@sema-agent/server 7.150.0 → 7.152.0

package/dist/http/routes/approvals-assistant.js

@@ -3,9 +3,9 @@ import { skillCardFacts } from "../../approval-card.js";
 import { hostDecisionFacts, readDecider, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { findParkedAgentForCheckpoint } from "../../parked-decide.js";
-import { DECIDED_REPLAY_SCAN_CAP, pendingTriageOrder } from "../../plugins/checkpoint-store-face.js";
+import { DECIDED_REPLAY_SCAN_CAP, displayRuleOffers, pendingTriageOrder } from "../../plugins/checkpoint-store-face.js";
 import { approvalPayloadFingerprint } from "../../plugins/approval-payload-fingerprint.js";
-import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
+import { cardRuleOffersOfAskRow, carriesDeploymentListQuestion, readPersistRuleSlot, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
@@ -13,7 +13,7 @@ import { keyAdmits } from "../../owner-faces.js";
 import { personOf } from "../../owner-brands.js";
 import { editedPlanBinding, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { isWellFormedUnicode } from "../../principal-shape.js";
-import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
+import { MAX_APPROVAL_REASON_CHARS, persistRuleFromProjection, projectPersistRule, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
 import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
@@ -22,12 +22,13 @@ import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
-import { gatedSubject, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
+import { createLogger } from "../../observability/logger.js";
+import { gatedSubject, explicitOperatorOk, confinedTierOf, sendPrincipalConfined, sendPrincipalRefusal } from "../principal-gate.js";
 import { admitRunById, admitSessionById, callerEntry, callerOf, callerOfDecision, deciderSubjectOf, enter, latestRunIdOf, listRunsOfScope, protocolEntry, readSessionAgent, readVisibleRun, refuse, runFactsOf, withCaller } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
 import { grantBindingOf } from "../../standing-answer-grant.js";
-import { sendResumeOutcome } from "../route-ctx.js";
+import { readRememberSlot, ruleReceiptOf, sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
@@ -38,13 +39,14 @@ import { fieldConflictFacts } from "../../field-conflict.js";
 import { buildSettlementEvidence } from "../../gate-settlement.js";
 import { seatText } from "../../trace/exit-seat.js";
 import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
-import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
+import { defaultPeerInboundFace, parsePeerInboundId } from "../../peer-inbound-face.js";
+import { engineScopeOfOwner } from "../../engine-identity.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "persistRule", "reason", "remember", "updatedInput",
     ...RESUME_RESTATABLE_KEYS,
 ];
-const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
+const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "persistRule", "reason"];
 const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "decidedVia", "feedback", "remember", "updatedInput", ...RESUME_RESTATABLE_KEYS];
 function readDecisionDoorRestatement(res, body, directDoorActive) {
     if (directDoorActive && RESUME_RESTATABLE_KEYS.some((key) => body[key] !== undefined)) {
@@ -67,6 +69,7 @@ const PROOF_SLOT_OF = {
     decision: "decision",
     editedPlan: "boundInputHash",
     permissionModeAfter: "permissionModeAfter",
+    persistRule: "persistRule",
     reason: "reason",
 };
 function buildApprovalEnvelope(sessionId, covered, reading) {
@@ -311,7 +314,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         }
         const cs = park.checkpointStore;
         const principal = gatedSubject(req, deps.config);
-        const operator = explicitOperatorOk(principal === undefined ? undefined : personOf(principal), deps.config);
+        const operator = explicitOperatorOk(principal === undefined ? undefined : personOf(principal), deps.config, "operate");
         const ownScope = principal ?? CHECKPOINT_PUBLIC_SCOPE;
         if (match.decl.id === "approvals-stream") {
             const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
@@ -332,7 +335,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
-            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage, deps.toolApproval)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
             const livePending = deps.toolApproval ? await deps.toolApproval.listLivePending(scope) : undefined;
             sendJson(res, 200, {
                 pending,
@@ -676,19 +679,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
                 const storeNowMs = await store.nowMs();
-                const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
+                const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
                     boundCallId: planNonce ?? null,
                     checkpointId: sighting?.value,
                     decision,
                     editedPlan: decision === "edit" ? editedPlanBinding(body.editedPlan) : null,
                     permissionModeAfter: isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined,
                     reason: typeof body.reason === "string" ? body.reason : null,
-                }), deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
-                if (!proof.ok) {
-                    sendError(res, proof.status, proof.errorCode, proof.error);
+                }), deps.config, match.decl.power, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                if (proof === undefined)
                     return;
-                }
                 deciderPrincipal = proof.principal;
                 singleUse = proof.singleUse === undefined ? undefined : { proof: proof.singleUse, store };
             }
@@ -739,7 +739,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const doorKind = approvalQueueKindOfDoorId(sessionId);
             switch (doorKind) {
                 case "peer_inbound":
-                    await decidePeerInbound(req, res, sessionId, { readJson, config: deps.config, logger: deps.logger, principal, face: defaultPeerInboundFace });
+                    await decidePeerInbound(req, res, sessionId, { readJson, config: deps.config, logger: deps.logger, principal, face: defaultPeerInboundFace, power: match.decl.power });
                     return;
                 case "checkpoint":
                     break;
@@ -771,15 +771,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             let remember = false;
-            if (body.remember !== undefined) {
-                if (body.remember !== "session") {
-                    sendError(res, 400, "request.field_invalid", `remember must be "session"`);
-                    return;
-                }
-                if (decision !== "approve") {
-                    sendError(res, 400, "request.field_conflict", "remember requires decision 'approve'", fieldConflictFacts("remember_decision", ["remember", "decision"]));
-                    return;
-                }
+            const rememberSlot = readRememberSlot(body.remember, decision);
+            if (rememberSlot.kind === "refused") {
+                sendError(res, 400, rememberSlot.refusal.errorCode, rememberSlot.refusal.message, rememberSlot.refusal.facts);
+                return;
+            }
+            if (rememberSlot.kind === "session") {
                 if (deps.config.directDoorActive) {
                     sendError(res, 400, "remember_not_in_proof", "remember is not supported on a direct-door worker (not covered by the decision proof)");
                     return;
@@ -790,6 +787,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 remember = true;
             }
+            const ruleSlot = readPersistRuleSlot(body.persistRule, decision === "approve" ? "allow" : "deny");
+            if (!ruleSlot.ok) {
+                sendError(res, 400, "request.body_shape", ruleSlot.error);
+                return;
+            }
+            const ruleProjection = ruleSlot.slot !== undefined ? projectPersistRule(ruleSlot.slot) : undefined;
             let answer;
             let answerProjection;
             if (body.answer !== undefined) {
@@ -863,24 +866,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             };
             let deciderPrincipal = principal === undefined ? undefined : personOf(principal);
             if (deps.config.directDoorActive) {
-                const hdr = (n) => {
-                    const h = req.headers[n];
-                    return Array.isArray(h) ? h[0] : h;
-                };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
+                const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
                     answer: answerProjection,
                     boundCallId: binding.boundCallId,
                     boundInputHash: binding.boundInputHash,
                     decision,
+                    persistRule: ruleProjection,
                     reason: typeof body.reason === "string" ? body.reason : null,
-                }), deps.config);
-                if (!proof.ok) {
-                    sendError(res, proof.status, proof.errorCode, proof.error);
+                }), deps.config, match.decl.power);
+                if (proof === undefined)
                     return;
-                }
                 deciderPrincipal = proof.principal;
             }
-            const deciderCaller = { subject: deciderSubjectOf(principal, deciderPrincipal), operator: explicitOperatorOk(deciderPrincipal, deps.config) };
+            const deciderCaller = { subject: deciderSubjectOf(principal, deciderPrincipal), operator: explicitOperatorOk(deciderPrincipal, deps.config, "operate") };
             if (!deciderCaller.operator) {
                 const cpScope = await cs
                     .peekPendingScope(sessionId, { gateKinds: APPROVAL_GATE_KINDS })
@@ -890,7 +888,8 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decider, deciderPrincipal), req, answer, binding, remember ? { grantedBy: deciderPrincipal ?? null, laneCannotRecord: "refuse" } : undefined, true, deciderCaller, restated.restatement);
+            const persistRule = ruleProjection !== undefined ? { slot: persistRuleFromProjection(ruleProjection), inputWasEdited: binding.updatedInput !== undefined } : undefined;
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decider, deciderPrincipal), req, answer, binding, remember ? { grantedBy: deciderPrincipal ?? null, laneCannotRecord: "refuse" } : undefined, true, deciderCaller, restated.restatement, persistRule);
             const replay = await decideIdempotentReplay(cs, {
                 sessionId,
                 out,
@@ -909,12 +908,31 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendResumeOutcome(res, replay, deps.logger);
                 return;
             }
-            sendResumeOutcome(res, out, deps.logger, remember ? { rememberApplied: out.rememberApplied === true } : undefined);
+            const rule = out.status >= 200 && out.status < 300 ? ruleReceiptOf(out, persistRule) : undefined;
+            const extra = { ...(remember ? { rememberApplied: out.rememberApplied === true } : {}), ...(rule ?? {}) };
+            sendResumeOutcome(res, out, deps.logger, Object.keys(extra).length > 0 ? extra : undefined);
             return;
         }
     }
     return assertNever(match.decl.id);
 }
+function admitDirectDoorDecider(req, res, envelope, config, power, opts) {
+    const hdr = (n) => {
+        const h = req.headers[n];
+        return Array.isArray(h) ? h[0] : h;
+    };
+    const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, envelope, config, opts);
+    if (!proof.ok) {
+        sendError(res, proof.status, proof.errorCode, proof.error);
+        return undefined;
+    }
+    const confined = confinedTierOf(proof.principal, config, power);
+    if (confined !== undefined) {
+        sendPrincipalConfined(res, confined);
+        return undefined;
+    }
+    return proof;
+}
 async function decidePeerInbound(req, res, id, env) {
     const body = (await env.readJson(req));
     const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
@@ -937,19 +955,13 @@ async function decidePeerInbound(req, res, id, env) {
     }
     let decider = env.principal;
     if (env.config.directDoorActive) {
-        const hdr = (n) => {
-            const h = req.headers[n];
-            return Array.isArray(h) ? h[0] : h;
-        };
-        const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(id, DECIDE_PROOF_COVERED_KEYS, { answer: undefined, boundCallId: undefined, boundInputHash: undefined, decision, reason: null }), env.config);
-        if (!proof.ok) {
-            sendError(res, proof.status, proof.errorCode, proof.error);
+        const proof = admitDirectDoorDecider(req, res, buildApprovalEnvelope(id, DECIDE_PROOF_COVERED_KEYS, { answer: undefined, boundCallId: undefined, boundInputHash: undefined, decision, persistRule: undefined, reason: null }), env.config, env.power);
+        if (proof === undefined)
             return;
-        }
         decider = proof.principal;
     }
     const coord = parsePeerInboundId(id);
-    const outcome = coord === undefined ? { kind: "not_found" } : await env.face.decide(peerBoxScope(decider), coord, decision);
+    const outcome = coord === undefined ? { kind: "not_found" } : await env.face.decide(engineScopeOfOwner(decider), coord, decision);
     switch (outcome.kind) {
         case "not_found":
             sendError(res, 404, "not_found.approval", "approval not found");
@@ -1016,7 +1028,7 @@ function redactPendingDisclosures(row) {
 function peerInboundRowsFor(face, principal, operatorOwnerParam) {
     if (operatorOwnerParam !== undefined && operatorOwnerParam !== principal)
         return () => [];
-    const scope = peerBoxScope(principal);
+    const scope = engineScopeOfOwner(principal);
     return () => face.list(scope);
 }
 function projectPendingForWire(row, deployment, agent) {
@@ -1034,9 +1046,45 @@ function projectPendingForWire(row, deployment, agent) {
     });
     return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}), ...(agent !== undefined ? { agent } : {}) };
 }
-async function projectDurableQueue(rows, deployment, sessions) {
+async function projectDurableQueue(rows, deployment, sessions, cards) {
     const agents = await sessionAgentsOf(rows.map((r) => r.sessionId), sessions);
-    return rows.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+    const carded = await Promise.all(rows.map((r) => withCardRecord(r, cards)));
+    return carded.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+}
+const queueLogger = createLogger();
+async function withCardRecord(row, cards) {
+    if (cards === undefined || row.toolCallId === null || row.boundInputHash === undefined)
+        return row;
+    const asked = await cards.readParkedAskOfGate(row.sessionId, { boundCallId: row.toolCallId, boundInputHash: row.boundInputHash });
+    const withOffers = (ruleOffers) => {
+        const next = { ...row };
+        if (ruleOffers === undefined)
+            delete next.ruleOffers;
+        else
+            next.ruleOffers = ruleOffers;
+        return next;
+    };
+    const withAskIdentity = (next, ask) => {
+        if (next.taskId !== null && next.taskId !== ask.taskId) {
+            queueLogger.warn("approval queue row: the parked leg's task differs from the ask's task — the row keeps its checkpoint identity", { sessionId: row.sessionId, askId: ask.askId });
+            return next;
+        }
+        return { ...next, taskId: ask.taskId, askId: ask.askId };
+    };
+    switch (asked.kind) {
+        case "none":
+            return row;
+        case "unreadable":
+            return withOffers(undefined);
+        case "row": {
+            const offers = cardRuleOffersOfAskRow(asked.row);
+            return withAskIdentity(withOffers(offers === undefined ? undefined : displayRuleOffers(offers, { countRedactions: false })), asked.row);
+        }
+        default: {
+            const unhandled = asked;
+            throw new Error(`queue projection: unhandled parked-ask reading ${JSON.stringify(unhandled)}`);
+        }
+    }
 }
 async function sessionAgentsOf(sessionIds, sessions) {
     const out = new Map();
@@ -1121,7 +1169,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, sessions,
     while (!closed) {
         let snapshot;
         try {
-            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
+            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions, live)), ...(peerInbound?.() ?? [])];
             snapshot = { pending, livePending: live ? await live.listLivePending(scope) : [] };
         }
         catch (err) {

package/dist/http/routes/background.d.ts

@@ -9,7 +9,7 @@
  *
  * ── 读口:逐字投 core `list()` 行 ─────────────────────────────────────────────────────────────────
  * 读的是**进程内**注册表(`defaultTaskRegistry.list`),访问元组 = 会话自己的 `{ owner: sid, sessionId: sid, scope }`
- * (scope = 会话行属主 `owner ?? "default"`,与 core 注册铸值同源)⇒ 可见集完全由 core 的 `canAccess` 判(fail-closed:
+ * (scope = 会话的引擎租户分区 `sessionTenantScope`,经唯一换算 `engineScopeOfOwner`,与 core 注册铸值同源)⇒ 可见集完全由 core 的 `canAccess` 判(fail-closed:
  * 缺轴即拒;本会话的会话驻留行、task id 即会话 id 的 run 行、本会话发起的 workflow、根会话是本会话的后台 agent)。
  * 键逐个处置(下面的 {@link ROW_KEY_DISPOSITION},core 给行加键 ⇒ 编译红):`task_id` 改名 `id`;`retained` **真才带**
  * (core:缺席 ⇒ 这一行在 `includeRetained:false` 的硬面上会停);`description` 是模型写的描述、缺席时是启动时的命令文本 ——
@@ -40,8 +40,8 @@
  *
  * 🔴 **停止口在无凭据写门内**(`credentialGated: ["POST"]`;车OL F1 = 7.102.0 合并复审 gpt-6 腿 [high]):门的两个合取项它都中
  *   —— ① 授权的唯一输入是 principal 头(属主判 `admitSessionRow` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedSubject`,
- *   无 service 凭证的部署上它收调用方自报的头);② 不可撤销、爆炸半径跨租户(知道会话 id + 自报它的属主 ⇒ 停掉那个会话的后台
- *   进程,`includeRetained:true` 连显式 retain 的活服务一起停)。于是无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的部署上它与
+ *   没带过门凭据的请求上它收调用方自报的头);② 不可撤销、爆炸半径跨租户(知道会话 id + 自报它的属主 ⇒ 停掉那个会话的后台
+ *   进程,`includeRetained:true` 连显式 retain 的活服务一起停)。于是无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的部署上,不带过门凭据的请求打它与
  *   其余改写门同码同句 503 `auth.service_token_required`(在路由之前,`dispatch.ts` 那一道),同一只会话级收敛函数的另一个调用点
  *   `DELETE /v1/sessions/:id` 早在同一形下被 `isDestructiveSessionWrite` 拒。读口 `GET …/background` 不进:它有属主门兜底、只读、
  *   只列本会话,与 `GET /v1/rules` 同判。已知同族缺口(不在本口单独打补丁):能力位 `exitFaces` 不含「凭据就绪」这一项,见契约

package/dist/http/routes/capabilities.d.ts

@@ -38,6 +38,10 @@ export declare const CAPABILITIES_ROUTES: readonly [{
     readonly id: "capability-mcp";
     readonly path: "/v1/capabilities/mcp";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "capability-scenario-effective";
+    readonly path: "/v1/capabilities/scenario";
+    readonly methods: readonly ["GET"];
 }, {
     readonly id: "capability-mcp-probe";
     readonly path: "/v1/capabilities/mcp/probe";

package/dist/http/routes/capabilities.js

@@ -19,7 +19,7 @@ import { sendJson, sendError } from "../send.js";
 import { codeFieldOf } from "../../terminal.js";
 import { engineRefusalAnswerOf } from "../engine-refusal.js";
 import { assertNever } from "../route-ctx.js";
-import { fileHistoryCaptureOf } from "../../file-history-capture.js";
+import { fileHistoryCaptureOf, fileHistoryWired } from "../../file-history-capture.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectStoreCapability, unwiredStorePosture } from "../../store-posture.js";
@@ -27,6 +27,7 @@ import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { SETTINGS_CONTRACT_CAPABILITY } from "../../capabilities/settings-contract.js";
 import { judgeSandboxGitPlane, sandboxGitPlanePremisesOf } from "../../sandbox-git-plane.js";
+import { SESSION_KINDS } from "../../session-kind.js";
 import { MCP_ASSERTION_HEADER_SENT, MCP_REQUEST_TRANSPORT_KINDS } from "../../mcp-assertion-header.js";
 import { gateCompositeMembers } from "../../capabilities/composite-members.js";
 import { projectApprovalsStreamLiveCapability } from "../../capabilities/approvals-push.js";
@@ -35,7 +36,8 @@ import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
-import { gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
+import { scenarioRequestedBySubject } from "../../request-form.js";
 import { readAdoptionImportCapability } from "../../adoption/import.js";
 import { headReadPresent } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
@@ -56,6 +58,12 @@ function retentionAdvertisement(config) {
 export function createCapabilitiesLocal() {
     return { mcpProbe: createMcpProbeLocal() };
 }
+const QUERY_SCENARIO_REPEATED = Symbol("scenario query given more than once");
+const SCENARIO_QUERY_REPEATED_REFUSAL = "scenario must be given at most once (omit it to read this deployment's default scenario)";
+function scenarioQueryOf(search) {
+    const given = new URLSearchParams(search).getAll("scenario");
+    return given.length > 1 ? QUERY_SCENARIO_REPEATED : given[0];
+}
 export async function handleCapabilities(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
@@ -84,6 +92,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPerson(req, deps.config)).available;
             const streamApprovalFact = facts.streamApproval(deps);
+            const historyWired = fileHistoryWired(deps.backend);
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
                 ...facts.engineCapabilityBits(),
@@ -138,6 +147,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 permissionRulesRevoke: facts.ruleLane(deps).available,
                 respondFreeFormRules: true,
                 respondBatchRuleOffers: true,
+                approvalDecideRuleSlot: true,
                 oneShot: true,
                 policy: true,
                 usage: Boolean(deps.costQuota),
@@ -211,19 +221,21 @@ export async function handleCapabilities(req, res, match, ctx) {
                 retention: retentionAdvertisement(deps.config),
                 peerLane: Boolean(deps.peerDirectory),
                 scenarioSubject: true,
+                effectiveScenario: true,
                 sessionList: facts.sessionList(deps).available,
                 sessionSearch: facts.sessionList(deps).available,
+                sessionKinds: facts.sessionKinds(deps).available ? [...SESSION_KINDS] : [],
                 sessionFork: facts.sessionFork(deps).available,
                 sessionDelete: facts.sessionDelete(deps).available,
-                resumeAt: Boolean(deps.resumeAnchorStore && headReadPresent(deps.sessionStorage)),
+                resumeAt: deps.backend !== undefined && headReadPresent(deps.sessionStorage),
                 promptSuggestions: true,
                 sessionPolicy: facts.sessionPolicy(deps).available,
                 sessionRulesNamespaceForms: sessionRulesNamespaceFormsHonored(),
-                restoreFiles: Boolean(deps.fileHistoryStore),
-                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadPresent(deps.sessionStorage)),
+                restoreFiles: historyWired,
+                rewindFilesTo: historyWired && headReadPresent(deps.sessionStorage),
                 sessionRewindFiles: facts.sessionRewindFiles(deps).available,
                 sessionRewindFilesPreview: facts.sessionRewindFilesPreview(deps).available,
-                fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore, deps.config.fileHistoryCapture),
+                fileHistoryCapture: fileHistoryCaptureOf(historyWired, deps.config.fileHistoryCapture),
                 scheduler: facts.hostScheduler(deps.config).available,
                 sessionSync: facts.sessionSync(deps).available,
                 sessionSyncFileHistory: facts.sessionSyncFileHistory(deps).available,
@@ -260,15 +272,30 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const scenarioParams = new URLSearchParams(match.search).getAll("scenario");
-            if (scenarioParams.length > 1) {
-                sendError(res, 400, "request.field_invalid", "scenario must be given at most once (omit it to read this deployment's default scenario)");
+            const named = scenarioQueryOf(match.search);
+            if (named === QUERY_SCENARIO_REPEATED) {
+                sendError(res, 400, "request.field_invalid", SCENARIO_QUERY_REPEATED_REFUSAL);
                 return;
             }
-            const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
+            const { scenario: scenarioName } = await deps.scenarioGate(principal, scenarioRequestedBySubject(gatedSubject(req, deps.config), named));
             await serveMcpProbeFace(res, ctx, principal, { declaredBy: "deployment", specs: mcpForScenario(deps.config.mcpServers, scenarioName) ?? [] });
             return;
         }
+        case "capability-scenario-effective": {
+            const principal = gatedPerson(req, deps.config);
+            if (deps.config.requirePrincipal && !principal) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            const named = scenarioQueryOf(match.search);
+            if (named === QUERY_SCENARIO_REPEATED) {
+                sendError(res, 400, "request.field_invalid", SCENARIO_QUERY_REPEATED_REFUSAL);
+                return;
+            }
+            const choice = await deps.scenarioGate(principal, scenarioRequestedBySubject(gatedSubject(req, deps.config), named));
+            sendJson(res, 200, { scenario: choice.scenario, source: choice.source });
+            return;
+        }
         case "capability-mcp-probe": {
             const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
@@ -398,6 +425,7 @@ export const CAPABILITIES_ROUTES = [
     { id: "capabilities", path: "/v1/capabilities", methods: ["GET"] },
     { id: "capability-scenario", pattern: /^\/v1\/capabilities\/scenarios\/(?<name>.*)$/, label: "/v1/capabilities/scenarios/:name", methods: ["GET"] },
     { id: "capability-mcp", path: "/v1/capabilities/mcp", methods: ["GET"] },
+    { id: "capability-scenario-effective", path: "/v1/capabilities/scenario", methods: ["GET"] },
     { id: "capability-mcp-probe", path: "/v1/capabilities/mcp/probe", methods: ["POST"] },
 ];
 //# sourceMappingURL=capabilities.js.map

package/dist/http/routes/config-catalog.js

@@ -23,13 +23,13 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                         sendError(res, 501, "feature.config_catalog_disabled", "the config catalog is switched off on this deployment (CONFIG_CATALOG_ENABLED=false)");
                         return;
                     case "operator_principals_empty":
-                        sendOperatorPrincipalsRequired(res);
+                        sendOperatorPrincipalsRequired(res, "operate");
                         return;
                     default:
                         return assertNever(fact.why);
                 }
             }
-            if (!explicitOperatorOk(principal, deps.config)) {
+            if (!explicitOperatorOk(principal, deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }

package/dist/http/routes/devices.js

@@ -144,7 +144,7 @@ export async function handleDevices(req, res, match, ctx) {
         }
     }
     const { store, hub, enrollment, runStore } = lane;
-    const operator = explicitOperatorOk(principal, deps.config);
+    const operator = explicitOperatorOk(principal, deps.config, "operate");
     const domain = deviceOwnerDomainOf(req, deps.config);
     if (match.decl.id === "devices-list") {
         if (!operator && domain === undefined) {

package/dist/http/routes/diagnostics.d.ts

@@ -42,7 +42,6 @@ export interface ServerWiringGates {
  *  不再是装配现场的事实,而是别处算完可能已漂的复述)。 */
 export interface ServerWiringGateInput {
     toolApprovalEnabled: boolean;
-    streamApprovalEnabled: boolean;
     /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
     backend: StreamApprovalGateInput["backend"];
     /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
@@ -116,8 +115,9 @@ export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, l
  * 字符串,端口误暴露到公网就是侦察面(装配拓扑 / 治理姿态 / 写保护名表)。配了 service 凭据的部署上,到得了这里的请求都过了全局凭据门、
  * 必然带着验过的身份,本判不咬;不要求静态凭据在场(鉴权桥的登录令牌就是身份)。
  *
- * 判源 = TCP 对端地址(`req.socket.remoteAddress`),**非任何头**(XFF 类头在无反代形上是自造面;有反代的部署必然配凭据)。
- * `remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed)。
+ * 「本机」按请求通道穷举(`request-channel.ts`;加一种通道不接 ⇒ 编译红):经本机控制 socket 来的请求 = 本机(能连上它的只有引擎的 OS 用户 —— 与 `/health` 把它认作
+ * 本机用户同读,同一只请求不被一面认作本机、另一面认作远程);经 TCP 来的请求判源 = TCP 对端地址(`req.socket.remoteAddress`),**非任何头**(XFF 类头在无反代形上是自造面;
+ * 有反代的部署必然配凭据)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed)。
  */
 export declare function remoteWithoutVerifiedIdentity(req: IncomingMessage, config: Parameters<typeof verifiedIdentitySource>[1]): boolean;
 export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, match: RouteMatch<DiagnosticsRouteId>, ctx: RouteCtx): Promise<void>;

package/dist/http/routes/diagnostics.js

@@ -5,6 +5,7 @@ import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPerson, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
+import { requestChannelOf } from "../request-channel.js";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { STORE_NOT_DURABLE_CODE, StoreNotDurableError, describeStoreRoot, projectStoreDurabilityWiring, unwiredStorePosture } from "../../store-posture.js";
@@ -12,7 +13,6 @@ import { describeLocalStoreDeclaration } from "../../local-store-declaration.js"
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
-        streamApprovalEnabled: input.streamApprovalEnabled,
         backend: input.backend,
         checkpointStore: input.checkpointStore,
     });
@@ -126,17 +126,30 @@ export function assertStaticWiringConsistent(facts, logger) {
     return audit;
 }
 export function remoteWithoutVerifiedIdentity(req, config) {
-    return !isLoopbackAddress(req.socket.remoteAddress) && verifiedIdentitySource(req, config) === undefined;
+    return !requestFromThisHost(req) && verifiedIdentitySource(req, config) === undefined;
+}
+function requestFromThisHost(req) {
+    const channel = requestChannelOf(req);
+    switch (channel) {
+        case "tcp":
+            return isLoopbackAddress(req.socket.remoteAddress);
+        case "control-socket":
+            return true;
+        default: {
+            const unknownChannel = channel;
+            throw new Error(`diagnostics: request channel ${String(unknownChannel)} has no locality reading`);
+        }
+    }
 }
 export async function handleDiagnostics(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "diagnostics-wiring": {
-            if (!facts.operatorLane(deps).available) {
-                sendOperatorPrincipalsRequired(res);
+            if (!facts.operatorLane(deps, "operate").available) {
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
-            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config)) {
+            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only");
                 return;
             }
@@ -156,8 +169,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({
-                    toolApprovalEnabled: deps.toolApproval !== undefined,
-                    streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                    toolApprovalEnabled: deps.config.toolApprovalEnabled === true,
                     backend: deps.backend,
                     checkpointStore: deps.checkpointStore,
                     durableApproval: deps.config.durableApproval === true,