@sema-agent/server 7.50.0 → 7.52.0

package/dist/execution-lane-caps.js

@@ -0,0 +1,166 @@
+const NO = "unsupported";
+const YES = "supported";
+const SU = "single-user-only";
+export function executionLaneCaps(lane) {
+    switch (lane) {
+        case "in-process":
+            return {
+                callerCwd: NO,
+                backgroundShell: NO,
+                scheduler: NO,
+                lsp: NO,
+                sandboxSendUserFile: NO,
+                isolation: NO,
+                suspendable: NO,
+                remoteScratchpad: NO,
+                sandboxPathAdjudication: NO,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: YES,
+                coreRemoteExecutionEnv: NO,
+            };
+        case "host":
+            return {
+                callerCwd: SU,
+                backgroundShell: SU,
+                scheduler: SU,
+                lsp: SU,
+                sandboxSendUserFile: NO,
+                isolation: NO,
+                suspendable: NO,
+                remoteScratchpad: NO,
+                sandboxPathAdjudication: NO,
+                worktreeIsolation: YES,
+                memoryPersistenceCapable: YES,
+                hostFilePlane: YES,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "e2b":
+            return {
+                callerCwd: NO,
+                backgroundShell: YES,
+                scheduler: NO,
+                lsp: YES,
+                sandboxSendUserFile: YES,
+                isolation: YES,
+                suspendable: YES,
+                remoteScratchpad: YES,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "k8s":
+            return {
+                callerCwd: NO,
+                backgroundShell: YES,
+                scheduler: NO,
+                lsp: YES,
+                sandboxSendUserFile: YES,
+                isolation: YES,
+                suspendable: YES,
+                remoteScratchpad: YES,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "ssh":
+            return {
+                callerCwd: NO,
+                backgroundShell: NO,
+                scheduler: NO,
+                lsp: NO,
+                sandboxSendUserFile: SU,
+                isolation: NO,
+                suspendable: NO,
+                remoteScratchpad: YES,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "adb":
+            return {
+                callerCwd: NO,
+                backgroundShell: NO,
+                scheduler: NO,
+                lsp: NO,
+                sandboxSendUserFile: NO,
+                isolation: NO,
+                suspendable: NO,
+                remoteScratchpad: NO,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "local-docker":
+            return {
+                callerCwd: NO,
+                backgroundShell: NO,
+                scheduler: NO,
+                lsp: NO,
+                sandboxSendUserFile: NO,
+                isolation: YES,
+                suspendable: NO,
+                remoteScratchpad: YES,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+        case "device":
+            return {
+                callerCwd: YES,
+                backgroundShell: NO,
+                scheduler: NO,
+                lsp: NO,
+                sandboxSendUserFile: NO,
+                isolation: NO,
+                suspendable: NO,
+                remoteScratchpad: YES,
+                sandboxPathAdjudication: YES,
+                worktreeIsolation: NO,
+                memoryPersistenceCapable: NO,
+                hostFilePlane: NO,
+                coreRemoteExecutionEnv: YES,
+            };
+    }
+}
+const EXECUTION_LANE_WORDS = {
+    "in-process": true,
+    host: true,
+    e2b: true,
+    k8s: true,
+    ssh: true,
+    adb: true,
+    "local-docker": true,
+    device: true,
+};
+export function isExecutionLane(word) {
+    return Object.hasOwn(EXECUTION_LANE_WORDS, word);
+}
+export const ALL_EXECUTION_LANES = Object.freeze(Object.keys(EXECUTION_LANE_WORDS).filter(isExecutionLane));
+export function executionLaneOf(provider) {
+    if (provider === undefined)
+        return "in-process";
+    return isExecutionLane(provider) ? provider : undefined;
+}
+export function laneCapabilityHolds(cap, deployment) {
+    switch (cap) {
+        case "supported":
+            return true;
+        case "unsupported":
+            return false;
+        case "single-user-only":
+            return deployment.requirePrincipal !== true;
+    }
+}
+export const PLANNED_LANE_DIVERGENCES = Object.freeze([]);
+//# sourceMappingURL=execution-lane-caps.js.map

package/dist/fleet/fleet-bus.d.ts

@@ -102,7 +102,7 @@ export interface FleetTaskRow {
     transcriptId?: string;
     /** [1839]①/(a) 案:**终态行帧的残局键**——cli 实测裸 durable-run 完成时终态 task 帧键集只有
      *  [id,name,status,tokens,elapsedMs,description],idle 观察者(web 首屏形)从行卡拿不到终局。
-     *  (b) 案(为顶层 run 造 bg_notification)被否:那族语义=观察者眼里的**子代**,伪造事件族比丰富行帧
+     *  (b) 案(为顶层 run 造 bg_notification)被否:那族语义=观察者眼里的**子代**,自造事件族比丰富行帧
      *  更伤([1840]§二)。四键全部 ADDITIVE / tolerate-absent、**只在终态帧出现**:
      *  - `stoppedBy`:core open enum verbatim(与 BgNotification 同姿势);顶层 run 仅 cancel 路径有源
      *    (= "user",与 markStopSource 同源值),其余终态诚实缺席。

package/dist/fleet/fleet-reconciler.d.ts

@@ -64,7 +64,7 @@ export declare const FLEET_RECONCILE_INTERVAL_MS = 60000;
 /** 每周期的**点读上限**。超出的行留到下一周期(顺序稳定 = bus 的插入序),不把一次扫描变成全表点读风暴。 */
 export declare const FLEET_RECONCILE_MAX_ROWS = 200;
 /** 一个周期的 durable 读**时间预算**。超时 = 放弃这一轮(记 F 类 fail-open),行留在面板上。
- *  与 `FLEET_SNAPSHOT_TERMINAL_READ_BUDGET_MS` 同值同理由:慢查询不该把整条腿钉死。 */
+ *  与 `FLEET_SNAPSHOT_TERMINAL_READ_BUDGET_MS` 同值同理由:慢查询不该把整条腿卡住。 */
 export declare const FLEET_RECONCILE_READ_BUDGET_MS = 2000;
 /** 熔断冷却:一次读失败/超预算之后,这段时间内**不再发起任何读**。`RunStore`/`WorkflowRunStore` 契约
  *  都没有取消面(发出去的查询撤不回),挂死的后端不该被每周期继续加压。冷却一过自动重探(自愈)。 */

package/dist/fleet/fleet-terminal-window.d.ts

@@ -16,7 +16,7 @@
  * ## 为什么本模块有进程级可变状态(路由域刻意保持零状态,故不放在 `routes/fleet.ts`)
  * 三件都长在同一个事实上——**`WorkflowRunStore` 契约没有取消面**,`Promise.race` 只结束等待、撤不回
  * 已发出的查询:合流(重连风暴不按连接数放大,R1-H2)、合流窗有限(不把陈旧结果发给后来者、也不让
- * 一条永不 settle 的读把后续连接全钉死,R2-H1/R3-M2)、熔断冷却(挂死的后端不被每周期继续加压,
+ * 一条永不 settle 的读把后续连接全卡住,R2-H1/R3-M2)、熔断冷却(挂死的后端不被每周期继续加压,
  * R3-H1)。真解是店侧查询超时/取消 —— 要动契约与四个后端,已作移交项。
  *
  * ## scope

package/dist/http/active-run-conflict.d.ts

@@ -73,7 +73,7 @@ export interface PendingGateMaterial {
      *    ③ **材料读取失败**:整只 `pendingGate` 都不在(那时本键连位置都没有)。
      *  ⇒ 读作「不知道这道门叫什么」,**不是**「这道门没有身份」,更**不是**「这一定是条老行」。
      *
-     *  🔴 **它命名的是「本次 409 实际读到的那一行」,不是「activeTaskId 这条 run 的门」**(codex 对抗复审
+     *  🔴 **它命名的是「本次 409 实际读到的那一行」,不是「activeTaskId 这条 run 的门」**(codex 交叉复审
      *  R1-[high] 验真后如实登记):同 session 可以并存两条 pending checkpoint(表上**没有** per-session
      *  pending 唯一约束),而 `findPendingTokenBySession` 是**无序 `LIMIT 1`** —— 这个条件是本仓自己成文的
      *  已知事实(见 `src/http/server.ts` mintFreshRun 腿 409 那段的逐字论证:「两条 pending 并存时旧
@@ -147,7 +147,7 @@ export interface ActiveRunConflictDoneResult {
     /**
      * #316(c):与 409 body 同键同语义(见 {@link ActiveRunConflictBody.stale})。
      *
-     * 🔴 **跨仓欠账,如实登记**(codex 对抗复审 R1-[medium] 验真后的真形):sema-sdk 的
+     * 🔴 **跨仓欠账,如实登记**(codex 交叉复审 R1-[medium] 验真后的真形):sema-sdk 的
      * `spec/openapi.yaml` 里 `ActiveRunConflictDoneResult` 是 `additionalProperties: false` 的**封闭**
      * schema,今天只声明 `status/errorCode/errorMessage/activeTaskId/activeTaskStatus/pendingGate` 六键。
      * ⚠️ 亲验后的关键修正:这**不是本键引入的新问题** —— `msSinceLastActivity`(#245 S1)早就在这条

package/dist/http/principal-gate.d.ts

@@ -13,7 +13,7 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
- *  "true-for-all" is a world-writable RCE door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
+ *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
  *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.
  *  🔴 SINGLE mint point (E1): a byte-identical twin `explicitOperator` used to live below (image-visibility lane)
  *  and two more hand-inlined copies sat in approvals-assistant — a future hardening of this judgment would have

package/dist/http/route-ctx.d.ts

@@ -156,18 +156,38 @@ export interface RouteLegs {
      *
      *  `onTypedFailure` = 「typed 拒绝**别写响应**,交回给我」。默认(缺席)行为不变:`HttpError` 走
      *  `sendError` 连 `extra` 一起回显。DESIGN-269 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
-     *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表泄漏。 */
-    prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void): Promise<PreparedTaskSubmission | null>;
+     *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表外泄。 */
+    prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void, 
+    /** S-46 件C:**腿身份**(不是能力表态)。`liveStream: true` 只由 `POST /v1/tasks/stream` 的装配点按
+     *  URL 传 —— 那是全树唯一挂 HITL 活流投递面的腿,逐腿 `interactionPosture` 判据的第一条合取项。
+     *  缺席 ⇒ 无人腿(bg / A2A / resume),行为字节不变。 */
+    legFacts?: {
+        liveStream?: boolean;
+    }): Promise<PreparedTaskSubmission | null>;
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
     finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
      *  `settledBy` = **这次结算的出处**(core `ApprovalSettledBy`),必填:本腿有两个调用方(HTTP
      *  `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
      *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (overrideSessionId?: string) => Promise<void>, 
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+    /** S-02 codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
+     *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
+     *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`
+     *  = 无可记)一并回传,路由只对这个逐字落店。`overrideSessionId` = parked 腿的 root/host 会话 grant 锚。 */
+    onResumeCommitted?: (grant: {
+        overrideSessionId?: string;
+        validatedToolName: string | null;
+    }) => Promise<void>, 
     /** #316:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/decide` 腿传 `true`;
      *  内部 D-D SLA deny-sweep 不传 —— 它没有在等响应的人,提前受理对它零收益而少一条同步失败面。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** S-02:调用方已验身份的裁定 —— stale 臂铸 `currentPending` 指路键前在被读回的行上重跑 decide 门
+     *  同一属主判(缺席 ⇒ 恒不造键;判据属主=server.ts 铸键点注)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/routes/admin-memory-optout.d.ts

@@ -0,0 +1,48 @@
+/**
+ * design/383 §3.1 / S-50 §1.3(S-49 S-2)—— per-principal **memory-capture opt-out 授权表**的 operator 四口:
+ *
+ *   · `GET    /v1/admin/memory-optout`             → `{ deploymentDefault: Row|null, overrides: Row[] }`
+ *   · `PUT    /v1/admin/memory-optout`             body `{allow, note?}` → 部署缺省行 upsert(哨兵 `principal=''`)
+ *   · `PUT    /v1/admin/memory-optout/:principal`  body `{allow, note?}` → per-principal 覆盖行 upsert
+ *   · `DELETE /v1/admin/memory-optout/:principal`  → 撤覆盖(回落部署缺省);`{ deleted: boolean }` 诚实答
+ *
+ * Row = `{ principal, allow, updatedAtMs, updatedBy, note? }`(审计行内,S-50 §1.3;`updatedBy` = 调用方 operator
+ * principal,server 铸,body 不收)。
+ *
+ * ── 稿偏离两条(如实记)────────────────────────────────────────────────────────────────────────────
+ * ① S-50 §1.1/§1.3 写的是 `orgDefault` + `(org_id, principal)`。亲读本仓(2026-08-30 侦察):server **没有 org 身份维**
+ *    (租户维 = 单 principal;`org` 只是记忆 scope 目录里的词),给表/wire 铸一根没人能填的 `org_id` 是编数据。一台
+ *    worker = 一个租户面 ⇒ 「org 级缺省」落成**部署级缺省**,wire 键名随实体改叫 `deploymentDefault`。折叠律不变。
+ * ② S-50 §1.3 把部署缺省写成 `PUT …/memory-optout/default`。codex R1-[medium] 验真:`default` 是一个**合法 principal
+ *    拼写**,字面路径 `/default` 与 `%64efault`(解码后同为 `default`)在第一版里分派到**两个不同的行**(哨兵行 vs
+ *    一条名叫 default 的覆盖行)—— 命名空间碰撞,而且 DELETE 侧还不对称。修法不是「解码后再保留一个词」(那只是把
+ *    碰撞改成一条不可寻址的 principal),而是**让缺省行住在集合根**:`PUT /v1/admin/memory-optout`(集合本身的
+ *    「缺省」属性),`:principal` 面从此没有任何保留词,任何合法 principal(包括字面 `default`)都可寻址。
+ *
+ * ── 族属与门序 ────────────────────────────────────────────────────────────────────────────────────
+ * 与 `/v1/admin/drain` · `/v1/admin/config/refresh` · `/v1/admin/memory/consolidation` 逐字同族(operator lane:
+ * 同一条 `explicitOperatorOk` 门;billable=false;刻意不吃 drain / roster-pending 两道 503)。门序照 operator
+ * 面既有口径:身份(401)→ 授权(403)→ **能力(501)** → 验型(400)。授权在能力之前:一个够不着任何东西
+ * 的调用方不该从「这台有没有授权表」上读出部署形态。
+ * 🔴 四口都在 `isCredentialGatedRewrite`(server.ts)门内(codex R1-[high] 验真后补):授权的**唯一**输入是
+ * principal 头 ∧ 一次调用的爆炸半径跨租户(改缺省行 = 改整台部署每个 principal 的 verdict;读面 = 全部授权行 +
+ * operator 手写的 note)—— 无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的 worker 上那个头**可自造**,与
+ * `/v1/memory/erase` / `POST /v1/memory/export` 同一条论证。
+ *
+ * ── 为什么缺席形是 **501 `capability.*`** 而不是 404(与 consolidation 阀门刻意分家)──────────────────
+ * consolidation 的 404 说的是「旋钮没开」(运维表态,动作=开旋钮)。本面的缺席是「**这家店在本部署上不存在**」
+ * —— local 车道刻意不给授权表一个会遗忘的 in-memory twin(接口注),动作=换部署形态(接 SQL 后端)。那正是
+ * 本仓 501 `capability.*` 族的定义(`capability.memory_engine_required` / `capability.outcome_ledger_required`
+ * 同族)。能力位 `memoryOptOutGrant`(`GET /v1/capabilities`)读同一个事实 + operator 名单非空。
+ *
+ * ── 撤销窗(S-50 §1.4)──────────────────────────────────────────────────────────────────────────
+ * 写后**零缓存**:resolver 腿(`RuntimeCaps.allowMemoryOptOut`)每次 prepare 直读同一张表 ⇒ 下一次带声明的
+ * prepare 即读到新 verdict(撤权后新声明具名拒;已声明会话 record wins,core 判,server 零码)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+export declare const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
+/** 带参口(`:principal`)⇒ 名册门走 `ROUTE_LABEL_PATTERNS`(server.ts),不是 LITERALS。 */
+export declare const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE: RegExp;
+export declare function handleMemoryOptOut(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=admin-memory-optout.d.ts.map

package/dist/http/routes/admin-memory-optout.js

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { memoryOptOutPrincipalShapeProblem } from "../../plugins/memory-optout-grant-store-sql.js";
+export const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
+export const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE = /^\/v1\/admin\/memory-optout\/([^/]+)$/;
+const PutBodySchema = z.object({ allow: z.boolean(), note: z.string().min(1).max(500).optional() }).strict();
+export async function handleMemoryOptOut(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+function decideVerb(method, path, safeDecode) {
+    if (path === ADMIN_MEMORY_OPTOUT_PATH) {
+        if (method === "GET")
+            return { kind: "list" };
+        if (method === "PUT")
+            return { kind: "putDefault" };
+        return undefined;
+    }
+    const m = ADMIN_MEMORY_OPTOUT_OVERRIDE_RE.exec(path);
+    if (m === null)
+        return undefined;
+    if (method !== "PUT" && method !== "DELETE")
+        return undefined;
+    const principal = safeDecode(m[1]);
+    if (principal === null)
+        return "malformed";
+    return method === "PUT" ? { kind: "putOverride", principal } : { kind: "deleteOverride", principal };
+}
+async function handleBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const path = url.split("?")[0] ?? url;
+    const verb = decideVerb(req.method, path, ctx.helpers.safeDecode);
+    if (verb === undefined) {
+        miss.fell = true;
+        return;
+    }
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && !principal) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return;
+    }
+    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+        sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable these endpoints)");
+        return;
+    }
+    const operator = principal;
+    const store = deps.memoryOptOutGrant;
+    if (store === undefined) {
+        sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no forgetting twin — wire a SQL backend to administer opt-out grants");
+        return;
+    }
+    if (verb === "malformed" || ((verb.kind === "putOverride" || verb.kind === "deleteOverride") && memoryOptOutPrincipalShapeProblem(verb.principal) !== undefined)) {
+        sendError(res, 400, "request.path_malformed", "invalid memory opt-out grant principal — the path segment must percent-decode to a non-empty principal of at most 190 chars with no leading/trailing whitespace or control characters (the deployment default row is addressed by PUT on the collection root, not by a path segment)");
+        return;
+    }
+    if (verb.kind === "list") {
+        sendJson(res, 200, await store.list());
+        return;
+    }
+    if (verb.kind === "deleteOverride") {
+        sendJson(res, 200, { principal: verb.principal, deleted: await store.deleteOverride(verb.principal) });
+        return;
+    }
+    const parsed = PutBodySchema.safeParse(await ctx.helpers.readJson(req));
+    if (!parsed.success) {
+        sendError(res, 400, "request.body_shape", "invalid memory opt-out grant body — expected exactly { allow: boolean, note?: string (1..500 chars) }; unknown keys are refused (a mistyped `allow` must not silently become a no-op)");
+        return;
+    }
+    const input = { allow: parsed.data.allow, updatedBy: operator, ...(parsed.data.note !== undefined ? { note: parsed.data.note } : {}) };
+    const row = verb.kind === "putDefault" ? await store.putDefault(input) : await store.putOverride(verb.principal, input);
+    sendJson(res, 200, row);
+}
+//# sourceMappingURL=admin-memory-optout.js.map

package/dist/http/routes/agents-roster.d.ts

@@ -16,7 +16,7 @@
  *
  * ## 三条边界(逐条对着失败形写)
  *  · **principal 门 + 反枚举**:身份判在店可用性判**之前**(否则「这台有没有装店」会先于 401 泄出去,
- *    与 `GET /v1/sessions` 的同款注释);principal 调用方**钉死自己的 scope**(`?scope=` 对它无效),
+ *    与 `GET /v1/sessions` 的同款注释);principal 调用方**锁定自己的 scope**(`?scope=` 对它无效),
  *    于是别的租户的行不是「403」也不是「空 200 但 total 多 1」——它在这个名册里**根本不存在**,
  *    没有任何可判别面(`total` 同样是属主口径:一个多出来的计数就是存在性 oracle)。
  *  · **投影白名单**(照 `routes/fleet.ts` `stripT` 的姿势):逐键**显式拼**,并用

package/dist/http/routes/approvals-assistant.js

@@ -38,6 +38,8 @@ async function decideIdempotentReplay(cs, args) {
     const boundCallId = binding.boundCallId;
     if (boundCallId === undefined)
         return undefined;
+    if (binding.checkpointToken !== undefined)
+        return undefined;
     if (typeof cs.findDecidedApprovalsForBinding !== "function")
         return undefined;
     const rows = await cs.findDecidedApprovalsForBinding(sessionId, boundCallId);
@@ -463,30 +465,28 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     return;
                 }
             }
-            let rememberToolName = null;
-            if (remember) {
-                const tok = await cs.findPendingTokenBySession(sessionId);
-                const cp0 = tok ? await cs.get(tok) : null;
-                const pa0 = cp0?.pendingAction;
-                const tn = pa0 && pa0.kind === "tool_approval" ? pa0.toolName : null;
-                rememberToolName = tn && tn !== "AskUserQuestion" ? tn : null;
-            }
             let rememberApplied = false;
-            const grantOnCommit = remember && deps.approvalExemptionStore && rememberToolName
-                ? async (overrideSessionId) => {
-                    const grantSessionId = overrideSessionId ?? sessionId;
-                    try {
-                        const canonical = rememberToolName;
-                        await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
-                        rememberApplied = true;
-                        deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
-                    }
-                    catch (e) {
-                        deps.logger?.warn?.("approval_exemption_grant_failed", { sessionId: grantSessionId, toolName: rememberToolName, error: String(e).slice(0, 200) });
-                    }
+            let pendingGrant;
+            const grantOnCommit = remember && deps.approvalExemptionStore
+                ? async (grant) => {
+                    const canonical = grant.validatedToolName;
+                    if (!canonical)
+                        return;
+                    pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true);
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const outErrorCode = out.body.errorCode;
+            if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
+                try {
+                    await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
+                    rememberApplied = true;
+                    deps.logger?.info?.("approval_exemption_granted", { sessionId: pendingGrant.sessionId, toolName: pendingGrant.toolName, grantedBy: deciderPrincipal ?? null });
+                }
+                catch (e) {
+                    deps.logger?.warn?.("approval_exemption_grant_failed", { sessionId: pendingGrant.sessionId, toolName: pendingGrant.toolName, error: String(e).slice(0, 200) });
+                }
+            }
             const replay = await decideIdempotentReplay(cs, {
                 sessionId,
                 out,

package/dist/http/routes/capabilities.js

@@ -2,12 +2,14 @@ import { DEFAULT_EFFORT_LEVELS, expandTiers, routePairingStatus } from "@sema-ag
 import { isModelAllowlisted } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
-import { cwdHonored } from "../../task-cwd.js";
+import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
+import { workflowModelAllowlistFor } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
@@ -47,28 +49,28 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             artifacts: Boolean(deps.runStore),
             approvals: Boolean(deps.checkpointStore),
             sessions: Boolean(deps.sessionAudit),
+            deviceExecutor: deps.deviceHub
+                ? { enabled: true, protocolVersion: DEVICE_PROTOCOL_VERSION, maxInflightPerDevice: deps.config.remoteExec?.provider === "device" ? (deps.config.remoteExec.maxInflightPerDevice ?? 4) : 4, wsPath: DEVICE_WS_PATH }
+                : false,
             sessionEvents: Boolean(deps.sessionWatch && deps.sessionStorage?.getLeafId && deps.sessionStorage?.ownerOf),
             fleet: deps.fleetBus
                 ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "advisory", hookFailureNotice: true }
                 : false,
-            workspace: (() => {
-                const wfs = deps.fileSnapshotStore;
-                return wfs && typeof wfs.listKeys === "function" && typeof wfs.exportManifest === "function" && typeof wfs.getBlob === "function" && Boolean(deps.sessionStorage?.ownerOf)
-                    ? { browse: true, archive: true, maxFileBytes: deps.config.workspaceFileMaxBytes ?? 8 * 1024 * 1024 }
-                    : false;
-            })(),
+            workspace: false,
             leader: Boolean(deps.leaderEndpoint),
             images: Boolean(deps.imageIndex),
             memory: false,
             memoryWrite: false,
             memoryEngine: projectMemoryEngineCapability(deps.memoryPosture),
             sessionBackgroundable: Boolean(deps.runStore),
+            runMemoryCaptureOptOut: Boolean(deps.runStore),
             sharedMemory: Boolean(deps.sharedMemoryStore && deps.orgMemoryDirectory),
             adoption: Boolean(deps.backend?.adoptionLog) && deps.config.operatorPrincipals.length > 0,
             memoryBundle: Boolean(deps.memoryBundleExport && deps.memoryBundleImport) && deps.config.operatorPrincipals.length > 0,
             memoryCompliance: Boolean(deps.memoryCompliance) && deps.config.operatorPrincipals.length > 0,
             memoryOrigin: Boolean(deps.memoryOriginFace) && deps.config.operatorPrincipals.length > 0,
             memoryConsolidationDriver: Boolean(deps.memoryConsolidation) && deps.config.operatorPrincipals.length > 0,
+            memoryOptOutGrant: Boolean(deps.memoryOptOutGrant) && deps.config.operatorPrincipals.length > 0,
             outcomeLedger: Boolean(deps.outcomeSink?.summary) && (deps.config.requirePrincipal !== true || deps.config.operatorPrincipals.length > 0),
             permissionRules: Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined,
             permissionRulesRevoke: Boolean(deps.ruleConsent),
@@ -86,7 +88,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             scratchpadDir: true,
             subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
             subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
-            taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config), hooks: deps.config.requirePrincipal !== true },
+            taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: deps.config.requirePrincipal !== true },
             modeShellGateTranslation: true,
             permissionModeAuto: {
                 accepted: true,
@@ -103,6 +105,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             retainBackgroundProcesses: deps.config.requirePrincipal !== true,
             interactiveTools: true,
             projectContext: cwdHonored(deps.config),
+            callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
             mcpInjection: mcpInjectionHonored(deps.config),
             a2a: true,
             a2aInjection: a2aInjectionHonored(deps.config),
@@ -130,15 +133,28 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             resumeAt: Boolean(deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
             promptSuggestions: true,
             sessionPolicy: Boolean(deps.sessionPolicyStore),
-            rewindFiles: Boolean(deps.fileSnapshotStore),
-            rewindFilesTo: Boolean(deps.fileSnapshotStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+            rewindFiles: Boolean(deps.fileHistoryStore),
+            restoreFiles: Boolean(deps.fileHistoryStore),
+            rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
             scheduler: Boolean(deps.config.schedulerEnabled && deps.config.requirePrincipal !== true && deps.config.remoteExec?.provider === "host"),
-            sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileSnapshotStore),
+            sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileHistoryStore),
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             sendUserFileLedger: Boolean(deps.sendFileLedger),
             workflows: deps.workflowsCapable ?? Boolean(deps.workflowRunStore),
             workflowsList: Boolean(deps.workflowRunStore),
+            workflowModels: (() => {
+                const allow = deps.workflowModelAllowlist
+                    ?? workflowModelAllowlistFor({
+                        selfOrchestrationModels: deps.config.selfOrchestrationModels ?? [],
+                        requirePrincipal: deps.config.requirePrincipal,
+                        models: deps.config.models ?? {},
+                    })
+                    ?? [];
+                const bare = deps.config.models ?? {};
+                const live = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
+                return allow.filter((n) => Object.hasOwn(live, n));
+            })(),
             manualCompact: Boolean(deps.runStore),
         });
         return;

package/dist/http/routes/diagnostics.d.ts

@@ -91,7 +91,7 @@ export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, l
  * 走认证(全局门),不进本臂。
  *
  * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
- * 是伪造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
+ * 是自造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
  * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
  */
 export declare function zeroCredentialLoopbackDenied(remoteAddress: string | undefined, config: {

package/dist/http/routes/leader.d.ts

@@ -2,7 +2,7 @@
  * design/158 A9 域模块 —— v2 leader 端点(design/50)。
  *
  * 路由:`POST /v1/leader`(异步,形同 `/v1/runs`)· `GET /v1/leader/:id`。整域由 `deps.leaderEndpoint`
- * 的存在与否开关;身份层与 `/v1/runs` 同款(BL-4:此前整条路绕过 authorize/requirePrincipal 且不记 owner,
+ * 的存在与否开关;身份层与 `/v1/runs` 同款(BL-4:此前整条路跳过 authorize/requirePrincipal 且不记 owner,
  * 任何持服务令牌者能提交/读任意租户的 leader run),owner 用 crypto 验证过的 `gatedPrincipal`。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/memory-bundle.d.ts

@@ -27,7 +27,7 @@
  *  · 记忆引擎整个没接线(`MEMORY_ENGINE=off` / 多租 file 底座等暗态);
  *  · 引擎接了但后端没有 bundle 复合面(pg/tidb 孪生)—— 这一支在**挂载期**就判掉了
  *    (`createMemoryBundleFaces` 返回 undefined ⇒ 两口整个不挂),能力位 `memoryBundle` 因此与「路由真能用」
- *    严格同真。🔴 首版把它当运行期事实(照常挂载、让 core 每次抛 409/422),被 codex 对抗复审驳倒并改此形:
+ *    严格同真。🔴 首版把它当运行期事实(照常挂载、让 core 每次抛 409/422),被 codex 交叉复审驳倒并改此形:
  *    面在不在是一次**属性检查**、boot 期判得出、且是**永久**缺席 ⇒ 照常挂着就是一个恒假的 yes,
  *    壳会据此给用户开出一条走不通的迁移流程。
  * ⚠️ 与**运行期**拒别混:后端**有**复合面但托管链 chain-degraded 时,core 照样抛

package/dist/http/routes/memory-bundle.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
+import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 export const MEMORY_BUNDLE_EXPORT_PATH = "/v1/memory/export";
 export const MEMORY_BUNDLE_IMPORT_PATH = "/v1/memory/import";
@@ -93,7 +94,8 @@ async function handleMemoryBundleBody(req, res, url, ctx, miss) {
         }
         try {
             const bundle = await engineExport(parsed.data.scopes);
-            sendJson(res, 200, bundle);
+            const fence = buildOriginFence(bundle.entries, readOriginAware(new URL(req.url ?? "", "http://x").searchParams));
+            sendJson(res, 200, fence.withheldOriginTagged !== undefined ? { ...bundle, entries: fence.entries, withheldOriginTagged: fence.withheldOriginTagged } : bundle);
         }
         catch (err) {
             if (!sentClassifiedFailure(res, ctx, "export", err))