@sema-agent/server 7.48.0 → 7.50.0

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -30,6 +31,52 @@ export function isQuestionAnswer(v) {
             (note === undefined || typeof note === "string"));
     });
 }
+async function decideIdempotentReplay(cs, args) {
+    const { sessionId, out, binding, decision, payload, deciderPrincipal, explicitOperator, warn } = args;
+    if (out.status !== 404 || out.body.errorCode !== "not_found.approval")
+        return undefined;
+    const boundCallId = binding.boundCallId;
+    if (boundCallId === undefined)
+        return undefined;
+    if (typeof cs.findDecidedApprovalsForBinding !== "function")
+        return undefined;
+    const rows = await cs.findDecidedApprovalsForBinding(sessionId, boundCallId);
+    if (rows.length === 0)
+        return undefined;
+    if (rows.length >= DECIDED_REPLAY_SCAN_CAP) {
+        warn("decide_replay_scan_cap_hit", { sessionId, rows: rows.length });
+        return undefined;
+    }
+    const requestFp = approvalPayloadFingerprint(payload);
+    if (requestFp === null)
+        return undefined;
+    for (const row of rows) {
+        if (row.decision === null)
+            return undefined;
+        if (!explicitOperator) {
+            const owner = decodeCheckpointScope(row.scope);
+            if (owner !== undefined && owner !== deciderPrincipal) {
+                warn("decide_replay_scope_mismatch", { sessionId });
+                return undefined;
+            }
+        }
+        if (binding.boundInputHash !== undefined && row.boundInputHash !== binding.boundInputHash)
+            return undefined;
+        if (row.decision !== decision)
+            return undefined;
+        if (row.payloadFp === null || row.payloadFp !== requestFp)
+            return undefined;
+    }
+    return {
+        status: 200,
+        body: {
+            sessionId,
+            idempotent: true,
+            decision,
+            bindingEnforced: true,
+        },
+    };
+}
 export async function handleApprovalsAssistant(req, res, url, ctx) {
     const miss = { fell: false };
     await handleApprovalsAssistantBody(req, res, url, ctx, miss);
@@ -440,6 +487,24 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true);
+            const replay = await decideIdempotentReplay(cs, {
+                sessionId,
+                out,
+                binding,
+                decision,
+                payload: {
+                    ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
+                    ...(answer !== undefined ? { answer } : {}),
+                    ...(body.reason ? { reason: body.reason } : {}),
+                },
+                deciderPrincipal,
+                explicitOperator,
+                warn: (event, fields) => deps.logger?.warn?.(event, fields),
+            });
+            if (replay !== undefined) {
+                sendResumeOutcome(res, replay, deps.logger);
+                return;
+            }
             sendResumeOutcome(res, out, deps.logger, remember && deps.approvalExemptionStore ? { rememberApplied } : undefined);
             return;
         }

package/dist/http/routes/notify-wake.js

@@ -83,7 +83,7 @@ async function handleNotifyWakeBody(req, res, url, ctx, miss) {
         const liveStream = liveTaskId !== undefined && liveTaskId !== null ? steerableRuns.get(liveTaskId) : undefined;
         if (liveStream) {
             try {
-                await liveStream.notify(payload);
+                await liveStream.notify(payload, { priority: "next" });
                 sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
                 return;
             }

package/dist/http/routes/runs.d.ts

@@ -13,7 +13,7 @@
  * `cancelledViaVerb` first-writer-wins 判别、`steerableRuns` 活流句柄、`wakeParkMints` park 铸造闩)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { ActorAssertionWire } from "@sema-agent/registry-core";
+import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission } from "../route-ctx.js";
 export declare const RUN_ID_RE: RegExp;
 export declare const RUN_CANCEL_RE: RegExp;

package/dist/http/routes/runs.js

@@ -23,7 +23,7 @@ import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
 import { buildCrossSliceUsage, readResourceWindow, recordResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
-import { ActorAssertionWire } from "@sema-agent/registry-core";
+import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
 export const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;

package/dist/http/routes/sessions.js

@@ -366,7 +366,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                     sendError(res, 503, "state.sse_probe_cap", "session-events probe cap reached — fall back to /head polling");
                     return;
                 }
-                res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache, no-transform", connection: "keep-alive", "x-accel-buffering": "no" });
+                sseHeaders(res, { "cache-control": "no-cache, no-transform", "x-accel-buffering": "no" });
                 writeRaw(": connected\n\n");
                 started = true;
                 if (preVal !== undefined)

package/dist/http/routes/tasks.js

@@ -331,12 +331,16 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         const td = e;
                                         sseData(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
                                     }
+                                    else if (t === "text_end") {
+                                        const tend = e;
+                                        sseData(res, { type: "text_end", content: tend.content, ...(tend.eventId ? { eventId: tend.eventId } : {}), ...(tend.parentToolCallId ? { parentToolCallId: tend.parentToolCallId } : {}) });
+                                    }
                                     else if (t === "reasoning_delta") {
                                         const rd = e;
                                         sseData(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
                                     }
                                 },
-                                onTaskNotification: (n) => {
+                                onTaskNotification: (n, opts) => {
                                     if (n.task_type === "workflow")
                                         return;
                                     defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -348,13 +352,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
                                     deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
                                     if (parked) {
-                                        void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                        void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                     }
                                     else if (deliverable) {
                                         const key = taskNotificationStreamKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
-                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n }) });
+                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
                                         }
                                     }
                                 },
@@ -459,7 +463,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 else if (ev.type === "human_input") {
                                     sseData(res, { type: "human_input", ...humanInputEventData(ev) });
                                 }
-                                else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
+                                else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     const e = ev;
                                     const ident = {
                                         ...(e.eventId !== undefined ? { eventId: e.eventId } : {}),
@@ -469,11 +473,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     };
                                     const arm = ev.type === "text_delta"
                                         ? { type: "text_delta", delta: e.delta, ...ident }
-                                        : ev.type === "turn_end"
-                                            ? { type: "turn_end", ...(e.usage !== undefined ? { usage: e.usage } : {}), ...(e.usageMissing !== undefined ? { usageMissing: e.usageMissing } : {}), ...(e.stopReason !== undefined ? { stopReason: e.stopReason } : {}), ...ident }
-                                            : ev.type === "message_committed"
-                                                ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
-                                                : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
+                                        : ev.type === "text_end"
+                                            ? { type: "text_end", content: e.content, ...ident }
+                                            : ev.type === "turn_end"
+                                                ? { type: "turn_end", ...(e.usage !== undefined ? { usage: e.usage } : {}), ...(e.usageMissing !== undefined ? { usageMissing: e.usageMissing } : {}), ...(e.stopReason !== undefined ? { stopReason: e.stopReason } : {}), ...ident }
+                                                : ev.type === "message_committed"
+                                                    ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
+                                                    : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
                                     sseData(res, arm);
                                 }
                                 else {

package/dist/http/send.d.ts

@@ -8,6 +8,20 @@
  * now imports them from here, so all ~500 existing `sendJson(...)` call sites are unchanged text.
  */
 import type { ServerResponse } from "node:http";
+/**
+ * #118(黑板 [5371]②)—— 一条响应「是 SSE 流」的**在场标记**。
+ *
+ * 引擎附着租约把**打开着的 SSE 流**当作壳的附着租约来数,于是 `handle()` 需要判「这条响应是不是流」。
+ * 🔴 **不能靠读回 content-type**(本机 node v24.2.0 实测):`res.writeHead(status, headersObject)` 直接
+ * 把头写进网络缓冲,`res.getHeader("content-type")` / `res.hasHeader(...)` 在那之后**仍然**回
+ * `undefined` / `false`。照那条路写会得到一个恒为 0 的附着计数 —— 而恒 0 的方向恰好是「以为没人附着」
+ * ⇒ 在一只有人用的引擎底下触发自退。所以判据必须是我们自己在开流那一刻盖的这个章。
+ *
+ * symbol 键:不上 wire、不进 `JSON.stringify`、不与任何应用属性撞名。
+ */
+export declare const SSE_RESPONSE_MARK: unique symbol;
+/** 这条响应是否已开成 SSE 流(= 走过 {@link sseHeaders})。 */
+export declare function isSseResponse(res: ServerResponse): boolean;
 export declare function sseHeaders(res: ServerResponse, extra?: Record<string, string>): void;
 /**
  * 一条 SSE 连接的墙钟上限。到点发一帧 `error`/`STREAM_MAX_DURATION`(**不是**静默关闭 —— 客户端分不出

package/dist/http/send.js

@@ -1,4 +1,9 @@
+export const SSE_RESPONSE_MARK = Symbol("sema.http.sse-response");
+export function isSseResponse(res) {
+    return res[SSE_RESPONSE_MARK] === true;
+}
 export function sseHeaders(res, extra) {
+    res[SSE_RESPONSE_MARK] = true;
     res.writeHead(200, {
         "content-type": "text/event-stream",
         "cache-control": "no-cache",

package/dist/http/server.d.ts

@@ -513,6 +513,9 @@ export interface ServiceDeploymentDeps {
      *  • `inflight` is ASSIGNED BY createServer (a live union of this replica's in-flight legs: durable bg/resume
      *    `inflightRuns` + live sync/resume streams `steerableRuns`) — main.ts polls it to know when drain is done.
      *  • /health carries `draining:true` (k8s readiness 摘流信号) + `version` (build self-description).
+     *  • #118:`attachedStreams` 同样 ASSIGNED BY createServer —— 本副本当前打开着的 SSE 流条数
+     *    (= 引擎附着租约集的大小)。消费方是 `boot/engine-lease.ts` 的自退判据;与 `inflight` 同族,
+     *    同一个共享盒子,不另开第二条 main↔server 的通道。
      */
     drainState?: {
         draining: boolean;
@@ -520,6 +523,8 @@ export interface ServiceDeploymentDeps {
         reason?: string;
         inflight?: () => number;
         lastActivityAt?: () => number;
+        attachedStreams?: () => number;
+        lastAttachEndedAt?: () => number;
     };
     /** boot ready 门(b):false = registry 部署无显式 env 模型且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。计费提交 503 + /health 加性 `ready:false`。absent = 恒 ready(env 模型在/非

package/dist/http/server.js

@@ -16,7 +16,7 @@ import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId,
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
-import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
@@ -70,7 +70,7 @@ import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendJson, sendError, httpErrorCode, msg } from "./send.js";
+import { sendJson, sendError, httpErrorCode, msg, isSseResponse } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 export { explicitOperatorOk, isOperator };
@@ -179,6 +179,18 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    const openResponses = new Set();
+    let lastAttachEndedAt = 0;
+    if (deps.drainState) {
+        deps.drainState.attachedStreams = () => {
+            let n = 0;
+            for (const r of openResponses)
+                if (isSseResponse(r))
+                    n++;
+            return n;
+        };
+        deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
+    }
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
             try {
@@ -247,6 +259,8 @@ export function createHttpServer(rawDeps) {
         const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
         if (admitted)
             counters.admittedInflight++;
+        if (admitted)
+            openResponses.add(res);
         let logged = false;
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
         const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
@@ -256,6 +270,8 @@ export function createHttpServer(rawDeps) {
             logged = true;
             if (admitted)
                 counters.admittedInflight--;
+            if (openResponses.delete(res) && isSseResponse(res))
+                lastAttachEndedAt = performance.now();
             const route = routeLabel(method, url);
             const seconds = (Date.now() - startedAt) / 1000;
             const aborted = viaClose && !res.writableEnded;
@@ -1249,7 +1265,7 @@ export function createHttpServer(rawDeps) {
                                 void verifySink.appendStatus(e).catch((err) => deps.logger?.warn?.("status_event_append_failed", { route: "resume-verify", taskId, err: err instanceof Error ? err.message : String(err) }));
                             }
                         },
-                        onTaskNotification: (n) => {
+                        onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
                             defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -1260,12 +1276,12 @@ export function createHttpServer(rawDeps) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume-verify", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationStreamKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
+                                    resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
                             }
                         },
@@ -1376,7 +1392,7 @@ export function createHttpServer(rawDeps) {
                                 void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
                             }
                         },
-                        onTaskNotification: (n) => {
+                        onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
                             defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -1387,12 +1403,12 @@ export function createHttpServer(rawDeps) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationStreamKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
+                                    resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
                             }
                         },

package/dist/http/wire-types.d.ts

@@ -216,7 +216,7 @@ export interface TaskRequestBody {
         skillsListing?: boolean;
     };
     /** C1 (core 1.219, subagent viewing pane): opt-in — forward a delegated child's live CONTENT events
-     *  (text_delta/reasoning_delta/tool_start/tool_end, each stamped `parentToolCallId`) onto this run's stream/durable
+     *  (text_delta/text_end/reasoning_delta/tool_start/tool_end, each stamped `parentToolCallId`) onto this run's stream/durable
      *  log, so a shell can render the child's transcript live ("enter 看详情"). Default OFF = progress-only (prior
      *  behavior). Purely a render channel — core never merges the child stream into the parent's model context. */
     forwardSubagentEvents?: boolean;

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,3 +1,4 @@
+import type { SystemInjectionPriority } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
  *  redacted + length-bounded by core's notifier seam (see {@link WorkflowCompletionPayload}). */
@@ -262,7 +263,17 @@ export declare function taskNotificationInboxEntry(sessionId: string, owner: str
 /** lead-b (dual-ID audit): the PARENT run's durable taskId (the uuid the shell's footer rows
  *  key on) — rides the drained frame so a consumer can bind the a*-keyed child notification to its uuid-keyed
  *  parent row without a side lookup. */
-parentTaskId?: string): WorkflowCompletionInboxEntry;
+parentTaskId?: string, 
+/**
+ * design/373 §3.6(core 5.61.0,#366 / codex R1[high]):core 在 `onTaskNotification` 的**第二参**上报的
+ * 投递档位。park 是**跨 run** 的那条投递路径 —— 不带过去,档位就在最常走的一条路上恒缺席。
+ *
+ * 🔴 只在 core **真的给了**档位时传:缺席原样缺席(与 live 投影同一条「缺席≠later」纪律)。
+ * 闭集之外的值当作缺席(下面的 `INJECTION_TIERS` 守卫)——durable 载荷更不该出现引擎从没发过的词。
+ * ⚠️ 本仓自己铸的 park(`POST /v1/sessions/:id/notify` 的 idle 半场)**不传**这一位:那条 park 是
+ * 纯展示帧,没有任何引擎侧的档位承诺,填一个词就是凭空铸一条投递声明。
+ */
+priority?: SystemInjectionPriority): WorkflowCompletionInboxEntry;
 /**
  * Resolve WHERE a workflow completion routes (core 1.208): the SESSION comes straight off
  * `originatingSessionId` (the Runner closes over it at RunWorkflow mount — lookup-free). The OWNER comes from,

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
+import { injectionTierOrAbsent } from "../trace/injection-tier.js";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -288,10 +289,14 @@ export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPri
         }
     }
 }
-export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, parentTaskId) {
+export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, parentTaskId, priority) {
     const cap = (s, max) => (s.length > max ? `${s.slice(0, max)}…[+${s.length - max} chars]` : s);
     const extras = {
         task_type: n.task_type,
+        ...(() => {
+            const tier = injectionTierOrAbsent(priority);
+            return tier !== undefined ? { priority: tier } : {};
+        })(),
         ...(parentTaskId ? { parentTaskId } : {}),
         ...(n.sessionId ? { sessionId: n.sessionId } : {}),
         ...(n.toolUseId ? { toolUseId: n.toolUseId } : {}),

package/dist/org-memory-admission.js

@@ -1,4 +1,4 @@
-import { PrincipalOrgMemoryWire } from "@sema-agent/registry-core";
+import { PrincipalOrgMemoryWire } from "@sema-agent/settings-schema";
 import { assertPrincipalShape } from "./security.js";
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const ORG_SCOPE_RE = /^org:\S+$/;

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDriver } from "./sql-driver.js";
 /**
@@ -175,6 +175,80 @@ export interface CheckpointAskCandidate {
     /** 在场 ⇒ 这行读不出(blob 版本超前 / JSON 坏)。收敛器视同不匹配;**从不是** false,缺席即可读。 */
     unparseable?: true;
 }
+/**
+ * #368 件1 —— legacy `/v1/approvals/:sessionId/decide` 腿的**幂等回放**判别行(窄读,非凭据面)。
+ *
+ * 刻意**不带 token**:回放只需要「这条已决的行归谁、绑的是哪一次调用、判词是什么」三件,而 token 是
+ * resume 凭据(§12-C「checkpointToken 从不外发」;`CheckpointAskCandidate` 带它是因为收敛器要拿它去
+ * `bindBatch`,本口没有那个用途 ⇒ 不给)。
+ */
+export interface DecidedApprovalRecord {
+    /** 行的属主 scope 列(`encodeCheckpointScope` 的产物:principal 或匿名哨兵 `"_"`)。回放属主门的输入。 */
+    scope: string;
+    /** 行上的 D-1 入参摘要(`bound_input_hash` 列);pre-D-1 行为 null。 */
+    boundInputHash: string | null;
+    /**
+     * 这条已决行的**工具审批判词**,或 `null` = **判别不出**(codex R1-[medium] 四的收敛形):
+     * outcome 读不出 / 没有 winner / winner 绑的是**另一个** callId / 判词是 REVIEW 门那三个词。
+     *
+     * 🔴 `null` **不是**「无所谓」:调用方必须把它当「这条命中的行我读不懂」⇒ **整次回放拒绝**。
+     * 一条读不懂的已决行与一条判词相反的已决行在风险上同级 —— 都意味着这只 callId 上的持久事实
+     * 不是本次回放能如实复述的。
+     */
+    decision: "approve" | "deny" | null;
+    /**
+     * 判词**之外**的决议载荷指纹(codex R2-[high] 一,验真后补):`updatedInput` / `answer` / `reason`
+     * 三件都在 core 的持久 winner 里,而**同判词不等于同决议** —— 「approve + 编辑后的实参 A」与
+     * 「approve + 实参 B」是两次不同的放行,只比判词就会把后者谎报成「你的请求已被处理」(而 B 从未执行)。
+     * 调用方按**同一份请求重发**的语义要求它与本次请求的同三件逐字相等。
+     * `null` = 算不出(载荷序列化不了)⇒ 与 `decision: null` 同判:整次拒绝。
+     * 铸法见 {@link approvalPayloadFingerprint}(两条车道共用同一只,免得指纹口径漂)。
+     */
+    payloadFp: string | null;
+}
+/**
+ * #368 件1(codex R2-[high] 一)—— 决议载荷的比对指纹:`[updatedInput, answer, reason]` 三件的规范串。
+ *
+ * 为什么是指纹而不是把三件原样交出来:`updatedInput` 可能携人写的命令原文/密钥形字节,而本读口的
+ * 契约是「窄读、非凭据面」—— 交指纹够比对,也不给任何调用点把它误投上 wire 的机会。
+ *
+ * 🔴 **必须是 canonical(键序无关)**,不是裸 `JSON.stringify`(codex R3-[high] 二,验真后修):行侧那份
+ * 载荷是从 `JSON`/`JSONB` 列**回读**的,而 **PG 的 jsonb 不保留输入键序**(它按自己的规则重排)⇒ 客户端
+ * 逐字重发原 body 时,请求侧按原键序、行侧按库的键序,裸 stringify 出来的两串不等 ⇒ 一次**合法重试**
+ * 被误拒成 404。方向虽保守(不是谎报成功),但那正是本件要修的那个场景,所以指纹按**递归键排序 +
+ * 数组保序**铸(见 {@link canonicalFingerprintJson})。
+ *
+ * 缺席一律折 `null` 哨兵(不是省位):`{updatedInput: undefined}` 与「没有这个键」在本比对里是同一件事。
+ * ⚠️ 调用方**必须**按 outcome 铸点的在场规则喂参(`updatedInput` 只在 approve 上、`reason` 走真值判)——
+ * 铸点丢掉的字节行上就没有,请求侧多喂一件会把一次合法重试误判成「不同的决议」。
+ * 序列化失败(循环引用/BigInt 等)⇒ `null` = 判别不出,调用方据此拒绝回放(fail-closed)。
+ */
+export declare function approvalPayloadFingerprint(v: {
+    updatedInput?: unknown;
+    answer?: unknown;
+    reason?: string;
+}): string | null;
+/**
+ * #368 件1 —— {@link SqlCheckpointStore.findDecidedApprovalsForBinding} 的扫描上界。
+ *
+ * 🔴 它**同时是判据**,不只是一道 LIMIT:调用方按「命中集里每条判词都一致才回放」判,而一次被截断的
+ * 集合可能把分歧藏在第 N+1 行 ⇒ 消费点约定「**回满 = 判别不出**」,整次拒绝回放(回落 404)。现网正常形
+ * 恒 0 或 1 行,回满只可能是数据异常。
+ */
+export declare const DECIDED_REPLAY_SCAN_CAP = 8;
+/**
+ * #368 件1 —— core 的 `ResolvedOutcome` → 本腿(工具审批 decide)的二值词表。**闭集穷举**(#157):
+ * core 哪天给 `ResolvedOutcome.decision` 加员,下面的 `never` 当场编译期红,而不是让一个新判词被
+ * 静默折成 `deny` 或漏成「没有决议」。
+ *
+ * 三条判据,缺一即 `null`(= 不回放,调用方逐字回落修前 404 —— **绝不**把 not-found 洗成成功):
+ *  ① 有 winner —— `resource_limit` / `wake` / `task_done` 的 resolve 不记 winner(core 契约),那些行
+ *     不是「一次人给的工具审批」,没有可回放的判词;
+ *  ② winner 绑的正是这次请求回显的那个 `boundCallId` —— 身份第二锚(列谓词是第一锚),两锚同意才算同一件事;
+ *  ③ 判词属于**工具审批**那两个词(`allow`/`deny`)—— `approve`/`reject`/`edit` 是 REVIEW 门
+ *     (plan_review / dry_run_review)的判词,那些门的决议入口不是本腿,回放它们等于跨门作答。
+ */
+export declare function approvalDecisionOfWinner(winner: ResolvedOutcome | undefined, boundCallId: string): "approve" | "deny" | null;
 /** `pending_steer` 列承载的两个 CheckpointState 字段(= core `appendPendingSteer` / `readPendingSteerQueue`
  *  的入参形)。列是**唯一**权威(suspend 时写的 blob 从不带它们)。 */
 type SteerColumnState = Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">;
@@ -431,6 +505,39 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * 维,列命中行结构上也必须解 blob 才拿得到它。
      */
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
+    /**
+     * #368 件1 —— 「这条会话上的这一次工具调用,**是不是已经被决过了**?」的窄读口(legacy `/decide`
+     * 腿的幂等回放判别器;返回形见 {@link DecidedApprovalRecord})。
+     *
+     * 为什么必须有这一口(而不是复用 `findPendingTokenBySession`):后者硬 `status='pending'`,首决之后
+     * 恒 null ⇒ 重试与「压根没有这条审批」在 wire 上同形(404)。而合规客户端的重试体里**没有**
+     * checkpointToken(它只回显二元组),所以既有的 `approval_stale` 409 那条判别路对它结构性不可达。
+     *
+     * 四条口径,逐条都是判据:
+     *  · **谓词 = (session_id, tool_call_id, status='resolved')**:`tool_call_id` 列是 `put()` 从
+     *    `pendingAction.toolCallId` 盖下来的权威投影,也正是 listPending 交给客户端回显的 `boundCallId`
+     *    ⇒ 客户端手里那把与库里这一列同源。`(session_id, status)` 是既有索引 `idx_checkpoint_session_status`
+     *    的前缀,不新增索引面。
+     *  · **只认 `resolved`**:`expired`(窗到期被 reaper 抹掉)**不是**一次决议 —— 把它回放成
+     *    「已决」等于把「没人来得及答」谎报成「有人答过」。那一形照旧落 404(诚实缺席)。
+     *  · **`decided_at_ms IS NOT NULL`**:与 respond 腿 `decidedRowIsAuthoritative` 的合取项③同判据
+     *    (「这条决议真的被结算腿落过」的印记);顺带消掉 MySQL/PG 对 `ORDER BY … DESC` 里 NULL 排序
+     *    方向不同这个方言差(MySQL NULL 最后、PG NULL 最前)—— 谓词先滤掉,排序就不含 NULL。
+     *  · **不带 scope 谓词、由调用方判属主**:与本类 `findPendingTokenBySession` 同姿势(读口不做租户
+     *    判决,判决在调用点)。回放腿据返回的 `scope` 做与 pending 那道**逐字同判**的属主门,非属主
+     *    拿到的仍是 404(不给存在性谕示)。
+     *
+     * 🔴 **返回的是全部命中行,不是「最近那一条」**(codex R1-[medium] 四,验真后改向):本口原先按
+     * `decided_at_ms DESC LIMIT 1` 取「最近一次决议」,而 local 孪生手里根本没有这个时间戳(core 的
+     * `Checkpoint` 上没有 decidedAt 字段),它只能按 `createdAt` 排 —— 两条车道于是可能对**同一批行**给出
+     * **不同**的判词(创建序与决议序相反时)。判据因此改成一条与排序**无关**的:调用方要求**全部命中行
+     * 判词一致**才回放,分歧即拒。同毫秒并列、两方言 NULL 排序差、跨车道排序键不同 —— 三个问题一起消失,
+     * 而现网正常形(恒 0 或 1 行)一个字节不变。上限 8 行足够:超过它的形已经不是「重试」而是数据异常。
+     *
+     * 坏 `outcome` cell **不抛**:回放是一条锦上添花的腿,让一条读不出的 JSON 把一次 decide 重试变成 500
+     * 比 404 更坏。留痕后交出 `decision: null`(= 判别不出),由调用方按「整次拒绝」处置。
+     */
+    findDecidedApprovalsForBinding(sessionId: string, boundCallId: string): Promise<DecidedApprovalRecord[]>;
     /**
      * The owner SCOPE of a session's pending checkpoint (the multi-tenant key === the owner principal in the
      * BFF/non-operator flow, the same key listPending filters by). For the /decide owner-gate: a non-operator

package/dist/plugins/checkpoint-store-sql.js

@@ -4,10 +4,12 @@ import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendi
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
+import { createLogger } from "../observability/logger.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
+const fingerprintLogger = createLogger();
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, (Number.isFinite(Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS)) ? Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) : 0) || 30 * 86_400_000);
 export const TERMINAL_GRACE_MS = 3_600_000;
@@ -79,6 +81,48 @@ export function boundedToolInput(args) {
         return { truncated: true, bytes: json.length };
     return redacted;
 }
+function canonicalFingerprintJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(canonicalFingerprintJson).join(",")}]`;
+    const entries = Object.entries(v)
+        .filter(([, val]) => val !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, val]) => `${JSON.stringify(k)}:${canonicalFingerprintJson(val)}`).join(",")}}`;
+}
+export function approvalPayloadFingerprint(v) {
+    try {
+        const fp = canonicalFingerprintJson([v.updatedInput ?? null, v.answer ?? null, v.reason ?? null]);
+        return fp;
+    }
+    catch (e) {
+        fingerprintLogger.warn("approval decision payload is not serializable — idempotent replay refused", { error: e instanceof Error ? e.message : String(e) });
+        return null;
+    }
+}
+export const DECIDED_REPLAY_SCAN_CAP = 8;
+export function approvalDecisionOfWinner(winner, boundCallId) {
+    if (winner === undefined)
+        return null;
+    if (winner.boundCallId !== boundCallId)
+        return null;
+    switch (winner.decision) {
+        case "allow":
+            return "approve";
+        case "deny":
+            return "deny";
+        case "approve":
+        case "reject":
+        case "edit":
+            return null;
+        default: {
+            const unhandled = winner.decision;
+            void unhandled;
+            return null;
+        }
+    }
+}
 function pendingActionToolCallId(blob) {
     let parsed;
     try {
@@ -429,6 +473,27 @@ export class SqlCheckpointStore {
         }
         return out;
     }
+    async findDecidedApprovalsForBinding(sessionId, boundCallId) {
+        const { rows } = await this.db.query(this.q("SELECT scope, bound_input_hash, outcome FROM checkpoint " +
+            `WHERE session_id=? AND tool_call_id=? AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`, "SELECT scope, bound_input_hash, outcome FROM checkpoint " +
+            `WHERE session_id=$1 AND tool_call_id=$2 AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`), [sessionId, boundCallId]);
+        return rows.map((r) => {
+            let winner;
+            try {
+                const outcome = parseJson(r.outcome);
+                winner = outcome ? winnerFromOutcome(outcome) : undefined;
+            }
+            catch (e) {
+                this.logger?.info?.("checkpoint_decided_outcome_unreadable", { sessionId, error: e instanceof Error ? e.message : String(e) });
+            }
+            return {
+                scope: String(r.scope),
+                boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
+                decision: approvalDecisionOfWinner(winner, boundCallId),
+                payloadFp: winner === undefined ? null : approvalPayloadFingerprint(winner),
+            };
+        });
+    }
     async peekPendingScope(sessionId) {
         const { rows } = await this.db.query(this.q("SELECT scope FROM checkpoint WHERE session_id=? AND status='pending' LIMIT 1", "SELECT scope FROM checkpoint WHERE session_id=$1 AND status='pending' LIMIT 1"), [sessionId]);
         if (!rows[0])