@sema-agent/server 7.55.0 → 7.57.0

package/dist/http/server.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
 import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME } from "@sema-agent/core";
@@ -8,7 +9,9 @@ import {} from "../config-center/facade.js";
 import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, taskSettingsKeyIssue } from "../task-settings.js";
+import { selfOrchestrationDenial } from "../task-workflow.js";
+import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
@@ -23,6 +26,7 @@ import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
+import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import {} from "../observability/rate-limit.js";
@@ -31,6 +35,7 @@ import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEve
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
+import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
@@ -246,7 +251,7 @@ export function createHttpServer(rawDeps) {
                     res.end();
                 return;
             }
-            deps.logger?.error("request_error", { method: req.method, url: req.url, err: msg(err) });
+            deps.logger?.error("request_error", { method: req.method, url: req.url, err: redactHead(msg(err), 2000) });
             if (!res.headersSent)
                 sendError(res, 500, "internal.error", "internal error");
             else
@@ -257,7 +262,7 @@ export function createHttpServer(rawDeps) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, resumePlanReview },
     };
@@ -289,7 +294,7 @@ export function createHttpServer(rawDeps) {
             deps.metrics?.inc("http_requests_total", { route, method, status });
             deps.metrics?.observe("http_request_duration_seconds", seconds, { route });
             const log = route === "/health" || route === "/metrics" ? deps.logger?.debug : deps.logger?.info;
-            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(aborted ? { aborted: true, ...(reqState.streamTaskId ? { taskId: reqState.streamTaskId } : {}), ...(reqState.streamDetached ? { detached: true } : {}) } : {}) });
+            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(reqState.runStatus !== undefined ? { runStatus: reqState.runStatus } : {}), ...(reqState.runErrorCode !== undefined ? { errorCode: reqState.runErrorCode } : {}), ...(aborted ? { aborted: true, ...(reqState.streamTaskId ? { taskId: reqState.streamTaskId } : {}), ...(reqState.streamDetached ? { detached: true } : {}) } : {}) });
         };
         res.on("finish", () => record(false));
         res.on("close", () => record(true));
@@ -582,6 +587,13 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
             const st = settingsRaw;
+            {
+                const keyIssue = taskSettingsKeyIssue(st);
+                if (keyIssue) {
+                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    return null;
+                }
+            }
             if (typeof st.outputStyle === "string" && st.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
                 sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`);
                 return null;
@@ -764,6 +776,19 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "enableFork must be a boolean");
             return null;
         }
+        if (body.selfOrchestration !== undefined && typeof body.selfOrchestration !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "selfOrchestration must be a boolean");
+            return null;
+        }
+        {
+            const denial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
+            const wantsSelfOrchestration = body.selfOrchestration === true
+                || parseTaskSettings(body.settings).settings?.ultracode === true;
+            if (denial !== null && wantsSelfOrchestration) {
+                sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
+                return null;
+            }
+        }
         if (body.resilience !== undefined) {
             const r = body.resilience;
             if (typeof r !== "object" || r === null || Array.isArray(r)) {
@@ -895,6 +920,11 @@ export function createHttpServer(rawDeps) {
                         sendError(res, 400, "request.field_invalid", 'settings.permissions.defaultMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
                         return null;
                     }
+                    const d = p.disableAutoMode;
+                    if (d !== undefined && d !== "disable" && d !== true && d !== false) {
+                        sendError(res, 400, "request.field_invalid", 'settings.permissions.disableAutoMode must be the literal "disable" or a boolean when present (omit it to leave auto mode available)');
+                        return null;
+                    }
                 }
             }
         }
@@ -1039,16 +1069,25 @@ export function createHttpServer(rawDeps) {
         }
         const cpPromise = cs.get(token);
         const ctxPromise = cs.getCtx(sessionId);
+        void ctxPromise.catch(() => { });
+        const noApproval = { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
         let cp;
         try {
             cp = await cpPromise;
         }
         catch (e) {
             void ctxPromise.catch(() => { });
+            if (!(await mayDiscloseRowError(cs, token, decider))) {
+                deps.logger?.warn?.("approval_decide_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
+                return noApproval;
+            }
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
-        if (!cp)
+        if (!cp) {
+            if (!(await mayDiscloseRowError(cs, token, decider)))
+                return noApproval;
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        }
         if (decider !== undefined && !decider.explicitOperator) {
             const cpOwner = decodeCheckpointScope(cp.scope);
             if (cpOwner !== undefined && cpOwner !== decider.principal) {
@@ -1109,12 +1148,41 @@ export function createHttpServer(rawDeps) {
         const boundGrant = onResumeCommitted
             ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
             : undefined;
+        const lateSettleSink = deps.approvalLateSettle;
+        const lateSettleAnchor = lateSettleSink !== undefined && req !== undefined && token
+            ? {
+                sessionId: cp.sessionId,
+                ...(paForGrant?.toolCallId !== undefined ? { toolCallId: paForGrant.toolCallId } : {}),
+                checkpointTokenHash: buildCheckpointAnchorHash(token),
+            }
+            : undefined;
+        const noteLateSettleIfAccepted = (out) => {
+            if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
+                return;
+            if (out.body?.errorCode === "cancelled")
+                return;
+            try {
+                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", settledBy, settledAtMs: Date.now() });
+            }
+            catch (e) {
+                recordFailOpen("server.approval-ask-audit.append-failed", `kind=late_settle err=${e instanceof Error ? e.message : String(e)}`);
+            }
+        };
+        const parkedForkQuotaDenial = req !== undefined ? ownerCostQuotaDenied(decodeCheckpointScope(cp.scope)) : undefined;
+        if (parkedForkQuotaDenial)
+            return parkedForkQuotaDenial;
+        const parkedForkLeaseDenial = req !== undefined ? await ownerFleetLeaseDenied(decodeCheckpointScope(cp.scope)) : undefined;
+        if (parkedForkLeaseDenial)
+            return parkedForkLeaseDenial;
+        const ownerLeaseAdmittedHere = req !== undefined;
         if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
-            const parked = await decideParkedAgent({
-                agentStore: deps.backgroundAgentStore,
+            const parkedAgentStore = deps.backgroundAgentStore;
+            const parkedTool = deps.parkedReviveTool;
+            const parked = await withPrincipal(decodeCheckpointScope(cp.scope), () => decideParkedAgent({
+                agentStore: parkedAgentStore,
                 checkpointStore: cs,
                 registry: defaultTaskRegistry,
-                reviveTool: deps.parkedReviveTool,
+                reviveTool: parkedTool,
                 ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                 ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                 ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
@@ -1124,9 +1192,10 @@ export function createHttpServer(rawDeps) {
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
                 ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
-            });
+            }));
             if (parked !== undefined) {
                 void ctxPromise.catch(() => { });
+                noteLateSettleIfAccepted(parked);
                 return parked;
             }
         }
@@ -1191,7 +1260,9 @@ export function createHttpServer(rawDeps) {
             settledBy,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
+        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+        noteLateSettleIfAccepted(driven);
+        return driven;
     }
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
@@ -1208,7 +1279,7 @@ export function createHttpServer(rawDeps) {
         }, (err) => {
             if (!wasAccepted)
                 return;
-            deps.logger?.error?.("resume_leg_threw_after_accept", { sessionId: args.sessionId, err: err instanceof Error ? err.message : String(err) });
+            deps.logger?.error?.("resume_leg_threw_after_accept", { sessionId: args.sessionId, err: redactHead(err instanceof Error ? err.message : String(err), 2000) });
             deps.metrics?.inc("resume_post_accept_failed_total");
         });
         return await Promise.race([accepted, leg]);
@@ -1224,19 +1295,18 @@ export function createHttpServer(rawDeps) {
         }).active;
         const approvalLeg = resolveApprovalLeg({
             streamApprovalOn,
-            windowMs: deps.config.streamApproval?.windowMs ?? 0,
+            windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
             ...(typeof taskConfig.limits?.maxWalltimeMs === "number" ? { legWalltimeMs: taskConfig.limits.maxWalltimeMs } : {}),
             nowMonotonicMs: performance.now(),
         });
         const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-        if (deps.fleetLease && principal) {
-            const adm = await deps.fleetLease.admit(principal);
-            if (!adm.ok) {
-                deps.metrics?.inc("fleet_lease_rejected_total");
-                return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
-            }
-        }
+        const ownerQuotaDenial = args.callerInitiated === true ? ownerCostQuotaDenied(principal) : undefined;
+        if (ownerQuotaDenial)
+            return ownerQuotaDenial;
+        const ownerLeaseDenial = args.callerInitiated === true && args.ownerLeaseAdmitted !== true ? await ownerFleetLeaseDenied(principal) : undefined;
+        if (ownerLeaseDenial)
+            return ownerLeaseDenial;
         let taskId = await deps.runStore?.getActiveTaskId(sessionId);
         let freshRunClaimed = false;
         if (args.mintFreshRun && taskId && deps.runStore) {
@@ -1764,7 +1834,7 @@ export function createHttpServer(rawDeps) {
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
             }
             if (claimedRow && taskId && deps.runStore) {
-                await deps.runStore.setTerminal(taskId, "failed", null, e instanceof Error ? e.message : String(e)).catch(() => undefined);
+                await deps.runStore.setTerminal(taskId, "failed", null, errorText(e)).catch(() => undefined);
             }
             settleFleet("failed");
             throw e;
@@ -1804,26 +1874,66 @@ export function createHttpServer(rawDeps) {
                 taskId, sessionId, status: result.status,
                 bindingEnforced: true,
                 ...(result.errorCode ? { errorCode: result.errorCode } : {}),
-                ...(result.errorMessage ? { errorMessage: redactSecrets(result.errorMessage) } : {}),
+                ...(result.errorMessage ? { errorMessage: redactErrorMessage(result.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
             },
         };
     }
-    async function resumePreempted(sessionId, req, acceptEarly) {
+    async function mayDiscloseRowError(cs, token, decider) {
+        if (decider === undefined || decider.explicitOperator)
+            return true;
+        let scope;
+        try {
+            scope = await cs.peekScopeByToken(token);
+        }
+        catch (e) {
+            deps.logger?.warn?.("checkpoint_owner_probe_unreadable", { note: "peekScopeByToken failed — row-error disclosure withheld (fail-closed)", err: e instanceof Error ? e.message : String(e) });
+            return false;
+        }
+        if (scope === undefined)
+            return false;
+        const owner = decodeCheckpointScope(scope ?? CHECKPOINT_PUBLIC_SCOPE);
+        return owner === undefined || owner === decider.principal;
+    }
+    async function resumePreempted(sessionId, req, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const RESUMABLE_GATE_KIND = "resource_limit";
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: [RESUMABLE_GATE_KIND] })) ?? (await cs.findPendingTokenBySession(sessionId));
+        const preemptBinding = { gateKinds: [RESUMABLE_GATE_KIND] };
+        const token = (await cs.findPendingTokenBySession(sessionId, undefined, preemptBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
+        const noSuspension = { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)", errorCode: "not_found.suspension" } };
         if (!token)
-            return { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)", errorCode: "not_found.suspension" } };
+            return noSuspension;
+        if (decider !== undefined && !decider.explicitOperator) {
+            const peeked = await cs
+                .peekPendingScope(sessionId, preemptBinding)
+                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
+                .catch(() => undefined);
+            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
+            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
+                deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
+                return noSuspension;
+            }
+        }
         let cp;
         try {
             cp = await cs.get(token);
         }
         catch (e) {
+            if (!(await mayDiscloseRowError(cs, token, decider))) {
+                deps.logger?.warn?.("assistant_resume_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
+                return noSuspension;
+            }
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
-        if (!cp)
+        if (!cp) {
+            if (!(await mayDiscloseRowError(cs, token, decider)))
+                return noSuspension;
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        }
+        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
+            deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
+            return noSuspension;
+        }
         const gateKind = cp.gate?.kind;
         if (gateKind !== RESUMABLE_GATE_KIND) {
             return { status: 409, body: { error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide`, errorCode: "gate_not_resumable" } };
@@ -1835,7 +1945,7 @@ export function createHttpServer(rawDeps) {
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     async function resumeWake(sessionId, message, caller, req, acceptEarly) {
         const cs = deps.checkpointStore;
@@ -1856,10 +1966,18 @@ export function createHttpServer(rawDeps) {
             cp = await cs.get(token);
         }
         catch (e) {
+            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
+                deps.logger?.warn?.("wake_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
+                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
+            }
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
-        if (!cp)
+        if (!cp) {
+            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
+                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
+            }
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        }
         if (!operator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== caller) {
             return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
         }
@@ -1897,9 +2015,10 @@ export function createHttpServer(rawDeps) {
             verifyRounds: undefined,
             mintFreshRun: { source: "wake" },
             ...(acceptEarly === true ? { acceptEarly: true } : {}),
+            ...(req !== undefined ? { callerInitiated: true } : {}),
         });
     }
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly) {
+    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const log404 = (r) => deps.logger?.info?.("decide_404", {
             reason: r,
@@ -1907,22 +2026,45 @@ export function createHttpServer(rawDeps) {
             ...(log?.principalPresent !== undefined ? { principalPresent: log.principalPresent } : {}),
         });
         const PLAN_REVIEW_GATE_KIND = "plan_review";
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: [PLAN_REVIEW_GATE_KIND] })) ?? (await cs.findPendingTokenBySession(sessionId));
+        const planReviewBinding = { gateKinds: [PLAN_REVIEW_GATE_KIND] };
+        const token = (await cs.findPendingTokenBySession(sessionId, undefined, planReviewBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
+        const noPending = { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
         if (!token) {
             log404("no-pending-checkpoint");
-            return { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
+            return noPending;
+        }
+        if (decider !== undefined && !decider.explicitOperator) {
+            const peeked = await cs
+                .peekPendingScope(sessionId, planReviewBinding)
+                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
+                .catch(() => undefined);
+            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
+            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
+                deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
+                return noPending;
+            }
         }
         let cp;
         try {
             cp = await cs.get(token);
         }
         catch (e) {
+            if (!(await mayDiscloseRowError(cs, token, decider))) {
+                deps.logger?.warn?.("plan_review_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
+                return noPending;
+            }
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp) {
             log404("checkpoint-missing");
+            if (!(await mayDiscloseRowError(cs, token, decider)))
+                return noPending;
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         }
+        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
+            deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
+            return noPending;
+        }
         const gateKind = cp.gate?.kind;
         if (gateKind !== PLAN_REVIEW_GATE_KIND) {
             return {
@@ -1946,7 +2088,7 @@ export function createHttpServer(rawDeps) {
             ...(editedPlan !== undefined ? { editedPlan } : {}),
             ...(reason ? { reason } : {}),
         };
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}) });
+        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     function recordTaskResult(result) {
         deps.metrics?.inc("tasks_total", { status: result.status });
@@ -1985,6 +2127,44 @@ export function createHttpServer(rawDeps) {
         sendError(res, 429, "limit.cost_quota_exceeded", "cost quota exceeded", { usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec });
         return true;
     }
+    function ownerCostQuotaDenied(principal) {
+        if (!deps.costQuota || !principal)
+            return undefined;
+        const d = deps.costQuota.check(principal);
+        if (d.allowed)
+            return undefined;
+        deps.metrics?.inc("cost_quota_rejected_total");
+        return { status: 429, body: { error: "cost quota exceeded", errorCode: "limit.cost_quota_exceeded", usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec } };
+    }
+    async function ownerFleetLeaseDenied(owner) {
+        if (!deps.fleetLease || !owner)
+            return undefined;
+        const adm = await deps.fleetLease.admit(owner);
+        if (adm.ok)
+            return undefined;
+        deps.metrics?.inc("fleet_lease_rejected_total");
+        return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
+    }
+    async function ownerLeaseDenied(res, owner) {
+        if (!deps.fleetLease || !owner)
+            return false;
+        const adm = await deps.fleetLease.admit(owner);
+        if (adm.ok)
+            return false;
+        deps.metrics?.inc("fleet_lease_rejected_total");
+        res.setHeader("retry-after", String(adm.retryAfterSec));
+        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        return true;
+    }
+    function ownerQuotaDenied(res, owner) {
+        const denial = ownerCostQuotaDenied(owner);
+        if (!denial)
+            return false;
+        const { errorCode, error, ...extras } = denial.body;
+        res.setHeader("retry-after", String(extras.retryAfterSec));
+        sendError(res, denial.status, errorCode, error, extras);
+        return true;
+    }
     async function leaseDenied(req, res) {
         if (!deps.fleetLease)
             return false;
@@ -2106,7 +2286,7 @@ export function createHttpServer(rawDeps) {
         if (chunks.length === 0)
             return {};
         try {
-            return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            return JSON.parse(Buffer.concat(chunks).toString("utf8")) ?? {};
         }
         catch {
             throw new HttpError(400, "invalid JSON body");
@@ -2168,7 +2348,7 @@ export function createHttpServer(rawDeps) {
                 continue;
             }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", "timeout").then((r) => { if (r.status >= 400)
-                deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, body: r.body }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: e instanceof Error ? e.message : String(e) }));
+                deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, errorCode: r.body?.errorCode }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
@@ -2220,6 +2400,10 @@ export function createHttpServer(rawDeps) {
             cp = await cs.get(req.gateToken);
         }
         catch (e) {
+            if (!(await mayDiscloseRowError(cs, req.gateToken, { principal: req.principal, explicitOperator: false }))) {
+                deps.logger?.warn?.("parked_late_decision_unreadable_row_withheld", { askId: req.askId });
+                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
+            }
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp) {
@@ -2334,7 +2518,9 @@ const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
     [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
     [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
-    [/^\/v1\/(elicitations|questions|tool-approvals)\/[^/]+\/respond$/, "/v1/$hitl/:id/respond"],
+    [/^\/v1\/elicitations\/[^/]+\/respond$/, "/v1/elicitations/:id/respond"],
+    [/^\/v1\/questions\/[^/]+\/respond$/, "/v1/questions/:id/respond"],
+    [/^\/v1\/tool-approvals\/[^/]+\/respond$/, "/v1/tool-approvals/:id/respond"],
     [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
     [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
     [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],

package/dist/http/wire-types.d.ts

@@ -364,10 +364,15 @@ export interface TaskRequestBody {
      *  shared settings keys on every path, while `settings.webSearch` has its OWN validator on the single-user
      *  scenario lane (capabilities/scenarios.ts `webSearchConfigFromSettings` — the multi-tenant lane ignores it
      *  by design). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
-     *  runtime drops garbage): a non-array object bag, or omit the key. Runtime is more tolerant than the type on
-     *  purpose — a `null` reads as absence on both the fresh-submit wall (prepareSpec) and replay
-     *  (parseTaskSettings), and malformed forms 400 on submit / no-op on replay. ([ref] 件1 leftover key,
-     *  declared 2026-08-31; ownership wording per codex adversarial round.) */
+     *  runtime drops garbage): a non-array object bag, or omit the key. A `null` reads as absence on both the
+     *  fresh-submit wall (prepareSpec) and replay (parseTaskSettings), and malformed forms 400 on submit /
+     *  no-op on replay. ([ref] 件1 leftover key, declared 2026-08-31; ownership wording per codex adversarial round.)
+     *
+     *  🔴 [ref] 件①(PM 裁「拒」[ref])—— **KEY SET 上运行时不再比类型宽**:`Record<string, unknown>` 的开放
+     *  下标是 TS 形状,不是受理面。FRESH 提交腿上顶层 / `settings.permissions` 的**受理键是闭集**
+     *  ({@link taskSettingsKeyIssue} 的两张表),集外键 400 `request.body_shape` + 逐字列名(`unknownKeys` /
+     *  `unsupportedKeys`)。RESUME 重放腿照旧宽容(`parseTaskSettings` 忽略未知键,4xx 会把存量 parked 任务
+     *  砖死)——「运行时比类型宽」这句现在**只对值形成立,对键集不成立**。 */
     settings?: Record<string, unknown>;
     /** [R3] Caller-supplied per-request MCP servers (the TOC client's local `.mcp.json`), aligned to core
      *  `McpServerSpec`. 🔒 honored on any SINGLE-USER deployment (task-mcp.ts `mcpInjectionHonored` = `requirePrincipal!==true`)

package/dist/leader/diffout.js

@@ -1,3 +1,4 @@
+import { redactHead } from "../observability/run-terminal-log.js";
 export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;
@@ -44,7 +45,7 @@ export async function pullDiff(env, baseSha, opts = {}) {
         return { ok: false, truncated: true, error: "stream ended without an exit chunk (truncated or aborted)" };
     }
     if (exitCode !== 0) {
-        return { ok: false, exitCode, error: `git format-patch exited ${exitCode}: ${stderr.slice(0, 500).trim()}` };
+        return { ok: false, exitCode, error: `git format-patch exited ${exitCode}: ${redactHead(stderr, 500).trim()}` };
     }
     if (patch.trim() === "") {
         return { ok: false, exitCode, error: `empty diff: no commits in ${baseSha}..${ref} (worker produced nothing)` };