@sema-agent/server 7.150.0 → 7.151.0

package/dist/http/owner-access.d.ts

@@ -23,7 +23,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { SessionHead, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { RunStore, StoreBackend } from "../plugins/store-backend.js";
 import { type Logger } from "../observability/logger.js";
-import type { LatestRunRef, RunListQuery, RunRecord } from "../plugins/store-contracts.js";
+import type { LatestRunRef, RunListQuery, RunRecord, SessionListQuery } from "../plugins/store-contracts.js";
 import type { ServiceConfig } from "../config-types.js";
 import type { SessionAuditReadOpts } from "../audit.js";
 import { type DeploymentShapeInput } from "../deployment-shape.js";
@@ -31,7 +31,7 @@ import { type SessionAgent } from "../session-agent.js";
 import { type SessionFace } from "../session-incarnation.js";
 import { type Admitted, type Caller, type FaceId, type ListFaceId, type ListFilter, type OwnedReading, type Qual, type RunFaceId, type SessionFaceId, type WorkflowFaceId } from "../owner-faces.js";
 import { type Person, type Subject } from "../owner-brands.js";
-import { type OwnerAwareSessionStore } from "../security.js";
+import { type OwnerAwareSessionStore, type SessionListItem } from "../security.js";
 import { type OperatorRoster } from "./principal-gate.js";
 import { type RouteDeps } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
@@ -427,10 +427,15 @@ export declare function admitSessionById(entry: Entry, res: ServerResponse, stor
  */
 export declare function readVisibleSession(entry: Entry, store: SessionGateStore, sessionId: string): Promise<Admitted<SessionHead> | undefined>;
 /**
- * 承认之后的**世代围栏**(会话事件流的心跳拍):这只会话此刻的属主还是承认时读到的那一格吗 —— 删了(没有这一行 / 读不出按面折)或换主 ⇒ 否。
- * 与 {@link readVisibleSession} 的「再判可见」不同:比的是同一行前后两次读到的属主(删建 / 易主 ⇒ 作废),两侧都是行上的属主,不是调用方身份。
+ * 承认之后的**世代围栏**(会话事件流的心跳拍):这只会话此刻的住客还是承认时读到的那一位吗 —— 删了(没有这一行 / 读不出按面折)、删后同 id 重建(包括同一属主)
+ * 或换主 ⇒ 否。比较器 = 住客复核的唯一判 `sameOccupant`(属主 ∧ 化身);与 {@link readVisibleSession} 的「再判可见」不同:两侧都是同一行前后两次的住客读数,不是调用方身份。
  */
-export declare function sessionOwnerUnchanged(entry: Entry, store: SessionGateStore, sessionId: string, admittedOwner: string | null): Promise<boolean>;
+export declare function sessionOccupantUnchanged(entry: Entry, store: SessionGateStore, sessionId: string, admitted: Pick<SessionHead, "owner" | "incarnation">): Promise<boolean>;
+/**
+ * 同步族门读之后的**住客复判**(律在 `routes/session-sync.ts` 门注「门后读」):门承认过的那一位此刻还占着这只 id 吗 —— 同一只比较器 `sameOccupant`,读法是门的两种读法之一:
+ * `pull` = 活行头(拉取口只认活行);`push` = 占位头(活行 ∪ 在删行,与门同一只 `deletionHeadReadOf`)。此刻无行 ⇒ 不是。只在门判**有住客**时调(门判空闲的口门后不读会话数据)。
+ */
+export declare function recheckSyncGate(store: DeletionGateStore, sessionId: string, admitted: SessionFace, port: "pull" | "push"): Promise<boolean>;
 /** 会话行的完整判(不下发,交回承认 / `undefined`):两读之间要再判一次的口(同步导入的提交前复判)与「看不见按自己的形答」的口用。 */
 export declare function judgeSession<T extends OwnedReading>(entry: Entry, store: PlacementReadingStore | undefined, sessionId: string, reading: T): Promise<Admitted<T> | undefined>;
 /** 这一份承认里的调用方是 fleet 吗(本口 `fleet` 列里的一格成立):fork 新属主「继承源属主」那一支读它。 */
@@ -489,6 +494,11 @@ export interface SessionFacts {
  * 读者:回退锚的逐轮捕获(两条起跑腿读叶子)、失认领答复的「会话在不在」(不碰叶子)、同步拉取清单的当前叶子。
  */
 export declare function sessionFactsReadOf(store: Pick<OwnerAwareSessionStore, "headOf"> | undefined): ((sessionId: string) => Promise<SessionFacts | undefined>) | undefined;
+/**
+ * 会话此刻的住客(属主 + 化身,同一行同一次头读,经 {@link sessionFaceOfHead} 投影 —— 活行上读到空化身响亮拒)。读者:运行腿的回退锚写座在见证里还没有化身时
+ * 钉住这条 run 自己的那一位(`runs.ts` 的 `createRunAnchorWriter`;调用发生在 run 在跑、认领在手的时刻)。店不交头读 ⇒ `undefined`。
+ */
+export declare function sessionOccupantReadOf(store: Pick<OwnerAwareSessionStore, "headOf"> | undefined): ((sessionId: string) => Promise<SessionFace | undefined>) | undefined;
 /**
  * 会话在委派树里的位置(wire 键 `agent` 的值;唯一读口):店的 placed 位一读 → `session-agent.ts` 的 `sessionAgentOf`(元组不带属主)。店不交这一面 ⇒ `undefined`
  * (这台部署不存元组,不探)。探针抛 ⇒ 原样上抛 —— 读不出怎么说归读者(视图读响亮失败;队列只缺那一行的键并计数),本函数不替任何一面把故障说成「不是子代」。
@@ -509,10 +519,16 @@ export declare function engineRulesKeyOf(store: Pick<OwnerAwareSessionStore, "he
  * 读者:会话面板的上一腿(面 `run.panel`,看不见 = 不投那个键)。
  */
 export declare function readVisibleLatestRun(entry: Entry, store: Pick<RunStore, "latestRunForSession">, sessionId: string): Promise<LatestRunRef | undefined>;
-/** run 列表的属主过滤参数(一只派生,读与游标指纹同读):视域钉住一位主体 ⇒ 强制那一位(调用方点名的 `owner` 不算);不钉人(fleet)⇒ 点名的照用(运维视图)。 */
-export declare function runListOwnerOf(filter: ListFilter, named: string | undefined): string | undefined;
-/** run 列表的读口(列表面 `list.read`):过滤参数由 {@link runListOwnerOf} 从视域派生,只在这里落成店的过滤参数。 */
+/** 列表的属主过滤参数(run 列表与会话列表同一只派生,读与游标指纹同读):视域钉住一位主体 ⇒ 强制那一位(调用方点名的 `owner` 不算);不钉人(fleet)⇒ 点名的照用(运维视图)。 */
+export declare function listOwnerOf(filter: ListFilter, named: string | undefined): string | undefined;
+/** run 列表的读口(列表面 `list.read`):过滤参数由 {@link listOwnerOf} 从视域派生,只在这里落成店的过滤参数。 */
 export declare function listVisibleRuns(store: Pick<RunStore, "listRuns">, filter: ListFilter, named: string | undefined, query: Omit<RunListQuery, "owner">): Promise<RunRecord[]>;
+/**
+ * 会话列表的读口(列表面 `session.list`;`GET /v1/sessions`):「读 + 过滤」只在这里落成店的过滤参数 —— 属主(由 {@link listOwnerOf} 从视域派生;`""` 是合法的精确属主,
+ * 只有「没给」才不过滤)、无主行的并入(视域的 `includeUnowned`)、视图(`sessionKind`,律 `session-kind.ts`:缺席 = 缺省视图)。谓词都打在店里(同一条 SELECT),
+ * 路由层不另滤行。peer 目录读同一只 lister 的缺省视图(`peer-directory.ts`)。
+ */
+export declare function listVisibleSessions(lister: (opts: SessionListQuery) => Promise<SessionListItem[]>, filter: ListFilter, named: string | undefined, query: Omit<SessionListQuery, "owner" | "includeUnowned">): Promise<SessionListItem[]>;
 /** 审批 / 助手面按停驻 scope 列 run:属主过滤 = scope 的属主键(公共 scope `_` ⇒ 属主为 null 的 run,主体 ⇒ 恰它的;`security.ts` 的唯一编解码),只在这里落成店的过滤参数。 */
 export declare function listRunsOfScope(store: Pick<RunStore, "listRuns">, scope: string, limit: number): Promise<RunRecord[]>;
 /** 一把提交钥匙命中的行对这位调用方算什么:`visible` = 读得到的那一行;`occupied` = 有行但不是这次提交拿得到的(看不见 / 自带 taskId 而键指着别的行)—— 回执 409,不回显那一行。 */
@@ -602,14 +618,18 @@ export interface WorkflowAdmission {
 /** 工作流门的一次判(不下发):承认,或拒因(没有 / 前门 / 看不见 / 会话断言不符)。 */
 export type WorkflowVerdict = WorkflowAdmission | "missing" | "door" | "not_visible" | "session_mismatch";
 /**
- * 工作流列表(`GET /v1/workflows`)—— 属主过滤只在这里落成店参数:调用方换成它的引擎身份(与 {@link judgeWorkflowRun} 同一只换算),店按 `scope` 列筛。
+ * 🔴 **一位调用方的工作流行住在 `scope` 列的哪一格**(唯一读法):调用方的主体换成它的引擎身份(`engine-identity.ts` 的 `engineScopeOf` —— 引擎按它写 scope:
+ * 带场景的请求今天是那个人,匿名是 `"default"`)。列表({@link listVisibleWorkflows})、按 id 的门({@link judgeWorkflowRun})与舰队流的工作流行 / 终态窗(`routes/fleet.ts`)同读这一只。
+ */
+export declare function workflowScopeOf(subject: Subject | undefined): string;
+/**
+ * 工作流列表(`GET /v1/workflows`)—— 属主过滤只在这里落成店参数:{@link workflowScopeOf},店按 `scope` 列筛。
  * 面表 `workflow.read` 只给属主(不放 fleet / 运维)⇒ 列表 = 调用方自己那一格的行。
  */
 export declare function listVisibleWorkflows(entry: Entry, store: Pick<WorkflowRunStore, "listByScope">, opts: Parameters<WorkflowRunStore["listByScope"]>[1]): ReturnType<WorkflowRunStore["listByScope"]>;
 /**
  * 🔴 **工作流行的判(唯一一处;[ref] 第二阶段)**:按 id 读一行(店的 `get`,不带 scope —— 修前是 core 按 scope 读 + 路由再比一次 scope,两读答同一问),
- * 行格 = `scope` 列的属主键(引擎写下的引擎身份,恒有主);调用方一侧换成它的引擎身份(`engine-identity.ts` 的 `engineScopeOf`:引擎按它写 scope ——
- * 带场景的请求是那个人,匿名是 `"default"`)再过事实函数 {@link qualsOf} + 面表;前门按这次请求的调用方判。承认之后按 {@link WORKFLOW_SESSION_ASSERTION} 判会话断言。
+ * 行格 = `scope` 列的属主键(引擎写下的引擎身份,恒有主);调用方一侧换成它的引擎身份({@link workflowScopeOf})再过事实函数 {@link qualsOf} + 面表;前门按这次请求的调用方判。承认之后按 {@link WORKFLOW_SESSION_ASSERTION} 判会话断言。
  */
 export declare function judgeWorkflowRun(entry: Entry, store: Pick<WorkflowRunStore, "get">, runId: string): Promise<WorkflowVerdict>;
 /** 工作流按 id 读面的门:没有 / 看不见 / 会话断言不符同一只投影(`workflow_missing`),前门经它的下发口。交回承认或 `undefined`(已应答)。 */

package/dist/http/owner-access.js

@@ -410,9 +410,24 @@ export async function readVisibleSession(entry, store, sessionId) {
     const verdict = await judgeSessionById(entry, store, sessionId);
     return verdict === undefined || verdict === "door" || verdict === "not_visible" ? undefined : verdict;
 }
-export async function sessionOwnerUnchanged(entry, store, sessionId, admittedOwner) {
+export async function sessionOccupantUnchanged(entry, store, sessionId, admitted) {
     const head = await readOwnerCell(entry, sessionId, () => store.headOf(sessionId));
-    return sessionRowPresent(head) && head.owner === admittedOwner;
+    return sessionRowPresent(head) && sameOccupant(admitted, head);
+}
+export async function recheckSyncGate(store, sessionId, admitted, port) {
+    const live = await store.headOf(sessionId);
+    switch (port) {
+        case "pull":
+            return rowRead(live) && sameOccupant(admitted, live);
+        case "push": {
+            const held = rowRead(live) ? live : await deletionHeadReadOf(store)(sessionId);
+            return rowRead(held) && sameOccupant(admitted, held);
+        }
+        default: {
+            const unknownPort = port;
+            throw new Error(`recheckSyncGate: no port ${JSON.stringify(unknownPort)}`);
+        }
+    }
 }
 export async function judgeSession(entry, store, sessionId, reading) {
     if (!sessionRowPresent(reading))
@@ -448,6 +463,15 @@ export function sessionFactsReadOf(store) {
         return rowRead(head) ? { get leafId() { return head.leafId; } } : undefined;
     };
 }
+export function sessionOccupantReadOf(store) {
+    const headOf = store?.headOf;
+    if (typeof headOf !== "function")
+        return undefined;
+    return async (sessionId) => {
+        const head = await headOf.call(store, sessionId);
+        return rowRead(head) ? sessionFaceOfHead(sessionId, head) : undefined;
+    };
+}
 export async function readSessionAgent(store, sessionId) {
     const placementOf = store?.placementOf;
     if (placementOf === undefined)
@@ -477,13 +501,17 @@ export async function readVisibleLatestRun(entry, store, sessionId) {
     const latest = await store.latestRunForSession(sessionId);
     return rowRead(latest) && seesRun(entry, latest.owner) ? latest : undefined;
 }
-export function runListOwnerOf(filter, named) {
+export function listOwnerOf(filter, named) {
     return filter.gateOwner ?? named;
 }
 export function listVisibleRuns(store, filter, named, query) {
-    const owner = runListOwnerOf(filter, named);
+    const owner = listOwnerOf(filter, named);
     return store.listRuns({ ...query, ...(owner ? { owner } : {}) });
 }
+export function listVisibleSessions(lister, filter, named, query) {
+    const owner = listOwnerOf(filter, named);
+    return lister({ ...query, ...(owner !== undefined ? { owner } : {}), ...(filter.includeUnowned ? { includeUnowned: true } : {}) });
+}
 export function listRunsOfScope(store, scope, limit) {
     return store.listRuns({ owner: ownerOfCheckpointScope(scope), limit });
 }
@@ -534,14 +562,17 @@ export const WORKFLOW_SESSION_ASSERTION = {
     "workflow-stream": { phase: "accept", label: "workflow.stream" },
     "workflow-agent-steer": { phase: "accept", label: "workflow.agent-steer" },
 };
+export function workflowScopeOf(subject) {
+    return engineScopeOf(subject);
+}
 export function listVisibleWorkflows(entry, store, opts) {
-    return store.listByScope(engineScopeOf(entry.caller.subject), opts);
+    return store.listByScope(workflowScopeOf(entry.caller.subject), opts);
 }
 export async function judgeWorkflowRun(entry, store, runId) {
     const row = await store.get(runId);
     if (!rowRead(row))
         return "missing";
-    const engineCaller = { ...entry.caller, subject: recoveredSubject(engineScopeOf(entry.caller.subject)) };
+    const engineCaller = { ...entry.caller, subject: recoveredSubject(workflowScopeOf(entry.caller.subject)) };
     const verdict = verdictOnQuals(entry, qualsOf(engineCaller, ownerCellOf(row.scope)));
     if (verdict === "door" || verdict === "not_visible")
         return verdict;

package/dist/http/resume-ctx-read.js

@@ -2,6 +2,7 @@ import { openCheckpointCtx } from "./checkpoint-ctx.js";
 import { storeFaultClassOf } from "../plugins/store-fault.js";
 import { refusalBody } from "./refusal-body.js";
 import { frozenProjectContextOf } from "../project-context.js";
+import { frozenMemorySeedOf } from "../project-registry.js";
 export async function readResumeCtx(load, opening) {
     const read = await readStoredCtx(load);
     if (read.kind !== "ok")
@@ -9,14 +10,35 @@ export async function readResumeCtx(load, opening) {
     const opened = openCheckpointCtx(read.ctx, opening.opener, opening.sessionId);
     if (opened.kind !== "ok")
         return { kind: "unsealable", field: opened.field, reason: opened.reason };
+    const where = (key) => ({ kind: "corrupt", where: `checkpoint ctx for session ${JSON.stringify(opening.sessionId)}: ${key}` });
+    const { memorySeed: _storedSeed, projectContext: _storedContext, ...rest } = opened.ctx;
+    const seed = frozenMemorySeedOf(opened.ctx.memorySeed);
     const frozen = frozenProjectContextOf(opened.ctx.projectContext);
+    let seedPart;
+    switch (seed.kind) {
+        case "absent":
+            seedPart = {};
+            break;
+        case "none":
+            seedPart = { memorySeed: null };
+            break;
+        case "malformed":
+            return where("memorySeed");
+        case "ok":
+            seedPart = { memorySeed: seed.seed };
+            break;
+        default: {
+            const unhandled = seed;
+            throw new Error(`resume-ctx-read: unplaced frozen memory seed reading ${JSON.stringify(unhandled)}`);
+        }
+    }
     switch (frozen.kind) {
         case "absent":
-            return { kind: "ok", ctx: opened.ctx };
+            return { kind: "ok", ctx: { ...rest, ...seedPart } };
         case "malformed":
-            return { kind: "corrupt", where: `checkpoint ctx for session ${JSON.stringify(opening.sessionId)}: projectContext` };
+            return where("projectContext");
         case "ok":
-            return { kind: "ok", ctx: { ...opened.ctx, projectContext: frozen.context } };
+            return { kind: "ok", ctx: { ...rest, ...seedPart, projectContext: frozen.context } };
         default: {
             const unhandled = frozen;
             throw new Error(`resume-ctx-read: unplaced frozen project context reading ${JSON.stringify(unhandled)}`);

package/dist/http/resume-legs.d.ts

@@ -129,7 +129,7 @@ export declare function createResumeLegs(ctx: {
     }) => void) => Promise<ResumeLegOutcome>;
     decisionRowAdmits: (cs: CheckpointStoreFull, token: CheckpointToken, who: KeyCaller | undefined, bodyScope: string | undefined) => Promise<boolean>;
     resumePreempted: (sessionId: string, req: IncomingMessage | undefined, acceptEarly?: boolean, decider?: KeyCaller, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
-    startFreshHostTurn: (sessionId: string, objective: string, subject: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
+    startFreshHostTurn: (sessionId: string, objective: string, subject: string | undefined, req: IncomingMessage | undefined, workflowDecision: WorkflowDecisionDelivery, runId: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     resumeWake: (sessionId: string, message: PendingSteerInput | undefined, caller: Subject | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
@@ -146,6 +146,7 @@ export declare function createResumeLegs(ctx: {
     }>;
     drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<ResumeLegOutcome>;
     sessionNotifyDoor: import("../session-notify-door.js").SessionNotifyDoor;
+    handOverRunEndedDecisions: (runId: string) => Promise<void>;
 };
 export {};
 //# sourceMappingURL=resume-legs.d.ts.map