconfirmed", "env.snapshot_bucket_missing", "env.occupant_missing", "env.sandbox_refused", "env.host_key_rejected"];
+export type ExecutionEnvRefusalCode = (typeof EXECUTION_ENV_REFUSAL_CODES)[number];
+/** 这个码是不是本族的一员(按闭集,不按前缀:引擎自己的 `env.lifetime_expired` 同前缀而不是本族)。 */
+export declare function isExecutionEnvRefusalCode(code: unknown): code is ExecutionEnvRefusalCode;
+//# sourceMappingURL=execution-env-refusal.d.ts.map

package/dist/execution-env-refusal.js

@@ -0,0 +1,5 @@
+export const EXECUTION_ENV_REFUSAL_CODES = ["env.home_unconfirmed", "env.snapshot_bucket_missing", "env.occupant_missing", "env.sandbox_refused", "env.host_key_rejected"];
+export function isExecutionEnvRefusalCode(code) {
+    return typeof code === "string" && EXECUTION_ENV_REFUSAL_CODES.includes(code);
+}
+//# sourceMappingURL=execution-env-refusal.js.map

package/dist/execution-lane-caps.d.ts

@@ -184,7 +184,7 @@ export declare function deployedExecutionLanes(config: Pick<ServiceConfigFlat, "
  * 读者问的都是这一句,**同一只函数**,不许各写一份 `=== "host"`:
  *  ① 部署形表行 `toolsOnThisHost`(`deployment-shape.ts`)—— wire `executionLane.toolsOnThisHost` + 出厂自扫技能与中心 plugin 技能的 `baseDir`;
  *  ② 部署形表行 `callerOwnsWorkerDisk`(本列 ∧ 单主)—— SendUserFile 本机腿(「无手不挂」)、调用方宿主路径(附加目录 / 项目上下文)、指令文件探针、
- *     本机语言服务器(`createLspManager`;这类车道的适配器必须绑得住读 `openBound`,对拍钉 `test/host-env-open-bound.test.ts`);
+ *     本机语言服务器(`createLspManager`;「绑得住读」`openBound` 不是本列的事,是每条有手车道的结构前提,见 {@link laneWiresExecutionEnv});
  *  ③ `approval.ts` 的 `buildNoResponderBootWarns` —— 写门的 ask 只在「有手写本机盘」时才会发生(它手里已有车道词,直接读本列)。
  */
 export declare function handsOnWorkerFilePlane(lane: ExecutionLane): boolean;
@@ -230,6 +230,8 @@ export declare function laneIsolated(lane: ExecutionLane): boolean;
  * 这条车道**有没有手**(块 `io`:文件与 shell 两面真到达目标;`none` 的桩块 false)的唯一布尔口。读者四处:路由的「有没有执行环境」(`boot/resolve-spec.ts`)、
  * wire `executionLane.isolated` 的在场判据(`capabilities/execution-lane.ts`)、场景详情的附件供给集(`boot/stage-07-capability-layer.ts` 把它填进
  * `ScenarioDeps.handsLane`:「这一 run 有没有工作区」的车道半场)、起服家目录那一行({@link buildLaneHomeBootNote})—— 同读这一只。
+ * 有手车道的结构前提:适配器有绑定读面(`openBound`;设备的面 presence-typed,执行器声明了才装)—— 「能不能绑定读」的源是适配器对象本身,
+ * 本列不另存一位(对拍钉 `test/host-env-open-bound.test.ts` P3;本版唯一缓装 = ssh,同文件 `HELD_THIS_VERSION`,翻回条件钉在那里)。
  */
 export declare function laneWiresExecutionEnv(lane: ExecutionLane): boolean;
 /** 一条**已登记**的分叉:表写的是目标态,今天的判别式还答别的。 */

package/dist/field-conflict.d.ts

@@ -7,7 +7,7 @@ export type FieldConflictReason = (typeof FIELD_CONFLICT_REASONS)[number];
  * 动态下标的坐标用模板字面量型(`agents[1].skills`)。
  */
 export interface FieldConflictCoordinates {
-    readonly cascade_verify: "verify" | "cascade" | "sandboxImageProfile" | "resumeAt" | "suggestNextPrompts";
+    readonly cascade_verify: "verify" | "cascade" | "sandboxImageProfile" | "resumeAt" | "rewindFilesTo" | "suggestNextPrompts";
     readonly image_profile: "capabilitiesNeeded" | "sandboxImageProfile";
     readonly resume_anchor: "resumeAtMode" | "resumeAt";
     readonly system_prompt_fold: "appendSystemPrompt" | "projectId" | "settings.outputStyle";

package/dist/file-history-capture.d.ts

@@ -52,21 +52,28 @@ export interface FileHistoryAssembly {
     /** 擦除脸:在场 ⟺ 后端在(与旋钮无关;是 {@link store} 的删除类动词视图)。 */
     readonly erasure: FileHistoryErasureFace | undefined;
 }
-/** 装配:「这台部署有没有文件历史店」的唯一判定。旋钮不在这里 —— 它只关捕获,不摘店([ref])。 */
+/** 「这台部署有没有文件历史店」的唯一判定:店是后端恒交的那一只(`StoreBackend.fileHistory()`,落定席位写的同一只)⇒ 店在 ⟺ 后端在。旋钮不在这里 ——
+ *  它只关捕获,不摘店([ref])。只问「在不在」的读者(能力位)读这一只,不必取店。 */
+export declare function fileHistoryWired(backend: StoreBackend | undefined): backend is StoreBackend;
+/** 装配:取那只店(判定 = {@link fileHistoryWired})。起服装配(引擎的还原族 / 擦除脸)与服务面要店的读者(同步族、rewind 口)都经这里取,手里有后端 ⇒ 型上就有店。 */
+export declare function assembleFileHistory(backend: StoreBackend): {
+    readonly store: ServiceFileHistoryStore;
+    readonly erasure: FileHistoryErasureFace;
+};
 export declare function assembleFileHistory(backend: StoreBackend | undefined): FileHistoryAssembly;
 /**
- * 「捕不捕」的**唯一**判定(纯函数):能力词。`store` = 装配出来的店(在不在),`knob` = 部署旋钮 `FILE_HISTORY_CAPTURE`
+ * 「捕不捕」的**唯一**判定(纯函数):能力词。`wired` = 店在不在({@link fileHistoryWired} 的答 / 装配出来的店在不在),`knob` = 部署旋钮 `FILE_HISTORY_CAPTURE`
  * (`config.fileHistoryCapture`)。从**装配结果**派生,不照旋钮字面回声:后端本来就没有这只店的部署同样是 `off`。
  *
  * 与 `restoreFiles` 分叉([ref] 当时写下的分叉条件,自 [ref] 成真):本词答「这台部署捕不捕、能不能按 run 关掉」,
  * `restoreFiles` 答「这台部署能不能还原」—— 旋钮关的部署本词 `off` 而 `restoreFiles` 仍为真。
  */
-export declare function fileHistoryCaptureOf(store: object | undefined, knob: boolean): FileHistoryCapture;
+export declare function fileHistoryCaptureOf(wired: boolean, knob: boolean): FileHistoryCapture;
 /**
  * core 的部署捕获位 `RunnerDeps.fileHistoryCapture`,由 {@link fileHistoryCaptureOf} 派生(同一组输入、同一只判定)。
  * 形照 `execution-lane-caps.ts` 的穷举 switch(无 default 臂):能力词加一个而这里不加臂 ⇒ 编译红 —— 加臂的那一刻就是
  * 决定「这一词下 core 的捕获位怎么递」的地方。没有店 ⇒ 恒 `undefined`(core 对「off 但没店」拒 prepare)。
  */
-export declare function coreFileHistoryCaptureSeat(store: object | undefined, knob: boolean): RunnerDeps["fileHistoryCapture"];
+export declare function coreFileHistoryCaptureSeat(wired: boolean, knob: boolean): RunnerDeps["fileHistoryCapture"];
 export {};
 //# sourceMappingURL=file-history-capture.d.ts.map

package/dist/file-history-capture.js

@@ -3,19 +3,22 @@ const FILE_HISTORY_CAPTURE_WORD_SET = {
     "on-optional": true,
 };
 export const FILE_HISTORY_CAPTURE_WORDS = Object.keys(FILE_HISTORY_CAPTURE_WORD_SET);
+export function fileHistoryWired(backend) {
+    return backend !== undefined;
+}
 export function assembleFileHistory(backend) {
-    if (backend === undefined)
+    if (!fileHistoryWired(backend))
         return { store: undefined, erasure: undefined };
     const physical = backend.fileHistory();
     return { store: physical, erasure: physical };
 }
-export function fileHistoryCaptureOf(store, knob) {
-    return store !== undefined && knob ? "on-optional" : "off";
+export function fileHistoryCaptureOf(wired, knob) {
+    return wired && knob ? "on-optional" : "off";
 }
-export function coreFileHistoryCaptureSeat(store, knob) {
-    if (store === undefined)
+export function coreFileHistoryCaptureSeat(wired, knob) {
+    if (!wired)
         return undefined;
-    const word = fileHistoryCaptureOf(store, knob);
+    const word = fileHistoryCaptureOf(wired, knob);
     switch (word) {
         case "off":
             return "off";

package/dist/file-history-disclosure.d.ts

@@ -50,16 +50,18 @@ export interface CaughtFailure {
     readonly fault: Pick<FileHistoryError, "permanence">;
 }
 /**
- * 把一个 caught error 折成店侧的散文 + 判断,**并**在它是一枚 typed 永久失败时留痕。
+ * 把一个 caught error 折成店侧的散文 + 判断,**并**在它是一枚 typed 永久失败时留痕。**先读店边界**(`storeBoundaryFault`,`site` = 折点所在的店方法):
+ * 文件历史店把失败**返回**成值(不抛),值里的文本取自这里 —— 驱动错(以及词法外的码:工作区 fs 的 `ENOENT` / `EACCES`、对象存储的码)在这里换成边界形
+ * (类别句 + 原码尾注,原句进运维日志 `at=store` 一行),返回值里不再带库的原话。
  *
- * `text` = 散文形:带 typed `code` 的前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
- * 不带的**逐字**是原 message(transient 失败的文案因此与本批之前一字不差)。
+ * `text` = 散文形:带本仓词法内 `code` 的(typed 失败:`blob_too_large_for_sql` 一类)前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
+ * 其余逐字是(过了边界的)message —— 边界句自带 `[original code: <码>]` 尾注,不再前缀第二遍码。
  * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;连接类故障 ⇒ `{ permanence: "transient" }`
  * (什么都不改稍后再试可能成);部署错配类故障 ⇒ `{ permanence: "terminal" }`(修表 / 授权之前重试注定失败);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。
- * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`,本文件不写码。
+ * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`(边界形带着它在原错上判的词),本文件不写码。
  * 副作用 = 机器形:码取自错误对象,逐次计数 + 每进程每码一条 warn。观测绝不抛。
  */
-export declare function foldCaughtFailure(err: unknown): CaughtFailure;
+export declare function foldCaughtFailure(err: unknown, site: string): CaughtFailure;
 /** 装配层把 logger/metrics 接上(main.ts,与 `installFailOpenRecorder` 同一处)。 */
 export declare function installFileHistoryFailureRecorder(deps: Sink): void;
 /** 本进程逐码累计(测试/诊断读面)。 */

package/dist/file-history-disclosure.js

@@ -1,5 +1,6 @@
 import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "@sema-agent/core";
 import { storeFaultClassOf } from "./plugins/store-fault.js";
+import { outwardFailureCode, storeBoundaryFault } from "./terminal.js";
 const PERMANENT_STORE_FAILURE_CODES = {
     blob_too_large_for_sql: {
         note: "a blob is larger than this deployment's SQL snapshot-blob cap — the same file will fail every turn until the deployment changes",
@@ -30,16 +31,17 @@ function drainToMetrics() {
         }
     }
 }
-export function foldCaughtFailure(err) {
-    const message = err instanceof Error ? err.message : String(err);
-    const code = err?.code;
-    const typedCode = typeof code === "string" && code !== "" ? code : undefined;
+export function foldCaughtFailure(err, site) {
+    const seen = storeBoundaryFault(err, site);
+    const message = seen instanceof Error ? seen.message : String(seen);
+    const code = seen?.code;
+    const typedCode = typeof code === "string" && code !== "" && outwardFailureCode(code) === code ? code : undefined;
     const permanentCode = typedCode !== undefined && isPermanentCode(typedCode) ? typedCode : undefined;
     if (permanentCode !== undefined)
         recordPermanent(permanentCode, message);
     return {
         text: typedCode !== undefined ? `(${typedCode}) ${message}` : message,
-        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(err)),
+        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(seen)),
     };
 }
 function faultOfClass(cls) {

package/dist/fleet/drain-entry.d.ts

@@ -87,6 +87,8 @@ export type DrainEntryAnswer = DrainReceipt | DrainDeadlineRefusal;
  * `session-resident-background.ts` 头注)· retain 的后台 shell · 只读订阅流(只进 `attachedStreams`)。
  * 四项在同一次读里求出(`http/server.ts` 的 `inflightBreakdown` 是唯一的分项函数,两个和都读它),`/health` 的 `inflight` 与 `inflightBreakdown` 因此永远自洽,
  * 判停与 `/health` 也不会各有一份算法。只有这两个函数各写一次这两个和,没有第三张计法表。
+ * 第三个读数 `/health.engineLease.attached`(附着流条数,[ref])进的是**同一张**计法表(契约「附着」一列:每一类活进不进它),不是第二套计数:
+ * 它读 {@link DrainState.attachedStreams} —— 自退判据第一合取读的那一只(`http/dispatch.ts` 的开放响应集 × SSE 章,定义只此一处)。
  */
 export interface InflightBreakdown {
     readonly http: number;
@@ -128,6 +130,8 @@ export interface DrainState {
     /** [ref]:首个**非探针**请求的单调时刻(`null` = 还没有过)。与 `lastActivityAt` 同一个写者(`http/server.ts` 的活性打点)、写一次就定;
      *  读者 = 租约腿的候首触态(`boot/engine-lease.ts`)与 `/health.engineLease.firstAttach.attachedAt`。 */
     firstActivityAt?: () => number | null;
+    /** 本副本此刻打开着的 SSE 流条数(`createHttpServer` 自赋;定义只此一处)。读者:附着租约自退判据的第一合取、`/health.engineLease.attached`(经租约腿的读数)—— 同一只读口,
+     *  不另数。语义是**附着流条数,不是活跃调用方**:订阅流与流式提交腿算,后台腿 / 无流同步腿不算(契约计法表「附着」列);纯轮询壳读到 0 合法。 */
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
     /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */

package/dist/hooks/hook-runner.js

@@ -60,8 +60,8 @@ export const SETTINGS_HOOK_STATIONS = {
 function chainsBelowTaskOn(patterns, station) {
     return patterns.some((p) => p === station || (p.endsWith(".*") && station.startsWith(p.slice(0, -1))));
 }
-const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but this deployment runs its own handler for this call after the request's hooks and that handler never sees a rewrite made above it, so the rewrite cannot be honored and the call was not executed";
-const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but this deployment runs its own handler for this call after the request's hooks, and a request hook's allow does not stand in for that handler's judgment, so the call was not executed";
+const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and such a handler never sees a rewrite made above it, so request-hook rewrites are refused at this site and the call was not executed";
+const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and a request hook's allow does not stand in for that handler's judgment, so request-hook allows are refused at this site and the call was not executed";
 function hangTranslator(on, event, translators) {
     const translate = translators[event];
     if (translate === undefined)

package/dist/host-lsp-manager.d.ts

@@ -6,8 +6,8 @@
  * `LSP_HOST_ENABLED`。理由:core 的 `NodeLspManager` 在 worker 上起本机子进程、在 worker 盘上找根,问的正是「这块盘是不是调用方的」;
  * 车道能力表不另存一位(同一个答案的第二个写者)。两个入口(服务装配 `boot/execution-env.ts`、纯本地 CLI `run-local.ts`)的 `lspManager`
  * 就是本函数的返回值,不再有任何条件(结构钉 `test/secret-env-scrub-disclosure.test.ts` 的 P1,逐格钉 `test/lsp-host-manager.test.ts` 的 P2)。
- * 「绑得住读」(`openBound`)不是运行期判据:它是「手在本 worker 盘上」的车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts`),
- * 运行期的不可绑拒由引擎答。
+ * 「绑得住读」(`openBound`)不是本铸点的判据:它是每条有手车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts` P3;本版 ssh 缓装),
+ * 运行期的不可绑由那一答答(远端目标给不出那一次观测 ⇒ `not_supported`,引擎读作缺席)。
  *
  * ## 子进程 env:病([ref],core 7.30.1 [ref] 提货;DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
  * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的

package/dist/http/admission.js

@@ -1,7 +1,7 @@
 import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
-import { HttpError, sessionIdShapeIssue } from "../security.js";
+import { HttpError, SESSION_KIND_UNRECORDABLE_MESSAGE, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, appendFold, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
@@ -9,7 +9,7 @@ import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, sessionKindFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
@@ -404,6 +404,10 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        if (body.cascade === true && fileHistoryRestoreKeysInBody(body).includes("rewindFilesTo")) {
+            sendError(res, 400, "request.field_conflict", "rewindFilesTo is not supported with cascade (every rung starts a fresh session, so there is no history to restore files from)", fieldConflictFacts("cascade_verify", ["rewindFilesTo", "cascade"]));
+            return null;
+        }
         if (body.resumeAtMode !== undefined) {
             if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
                 sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
@@ -454,6 +458,17 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        {
+            const kindIssue = sessionKindFieldIssue(body);
+            if (kindIssue) {
+                sendError(res, 400, "request.field_invalid", kindIssue);
+                return null;
+            }
+            if (body.sessionKind !== undefined && !facts.sessionKinds(deps).available) {
+                sendError(res, 400, "request.precondition_unmet", SESSION_KIND_UNRECORDABLE_MESSAGE);
+                return null;
+            }
+        }
         if (fileHistoryRestoreConflict(body)) {
             sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE, fieldConflictFacts("file_history_restore", ["fileHistory", ...fileHistoryRestoreKeysInBody(body)]));
             return null;

package/dist/http/approval-sweeps.js

@@ -7,8 +7,8 @@ import { hostDecisionFacts } from "../host-decision.js";
 import {} from "../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../approval-content-kind.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
-import { gatedPerson } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { gatedPerson, verifiedIdentitySource } from "./principal-gate.js";
+import { passesCredentialGate } from "../identity-source.js";
 import { costQuotaRefusalOf } from "./request-guards.js";
 import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { memberLeaseOf } from "../fleet/engine-signal.js";
@@ -216,8 +216,8 @@ export function createApprovalSweeps(ctx) {
         if (!cs) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
-        if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
-            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions" }) };
+        if (!passesCredentialGate(req.httpReq === undefined ? undefined : verifiedIdentitySource(req.httpReq, deps.config)) && !deps.config.allowUnauthedWrites) {
+            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions" }) };
         }
         const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), "hitl-answer");
         if (refusal !== undefined)
@@ -232,7 +232,7 @@ export function createApprovalSweeps(ctx) {
                 }
             }
         }
-        const answerer = { subject: recoveredSubject(req.principal), operator: false };
+        const answerer = { subject: recoveredSubject(req.principal), operator: req.operator };
         let cp;
         try {
             cp = await cs.get(req.gateToken);

package/dist/http/checkpoint-ctx.d.ts

@@ -43,6 +43,7 @@
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ProjectContext } from "../project-context.js";
+import type { MemorySeed } from "../project-registry.js";
 import type { InertToolListEntry } from "../rule-entry-list.js";
 import { type Refusal } from "./refusal-body.js";
 /** allow 层读法从这一版起(7.117.0):此前的写者对 `settings.permissions.allow` 是另一种读法(≤7.114.x 名单 / 7.115.0–7.116.x 表态)。规则见顶注「allow 读法问」。 */
@@ -79,6 +80,7 @@ export declare function buildCheckpointCtx(fields: {
     unattendedLeg?: true;
     promptScreened?: true;
     projectContext?: ProjectContext | undefined;
+    memorySeed?: MemorySeed | null | undefined;
     writerVersion: string;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
 /**

package/dist/http/checkpoint-ctx.js

@@ -44,6 +44,7 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(fields.promptScreened === true ? { promptScreened: true } : {}),
         ...(fields.projectContext !== undefined ? { projectContext: fields.projectContext } : {}),
+        ...(fields.memorySeed !== undefined ? { memorySeed: fields.memorySeed } : {}),
     };
     return sealCheckpointCtx(ctx, sealer, sessionId);
 }

package/dist/http/dispatch.d.ts

@@ -33,7 +33,8 @@ export interface HealthDeploymentModsSection {
  * 配了 service token、没开 REQUIRE_PRINCIPAL 的部署上,`POST /v1/tasks` 吃凭据,这三族读路对端口全开。
  *
  * 规则(一条,三族同读;fail-closed):
- *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 与全局门对 `/v1/tasks` 同判(run-local 形);
+ *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 问的是「全局凭据门武装没有」,与门后各口同判(门不武装 ⇒ 门后的读口也不要凭据;
+ *    写门是另一问,问的是请求,见 `identity-source.ts` 头注律 5);
  *  · 否则要么出示了**服务凭据**(service token 单 / 多,或只读 `TRACE_TOKEN` —— 后者正是这几族在门前的理由),
  *    要么带着**验过的** principal(registry 登录令牌 / direct-door 签名 principal 令牌;判据 = `verifiedIdentitySource`,
  *    与 off-box operator 读面同一只)。调用方自己写的 principal 头不是凭据。

package/dist/http/dispatch.js

@@ -4,7 +4,7 @@ import { partsOf } from "../owner-brands.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { admitBridgeIdentity } from "../auth-bridge.js";
+import { admitBridgeIdentity, ssoForeignScope } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, sendHttpError, isSseResponse, endSseWithError } from "./send.js";
@@ -16,7 +16,7 @@ import { projectHealthStoreSection, unwiredStorePosture } from "../store-posture
 import { autoBackgroundOnTimeout as autoBackgroundOnTimeoutFact, autoBackgroundOnTimeoutWord, deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { hostBackgroundShellEnabled } from "../config.js";
 import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, systemFor, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { hasServiceAuth, passesCredentialGate } from "../identity-source.js";
 import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -31,6 +31,18 @@ export function healthReaderOf(req, config) {
         return "open";
     return readCredentialOk(req, config) ? "credentialed" : "anonymous";
 }
+function credentialAttribution(req, credential, config) {
+    switch (credential) {
+        case "service_token":
+            return systemFor(req, config) ?? null;
+        case "sso":
+            return "sso";
+        default: {
+            const unknownCredential = credential;
+            throw new Error(`credential gate: credential ${String(unknownCredential)} has no attribution`);
+        }
+    }
+}
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
         return;
@@ -120,6 +132,11 @@ export function createDispatch(ctx) {
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
                 const identity = admitBridgeIdentity(await deps.webAdminJwtVerifier.verify(rawBearer), { logger: deps.logger, metrics: deps.metrics });
+                const foreign = identity === undefined ? undefined : ssoForeignScope(identity, deps.config);
+                if (identity !== undefined && foreign !== undefined) {
+                    deps.logger?.warn?.("auth_bridge_scope_refused", { principal: identity.principal, tokenScope: foreign.tokenScope, boundScope: foreign.boundScope });
+                    return systemFor(req, deps.config) === undefined ? "foreign_scope" : undefined;
+                }
                 if (identity) {
                     setSsoPrincipal(req, identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = identity.principal;
@@ -132,6 +149,7 @@ export function createDispatch(ctx) {
                 }
             }
         }
+        return undefined;
     }
     async function handle(req, res) {
         const startedAt = Date.now();
@@ -209,6 +227,7 @@ export function createDispatch(ctx) {
                             lingerMs: lease.lingerMs,
                             tickMs: lease.tickMs,
                             lane: lease.lane,
+                            attached: lease.attached,
                             ...(fa ? { firstAttach: { windowMs: fa.windowMs, since: fa.since, attachedAt: fa.attachedAt } } : {}),
                             ...(ho ? { handover: { since: ho.since, reason: ho.reason, lingerMs: ho.lingerMs, backgroundShells: ho.backgroundShells } } : {}),
                         },
@@ -294,39 +313,27 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        await attachBridgeIdentity(req);
+        if ((await attachBridgeIdentity(req)) === "foreign_scope") {
+            sendError(res, 403, "auth.scope_mismatch", "forbidden — the sign-in token was issued for a different scope than the one this worker serves: send a sign-in token issued for this worker's scope, or send this request to a worker of your token's scope");
+            return;
+        }
         if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx, undefined, false))
             return;
         const identitySource = verifiedIdentitySource(req, deps.config);
         admitRunIdentity(req, identitySource, deps.logger);
-        let source = null;
-        const anyServiceAuth = hasServiceAuth(deps.config);
-        if (anyServiceAuth) {
-            switch (identitySource) {
-                case "service_token":
-                    source = systemFor(req, deps.config) ?? null;
-                    break;
-                case "sso":
-                    source = "sso";
-                    break;
-                case "direct_door_jwt":
-                case undefined:
-                    sendUnauthorized(res, "credential");
-                    return;
-                default: {
-                    const unknownSource = identitySource;
-                    throw new Error(`credential gate: identity source ${String(unknownSource)} has no gate row`);
-                }
-            }
+        const credential = passesCredentialGate(identitySource) ? identitySource : undefined;
+        if (credential === undefined && hasServiceAuth(deps.config)) {
+            sendUnauthorized(res, "credential");
+            return;
         }
-        reqState.source = source;
-        if (!anyServiceAuth &&
+        reqState.source = credential === undefined ? null : credentialAttribution(req, credential, deps.config);
+        if (credential === undefined &&
             !deps.config.allowUnauthedWrites &&
             ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
                 isCredentialGatedRewrite(req.method ?? "", url))) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions");
             return;
         }
         const billableKind = req.method === "POST" && !isMethodDispatchedSubmitPath(url) ? billableKindOf(url) : undefined;
@@ -337,8 +344,8 @@ export function createDispatch(ctx) {
                 return;
             }
         }
-        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
+        if (isDestructiveSessionWrite(req.method ?? "", url) && credential === undefined && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
         if (await dispatchSegment(POST_CREDENTIAL_ROUTES, req, res, url, search, method, allow.post, ctx))

package/dist/http/durable-run-leg.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
-import { runInBackground } from "../runs.js";
+import { createRunAnchorWriter, runInBackground } from "../runs.js";
 import { recheckClaimBeforeLaunch, refusalAfterLostClaim, startClaimHeartbeat } from "./claim-heartbeat.js";
 import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
@@ -11,12 +11,12 @@ import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext, faultedAnswerOf } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmissionCtx, SUBMIT_CTX_CLAIM_LOST } from "./submit-ctx.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
-import { sessionFactsReadOf } from "./owner-access.js";
+import { sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
@@ -82,24 +82,24 @@ async function claimAndCommit(ctx, runStore, args, sessionId, taskId) {
     finally {
         stopPreLaunchHeartbeat();
     }
-    commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
+    commitLegBindings(deps, undefined, args.prepared.spec.sessionId, args.prepared.legFacts?.sessionBindings);
     return { holdingLeg: created.legId };
 }
 function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInternals, legId) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
-    const anchorOwner = args.prepared.auth?.subject ?? null;
     const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
-    const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
-        ? async (eventId) => {
-            const leaf = (await sessionFactsOf(sessionId))?.leafId;
-            if (leaf)
-                await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
-        }
-        : undefined;
-    const captureUserMessageAnchor = deps.resumeAnchorStore
-        ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-        : undefined;
+    const anchors = createRunAnchorWriter({
+        seat: deps.backend?.landedAttendants(),
+        sessionId,
+        owner: args.prepared.auth?.subject ?? null,
+        promptKey: taskId,
+        witness: args.prepared.legFacts?.sessionWitness,
+        occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+        leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+    });
+    const captureTurnAnchor = anchors.turn;
+    const captureUserMessageAnchor = anchors.prompt;
     const fleetPub = fleetRunPublisher(deps.fleetBus, {
         runId: taskId,
         scope: args.fleetScope,
@@ -122,7 +122,7 @@ function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInterna
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
             origin: approvalLegOriginOf(args.prepared.execution),
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.registeredCwd));
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills, args.prepared.legFacts?.sessionBindings.cwd));
     args.runSlot?.release();
     args.prepared.seat.markRecord();
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };

package/dist/http/health-self-report.d.ts

@@ -23,6 +23,9 @@
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
  *    四件齐时:多租户(`REQUIRE_PRINCIPAL`)每条会话都落着验过的属主 ⇒ `true`;单用户形下一条会话归谁取决于提交它的那次请求带没带
  *    身份(web 面只列调用人自己的会话)—— 部署级答不了 ⇒ `"unknown"`。
+ *  · `center.assertionToken` = web-admin 断言令牌的**声明读数**(配置 `webAdmin.assertionToken`,读口 `center-credential.ts` 的 `readWebAdminCredentialDeclaration`,
+ *    与主凭证同一只判官):`declared` ⇔ 两键之一设了,`absent` ⇔ 都没设;只在接了中心时在场(没接中心的部署不读这一对键,答不了)。只说声明,不说令牌
+ *    有效、也不说引擎向中心出示了它(本版不出示)。
  *
  * ## 无鉴权面
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
@@ -33,7 +36,8 @@
  * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
  *
  * ## 在场律
- * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。
+ * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜;
+ * `center.assertionToken` 在场 ⇔ 接了中心(接了中心却缺席 = 老 worker)。
  */
 import type { FlatServiceDeps } from "./server.js";
 import { type IdentitySource } from "../identity-source.js";
@@ -43,6 +47,9 @@ export type IdentityAttach = (typeof IDENTITY_ATTACH_WORDS)[number];
 /** `operator` 的词表。 */
 export declare const OPERATOR_PRESENCE_WORDS: readonly ["present", "absent"];
 export type OperatorPresence = (typeof OPERATOR_PRESENCE_WORDS)[number];
+/** `center.assertionToken` 的词表(声明读数:两键之一设了 / 都没设)。 */
+export declare const ASSERTION_TOKEN_DECLARATION_WORDS: readonly ["declared", "absent"];
+export type AssertionTokenDeclaration = (typeof ASSERTION_TOKEN_DECLARATION_WORDS)[number];
 /** `center.sessionsVisible` 的值域(两个布尔 + 一个词;`"unknown"` = 接线齐了,但会话归谁要看提交它的那次请求)。 */
 export declare const SESSIONS_VISIBLE_VALUES: readonly [true, false, "unknown"];
 export type SessionsVisible = (typeof SESSIONS_VISIBLE_VALUES)[number];
@@ -59,6 +66,7 @@ export interface HealthSelfReport {
         readonly issuer?: string;
         readonly webBaseUrl?: string;
         readonly sessionsVisible: SessionsVisible;
+        readonly assertionToken?: AssertionTokenDeclaration;
     };
 }
 /**

package/dist/http/health-self-report.js

@@ -5,6 +5,7 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
 export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
+export const ASSERTION_TOKEN_DECLARATION_WORDS = ["declared", "absent"];
 export const SESSIONS_VISIBLE_VALUES = [true, false, "unknown"];
 function carriesCallerIdentity(kind) {
     switch (kind) {
@@ -34,6 +35,7 @@ export function buildHealthSelfReport(deps) {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),
             ...(webBaseUrl !== undefined ? { webBaseUrl: buildDisplaySafeUrl(webBaseUrl) } : {}),
             sessionsVisible,
+            ...(config.webAdmin !== undefined ? { assertionToken: config.webAdmin.assertionToken !== undefined ? "declared" : "absent" } : {}),
         },
     };
 }