@sema-agent/server 7.76.0 → 7.76.1

package/dist/http/routes/approvals-assistant.js

@@ -5,7 +5,7 @@ import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugi
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
-import { verifyDirectDoorProof } from "../../principal-jwt.js";
+import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
@@ -352,6 +352,10 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 400, "request.field_conflict", "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)");
                 return;
             }
+            if (decision === "edit" && !isWellFormedUnicode(body.editedPlan)) {
+                sendError(res, 400, "request.field_invalid", "editedPlan must be well-formed Unicode text (a lone surrogate cannot be signed unambiguously)");
+                return;
+            }
             if (decision !== "edit" && body.editedPlan !== undefined) {
                 sendError(res, 400, "request.field_conflict", `editedPlan is only valid with decision 'edit' (got '${decision}')`);
                 return;
@@ -399,7 +403,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 const storeNowMs = await store.nowMs();
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;

package/dist/plugins/tidb-session-storage.d.ts

@@ -1,5 +1,9 @@
 import { BaseSessionStorage, type PromptEpochDescriptor, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
+export declare const SESSION_EVENT_LATEST_BY_TYPE_SQL: {
+    readonly floor: "SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ payload FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1";
+    readonly epochAnchor: "SELECT /*+ USE_INDEX(session_event, idx_session_event_type) */ seq, payload FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100";
+};
 /**
  * TiDB-backed {@link BaseSessionStorage} — the durable L1 event log for one session.
  *

package/dist/plugins/tidb-session-storage.js

@@ -3,6 +3,11 @@ import { BaseSessionStorage, SessionError, leafIdAfterEntry, normalizePromptEpoc
 import { toIso } from "./sql-row-helpers.js";
 import { isMysqlDupKeyError } from "./sql-errors.js";
 import { PLACEMENT_SELECT_COLUMNS, placementFromRow } from "./session-placement.js";
+const SESSION_EVENT_BY_TYPE_HINT = "/*+ USE_INDEX(session_event, idx_session_event_type) */";
+export const SESSION_EVENT_LATEST_BY_TYPE_SQL = {
+    floor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} payload FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`,
+    epochAnchor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} seq, payload FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`,
+};
 const isDupKey = isMysqlDupKeyError;
 export class TiDBSessionStorage extends BaseSessionStorage {
     pool;
@@ -19,7 +24,7 @@ export class TiDBSessionStorage extends BaseSessionStorage {
             return undefined;
         let cursor = this.floorSeq;
         for (;;) {
-            const [rows] = await this.pool.query("SELECT seq, payload FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100", [this.sessionId, cursor]);
+            const [rows] = await this.pool.query(SESSION_EVENT_LATEST_BY_TYPE_SQL.epochAnchor, [this.sessionId, cursor]);
             if (rows.length === 0)
                 return undefined;
             for (const r of rows) {
@@ -44,7 +49,7 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         return new TiDBSessionStorage(pool, sessionId, metadata, entries, meta.leaf_id ?? null, floorEntryId, floorSeq);
     }
     static async computeFloor(pool, sessionId) {
-        const [compRows] = await pool.query("SELECT payload FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1", [sessionId]);
+        const [compRows] = await pool.query(SESSION_EVENT_LATEST_BY_TYPE_SQL.floor, [sessionId]);
         if (!compRows[0])
             return { floorEntryId: null, floorSeq: 0 };
         const comp = (typeof compRows[0].payload === "string" ? JSON.parse(compRows[0].payload) : compRows[0].payload);

package/dist/principal-jwt.d.ts

@@ -30,6 +30,23 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
 /** The channel-binding value a direct client's principal JWT must carry in `cnf.bnd`: the hex SHA-256 of the
  *  CLIENT-VISIBLE action identity (sessionId + boundCallId + boundInputHash — NOT the unexposed checkpointToken).
  *  Binds the identity assertion to THIS specific suspended action so a captured JWT cannot be lifted onto another. */
+/**
+ * 直连门信封**第三槽**的 plan_review 半场:**决定所作用内容的哈希**。
+ *
+ * 第三槽在两种门上是**同一条规则**「这份决定作用在哪份内容上」:动作门填被批工具调用的 `boundInputHash`
+ * (core 铸);非动作门 `plan_review` 的 `edit` 填**修订后的计划**的哈希(计划随本次请求一起提交,签名器手上
+ * 就有原文),`approve` / `reject` 不作用于任何新内容 ⇒ null。B-121(test 黑盒发现,验真后修):此前 edit 也填
+ * null,于是为「只改 README」签出的证明可以拿去提交任意 `editedPlan`——签名只护住了 decision/reason,没护住
+ * 决定真正落地的那份内容。`cnf.bnd` 与 HMAC 都吃第三槽,所以 JWT 与信封同时绑住它;不匹配 ⇒
+ * `401 principal_unbound`(既有码,cnf.bnd 不符)。旧注记「计划哈希被拒」说的是 approve(worker 没有可哈希的
+ * 原文),不覆盖 edit。
+ *
+ * 形:`sha256(utf8(editedPlan))` hex —— 与 `approvalBnd` 同摘要、同编码;逐字节,不归一化(签名器与 worker
+ * 必须对同一串字节达成一致,任何"归一化"都是第二个写者)。
+ */
+/** 良构 Unicode(无孤立代理项)。`u` 旗下配对代理项是一个码点、不匹配 `\p{Surrogate}`;只有孤立的才命中。 */
+export declare function isWellFormedUnicode(s: string): boolean;
+export declare function editedPlanBinding(editedPlan: string): string;
 export declare function approvalBnd(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -81,9 +98,12 @@ export type DirectDoorProofResult = {
  * SPECIFIC (a pending TOOL call). A NON-ACTION gate — `plan_review` (and any review-pause) — `binds NO action`
  * (core checkpoint-store.ts: pendingAction `{kind:"plan_review"}`, editedPlan is a typed sibling that binds no
  * action), so the proof correctly DEGRADES to "verify WHO": JWT identity + cnf.bnd channel-binding + the HMAC over
- * {sessionId, decision} (bound fields null) — WITHOUT requiring a boundInputHash. Pass `actionBinding:false` for a
- * non-action gate; the default (true) keeps the /decide tool-approval contract byte-identical. Binding the decision
- * to a plan HASH was REJECTED (the plan artifact lives in a profile ref store; the worker has no TOCTOU original).
+ * {sessionId, nonce, <content hash>, decision, reason}. Pass `actionBinding:false` for a non-action gate; the default
+ * (true) keeps the /decide tool-approval contract byte-identical. The THIRD slot carries one rule on both gates —
+ * "the content this decision acts on": the bound tool input for /decide, `editedPlanBinding(editedPlan)` for a
+ * plan_review `edit` (B-121), null for approve/reject. Binding approve/reject to a hash of the EXISTING plan was
+ * rejected (the plan artifact lives in a profile ref store; the worker has no TOCTOU original) — that ruling never
+ * covered `edit`, whose content arrives with the request.
  */
 export declare function verifyDirectDoorProof(proof: {
     jwt?: string;

package/dist/principal-jwt.js

@@ -72,6 +72,14 @@ export function verifyPrincipalJwt(token, keys, expect) {
     const bnd = typeof payload.cnf?.bnd === "string" ? payload.cnf.bnd : undefined;
     return { sub: payload.sub, bnd, acceptedBeforeMs: (Math.floor(payload.exp + skew) + 1) * 1000 };
 }
+export function isWellFormedUnicode(s) {
+    return !/\p{Surrogate}/u.test(s);
+}
+export function editedPlanBinding(editedPlan) {
+    if (!isWellFormedUnicode(editedPlan))
+        throw new Error("editedPlanBinding: editedPlan is not well-formed Unicode (lone surrogate) — utf8 hashing would be lossy");
+    return createHash("sha256").update(editedPlan, "utf8").digest("hex");
+}
 export function approvalBnd(env) {
     return createHash("sha256").update(JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null])).digest("hex");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.76.0",
+  "version": "7.76.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.6",
+    "@sema-agent/core": "7.17.7",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",