@sema-agent/server 7.43.0 → 7.44.0

package/dist/http/active-run-conflict.js

@@ -1,130 +1,29 @@
-/**
- * [2252]/[2255]①/[2257] 追加件:409 `conflict.session_active_run` 的**真出路材料**装配(单源)。
- *
- * 事故形:park(suspended/needs_review)占着 session claim,客户端每条新提交吃 409,而旧文案只教
- * cancel(毁灭当前 run)。对 parked 会话,「继续」的唯一合法动作是去**对的** resume 入口决议——但四条
- * resume 入口各认各的 gate.kind,客户端不知道等的是哪种门,只能试错。本模块把答案放进 409 响应体:
- *   activeTaskStatus(区分「插话/取消」与「决议/取消」两族出路)
- *   pendingGate { kind, decidePath }(parked 且真有 pending checkpoint 时)
- *
- * 🔴 token 永不上 wire(approvals-assistant 纪律:resume 寻址=sessionId,checkpoint token 是秘密能力)。
- * 🔴 失败方向:材料是 best-effort 增强——store 面任何失败都不得挡 409 本体,退化为旧形状,绝不 throw。
- * 🔴 gateKind→入口映射是**这张表在仓里的唯一函数形**;它的知识此前散在 server.ts 三处 guard 文案里
- *    (`gate_not_tool_approval`/`gate_not_resumable`/`wake.gate_pending` 的指路句)。三处文案与本表若漂移,
- *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
- */
 import { governanceMandatesShellGateAlways } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-/** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
-/** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
 export function resumeEntryForGate(kind, ids) {
     switch (kind) {
-        // 🔴 tool_approval / policy_ask 历史臂已撤([2373] D 类容忍的翻案,扫描修复批 2026-08-12):
-        // 当年这两臂指 /decide,但 /decide 入口守卫按 APPROVAL_GATE_KINDS 闭集(human/irreversible_ask,
-        // A-002.1 单一属主)判 kind,旧 kind 名打过去必 409 gate_not_tool_approval——指一条会拒绝自己的
-        // 路径,与 needs_review 臂同「铸假门」病族;且 D-D SLA deny-sweep 的 SQL 取行也只选闭集两 kind,
-        // 旧 kind 历史行在系统内已无任何处理臂。诚实缺席(落 default null)> 假指路;若真要救历史行,
-        // 正解是扩 APPROVAL_GATE_KINDS 单一属主(连带 SQL IN/守卫/sweep 全族),不是在这里单独铸路。
         case "human":
         case "irreversible_ask":
             return `/v1/approvals/${ids.sessionId}/decide`;
         case "plan_review":
             return `/v1/assistant/tasks/${ids.taskId}/plan_review`;
-        // 🔴 needs_review **gate kind** 刻意无臂([3683]-1 属主定谳,2026-08-12,翻转 [2400] 补臂):
-        // core 三向拆分里 {kind:"needs_review"}(dry-run 拦截)的合法 outcome=dry_run_review,而 server
-        // 生产路由没有 dry_run_review 决议端点、/plan_review 端点守卫会 409 gate_not_plan_review 拒它
-        // ——旧映射把消费端指到一个会拒绝它的端点(铸假门)。[2400] 当年引的 tasks.ts 注明文说的是
-        // run **status** needs_review(plan_review/dry_run 两 gate 共享该 status),被误当 gate **kind**
-        // 语义抄进本表。落 default null=诚实缺席(客户端仍有 activeTaskStatus + cancel 保底真路);
-        // 将来若接 dry-run/shadow profile 的决议端点,在此补臂并同步 wire 契约。
         case "resource_limit":
             return `/v1/assistant/tasks/${ids.taskId}/resume`;
         case "task_done":
             return `/v1/sessions/${ids.sessionId}/wake`;
         default:
-            return null; // 未知门型:宁缺毋假 —— 客户端仍有 activeTaskStatus + cancel 这条保底真路
+            return null;
     }
 }
-/**
- * #220:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
- *
- *   行上的取证格 `gate.riskDescriptor.shellGateDoctrine === "always"`
- *   ∧ 本部署的治理层本来就要求 always(`governanceMandatesShellGateAlways`,单一判据属主在
- *     `runtime-governance.ts`,那里写着为什么单看行不够 —— SUP 路由姿态同样产 `"always"`)
- *
- * 第一半:core 在 mint 这道门时把「当时活着的 doctrine」如实写进 `riskDescriptor.shellGateDoctrine`
- * (2026-08-05 取证裁定;`prepare-task` 只在**被 shell 门铸**的 ask 上写它),所以持久行自己带着证据 ——
- * park 腿天然跨副本、跨重启,活卡腿那张 ALS 标记表在这里结构上够不着。
- * 第二半:把「有效档 always」收窄到「治理层是真成因」,否则一条 SUP 路由出来的门会被谎报成治理强制。
- *
- * ⚠️ 残留(双向失真的窄在场向 + 根治路径)登记在 `governanceMandatesShellGateAlways` 的顶注,别在这里
- * 复述;本位只承担「分诊提示」的分量,不参与任何门/CAS/resume 判定。
- *
- * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
- * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
- *
- * 🔴 **导出的理由 = 单一属主**([3684]②):这条推法此前只服务 409 体,于是 `GET /v1/approvals` /
- * `/v1/approvals/stream` 两条 durable 读面的行上**没有**出身格 —— 同一道 park 门,从 409 看得见出身、
- * 从运维队列看不见([3683]-2 实测)。补法**不是**在读面另写一份判据(两份必漂,而这一位恰恰是靠
- * 「行上取证 ∧ 部署姿态」的合取才不谎报的),而是让三条面共用本函数。
- *
- * ⚠️ **askId 为什么不在这里**(#220 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
- * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
- * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
- * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
- * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
- * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
- * 比缺席坏得多(本文件 `resumeEntryForGate` 的 default 臂是同一条纪律)。故本批诚实缺席。
- */
-/**
- * #285 身份格的**信任边界校验**(codex 对抗复审 R1-[high],验真后修)。
- *
- * 这个值来自**持久层 blob**(`checkpoint-store-sql.ts` 是 `parseJson<Checkpoint>` 整只反序列化,
- * 零运行时字段校验;LOCAL 车道同理),所以它和别的「core 铸给我们的值」不是一个信任等级 ——
- * 坏行 / 错迁移 / 第三方 store 实现都能往这一格里写任何字符串。
- *
- * 🔴 **两条判据都是 fail-closed(判不了就丢键),而不是「尽量带上」**:
- *  1. **绝不**把 token **包含**进去(不是「不等于」——见下方那条返工记账)。这是本文件第一条纪律
- *     (`token` 永不上 wire)的**执行点**,不是洁癖:`CheckpointToken` 在运行时就是个字符串,一条把
- *     token 抄进 `checkpointId` 的行会让这条投影**原样把 resume 能力写进 409 体**,并经
- *     `toDoneFrameResult` 继续流到 SSE done 帧。
- *     ⚠️ **返工记账(codex 对抗复审两轮,第二轮才逼出真形)**:第一版判据是「非空串」——对「行上写的
- *     就是 token」这个反例零覆盖(token 也是非空串);第二版收成「不等于 token」——**仍然可绕**:写
- *     `"cp_" + token`(35 字符,非空,不等于 token)照样过关,接收方剥掉前缀就拿回完整能力。⇒ 判据必须
- *     是**包含关系**。负控三格(逐字相等 / 前缀包装 / 后缀包装)钉在
- *     `test/session-active-conflict-materials.test.ts` 的 #285 安全负控族。
- *     比较**大小写不敏感**(第三轮加固:小写 hex token 的 `toUpperCase()` 形不含原串,零成本堵掉)。
- *  2. **长度有界**。core 的真形是 `cp_`+uuid(39 字符),给到 {@link MAX_CHECKPOINT_ID_CHARS} 已是
- *     数量级余量;无界透传等于让持久层里的垃圾决定响应体大小。边界(恰好 128 / 129)有钉。
- *
- * 🔴 **这道校验买得到什么、买不到什么(威胁模型如实写死,别再让下一个人以为它是闭合的)**:
- *  · **买得到**:误抄(迁移脚本 / 店实现把 token 抄进这一格)、朴素包装(`"cp_"+token`、加后缀)、
- *    大小写变形 —— 这几类是**真实可能发生的事故**,而它们的后果是把 resume 能力发上 wire。
- *  · **买不到、也不可能买到**:一个**能往 blob 里写任意值的对手**。128 位能力键塞进一个 128 字符的
- *    身份格有无穷多种可逆编码(base64、逐字符置换、……),值校验挡不住任何一种。
- *    ⚠️ 第三轮复审建议「严格只放行 `cp_`+UUID 格式」来闭合 —— **实测反证:那样也闭合不了**。把 32 位
- *    hex token 按 uuid 分组(`cp_01234567-89ab-cdef-0123-456789abcdef`)**逐字满足**严格正则,接收方
- *    去掉 `cp_` 和连字符就拿回完整 token(2026-08-18 亲跑验过)。⇒ 格式钉只会额外买来「core 换形我方
- *    静默丢键」的代价,不买来任何安全性,故**仍然刻意不做格式正则**。
- *  · 真正的控制在别处:能往 checkpoint blob 里写任意值 ⇒ 已有该表的写权限 ⇒ 本来就读得到 token 列。
- *    本校验的定位因此是**纵深防御 + 事故拦截**,不是信任边界的唯一防线。
- * ⚠️ 丢键是**静默**的(本函数无日志席,而本载体按顶注是 best-effort 分诊材料)。⇒ 一条被污染的行在
- * 运维面上**与 legacy 行不可分辨**,这是本批**如实登记的残留**(第三轮复审 [low] 验真):此前这里写
- * 「坏行在 store 读路径另有响亮面」是**假的** —— `checkpoint-store-sql.ts` 的 `get` 只是
- * `parseJson<Checkpoint>` 直返,没有任何字段校验或告警。补一条结构化 warning/metric(**绝不带原值**)
- * 需要给本模块拉观测席,那要过三问,已作为提货批未决项上报,不在本批就地加。
- */
 const MAX_CHECKPOINT_ID_CHARS = 128;
 function safeCheckpointIdOf(raw, token) {
     if (typeof raw !== "string" || raw === "" || raw.length > MAX_CHECKPOINT_ID_CHARS)
         return undefined;
-    // 🔴 `includes` 而不是 `===`:包装形(`"cp_" + token` / `token + "-x"`)剥掉装饰就是完整能力键。
-    // 🔴 大小写不敏感:小写 hex token 的 `toUpperCase()` 形不含原串,而它同样是可逆的(零成本堵掉)。
     const secret = token === undefined || token === null ? "" : String(token).toLowerCase();
     if (secret !== "" && raw.toLowerCase().includes(secret))
-        return undefined; // 秘密反射(含包装/变形):丢
+        return undefined;
     return raw;
 }
 export function governanceOriginOf(gate, governance) {
@@ -140,7 +39,7 @@ export function toDoneFrameResult(body) {
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),
         ...(body.msSinceLastActivity !== undefined ? { msSinceLastActivity: body.msSinceLastActivity } : {}),
-        ...(body.stale !== undefined ? { stale: body.stale } : {}), // #316(c):SSE done 帧与 409 体同材料,禁分家
+        ...(body.stale !== undefined ? { stale: body.stale } : {}),
         ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
     };
 }
@@ -155,17 +54,10 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
     try {
         const row = await deps.runStore?.getRun?.(activeTaskId);
         const status = row?.status;
-        // 判据取词表属主(合并码重扫):park 是两个词,由 `isParkedRunStatus` 的穷举 switch + `never` 臂看管;
-        // 手抄词表绕开那道编译期执法(core 新增一个 park 类成员时这里会静默判「非 park」⇒ 409 体少 activeTaskStatus
-        // 与 pendingGate 两格指路材料)。`running` 分支照旧单列(它不是 park,文案与出路都不同)。
         if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {
-            // #245 S1:活性证据只在 running 形铸(parked 行的状态本身就是证据);读口失败与缺席同路(best-effort)。
             const lastAt = deps.turnActivity?.(activeTaskId);
-            // #316(c):与 poll 面**逐字同一条**判据(`run.status === "running" && now - updatedAt > runStaleSec*1000`,
-            // 见 routes/runs.ts)。差别只在**结论**:poll 面折成终态,本面加位不改状态(理由见 `stale` 顶注)。
-            // 阈值/时间戳任一缺席或不可解析 ⇒ 键缺席(best-effort,绝不猜)。
             const updatedAtMs = row?.updatedAt !== undefined ? new Date(row.updatedAt).getTime() : Number.NaN;
             const staleMs = (deps.runStaleSec ?? 0) * 1000;
             const stale = staleMs > 0 && Number.isFinite(updatedAtMs) && Date.now() - updatedAtMs > staleMs;
@@ -177,7 +69,6 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
                 ...(stale ? { stale: true } : {}),
             };
         }
-        // parked:找 pending checkpoint 的门型,指到它的那一个 resume 入口
         const cs = deps.checkpointStore;
         let pendingGate;
         if (cs?.findPendingTokenBySession) {
@@ -187,9 +78,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             const gate = row?.gate;
             const kind = gate?.kind;
             const decidePath = kind ? resumeEntryForGate(kind, { sessionId, taskId: activeTaskId }) : null;
-            // #220:出身格与出路格**同一次读**里取(不为它多打一次库),`true` 才写键(见 PendingGateMaterial 顶注)。
             const governanceForced = governanceOriginOf(gate, deps.governance);
-            // #285:身份格同一次读里取,判据见 `safeCheckpointIdOf`(信任边界校验 —— 该值来自持久层 blob)。
             const checkpointId = safeCheckpointIdOf(row?.checkpointId, token);
             if (kind && decidePath) {
                 pendingGate = {
@@ -210,22 +99,8 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
         };
     }
     catch {
-        // 🔴 A-057.19 姊妹件 A-057.47 [PARTIAL high](2026-08-19)—— **方向不变,补留痕**。
-        // 存活子句 = 运行期遥测缺口:这段 try 包住 getRun / turnActivity / peekPendingScope /
-        // findPendingTokenBySession / cs.get 全部,失败时 activeTaskStatus / msSinceLastActivity /
-        // pendingGate(kind·decidePath·governanceForced·checkpointId)整套蒸发、退化成裸 409,而
-        // ①本文件零 logger 席 ②pg-pool/tidb-pool 无 per-query 错误留痕 ③调用侧因本函数恒不 reject 拿不到
-        // 信号 ⇒ store 抖动 / 坏 checkpoint 行 / 滚动升级期 `checkpoint-store-sql.ts` 的版本守卫 throw
-        // 导致的「approval 出路材料系统性丢失」在生产遥测里**零信号**。
-        // 定性 F 类(台账驳倒了 high 自评):本材料成文为**展示/分诊**,不参与任何门/CAS/resume 判定
-        // (顶注 150 行 + FAIL-OPEN-CENSUS 第 21 行同一条判据);降级后 409 仍带 errorCode + activeTaskId +
-        // cancel 保底真路,不构成执法面绕过。所以是「F 类兜底必留痕」(CLAUDE.md #157),不是要改方向。
-        // 台账同时驳倒了本 finding 的两条推论:`recordFailOpen` 是**零依赖自由函数**,不需要给本模块拉
-        // 观测席(顶注 200-204 行那句「需要过三问」高估了成本);本臂也不是完全账外(它在
-        // `test/silent-degradation-scan.test.ts` 的 SHAPE C 棘轮里有冻结值)—— 本批把它从「有行无痕」
-        // 收成「有行有痕」,棘轮值随之从 1 归 0(catch 体不再是「只 return 默认值」)。
         recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
-        return base; // 材料装配的任何失败都退化为旧形状 —— 增强绝不成为新故障点
+        return base;
     }
 }
 //# sourceMappingURL=active-run-conflict.js.map

package/dist/http/cursor-fingerprint.d.ts

@@ -0,0 +1,5 @@
+/** filter 各分量按固定序 JSON 归一后取 sha256 前 8 hex——短到能进游标,碰撞面(2^32)对
+ *  「同 caller 误用」这个人因场景绰绰有余(不是安全边界,是配对判据)。undefined 分量显式
+ *  编入(缺席≠空串),换 filter 任何一个分量都会翻指纹。 */
+export declare function filterFingerprint(parts: readonly (string | boolean | undefined)[]): string;
+//# sourceMappingURL=cursor-fingerprint.d.ts.map

package/dist/http/cursor-fingerprint.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+export function filterFingerprint(parts) {
+    return createHash("sha256").update(JSON.stringify(parts.map((p) => (p === undefined ? null : p)))).digest("hex").slice(0, 8);
+}
+//# sourceMappingURL=cursor-fingerprint.js.map

package/dist/http/idempotency.js

@@ -1,23 +1,3 @@
-/**
- * In-memory, TTL'd dedup cache keyed by an opaque string (an Idempotency-Key).
- *
- * - `run(key, produce, shouldCache?)` invokes `produce` at most once per key — concurrent and retried calls
- *   with the same key await the same promise — and retains a CACHEABLE resolution for `ttlMs` so a later retry
- *   replays it. A rejection (a thrown error billed nothing) or a caller-marked un-cacheable resolution (e.g. a
- *   transient 409) is evicted so a genuine retry re-runs.
- * - `peek(key)` returns the cached (in-flight or settled) promise without producing — letting a caller
- *   short-circuit a retry BEFORE side gates (rate/quota), so the retry gets the same response, not a fresh 429.
- *   An SSE stream wraps its live run in `run()` so the in-flight promise is stored too; a retry then peeks it.
- *
- * Per-entry TTL is enforced on access (O(1)); abandoned keys are reclaimed by a sweep that runs only once the
- * map grows past a threshold (no O(n) scan on the hot path). Single-threaded event-loop semantics: each HTTP
- * request is its own task, so there is no get→set race within a tick.
- *
- * (Caller context: the sema-registry review gateway mints/echoes the Idempotency-Key and routes a given key to
- * the same worker, so this PER-POD cache is the worker-side backstop against a retried submission re-running —
- * and re-billing. Cross-pod / cross-restart exactly-once needs store-backing; the durable async /v1/runs path
- * is the alternative for long tasks.)
- */
 export class IdempotencyCache {
     ttlMs;
     sweepThreshold;
@@ -26,7 +6,6 @@ export class IdempotencyCache {
         this.ttlMs = ttlMs;
         this.sweepThreshold = sweepThreshold;
     }
-    /** Live (un-expired) cached promise for a key, or undefined — without producing. */
     peek(key) {
         return this.live(key);
     }
@@ -39,18 +18,12 @@ export class IdempotencyCache {
             return hit;
         const promise = produce();
         this.entries.set(key, { at: Date.now(), promise });
-        // Evict on rejection (retry must re-run) and on a caller-marked un-cacheable resolution; keep only a
-        // cacheable success for the TTL. Handlers also avert an unhandled-rejection on the cached copy; the returned
-        // promise is the same object the caller awaits, so errors still surface to the caller.
         promise.then((value) => {
-            // #131-7:谓词抛=当不可缓存(重试重跑)。裸调时谓词一抛,这条**派生** promise 就成了无人接的
-            // rejection(调用方拿的是原 promise,接不到它),且条目滞留缓存——双错方向。
             let cacheable = false;
             try {
                 cacheable = shouldCache(value);
             }
             catch {
-                /* fall through: cacheable=false */
             }
             if (!cacheable)
                 this.entries.delete(key);
@@ -60,7 +33,6 @@ export class IdempotencyCache {
     get size() {
         return this.entries.size;
     }
-    /** Return the cached promise if present AND within the TTL; drop it and return undefined if expired. */
     live(key) {
         const hit = this.entries.get(key);
         if (!hit)
@@ -71,7 +43,6 @@ export class IdempotencyCache {
         }
         return hit.promise;
     }
-    /** Reclaim expired entries only once the map is large — avoids an O(n) scan on every call (council). */
     maybeSweep() {
         if (this.entries.size < this.sweepThreshold)
             return;
@@ -81,14 +52,6 @@ export class IdempotencyCache {
                 this.entries.delete(k);
     }
 }
-/**
- * Namespace an Idempotency-Key by the authenticated identity (BL-3). The dedup cache is one per process; keying
- * it on the RAW client header let a different tenant (or anonymous caller) replaying the same key receive the
- * FIRST caller's response and skip the rate/quota gates. Folding the credential-derived `source` + the
- * `principal` into the key scopes a replay to the SAME caller only — cross-tenant collisions become cache
- * misses (re-run, correctly attributed). `\x1f` (unit separator) can't occur in an HTTP header value, so the
- * three fields can't be confused. undefined raw key → undefined (no dedup, unchanged).
- */
 export function scopedIdempotencyKey(raw, source, principal) {
     return raw ? `${source ?? ""}\x1f${principal ?? ""}\x1f${raw}` : undefined;
 }

package/dist/http/principal-gate.js

@@ -1,15 +1,5 @@
-/**
- * design/158 A9 seam — credential/identity primitives, extracted VERBATIM out of `http/server.ts`.
- *
- * Every per-domain route module needs `gatedPrincipal` (80 call sites in the old monolith), which pulls in
- * `bearerPresentedButUnverified` → `systemFor` → `authorized` → `safeEqual`. They live here (a leaf that only
- * depends on `node:*`, `../security.js` and the config TYPE) so `http/routes/*` never value-imports `server.ts`.
- *
- * Pure move: bodies are byte-identical to `server.ts:682/693/9310/9779/9789/9796`.
- */
 import { timingSafeEqual } from "node:crypto";
 import { verifiedPrincipal, ssoVerifiedPrincipal } from "../security.js";
-/** Coerce a possibly-repeated request header to a single string (or undefined). */
 export function headerStr(v) {
     return Array.isArray(v) ? v[0] : v;
 }
@@ -20,13 +10,8 @@ export function safeEqual(a, b) {
 }
 export function authorized(req, token) {
     const h = req.headers.authorization ?? "";
-    // Constant-time compare so the service token can't be recovered byte-by-byte via response-timing (a plain
-    // `===` short-circuits on the first mismatching char). Length is allowed to leak (standard for this pattern).
     return safeEqual(h, `Bearer ${token}`) || safeEqual(h, `token ${token}`);
 }
-/** Which SYSTEM credential authenticated this request (clay 2026-06-12: source must be credential-DERIVED,
- *  never self-declared). Returns the system name for a SERVICE_AUTH_TOKENS match; null for the legacy single
- *  SERVICE_AUTH_TOKEN (authenticated, no system identity); undefined = no valid service credential. */
 export function systemFor(req, config) {
     for (const [tok, system] of Object.entries(config.authTokens ?? {})) {
         if (authorized(req, tok))
@@ -36,51 +21,29 @@ export function systemFor(req, config) {
         return null;
     return undefined;
 }
-/** "presented credentials must verify":Authorization 带 Bearer/token scheme 且三路全验不过 → true。
- *  其他 scheme(Basic 等,非我方凭证空间)不管——由原有门语义处置,避免误伤未知代理注头。 */
 export function bearerPresentedButUnverified(req, config) {
     const h = req.headers.authorization;
     if (typeof h !== "string" || !/^(Bearer|token) /i.test(h))
         return false;
     if (ssoVerifiedPrincipal(req))
-        return false; // registry JWT 已在入口预认证验过(签名真源)
+        return false;
     if (systemFor(req, config) !== undefined)
-        return false; // service token(单一或 per-system)
+        return false;
     if (config.traceToken && authorized(req, config.traceToken))
-        return false; // 只读 trace 凭证
+        return false;
     return true;
 }
 export function gatedPrincipal(req, config) {
-    // 实测抓获的软鉴权:出示了 Bearer/token 凭证但验不过任何已知凭证(service token 单/多、
-    // traceToken、registry SSO-JWT)⇒ 无可信身份,绝不回退 spoofable principal 头——此前伪造凭证被静默忽略、
-    // 拿 principal 头的 owner 视图(200 空列表),会把轮换错配掩蔽成假健康。未出示凭证(纯 BFF 头姿势)不受
-    // 影响;POST 面在全局门后调用=凭证已验,语义不变。
     if (bearerPresentedButUnverified(req, config))
         return undefined;
     return verifiedPrincipal(req, config);
 }
-/** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
- *  "true-for-all" is a world-writable RCE door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
- *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.
- *  🔴 SINGLE mint point (E1): a byte-identical twin `explicitOperator` used to live below (image-visibility lane)
- *  and two more hand-inlined copies sat in approvals-assistant — a future hardening of this judgment would have
- *  missed them. All call sites now consume THIS function; do not re-introduce a sibling. */
 export function explicitOperatorOk(principal, operatorPrincipals) {
     return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
 }
-/** May `principal` act as an OPERATOR on the F4 approval queue? Empty `operatorPrincipals` = legacy
- *  behavior (the shared service token IS the operator boundary → everyone authenticated is an operator).
- *  Otherwise only listed principals are operators. */
 export function isOperator(principal, operatorPrincipals) {
     if (operatorPrincipals.length === 0)
         return true;
     return principal !== undefined && operatorPrincipals.includes(principal);
 }
-/** Operator check WITHOUT the empty-list "everyone is an operator" legacy fallback — an EMPTY `operatorPrincipals`
- *  yields `false` (no one is an operator). Use this where empty-operators-means-all would be a SECURITY hole rather
- *  than a back-compat convenience: image VISIBILITY scoping (a tenant-scoped image must not leak to every caller
- *  just because OPERATOR_PRINCIPALS is unset). Adversarial-review HIGH: `isOperator([], p)=true` made
- *  `latestPublished(..., {operator:true})` bypass tenant visibility for any caller on an operator-less deployment.
- *  (The byte-identical `explicitOperator` twin that used to live here was folded into `explicitOperatorOk` above —
- *  one judgment, one mint point.) */
 //# sourceMappingURL=principal-gate.js.map

package/dist/http/route-ctx.js

@@ -1,13 +1,4 @@
-/**
- * #262(A-041 存在性 oracle 封口)——`not_found.run` 的**唯一**文案源,unknown 与 not-yours 两臂共用。
- * 修前:unknown 臂发这条长指路文案、not-yours 臂发短文「run not found」,同 code 下按**文案长度**即可
- * 枚举他人 run id 的存在性(822 行「no existence oracle」注释的意图被长短差打穿)。not-yours 臂只可能
- * 拿到非 a\* id(store 查到行才有 owner 比对;a\* 与 wa\* 形 id 永不在 run store)⇒ 非 a\* 长文串足以让
- * 两臂逐字节同形,指路价值不丢。钉=audit-fixes-http「#262」格(两臂全文比对);文案变更走
- * api-error-text-freeze 基线流程。
- */
 export const RUN_NOT_FOUND_MESSAGE = "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
-/** [1434] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给 TaskOutput/journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
 export function runNotFoundMessage(id) {
     const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);
     return aStar