@sema-agent/server 7.56.0 → 7.58.0

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -521,7 +521,8 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
             model: m.id,
             value: String(act),
             contextWindow: String(window),
-            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window, so a value above the physical window means autocompaction effectively never fires and the destructive context guard truncates history instead (the opposite of what this knob is for). The value is applied as configured (not clamped, not rejected); lower it below the window — CC's own shape is window-33000.`,
+            clampedTo: String(window),
+            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window and CLAMPS it to the physical window (resolveTriggerWindow), so this knob is a NO-OP here: the trigger geometry falls back to ${window} and core mints one config.autocompact_window_clamped notice per prepare. server neither clamps nor rejects the value (clamping is core's, at the read site); lower it below the window to make the knob do something — CC's own shape is window-33000.`,
         },
     });
 }
@@ -637,8 +638,8 @@ function parseModelDomain() {
         return "gateway";
     })();
     const extraBody = buildExtraBody();
-    const thinkingDefault = (() => { const v = process.env.MODEL_DEFAULT_THINKING; return v && isThinkingLevel(v) && v !== "off" ? v : undefined; })();
-    const effortLevels = (process.env.MODEL_REASONING_EFFORT_LEVELS ?? "").split(",").map((s) => s.trim()).filter((s) => isThinkingLevel(s) && s !== "off");
+    const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
+    const effortLevels = parseReasoningEffortLevels(csv("MODEL_REASONING_EFFORT_LEVELS"));
     const model = {
         id: modelId,
         name: modelId,
@@ -777,6 +778,32 @@ function parseModelDomain() {
             : undefined,
     };
 }
+const THINKING_LEVEL_TABLE = { minimal: true, low: true, medium: true, high: true, xhigh: true, max: true };
+export const THINKING_LEVELS = Object.keys(THINKING_LEVEL_TABLE);
+const isThinkingTier = (w) => THINKING_LEVELS.includes(w);
+function parseDefaultThinking(raw) {
+    const v = raw?.trim();
+    if (v === undefined || v === "")
+        return undefined;
+    if (v === "off")
+        return undefined;
+    if (!isThinkingTier(v)) {
+        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a thinking tier — valid: ${THINKING_LEVELS.join(" | ")} | off ` +
+            `("off" = no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
+    }
+    return v;
+}
+function parseReasoningEffortLevels(words) {
+    if (words.length === 0)
+        return [];
+    const bad = words.filter((w) => !isThinkingTier(w));
+    if (bad.length > 0) {
+        throw new Error(`env MODEL_REASONING_EFFORT_LEVELS has unknown tier(s): ${bad.join(", ")} (valid: ${THINKING_LEVELS.join(" | ")})` +
+            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (no model-level default), it is not an effort tier an endpoint can accept' : ""}. ` +
+            `Bad words used to be dropped SILENTLY, narrowing the declared ladder without a word (#210 A 档).`);
+    }
+    return words.filter(isThinkingTier);
+}
 const DEGRADE_ON_WORDS = new Set(["breaker_open", "rate_limit", "budget", "server_error", "last_resort"]);
 function parseDegradeOn(words) {
     if (words.length === 0)
@@ -853,6 +880,7 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
@@ -866,6 +894,12 @@ function streamApprovalConfig(gates) {
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
         unreachedTtlMs: numEnvBounded("UNREACHED_ASK_TTL_MS", String(60 * 60 * 1000), 60_000, 24 * 60 * 60 * 1000),
     };
+    if (cfg.windowMs < 0) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} must not be negative — 0 means "close the window" (every gated ask goes straight to the unattended outcome and NO approval card is emitted), any positive value is the live-card window in ms. A negative value used to emit a card nobody could ever win.`);
+    }
+    if (cfg.windowMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} exceeds the Node timer ceiling ${MAX_TIMER_DELAY_MS} (2^31-1 ms ≈ 24.8 days) — setTimeout SILENTLY collapses a larger delay to 1ms, so the window you meant to lengthen would expire immediately and every gated ask would take the unattended route on the next tick. Pick a window at or below the ceiling (and remember STREAM_ASK_WINDOW_MS + STREAM_APPROVAL_ADHOC_GRACE_MS must stay strictly below STREAM_APPROVAL_ORPHAN_TTL_MS).`);
+    }
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
@@ -945,6 +979,7 @@ function parseApprovalDomain(ctx) {
                 `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
+        permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
         mcpElicitation: {
             enabled: boolEnv("MCP_ELICITATION_ENABLED", false),
             throttle: {
@@ -1757,7 +1792,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "manualModeShellGate",
+    "sensitiveWritePatterns", "manualModeShellGate", "permissionsDisableAutoMode",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/hooks/hook-runner.js

@@ -673,7 +673,7 @@ async function runObserveOnlyEvent(event, groups, matchValue, payload, ctx, once
         if (!out)
             continue;
         if (typeof out.systemMessage === "string")
-            ctx.logger.warn("hook_system_message", { event, message: clip(out.systemMessage, 500) });
+            ctx.logger.info("hook_system_message", { event, message: clip(out.systemMessage, 500) });
         if (out.decision !== undefined || out.continue === false || out.hookSpecificOutput !== undefined) {
             ctx.logger.warn("hook_result_unsupported", { event });
         }
@@ -747,7 +747,7 @@ export function createTaskHooks(config, ctx) {
                     if (!out)
                         continue;
                     if (typeof out.systemMessage === "string")
-                        ctx.logger.warn("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
+                        ctx.logger.info("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
                     if (out.continue === false) {
                         const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                         return { action: "deny", message: reason, ...buildHookContextField(contexts) };
@@ -845,7 +845,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUse" });
                 }
@@ -895,7 +895,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUseFailure" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -942,7 +942,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolBatch" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -974,7 +974,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                     return { block: reason, ...buildHookContextField(contexts) };
@@ -1063,7 +1063,7 @@ export function createTaskHooks(config, ctx) {
                     continue;
                 }
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     sawContinueFalse = true;
                 if (out.decision === "block" && block === undefined) {
@@ -1122,7 +1122,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PreCompact" });
                 }

package/dist/http/route-ctx.d.ts

@@ -47,6 +47,24 @@ export interface RouteHelpers {
     rateLimited(req: IncomingMessage, res: ServerResponse): boolean;
     quotaExceeded(req: IncomingMessage, res: ServerResponse): boolean;
     leaseDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    /**
+     * 🔴 **[ref]:按**付费**方(不是请求方)判的成本配额准入 —— {@link quotaExceeded} 的孪生。**
+     *
+     * `quotaExceeded` 键在 `gatedPrincipal(req)` = 谁点的按钮;本门键在**这笔钱记谁的账**。两者在自助
+     * 场景恒相等,在「显式 operator 代别人动手」的场景不等 —— 那正是配额上限被绕过的那一支。
+     * 参数 `owner` 由调用点从**已属主校验过的那一行**取(run 行的 `owner` / checkpoint 的 scope),
+     * 本门不自己推身份(推得出来就说明调用点还有第二个身份源,那才是病)。
+     * `undefined`(匿名/开放行)⇒ 无付费方 ⇒ 不 gated,与 `quotaExceeded` 的成文语义同判。
+     * 拒 = 429 + `Retry-After`,码/文案/extras 与 `quotaExceeded` 逐字同一套。
+     * 位序纪律:**必须排在本路由的 owner 门之后**(反枚举 —— 否则 429 会变成「这行存在且它属主超顶了」
+     * 的谕示);且排在真正驱动模型之前。
+     */
+    ownerQuotaDenied(res: ServerResponse, owner: string | undefined): boolean;
+    /** 🔴 **[ref]:{@link ownerQuotaDenied} 的 lease 孪生 —— 按**付费**方判的 fleet-lease 准入。**
+     *  `leaseDenied` 键在请求方;本门键在付费方(`driveResumeLeg` 的 `fleetLease.admit(卡属主)` 早就是这个
+     *  语义,本位把它交给路由域)。两门在自助场景恒同答,在「operator 代别人动手」时不同 —— 那正是
+     *  「拿自己的额度去烧别人的账」的那一支。同样必须排在 owner 门之后、驱动之前。 */
+    ownerLeaseDenied(res: ServerResponse, owner: string | undefined): Promise<boolean>;
     /** [ref]-T1:治理窗 pre-admission(异步 202 车道的唯一 429 出路;key 公式与 core 单源)。 */
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
@@ -79,6 +97,17 @@ export interface RouteRequestState {
     streamDetached: boolean;
     /** 凭证派生的调用方系统身份(`source`)。handle() 的鉴权门是**唯一**赋值点,域模块只读。 */
     source: string | null;
+    /**
+     * [ref] 件2(cli [ref] sema-bug4 (c)):本请求驱动的那条 run 的**终局**(`completed` / `failed` /
+     * `suspended` / …)与结构化失败码。`handle()` 的 `request` 日志行读它 —— 让「端点 200 ≠ 模型成功」
+     * 这条歧义消失(取证:模型 connect timeout 的那一刻,日志里唯一的行是 `request status:200`)。
+     *
+     * 赋值点在 `routes/tasks.ts`(`/v1/tasks` 与 `/v1/tasks/stream` 两腿的终局到手处);拿不到 run 结果
+     * (受理即拒 / 幂等重放 / 非任务端点)⇒ **键缺席**,绝不写 null —— 缺席 = 「这条请求没驱动 run」,
+     * 与「run 结果不明」是两句话,而 `null` 会把两者压成一个形。
+     */
+    runStatus?: string;
+    runErrorCode?: string;
 }
 /** B4①(命名化):`prepareSpec` 的返回形(tasks.ts/runs.ts 两域共同消费的属性面)——原为 6 成员内联匿名对象。
  *  命名后好处不只是过 B4 门:两个消费域现在都能对同一个符号做 `import type` 标注,而不是各自重推断结构。 */
@@ -141,6 +170,52 @@ export interface DriveResumeArgs {
      *  **唯一不设此位的**是内部 D-D SLA deny-sweep:它没有在等响应的人,提前受理对它零收益,而且那条
      *  循环靠 `await` 串行给每 tick 的重活限流(见其调用处的登记注)。 */
     acceptEarly?: boolean;
+    /**
+     * 🔴 **[ref](codex 交叉复审 r2-[medium] 验真后修):这条腿是**调用方发起**的吗?**
+     *
+     * `true` = 有人在 HTTP 上点了按钮(resume / plan_review / wake / decide / 赎回席)⇒ 吃按**付费方**
+     * (卡属主)判的成本配额准入(`ownerCostQuotaDenied`)。缺席/`false` = **部署自己的结算腿**
+     * (内部 D-D SLA deny-sweep)⇒ **不吃**那道门。
+     *
+     * 为什么系统腿必须豁免(亲核后改的判据,首版曾一并拦下 sweep):sweep 的活是把过了 SLA 的卡**结算掉**
+     * (graceful deny → 行收敛 → 释放 `task_active` claim)。拦住它并不能省钱,只会让超顶租户的卡**挂着**
+     * —— 而挂多久的兜底**比首版注释里写的差得多**:`checkpoint-store-sql.ts` 的 `reapExpired` 在
+     * **deadline 分支**上逐字排除了 `APPROVAL_GATE_KINDS`(`gate_kind NOT IN (…) OR tool_name='AskUserQuestion'`),
+     * 所以一张过期的 human / irreversible_ask 卡根本不走那条腿;真正兜住它的只有绝对 backstop
+     * `terminal_at_ms`(`TERMINAL_BACKSTOP_MS` 默认 **30 天**)。于是「拦 sweep」= 把一个由
+     * `APPROVAL_TIMEOUT_SEC` 界定的 SLA 换成「等成本窗滚过(`COST_QUOTA_WINDOW_SEC` 默认 24h)、最坏等 30 天」,
+     * 并且整段时间攥着会话 claim。**方向也自洽**:deny 是**停下**这条 run 的动作,为了省钱而拒绝执行「停」
+     * 与 preempt 路由早就成文的那句同一条(「否则超顶租户连自己的花费都停不下来」)。
+     *
+     * 判别子取 `req` 的在场与否 —— 这在 `resumeCheckpoint` 里**已经是**「系统腿 vs 调用方腿」的既有判据
+     * (绑定强制、parked 分流两处都写着 `req !== undefined` 与「内部 D-D SLA deny-sweep(req 缺席)豁免」),
+     * 本位只是把同一条判据显式化成一个有名字的位,而不是让下游去猜。
+     * ⚠️ **射程覆盖两道门**:紧邻的 fleet-lease 准入(`ownerFleetLeaseDenied`)读**同一位** —— [ref] 件⑤②
+     * (codex r3-[high])把它一并改吃了 `callerInitiated`,理由与三问逐字同 cost 半场。
+     * 🔴 本句是 [ref] R4 改写的(2026-09-03,7.57.0 发车前合并重扫 wf_1abaaa9a):此处原文写着「紧邻的
+     * fleet-lease 准入**没有**这条豁免(对 sweep 一视同仁),本批不动它,分歧已登记为遗留」—— 那是**同一批
+     * 件⑤② 落地之前**的话,件⑤② 修好后这条 JSDoc 没跟着改,于是注释与代码正相反(亲读
+     * `server.ts` 的 `ownerFleetLeaseDenied` 消费点:两处都是 `args.callerInitiated === true` /
+     * `req !== undefined`)。两道门在这一位上**无分歧**,[ref] 上也没有这一项。
+     */
+    callerInitiated?: boolean;
+    /**
+     * 🔴 **[ref] codex 对抗复审 r1-F3 [medium](验真后修):本次请求的属主 lease 准入**已经做过了**。**
+     *
+     * `resumeCheckpoint` 在 parked 子代赎回分流**之前**先判一次属主 lease([ref] R3:那条腿提前 `return`,
+     * 结构上够不到 `driveResumeLeg` 的同一道门)。分流**未命中**时请求落回 legacy 腿,于是同一条请求、
+     * 同一个付费方会向 center 协商**两次**。cost 半场可以「过两次门」(本地同步、纯读);lease 半场**不行**:
+     * `FleetLeaseManager.admit` 的五条 fail-open 路径(center 不可达 / 5xx / 超时 / 401-403 / 畸形响应)
+     * 一律**不写缓存态**(亲读 `fleet-lease.ts` 的 `issueOrRenewInner`),而 single-flight 只合并**并发**调用 ——
+     * 两道门是串行的 ⇒ 半开 center 下一个请求连吃两次 `LEASE_FETCH_TIMEOUT_MS`,持续故障时整条 legacy
+     * resume 车道把控制面负载翻倍。
+     *
+     * 所以由上游把「已受理」这个事实传下来,`driveResumeLeg` 据此跳过重复协商。**安全性**:两处的键是
+     * **同一个表达式**(`decodeCheckpointScope(cp.scope)`,上游门与下游 `auth.principal` 同源),射程条件也
+     * 同一条(`req !== undefined` ⇔ `callerInitiated`)⇒ 跳过的是一次**逐字相同**的判定,不是一道门。
+     * 缺席/`false` ⇒ 照常自己判(其余三条驱动腿与 sweep 一字不变)。
+     */
+    ownerLeaseAdmitted?: boolean;
 }
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用

package/dist/http/routes/a2a-serve.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
+import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
-import { isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError } from "../send.js";
@@ -80,10 +81,11 @@ function statusTextForRun(run, state) {
         return "this task is suspended awaiting an approval decision on the serving deployment; it resumes once that decision is made";
     if (run.result?.result)
         return run.result.result;
+    const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
-        return run.error;
+        return memo("error", run.error);
     if (run.result?.errorMessage)
-        return run.result.errorMessage;
+        return memo("errorMessage", run.result.errorMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {

package/dist/http/routes/approvals-assistant.js

@@ -107,6 +107,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 : (principal ?? "__none__");
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
+                serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
@@ -520,9 +521,20 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
 const APPROVALS_STREAM_POLL_MS = 3000;
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
-    if (rd === null || rd === undefined || typeof rd.shadowedRule !== "string")
+    if (rd === null || rd === undefined)
         return row;
-    return { ...row, riskDescriptor: { ...rd, shadowedRule: redactSecrets(rd.shadowedRule) } };
+    const shadowedRule = typeof rd.shadowedRule === "string" ? redactSecrets(rd.shadowedRule) : undefined;
+    const summary = typeof rd.summary === "string" ? redactSecrets(rd.summary) : undefined;
+    if (shadowedRule === undefined && summary === undefined)
+        return row;
+    return {
+        ...row,
+        riskDescriptor: {
+            ...rd,
+            ...(shadowedRule !== undefined ? { shadowedRule } : {}),
+            ...(summary !== undefined ? { summary } : {}),
+        },
+    };
 }
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);
@@ -553,19 +565,20 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
         }
         const cur = new Map(pending.map((p) => [keyOf(p), p]));
         const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
+        const pendingFrame = (k) => JSON.stringify({ type: "pending", ...cur.get(k), serverNowMs: Date.now() });
         if (first) {
-            for (const frame of curFrames.values())
-                res.write(`event: pending\ndata: ${frame}\n\n`);
+            for (const k of curFrames.keys())
+                res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
         else {
             for (const [k, frame] of curFrames)
                 if (prevFrames.get(k) !== frame)
-                    res.write(`event: pending\ndata: ${frame}\n\n`);
+                    res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             for (const [k, p] of prev)
                 if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`);
+                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: Date.now() })}\n\n`);
         }
         prev = cur;
         prevFrames = curFrames;

package/dist/http/routes/capabilities.js

@@ -9,8 +9,10 @@ import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
-import { workflowModelAllowlistFor } from "../../task-workflow.js";
+import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
+import { judgeAutoModeArming } from "../../auto-mode-face.js";
+import { coercePermissionModeStrict } from "../../task-settings.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
@@ -43,6 +45,18 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
         return;
     }
     if (req.method === "GET" && url === "/v1/capabilities") {
+        const workflowsEngineCan = deps.workflowsCapable ?? Boolean(deps.workflowRunStore);
+        const workflowsDenial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
+        const requestedModeRaw = new URL(req.url ?? "", "http://x").searchParams.get("permissionMode");
+        const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
+        if (requestedModeRaw !== null && requestedMode === undefined) {
+            sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+            return;
+        }
+        const entitlementSource = centerEntitlementSourceWired(deps.config);
+        const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), entitlementSource, localDeny: deps.config.permissionsDisableAutoMode });
+        if (autoModeFault !== undefined)
+            deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
         sendJson(res, 200, {
             ...deps.capabilities,
             asyncRuns: Boolean(deps.runStore),
@@ -92,8 +106,10 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             modeShellGateTranslation: true,
             permissionModeAuto: {
                 accepted: true,
-                classifierSeat: true,
-                entitlementSource: centerEntitlementSourceWired(deps.config),
+                classifierSeat: deps.autoModeFace?.seatMounted === true,
+                entitlementSource,
+                intentArming: deps.autoModeFace?.engineArmsOnIntent === true,
+                ...autoMode,
             },
             readFace: deps.config.readFace ?? null,
             appendSystemPrompt: true,
@@ -141,8 +157,9 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             sendUserFileLedger: Boolean(deps.sendFileLedger),
-            workflows: deps.workflowsCapable ?? Boolean(deps.workflowRunStore),
+            workflows: workflowsEngineCan && workflowsDenial === null,
             workflowsList: Boolean(deps.workflowRunStore),
+            workflowsGate: { engineCan: workflowsEngineCan, denial: workflowsDenial },
             workflowModels: (() => {
                 const allow = deps.workflowModelAllowlist
                     ?? workflowModelAllowlistFor({

package/dist/http/routes/memory-origin.d.ts

@@ -99,7 +99,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "failed" | "done";
+        to: "done" | "failed";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -107,7 +107,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "failed" | "done";
+    status: "pending" | "done" | "failed";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/http/routes/rules.js

@@ -6,6 +6,7 @@ import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, seri
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
 import { MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
+import { PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -45,8 +46,8 @@ const LocalImportRowSchema = z
     .object({
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
-    tool: z.literal("Bash"),
-    match: z.enum(["exact", "prefix"]),
+    tool: z.enum(PERSISTED_RULE_TOOLS),
+    match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
 })

package/dist/http/routes/runs.d.ts

@@ -1,17 +1,3 @@
-/**
- * [ref] A9 域模块 —— 异步 run 面与它的全部动词。
- *
- * 路由:`POST /v1/runs`(异步提交)· `GET /v1/runs/:id[/events]`(轮询 / 可恢复 SSE)· 运行期动词
- * `cancel` / `steer` / `compact` / `detach` · 子代理面 `subagents/:target/{steer,resume,output,stream}` ·
- * 通用任务句柄 `tasks/:handle/{output,stop}` · 三条 HITL 应答口 `elicitations|questions|tool-approvals/:id/respond`。
- *
- * 两段搬运:提交+run 级动词一段,子代理/任务句柄/HITL 应答一段——它们在 `handle()` 里原本被 SVC-5 的
- * workflow steer 隔开,拆分保持各自位置(本文件里的先后只是同域归并)。`POST /v1/runs` 与 tasks 域共用
- * `ctx.legs.prepareSpec`(同一条读体/校验/建 spec 的前段)。
- *
- * 可变状态全部来自跨域 registry(`idemCache` 幂等、`inflightRuns`/`preemptableRuns` 中止句柄、
- * `cancelledViaVerb` first-writer-wins 判别、`steerableRuns` 活流句柄、`wakeParkMints` park 铸造闩)。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission } from "../route-ctx.js";

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -22,10 +23,12 @@ import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
+import { buildCancelContext } from "../../run-cancel-context.js";
 import { buildCrossSliceUsage, readResourceWindow, recordResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
+import { withPrincipal } from "../../observability/principal-context.js";
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
 export const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;
 export const RUN_STEER_RE = /^\/v1\/runs\/([^/]+)\/steer$/;
@@ -136,7 +139,10 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         retainedFrom: (id) => runStore.retainedFrom(id),
         formatEvent: (ev) => {
             const type = normalizeRunEventType(ev.type);
-            return { id: ev.seq, event: type, data: { type, ...(ev.data ?? {}) } };
+            const data = type === "done" && ev.data && typeof ev.data === "object" && ev.data.result && typeof ev.data.result === "object"
+                ? { ...ev.data, result: memoRedactTerminalResult("ev.done.result", ev.data.result) }
+                : type === "failed" ? memoRedactedRead("ev.failed", ev.data, (d) => redactLedgerEventData(type, d)) : redactLedgerEventData(type, ev.data);
+            return { id: ev.seq, event: type, data: { type, ...(data ?? {}) } };
         },
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
@@ -251,11 +257,11 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 status: stale ? "failed" : run.status,
                 ...(lastActivityAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastActivityAt) } : {}),
                 ...(crossSliceUsage !== undefined ? { crossSliceUsage } : {}),
-                result: run.result ?? undefined,
+                result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : redactTerminalResult(run.result ?? undefined),
                 supervisorCost,
                 suggestions,
                 errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
-                error: stale ? "run stalled (instance lost?)" : run.error ?? undefined,
+                error: stale ? "run stalled (instance lost?)" : isTerminalRunStatus(run.status) ? memoRedactedRead("run.error", run.error ?? undefined, redactErrorMessage) : redactErrorMessage(run.error ?? undefined),
                 jobId: run.jobId ?? undefined,
                 source: run.source ?? undefined,
             });
@@ -324,7 +330,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             }
             const err = note;
             try {
-                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 } };
+                const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
+                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -870,7 +877,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             deps.logger?.[level]?.("manual_compact_outcome", { taskId, outcome, note: outcome === "compacted" ? "a compacted{trigger:'manual'} event rode the run stream" : `no event (see compaction.${outcome === "mooted" ? "mooted" : outcome} trace / task terminal events)` });
         }, (e) => {
             if (e.code !== "steering.not_running") {
-                deps.logger?.warn?.("manual_compact_failed", { taskId, err: e instanceof Error ? e.message : String(e) });
+                deps.logger?.warn?.("manual_compact_failed", { taskId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
             }
             else {
                 deps.logger?.info?.("manual_compact_not_running", { taskId, note: "stream settled between lookup and compact() — benign unless systematic" });
@@ -934,7 +941,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
 }
 async function handleRunVerbsBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
     const subOutputMatch = req.method === "GET" ? RUN_SUBAGENT_OUTPUT_RE.exec(url) : null;
     if (subOutputMatch) {
         if (!deps.runStore || !deps.subagentTaskOutput) {
@@ -1159,7 +1166,12 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
                         send409("resume.retain_off", "the parent run did not retain sub-agent sessions (set retainSubagentSessions on the run to enable revival)");
                         return;
                     }
-                    const marker = await handle.resume(redacted);
+                    if (ownerQuotaDenied(res, run.owner ?? undefined))
+                        return;
+                    if (await ownerLeaseDenied(res, run.owner ?? undefined))
+                        return;
+                    const resumeFn = handle.resume;
+                    const marker = await withPrincipal(run.owner ?? undefined, () => resumeFn(redacted));
                     sendJson(res, 200, { taskId: runId, target, status: "running", delivery: "applied", marker, note: `Message queued for delivery to ${handle.agentName ?? target}; it will continue in the background.` });
                     return;
                 }
@@ -1593,7 +1605,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
                     backend: deps.backend,
                     parkFacility: deps.checkpointStore !== undefined,
                 }).active,
-                windowMs: deps.config.streamApproval?.windowMs ?? 0,
+                windowMs: deps.config.streamApproval?.windowMs,
                 windowMarginMs: deps.config.streamAskWindowMarginMs,
             }
             : undefined, deps.checkpointStore);